Overview

overview

7

Static

static

3

78acbe80bc...2d.dll

windows10-2004-x64

7

78acbe80bc...2d.dll

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/09/2026, 22:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    78acbe80bc152c548a7977b9c2decac0acf2042927a4b10bb319af84dbb5aa2d.dll
  • Size 9.1MB
  • Sample260922-2hezaatdja
  • SHA256 78acbe80bc152c548a7977b9c2decac0acf2042927a4b10bb319af84dbb5aa2d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 37 IoCs
  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 51 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 56 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\78acbe80bc152c548a7977b9c2decac0acf2042927a4b10bb319af84dbb5aa2d.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3256
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\78acbe80bc152c548a7977b9c2decac0acf2042927a4b10bb319af84dbb5aa2d.dll,#1
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3192
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3756
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1508
          • C:\ProgramData\kIZlHZWbZtIZHlMgHzXcOseFAwoeivnv.FpY\yQIzRoKmWgMEhBIsCDZUMpIwJtHfAHwC.ZHc.exe
            "yQIzRoKmWgMEhBIsCDZUMpIwJtHfAHwC.ZHc.exe"
            5⤵
            • Executes dropped EXE
            PID:6080
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5440
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5656
          • C:\ProgramData\bwJaIOodvdNmmuJWzFnuAzahAJTUljzx.FTP\YgPBeCTwVVtSTrNtrJrRfjiScOJHhdCN.tdo.exe
            "YgPBeCTwVVtSTrNtrJrRfjiScOJHhdCN.tdo.exe"
            5⤵
            • Executes dropped EXE
            PID:1196
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5652
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4544
          • C:\ProgramData\hdRZjqCYZghfpiUnTYOCOvwMBbJTBWqS.vqF\BPYLaPivVxQvUFtHTHEqMpioGFUYSqYM.eTW.exe
            "BPYLaPivVxQvUFtHTHEqMpioGFUYSqYM.eTW.exe"
            5⤵
            • Executes dropped EXE
            PID:5176
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3464
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3800
          • C:\ProgramData\HcikcknsZMIoapyDpmqJksPrqIeikjHm.NTN\nnWRgFPvrYvGPSRLtJsligMxdkvoEmgl.eVo.exe
            "nnWRgFPvrYvGPSRLtJsligMxdkvoEmgl.eVo.exe"
            5⤵
            • Executes dropped EXE
            PID:2432
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2232
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1840
          • C:\ProgramData\zMYffrllwbLcJJxPMeclWEMzojavQivA.xss\LtmVpzeNTexsEJsmjIzeQNEkaxMaWIpz.XhD.exe
            "LtmVpzeNTexsEJsmjIzeQNEkaxMaWIpz.XhD.exe"
            5⤵
            • Executes dropped EXE
            PID:1188
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4972
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2868
          • C:\ProgramData\rNdrogdXJLBovKXxIRVaVsxaqhEkCaiE.YVL\hwZPaMCAuoKxWymdvUfoarTNMjZKXSSJ.ApW.exe
            "hwZPaMCAuoKxWymdvUfoarTNMjZKXSSJ.ApW.exe"
            5⤵
            • Executes dropped EXE
            PID:1672
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3516
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4540
          • C:\ProgramData\CXCgClIEcEbVwvcTyQwQyrRaNOYXeqrC.Rge\RESvivCRAMgfeGtguCISdbGAAxjzisFp.EHn.exe
            "RESvivCRAMgfeGtguCISdbGAAxjzisFp.EHn.exe"
            5⤵
            • Executes dropped EXE
            PID:3432
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5952
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3224
          • C:\ProgramData\mJVgoKspIcguXUAsrBQpmgELRYhkWFOI.iIs\dTByDcZDgHRGcoxTiAeoIWcjtDcsDVMl.zgH.exe
            "dTByDcZDgHRGcoxTiAeoIWcjtDcsDVMl.zgH.exe"
            5⤵
            • Executes dropped EXE
            PID:5668
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5032
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5924
          • C:\ProgramData\xlwDWvspCcCNopenttupCYKaFDmZRUMT.Rpk\DPEjgmdnubkZfxGEByPBLAipebKhhTem.tMa.exe
            "DPEjgmdnubkZfxGEByPBLAipebKhhTem.tMa.exe"
            5⤵
            • Executes dropped EXE
            PID:5900
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5892
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2456
          • C:\ProgramData\PCMpSdYUjYvyvpHmJCnXdgGVMsbTDaGK.ZpC\ngGrNlkewhkrNcSzNXhtRIVFYaGGgJdr.Nbr.exe
            "ngGrNlkewhkrNcSzNXhtRIVFYaGGgJdr.Nbr.exe"
            5⤵
            • Executes dropped EXE
            PID:2564
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2260
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3376
          • C:\ProgramData\CycIkKJqsintaGrKcSDTxtEoFyuSxPve.yix\MQTPTpVguDMkyNnnDMvQdMunHCCgDYvi.QUV.exe
            "MQTPTpVguDMkyNnnDMvQdMunHCCgDYvi.QUV.exe"
            5⤵
            • Executes dropped EXE
            PID:2428
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4584
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1068
          • C:\ProgramData\qYnZoRulomUoctxofPiJngqiIxSbQzes.irD\MrNYavYuqeihpoOGTfDIfgrllhoLajQk.zet.exe
            "MrNYavYuqeihpoOGTfDIfgrllhoLajQk.zet.exe"
            5⤵
            • Executes dropped EXE
            PID:3328
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5228
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5808
          • C:\ProgramData\tHVuqHcgLWAykexVGUxjHXgaUWyzhzLu.jCU\XoGagvuzqDvJJsnxWZEhCTkFhwsEDNbc.TVg.exe
            "XoGagvuzqDvJJsnxWZEhCTkFhwsEDNbc.TVg.exe"
            5⤵
            • Executes dropped EXE
            PID:6016
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3008
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:200
          • C:\ProgramData\RVBtMYLbbjJXmyYPNbTZOSqAHbhHoYSw.VJk\ccNbakGwgwoEAKLbVxVhzAxBBJaKWNHG.nyN.exe
            "ccNbakGwgwoEAKLbVxVhzAxBBJaKWNHG.nyN.exe"
            5⤵
            • Executes dropped EXE
            PID:2036
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:856
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4324
          • C:\ProgramData\ogFYmQbQYqeRsxBSlOeqWhUMBWJADMXB.hvD\dVosSIRryLfjBAfXYQVFVgOSZuZbvHwY.CUH.exe
            "dVosSIRryLfjBAfXYQVFVgOSZuZbvHwY.CUH.exe"
            5⤵
            • Executes dropped EXE
            PID:1780
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4088
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5976
          • C:\ProgramData\WeKLhCwuDgdbqYqdFdfmWIMaENmGaDko.oLc\fudIlbatHRbzoNfMeqdaTEGwYvJthblD.MFq.exe
            "fudIlbatHRbzoNfMeqdaTEGwYvJthblD.MFq.exe"
            5⤵
            • Executes dropped EXE
            PID:2492
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3264
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1392
          • C:\ProgramData\pxoiRloDzjWfYiMkwXAOvnJHUjCPSAHw.COG\HehUNtMkwsHxdQyuxMGSCrpBpdfrYUaN.NiC.exe
            "HehUNtMkwsHxdQyuxMGSCrpBpdfrYUaN.NiC.exe"
            5⤵
            • Executes dropped EXE
            PID:4264
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1764
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4660
          • C:\ProgramData\HQYmEnLeFAoETGGcUtsUosPCKSiUAmJW.Vgr\kafOUeOfAPVezGOjqYoZympOydXVEfbC.QLs.exe
            "kafOUeOfAPVezGOjqYoZympOydXVEfbC.QLs.exe"
            5⤵
            • Executes dropped EXE
            PID:720
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5424
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:804
          • C:\ProgramData\HQSYWLPyoZPxmJhwEJjbDEWMAxEpCXBw.ovX\ZmmNbUFAhLhHpTFffbGwgydvvHhhiixv.YdK.exe
            "ZmmNbUFAhLhHpTFffbGwgydvvHhhiixv.YdK.exe"
            5⤵
            • Executes dropped EXE
            PID:724
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2236
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5856
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3076
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2028
          • C:\ProgramData\vBDjrwnHNugWnMEtdNuzwDqdPEQUWlIl.chd\KkkCBiOfWBmeMlHGGkxxlzrNVXZXapWf.reg.exe
            "KkkCBiOfWBmeMlHGGkxxlzrNVXZXapWf.reg.exe"
            5⤵
            • Executes dropped EXE
            PID:5860
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
          PID:4312
          • C:\Windows\SysWOW64\ComputerDefaults.exe
            C:\Windows\System32\ComputerDefaults.exe
            4⤵
              PID:3052
              • C:\ProgramData\FwgJeNdhunkhmIEXGXEjgPsUGjdCHxLQ.bJC\McVjVeCoQauwoerZyubNLonhFTfyNqMG.HsJ.exe
                "McVjVeCoQauwoerZyubNLonhFTfyNqMG.HsJ.exe"
                5⤵
                • Executes dropped EXE
                PID:4528
          • C:\Windows\SysWOW64\cmd.exe
            /c "C:\Windows\System32\ComputerDefaults.exe"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2424
            • C:\Windows\SysWOW64\ComputerDefaults.exe
              C:\Windows\System32\ComputerDefaults.exe
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2136
              • C:\ProgramData\QyaBOCuAkDfIjDLVDJUzvKtNLHqfxcWb.sIJ\iJsutyRgfLiiTNKqrOClAPGRQWoGyIcH.YiI.exe
                "iJsutyRgfLiiTNKqrOClAPGRQWoGyIcH.YiI.exe"
                5⤵
                • Executes dropped EXE
                PID:4480
          • C:\Windows\SysWOW64\cmd.exe
            /c "C:\Windows\System32\ComputerDefaults.exe"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:4964
            • C:\Windows\SysWOW64\ComputerDefaults.exe
              C:\Windows\System32\ComputerDefaults.exe
              4⤵
                PID:5080
                • C:\ProgramData\aRLTqPopAAOQgfkYzEKcgEyvbpciCtzn.ZTn\RxWGPRUpyBfcSQlquUmnLovWdnoVIHfT.Ypt.exe
                  "RxWGPRUpyBfcSQlquUmnLovWdnoVIHfT.Ypt.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:3200
            • C:\Windows\SysWOW64\cmd.exe
              /c "C:\Windows\System32\ComputerDefaults.exe"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:3452
              • C:\Windows\SysWOW64\ComputerDefaults.exe
                C:\Windows\System32\ComputerDefaults.exe
                4⤵
                • System Location Discovery: System Language Discovery
                PID:5156
                • C:\ProgramData\iDBGJxBjlzOJtwVWbKmOrFAWiGvpPXez.aOQ\iiSWAuUrexNWcLdpXvlKAPyQqBpgLAfo.GbF.exe
                  "iiSWAuUrexNWcLdpXvlKAPyQqBpgLAfo.GbF.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:2308
            • C:\Windows\SysWOW64\cmd.exe
              /c "C:\Windows\System32\ComputerDefaults.exe"
              3⤵
                PID:4424
                • C:\Windows\SysWOW64\ComputerDefaults.exe
                  C:\Windows\System32\ComputerDefaults.exe
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:4892
                  • C:\ProgramData\cQrcegMMyYCgNDYJgqBBrkDofmAurrqe.yJu\sPhwfdfJVGtqSiaGMYCCLEvYpgAivQWc.AvE.exe
                    "sPhwfdfJVGtqSiaGMYCCLEvYpgAivQWc.AvE.exe"
                    5⤵
                    • Executes dropped EXE
                    PID:6052
              • C:\Windows\SysWOW64\cmd.exe
                /c "C:\Windows\System32\ComputerDefaults.exe"
                3⤵
                  PID:2968
                  • C:\Windows\SysWOW64\ComputerDefaults.exe
                    C:\Windows\System32\ComputerDefaults.exe
                    4⤵
                      PID:3228
                      • C:\ProgramData\NugzYIjwqyFpliBfaDJDIWTlYQmnbKDT.qES\igtluppbGtIlhWVjPpGcfTgSldRmNqpX.pFW.exe
                        "igtluppbGtIlhWVjPpGcfTgSldRmNqpX.pFW.exe"
                        5⤵
                        • Executes dropped EXE
                        PID:2784
                  • C:\Windows\SysWOW64\cmd.exe
                    /c "C:\Windows\System32\ComputerDefaults.exe"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:4548
                    • C:\Windows\SysWOW64\ComputerDefaults.exe
                      C:\Windows\System32\ComputerDefaults.exe
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:4632
                      • C:\ProgramData\gkDAvYnYqueAbjSrbqjUhyLzBsKsTqkI.FEI\eJDZtNmaVEvgbOrhRJRAOstGkZdvvzkA.mHT.exe
                        "eJDZtNmaVEvgbOrhRJRAOstGkZdvvzkA.mHT.exe"
                        5⤵
                        • Executes dropped EXE
                        PID:5044
                  • C:\Windows\SysWOW64\cmd.exe
                    /c "C:\Windows\System32\ComputerDefaults.exe"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:4200
                    • C:\Windows\SysWOW64\ComputerDefaults.exe
                      C:\Windows\System32\ComputerDefaults.exe
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:2364
                      • C:\ProgramData\azanaIqVdjULHVZjWfYExQzORmPCaPGN.eoR\YcJhGSxBDcUXxaWvAUMqiHJNKMbebaqm.EWv.exe
                        "YcJhGSxBDcUXxaWvAUMqiHJNKMbebaqm.EWv.exe"
                        5⤵
                        • Executes dropped EXE
                        PID:3708
                  • C:\Windows\SysWOW64\cmd.exe
                    /c "C:\Windows\System32\ComputerDefaults.exe"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:5784
                    • C:\Windows\SysWOW64\ComputerDefaults.exe
                      C:\Windows\System32\ComputerDefaults.exe
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:6060
                  • C:\Windows\SysWOW64\cmd.exe
                    /c "C:\Windows\System32\ComputerDefaults.exe"
                    3⤵
                      PID:4460
                      • C:\Windows\SysWOW64\ComputerDefaults.exe
                        C:\Windows\System32\ComputerDefaults.exe
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:2040
                        • C:\ProgramData\sDEVoMqlnKWgaKXwWXenSxLowwjhYXal.BaE\wNJLQdPqFPynOgTstFiSuHmhArvRUUoL.HES.exe
                          "wNJLQdPqFPynOgTstFiSuHmhArvRUUoL.HES.exe"
                          5⤵
                          • Executes dropped EXE
                          PID:720
                    • C:\Windows\SysWOW64\cmd.exe
                      /c "C:\Windows\System32\ComputerDefaults.exe"
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:556
                      • C:\Windows\SysWOW64\ComputerDefaults.exe
                        C:\Windows\System32\ComputerDefaults.exe
                        4⤵
                          PID:4388
                      • C:\Windows\SysWOW64\cmd.exe
                        /c "C:\Windows\System32\ComputerDefaults.exe"
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:2016
                        • C:\Windows\SysWOW64\ComputerDefaults.exe
                          C:\Windows\System32\ComputerDefaults.exe
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:2956
                          • C:\ProgramData\sGflQcyIbvCQrDAzIhlqbbGtCAeGbVzN.KRz\BlIGDjmkyjpaLXpuSXbpMCXxnmmQnvna.XBV.exe
                            "BlIGDjmkyjpaLXpuSXbpMCXxnmmQnvna.XBV.exe"
                            5⤵
                            • Executes dropped EXE
                            PID:4624
                      • C:\Windows\SysWOW64\cmd.exe
                        /c "C:\Windows\System32\ComputerDefaults.exe"
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:1556
                        • C:\Windows\SysWOW64\ComputerDefaults.exe
                          C:\Windows\System32\ComputerDefaults.exe
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:1332
                      • C:\Windows\SysWOW64\cmd.exe
                        /c "C:\Windows\System32\ComputerDefaults.exe"
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:1660
                        • C:\Windows\SysWOW64\ComputerDefaults.exe
                          C:\Windows\System32\ComputerDefaults.exe
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:4408
                          • C:\ProgramData\QlxzCvKGKCUCrQlyoMPAYwTUICSmXeIk.CtX\SOpJlqpDmwFQsXIbxmmWppYKdvwPwDLy.SJg.exe
                            "SOpJlqpDmwFQsXIbxmmWppYKdvwPwDLy.SJg.exe"
                            5⤵
                            • Executes dropped EXE
                            PID:832
                      • C:\Windows\SysWOW64\cmd.exe
                        /c "C:\Windows\System32\ComputerDefaults.exe"
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:6032
                        • C:\Windows\SysWOW64\ComputerDefaults.exe
                          C:\Windows\System32\ComputerDefaults.exe
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:2428
                          • C:\ProgramData\qEhHkWtzqGRyQYKYjqGuWoLYmGhyATRh.Phg\OhmzNDliAGQzejGgzHkBHXarfxtYFfBf.GpG.exe
                            "OhmzNDliAGQzejGgzHkBHXarfxtYFfBf.GpG.exe"
                            5⤵
                            • Executes dropped EXE
                            PID:360
                      • C:\Windows\SysWOW64\cmd.exe
                        /c "C:\Windows\System32\ComputerDefaults.exe"
                        3⤵
                          PID:4356
                          • C:\Windows\SysWOW64\ComputerDefaults.exe
                            C:\Windows\System32\ComputerDefaults.exe
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:924
                            • C:\ProgramData\WDsruojcndhoEGbyCyYLRTqFfeoRptRF.eeV\XHMkaWHchVWFPNDturcGFKRAwfLNaKPe.RIi.exe
                              "XHMkaWHchVWFPNDturcGFKRAwfLNaKPe.RIi.exe"
                              5⤵
                              • Executes dropped EXE
                              PID:3216
                        • C:\Windows\SysWOW64\cmd.exe
                          /c "C:\Windows\System32\ComputerDefaults.exe"
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:2096
                          • C:\Windows\SysWOW64\ComputerDefaults.exe
                            C:\Windows\System32\ComputerDefaults.exe
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:2568
                            • C:\ProgramData\WnCBNuXqNiXXjlffAxGvvQvllVzhKLTY.Gnr\uaaBovQtjmMWwRdBoMujZguKorZObpTF.uqv.exe
                              "uaaBovQtjmMWwRdBoMujZguKorZObpTF.uqv.exe"
                              5⤵
                              • Executes dropped EXE
                              PID:1552
                        • C:\Windows\SysWOW64\cmd.exe
                          /c "C:\Windows\System32\ComputerDefaults.exe"
                          3⤵
                            PID:3060
                            • C:\Windows\SysWOW64\ComputerDefaults.exe
                              C:\Windows\System32\ComputerDefaults.exe
                              4⤵
                              • System Location Discovery: System Language Discovery
                              PID:2628
                              • C:\ProgramData\SjNZVqhhGufZuFGbglhbjykBnKtnKWzf.EfG\JeGHklwQCJDsQKqqrcgCDJckrhlfsqkK.Puy.exe
                                "JeGHklwQCJDsQKqqrcgCDJckrhlfsqkK.Puy.exe"
                                5⤵
                                • Executes dropped EXE
                                PID:4092
                          • C:\Windows\SysWOW64\cmd.exe
                            /c "C:\Windows\System32\ComputerDefaults.exe"
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:6072
                            • C:\Windows\SysWOW64\ComputerDefaults.exe
                              C:\Windows\System32\ComputerDefaults.exe
                              4⤵
                              • System Location Discovery: System Language Discovery
                              PID:1780
                              • C:\ProgramData\aKshpQwefztzeKldcqqYWQGtWmUlcyHC.Xcw\OLUUsEplTEAbwsfzpwBXmAJnGrrlfnzf.Nmt.exe
                                "OLUUsEplTEAbwsfzpwBXmAJnGrrlfnzf.Nmt.exe"
                                5⤵
                                • Executes dropped EXE
                                PID:3528
                          • C:\Windows\SysWOW64\cmd.exe
                            /c "C:\Windows\System32\ComputerDefaults.exe"
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:1364
                            • C:\Windows\SysWOW64\ComputerDefaults.exe
                              C:\Windows\System32\ComputerDefaults.exe
                              4⤵
                              • System Location Discovery: System Language Discovery
                              PID:3624
                              • C:\ProgramData\SYLccMRMKHRtSbTkGygVHWbBvYdPSoqS.zvp\pOpLFrDVziSSuxrvQwjdddnvgKougDSL.xPr.exe
                                "pOpLFrDVziSSuxrvQwjdddnvgKougDSL.xPr.exe"
                                5⤵
                                • Executes dropped EXE
                                PID:1592
                          • C:\Windows\SysWOW64\cmd.exe
                            /c "C:\Windows\System32\ComputerDefaults.exe"
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:2944
                            • C:\Windows\SysWOW64\ComputerDefaults.exe
                              C:\Windows\System32\ComputerDefaults.exe
                              4⤵
                                PID:1976
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                          1⤵
                            PID:5360

                          Network

                                MITRE ATT&CK Enterprise v16

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                89754933.nHId
                                • Path C:\ProgramData\NmjdoD.wQM\89754933.nHId
                                • Size 17KB
                                • SHA256 671e564fa73da5f33f6591d27eef6d3f02264c94f4cf85328bab1412a7fcb687
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                89754933.nHId.ppt
                                • Path C:\ProgramData\NmjdoD.wQM\89754933.nHId.ppt
                                • Size 17KB
                                • SHA256 4df92dda94bde425df050a679eb5774be2f8fabaa1c3f5e1618a247c7f87a139
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                9315129827.xav
                                • Path C:\ProgramData\NmjdoD.wQM\9315129827.xav
                                • Size 32KB
                                • SHA256 fb1c10d2d9e89ae8263faaed9b211bd1585896fc8eb4bc21622942a8a22cee09
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                9315129827.xav.ppt
                                • Path C:\ProgramData\NmjdoD.wQM\9315129827.xav.ppt
                                • Size 32KB
                                • SHA256 5bb44bb2a9735b9b71e649635474cdae602e4f3c898ecfc4717cc7fea11e8570
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                yQIzRoKmWgMEhBIsCDZUMpIwJtHfAHwC.ZHc.exe
                                • Path C:\ProgramData\kIZlHZWbZtIZHlMgHzXcOseFAwoeivnv.FpY\yQIzRoKmWgMEhBIsCDZUMpIwJtHfAHwC.ZHc.exe
                                • Size 51KB
                                • SHA256 ce6bb7eddc83762c708d4a41709ae00371dbdc09b2a380f28fa60b1edf917473
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download