Overview

overview

7

Static

static

3

3a9353806f...a4.dll

windows10-2004-x64

7

3a9353806f...a4.dll

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/09/2026, 08:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    3a9353806f1304a3c1a06463f146dd7cdbe1e629b5258db5f076f7bd0c0451a4.dll
  • Size 9.3MB
  • Sample260924-jwelka1cmd
  • SHA256 3a9353806f1304a3c1a06463f146dd7cdbe1e629b5258db5f076f7bd0c0451a4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 51 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 57 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a9353806f1304a3c1a06463f146dd7cdbe1e629b5258db5f076f7bd0c0451a4.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4672
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a9353806f1304a3c1a06463f146dd7cdbe1e629b5258db5f076f7bd0c0451a4.dll,#1
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4528
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1536
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4756
          • C:\ProgramData\VTeKrPIzzCOlZUABjmymDdcvlVSVejOJ.xAg\ngwrViCafLvuKoDqCtbyPumaAnRXekCx.Jmw.exe
            "ngwrViCafLvuKoDqCtbyPumaAnRXekCx.Jmw.exe"
            5⤵
            • Executes dropped EXE
            PID:5984
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2280
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5356
          • C:\ProgramData\TqGoTTQVkDkYONtFGWyXbpRCyDZsnzfz.mHI\gcAarpqKeMeVZKlbDFKMPCLtUGJnEBCV.PXL.exe
            "gcAarpqKeMeVZKlbDFKMPCLtUGJnEBCV.PXL.exe"
            5⤵
            • Executes dropped EXE
            PID:1956
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:696
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5700
          • C:\ProgramData\VffAGeQANeQSDAVQEkoRMxefmMdUxrql.Tqm\HCNIBlaKgiGWuFWRdAyMaQcXLcPvKCzQ.VhI.exe
            "HCNIBlaKgiGWuFWRdAyMaQcXLcPvKCzQ.VhI.exe"
            5⤵
            • Executes dropped EXE
            PID:1216
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2740
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4516
          • C:\ProgramData\PYxMJVLqhZTeKBpUKuzoYSGVgpPbqpOQ.siU\ORSJUHhqNslwKPfuQkkbIonRIYdvEGOP.cvp.exe
            "ORSJUHhqNslwKPfuQkkbIonRIYdvEGOP.cvp.exe"
            5⤵
            • Executes dropped EXE
            PID:5900
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4848
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:888
          • C:\ProgramData\UEkQAGnFNWReNQPgWNqwnrOrgFtKkLHS.VTP\EXJlhoeUGXPnsSNAwZsFRyHQVdayrHGj.RCw.exe
            "EXJlhoeUGXPnsSNAwZsFRyHQVdayrHGj.RCw.exe"
            5⤵
            • Executes dropped EXE
            PID:2900
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5832
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5380
          • C:\ProgramData\KIUzorYngOvjmMdeyMqhPVQmRbQOMrFO.soV\ocYDmQtXcoEilNaEiizASNAcwRkPEmmj.VfQ.exe
            "ocYDmQtXcoEilNaEiizASNAcwRkPEmmj.VfQ.exe"
            5⤵
            • Executes dropped EXE
            PID:5560
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4868
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5112
          • C:\ProgramData\hGOIXnKngooEmNHpTIevDrMQfgKlftAq.lVh\UDpFqPdxVsirjdGRJJYQmMxBGaimTeGo.nQL.exe
            "UDpFqPdxVsirjdGRJJYQmMxBGaimTeGo.nQL.exe"
            5⤵
            • Executes dropped EXE
            PID:4088
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4636
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2384
          • C:\ProgramData\BoZIHpzByUdsYjKAztDrhOebAYpYKMhN.reQ\zTlkuaTGdYPyeZIxqugSroPbqfrymTim.cAs.exe
            "zTlkuaTGdYPyeZIxqugSroPbqfrymTim.cAs.exe"
            5⤵
            • Executes dropped EXE
            PID:5028
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4200
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5104
          • C:\ProgramData\oHpZWddmadGdbutlLcOsuBQLcqoOThCu.qaR\zkkyVHVeJqZiVJAMDequKQbirqzNGgdx.zGM.exe
            "zkkyVHVeJqZiVJAMDequKQbirqzNGgdx.zGM.exe"
            5⤵
            • Executes dropped EXE
            PID:5548
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4784
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:808
          • C:\ProgramData\CwmgHkTKDisQzcpshtaczJlocqfGtQkw.GkH\vYLzYhmJCRJqiSRLykxRKzvFgqixmWvw.nMt.exe
            "vYLzYhmJCRJqiSRLykxRKzvFgqixmWvw.nMt.exe"
            5⤵
            • Executes dropped EXE
            PID:2852
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2344
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5184
          • C:\ProgramData\BxxmWiowbfPTiaUmNjUpEFtIokDrFQGi.QVL\qodnUfVDzmGgOPvTIeJNmPQDGkKXzzWU.ZlG.exe
            "qodnUfVDzmGgOPvTIeJNmPQDGkKXzzWU.ZlG.exe"
            5⤵
            • Executes dropped EXE
            PID:4100
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4544
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2780
          • C:\ProgramData\VGKJEbjaNMWRyOTAhKfngkwKhgSghVfG.VmQ\ZfiDicjeNUSsiwlProgNSIjWPhQyIKIx.rpJ.exe
            "ZfiDicjeNUSsiwlProgNSIjWPhQyIKIx.rpJ.exe"
            5⤵
            • Executes dropped EXE
            PID:5724
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3540
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4752
          • C:\ProgramData\reoGmzjVfgalXIMGsrqlrNjXTeWdTcIK.kBg\YzaFbushblVDNvwezShPjWlOYKSUQOJR.uPP.exe
            "YzaFbushblVDNvwezShPjWlOYKSUQOJR.uPP.exe"
            5⤵
            • Executes dropped EXE
            PID:5012
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2552
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5080
          • C:\ProgramData\frlDCKlEmqZGKGRsSTOMSOUEJfSVCRff.iWl\jgEyvsRTKMAMokIeibuCXwFdsSnsdNMj.xZk.exe
            "jgEyvsRTKMAMokIeibuCXwFdsSnsdNMj.xZk.exe"
            5⤵
            • Executes dropped EXE
            PID:5928
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1100
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3256
          • C:\ProgramData\UYkFeZIYYfsZlaIpruvGtSZwXRPXkAhf.aFP\ejVqeNeLJHQedUJfKMaqbopjskRxzhWx.Bot.exe
            "ejVqeNeLJHQedUJfKMaqbopjskRxzhWx.Bot.exe"
            5⤵
            • Executes dropped EXE
            PID:1576
      • C:\ProgramData\GCjuKmlaBHbsAluqbOyNXisfHrqvErQt.NNv\MkJpTKEBAvBXcYYdzSmREztsBAcqhiNv.Joo.exe
        "C:\ProgramData\GCjuKmlaBHbsAluqbOyNXisfHrqvErQt.NNv\MkJpTKEBAvBXcYYdzSmREztsBAcqhiNv.Joo.exe"
        3⤵
        • Executes dropped EXE
        PID:5744
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4696
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4272
          • C:\ProgramData\rldDSRljqlFdaCrGzYzdiXSdUHbEvXsl.zDx\hhvYgcjlHYIPSUOJJajsipddCKqjabVE.Ech.exe
            "hhvYgcjlHYIPSUOJJajsipddCKqjabVE.Ech.exe"
            5⤵
            • Executes dropped EXE
            PID:3784
      • C:\ProgramData\VuGKfNMAhoxruCicFLMevmYvIkyIYKRf.wPJ\qKZvMaVRtzoeHDqJSbYKlGtucFUJIWQW.vik.exe
        "C:\ProgramData\VuGKfNMAhoxruCicFLMevmYvIkyIYKRf.wPJ\qKZvMaVRtzoeHDqJSbYKlGtucFUJIWQW.vik.exe"
        3⤵
        • Executes dropped EXE
        PID:2264
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5280
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3680
          • C:\ProgramData\eGNhYPSmwBHEQlcxwlqoZWCbNQDAtsfK.Luw\rLWAkekdiHfhpeOSpONgCXgNPXPZbOyJ.IRn.exe
            "rLWAkekdiHfhpeOSpONgCXgNPXPZbOyJ.IRn.exe"
            5⤵
            • Executes dropped EXE
            PID:3084
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5860
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1136
          • C:\ProgramData\BWFNyKCywwkhzCrEkoJvqndZdeSQQMJw.ocl\WIWfAhTxRArApvRoQNkiWOfjHDPEzWoi.SlK.exe
            "WIWfAhTxRArApvRoQNkiWOfjHDPEzWoi.SlK.exe"
            5⤵
            • Executes dropped EXE
            PID:4224
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3400
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3800
          • C:\ProgramData\JCpBoLoIvWLzhTNNGewxsIekxiOfdlfr.Pjz\gtYRAAEaxOIJAiKualbaZJkeTDykotNa.yGj.exe
            "gtYRAAEaxOIJAiKualbaZJkeTDykotNa.yGj.exe"
            5⤵
            • Executes dropped EXE
            PID:5412
      • C:\ProgramData\GaoiCNikzcKHDZndRFQjAEibFiALXVtj.rUP\hnExQUyuorwamiVjTvQMDNUipuWkcGaC.UUt.exe
        "C:\ProgramData\GaoiCNikzcKHDZndRFQjAEibFiALXVtj.rUP\hnExQUyuorwamiVjTvQMDNUipuWkcGaC.UUt.exe"
        3⤵
        • Executes dropped EXE
        PID:5560
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1320
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5100
          • C:\ProgramData\YxjlnkWnlBqCQCawiMGTENOFUGJbCCGg.tZy\yRTJCtgXnFLoNzxetUhmIPbeOIzYZnCS.oOo.exe
            "yRTJCtgXnFLoNzxetUhmIPbeOIzYZnCS.oOo.exe"
            5⤵
            • Executes dropped EXE
            PID:2492
      • C:\ProgramData\UvymAQfXyyNlgfoFhIVmXzHMlZVJXblo.lKp\WSnAPWwFOXalaKLiVQlpynDubYNILnGe.bHw.exe
        "C:\ProgramData\UvymAQfXyyNlgfoFhIVmXzHMlZVJXblo.lKp\WSnAPWwFOXalaKLiVQlpynDubYNILnGe.bHw.exe"
        3⤵
        • Executes dropped EXE
        PID:2944
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3844
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:6128
          • C:\ProgramData\IWmoutKYZamRCDuMOstSTLhOMfQTyQUW.DWP\sJMaaFbefxnIHCFgRxyDKCIkGZIvmjNn.bRl.exe
            "sJMaaFbefxnIHCFgRxyDKCIkGZIvmjNn.bRl.exe"
            5⤵
            • Executes dropped EXE
            PID:692
      • C:\ProgramData\nCLKPHapTBbibESZDWMIOqyufFHBhKvh.Vkh\JHTHoIRNsofXHlzVhDLIuiaTHJroYyvX.ozo.exe
        "C:\ProgramData\nCLKPHapTBbibESZDWMIOqyufFHBhKvh.Vkh\JHTHoIRNsofXHlzVhDLIuiaTHJroYyvX.ozo.exe"
        3⤵
        • Executes dropped EXE
        PID:3792
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4560
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2192
          • C:\ProgramData\xWOaFPexsgGMVkUDBezOgRudlKauAHtv.Tpt\QwfCeDMvYXjHcXUecPvkTqVKoSujXOcs.fJQ.exe
            "QwfCeDMvYXjHcXUecPvkTqVKoSujXOcs.fJQ.exe"
            5⤵
            • Executes dropped EXE
            PID:2456
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5572
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5960
          • C:\ProgramData\fYpCOxsiitEZsykYacszIgEOFogDbahG.uVN\GfqiLudcdOLYsIfMdtSXDQfjUEynQlRX.VWl.exe
            "GfqiLudcdOLYsIfMdtSXDQfjUEynQlRX.VWl.exe"
            5⤵
            • Executes dropped EXE
            PID:1364
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2736
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3548
          • C:\ProgramData\izDifFpuexEooWuIxlwjPCoGlnMUwvRU.nwY\TwLYQbEbxJZWDZgaPNLRTBqbruLGCzkL.vaT.exe
            "TwLYQbEbxJZWDZgaPNLRTBqbruLGCzkL.vaT.exe"
            5⤵
            • Executes dropped EXE
            PID:4396
      • C:\ProgramData\KHiMxwEEeVpLHhJBWkoFFNxcVkmaqUxo.vCJ\zjCONMjKZGDRKmIOUqQxjsesCTGGfPwp.jdx.exe
        "C:\ProgramData\KHiMxwEEeVpLHhJBWkoFFNxcVkmaqUxo.vCJ\zjCONMjKZGDRKmIOUqQxjsesCTGGfPwp.jdx.exe"
        3⤵
        • Executes dropped EXE
        PID:2824
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5776
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5472
          • C:\ProgramData\nKtSGQsTKIfyHUSzeaCYXKVrdaEJFGBB.IDU\xIbkqYfBuHfpFyUFQLFLOKcjSFSpvPRb.ahl.exe
            "xIbkqYfBuHfpFyUFQLFLOKcjSFSpvPRb.ahl.exe"
            5⤵
            • Executes dropped EXE
            PID:4824
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:792
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
            PID:3292
            • C:\ProgramData\MufUYuLLrayAbQfsqcudceBUDwjJJKqw.Hqz\OZNMnXeWxIdVGKmomlLYWwBdFxIbiQTv.PCk.exe
              "OZNMnXeWxIdVGKmomlLYWwBdFxIbiQTv.PCk.exe"
              5⤵
              • Executes dropped EXE
              PID:4276
        • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
          /c "C:\Windows\System32\ComputerDefaults.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1568
          • C:\Windows\SysWOW64\ComputerDefaults.exe
            C:\Windows\System32\ComputerDefaults.exe
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2260
            • C:\ProgramData\LQsLFKoLBWXqkwKyXVRNJeUsOeXvgkEC.zBA\QkOcvuSCdIuVrntfuiLLWtOuJGQLTsWx.ebA.exe
              "QkOcvuSCdIuVrntfuiLLWtOuJGQLTsWx.ebA.exe"
              5⤵
              • Executes dropped EXE
              PID:3144
        • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
          /c "C:\Windows\System32\ComputerDefaults.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:124
          • C:\Windows\SysWOW64\ComputerDefaults.exe
            C:\Windows\System32\ComputerDefaults.exe
            4⤵
              PID:4644
              • C:\ProgramData\WDlcroEzqcOBJSGtCLahKqbAWyDTcuQq.qNr\uUBHRWJHtkNXovswolKLqMrYbydgXTbW.uTL.exe
                "uUBHRWJHtkNXovswolKLqMrYbydgXTbW.uTL.exe"
                5⤵
                • Executes dropped EXE
                PID:3332
          • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
            /c "C:\Windows\System32\ComputerDefaults.exe"
            3⤵
              PID:2528
              • C:\Windows\SysWOW64\ComputerDefaults.exe
                C:\Windows\System32\ComputerDefaults.exe
                4⤵
                • System Location Discovery: System Language Discovery
                PID:5016
                • C:\ProgramData\DXTxMCBNNvdUBhWIjnwwpIfSyxPCQVtw.CfV\uklBWcMxIwuyVjqYQmvRKvSfNguuyUWc.wuJ.exe
                  "uklBWcMxIwuyVjqYQmvRKvSfNguuyUWc.wuJ.exe"
                  5⤵
                    PID:948
              • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
                /c "C:\Windows\System32\ComputerDefaults.exe"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:4628
                • C:\Windows\SysWOW64\ComputerDefaults.exe
                  C:\Windows\System32\ComputerDefaults.exe
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:3032
                  • C:\ProgramData\GvFiOBBdggSCohiaUbiTHcqgThNrxNaa.UHo\ARFEFujDdPNOZekbNtPIAJTWlbjbiUtD.OtM.exe
                    "ARFEFujDdPNOZekbNtPIAJTWlbjbiUtD.OtM.exe"
                    5⤵
                      PID:4424
                • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
                  /c "C:\Windows\System32\ComputerDefaults.exe"
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:1900
                  • C:\Windows\SysWOW64\ComputerDefaults.exe
                    C:\Windows\System32\ComputerDefaults.exe
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:6036
                    • C:\ProgramData\wJZFEYUzzLeKBwzbnjnPQOoJoDWsZOVc.xOf\ihFFxOMtOgbSoBQELtQTVmuTTNxuReaI.jdY.exe
                      "ihFFxOMtOgbSoBQELtQTVmuTTNxuReaI.jdY.exe"
                      5⤵
                        PID:2256
                  • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
                    /c "C:\Windows\System32\ComputerDefaults.exe"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:3744
                    • C:\Windows\SysWOW64\ComputerDefaults.exe
                      C:\Windows\System32\ComputerDefaults.exe
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:2728
                      • C:\ProgramData\kjAFsJZmAgIpVWgIHHRkpVdFaRLVdgsd.sMz\IdHLCnZDepaUZLjxExfxLowlIpAsYiSY.SpY.exe
                        "IdHLCnZDepaUZLjxExfxLowlIpAsYiSY.SpY.exe"
                        5⤵
                          PID:5744
                    • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
                      /c "C:\Windows\System32\ComputerDefaults.exe"
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:5148
                      • C:\Windows\SysWOW64\ComputerDefaults.exe
                        C:\Windows\System32\ComputerDefaults.exe
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:5704
                        • C:\ProgramData\MvcPimykyzxJaeXQJAGGWnmnwpkxOtgX.Xeh\oHzmtlqoGfTResDuRSRljSOxRYJSgAmQ.Orc.exe
                          "oHzmtlqoGfTResDuRSRljSOxRYJSgAmQ.Orc.exe"
                          5⤵
                            PID:3784
                      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
                        /c "C:\Windows\System32\ComputerDefaults.exe"
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:2264
                        • C:\Windows\SysWOW64\ComputerDefaults.exe
                          C:\Windows\System32\ComputerDefaults.exe
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:2084
                          • C:\ProgramData\YPoOlkRsZRfyPRMXOrWIOsDTBQMWLAjE.fOm\uhbIqLWqTSmtSYnMjaaouNrCRaGsrYWN.KEc.exe
                            "uhbIqLWqTSmtSYnMjaaouNrCRaGsrYWN.KEc.exe"
                            5⤵
                              PID:3084
                        • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
                          /c "C:\Windows\System32\ComputerDefaults.exe"
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:6140
                          • C:\Windows\SysWOW64\ComputerDefaults.exe
                            C:\Windows\System32\ComputerDefaults.exe
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:5208
                            • C:\ProgramData\kElHdGIPgDkuAvsKicYAlWXGHViXZvSA.Wgn\cLWHiDGcmThjPimCooqbDiSTQSNuxrGL.gso.exe
                              "cLWHiDGcmThjPimCooqbDiSTQSNuxrGL.gso.exe"
                              5⤵
                                PID:3460
                          • C:\ProgramData\kElHdGIPgDkuAvsKicYAlWXGHViXZvSA.Wgn\cLWHiDGcmThjPimCooqbDiSTQSNuxrGL.gso.exe
                            "C:\ProgramData\kElHdGIPgDkuAvsKicYAlWXGHViXZvSA.Wgn\cLWHiDGcmThjPimCooqbDiSTQSNuxrGL.gso.exe"
                            3⤵
                              PID:2340
                        • C:\ProgramData\cWyWio.FGQ\22391363.Hyrs
                          C:\ProgramData\cWyWio.FGQ\22391363.Hyrs
                          1⤵
                          • Executes dropped EXE
                          PID:2260
                        • C:\ProgramData\cWyWio.FGQ\6427677579.gvw
                          C:\ProgramData\cWyWio.FGQ\6427677579.gvw
                          1⤵
                          • Executes dropped EXE
                          PID:2712

                        Network

                              MITRE ATT&CK Enterprise v16

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              ngwrViCafLvuKoDqCtbyPumaAnRXekCx.Jmw.exe
                              • Path C:\ProgramData\VTeKrPIzzCOlZUABjmymDdcvlVSVejOJ.xAg\ngwrViCafLvuKoDqCtbyPumaAnRXekCx.Jmw.exe
                              • Size 51KB
                              • SHA256 ce6bb7eddc83762c708d4a41709ae00371dbdc09b2a380f28fa60b1edf917473
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              22391363.Hyrs
                              • Path C:\ProgramData\cWyWio.FGQ\22391363.Hyrs
                              • Size 17KB
                              • SHA256 671e564fa73da5f33f6591d27eef6d3f02264c94f4cf85328bab1412a7fcb687
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              22391363.Hyrs.ppt
                              • Path C:\ProgramData\cWyWio.FGQ\22391363.Hyrs.ppt
                              • Size 17KB
                              • SHA256 4df92dda94bde425df050a679eb5774be2f8fabaa1c3f5e1618a247c7f87a139
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              6427677579.gvw
                              • Path C:\ProgramData\cWyWio.FGQ\6427677579.gvw
                              • Size 32KB
                              • SHA256 fb1c10d2d9e89ae8263faaed9b211bd1585896fc8eb4bc21622942a8a22cee09
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              6427677579.gvw.ppt
                              • Path C:\ProgramData\cWyWio.FGQ\6427677579.gvw.ppt
                              • Size 32KB
                              • SHA256 5bb44bb2a9735b9b71e649635474cdae602e4f3c898ecfc4717cc7fea11e8570
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              CMD.EXE
                              • Path C:\Users\Admin\AppData\Local\Temp\CMD.EXE
                              • Size 247KB
                              • SHA256 66c09b9350a906c30d45cf00e8193c6a65862736aceb55ef8c9eb6f2b1aeca53
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              memory/2260-4-0x0000000000010000-0x0000000000017000-memory.dmp
                              Download