86cdb7867dc7e6d5b286e8f015da56b66faba6e5b21490c9d3db5b13ee9f3a31

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 10:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__8e5ed68cdb51ef9b042f480126ff5430.exe
Size 48KB
Sample260919-m2kasaed55
SHA256 86cdb7867dc7e6d5b286e8f015da56b66faba6e5b21490c9d3db5b13ee9f3a31
MD5 8e5ed68cdb51ef9b042f480126ff5430
SHA1 fdbcfa06003477312a42714b7d4e1b24a2f10821
SHA512 7948e01fc17740804ebc593ce968d4167aa73a289b71185487f6751c59a10a6a8f34ac0da7d6e497caa7ee164db372bc2c6119c4ad79ecf040a752e505b7f6b8
SSDEEP 384:pVJ0qsMkhT/SGp/R//D8xfvwicc2ZABWrdhWQylgePf+cMd4tliUN+l9BjqT1y:pT0b/SqR/cnuTZNRc7LH8ZjqT1
TLSH
T1F9236B6E379C4AF1C4B4CAB0B5299311E87F2C75AC6A9132D3903C4475B9843EF28B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	jaffacakes118__8e5ed68cdb51ef9b042f480126ff5430.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winbery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winbery.exe"	winbery.exe

Executes dropped EXE 64 IoCs

pid	Process
2228	winbery.exe
5868	winbery.exe
5824	winbery.exe
264	winbery.exe
2700	winbery.exe
5672	winbery.exe
5960	winbery.exe
4568	winbery.exe
3332	winbery.exe
1296	winbery.exe
4108	winbery.exe
2792	winbery.exe
1640	winbery.exe
2776	winbery.exe
2428	winbery.exe
5476	winbery.exe
1460	winbery.exe
5460	winbery.exe
4368	winbery.exe
2824	winbery.exe
4148	winbery.exe
5872	winbery.exe
2632	winbery.exe
1096	winbery.exe
5596	winbery.exe
2924	winbery.exe
2524	winbery.exe
1184	winbery.exe
4052	winbery.exe
476	winbery.exe
1164	winbery.exe
5876	winbery.exe
4564	winbery.exe
1764	winbery.exe
2648	winbery.exe
5316	winbery.exe
692	winbery.exe
3676	winbery.exe
5080	winbery.exe
4824	winbery.exe
4444	winbery.exe
2172	winbery.exe
3256	winbery.exe
1688	winbery.exe
4048	winbery.exe
3636	winbery.exe
2592	winbery.exe
3468	winbery.exe
2392	winbery.exe
5484	winbery.exe
3268	winbery.exe
4072	winbery.exe
4388	winbery.exe
5512	winbery.exe
6028	winbery.exe
1372	winbery.exe
4044	winbery.exe
2860	winbery.exe
4596	winbery.exe
2944	winbery.exe
1328	winbery.exe
4504	winbery.exe
3568	winbery.exe
1092	winbery.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File created	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe
File opened for modification	C:\Windows\SysWOW64\winbery.exe	winbery.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winbery.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4436	jaffacakes118__8e5ed68cdb51ef9b042f480126ff5430.exe
4436	jaffacakes118__8e5ed68cdb51ef9b042f480126ff5430.exe
2228	winbery.exe
2228	winbery.exe
2228	winbery.exe
2228	winbery.exe
5868	winbery.exe
5868	winbery.exe
5868	winbery.exe
5868	winbery.exe
5824	winbery.exe
5824	winbery.exe
5824	winbery.exe
5824	winbery.exe
264	winbery.exe
264	winbery.exe
264	winbery.exe
264	winbery.exe
2700	winbery.exe
2700	winbery.exe
2700	winbery.exe
2700	winbery.exe
5672	winbery.exe
5672	winbery.exe
5672	winbery.exe
5672	winbery.exe
5960	winbery.exe
5960	winbery.exe
5960	winbery.exe
5960	winbery.exe
4568	winbery.exe
4568	winbery.exe
4568	winbery.exe
4568	winbery.exe
3332	winbery.exe
3332	winbery.exe
3332	winbery.exe
3332	winbery.exe
1296	winbery.exe
1296	winbery.exe
1296	winbery.exe
1296	winbery.exe
4108	winbery.exe
4108	winbery.exe
4108	winbery.exe
4108	winbery.exe
2792	winbery.exe
2792	winbery.exe
2792	winbery.exe
2792	winbery.exe
1640	winbery.exe
1640	winbery.exe
1640	winbery.exe
1640	winbery.exe
2776	winbery.exe
2776	winbery.exe
2776	winbery.exe
2776	winbery.exe
2428	winbery.exe
2428	winbery.exe
2428	winbery.exe
2428	winbery.exe
5476	winbery.exe
5476	winbery.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4436	jaffacakes118__8e5ed68cdb51ef9b042f480126ff5430.exe
Token: SeDebugPrivilege	2228	winbery.exe
Token: SeDebugPrivilege	5868	winbery.exe
Token: SeDebugPrivilege	5824	winbery.exe
Token: SeDebugPrivilege	264	winbery.exe
Token: SeDebugPrivilege	2700	winbery.exe
Token: SeDebugPrivilege	5672	winbery.exe
Token: SeDebugPrivilege	5960	winbery.exe
Token: SeDebugPrivilege	4568	winbery.exe
Token: SeDebugPrivilege	3332	winbery.exe
Token: SeDebugPrivilege	1296	winbery.exe
Token: SeDebugPrivilege	4108	winbery.exe
Token: SeDebugPrivilege	2792	winbery.exe
Token: SeDebugPrivilege	1640	winbery.exe
Token: SeDebugPrivilege	2776	winbery.exe
Token: SeDebugPrivilege	2428	winbery.exe
Token: SeDebugPrivilege	5476	winbery.exe
Token: SeDebugPrivilege	1460	winbery.exe
Token: SeDebugPrivilege	5460	winbery.exe
Token: SeDebugPrivilege	4368	winbery.exe
Token: SeDebugPrivilege	2824	winbery.exe
Token: SeDebugPrivilege	4148	winbery.exe
Token: SeDebugPrivilege	5872	winbery.exe
Token: SeDebugPrivilege	2632	winbery.exe
Token: SeDebugPrivilege	1096	winbery.exe
Token: SeDebugPrivilege	5596	winbery.exe
Token: SeDebugPrivilege	2924	winbery.exe
Token: SeDebugPrivilege	2524	winbery.exe
Token: SeDebugPrivilege	1184	winbery.exe
Token: SeDebugPrivilege	4052	winbery.exe
Token: SeDebugPrivilege	476	winbery.exe
Token: SeDebugPrivilege	1164	winbery.exe
Token: SeDebugPrivilege	5876	winbery.exe
Token: SeDebugPrivilege	4564	winbery.exe
Token: SeDebugPrivilege	1764	winbery.exe
Token: SeDebugPrivilege	2648	winbery.exe
Token: SeDebugPrivilege	5316	winbery.exe
Token: SeDebugPrivilege	692	winbery.exe
Token: SeDebugPrivilege	3676	winbery.exe
Token: SeDebugPrivilege	5080	winbery.exe
Token: SeDebugPrivilege	4824	winbery.exe
Token: SeDebugPrivilege	4444	winbery.exe
Token: SeDebugPrivilege	2172	winbery.exe
Token: SeDebugPrivilege	3256	winbery.exe
Token: SeDebugPrivilege	1688	winbery.exe
Token: SeDebugPrivilege	4048	winbery.exe
Token: SeDebugPrivilege	3636	winbery.exe
Token: SeDebugPrivilege	2592	winbery.exe
Token: SeDebugPrivilege	3468	winbery.exe
Token: SeDebugPrivilege	2392	winbery.exe
Token: SeDebugPrivilege	5484	winbery.exe
Token: SeDebugPrivilege	3268	winbery.exe
Token: SeDebugPrivilege	4072	winbery.exe
Token: SeDebugPrivilege	4388	winbery.exe
Token: SeDebugPrivilege	5512	winbery.exe
Token: SeDebugPrivilege	6028	winbery.exe
Token: SeDebugPrivilege	1372	winbery.exe
Token: SeDebugPrivilege	4044	winbery.exe
Token: SeDebugPrivilege	2860	winbery.exe
Token: SeDebugPrivilege	4596	winbery.exe
Token: SeDebugPrivilege	2944	winbery.exe
Token: SeDebugPrivilege	1328	winbery.exe
Token: SeDebugPrivilege	4504	winbery.exe
Token: SeDebugPrivilege	3568	winbery.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 2228	4436	jaffacakes118__8e5ed68cdb51ef9b042f480126ff5430.exe	89
PID 2228 wrote to memory of 5868	2228	winbery.exe	90
PID 5868 wrote to memory of 5824	5868	winbery.exe	91
PID 5824 wrote to memory of 264	5824	winbery.exe	92
PID 264 wrote to memory of 2700	264	winbery.exe	93
PID 2700 wrote to memory of 5672	2700	winbery.exe	94
PID 5672 wrote to memory of 5960	5672	winbery.exe	95
PID 5960 wrote to memory of 4568	5960	winbery.exe	96
PID 4568 wrote to memory of 3332	4568	winbery.exe	97
PID 3332 wrote to memory of 1296	3332	winbery.exe	98
PID 1296 wrote to memory of 4108	1296	winbery.exe	99
PID 4108 wrote to memory of 2792	4108	winbery.exe	100
PID 2792 wrote to memory of 1640	2792	winbery.exe	101
PID 1640 wrote to memory of 2776	1640	winbery.exe	102
PID 2776 wrote to memory of 2428	2776	winbery.exe	103
PID 2428 wrote to memory of 5476	2428	winbery.exe	104
PID 5476 wrote to memory of 1460	5476	winbery.exe	105
PID 1460 wrote to memory of 5460	1460	winbery.exe	106
PID 5460 wrote to memory of 4368	5460	winbery.exe	107
PID 4368 wrote to memory of 2824	4368	winbery.exe	108
PID 2824 wrote to memory of 4148	2824	winbery.exe	109
PID 4148 wrote to memory of 5872	4148	winbery.exe	110
PID 5872 wrote to memory of 2632	5872	winbery.exe	111
PID 2632 wrote to memory of 1096	2632	winbery.exe	112
PID 1096 wrote to memory of 5596	1096	winbery.exe	113
PID 5596 wrote to memory of 2924	5596	winbery.exe	114
PID 2924 wrote to memory of 2524	2924	winbery.exe	115
PID 2524 wrote to memory of 1184	2524	winbery.exe	116
PID 1184 wrote to memory of 4052	1184	winbery.exe	117
PID 4052 wrote to memory of 476	4052	winbery.exe	118
PID 476 wrote to memory of 1164	476	winbery.exe	119
PID 1164 wrote to memory of 5876	1164	winbery.exe	120
PID 5876 wrote to memory of 4564	5876	winbery.exe	121
PID 4564 wrote to memory of 1764	4564	winbery.exe	122
PID 1764 wrote to memory of 2648	1764	winbery.exe	123
PID 2648 wrote to memory of 5316	2648	winbery.exe	124
PID 5316 wrote to memory of 692	5316	winbery.exe	125
PID 692 wrote to memory of 3676	692	winbery.exe	126
PID 3676 wrote to memory of 5080	3676	winbery.exe	127
PID 5080 wrote to memory of 4824	5080	winbery.exe	128
PID 4824 wrote to memory of 4444	4824	winbery.exe	129
PID 4444 wrote to memory of 2172	4444	winbery.exe	130
PID 2172 wrote to memory of 3256	2172	winbery.exe	131
PID 3256 wrote to memory of 1688	3256	winbery.exe	132
PID 1688 wrote to memory of 4048	1688	winbery.exe	133
PID 4048 wrote to memory of 3636	4048	winbery.exe	134
PID 3636 wrote to memory of 2592	3636	winbery.exe	135
PID 2592 wrote to memory of 3468	2592	winbery.exe	136
PID 3468 wrote to memory of 2392	3468	winbery.exe	137
PID 2392 wrote to memory of 5484	2392	winbery.exe	138
PID 5484 wrote to memory of 3268	5484	winbery.exe	139
PID 3268 wrote to memory of 4072	3268	winbery.exe	140
PID 4072 wrote to memory of 4388	4072	winbery.exe	142
PID 4388 wrote to memory of 5512	4388	winbery.exe	143
PID 5512 wrote to memory of 6028	5512	winbery.exe	144
PID 6028 wrote to memory of 1372	6028	winbery.exe	145
PID 1372 wrote to memory of 4044	1372	winbery.exe	146
PID 4044 wrote to memory of 2860	4044	winbery.exe	147
PID 2860 wrote to memory of 4596	2860	winbery.exe	148
PID 4596 wrote to memory of 2944	4596	winbery.exe	149
PID 2944 wrote to memory of 1328	2944	winbery.exe	150
PID 1328 wrote to memory of 4504	1328	winbery.exe	151
PID 4504 wrote to memory of 3568	4504	winbery.exe	152
PID 3568 wrote to memory of 1092	3568	winbery.exe	153

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e5ed68cdb51ef9b042f480126ff5430.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e5ed68cdb51ef9b042f480126ff5430.exe"
1⤵
- Adds policy Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\SysWOW64\winbery.exe
  C:\Windows\system32\winbery.exe "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e5ed68cdb51ef9b042f480126ff5430.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Windows\SysWOW64\winbery.exe
    C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
    3⤵
    - Adds policy Run key to start application
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5868
  - - C:\Windows\SysWOW64\winbery.exe
      C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5824
    - - C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:264
      - C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2700
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5672
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5960
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4568
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        10⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3332
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1296
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4108
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2792
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1640
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2776
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        16⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2428
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5476
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        18⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1460
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5460
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4368
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2824
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4148
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5872
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2632
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1096
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5596
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        27⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2924
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2524
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1184
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4052
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        31⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:476
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        32⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1164
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        33⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5876
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        34⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4564
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        35⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1764
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2648
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        37⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5316
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        38⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:692
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3676
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        40⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5080
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4824
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        42⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4444
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2172
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        44⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3256
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        45⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1688
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        46⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4048
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3636
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        48⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2592
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        49⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3468
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        50⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2392
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        51⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5484
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        52⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3268
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        53⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4072
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4388
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        55⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5512
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        56⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:6028
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        57⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1372
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4044
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        59⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2860
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        60⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4596
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        61⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2944
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        62⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1328
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        63⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4504
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        64⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3568
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        65⤵
        Executes dropped EXE
        
        PID:1092
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        66⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4960
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        67⤵
        Drops file in System32 directory
        
        PID:4608
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        68⤵
        System Location Discovery: System Language Discovery
        
        PID:3108
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        69⤵
        Adds policy Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1728
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        70⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        71⤵
        
        PID:3612
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        72⤵
        System Location Discovery: System Language Discovery
        
        PID:4776
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        73⤵
        System Location Discovery: System Language Discovery
        
        PID:832
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        74⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        75⤵
        Adds policy Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4200
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        76⤵
        Drops file in System32 directory
        
        PID:1368
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        77⤵
        Drops file in System32 directory
        
        PID:5784
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        78⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        79⤵
        Adds policy Run key to start application
        
        PID:2548
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        80⤵
        
        PID:256
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        81⤵
        Drops file in System32 directory
        
        PID:5412
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        82⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        83⤵
        System Location Discovery: System Language Discovery
        
        PID:4964
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        84⤵
        
        PID:4224
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        85⤵
        Adds policy Run key to start application
        
        PID:1596
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        86⤵
        
        PID:1188
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        87⤵
        Drops file in System32 directory
        
        PID:4576
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        88⤵
        
        PID:2684
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        89⤵
        System Location Discovery: System Language Discovery
        
        PID:4764
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        90⤵
        
        PID:200
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        91⤵
        
        PID:1908
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        92⤵
        Adds policy Run key to start application
        Drops file in System32 directory
        
        PID:5524
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        93⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        94⤵
        
        PID:3808
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        95⤵
        System Location Discovery: System Language Discovery
        
        PID:1664
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        96⤵
        
        PID:4508
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        97⤵
        Adds policy Run key to start application
        Drops file in System32 directory
        
        PID:2484
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        98⤵
        Adds policy Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5840
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        99⤵
        
        PID:3472
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        100⤵
        System Location Discovery: System Language Discovery
        
        PID:6056
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        101⤵
        Adds policy Run key to start application
        
        PID:4664
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        102⤵
        
        PID:1276
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        103⤵
        Adds policy Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4972
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        104⤵
        Adds policy Run key to start application
        
        PID:2612
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        105⤵
        System Location Discovery: System Language Discovery
        
        PID:5832
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        106⤵
        
        PID:804
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        107⤵
        System Location Discovery: System Language Discovery
        
        PID:5508
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        108⤵
        
        PID:988
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        109⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        110⤵
        
        PID:3948
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        111⤵
        
        PID:1384
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        112⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        113⤵
        Drops file in System32 directory
        
        PID:5140
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        114⤵
        
        PID:2348
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        115⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        116⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        117⤵
        Drops file in System32 directory
        
        PID:4448
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        118⤵
        Drops file in System32 directory
        
        PID:1416
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        119⤵
        Adds policy Run key to start application
        
        PID:5360
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        120⤵
        Drops file in System32 directory
        
        PID:3204
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        121⤵
        
        PID:4640
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        122⤵
        Adds policy Run key to start application
        Drops file in System32 directory
        
        PID:3724
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        123⤵
        System Location Discovery: System Language Discovery
        
        PID:1720
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        124⤵
        Drops file in System32 directory
        
        PID:4920
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        125⤵
        Drops file in System32 directory
        
        PID:1228
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        126⤵
        
        PID:3540
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        127⤵
        System Location Discovery: System Language Discovery
        
        PID:3352
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        128⤵
        Adds policy Run key to start application
        
        PID:5904
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        129⤵
        Adds policy Run key to start application
        
        PID:5968
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        130⤵
        Drops file in System32 directory
        
        PID:5452
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        131⤵
        Adds policy Run key to start application
        
        PID:6004
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        132⤵
        Adds policy Run key to start application
        
        PID:5236
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        133⤵
        System Location Discovery: System Language Discovery
        
        PID:5428
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        134⤵
        Adds policy Run key to start application
        
        PID:944
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        135⤵
        Drops file in System32 directory
        
        PID:828
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        136⤵
        Drops file in System32 directory
        
        PID:5020
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        137⤵
        Adds policy Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:5240
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        138⤵
        System Location Discovery: System Language Discovery
        
        PID:5264
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        139⤵
        Drops file in System32 directory
        
        PID:4156
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        140⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        141⤵
        System Location Discovery: System Language Discovery
        
        PID:6048
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        142⤵
        
        PID:3440
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        143⤵
        
        PID:2120
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        144⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        145⤵
        
        PID:4344
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        146⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1060
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        147⤵
        Adds policy Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6100
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        148⤵
        Drops file in System32 directory
        
        PID:4524
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        149⤵
        Adds policy Run key to start application
        
        PID:1844
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        150⤵
        System Location Discovery: System Language Discovery
        
        PID:1636
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        151⤵
        Drops file in System32 directory
        
        PID:2384
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        152⤵
        Drops file in System32 directory
        
        PID:3916
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        153⤵
        
        PID:3276
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        154⤵
        
        PID:1916
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        155⤵
        Drops file in System32 directory
        
        PID:4968
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        156⤵
        Drops file in System32 directory
        
        PID:2668
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        157⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        158⤵
        System Location Discovery: System Language Discovery
        
        PID:2812
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        159⤵
        System Location Discovery: System Language Discovery
        
        PID:1116
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        160⤵
        Adds policy Run key to start application
        Drops file in System32 directory
        
        PID:3156
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        161⤵
        
        PID:4228
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        162⤵
        System Location Discovery: System Language Discovery
        
        PID:3264
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        163⤵
        Drops file in System32 directory
        
        PID:5276
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        164⤵
        Drops file in System32 directory
        
        PID:1056
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        165⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        166⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        167⤵
        System Location Discovery: System Language Discovery
        
        PID:4352
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        168⤵
        
        PID:2692
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        169⤵
        Adds policy Run key to start application
        
        PID:5940
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        170⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        171⤵
        
        PID:1404
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        172⤵
        System Location Discovery: System Language Discovery
        
        PID:2072
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        173⤵
        System Location Discovery: System Language Discovery
        
        PID:5124
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        174⤵
        Adds policy Run key to start application
        Drops file in System32 directory
        
        PID:5312
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        175⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        176⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        177⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        178⤵
        Adds policy Run key to start application
        
        PID:1324
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        179⤵
        
        PID:2096
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        180⤵
        
        PID:3504
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        181⤵
        
        PID:4752
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        182⤵
        Adds policy Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:6088
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        183⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        184⤵
        
        PID:3800
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        185⤵
        System Location Discovery: System Language Discovery
        
        PID:484
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        186⤵
        Drops file in System32 directory
        
        PID:4496
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        187⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        188⤵
        
        PID:2496
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        189⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        190⤵
        Adds policy Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2808
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        191⤵
        Adds policy Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2012
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        192⤵
        Drops file in System32 directory
        
        PID:1552
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        193⤵
        Adds policy Run key to start application
        
        PID:1604
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        194⤵
        
        PID:4256
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        195⤵
        System Location Discovery: System Language Discovery
        
        PID:3000
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        196⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        197⤵
        
        PID:4932
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        198⤵
        System Location Discovery: System Language Discovery
        
        PID:5892
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        199⤵
        Drops file in System32 directory
        
        PID:3628
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        200⤵
        Drops file in System32 directory
        
        PID:4804
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        201⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        202⤵
        Adds policy Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4644
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        203⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        204⤵
        Adds policy Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:5380
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        205⤵
        
        PID:3036
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        206⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        207⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        208⤵
        Adds policy Run key to start application
        
        PID:1680
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        209⤵
        Adds policy Run key to start application
        
        PID:1992
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        210⤵
        
        PID:2436
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        211⤵
        Drops file in System32 directory
        
        PID:2000
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        212⤵
        System Location Discovery: System Language Discovery
        
        PID:5600
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        213⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        214⤵
        
        PID:3100
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        215⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        216⤵
        
        PID:3172
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        217⤵
        
        PID:3420
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        218⤵
        
        PID:1084
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        219⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        220⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        221⤵
        
        PID:2544
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        222⤵
        System Location Discovery: System Language Discovery
        
        PID:3208
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        223⤵
        
        PID:3424
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        224⤵
        System Location Discovery: System Language Discovery
        
        PID:2856
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        225⤵
        Adds policy Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2764
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        226⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        227⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        228⤵
        Drops file in System32 directory
        
        PID:3740
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        229⤵
        System Location Discovery: System Language Discovery
        
        PID:5860
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        230⤵
        
        PID:2264
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        231⤵
        Adds policy Run key to start application
        
        PID:4264
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        232⤵
        
        PID:4720
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        233⤵
        
        PID:2376
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        234⤵
        
        PID:1212
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        235⤵
        Drops file in System32 directory
        
        PID:4248
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        236⤵
        
        PID:4144
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        237⤵
        System Location Discovery: System Language Discovery
        
        PID:1540
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        238⤵
        Drops file in System32 directory
        
        PID:4852
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        239⤵
        
        PID:4432
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        240⤵
        
        PID:4888
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        241⤵
        Adds policy Run key to start application
        
        PID:4492
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        242⤵
        Adds policy Run key to start application
        
        PID:1904
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        243⤵
        System Location Discovery: System Language Discovery
        
        PID:4204
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        244⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        245⤵
        Adds policy Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:5148
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        246⤵
        
        PID:2176
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        247⤵
        Adds policy Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3532
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        248⤵
        Adds policy Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2340
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        249⤵
        Drops file in System32 directory
        
        PID:3556
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        250⤵
        Adds policy Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:5660
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        251⤵
        Adds policy Run key to start application
        
        PID:3168
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        252⤵
        System Location Discovery: System Language Discovery
        
        PID:2868
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        253⤵
        System Location Discovery: System Language Discovery
        
        PID:4792
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        254⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        255⤵
        Adds policy Run key to start application
        
        PID:1240
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        256⤵
        Adds policy Run key to start application
        
        PID:4916
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        257⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        258⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        259⤵
        
        PID:3776
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        260⤵
        
        PID:1464
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        261⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        262⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\winbery.exe
        
        C:\Windows\system32\winbery.exe "C:\Windows\SysWOW64\winbery.exe"
        263⤵
        
        PID:2908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

winbery.exe

Path C:\Windows\SysWOW64\winbery.exe
Size 48KB
SHA256 86cdb7867dc7e6d5b286e8f015da56b66faba6e5b21490c9d3db5b13ee9f3a31
MD5 8e5ed68cdb51ef9b042f480126ff5430
SHA1 fdbcfa06003477312a42714b7d4e1b24a2f10821
SHA512 7948e01fc17740804ebc593ce968d4167aa73a289b71185487f6751c59a10a6a8f34ac0da7d6e497caa7ee164db372bc2c6119c4ad79ecf040a752e505b7f6b8
SSDEEP 384:pVJ0qsMkhT/SGp/R//D8xfvwicc2ZABWrdhWQylgePf+cMd4tliUN+l9BjqT1y:pT0b/SqR/cnuTZNRc7LH8ZjqT1
TLSH
T1F9236B6E379C4AF1C4B4CAB0B5299311E87F2C75AC6A9132D3903C4475B9843EF28B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/200-154-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/256-144-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/264-9-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/476-62-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/692-76-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/832-137-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1092-129-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1096-50-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1164-64-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1184-58-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1188-150-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1296-22-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1328-124-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1368-140-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1372-114-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1460-36-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1596-149-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1640-28-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1664-159-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1688-90-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1724-134-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1728-133-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1764-70-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1908-155-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2172-86-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2228-3-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2392-100-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2428-32-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2524-56-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2548-143-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2592-96-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2632-48-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2648-72-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2684-152-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2700-11-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2776-30-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2792-26-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2824-42-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2860-118-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2924-54-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2944-122-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3108-132-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3256-88-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3268-104-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3332-20-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3468-98-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3568-128-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3612-135-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3636-94-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3676-78-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3808-158-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4044-116-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4048-92-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4052-60-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4072-106-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4108-24-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4148-44-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4200-139-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4224-148-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4368-40-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4388-108-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4436-19-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4436-0-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4444-84-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4504-126-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4564-68-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4568-17-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4576-151-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4596-120-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4608-131-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4764-153-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4776-136-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4824-82-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4828-138-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4944-146-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4960-130-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4964-147-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4984-157-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5080-80-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5316-74-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5412-145-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5436-142-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5460-38-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5476-34-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5484-102-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5512-110-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5524-156-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5596-52-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5672-13-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5784-141-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5824-7-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5868-5-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5872-46-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5876-66-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5960-15-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/6028-112-0x0000000000400000-0x000000000040C000-memory.dmp

Download