Overview

overview

7

Static

static

3

9bffdc4479...36.dll

windows10-2004-x64

7

9bffdc4479...36.dll

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/09/2026, 22:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    9bffdc447940a1cb4eb665ed63e0d9d0356e8e72a35ebe1c140114a99be2dd36.dll
  • Size 9.1MB
  • Sample260922-2hheeazyf1
  • SHA256 9bffdc447940a1cb4eb665ed63e0d9d0356e8e72a35ebe1c140114a99be2dd36
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 34 IoCs
  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 50 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 57 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\9bffdc447940a1cb4eb665ed63e0d9d0356e8e72a35ebe1c140114a99be2dd36.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5620
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\9bffdc447940a1cb4eb665ed63e0d9d0356e8e72a35ebe1c140114a99be2dd36.dll,#1
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2152
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2708
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4728
          • C:\ProgramData\iJQVnGYrSOngbwXgXOsUIiLFatEsHQOp.vay\wtKjUwwfFkNzXkZlMDHFRGflwGMcAskn.SQY.exe
            "wtKjUwwfFkNzXkZlMDHFRGflwGMcAskn.SQY.exe"
            5⤵
            • Executes dropped EXE
            PID:4676
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1412
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3244
          • C:\ProgramData\HhxGUbkovUzQsMVTTiZgeBJqJKvMLrie.Jsp\TxNZNGWNcIKzXxsGWGZzkFJotMlyYmgc.Yrg.exe
            "TxNZNGWNcIKzXxsGWGZzkFJotMlyYmgc.Yrg.exe"
            5⤵
            • Executes dropped EXE
            PID:2560
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3368
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3008
          • C:\ProgramData\BGVUKLtYGslkUONqAsvvoGByeXSQVdpn.bKS\DSdYdLliPAEibHItyTUDpFoEuCbCcGbz.mYY.exe
            "DSdYdLliPAEibHItyTUDpFoEuCbCcGbz.mYY.exe"
            5⤵
            • Executes dropped EXE
            PID:2992
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1084
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5644
          • C:\ProgramData\yRhxTxSAzPjbtmAEVoGaRCsPFVTooFre.hYc\BEKNanWBVTyFrAsOzjsrripGJxgaoMNm.yJm.exe
            "BEKNanWBVTyFrAsOzjsrripGJxgaoMNm.yJm.exe"
            5⤵
            • Executes dropped EXE
            PID:4564
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3676
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5696
          • C:\ProgramData\eYfZShTAujylLeLXeUyxwfzHhjJljrKM.hkJ\jQKEELKHcAMrcncQquIUvjdQLmiXYZFI.oMN.exe
            "jQKEELKHcAMrcncQquIUvjdQLmiXYZFI.oMN.exe"
            5⤵
            • Executes dropped EXE
            PID:5876
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4648
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3392
          • C:\ProgramData\LrFagSDipIsWCywAJGTIummTdxyWmMkH.ZIo\joaNckeqdCVwSdapMUyubCqzuZJKKiCt.Ncw.exe
            "joaNckeqdCVwSdapMUyubCqzuZJKKiCt.Ncw.exe"
            5⤵
            • Executes dropped EXE
            PID:5736
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2236
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3360
          • C:\ProgramData\DPuiLYhCwCKkqkQoBgqgZDNuHWosPmPV.gNT\cNkDyooCzxYVGtsJEjeDpLvPtwmMiXUj.OwT.exe
            "cNkDyooCzxYVGtsJEjeDpLvPtwmMiXUj.OwT.exe"
            5⤵
            • Executes dropped EXE
            PID:5472
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4364
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2340
          • C:\ProgramData\XXYcjhGumnDlexGRGQdOQRTbysPeuUcw.OYw\byzUbowqznCgEPblPLiikfhWnSSTObgz.fSU.exe
            "byzUbowqznCgEPblPLiikfhWnSSTObgz.fSU.exe"
            5⤵
            • Executes dropped EXE
            PID:2668
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4076
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4956
          • C:\ProgramData\bFtcseBkaBpfOVzjVwFyZEmVbvjRNMvC.kdM\qcJhOzQrFGklxvbCTvIUKIXxhzvINiXY.Rax.exe
            "qcJhOzQrFGklxvbCTvIUKIXxhzvINiXY.Rax.exe"
            5⤵
            • Executes dropped EXE
            PID:4572
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3096
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4472
          • C:\ProgramData\JhoXuVUqiRESBHTHYukFdrBomPBYIpOK.xHG\ZsMPVOatjWMLEDLjTQHfomaGatZmoPIw.cub.exe
            "ZsMPVOatjWMLEDLjTQHfomaGatZmoPIw.cub.exe"
            5⤵
            • Executes dropped EXE
            PID:4084
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1072
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5064
          • C:\ProgramData\dxbXjCEqcMWOlLeyWHurfgPFadHFBUsl.bff\QCGIYsszEQFCaNekxHQkaWopWcMpGhbU.PLT.exe
            "QCGIYsszEQFCaNekxHQkaWopWcMpGhbU.PLT.exe"
            5⤵
            • Executes dropped EXE
            PID:2280
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2932
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4976
          • C:\ProgramData\lsVmcQECSUQJDbzixIXAQrKrzJbZgadm.GKG\cUzFXTHKocRMRmelpfvCRuiXdiXaFBFA.jNN.exe
            "cUzFXTHKocRMRmelpfvCRuiXdiXaFBFA.jNN.exe"
            5⤵
            • Executes dropped EXE
            PID:5724
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2996
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:6108
          • C:\ProgramData\soDRvNhQMbYedtFQxgGHFYJFUCkfCkbD.PUL\UXqxtIZSdiTaDvmRPOpLIrfLzXchOPmn.HUJ.exe
            "UXqxtIZSdiTaDvmRPOpLIrfLzXchOPmn.HUJ.exe"
            5⤵
            • Executes dropped EXE
            PID:3196
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4464
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:692
          • C:\ProgramData\HqtWKYLWjeMNITIhsVdDINEOLjrXPtdA.cQV\eFVlYUdvPtYHtkpmItZraJJyfIfPQjDc.bYq.exe
            "eFVlYUdvPtYHtkpmItZraJJyfIfPQjDc.bYq.exe"
            5⤵
            • Executes dropped EXE
            PID:5532
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:8
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4208
          • C:\ProgramData\ysyEFFEIujmDRvtvHDGkgwQlsyWaCZbm.gDm\qJrDmpfCfotEKWwSayrHydWprVHpXPrC.mOB.exe
            "qJrDmpfCfotEKWwSayrHydWprVHpXPrC.mOB.exe"
            5⤵
            • Executes dropped EXE
            PID:1988
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4340
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
            PID:4836
        • C:\Windows\SysWOW64\cmd.exe
          /c "C:\Windows\System32\ComputerDefaults.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1376
          • C:\Windows\SysWOW64\ComputerDefaults.exe
            C:\Windows\System32\ComputerDefaults.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4304
            • C:\ProgramData\XJsbaZRIvitJUwHkVhciTarDpyKMyIrg.jUE\JyTXCDSBiwlKKBiMhGNwDqPxwAEkDwDn.ClH.exe
              "JyTXCDSBiwlKKBiMhGNwDqPxwAEkDwDn.ClH.exe"
              5⤵
              • Executes dropped EXE
              PID:2232
        • C:\Windows\SysWOW64\cmd.exe
          /c "C:\Windows\System32\ComputerDefaults.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5184
          • C:\Windows\SysWOW64\ComputerDefaults.exe
            C:\Windows\System32\ComputerDefaults.exe
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:992
            • C:\ProgramData\XJsbaZRIvitJUwHkVhciTarDpyKMyIrg.jUE\JyTXCDSBiwlKKBiMhGNwDqPxwAEkDwDn.ClH.exe
              "JyTXCDSBiwlKKBiMhGNwDqPxwAEkDwDn.ClH.exe"
              5⤵
              • Executes dropped EXE
              PID:5444
        • C:\Windows\SysWOW64\cmd.exe
          /c "C:\Windows\System32\ComputerDefaults.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4644
          • C:\Windows\SysWOW64\ComputerDefaults.exe
            C:\Windows\System32\ComputerDefaults.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4680
            • C:\ProgramData\ELlEmTLDKAhLpJnWawkkmtwAlCgjnqJK.xPJ\PjursAwKebRTcFVYNIDqRrGLilvyryom.yMI.exe
              "PjursAwKebRTcFVYNIDqRrGLilvyryom.yMI.exe"
              5⤵
              • Executes dropped EXE
              PID:4100
        • C:\Windows\SysWOW64\cmd.exe
          /c "C:\Windows\System32\ComputerDefaults.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4296
          • C:\Windows\SysWOW64\ComputerDefaults.exe
            C:\Windows\System32\ComputerDefaults.exe
            4⤵
            • System Location Discovery: System Language Discovery
            PID:5236
        • C:\Windows\SysWOW64\cmd.exe
          /c "C:\Windows\System32\ComputerDefaults.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2840
          • C:\Windows\SysWOW64\ComputerDefaults.exe
            C:\Windows\System32\ComputerDefaults.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4148
            • C:\ProgramData\PEBTAfriCOlrirSfbKLXeEBtFfqyLATI.kMG\VPtSLQqtBVToGPxrUJKLfLyFpDPymmjU.lnd.exe
              "VPtSLQqtBVToGPxrUJKLfLyFpDPymmjU.lnd.exe"
              5⤵
              • Executes dropped EXE
              PID:2856
        • C:\Windows\SysWOW64\cmd.exe
          /c "C:\Windows\System32\ComputerDefaults.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3016
          • C:\Windows\SysWOW64\ComputerDefaults.exe
            C:\Windows\System32\ComputerDefaults.exe
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4416
        • C:\Windows\SysWOW64\cmd.exe
          /c "C:\Windows\System32\ComputerDefaults.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:5308
          • C:\Windows\SysWOW64\ComputerDefaults.exe
            C:\Windows\System32\ComputerDefaults.exe
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2036
            • C:\ProgramData\DOKnbvrxHuZEpGGjgptDOMnsNdxsETct.DOf\wrudAbrRFkHgbYkSahiDZFPnltpfCHTh.Ysm.exe
              "wrudAbrRFkHgbYkSahiDZFPnltpfCHTh.Ysm.exe"
              5⤵
              • Executes dropped EXE
              PID:5724
        • C:\Windows\SysWOW64\cmd.exe
          /c "C:\Windows\System32\ComputerDefaults.exe"
          3⤵
            PID:2900
            • C:\Windows\SysWOW64\ComputerDefaults.exe
              C:\Windows\System32\ComputerDefaults.exe
              4⤵
              • System Location Discovery: System Language Discovery
              PID:4764
          • C:\Windows\SysWOW64\cmd.exe
            /c "C:\Windows\System32\ComputerDefaults.exe"
            3⤵
              PID:1444
              • C:\Windows\SysWOW64\ComputerDefaults.exe
                C:\Windows\System32\ComputerDefaults.exe
                4⤵
                  PID:2664
                  • C:\ProgramData\wXdLrPsMsGXZWcmwJMlbYzGVRnNNVVEJ.yOC\tindjpTRNUkHqQwCIuACEWEzkMbTcOTa.KVq.exe
                    "tindjpTRNUkHqQwCIuACEWEzkMbTcOTa.KVq.exe"
                    5⤵
                    • Executes dropped EXE
                    PID:1112
              • C:\Windows\SysWOW64\cmd.exe
                /c "C:\Windows\System32\ComputerDefaults.exe"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:1136
                • C:\Windows\SysWOW64\ComputerDefaults.exe
                  C:\Windows\System32\ComputerDefaults.exe
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:5752
              • C:\Windows\SysWOW64\cmd.exe
                /c "C:\Windows\System32\ComputerDefaults.exe"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:1356
                • C:\Windows\SysWOW64\ComputerDefaults.exe
                  C:\Windows\System32\ComputerDefaults.exe
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:3396
                  • C:\ProgramData\iYhkNLNkEUzRGUXLPjDXsEynIpfVAKCj.Drh\gAUfLrLWCwUmUzcuQSwtpRupGMSEkdlr.CYj.exe
                    "gAUfLrLWCwUmUzcuQSwtpRupGMSEkdlr.CYj.exe"
                    5⤵
                    • Executes dropped EXE
                    PID:2408
              • C:\Windows\SysWOW64\cmd.exe
                /c "C:\Windows\System32\ComputerDefaults.exe"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:1308
                • C:\Windows\SysWOW64\ComputerDefaults.exe
                  C:\Windows\System32\ComputerDefaults.exe
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:244
              • C:\Windows\SysWOW64\cmd.exe
                /c "C:\Windows\System32\ComputerDefaults.exe"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:2956
                • C:\Windows\SysWOW64\ComputerDefaults.exe
                  C:\Windows\System32\ComputerDefaults.exe
                  4⤵
                    PID:4580
                    • C:\ProgramData\uXVVUKYkJiMNkdhMSdUDlzYibdknGGAX.ogL\RVrQWoFaLFfOisvjJAckSNOywMGwvzUZ.FLl.exe
                      "RVrQWoFaLFfOisvjJAckSNOywMGwvzUZ.FLl.exe"
                      5⤵
                      • Executes dropped EXE
                      PID:4700
                • C:\Windows\SysWOW64\cmd.exe
                  /c "C:\Windows\System32\ComputerDefaults.exe"
                  3⤵
                    PID:5980
                    • C:\Windows\SysWOW64\ComputerDefaults.exe
                      C:\Windows\System32\ComputerDefaults.exe
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:3640
                  • C:\Windows\SysWOW64\cmd.exe
                    /c "C:\Windows\System32\ComputerDefaults.exe"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:1976
                    • C:\Windows\SysWOW64\ComputerDefaults.exe
                      C:\Windows\System32\ComputerDefaults.exe
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:2200
                      • C:\ProgramData\DfPDIWdiUprCwMXfwERWRErYccvSSNts.Mze\lhHDElhvScIYUbBiJMQrhXFJxyWuApoD.rJq.exe
                        "lhHDElhvScIYUbBiJMQrhXFJxyWuApoD.rJq.exe"
                        5⤵
                        • Executes dropped EXE
                        PID:3380
                  • C:\Windows\SysWOW64\cmd.exe
                    /c "C:\Windows\System32\ComputerDefaults.exe"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:4100
                    • C:\Windows\SysWOW64\ComputerDefaults.exe
                      C:\Windows\System32\ComputerDefaults.exe
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:4528
                  • C:\Windows\SysWOW64\cmd.exe
                    /c "C:\Windows\System32\ComputerDefaults.exe"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:4932
                    • C:\Windows\SysWOW64\ComputerDefaults.exe
                      C:\Windows\System32\ComputerDefaults.exe
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:2508
                      • C:\ProgramData\ahlKEUuYzSMIyZJoDIWYfBbBMCZbVzga.Nki\xQAGTPoHzzNLywdHEPLwRnjCuoVcVPxE.CpJ.exe
                        "xQAGTPoHzzNLywdHEPLwRnjCuoVcVPxE.CpJ.exe"
                        5⤵
                        • Executes dropped EXE
                        PID:4712
                  • C:\Windows\SysWOW64\cmd.exe
                    /c "C:\Windows\System32\ComputerDefaults.exe"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:1680
                    • C:\Windows\SysWOW64\ComputerDefaults.exe
                      C:\Windows\System32\ComputerDefaults.exe
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:3364
                      • C:\ProgramData\lDbEcbJYRMxhlDVuuzplooAdQkZlqZId.YIz\YqxVHLFxoKvxXEIdpcQXBroNiMbnbnVX.jRv.exe
                        "YqxVHLFxoKvxXEIdpcQXBroNiMbnbnVX.jRv.exe"
                        5⤵
                        • Executes dropped EXE
                        PID:4840
                  • C:\Windows\SysWOW64\cmd.exe
                    /c "C:\Windows\System32\ComputerDefaults.exe"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:1628
                    • C:\Windows\SysWOW64\ComputerDefaults.exe
                      C:\Windows\System32\ComputerDefaults.exe
                      4⤵
                        PID:4632
                        • C:\ProgramData\zGCIVlmKeuLrhtGnHVPuSeylqVVcKSOl.yYM\GzMCCFAGrndtfjrvEBgcBHtGxqEbfqmE.HYW.exe
                          "GzMCCFAGrndtfjrvEBgcBHtGxqEbfqmE.HYW.exe"
                          5⤵
                          • Executes dropped EXE
                          PID:4980
                    • C:\Windows\SysWOW64\cmd.exe
                      /c "C:\Windows\System32\ComputerDefaults.exe"
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:5548
                      • C:\Windows\SysWOW64\ComputerDefaults.exe
                        C:\Windows\System32\ComputerDefaults.exe
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:4484
                        • C:\ProgramData\jnTIbfKsSrWhFFvSxBpsOnspJcuznLZS.zHe\neATzFgOPrgVSKiPUPkQZIjpkwnATVki.sBC.exe
                          "neATzFgOPrgVSKiPUPkQZIjpkwnATVki.sBC.exe"
                          5⤵
                          • Executes dropped EXE
                          PID:4692
                    • C:\Windows\SysWOW64\cmd.exe
                      /c "C:\Windows\System32\ComputerDefaults.exe"
                      3⤵
                        PID:5972
                        • C:\Windows\SysWOW64\ComputerDefaults.exe
                          C:\Windows\System32\ComputerDefaults.exe
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:5568
                          • C:\ProgramData\GkjJOXlrhDHUTPTdbDJglcFTkaCCWdOW.mlP\RuxhuRlZMTwpKAXSSLubUknXZlKPmuPU.Gls.exe
                            "RuxhuRlZMTwpKAXSSLubUknXZlKPmuPU.Gls.exe"
                            5⤵
                            • Executes dropped EXE
                            PID:4952
                      • C:\ProgramData\nqoocaIFNtJlGRMzyzSSIJKMDQItFPRi.QTy\NHuHsRmFLPGsTLieXBQIPmbPGMetvYnb.AXP.exe
                        "C:\ProgramData\nqoocaIFNtJlGRMzyzSSIJKMDQItFPRi.QTy\NHuHsRmFLPGsTLieXBQIPmbPGMetvYnb.AXP.exe"
                        3⤵
                        • Executes dropped EXE
                        PID:1700
                      • C:\Windows\SysWOW64\cmd.exe
                        /c "C:\Windows\System32\ComputerDefaults.exe"
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:4236
                        • C:\Windows\SysWOW64\ComputerDefaults.exe
                          C:\Windows\System32\ComputerDefaults.exe
                          4⤵
                            PID:2608
                            • C:\ProgramData\jAXqDokYFVIaSuXrAnbzYkoqMJrepxaT.ppb\lpFlAXhOFBnPExyUDyJHRDVcfTJMCwXP.EsW.exe
                              "lpFlAXhOFBnPExyUDyJHRDVcfTJMCwXP.EsW.exe"
                              5⤵
                              • Executes dropped EXE
                              PID:2904
                        • C:\Windows\SysWOW64\cmd.exe
                          /c "C:\Windows\System32\ComputerDefaults.exe"
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:6048
                          • C:\Windows\SysWOW64\ComputerDefaults.exe
                            C:\Windows\System32\ComputerDefaults.exe
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:3964
                            • C:\ProgramData\ekEyKQvjQWQuUhdVvQDVMWqFjHGuefiA.CVd\IuFiFbOzmAoNYFYDVTqcpKVIuxArZGYB.ubC.exe
                              "IuFiFbOzmAoNYFYDVTqcpKVIuxArZGYB.ubC.exe"
                              5⤵
                              • Executes dropped EXE
                              PID:5752
                        • C:\Windows\SysWOW64\cmd.exe
                          /c "C:\Windows\System32\ComputerDefaults.exe"
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:5196
                          • C:\Windows\SysWOW64\ComputerDefaults.exe
                            C:\Windows\System32\ComputerDefaults.exe
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:1980
                    • C:\ProgramData\tThJql.SIj\26622358.RhMQ
                      C:\ProgramData\tThJql.SIj\26622358.RhMQ
                      1⤵
                      • Executes dropped EXE
                      PID:4952
                    • C:\ProgramData\tThJql.SIj\4493191471.ApY
                      C:\ProgramData\tThJql.SIj\4493191471.ApY
                      1⤵
                      • Executes dropped EXE
                      PID:5708
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                      1⤵
                        PID:3540

                      Network

                            MITRE ATT&CK Enterprise v16

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            wtKjUwwfFkNzXkZlMDHFRGflwGMcAskn.SQY.exe
                            • Path C:\ProgramData\iJQVnGYrSOngbwXgXOsUIiLFatEsHQOp.vay\wtKjUwwfFkNzXkZlMDHFRGflwGMcAskn.SQY.exe
                            • Size 51KB
                            • SHA256 ce6bb7eddc83762c708d4a41709ae00371dbdc09b2a380f28fa60b1edf917473
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            26622358.RhMQ
                            • Path C:\ProgramData\tThJql.SIj\26622358.RhMQ
                            • Size 17KB
                            • SHA256 671e564fa73da5f33f6591d27eef6d3f02264c94f4cf85328bab1412a7fcb687
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            26622358.RhMQ.ppt
                            • Path C:\ProgramData\tThJql.SIj\26622358.RhMQ.ppt
                            • Size 17KB
                            • SHA256 4df92dda94bde425df050a679eb5774be2f8fabaa1c3f5e1618a247c7f87a139
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            4493191471.ApY
                            • Path C:\ProgramData\tThJql.SIj\4493191471.ApY
                            • Size 32KB
                            • SHA256 fb1c10d2d9e89ae8263faaed9b211bd1585896fc8eb4bc21622942a8a22cee09
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            4493191471.ApY.ppt
                            • Path C:\ProgramData\tThJql.SIj\4493191471.ApY.ppt
                            • Size 32KB
                            • SHA256 5bb44bb2a9735b9b71e649635474cdae602e4f3c898ecfc4717cc7fea11e8570
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            memory/4952-4-0x0000000000010000-0x0000000000017000-memory.dmp
                            Download