d6e8a38bdbe974f761eaa9946ba3fe3cde2652cafa254b63a20454218cc2e7c2

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 20:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-PSW.Win32.Gamec.u.exe
Size 18KB
Sample261011-y29ffsge22
SHA256 d6e8a38bdbe974f761eaa9946ba3fe3cde2652cafa254b63a20454218cc2e7c2
MD5 626073caf3554e6526b990e86f263308
SHA1 0497376e4eab5fd4d3f372d555ac18f851ab1bb6
SHA512 c47dc66b2a23c20887455ee6c582b03dcde817457d5e20e29a930e007318fad0d79656eb292e6b6e3e3d66454c39ec15646c8086aa0ec1c99bc7d4c8fe711a2b
SSDEEP 384:MrsSY5y2gdrmhem/kxxXD3HvtQ41sWrdhW4h:MSSdreem8xNNz
TLSH
T17482B00A07EC6EAAD1D3CBB166F9423FF02E7811DE314A35560888852CF2575FB60B69
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winser.exe"	winser.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winser.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winser.exe"	winser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winser.exe"	winser.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winser.exe"	winser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winser.exe"	winser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winser.exe"	winser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winser.exe"	winser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winser.exe"	winser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winser.exe"	winser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winser.exe"	winser.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winser.exe"	winser.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winser.exe"	winser.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winser.exe"	winser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winser.exe"	winser.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winser.exe"	winser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winser.exe"	winser.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winser.exe"	winser.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winser.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winser.exe"	winser.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winser.exe"	winser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winser.exe"	winser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winser.exe"	winser.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winser.exe"	winser.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winser.exe"	winser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winser.exe"	winser.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winser.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winser.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winser.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winser.exe"	winser.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winser.exe"	winser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winser.exe"	winser.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winser.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winser.exe"	winser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winser.exe"	winser.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winser.exe"	winser.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winser.exe"	winser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winser.exe"	winser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winser.exe"	winser.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winser.exe"	winser.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winser.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winser.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winser.exe"	winser.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KernelCheck = "C:\\Windows\\system32\\winser.exe"	winser.exe

Executes dropped EXE 64 IoCs

pid	Process
4472	winser.exe
1252	winser.exe
3588	winser.exe
3132	winser.exe
4640	winser.exe
2128	winser.exe
4656	winser.exe
4760	winser.exe
1532	winser.exe
6140	winser.exe
5576	winser.exe
2408	winser.exe
3572	winser.exe
4952	winser.exe
2148	winser.exe
3160	winser.exe
2360	winser.exe
2580	winser.exe
52	winser.exe
124	winser.exe
1720	winser.exe
3276	winser.exe
3716	winser.exe
5340	winser.exe
3944	winser.exe
5960	winser.exe
1144	winser.exe
2736	winser.exe
2520	winser.exe
2824	winser.exe
4276	winser.exe
2016	winser.exe
2100	winser.exe
4752	winser.exe
5080	winser.exe
1240	winser.exe
4832	winser.exe
4500	winser.exe
1480	winser.exe
3460	winser.exe
1944	winser.exe
2348	winser.exe
3428	winser.exe
4528	winser.exe
1540	winser.exe
1612	winser.exe
4940	winser.exe
4996	winser.exe
1860	winser.exe
1884	winser.exe
1176	winser.exe
4100	winser.exe
5628	winser.exe
3328	winser.exe
1988	winser.exe
1316	winser.exe
4856	winser.exe
2828	winser.exe
1468	winser.exe
3952	winser.exe
5928	winser.exe
3368	winser.exe
2184	winser.exe
4764	winser.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\winser.exe	winser.exe
File opened for modification	C:\Windows\SysWOW64\winser.exe	winser.exe
File opened for modification	C:\Windows\SysWOW64\winser.exe	winser.exe
File created	C:\Windows\SysWOW64\winser.exe	winser.exe
File created	C:\Windows\SysWOW64\winser.exe	winser.exe
File opened for modification	C:\Windows\SysWOW64\winser.exe	winser.exe
File opened for modification	C:\Windows\SysWOW64\winser.exe	winser.exe
File created	C:\Windows\SysWOW64\winser.exe	winser.exe
File created	C:\Windows\SysWOW64\winser.exe	winser.exe
File created	C:\Windows\SysWOW64\winser.exe	winser.exe
File created	C:\Windows\SysWOW64\winser.exe	winser.exe
File created	C:\Windows\SysWOW64\winser.exe	winser.exe
File opened for modification	C:\Windows\SysWOW64\winser.exe	winser.exe
File created	C:\Windows\SysWOW64\winser.exe	winser.exe
File opened for modification	C:\Windows\SysWOW64\winser.exe	winser.exe
File created	C:\Windows\SysWOW64\winser.exe	jaffacakes118_Trojan-PSW.Win32.Gamec.u.exe
File created	C:\Windows\SysWOW64\winser.exe	winser.exe
File opened for modification	C:\Windows\SysWOW64\winser.exe	winser.exe
File created	C:\Windows\SysWOW64\winser.exe	winser.exe
File opened for modification	C:\Windows\SysWOW64\winser.exe	winser.exe
File opened for modification	C:\Windows\SysWOW64\winser.exe	winser.exe
File opened for modification	C:\Windows\SysWOW64\winser.exe	winser.exe
File created	C:\Windows\SysWOW64\winser.exe	winser.exe
File opened for modification	C:\Windows\SysWOW64\winser.exe	winser.exe
File opened for modification	C:\Windows\SysWOW64\winser.exe	winser.exe
File opened for modification	C:\Windows\SysWOW64\winser.exe	winser.exe
File opened for modification	C:\Windows\SysWOW64\winser.exe	winser.exe
File created	C:\Windows\SysWOW64\winser.exe	winser.exe
File created	C:\Windows\SysWOW64\winser.exe	winser.exe
File opened for modification	C:\Windows\SysWOW64\winser.exe	winser.exe
File opened for modification	C:\Windows\SysWOW64\winser.exe	winser.exe
File opened for modification	C:\Windows\SysWOW64\winser.exe	winser.exe
File created	C:\Windows\SysWOW64\winser.exe	winser.exe
File opened for modification	C:\Windows\SysWOW64\winser.exe	winser.exe
File created	C:\Windows\SysWOW64\winser.exe	winser.exe
File created	C:\Windows\SysWOW64\winser.exe	winser.exe
File opened for modification	C:\Windows\SysWOW64\winser.exe	winser.exe
File created	C:\Windows\SysWOW64\winser.exe	winser.exe
File opened for modification	C:\Windows\SysWOW64\winser.exe	winser.exe
File opened for modification	C:\Windows\SysWOW64\winser.exe	winser.exe
File opened for modification	C:\Windows\SysWOW64\winser.exe	winser.exe
File created	C:\Windows\SysWOW64\winser.exe	winser.exe
File opened for modification	C:\Windows\SysWOW64\winser.exe	winser.exe
File created	C:\Windows\SysWOW64\winser.exe	winser.exe
File opened for modification	C:\Windows\SysWOW64\winser.exe	winser.exe
File opened for modification	C:\Windows\SysWOW64\winser.exe	winser.exe
File opened for modification	C:\Windows\SysWOW64\winser.exe	winser.exe
File created	C:\Windows\SysWOW64\winser.exe	winser.exe
File opened for modification	C:\Windows\SysWOW64\winser.exe	winser.exe
File created	C:\Windows\SysWOW64\winser.exe	winser.exe
File opened for modification	C:\Windows\SysWOW64\winser.exe	winser.exe
File opened for modification	C:\Windows\SysWOW64\winser.exe	winser.exe
File opened for modification	C:\Windows\SysWOW64\winser.exe	winser.exe
File created	C:\Windows\SysWOW64\winser.exe	winser.exe
File created	C:\Windows\SysWOW64\winser.exe	winser.exe
File opened for modification	C:\Windows\SysWOW64\winser.exe	winser.exe
File opened for modification	C:\Windows\SysWOW64\winser.exe	winser.exe
File created	C:\Windows\SysWOW64\winser.exe	winser.exe
File opened for modification	C:\Windows\SysWOW64\winser.exe	winser.exe
File created	C:\Windows\SysWOW64\winser.exe	winser.exe
File created	C:\Windows\SysWOW64\winser.exe	winser.exe
File created	C:\Windows\SysWOW64\winser.exe	winser.exe
File created	C:\Windows\SysWOW64\winser.exe	winser.exe
File created	C:\Windows\SysWOW64\winser.exe	winser.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winser.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3500	jaffacakes118_Trojan-PSW.Win32.Gamec.u.exe
3500	jaffacakes118_Trojan-PSW.Win32.Gamec.u.exe
4472	winser.exe
4472	winser.exe
4472	winser.exe
4472	winser.exe
1252	winser.exe
1252	winser.exe
1252	winser.exe
1252	winser.exe
3588	winser.exe
3588	winser.exe
3588	winser.exe
3588	winser.exe
3132	winser.exe
3132	winser.exe
3132	winser.exe
3132	winser.exe
4640	winser.exe
4640	winser.exe
4640	winser.exe
4640	winser.exe
2128	winser.exe
2128	winser.exe
2128	winser.exe
2128	winser.exe
4656	winser.exe
4656	winser.exe
4656	winser.exe
4656	winser.exe
4760	winser.exe
4760	winser.exe
4760	winser.exe
4760	winser.exe
1532	winser.exe
1532	winser.exe
1532	winser.exe
1532	winser.exe
6140	winser.exe
6140	winser.exe
6140	winser.exe
6140	winser.exe
5576	winser.exe
5576	winser.exe
5576	winser.exe
5576	winser.exe
2408	winser.exe
2408	winser.exe
2408	winser.exe
2408	winser.exe
3572	winser.exe
3572	winser.exe
3572	winser.exe
3572	winser.exe
4952	winser.exe
4952	winser.exe
4952	winser.exe
4952	winser.exe
2148	winser.exe
2148	winser.exe
2148	winser.exe
2148	winser.exe
3160	winser.exe
3160	winser.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3500	jaffacakes118_Trojan-PSW.Win32.Gamec.u.exe
Token: SeDebugPrivilege	4472	winser.exe
Token: SeDebugPrivilege	1252	winser.exe
Token: SeDebugPrivilege	3588	winser.exe
Token: SeDebugPrivilege	3132	winser.exe
Token: SeDebugPrivilege	4640	winser.exe
Token: SeDebugPrivilege	2128	winser.exe
Token: SeDebugPrivilege	4656	winser.exe
Token: SeDebugPrivilege	4760	winser.exe
Token: SeDebugPrivilege	1532	winser.exe
Token: SeDebugPrivilege	6140	winser.exe
Token: SeDebugPrivilege	5576	winser.exe
Token: SeDebugPrivilege	2408	winser.exe
Token: SeDebugPrivilege	3572	winser.exe
Token: SeDebugPrivilege	4952	winser.exe
Token: SeDebugPrivilege	2148	winser.exe
Token: SeDebugPrivilege	3160	winser.exe
Token: SeDebugPrivilege	2360	winser.exe
Token: SeDebugPrivilege	2580	winser.exe
Token: SeDebugPrivilege	52	winser.exe
Token: SeDebugPrivilege	124	winser.exe
Token: SeDebugPrivilege	1720	winser.exe
Token: SeDebugPrivilege	3276	winser.exe
Token: SeDebugPrivilege	3716	winser.exe
Token: SeDebugPrivilege	5340	winser.exe
Token: SeDebugPrivilege	3944	winser.exe
Token: SeDebugPrivilege	5960	winser.exe
Token: SeDebugPrivilege	1144	winser.exe
Token: SeDebugPrivilege	2736	winser.exe
Token: SeDebugPrivilege	2520	winser.exe
Token: SeDebugPrivilege	2824	winser.exe
Token: SeDebugPrivilege	4276	winser.exe
Token: SeDebugPrivilege	2016	winser.exe
Token: SeDebugPrivilege	2100	winser.exe
Token: SeDebugPrivilege	4752	winser.exe
Token: SeDebugPrivilege	5080	winser.exe
Token: SeDebugPrivilege	1240	winser.exe
Token: SeDebugPrivilege	4832	winser.exe
Token: SeDebugPrivilege	4500	winser.exe
Token: SeDebugPrivilege	1480	winser.exe
Token: SeDebugPrivilege	3460	winser.exe
Token: SeDebugPrivilege	1944	winser.exe
Token: SeDebugPrivilege	2348	winser.exe
Token: SeDebugPrivilege	3428	winser.exe
Token: SeDebugPrivilege	4528	winser.exe
Token: SeDebugPrivilege	1540	winser.exe
Token: SeDebugPrivilege	1612	winser.exe
Token: SeDebugPrivilege	4940	winser.exe
Token: SeDebugPrivilege	4996	winser.exe
Token: SeDebugPrivilege	1860	winser.exe
Token: SeDebugPrivilege	1884	winser.exe
Token: SeDebugPrivilege	1176	winser.exe
Token: SeDebugPrivilege	4100	winser.exe
Token: SeDebugPrivilege	5628	winser.exe
Token: SeDebugPrivilege	3328	winser.exe
Token: SeDebugPrivilege	1988	winser.exe
Token: SeDebugPrivilege	1316	winser.exe
Token: SeDebugPrivilege	4856	winser.exe
Token: SeDebugPrivilege	2828	winser.exe
Token: SeDebugPrivilege	1468	winser.exe
Token: SeDebugPrivilege	3952	winser.exe
Token: SeDebugPrivilege	5928	winser.exe
Token: SeDebugPrivilege	3368	winser.exe
Token: SeDebugPrivilege	2184	winser.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 4472	3500	jaffacakes118_Trojan-PSW.Win32.Gamec.u.exe	90
PID 4472 wrote to memory of 1252	4472	winser.exe	91
PID 1252 wrote to memory of 3588	1252	winser.exe	92
PID 3588 wrote to memory of 3132	3588	winser.exe	93
PID 3132 wrote to memory of 4640	3132	winser.exe	94
PID 4640 wrote to memory of 2128	4640	winser.exe	95
PID 2128 wrote to memory of 4656	2128	winser.exe	96
PID 4656 wrote to memory of 4760	4656	winser.exe	97
PID 4760 wrote to memory of 1532	4760	winser.exe	98
PID 1532 wrote to memory of 6140	1532	winser.exe	99
PID 6140 wrote to memory of 5576	6140	winser.exe	100
PID 5576 wrote to memory of 2408	5576	winser.exe	101
PID 2408 wrote to memory of 3572	2408	winser.exe	102
PID 3572 wrote to memory of 4952	3572	winser.exe	103
PID 4952 wrote to memory of 2148	4952	winser.exe	104
PID 2148 wrote to memory of 3160	2148	winser.exe	105
PID 3160 wrote to memory of 2360	3160	winser.exe	106
PID 2360 wrote to memory of 2580	2360	winser.exe	107
PID 2580 wrote to memory of 52	2580	winser.exe	108
PID 52 wrote to memory of 124	52	winser.exe	109
PID 124 wrote to memory of 1720	124	winser.exe	110
PID 1720 wrote to memory of 3276	1720	winser.exe	111
PID 3276 wrote to memory of 3716	3276	winser.exe	112
PID 3716 wrote to memory of 5340	3716	winser.exe	113
PID 5340 wrote to memory of 3944	5340	winser.exe	114
PID 3944 wrote to memory of 5960	3944	winser.exe	115
PID 5960 wrote to memory of 1144	5960	winser.exe	116
PID 1144 wrote to memory of 2736	1144	winser.exe	117
PID 2736 wrote to memory of 2520	2736	winser.exe	118
PID 2520 wrote to memory of 2824	2520	winser.exe	119
PID 2824 wrote to memory of 4276	2824	winser.exe	120
PID 4276 wrote to memory of 2016	4276	winser.exe	121
PID 2016 wrote to memory of 2100	2016	winser.exe	122
PID 2100 wrote to memory of 4752	2100	winser.exe	123
PID 4752 wrote to memory of 5080	4752	winser.exe	124
PID 5080 wrote to memory of 1240	5080	winser.exe	125
PID 1240 wrote to memory of 4832	1240	winser.exe	126
PID 4832 wrote to memory of 4500	4832	winser.exe	127
PID 4500 wrote to memory of 1480	4500	winser.exe	128
PID 1480 wrote to memory of 3460	1480	winser.exe	129
PID 3460 wrote to memory of 1944	3460	winser.exe	130
PID 1944 wrote to memory of 2348	1944	winser.exe	131
PID 2348 wrote to memory of 3428	2348	winser.exe	132
PID 3428 wrote to memory of 4528	3428	winser.exe	133
PID 4528 wrote to memory of 1540	4528	winser.exe	134
PID 1540 wrote to memory of 1612	1540	winser.exe	135
PID 1612 wrote to memory of 4940	1612	winser.exe	136
PID 4940 wrote to memory of 4996	4940	winser.exe	137
PID 4996 wrote to memory of 1860	4996	winser.exe	138
PID 1860 wrote to memory of 1884	1860	winser.exe	139
PID 1884 wrote to memory of 1176	1884	winser.exe	140
PID 1176 wrote to memory of 4100	1176	winser.exe	141
PID 4100 wrote to memory of 5628	4100	winser.exe	143
PID 5628 wrote to memory of 3328	5628	winser.exe	144
PID 3328 wrote to memory of 1988	3328	winser.exe	145
PID 1988 wrote to memory of 1316	1988	winser.exe	146
PID 1316 wrote to memory of 4856	1316	winser.exe	147
PID 4856 wrote to memory of 2828	4856	winser.exe	148
PID 2828 wrote to memory of 1468	2828	winser.exe	149
PID 1468 wrote to memory of 3952	1468	winser.exe	150
PID 3952 wrote to memory of 5928	3952	winser.exe	151
PID 5928 wrote to memory of 3368	5928	winser.exe	152
PID 3368 wrote to memory of 2184	3368	winser.exe	153
PID 2184 wrote to memory of 4764	2184	winser.exe	154

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-PSW.Win32.Gamec.u.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-PSW.Win32.Gamec.u.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Windows\SysWOW64\winser.exe
  C:\Windows\system32\winser.exe "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-PSW.Win32.Gamec.u.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\SysWOW64\winser.exe
    C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1252
  - - C:\Windows\SysWOW64\winser.exe
      C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3588
    - - C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3132
      - C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4640
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        7⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2128
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4656
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4760
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1532
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:6140
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5576
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2408
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3572
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        15⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4952
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2148
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3160
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2360
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2580
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:52
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:124
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1720
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3276
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        24⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3716
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        25⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5340
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3944
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5960
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1144
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2736
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2520
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        31⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2824
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        32⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4276
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        33⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2016
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        34⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2100
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        36⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5080
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1240
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        38⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4832
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        39⤵
        Adds policy Run key to start application
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4500
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1480
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        41⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3460
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        42⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1944
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        43⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2348
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        44⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3428
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4528
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        46⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1540
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        47⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1612
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        48⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4940
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4996
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1860
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        51⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1884
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        52⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1176
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        53⤵
        Adds policy Run key to start application
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4100
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5628
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        55⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3328
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        56⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1988
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        57⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1316
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4856
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        59⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2828
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        60⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1468
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        61⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3952
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        62⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5928
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        63⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3368
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        64⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2184
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        65⤵
        Executes dropped EXE
        
        PID:4764
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        66⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3600
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        67⤵
        Adds policy Run key to start application
        Drops file in System32 directory
        
        PID:5296
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        68⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6108
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:5916
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        70⤵
        System Location Discovery: System Language Discovery
        
        PID:4800
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        71⤵
        Adds policy Run key to start application
        Drops file in System32 directory
        
        PID:1332
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        72⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        73⤵
        Adds policy Run key to start application
        
        PID:1844
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        74⤵
        Adds policy Run key to start application
        
        PID:1276
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        75⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        76⤵
        Adds policy Run key to start application
        
        PID:704
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        77⤵
        Adds policy Run key to start application
        Drops file in System32 directory
        
        PID:4912
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        78⤵
        
        PID:844
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        79⤵
        Adds policy Run key to start application
        Drops file in System32 directory
        
        PID:3784
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        80⤵
        
        PID:788
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        81⤵
        
        PID:5000
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        82⤵
        Drops file in System32 directory
        
        PID:8
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        83⤵
        
        PID:464
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        84⤵
        System Location Discovery: System Language Discovery
        
        PID:2068
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        85⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        86⤵
        Drops file in System32 directory
        
        PID:2988
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        87⤵
        Adds policy Run key to start application
        
        PID:3864
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        88⤵
        
        PID:3836
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        89⤵
        
        PID:3904
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        90⤵
        Adds policy Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3968
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        91⤵
        System Location Discovery: System Language Discovery
        
        PID:2724
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        92⤵
        Drops file in System32 directory
        
        PID:5136
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        93⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        94⤵
        Adds policy Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3028
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        95⤵
        Adds policy Run key to start application
        
        PID:3488
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        96⤵
        
        PID:1244
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        97⤵
        
        PID:2668
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        98⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        99⤵
        
        PID:248
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        100⤵
        System Location Discovery: System Language Discovery
        
        PID:1924
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        101⤵
        Drops file in System32 directory
        
        PID:1708
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        102⤵
        Drops file in System32 directory
        
        PID:4256
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        103⤵
        
        PID:1192
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        104⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        105⤵
        Drops file in System32 directory
        
        PID:1216
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        106⤵
        Adds policy Run key to start application
        Drops file in System32 directory
        
        PID:2176
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        107⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        108⤵
        Adds policy Run key to start application
        
        PID:5896
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        109⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        110⤵
        Adds policy Run key to start application
        
        PID:1220
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        111⤵
        Adds policy Run key to start application
        
        PID:4772
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        112⤵
        
        PID:3456
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        113⤵
        System Location Discovery: System Language Discovery
        
        PID:5260
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        114⤵
        
        PID:4152
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        115⤵
        System Location Discovery: System Language Discovery
        
        PID:4636
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        116⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        117⤵
        
        PID:2416
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        118⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        119⤵
        
        PID:1068
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        120⤵
        
        PID:1656
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        121⤵
        Drops file in System32 directory
        
        PID:4260
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        122⤵
        Drops file in System32 directory
        
        PID:3252
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        123⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        124⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        125⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2884
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        126⤵
        
        PID:4480
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        127⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        128⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2532
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        129⤵
        System Location Discovery: System Language Discovery
        
        PID:5760
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        130⤵
        System Location Discovery: System Language Discovery
        
        PID:5104
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        131⤵
        Adds policy Run key to start application
        Drops file in System32 directory
        
        PID:2060
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        132⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        133⤵
        
        PID:4176
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        134⤵
        System Location Discovery: System Language Discovery
        
        PID:5448
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        135⤵
        Adds policy Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4860
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        136⤵
        
        PID:4388
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        137⤵
        
        PID:2468
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        138⤵
        Adds policy Run key to start application
        
        PID:4288
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        139⤵
        Drops file in System32 directory
        
        PID:4604
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        140⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        141⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4336
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        142⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        143⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        144⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        145⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        146⤵
        
        PID:3824
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        147⤵
        System Location Discovery: System Language Discovery
        
        PID:3012
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        148⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        149⤵
        Drops file in System32 directory
        
        PID:1432
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        150⤵
        Adds policy Run key to start application
        
        PID:5764
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        151⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        152⤵
        
        PID:3512
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        153⤵
        
        PID:1384
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        154⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4252
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        155⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        156⤵
        Adds policy Run key to start application
        Drops file in System32 directory
        
        PID:5388
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        157⤵
        
        PID:3244
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        158⤵
        Drops file in System32 directory
        
        PID:980
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        159⤵
        
        PID:3196
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        160⤵
        Drops file in System32 directory
        
        PID:4492
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        161⤵
        Adds policy Run key to start application
        
        PID:3240
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        162⤵
        
        PID:2364
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        163⤵
        Adds policy Run key to start application
        
        PID:5124
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        164⤵
        
        PID:2560
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        165⤵
        Adds policy Run key to start application
        Drops file in System32 directory
        
        PID:1348
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        166⤵
        Adds policy Run key to start application
        
        PID:5632
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        167⤵
        Adds policy Run key to start application
        
        PID:4136
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        168⤵
        
        PID:2864
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        169⤵
        
        PID:2976
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        170⤵
        System Location Discovery: System Language Discovery
        
        PID:5748
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        171⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1544
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        172⤵
        System Location Discovery: System Language Discovery
        
        PID:1900
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        173⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        174⤵
        Drops file in System32 directory
        
        PID:108
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        175⤵
        Drops file in System32 directory
        
        PID:296
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        176⤵
        
        PID:2728
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        177⤵
        Adds policy Run key to start application
        
        PID:5868
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        178⤵
        System Location Discovery: System Language Discovery
        
        PID:4780
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        179⤵
        Drops file in System32 directory
        
        PID:1476
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        180⤵
        Adds policy Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2040
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        181⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:828
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        182⤵
        Drops file in System32 directory
        
        PID:3700
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        183⤵
        System Location Discovery: System Language Discovery
        
        PID:2300
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        184⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        185⤵
        Drops file in System32 directory
        
        PID:1320
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        186⤵
        
        PID:3400
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        187⤵
        Adds policy Run key to start application
        Drops file in System32 directory
        
        PID:3396
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        188⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        189⤵
        
        PID:3304
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        190⤵
        Adds policy Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3584
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        191⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        192⤵
        Drops file in System32 directory
        
        PID:2844
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        193⤵
        Drops file in System32 directory
        
        PID:1080
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        194⤵
        Adds policy Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4408
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        195⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2152
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        196⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        197⤵
        Adds policy Run key to start application
        
        PID:5704
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        198⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        199⤵
        System Location Discovery: System Language Discovery
        
        PID:2076
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        200⤵
        Adds policy Run key to start application
        
        PID:364
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        201⤵
        Adds policy Run key to start application
        Drops file in System32 directory
        
        PID:3800
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        202⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        203⤵
        
        PID:1296
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        204⤵
        
        PID:3432
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        205⤵
        Adds policy Run key to start application
        Drops file in System32 directory
        
        PID:4404
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        206⤵
        Adds policy Run key to start application
        
        PID:1520
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        207⤵
        System Location Discovery: System Language Discovery
        
        PID:2972
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        208⤵
        
        PID:3332
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        209⤵
        
        PID:2924
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        210⤵
        
        PID:1412
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        211⤵
        System Location Discovery: System Language Discovery
        
        PID:4868
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        212⤵
        Adds policy Run key to start application
        Drops file in System32 directory
        
        PID:2872
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        213⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        214⤵
        
        PID:3564
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        215⤵
        Drops file in System32 directory
        
        PID:3984
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        216⤵
        
        PID:2656
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        217⤵
        Drops file in System32 directory
        
        PID:5972
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        218⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        219⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        220⤵
        System Location Discovery: System Language Discovery
        
        PID:3024
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        221⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        222⤵
        Adds policy Run key to start application
        
        PID:4428
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        223⤵
        Drops file in System32 directory
        
        PID:4644
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        224⤵
        
        PID:2620
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        225⤵
        
        PID:1768
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        226⤵
        
        PID:4520
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        227⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        228⤵
        System Location Discovery: System Language Discovery
        
        PID:2080
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        229⤵
        System Location Discovery: System Language Discovery
        
        PID:4216
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        230⤵
        Adds policy Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4320
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        231⤵
        Drops file in System32 directory
        
        PID:2084
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        232⤵
        Adds policy Run key to start application
        
        PID:3712
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        233⤵
        Drops file in System32 directory
        
        PID:1484
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        234⤵
        System Location Discovery: System Language Discovery
        
        PID:2412
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        235⤵
        
        PID:3108
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        236⤵
        System Location Discovery: System Language Discovery
        
        PID:4416
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        237⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        238⤵
        Adds policy Run key to start application
        
        PID:4920
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        239⤵
        
        PID:3296
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        240⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:352
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        241⤵
        Adds policy Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:260
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        242⤵
        
        PID:292
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        243⤵
        System Location Discovery: System Language Discovery
        
        PID:4896
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        244⤵
        
        PID:2224
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        245⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        246⤵
        
        PID:3536
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        247⤵
        
        PID:3064
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        248⤵
        System Location Discovery: System Language Discovery
        
        PID:4576
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        249⤵
        Adds policy Run key to start application
        
        PID:2832
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        250⤵
        
        PID:504
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        251⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        252⤵
        
        PID:4116
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        253⤵
        
        PID:4120
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        254⤵
        System Location Discovery: System Language Discovery
        
        PID:3020
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        255⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3808
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        256⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        257⤵
        Adds policy Run key to start application
        
        PID:3608
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        258⤵
        Adds policy Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4392
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        259⤵
        Adds policy Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:5948
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        260⤵
        System Location Discovery: System Language Discovery
        
        PID:692
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        261⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        262⤵
        
        PID:3264
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        263⤵
        System Location Discovery: System Language Discovery
        
        PID:1292
        
        C:\Windows\SysWOW64\winser.exe
        
        C:\Windows\system32\winser.exe "C:\Windows\SysWOW64\winser.exe"
        264⤵
        
        PID:4620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

winser.exe

Path C:\Windows\SysWOW64\winser.exe
Size 18KB
SHA256 d6e8a38bdbe974f761eaa9946ba3fe3cde2652cafa254b63a20454218cc2e7c2
MD5 626073caf3554e6526b990e86f263308
SHA1 0497376e4eab5fd4d3f372d555ac18f851ab1bb6
SHA512 c47dc66b2a23c20887455ee6c582b03dcde817457d5e20e29a930e007318fad0d79656eb292e6b6e3e3d66454c39ec15646c8086aa0ec1c99bc7d4c8fe711a2b
SSDEEP 384:MrsSY5y2gdrmhem/kxxXD3HvtQ41sWrdhW4h:MSSdreem8xNNz
TLSH
T17482B00A07EC6EAAD1D3CBB166F9423FF02E7811DE314A35560888852CF2575FB60B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-151-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/52-44-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/124-47-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/464-152-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/704-145-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/788-149-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/844-147-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1144-61-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1176-109-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1240-79-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1252-5-0x0000000000640000-0x0000000000641000-memory.dmp

Download

memory/1252-8-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1276-143-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1316-119-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1332-140-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1468-125-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1480-85-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1532-24-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1540-97-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1612-99-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1720-49-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1720-46-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1772-154-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1844-142-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1860-105-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1884-107-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1944-89-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1988-117-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2016-71-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2068-153-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2100-73-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2128-18-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2148-36-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2184-133-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2348-91-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2360-40-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2408-30-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2520-65-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2580-42-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2736-63-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2824-67-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2828-123-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2988-155-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3132-10-0x0000000000740000-0x0000000000741000-memory.dmp

Download

memory/3132-14-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3160-38-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3276-51-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3328-115-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3368-131-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3428-93-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3460-87-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3500-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3500-13-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3500-1-0x0000000000640000-0x0000000000641000-memory.dmp

Download

memory/3572-32-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3588-11-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3600-135-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3716-53-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3784-148-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3836-157-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3864-156-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3904-158-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3944-57-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3952-127-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3968-159-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4100-111-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4276-69-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4472-3-0x0000000000510000-0x0000000000511000-memory.dmp

Download

memory/4472-6-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4500-83-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4528-95-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4640-16-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4656-20-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4752-75-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4760-22-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4764-134-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4800-139-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4832-81-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4856-121-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4912-146-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4940-101-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4952-34-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4996-103-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5000-150-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5080-77-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5296-136-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5340-55-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5476-141-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5576-28-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5628-113-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5740-144-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5916-138-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5928-129-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5960-59-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/6108-137-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/6140-26-0x0000000000400000-0x000000000040D000-memory.dmp

Download