86cdb7867dc7e6d5b286e8f015da56b66faba6e5b21490c9d3db5b13ee9f3a31

Analysis

max time kernel
150s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/09/2026, 10:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__8e5ed68cdb51ef9b042f480126ff5430.exe
Size 48KB
Sample260919-m2kasaed55
SHA256 86cdb7867dc7e6d5b286e8f015da56b66faba6e5b21490c9d3db5b13ee9f3a31
MD5 8e5ed68cdb51ef9b042f480126ff5430
SHA1 fdbcfa06003477312a42714b7d4e1b24a2f10821
SHA512 7948e01fc17740804ebc593ce968d4167aa73a289b71185487f6751c59a10a6a8f34ac0da7d6e497caa7ee164db372bc2c6119c4ad79ecf040a752e505b7f6b8
SSDEEP 384:pVJ0qsMkhT/SGp/R//D8xfvwicc2ZABWrdhWQylgePf+cMd4tliUN+l9BjqT1y:pT0b/SqR/cnuTZNRc7LH8ZjqT1
TLSH
T1F9236B6E379C4AF1C4B4CAB0B5299311E87F2C75AC6A9132D3903C4475B9843EF28B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	jaffacakes118__8e5ed68cdb51ef9b042f480126ff5430.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe

Executes dropped EXE 64 IoCs

pid	Process
4532	winbery.exe
1488	winbery.exe
2532	winbery.exe
2064	winbery.exe
4816	winbery.exe
3052	winbery.exe
2292	winbery.exe
2060	winbery.exe
1692	winbery.exe
2404	winbery.exe
2036	winbery.exe
3956	winbery.exe
224	winbery.exe
2148	winbery.exe
4564	winbery.exe
4412	winbery.exe
2000	winbery.exe
4000	winbery.exe
944	winbery.exe
3132	winbery.exe
3008	winbery.exe
3292	winbery.exe
2788	winbery.exe
4228	winbery.exe
1560	winbery.exe
4488	winbery.exe
4712	winbery.exe
3164	winbery.exe
4808	winbery.exe
2672	winbery.exe
4892	winbery.exe
2384	winbery.exe
2400	winbery.exe
548	winbery.exe
4676	winbery.exe
3312	winbery.exe
4332	winbery.exe
5096	winbery.exe
564	winbery.exe
2600	winbery.exe
4684	winbery.exe
2692	winbery.exe
3972	winbery.exe
3572	winbery.exe
4720	winbery.exe
3536	winbery.exe
2792	winbery.exe
4796	winbery.exe
1716	winbery.exe
4872	winbery.exe
3364	winbery.exe
1800	winbery.exe
1520	winbery.exe
1752	winbery.exe
1224	winbery.exe
5036	winbery.exe
5012	winbery.exe
3016	winbery.exe
692	winbery.exe
4664	winbery.exe
4496	winbery.exe
4948	winbery.exe
4232	winbery.exe
4524	winbery.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2676	jaffacakes118__8e5ed68cdb51ef9b042f480126ff5430.exe
2676	jaffacakes118__8e5ed68cdb51ef9b042f480126ff5430.exe
4532	winbery.exe
4532	winbery.exe
4532	winbery.exe
4532	winbery.exe
1488	winbery.exe
1488	winbery.exe
1488	winbery.exe
1488	winbery.exe
2532	winbery.exe
2532	winbery.exe
2532	winbery.exe
2532	winbery.exe
2064	winbery.exe
2064	winbery.exe
2064	winbery.exe
2064	winbery.exe
4816	winbery.exe
4816	winbery.exe
4816	winbery.exe
4816	winbery.exe
3052	winbery.exe
3052	winbery.exe
3052	winbery.exe
3052	winbery.exe
2292	winbery.exe
2292	winbery.exe
2292	winbery.exe
2292	winbery.exe
2060	winbery.exe
2060	winbery.exe
2060	winbery.exe
2060	winbery.exe
1692	winbery.exe
1692	winbery.exe
1692	winbery.exe
1692	winbery.exe
2404	winbery.exe
2404	winbery.exe
2404	winbery.exe
2404	winbery.exe
2036	winbery.exe
2036	winbery.exe
2036	winbery.exe
2036	winbery.exe
3956	winbery.exe
3956	winbery.exe
3956	winbery.exe
3956	winbery.exe
224	winbery.exe
224	winbery.exe
224	winbery.exe
224	winbery.exe
2148	winbery.exe
2148	winbery.exe
2148	winbery.exe
2148	winbery.exe
4564	winbery.exe
4564	winbery.exe
4564	winbery.exe
4564	winbery.exe
4412	winbery.exe
4412	winbery.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2676	jaffacakes118__8e5ed68cdb51ef9b042f480126ff5430.exe
Token: SeDebugPrivilege	4532	winbery.exe
Token: SeDebugPrivilege	1488	winbery.exe
Token: SeDebugPrivilege	2532	winbery.exe
Token: SeDebugPrivilege	2064	winbery.exe
Token: SeDebugPrivilege	4816	winbery.exe
Token: SeDebugPrivilege	3052	winbery.exe
Token: SeDebugPrivilege	2292	winbery.exe
Token: SeDebugPrivilege	2060	winbery.exe
Token: SeDebugPrivilege	1692	winbery.exe
Token: SeDebugPrivilege	2404	winbery.exe
Token: SeDebugPrivilege	2036	winbery.exe
Token: SeDebugPrivilege	3956	winbery.exe
Token: SeDebugPrivilege	224	winbery.exe
Token: SeDebugPrivilege	2148	winbery.exe
Token: SeDebugPrivilege	4564	winbery.exe
Token: SeDebugPrivilege	4412	winbery.exe
Token: SeDebugPrivilege	2000	winbery.exe
Token: SeDebugPrivilege	4000	winbery.exe
Token: SeDebugPrivilege	944	winbery.exe
Token: SeDebugPrivilege	3132	winbery.exe
Token: SeDebugPrivilege	3008	winbery.exe
Token: SeDebugPrivilege	3292	winbery.exe
Token: SeDebugPrivilege	2788	winbery.exe
Token: SeDebugPrivilege	4228	winbery.exe
Token: SeDebugPrivilege	1560	winbery.exe
Token: SeDebugPrivilege	4488	winbery.exe
Token: SeDebugPrivilege	4712	winbery.exe
Token: SeDebugPrivilege	3164	winbery.exe
Token: SeDebugPrivilege	4808	winbery.exe
Token: SeDebugPrivilege	2672	winbery.exe
Token: SeDebugPrivilege	4892	winbery.exe
Token: SeDebugPrivilege	2384	winbery.exe
Token: SeDebugPrivilege	2400	winbery.exe
Token: SeDebugPrivilege	548	winbery.exe
Token: SeDebugPrivilege	4676	winbery.exe
Token: SeDebugPrivilege	3312	winbery.exe
Token: SeDebugPrivilege	4332	winbery.exe
Token: SeDebugPrivilege	5096	winbery.exe
Token: SeDebugPrivilege	564	winbery.exe
Token: SeDebugPrivilege	2600	winbery.exe
Token: SeDebugPrivilege	4684	winbery.exe
Token: SeDebugPrivilege	2692	winbery.exe
Token: SeDebugPrivilege	3972	winbery.exe
Token: SeDebugPrivilege	3572	winbery.exe
Token: SeDebugPrivilege	4720	winbery.exe
Token: SeDebugPrivilege	3536	winbery.exe
Token: SeDebugPrivilege	2792	winbery.exe
Token: SeDebugPrivilege	4796	winbery.exe
Token: SeDebugPrivilege	1716	winbery.exe
Token: SeDebugPrivilege	4872	winbery.exe
Token: SeDebugPrivilege	3364	winbery.exe
Token: SeDebugPrivilege	1800	winbery.exe
Token: SeDebugPrivilege	1520	winbery.exe
Token: SeDebugPrivilege	1752	winbery.exe
Token: SeDebugPrivilege	1224	winbery.exe
Token: SeDebugPrivilege	5036	winbery.exe
Token: SeDebugPrivilege	5012	winbery.exe
Token: SeDebugPrivilege	3016	winbery.exe
Token: SeDebugPrivilege	692	winbery.exe
Token: SeDebugPrivilege	4664	winbery.exe
Token: SeDebugPrivilege	4496	winbery.exe
Token: SeDebugPrivilege	4948	winbery.exe
Token: SeDebugPrivilege	4232	winbery.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 4532	2676	jaffacakes118__8e5ed68cdb51ef9b042f480126ff5430.exe	88
PID 4532 wrote to memory of 1488	4532	winbery.exe	90
PID 1488 wrote to memory of 2532	1488	winbery.exe	91
PID 2532 wrote to memory of 2064	2532	winbery.exe	92
PID 2064 wrote to memory of 4816	2064	winbery.exe	93
PID 4816 wrote to memory of 3052	4816	winbery.exe	94
PID 3052 wrote to memory of 2292	3052	winbery.exe	95
PID 2292 wrote to memory of 2060	2292	winbery.exe	96
PID 2060 wrote to memory of 1692	2060	winbery.exe	97
PID 1692 wrote to memory of 2404	1692	winbery.exe	98
PID 2404 wrote to memory of 2036	2404	winbery.exe	99
PID 2036 wrote to memory of 3956	2036	winbery.exe	100
PID 3956 wrote to memory of 224	3956	winbery.exe	101
PID 224 wrote to memory of 2148	224	winbery.exe	102
PID 2148 wrote to memory of 4564	2148	winbery.exe	103
PID 4564 wrote to memory of 4412	4564	winbery.exe	104
PID 4412 wrote to memory of 2000	4412	winbery.exe	105
PID 2000 wrote to memory of 4000	2000	winbery.exe	106
PID 4000 wrote to memory of 944	4000	winbery.exe	108
PID 944 wrote to memory of 3132	944	winbery.exe	109
PID 3132 wrote to memory of 3008	3132	winbery.exe	110
PID 3008 wrote to memory of 3292	3008	winbery.exe	113
PID 3292 wrote to memory of 2788	3292	winbery.exe	114
PID 2788 wrote to memory of 4228	2788	winbery.exe	117
PID 4228 wrote to memory of 1560	4228	winbery.exe	118
PID 1560 wrote to memory of 4488	1560	winbery.exe	119
PID 4488 wrote to memory of 4712	4488	winbery.exe	122
PID 4712 wrote to memory of 3164	4712	winbery.exe	123
PID 3164 wrote to memory of 4808	3164	winbery.exe	125
PID 4808 wrote to memory of 2672	4808	winbery.exe	126
PID 2672 wrote to memory of 4892	2672	winbery.exe	127
PID 4892 wrote to memory of 2384	4892	winbery.exe	128
PID 2384 wrote to memory of 2400	2384	winbery.exe	129
PID 2400 wrote to memory of 548	2400	winbery.exe	131
PID 548 wrote to memory of 4676	548	winbery.exe	134
PID 4676 wrote to memory of 3312	4676	winbery.exe	135
PID 3312 wrote to memory of 4332	3312	winbery.exe	136
PID 4332 wrote to memory of 5096	4332	winbery.exe	137
PID 5096 wrote to memory of 564	5096	winbery.exe	138
PID 564 wrote to memory of 2600	564	winbery.exe	139
PID 2600 wrote to memory of 4684	2600	winbery.exe	140
PID 4684 wrote to memory of 2692	4684	winbery.exe	141
PID 2692 wrote to memory of 3972	2692	winbery.exe	142
PID 3972 wrote to memory of 3572	3972	winbery.exe	143
PID 3572 wrote to memory of 4720	3572	winbery.exe	144
PID 4720 wrote to memory of 3536	4720	winbery.exe	145
PID 3536 wrote to memory of 2792	3536	winbery.exe	146
PID 2792 wrote to memory of 4796	2792	winbery.exe	147
PID 4796 wrote to memory of 1716	4796	winbery.exe	148
PID 1716 wrote to memory of 4872	1716	winbery.exe	149
PID 4872 wrote to memory of 3364	4872	winbery.exe	150
PID 3364 wrote to memory of 1800	3364	winbery.exe	151
PID 1800 wrote to memory of 1520	1800	winbery.exe	152
PID 1520 wrote to memory of 1752	1520	winbery.exe	153
PID 1752 wrote to memory of 1224	1752	winbery.exe	155
PID 1224 wrote to memory of 5036	1224	winbery.exe	156
PID 5036 wrote to memory of 5012	5036	winbery.exe	157
PID 5012 wrote to memory of 3016	5012	winbery.exe	158
PID 3016 wrote to memory of 692	3016	winbery.exe	159
PID 692 wrote to memory of 4664	692	winbery.exe	160
PID 4664 wrote to memory of 4496	4664	winbery.exe	161
PID 4496 wrote to memory of 4948	4496	winbery.exe	162
PID 4948 wrote to memory of 4232	4948	winbery.exe	163
PID 4232 wrote to memory of 4524	4232	winbery.exe	164

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e5ed68cdb51ef9b042f480126ff5430.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e5ed68cdb51ef9b042f480126ff5430.exe"
1⤵
- Adds policy Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\SysWOW64\winbery.exe
  C:\Windows\system32\winbery.exe "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e5ed68cdb51ef9b042f480126ff5430.exe"
  2⤵
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Windows\SysWOW64\winbery.exe
    C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1488
  - - C:\Windows\SysWOW64\winbery.exe
      C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2532
    - - C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2064
      - C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4816
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3052
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2292
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2060
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1692
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2404
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2036
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3956
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:224
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2148
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4564
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        17⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4412
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        18⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2000
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4000
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:944
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        21⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3132
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3008
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3292
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2788
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4228
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        26⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1560
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4488
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4712
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        29⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3164
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4808
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        31⤵
        Adds policy Run key to start application
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2672
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        32⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4892
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        33⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2384
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        34⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2400
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        35⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:548
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        36⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4676
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        37⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3312
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        38⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4332
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        39⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5096
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        40⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:564
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2600
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        42⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4684
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2692
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        44⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3972
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        45⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3572
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        46⤵
        Adds policy Run key to start application
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4720
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        47⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3536
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2792
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        49⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4796
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1716
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        51⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4872
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        52⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3364
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        53⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1800
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        54⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1520
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1752
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1224
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5036
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        59⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3016
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        60⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:692
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        61⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4664
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        62⤵
        Adds policy Run key to start application
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4496
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4948
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        64⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4232
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4524
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        66⤵
        
        PID:2684
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        67⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        68⤵
        System Location Discovery: System Language Discovery
        
        PID:4652
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        69⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        70⤵
        
        PID:4028
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        71⤵
        System Location Discovery: System Language Discovery
        
        PID:2352
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        72⤵
        
        PID:1300
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        73⤵
        System Location Discovery: System Language Discovery
        
        PID:3224
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        74⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1972
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        75⤵
        Adds policy Run key to start application
        
        PID:4068
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        76⤵
        
        PID:2288
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        77⤵
        System Location Discovery: System Language Discovery
        
        PID:3776
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        78⤵
        Adds policy Run key to start application
        
        PID:3248
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        79⤵
        
        PID:3036
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        80⤵
        Adds policy Run key to start application
        
        PID:4076
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        81⤵
        Adds policy Run key to start application
        
        PID:3040
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        82⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        83⤵
        
        PID:2044
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        84⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        85⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        86⤵
        Drops file in System32 directory
        
        PID:4576
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        87⤵
        Drops file in System32 directory
        
        PID:1608
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        88⤵
        
        PID:3284
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        89⤵
        System Location Discovery: System Language Discovery
        
        PID:2936
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        90⤵
        Adds policy Run key to start application
        
        PID:3952
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        91⤵
        
        PID:2476
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        92⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        93⤵
        Drops file in System32 directory
        
        PID:1508
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        94⤵
        
        PID:4048
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        95⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        96⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        97⤵
        
        PID:372
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        98⤵
        System Location Discovery: System Language Discovery
        
        PID:2988
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        99⤵
        
        PID:984
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        100⤵
        
        PID:3976
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        101⤵
        System Location Discovery: System Language Discovery
        
        PID:4120
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        102⤵
        
        PID:2932
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        103⤵
        System Location Discovery: System Language Discovery
        
        PID:208
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        104⤵
        Adds policy Run key to start application
        
        PID:4388
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        105⤵
        Drops file in System32 directory
        
        PID:1976
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        106⤵
        System Location Discovery: System Language Discovery
        
        PID:2220
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        107⤵
        Drops file in System32 directory
        
        PID:2232
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        108⤵
        Adds policy Run key to start application
        
        PID:1840
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        109⤵
        System Location Discovery: System Language Discovery
        
        PID:900
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        110⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        111⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4368
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        112⤵
        Drops file in System32 directory
        
        PID:2888
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        113⤵
        Adds policy Run key to start application
        Drops file in System32 directory
        
        PID:3820
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        114⤵
        System Location Discovery: System Language Discovery
        
        PID:1260
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        115⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1004
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        116⤵
        Adds policy Run key to start application
        Drops file in System32 directory
        
        PID:4440
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        117⤵
        
        PID:3220
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        118⤵
        Adds policy Run key to start application
        
        PID:4016
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        119⤵
        Drops file in System32 directory
        
        PID:2372
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        120⤵
        
        PID:2468
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        121⤵
        System Location Discovery: System Language Discovery
        
        PID:3988
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        122⤵
        
        PID:2296
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        123⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        124⤵
        Adds policy Run key to start application
        
        PID:4552
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        125⤵
        Drops file in System32 directory
        
        PID:852
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        126⤵
        Adds policy Run key to start application
        
        PID:2152
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        127⤵
        Adds policy Run key to start application
        
        PID:1616
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        128⤵
        
        PID:4860
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        129⤵
        
        PID:4708
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        130⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        131⤵
        
        PID:3732
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        132⤵
        
        PID:3332
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        133⤵
        Adds policy Run key to start application
        
        PID:1536
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        134⤵
        Drops file in System32 directory
        
        PID:5060
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        135⤵
        System Location Discovery: System Language Discovery
        
        PID:4376
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        136⤵
        Drops file in System32 directory
        
        PID:2172
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        137⤵
        
        PID:2736
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        138⤵
        Drops file in System32 directory
        
        PID:4936
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        139⤵
        
        PID:3784
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        140⤵
        
        PID:3060
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        141⤵
        
        PID:488
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        142⤵
        Adds policy Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3156
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        143⤵
        Adds policy Run key to start application
        
        PID:2768
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        144⤵
        Adds policy Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4144
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        145⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        146⤵
        
        PID:3836
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        147⤵
        Drops file in System32 directory
        
        PID:1880
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        148⤵
        
        PID:4264
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        149⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        150⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        151⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        152⤵
        System Location Discovery: System Language Discovery
        
        PID:3900
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        153⤵
        Adds policy Run key to start application
        
        PID:2472
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        154⤵
        Adds policy Run key to start application
        
        PID:2728
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        155⤵
        
        PID:3712
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        156⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        157⤵
        
        PID:880
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        158⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        159⤵
        Adds policy Run key to start application
        
        PID:4080
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        160⤵
        
        PID:2276
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        161⤵
        
        PID:2056
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        162⤵
        Drops file in System32 directory
        
        PID:180
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        163⤵
        
        PID:4468
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        164⤵
        Adds policy Run key to start application
        
        PID:3348
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        165⤵
        Adds policy Run key to start application
        
        PID:1788
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        166⤵
        System Location Discovery: System Language Discovery
        
        PID:1804
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        167⤵
        Adds policy Run key to start application
        
        PID:4520
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        168⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        169⤵
        Adds policy Run key to start application
        Drops file in System32 directory
        
        PID:744
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        170⤵
        Drops file in System32 directory
        
        PID:3380
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        171⤵
        Adds policy Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4444
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        172⤵
        System Location Discovery: System Language Discovery
        
        PID:796
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        173⤵
        Drops file in System32 directory
        
        PID:1912
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        174⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        175⤵
        System Location Discovery: System Language Discovery
        
        PID:5072
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        176⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        177⤵
        
        PID:1208
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        178⤵
        Adds policy Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2124
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        179⤵
        
        PID:1288
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        180⤵
        Adds policy Run key to start application
        
        PID:4276
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        181⤵
        System Location Discovery: System Language Discovery
        
        PID:2856
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        182⤵
        Drops file in System32 directory
        
        PID:3144
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        183⤵
        
        PID:3692
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        184⤵
        
        PID:3528
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        185⤵
        Drops file in System32 directory
        
        PID:1292
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        186⤵
        
        PID:3796
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        187⤵
        
        PID:4904
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        188⤵
        Drops file in System32 directory
        
        PID:1316
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        189⤵
        
        PID:3916
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        190⤵
        
        PID:1820
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        191⤵
        Drops file in System32 directory
        
        PID:1084
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        192⤵
        Drops file in System32 directory
        
        PID:2708
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        193⤵
        System Location Discovery: System Language Discovery
        
        PID:1896
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        194⤵
        Adds policy Run key to start application
        
        PID:2700
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        195⤵
        
        PID:4924
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        196⤵
        System Location Discovery: System Language Discovery
        
        PID:1856
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        197⤵
        Drops file in System32 directory
        
        PID:3452
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        198⤵
        Adds policy Run key to start application
        
        PID:2992
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        199⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        200⤵
        
        PID:4604
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        201⤵
        Drops file in System32 directory
        
        PID:2160
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        202⤵
        Drops file in System32 directory
        
        PID:3984
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        203⤵
        Drops file in System32 directory
        
        PID:3304
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        204⤵
        Adds policy Run key to start application
        
        PID:756
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        205⤵
        Adds policy Run key to start application
        
        PID:3960
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        206⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        207⤵
        Drops file in System32 directory
        
        PID:4320
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        208⤵
        System Location Discovery: System Language Discovery
        
        PID:888
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        209⤵
        Adds policy Run key to start application
        
        PID:3808
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        210⤵
        System Location Discovery: System Language Discovery
        
        PID:3128
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        211⤵
        
        PID:3208
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        212⤵
        
        PID:3676
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        213⤵
        Adds policy Run key to start application
        Drops file in System32 directory
        
        PID:2964
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        214⤵
        
        PID:1688
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        215⤵
        System Location Discovery: System Language Discovery
        
        PID:2444
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        216⤵
        System Location Discovery: System Language Discovery
        
        PID:3880
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        217⤵
        
        PID:3408
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        218⤵
        
        PID:1064
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        219⤵
        System Location Discovery: System Language Discovery
        
        PID:3560
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        220⤵
        
        PID:1408
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        221⤵
        System Location Discovery: System Language Discovery
        
        PID:4176
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        222⤵
        Adds policy Run key to start application
        
        PID:4964
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        223⤵
        
        PID:3756
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        224⤵
        System Location Discovery: System Language Discovery
        
        PID:4308
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        225⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        226⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        227⤵
        Adds policy Run key to start application
        
        PID:4672
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        228⤵
        Adds policy Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2244
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        229⤵
        Drops file in System32 directory
        
        PID:1636
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        230⤵
        Drops file in System32 directory
        
        PID:3748
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        231⤵
        Adds policy Run key to start application
        Drops file in System32 directory
        
        PID:1684
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        232⤵
        Adds policy Run key to start application
        
        PID:3968
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        233⤵
        System Location Discovery: System Language Discovery
        
        PID:2704
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        234⤵
        
        PID:4328
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        235⤵
        Adds policy Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3772
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        236⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        237⤵
        
        PID:1496
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        238⤵
        System Location Discovery: System Language Discovery
        
        PID:4768
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        239⤵
        
        PID:4420
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        240⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3412
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        241⤵
        
        PID:4760
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        242⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2368
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        243⤵
        
        PID:496
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        244⤵
        
        PID:3644
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        245⤵
        Drops file in System32 directory
        
        PID:2492
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        246⤵
        Drops file in System32 directory
        
        PID:4008
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        247⤵
        
        PID:2408
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        248⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        249⤵
        Adds policy Run key to start application
        
        PID:1052
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        250⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        251⤵
        
        PID:980
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        252⤵
        
        PID:1888
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        253⤵
        Drops file in System32 directory
        
        PID:3884
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        254⤵
        Adds policy Run key to start application
        
        PID:1984
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        255⤵
        Adds policy Run key to start application
        
        PID:4756
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        256⤵
        Adds policy Run key to start application
        
        PID:2284
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        257⤵
        Adds policy Run key to start application
        Drops file in System32 directory
        
        PID:4092
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        258⤵
        System Location Discovery: System Language Discovery
        
        PID:4452
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        259⤵
        System Location Discovery: System Language Discovery
        
        PID:2912
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        260⤵
        
        PID:3516
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        261⤵
        
        PID:3700
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        262⤵
        Drops file in System32 directory
        
        PID:4588
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        263⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        264⤵
        
        PID:3828
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        265⤵
        
        PID:4900
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        266⤵
        Adds policy Run key to start application
        
        PID:1096
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        267⤵
        
        PID:4268
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        268⤵
        Adds policy Run key to start application
        
        PID:3520
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        269⤵
        Adds policy Run key to start application
        
        PID:1864
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        270⤵
        System Location Discovery: System Language Discovery
        
        PID:5008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

winbery.exe

Path C:\Windows\SysWOW64\winbery.exe
Size 48KB
SHA256 86cdb7867dc7e6d5b286e8f015da56b66faba6e5b21490c9d3db5b13ee9f3a31
MD5 8e5ed68cdb51ef9b042f480126ff5430
SHA1 fdbcfa06003477312a42714b7d4e1b24a2f10821
SHA512 7948e01fc17740804ebc593ce968d4167aa73a289b71185487f6751c59a10a6a8f34ac0da7d6e497caa7ee164db372bc2c6119c4ad79ecf040a752e505b7f6b8
SSDEEP 384:pVJ0qsMkhT/SGp/R//D8xfvwicc2ZABWrdhWQylgePf+cMd4tliUN+l9BjqT1y:pT0b/SqR/cnuTZNRc7LH8ZjqT1
TLSH
T1F9236B6E379C4AF1C4B4CAB0B5299311E87F2C75AC6A9132D3903C4475B9843EF28B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/224-32-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/224-35-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/548-77-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/564-88-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/692-128-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/944-47-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1056-138-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1224-120-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1300-143-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1488-9-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1520-116-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1560-59-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1608-158-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1692-26-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1716-108-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1752-118-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1800-114-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1832-155-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1972-145-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2000-43-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2036-30-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2044-154-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2060-22-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2064-11-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2064-14-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2148-37-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2288-147-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2292-20-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2328-140-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2352-142-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2384-73-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2400-75-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2404-25-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2404-28-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2476-162-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2532-12-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2600-90-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2672-69-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2676-0-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2676-24-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2684-137-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2692-94-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2788-55-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2792-104-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2936-160-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3008-51-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3016-126-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3036-150-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3040-152-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3052-18-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3132-49-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3164-65-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3224-144-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3248-149-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3284-159-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3292-53-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3312-79-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3312-82-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3364-112-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3536-102-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3572-98-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3776-148-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3952-161-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3956-33-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3972-96-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4000-45-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4028-141-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4068-146-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4076-151-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4228-57-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4232-135-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4324-153-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4332-84-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4412-41-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4488-61-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4496-132-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4524-136-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4532-7-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4564-39-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4576-157-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4652-139-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4664-130-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4676-80-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4684-92-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4712-63-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4720-100-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4796-106-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4808-67-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4816-16-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4872-110-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4892-71-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4948-134-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5012-124-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5036-122-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5064-156-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5096-86-0x0000000000400000-0x000000000040C000-memory.dmp

Download