Overview

overview

7

Static

static

3

3f9dcc55e3...17.dll

windows10-2004-x64

7

3f9dcc55e3...17.dll

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/09/2026, 10:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    3f9dcc55e3daf7108dfdd161e799366d8ea95c8320fde89291c3160c30aef017.dll
  • Size 9.1MB
  • Sample260922-ml58batene
  • SHA256 3f9dcc55e3daf7108dfdd161e799366d8ea95c8320fde89291c3160c30aef017
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 34 IoCs
  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 51 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 56 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f9dcc55e3daf7108dfdd161e799366d8ea95c8320fde89291c3160c30aef017.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2632
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f9dcc55e3daf7108dfdd161e799366d8ea95c8320fde89291c3160c30aef017.dll,#1
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4756
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5908
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5376
          • C:\ProgramData\LVxGiKZohlBAfPigLvcZhCjhLlrvmqDH.XSj\PjvPyvUMVokuqaHvlzvavMvTWHVatQkQ.qze.exe
            "PjvPyvUMVokuqaHvlzvavMvTWHVatQkQ.qze.exe"
            5⤵
            • Executes dropped EXE
            PID:1772
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4416
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4388
          • C:\ProgramData\gPVmwovpmccfCDOxpuPIeTCibHCLiEJO.bzv\sKDlxVZVVkDZuOiZpYCMXAjnDrHkatoi.LNK.exe
            "sKDlxVZVVkDZuOiZpYCMXAjnDrHkatoi.LNK.exe"
            5⤵
            • Executes dropped EXE
            PID:4428
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1704
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4144
          • C:\ProgramData\cwvivNYOivDoHxmcupfaSaCmpuCGJLqq.hDk\DstknCSzGceLEqZKYdoOWquLsTxBzRGd.PdX.exe
            "DstknCSzGceLEqZKYdoOWquLsTxBzRGd.PdX.exe"
            5⤵
            • Executes dropped EXE
            PID:3040
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3484
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5600
          • C:\ProgramData\FMAgMyWIXLNGmjtdxfTeXMRGxvzwbuip.Tha\vYtyfjVUuZLLQdUnwPPfSOXUXBVBWZya.vnj.exe
            "vYtyfjVUuZLLQdUnwPPfSOXUXBVBWZya.vnj.exe"
            5⤵
            • Executes dropped EXE
            PID:3016
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1088
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:800
          • C:\ProgramData\VmwhTpdREzNKCYiYsIlRQtMtmDCzjLWq.RJV\UrQivLdHRPduRbnFlMbxqtVhYKFufNDc.kGm.exe
            "UrQivLdHRPduRbnFlMbxqtVhYKFufNDc.kGm.exe"
            5⤵
            • Executes dropped EXE
            PID:2120
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5256
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4952
          • C:\ProgramData\QilPwZvVOGjuYYRSioNldTIUnafopSAC.GXh\pTPVLzTtGNgywfRonjoSvkbRNztDaDUT.EJR.exe
            "pTPVLzTtGNgywfRonjoSvkbRNztDaDUT.EJR.exe"
            5⤵
            • Executes dropped EXE
            PID:3192
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3352
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3448
          • C:\ProgramData\WGoVchzPFJYQZzTxxLXDooVJjQLepIcs.pnH\LFudTfdGacAeBwohoVWjjoOQVrMXgMHX.lKu.exe
            "LFudTfdGacAeBwohoVWjjoOQVrMXgMHX.lKu.exe"
            5⤵
            • Executes dropped EXE
            PID:2692
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1376
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1180
          • C:\ProgramData\eKucZaDudfhyUfeOvEjaygsJGRzjTEzP.QEt\vTHxQjNdPhJYsdavewdukodXdNcKpcZG.zzl.exe
            "vTHxQjNdPhJYsdavewdukodXdNcKpcZG.zzl.exe"
            5⤵
            • Executes dropped EXE
            PID:1248
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2732
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1152
          • C:\ProgramData\GMyzeRtolxpPepdvtUXqWVArxipTMVjG.Ang\cNteeRNcdanMTqJNfwLjkyIcdbmJBHBc.FYn.exe
            "cNteeRNcdanMTqJNfwLjkyIcdbmJBHBc.FYn.exe"
            5⤵
            • Executes dropped EXE
            PID:5480
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2812
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2884
          • C:\ProgramData\fQunlGLKFsizqGBAfAfmpdfvsRqhbGlS.Ekq\ygdqmTmIdJGyXBTckJuylBkRLyFpgiYr.Mrs.exe
            "ygdqmTmIdJGyXBTckJuylBkRLyFpgiYr.Mrs.exe"
            5⤵
            • Executes dropped EXE
            PID:2932
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4900
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4500
          • C:\ProgramData\EzNCZZacolPeDxvitDWrPLQfHvnysKBO.jGI\pLdFFSFhAqexKaPUnUxqPewBtfHYLLuI.cqD.exe
            "pLdFFSFhAqexKaPUnUxqPewBtfHYLLuI.cqD.exe"
            5⤵
            • Executes dropped EXE
            PID:2224
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4448
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5348
          • C:\ProgramData\rcesusKoXfgoHRNaRdDuWGpUJweTILtp.AAe\gTcGtOZdzhyeRNAFUMNShymyokSuOOnI.gBE.exe
            "gTcGtOZdzhyeRNAFUMNShymyokSuOOnI.gBE.exe"
            5⤵
            • Executes dropped EXE
            PID:3572
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3692
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4692
          • C:\ProgramData\UPgugxOtHNEfLebZkaiVGVywbpZLKazj.FMn\CenyLLENKDghJqKmnWEPIejNIroYiLco.ZsF.exe
            "CenyLLENKDghJqKmnWEPIejNIroYiLco.ZsF.exe"
            5⤵
            • Executes dropped EXE
            PID:248
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1300
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2748
          • C:\ProgramData\mryBGzXTFNyFPHTSiIgjeDhpnlUMHyWH.duX\cMGTDOcnyejvMDUgQZOiVsNvcCZJyMQb.zXB.exe
            "cMGTDOcnyejvMDUgQZOiVsNvcCZJyMQb.zXB.exe"
            5⤵
            • Executes dropped EXE
            PID:1900
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1444
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2160
          • C:\ProgramData\SVleOzelfVXvvjSZVoNPGDDvVwlveRYS.UcY\QKHtSAanfiYFKdauWXuMGSSZnVAcUnFi.RVY.exe
            "QKHtSAanfiYFKdauWXuMGSSZnVAcUnFi.RVY.exe"
            5⤵
            • Executes dropped EXE
            PID:5592
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5336
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1740
          • C:\ProgramData\bJrCeuzAgbYLzCDsJVgYeDGgrLvghrGU.wMA\SdgRQtRHdzUXVLuQFJqoqEbVUCTETokm.Fqg.exe
            "SdgRQtRHdzUXVLuQFJqoqEbVUCTETokm.Fqg.exe"
            5⤵
            • Executes dropped EXE
            PID:4148
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1816
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2464
          • C:\ProgramData\PNOOSsoDCmPbVUgBofEMUygLMbodkimm.zuQ\RdlxmaadTAYKfvdtwtHYWjoOCfWZkxNy.QIy.exe
            "RdlxmaadTAYKfvdtwtHYWjoOCfWZkxNy.QIy.exe"
            5⤵
            • Executes dropped EXE
            PID:5228
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5672
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3984
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4812
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:5832
          • C:\ProgramData\fwJmtmRHsCEnTefbemFVXSSaXhRrhzPe.hVV\DMGSLqHcfFmRpeVexzxRbPsiTsyMiKGZ.LNm.exe
            "DMGSLqHcfFmRpeVexzxRbPsiTsyMiKGZ.LNm.exe"
            5⤵
            • Executes dropped EXE
            PID:700
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4340
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5936
          • C:\ProgramData\fwJmtmRHsCEnTefbemFVXSSaXhRrhzPe.hVV\DMGSLqHcfFmRpeVexzxRbPsiTsyMiKGZ.LNm.exe
            "DMGSLqHcfFmRpeVexzxRbPsiTsyMiKGZ.LNm.exe"
            5⤵
            • Executes dropped EXE
            PID:5308
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1556
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4768
          • C:\ProgramData\NHoxOuTxOPLpyamkJAsvvdKCGsxJrGct.AHG\CTMxUZUHOuZFuToKvejQxtqpObHdZDww.Lyg.exe
            "CTMxUZUHOuZFuToKvejQxtqpObHdZDww.Lyg.exe"
            5⤵
            • Executes dropped EXE
            PID:5752
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
          PID:5380
          • C:\Windows\SysWOW64\ComputerDefaults.exe
            C:\Windows\System32\ComputerDefaults.exe
            4⤵
              PID:5060
          • C:\Windows\SysWOW64\cmd.exe
            /c "C:\Windows\System32\ComputerDefaults.exe"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:4456
            • C:\Windows\SysWOW64\ComputerDefaults.exe
              C:\Windows\System32\ComputerDefaults.exe
              4⤵
              • System Location Discovery: System Language Discovery
              PID:5196
              • C:\ProgramData\gMpWZpHCiwfgPJZxXXNEqfVIlxrnhfkg.ONu\TJuPxxLYOLPtWJuGTBzAwoQZbzlrKaMP.iyM.exe
                "TJuPxxLYOLPtWJuGTBzAwoQZbzlrKaMP.iyM.exe"
                5⤵
                • Executes dropped EXE
                PID:4276
          • C:\Windows\SysWOW64\cmd.exe
            /c "C:\Windows\System32\ComputerDefaults.exe"
            3⤵
              PID:5408
              • C:\Windows\SysWOW64\ComputerDefaults.exe
                C:\Windows\System32\ComputerDefaults.exe
                4⤵
                • System Location Discovery: System Language Discovery
                PID:4328
            • C:\Windows\SysWOW64\cmd.exe
              /c "C:\Windows\System32\ComputerDefaults.exe"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:256
              • C:\Windows\SysWOW64\ComputerDefaults.exe
                C:\Windows\System32\ComputerDefaults.exe
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1144
                • C:\ProgramData\JIDSlnrayYCMJWiLFVIlfCRKWQkJaPTg.zGq\bloYMgPCOwMvuWiCAUtnGpKROjkbqbhx.xOi.exe
                  "bloYMgPCOwMvuWiCAUtnGpKROjkbqbhx.xOi.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:5864
            • C:\Windows\SysWOW64\cmd.exe
              /c "C:\Windows\System32\ComputerDefaults.exe"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:5156
              • C:\Windows\SysWOW64\ComputerDefaults.exe
                C:\Windows\System32\ComputerDefaults.exe
                4⤵
                • System Location Discovery: System Language Discovery
                PID:5628
            • C:\Windows\SysWOW64\cmd.exe
              /c "C:\Windows\System32\ComputerDefaults.exe"
              3⤵
                PID:940
                • C:\Windows\SysWOW64\ComputerDefaults.exe
                  C:\Windows\System32\ComputerDefaults.exe
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:5248
                  • C:\ProgramData\tGNBpbLUlzZqOBSMyNfpnNbMgBrjnnfU.JWo\xsDAiopmnUXHktdqlxDjoCPUKRmSXUyn.GPy.exe
                    "xsDAiopmnUXHktdqlxDjoCPUKRmSXUyn.GPy.exe"
                    5⤵
                    • Executes dropped EXE
                    PID:3704
              • C:\Windows\SysWOW64\cmd.exe
                /c "C:\Windows\System32\ComputerDefaults.exe"
                3⤵
                  PID:4128
                  • C:\Windows\SysWOW64\ComputerDefaults.exe
                    C:\Windows\System32\ComputerDefaults.exe
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:2652
                    • C:\ProgramData\dYnQqekIJXJOQLufULyAfbcxDqclPvmv.ucZ\bZzOHvlUyjNZGDkqHEODIvRndhQtnTSU.xye.exe
                      "bZzOHvlUyjNZGDkqHEODIvRndhQtnTSU.xye.exe"
                      5⤵
                      • Executes dropped EXE
                      PID:4740
                • C:\Windows\SysWOW64\cmd.exe
                  /c "C:\Windows\System32\ComputerDefaults.exe"
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:3888
                  • C:\Windows\SysWOW64\ComputerDefaults.exe
                    C:\Windows\System32\ComputerDefaults.exe
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:3528
                    • C:\ProgramData\GScwdrcerDvMrUtzxwnKNBjfXupXMLjP.GBc\ANqdJlSvOQHalvvZgtoKHaaGxiPwwafq.EtX.exe
                      "ANqdJlSvOQHalvvZgtoKHaaGxiPwwafq.EtX.exe"
                      5⤵
                      • Executes dropped EXE
                      PID:5968
                • C:\Windows\SysWOW64\cmd.exe
                  /c "C:\Windows\System32\ComputerDefaults.exe"
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:3168
                  • C:\Windows\SysWOW64\ComputerDefaults.exe
                    C:\Windows\System32\ComputerDefaults.exe
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:4892
                • C:\Windows\SysWOW64\cmd.exe
                  /c "C:\Windows\System32\ComputerDefaults.exe"
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:5988
                  • C:\Windows\SysWOW64\ComputerDefaults.exe
                    C:\Windows\System32\ComputerDefaults.exe
                    4⤵
                      PID:3640
                      • C:\ProgramData\DjRQJWdIcSYrdDTfMVymAqcXfrFiCwpW.xtN\TSYmzzxSgTukIuvsynXlCRYzVLxLSCxZ.xPO.exe
                        "TSYmzzxSgTukIuvsynXlCRYzVLxLSCxZ.xPO.exe"
                        5⤵
                        • Executes dropped EXE
                        PID:5844
                  • C:\Windows\SysWOW64\cmd.exe
                    /c "C:\Windows\System32\ComputerDefaults.exe"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:5500
                    • C:\Windows\SysWOW64\ComputerDefaults.exe
                      C:\Windows\System32\ComputerDefaults.exe
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:4196
                  • C:\Windows\SysWOW64\cmd.exe
                    /c "C:\Windows\System32\ComputerDefaults.exe"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:3196
                    • C:\Windows\SysWOW64\ComputerDefaults.exe
                      C:\Windows\System32\ComputerDefaults.exe
                      4⤵
                        PID:6028
                        • C:\ProgramData\SslvgrFXCWoLYKQDstWaIlbLDPGERyrp.ZMa\cjfgtmTIzYiLzCilazHjfioxImZiFBGv.mGT.exe
                          "cjfgtmTIzYiLzCilazHjfioxImZiFBGv.mGT.exe"
                          5⤵
                          • Executes dropped EXE
                          PID:2936
                    • C:\Windows\SysWOW64\cmd.exe
                      /c "C:\Windows\System32\ComputerDefaults.exe"
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:700
                      • C:\Windows\SysWOW64\ComputerDefaults.exe
                        C:\Windows\System32\ComputerDefaults.exe
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:5792
                    • C:\Windows\SysWOW64\cmd.exe
                      /c "C:\Windows\System32\ComputerDefaults.exe"
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:1700
                      • C:\Windows\SysWOW64\ComputerDefaults.exe
                        C:\Windows\System32\ComputerDefaults.exe
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:1564
                        • C:\ProgramData\DWHpxCmdvVcoDFYLFfsNNjaqKngipXrL.CcZ\PgHXoBBZspHxPcRHgfKuztCsSVsZKCLl.rju.exe
                          "PgHXoBBZspHxPcRHgfKuztCsSVsZKCLl.rju.exe"
                          5⤵
                          • Executes dropped EXE
                          PID:4808
                    • C:\Windows\SysWOW64\cmd.exe
                      /c "C:\Windows\System32\ComputerDefaults.exe"
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:3976
                      • C:\Windows\SysWOW64\ComputerDefaults.exe
                        C:\Windows\System32\ComputerDefaults.exe
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:4820
                        • C:\ProgramData\szpEYVuGXDgjvivSEJNomUFtvsynaWeo.IaQ\ySFZBbLdZaeNzNOCyUxNQQzZbkChElPE.RVF.exe
                          "ySFZBbLdZaeNzNOCyUxNQQzZbkChElPE.RVF.exe"
                          5⤵
                          • Executes dropped EXE
                          PID:3504
                    • C:\Windows\SysWOW64\cmd.exe
                      /c "C:\Windows\System32\ComputerDefaults.exe"
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:5548
                      • C:\Windows\SysWOW64\ComputerDefaults.exe
                        C:\Windows\System32\ComputerDefaults.exe
                        4⤵
                          PID:5776
                          • C:\ProgramData\hYAuBEUyXZNIzmpZuQufhfYfLhsqfIoe.IeF\YWVcASfTgqJaHVpIVNGUZuxYlsxyVQVW.FHa.exe
                            "YWVcASfTgqJaHVpIVNGUZuxYlsxyVQVW.FHa.exe"
                            5⤵
                            • Executes dropped EXE
                            PID:5412
                      • C:\Windows\SysWOW64\cmd.exe
                        /c "C:\Windows\System32\ComputerDefaults.exe"
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:3860
                        • C:\Windows\SysWOW64\ComputerDefaults.exe
                          C:\Windows\System32\ComputerDefaults.exe
                          4⤵
                            PID:5420
                        • C:\Windows\SysWOW64\cmd.exe
                          /c "C:\Windows\System32\ComputerDefaults.exe"
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:264
                          • C:\Windows\SysWOW64\ComputerDefaults.exe
                            C:\Windows\System32\ComputerDefaults.exe
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:5292
                            • C:\ProgramData\GuFAAcfrOLumEpOZyVwEXNXQAJswYXXU.nJf\HNqUOphEYDlfwKzTvweQvVkKTwhCYJsu.SDz.exe
                              "HNqUOphEYDlfwKzTvweQvVkKTwhCYJsu.SDz.exe"
                              5⤵
                              • Executes dropped EXE
                              PID:4644
                        • C:\Windows\SysWOW64\cmd.exe
                          /c "C:\Windows\System32\ComputerDefaults.exe"
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:4384
                          • C:\Windows\SysWOW64\ComputerDefaults.exe
                            C:\Windows\System32\ComputerDefaults.exe
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:4284
                            • C:\ProgramData\hoKKMiHrdxdgAwsXgqhKVTsPpzVfWYrk.VTk\YwFnmYjaEMaGQvhFwIsFCQNrfpezxuCc.row.exe
                              "YwFnmYjaEMaGQvhFwIsFCQNrfpezxuCc.row.exe"
                              5⤵
                              • Executes dropped EXE
                              PID:1284
                        • C:\Windows\SysWOW64\cmd.exe
                          /c "C:\Windows\System32\ComputerDefaults.exe"
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:2700
                          • C:\Windows\SysWOW64\ComputerDefaults.exe
                            C:\Windows\System32\ComputerDefaults.exe
                            4⤵
                              PID:2232
                          • C:\Windows\SysWOW64\cmd.exe
                            /c "C:\Windows\System32\ComputerDefaults.exe"
                            3⤵
                              PID:5424
                              • C:\Windows\SysWOW64\ComputerDefaults.exe
                                C:\Windows\System32\ComputerDefaults.exe
                                4⤵
                                  PID:1736
                          • C:\ProgramData\Vspjfm.CYA\61797184.WoEw
                            C:\ProgramData\Vspjfm.CYA\61797184.WoEw
                            1⤵
                            • Executes dropped EXE
                            PID:3164
                          • C:\ProgramData\Vspjfm.CYA\5622646659.hHt
                            C:\ProgramData\Vspjfm.CYA\5622646659.hHt
                            1⤵
                            • Executes dropped EXE
                            PID:1068
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                            1⤵
                              PID:5704

                            Network

                                  MITRE ATT&CK Enterprise v16

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  PjvPyvUMVokuqaHvlzvavMvTWHVatQkQ.qze.exe
                                  • Path C:\ProgramData\LVxGiKZohlBAfPigLvcZhCjhLlrvmqDH.XSj\PjvPyvUMVokuqaHvlzvavMvTWHVatQkQ.qze.exe
                                  • Size 51KB
                                  • SHA256 ce6bb7eddc83762c708d4a41709ae00371dbdc09b2a380f28fa60b1edf917473
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  5622646659.hHt
                                  • Path C:\ProgramData\Vspjfm.CYA\5622646659.hHt
                                  • Size 32KB
                                  • SHA256 fb1c10d2d9e89ae8263faaed9b211bd1585896fc8eb4bc21622942a8a22cee09
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  5622646659.hHt.ppt
                                  • Path C:\ProgramData\Vspjfm.CYA\5622646659.hHt.ppt
                                  • Size 32KB
                                  • SHA256 5bb44bb2a9735b9b71e649635474cdae602e4f3c898ecfc4717cc7fea11e8570
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  61797184.WoEw
                                  • Path C:\ProgramData\Vspjfm.CYA\61797184.WoEw
                                  • Size 17KB
                                  • SHA256 671e564fa73da5f33f6591d27eef6d3f02264c94f4cf85328bab1412a7fcb687
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  61797184.WoEw.ppt
                                  • Path C:\ProgramData\Vspjfm.CYA\61797184.WoEw.ppt
                                  • Size 17KB
                                  • SHA256 4df92dda94bde425df050a679eb5774be2f8fabaa1c3f5e1618a247c7f87a139
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  memory/3164-4-0x0000000000010000-0x0000000000017000-memory.dmp
                                  Download