Overview

overview

7

Static

static

3

73b5460581...73.dll

windows10-2004-x64

7

73b5460581...73.dll

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/09/2026, 22:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    73b5460581ae6b1d925470602255a18d2d2aa2f43d1daeef86ae87e24e7edc73.dll
  • Size 9.1MB
  • Sample260922-2g62dagh94
  • SHA256 73b5460581ae6b1d925470602255a18d2d2aa2f43d1daeef86ae87e24e7edc73
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 37 IoCs
  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 52 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 56 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\73b5460581ae6b1d925470602255a18d2d2aa2f43d1daeef86ae87e24e7edc73.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4620
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\73b5460581ae6b1d925470602255a18d2d2aa2f43d1daeef86ae87e24e7edc73.dll,#1
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3808
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2608
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1900
          • C:\ProgramData\BufsOxxQUKaTiOkRiaVdUjNBIHejPvHQ.bDZ\slOfkAkbRLhVCyJYAYHsaYHtbiFJrFbD.DHh.exe
            "slOfkAkbRLhVCyJYAYHsaYHtbiFJrFbD.DHh.exe"
            5⤵
            • Executes dropped EXE
            PID:3484
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2476
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5916
          • C:\ProgramData\VLKcMTjViDtgdAZJuDFdKoyMgVUPnYSI.caD\JTyrKucDtIRqpfqgTiSQYNbNotAAicen.cSs.exe
            "JTyrKucDtIRqpfqgTiSQYNbNotAAicen.cSs.exe"
            5⤵
            • Executes dropped EXE
            PID:2076
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5480
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4308
          • C:\ProgramData\GldciAwKIomrbJkuQCaipglplGRUCEuA.Zig\EuvgHtTKitBKkNGuJZrhVQsKybQjcors.zAX.exe
            "EuvgHtTKitBKkNGuJZrhVQsKybQjcors.zAX.exe"
            5⤵
            • Executes dropped EXE
            PID:1264
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1400
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3448
          • C:\ProgramData\KMttCTzULnECOTuTSjIcawJGkzYoOaUm.rle\NnlFNqiLjqQgZHNkrUPuPTMAVPjNaJvO.vLJ.exe
            "NnlFNqiLjqQgZHNkrUPuPTMAVPjNaJvO.vLJ.exe"
            5⤵
            • Executes dropped EXE
            PID:2596
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1576
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6132
          • C:\ProgramData\tGpMCJFAhXyPInpMgbiGASQgJIrPJebQ.GzQ\SNiXhISPJGrpvprGdaOSpxggzIGdnfOk.OCT.exe
            "SNiXhISPJGrpvprGdaOSpxggzIGdnfOk.OCT.exe"
            5⤵
            • Executes dropped EXE
            PID:2236
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3672
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4496
          • C:\ProgramData\TFxGJfIMiOJbzsAVhaRmLdTIoPaigIgd.TuJ\VHuWtGHMVbJrpgppNPCoHoxKZSfjtazX.WQF.exe
            "VHuWtGHMVbJrpgppNPCoHoxKZSfjtazX.WQF.exe"
            5⤵
            • Executes dropped EXE
            PID:3252
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3340
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4692
          • C:\ProgramData\eLPAxPbqmidjJKTpGEgqbMXGRmtDswRu.QtG\mvpzxTEpKAZJvITRHXZuqlKuwCQcgcIW.YNK.exe
            "mvpzxTEpKAZJvITRHXZuqlKuwCQcgcIW.YNK.exe"
            5⤵
            • Executes dropped EXE
            PID:3568
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4424
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:5136
          • C:\ProgramData\zoCuPatfvIPBuAaDoxWvBFXvxainwRom.GCI\hEQAIOrYboHpYTqJbEfEdisIIeEHVDUP.mUY.exe
            "hEQAIOrYboHpYTqJbEfEdisIIeEHVDUP.mUY.exe"
            5⤵
            • Executes dropped EXE
            PID:4492
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5312
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4472
          • C:\ProgramData\fpWDPXtmvcwcgDdHAempPGKveJgIhixd.uwA\hzNEeHRZrqkRHUJfLEadITLiiZPeyevS.dBy.exe
            "hzNEeHRZrqkRHUJfLEadITLiiZPeyevS.dBy.exe"
            5⤵
            • Executes dropped EXE
            PID:1824
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2396
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1356
          • C:\ProgramData\pQctLiVZhnIwEuJQmjfDqboojUyPUACt.Mgd\eacPsMnaVOZfWmiBjWWbSPGIcrhskQui.aWZ.exe
            "eacPsMnaVOZfWmiBjWWbSPGIcrhskQui.aWZ.exe"
            5⤵
            • Executes dropped EXE
            PID:4484
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5884
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3280
          • C:\ProgramData\fTtCapJPhLjsCjHmoyuqvsgsdZAzdrzl.AvQ\pGhCwRrhKaQqlbjCBGwqYitvGYuoVmCx.TnS.exe
            "pGhCwRrhKaQqlbjCBGwqYitvGYuoVmCx.TnS.exe"
            5⤵
            • Executes dropped EXE
            PID:4444
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5080
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4316
          • C:\ProgramData\IFIbcZVQARFPZQRwOztUcTacZBqiZPgT.Fyr\BTnSBBEUXBGXTtICqszPXHRvniSYkXDV.BRq.exe
            "BTnSBBEUXBGXTtICqszPXHRvniSYkXDV.BRq.exe"
            5⤵
            • Executes dropped EXE
            PID:5732
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5072
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3388
          • C:\ProgramData\KoKwbGjAvPTatTCiRaWmTGCcUmwSpWIS.NJG\upHxuqnUxXnjnGUqibSQcdWeqAeGrvQN.LQU.exe
            "upHxuqnUxXnjnGUqibSQcdWeqAeGrvQN.LQU.exe"
            5⤵
            • Executes dropped EXE
            PID:5796
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3044
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2692
          • C:\ProgramData\yrFtPEMJTynEhVvrRaebClHEQcIRZsyI.ZxT\IYAQPbyZdHOykYqdkZOghUNhSLGlBKAT.glA.exe
            "IYAQPbyZdHOykYqdkZOghUNhSLGlBKAT.glA.exe"
            5⤵
            • Executes dropped EXE
            PID:3056
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:712
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4216
          • C:\ProgramData\dBDfhOPDhowRINVvfcPNoBXxXDBLaiiT.vsJ\YYGngYJcXsDtKGulEMThKpxtJLQLVjQD.ZPl.exe
            "YYGngYJcXsDtKGulEMThKpxtJLQLVjQD.ZPl.exe"
            5⤵
            • Executes dropped EXE
            PID:3160
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2080
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5096
          • C:\ProgramData\ZlzLUujmEQpcBbWwaWUpWeZsDOVxzYFO.NWI\oVczUCbZsIMcutWBquJAIGHrlzTseHTl.ISA.exe
            "oVczUCbZsIMcutWBquJAIGHrlzTseHTl.ISA.exe"
            5⤵
            • Executes dropped EXE
            PID:4332
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5676
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6080
          • C:\ProgramData\ZxWvZcTeocKLNNYAqCzILTgeVgkmtySt.sTE\lQWVJQjiIUhlLwLAQHNMPvhjkvNVCJTm.fvv.exe
            "lQWVJQjiIUhlLwLAQHNMPvhjkvNVCJTm.fvv.exe"
            5⤵
            • Executes dropped EXE
            PID:1540
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3028
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3264
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1888
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2720
          • C:\ProgramData\mRCwXQzyPIRDAahUJxUHRNCTBZUaJwHr.bOB\jpEKFzICKHgtcyGLfLWLOCVkpNHQaEqx.zpP.exe
            "jpEKFzICKHgtcyGLfLWLOCVkpNHQaEqx.zpP.exe"
            5⤵
            • Executes dropped EXE
            PID:3016
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2724
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2744
          • C:\ProgramData\MlewiwmTRTNSUPeUBjqpEtFjVwfOMwYb.IAr\xTfnbTwqIOCbHFMXzUxoQyszRjlIMtVI.etg.exe
            "xTfnbTwqIOCbHFMXzUxoQyszRjlIMtVI.etg.exe"
            5⤵
            • Executes dropped EXE
            PID:5780
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1856
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4484
          • C:\ProgramData\iJpJDwyJRqEYgbiluKsmRkeXskZwAnBx.zFt\vTUOifhCiyFlypDauNoVyKIimOzVppLs.PTX.exe
            "vTUOifhCiyFlypDauNoVyKIimOzVppLs.PTX.exe"
            5⤵
            • Executes dropped EXE
            PID:468
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4864
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
            PID:5988
            • C:\ProgramData\sZHdyzvidtbjIcndqSdqhJWxUdrWScHf.AUC\ZFWdpNaHPyYIQGgMomvobKfeRnYjtJfe.twR.exe
              "ZFWdpNaHPyYIQGgMomvobKfeRnYjtJfe.twR.exe"
              5⤵
              • Executes dropped EXE
              PID:4340
        • C:\Windows\SysWOW64\cmd.exe
          /c "C:\Windows\System32\ComputerDefaults.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3580
          • C:\Windows\SysWOW64\ComputerDefaults.exe
            C:\Windows\System32\ComputerDefaults.exe
            4⤵
            • System Location Discovery: System Language Discovery
            PID:5248
            • C:\ProgramData\xAIchlYNVJiKwOrWUpJPXZhiYuBrBQNS.Aci\JACzQdMfhCQSzoLbLumiCUiWlCGArqAS.Imh.exe
              "JACzQdMfhCQSzoLbLumiCUiWlCGArqAS.Imh.exe"
              5⤵
              • Executes dropped EXE
              PID:2296
        • C:\Windows\SysWOW64\cmd.exe
          /c "C:\Windows\System32\ComputerDefaults.exe"
          3⤵
            PID:5724
            • C:\Windows\SysWOW64\ComputerDefaults.exe
              C:\Windows\System32\ComputerDefaults.exe
              4⤵
              • System Location Discovery: System Language Discovery
              PID:1476
              • C:\ProgramData\kGPsCbvOuiYoHNRGsvcpcHVTBDDNZIjt.XMa\FVKMtYgYnXZKqmqNbhBdcYRrAYRswbmn.LCy.exe
                "FVKMtYgYnXZKqmqNbhBdcYRrAYRswbmn.LCy.exe"
                5⤵
                • Executes dropped EXE
                PID:5696
          • C:\Windows\SysWOW64\cmd.exe
            /c "C:\Windows\System32\ComputerDefaults.exe"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:3428
            • C:\Windows\SysWOW64\ComputerDefaults.exe
              C:\Windows\System32\ComputerDefaults.exe
              4⤵
                PID:2620
                • C:\ProgramData\ETkknpgoqJwutDkEappQawBSIhbGMREK.EQb\HnATwTLDSQuYEgtZvmSUPCahCnepjoLz.bvu.exe
                  "HnATwTLDSQuYEgtZvmSUPCahCnepjoLz.bvu.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:4116
            • C:\Windows\SysWOW64\cmd.exe
              /c "C:\Windows\System32\ComputerDefaults.exe"
              3⤵
                PID:4724
                • C:\Windows\SysWOW64\ComputerDefaults.exe
                  C:\Windows\System32\ComputerDefaults.exe
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:5816
              • C:\Windows\SysWOW64\cmd.exe
                /c "C:\Windows\System32\ComputerDefaults.exe"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:1380
                • C:\Windows\SysWOW64\ComputerDefaults.exe
                  C:\Windows\System32\ComputerDefaults.exe
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:5596
                  • C:\ProgramData\ffxYiktQYkVtQdkWFhfkfQHmumrXgTap.jlH\LkRXHxWNKKspREVSZmQUddLJJgtojhVY.YQK.exe
                    "LkRXHxWNKKspREVSZmQUddLJJgtojhVY.YQK.exe"
                    5⤵
                    • Executes dropped EXE
                    PID:1636
              • C:\Windows\SysWOW64\cmd.exe
                /c "C:\Windows\System32\ComputerDefaults.exe"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:4676
                • C:\Windows\SysWOW64\ComputerDefaults.exe
                  C:\Windows\System32\ComputerDefaults.exe
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:5968
              • C:\Windows\SysWOW64\cmd.exe
                /c "C:\Windows\System32\ComputerDefaults.exe"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:5772
                • C:\Windows\SysWOW64\ComputerDefaults.exe
                  C:\Windows\System32\ComputerDefaults.exe
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:3964
                  • C:\ProgramData\IlVxPlTzHQTJSqEzgEnypqrCPZBbdWtm.kbC\IBVpcdaZoGzkthKdPhZdLRImNNAXfacB.dbe.exe
                    "IBVpcdaZoGzkthKdPhZdLRImNNAXfacB.dbe.exe"
                    5⤵
                    • Executes dropped EXE
                    PID:5048
              • C:\Windows\SysWOW64\cmd.exe
                /c "C:\Windows\System32\ComputerDefaults.exe"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:2408
                • C:\Windows\SysWOW64\ComputerDefaults.exe
                  C:\Windows\System32\ComputerDefaults.exe
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:5372
              • C:\Windows\SysWOW64\cmd.exe
                /c "C:\Windows\System32\ComputerDefaults.exe"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:5688
                • C:\Windows\SysWOW64\ComputerDefaults.exe
                  C:\Windows\System32\ComputerDefaults.exe
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:5104
                  • C:\ProgramData\VuCTGZyFugDpnnIArQpKtyLsyloqiUpD.JWX\SYaecMNZqyTMdDJQowYeyOHSKrwLaksq.Mxg.exe
                    "SYaecMNZqyTMdDJQowYeyOHSKrwLaksq.Mxg.exe"
                    5⤵
                    • Executes dropped EXE
                    PID:1664
              • C:\Windows\SysWOW64\cmd.exe
                /c "C:\Windows\System32\ComputerDefaults.exe"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:3016
                • C:\Windows\SysWOW64\ComputerDefaults.exe
                  C:\Windows\System32\ComputerDefaults.exe
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:1100
              • C:\Windows\SysWOW64\cmd.exe
                /c "C:\Windows\System32\ComputerDefaults.exe"
                3⤵
                  PID:5636
                  • C:\Windows\SysWOW64\ComputerDefaults.exe
                    C:\Windows\System32\ComputerDefaults.exe
                    4⤵
                      PID:4764
                      • C:\ProgramData\uVbIEjGuZnruGkIfoPXmFCxptZOMlCXa.Mxj\IZRHEwFwnCpiOIMHxzPNESdkpKixFyeK.Awj.exe
                        "IZRHEwFwnCpiOIMHxzPNESdkpKixFyeK.Awj.exe"
                        5⤵
                        • Executes dropped EXE
                        PID:2896
                  • C:\Windows\SysWOW64\cmd.exe
                    /c "C:\Windows\System32\ComputerDefaults.exe"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:4336
                    • C:\Windows\SysWOW64\ComputerDefaults.exe
                      C:\Windows\System32\ComputerDefaults.exe
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:4828
                  • C:\Windows\SysWOW64\cmd.exe
                    /c "C:\Windows\System32\ComputerDefaults.exe"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:2600
                    • C:\Windows\SysWOW64\ComputerDefaults.exe
                      C:\Windows\System32\ComputerDefaults.exe
                      4⤵
                        PID:5620
                        • C:\ProgramData\UJlqTaUwLMBOWFWCFmqjYooUtfyOpwwT.lSB\jsfzrfBdhpDPYNoDwgrohBupRYWmVWon.GuU.exe
                          "jsfzrfBdhpDPYNoDwgrohBupRYWmVWon.GuU.exe"
                          5⤵
                          • Executes dropped EXE
                          PID:256
                    • C:\Windows\SysWOW64\cmd.exe
                      /c "C:\Windows\System32\ComputerDefaults.exe"
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:5732
                      • C:\Windows\SysWOW64\ComputerDefaults.exe
                        C:\Windows\System32\ComputerDefaults.exe
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:2892
                        • C:\ProgramData\hmfhnUuvJkyvSvFiXwrWJMDoTkwFhyzn.iAh\LpbLnckHeLoNkxTZUDqkAXBckRKOKaJI.ngb.exe
                          "LpbLnckHeLoNkxTZUDqkAXBckRKOKaJI.ngb.exe"
                          5⤵
                          • Executes dropped EXE
                          PID:1260
                    • C:\Windows\SysWOW64\cmd.exe
                      /c "C:\Windows\System32\ComputerDefaults.exe"
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:464
                      • C:\Windows\SysWOW64\ComputerDefaults.exe
                        C:\Windows\System32\ComputerDefaults.exe
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:672
                        • C:\ProgramData\wfmvXgBuUDdBqIlTASGFDlESenpvRKyG.kaV\PiTKrMOfHIobhPdOppOHXoEuZWuZmDzx.iYf.exe
                          "PiTKrMOfHIobhPdOppOHXoEuZWuZmDzx.iYf.exe"
                          5⤵
                          • Executes dropped EXE
                          PID:1448
                    • C:\Windows\SysWOW64\cmd.exe
                      /c "C:\Windows\System32\ComputerDefaults.exe"
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:2108
                      • C:\Windows\SysWOW64\ComputerDefaults.exe
                        C:\Windows\System32\ComputerDefaults.exe
                        4⤵
                          PID:4836
                          • C:\ProgramData\MzVmLdCtWmljuFMsaNTHrPnLcEnsPvVK.rUt\xPdCiHoojNKnqVLxnYQvjXlnftqEkYjw.xWR.exe
                            "xPdCiHoojNKnqVLxnYQvjXlnftqEkYjw.xWR.exe"
                            5⤵
                            • Executes dropped EXE
                            PID:2448
                      • C:\Windows\SysWOW64\cmd.exe
                        /c "C:\Windows\System32\ComputerDefaults.exe"
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:360
                        • C:\Windows\SysWOW64\ComputerDefaults.exe
                          C:\Windows\System32\ComputerDefaults.exe
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:4224
                          • C:\ProgramData\tHtwskAfPFOjXfBjGucinxumXLkEOoAM.YDN\ResHucMrhcOzjnYowIOJaNhWTbwDZudq.vJF.exe
                            "ResHucMrhcOzjnYowIOJaNhWTbwDZudq.vJF.exe"
                            5⤵
                            • Executes dropped EXE
                            PID:2516
                      • C:\Windows\SysWOW64\cmd.exe
                        /c "C:\Windows\System32\ComputerDefaults.exe"
                        3⤵
                          PID:1540
                          • C:\Windows\SysWOW64\ComputerDefaults.exe
                            C:\Windows\System32\ComputerDefaults.exe
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:6028
                            • C:\ProgramData\cbVeuRnBGYFHhNWFCUJPiIurprvODZoj.zEZ\HNPSVBBchkZNXfPmQjXPATgqAoVsKwIf.pSl.exe
                              "HNPSVBBchkZNXfPmQjXPATgqAoVsKwIf.pSl.exe"
                              5⤵
                              • Executes dropped EXE
                              PID:1112
                        • C:\Windows\SysWOW64\cmd.exe
                          /c "C:\Windows\System32\ComputerDefaults.exe"
                          3⤵
                            PID:3096
                            • C:\Windows\SysWOW64\ComputerDefaults.exe
                              C:\Windows\System32\ComputerDefaults.exe
                              4⤵
                              • System Location Discovery: System Language Discovery
                              PID:5448
                              • C:\ProgramData\tawzUfvGorBCgZCGIyCIWvvRkytHtBzS.gmB\UJEfDgVrTtiPIDzftcsIMbttwjijIQbe.iJu.exe
                                "UJEfDgVrTtiPIDzftcsIMbttwjijIQbe.iJu.exe"
                                5⤵
                                • Executes dropped EXE
                                PID:5276
                          • C:\Windows\SysWOW64\cmd.exe
                            /c "C:\Windows\System32\ComputerDefaults.exe"
                            3⤵
                              PID:3216
                              • C:\Windows\SysWOW64\ComputerDefaults.exe
                                C:\Windows\System32\ComputerDefaults.exe
                                4⤵
                                • System Location Discovery: System Language Discovery
                                PID:2676
                                • C:\ProgramData\zjvZpblzjkoICzeUuYuMUtFvbYUCqgRA.cMa\jnscCPCYJKmUmIWoWVduUeFhpjtTiGZD.ltx.exe
                                  "jnscCPCYJKmUmIWoWVduUeFhpjtTiGZD.ltx.exe"
                                  5⤵
                                    PID:3124
                          • C:\ProgramData\uiuaJK.hvk\11458485.jaSI
                            C:\ProgramData\uiuaJK.hvk\11458485.jaSI
                            1⤵
                            • Executes dropped EXE
                            PID:3768
                          • C:\ProgramData\uiuaJK.hvk\2127976181.FWp
                            C:\ProgramData\uiuaJK.hvk\2127976181.FWp
                            1⤵
                            • Executes dropped EXE
                            PID:2816
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                            1⤵
                              PID:3924
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k GPSvcGroup
                              1⤵
                                PID:2996

                              Network

                                    MITRE ATT&CK Enterprise v16

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    slOfkAkbRLhVCyJYAYHsaYHtbiFJrFbD.DHh.exe
                                    • Path C:\ProgramData\BufsOxxQUKaTiOkRiaVdUjNBIHejPvHQ.bDZ\slOfkAkbRLhVCyJYAYHsaYHtbiFJrFbD.DHh.exe
                                    • Size 51KB
                                    • SHA256 ce6bb7eddc83762c708d4a41709ae00371dbdc09b2a380f28fa60b1edf917473
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    11458485.jaSI
                                    • Path C:\ProgramData\uiuaJK.hvk\11458485.jaSI
                                    • Size 17KB
                                    • SHA256 671e564fa73da5f33f6591d27eef6d3f02264c94f4cf85328bab1412a7fcb687
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    11458485.jaSI.ppt
                                    • Path C:\ProgramData\uiuaJK.hvk\11458485.jaSI.ppt
                                    • Size 17KB
                                    • SHA256 4df92dda94bde425df050a679eb5774be2f8fabaa1c3f5e1618a247c7f87a139
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    2127976181.FWp
                                    • Path C:\ProgramData\uiuaJK.hvk\2127976181.FWp
                                    • Size 32KB
                                    • SHA256 fb1c10d2d9e89ae8263faaed9b211bd1585896fc8eb4bc21622942a8a22cee09
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    2127976181.FWp.ppt
                                    • Path C:\ProgramData\uiuaJK.hvk\2127976181.FWp.ppt
                                    • Size 32KB
                                    • SHA256 5bb44bb2a9735b9b71e649635474cdae602e4f3c898ecfc4717cc7fea11e8570
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    memory/3768-4-0x0000000000010000-0x0000000000017000-memory.dmp
                                    Download