Overview

overview

7

Static

static

3

b2a5203f35...3b.dll

windows10-2004-x64

7

b2a5203f35...3b.dll

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/09/2026, 10:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    b2a5203f35f123d299cdbb326da8f8944fc6fd0c2b70dc98e335c4eeedb9fd3b.dll
  • Size 8.0MB
  • Sample260924-ml58babe22
  • SHA256 b2a5203f35f123d299cdbb326da8f8944fc6fd0c2b70dc98e335c4eeedb9fd3b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 47 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 55 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\b2a5203f35f123d299cdbb326da8f8944fc6fd0c2b70dc98e335c4eeedb9fd3b.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3320
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\b2a5203f35f123d299cdbb326da8f8944fc6fd0c2b70dc98e335c4eeedb9fd3b.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3124
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2308
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5696
          • C:\ProgramData\HUjmXSaJnYZUzPsReKATewIBfWolwrMH.men\KjYnVWMAMVLFPUTmrHKQbOaFyuCVNTwB.XfD.exe
            "KjYnVWMAMVLFPUTmrHKQbOaFyuCVNTwB.XfD.exe"
            5⤵
            • Executes dropped EXE
            PID:3560
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3424
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5244
          • C:\ProgramData\iNtfcipuMcoUuOTQqFmRjXTCzqvyGLmE.shu\WtgeMgyEzyJwjmjOfVlBDVutPSqFplZB.iHd.exe
            "WtgeMgyEzyJwjmjOfVlBDVutPSqFplZB.iHd.exe"
            5⤵
            • Executes dropped EXE
            PID:5832
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5944
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:808
          • C:\ProgramData\EEXPCJsOReZQgvRSoqsLIDmWlwXjUEpq.rEZ\KTYyPfoccojiXiFODiZvUzRvEYkVdTXA.TTm.exe
            "KTYyPfoccojiXiFODiZvUzRvEYkVdTXA.TTm.exe"
            5⤵
            • Executes dropped EXE
            PID:5372
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1884
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5620
          • C:\ProgramData\PWSlgNBmbXetlrnNvWyLhGlZCDHnKYch.Iui\EbmaJOAtacSZtDhJGABOAEOthbuHyGUE.TGM.exe
            "EbmaJOAtacSZtDhJGABOAEOthbuHyGUE.TGM.exe"
            5⤵
            • Executes dropped EXE
            PID:5972
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1012
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3420
          • C:\ProgramData\uesSWalcbcFaldEIzqOlGJWJWcNTYSiE.UZJ\diFsjgtGRrDKvZHhFEVmFipqaJFMWDeD.HLA.exe
            "diFsjgtGRrDKvZHhFEVmFipqaJFMWDeD.HLA.exe"
            5⤵
            • Executes dropped EXE
            PID:2776
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4524
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3812
          • C:\ProgramData\FBOhnydLnYLhDCIiLRqFLNXdEdeqcnHK.ifl\ylNrIuQZEimNsRFztfCeVadjgCzYYRbD.wBq.exe
            "ylNrIuQZEimNsRFztfCeVadjgCzYYRbD.wBq.exe"
            5⤵
            • Executes dropped EXE
            PID:5468
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5996
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3880
          • C:\ProgramData\yrofkJrdaguOLxPfZjyZPCEtQYlwtIjF.YjJ\iOfgTuZAxkAtfACMaTPgrBEbtqoRVjZk.wUI.exe
            "iOfgTuZAxkAtfACMaTPgrBEbtqoRVjZk.wUI.exe"
            5⤵
            • Executes dropped EXE
            PID:5532
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4496
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5184
          • C:\ProgramData\JHyEvFvyKaZgCauRHWUrspwcCqOXrxEY.LTE\jbqbguxNcMIBngPXfVkRoCJDNyMpXXJg.Fdq.exe
            "jbqbguxNcMIBngPXfVkRoCJDNyMpXXJg.Fdq.exe"
            5⤵
            • Executes dropped EXE
            PID:908
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5748
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4456
          • C:\ProgramData\IHNFNPditOHdhLIMcfjewzWkFhvYUXuY.rKL\MriCUXaRHbWbnEYDSDzDelfowPQkIPsY.gXO.exe
            "MriCUXaRHbWbnEYDSDzDelfowPQkIPsY.gXO.exe"
            5⤵
            • Executes dropped EXE
            PID:3576
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3168
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2396
          • C:\ProgramData\iBEawlAqPSyvCElNJMXJPzjRUcClRjAX.xTS\kNQyImZbUInvdqIorfAczGfRJnFAjwup.Lsd.exe
            "kNQyImZbUInvdqIorfAczGfRJnFAjwup.Lsd.exe"
            5⤵
            • Executes dropped EXE
            PID:120
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4644
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1092
          • C:\ProgramData\gwqOOPoNDFgjASTyzzfbwfuTXGIGBkUU.ChX\vBeLUqccqPLNKprewfPcdbGpLOMRpYGv.LZo.exe
            "vBeLUqccqPLNKprewfPcdbGpLOMRpYGv.LZo.exe"
            5⤵
            • Executes dropped EXE
            PID:4752
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1328
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4472
          • C:\ProgramData\HailyytYejfFAXkaebKnCfHEwRCWcCYk.CXm\GsPHrytbLNjXWNEGUxCgKctoBYOzhWiQ.MjS.exe
            "GsPHrytbLNjXWNEGUxCgKctoBYOzhWiQ.MjS.exe"
            5⤵
            • Executes dropped EXE
            PID:1660
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2376
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:784
          • C:\ProgramData\rQuFmaaReNqjVZtPWkLQfvjkwHcrPYTB.qxb\EYTarFEpZDedcpUUfYcWchHzvmBofVrO.fAy.exe
            "EYTarFEpZDedcpUUfYcWchHzvmBofVrO.fAy.exe"
            5⤵
            • Executes dropped EXE
            PID:4084
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2388
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4236
          • C:\ProgramData\fcoIfdIsBBirptCAFOfDgzypwDJyJrdp.EMh\UnJdJnyUzQIdqWUFtYMxcOMFnfWqpDqi.AwT.exe
            "UnJdJnyUzQIdqWUFtYMxcOMFnfWqpDqi.AwT.exe"
            5⤵
            • Executes dropped EXE
            PID:3012
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2288
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2056
          • C:\ProgramData\HkBLCisjCrikILWQRFVRKhneIDvdZqrk.npI\lutIrJyEotBgNJTgJxGwdTcLchuwVTIj.LFY.exe
            "lutIrJyEotBgNJTgJxGwdTcLchuwVTIj.LFY.exe"
            5⤵
            • Executes dropped EXE
            PID:1740
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5968
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1312
          • C:\ProgramData\BfRgfEUOFVKxcAFEAtRJvHTMZNGRBJDk.XVm\ATxoxXNziqbLMJrRFDmWNpMibHUVFTxS.Fnq.exe
            "ATxoxXNziqbLMJrRFDmWNpMibHUVFTxS.Fnq.exe"
            5⤵
            • Executes dropped EXE
            PID:4224
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:952
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5764
          • C:\ProgramData\DDhcvwvKYTkfXbPAbGcgZMOSmLhInNWL.bzg\YOxOawlBsZJiheNvYbYNMeBPOrNhZFIf.INg.exe
            "YOxOawlBsZJiheNvYbYNMeBPOrNhZFIf.INg.exe"
            5⤵
            • Executes dropped EXE
            PID:5880
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3236
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4392
          • C:\ProgramData\OtIyXjhYwiBSnWIRohcxXuDnhToFPDHW.lhd\ghwbAqCAaieXGMYcqehumoywMmYvXXqW.uwB.exe
            "ghwbAqCAaieXGMYcqehumoywMmYvXXqW.uwB.exe"
            5⤵
            • Executes dropped EXE
            PID:2560
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4228
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3120
          • C:\ProgramData\JberFUFOzvEMjyFIPzOyvrCuCkWjBLqW.ImQ\YqJxBqILazEYKxoXQBJhBHqmAMlbKUvx.ChP.exe
            "YqJxBqILazEYKxoXQBJhBHqmAMlbKUvx.ChP.exe"
            5⤵
            • Executes dropped EXE
            PID:5112
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4824
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5468
          • C:\ProgramData\fpJOLdksBjPbTgzyPVRChtrZjjUShmXY.hNN\BTATdDrSsrFGaDCaUrzprrYbiZVOuivx.saj.exe
            "BTATdDrSsrFGaDCaUrzprrYbiZVOuivx.saj.exe"
            5⤵
            • Executes dropped EXE
            PID:3580
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1204
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3188
          • C:\ProgramData\LwDfZZXbmSJqGBkacpjxHKcmmNqRNhhp.YCR\SwggLXtEbGxRiOkNmtixqgZroFoQoIls.wvg.exe
            "SwggLXtEbGxRiOkNmtixqgZroFoQoIls.wvg.exe"
            5⤵
            • Executes dropped EXE
            PID:5924
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        PID:2148
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4336
          • C:\ProgramData\yDOaijSRIOcsWImaPwaddxZzGNjTNLgM.xHP\RHvTwUxcHUblmfMFwCViuaXKLPMVRTCn.zfl.exe
            "RHvTwUxcHUblmfMFwCViuaXKLPMVRTCn.zfl.exe"
            5⤵
            • Executes dropped EXE
            PID:5168
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5520
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2812
          • C:\ProgramData\PFEUVWccwlMIqBGVMHCTqexfVaqpwZwE.szP\fiVNALjrtUPNkBkCufuvzyFCCmhtarGn.Cok.exe
            "fiVNALjrtUPNkBkCufuvzyFCCmhtarGn.Cok.exe"
            5⤵
            • Executes dropped EXE
            PID:2036
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1976
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3384
          • C:\ProgramData\xaVwqwaJvtqesFpQUxtwlKHoGxfsYOCx.AeC\icUDKjwUuhwHMDCTHAQiabcIcyBueBtE.KHD.exe
            "icUDKjwUuhwHMDCTHAQiabcIcyBueBtE.KHD.exe"
            5⤵
            • Executes dropped EXE
            PID:4788
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:204
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2120
          • C:\ProgramData\gzjntlcmTIgGNHwWASCOckgBcoOpCmkk.rcQ\LENCnJoEmgBQiTHPJulWMDOEdnufPnyM.tly.exe
            "LENCnJoEmgBQiTHPJulWMDOEdnufPnyM.tly.exe"
            5⤵
            • Executes dropped EXE
            PID:4608
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        PID:4172
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2272
          • C:\ProgramData\vVuKwndbFtHkSlpeWmlRJIxKtUmnhkNz.svQ\bwnyXqNLILEBjKpUOEJFsHBFUTlzreVY.VkL.exe
            "bwnyXqNLILEBjKpUOEJFsHBFUTlzreVY.VkL.exe"
            5⤵
            • Executes dropped EXE
            PID:2496
      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1972
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
            PID:1348
            • C:\ProgramData\XHsxohKmohiACrbNxcAIUXumoCyBgtSj.bbW\LsdQqGOSQLzmMUGRJUjaspChqScrHRRN.ELu.exe
              "LsdQqGOSQLzmMUGRJUjaspChqScrHRRN.ELu.exe"
              5⤵
              • Executes dropped EXE
              PID:2924
        • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
          /c "C:\Windows\System32\ComputerDefaults.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5448
          • C:\Windows\SysWOW64\ComputerDefaults.exe
            C:\Windows\System32\ComputerDefaults.exe
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2584
            • C:\ProgramData\qjtOQqYnEfbictPUrXQLBBhJctjBHulZ.sfR\OvhGbaCzJpXNnhNXeOsgFfInsHwBaZkk.bFv.exe
              "OvhGbaCzJpXNnhNXeOsgFfInsHwBaZkk.bFv.exe"
              5⤵
              • Executes dropped EXE
              PID:4924
        • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
          /c "C:\Windows\System32\ComputerDefaults.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3380
          • C:\Windows\SysWOW64\ComputerDefaults.exe
            C:\Windows\System32\ComputerDefaults.exe
            4⤵
            • System Location Discovery: System Language Discovery
            PID:936
            • C:\ProgramData\VRflxSvyjXuLTQOQNQfzbbrPpwCeGdeM.nuZ\sHZpkUXgVtQkOMmdMHGUUyPJkpCdURCB.ozJ.exe
              "sHZpkUXgVtQkOMmdMHGUUyPJkpCdURCB.ozJ.exe"
              5⤵
              • Executes dropped EXE
              PID:3636
        • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
          /c "C:\Windows\System32\ComputerDefaults.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2280
          • C:\Windows\SysWOW64\ComputerDefaults.exe
            C:\Windows\System32\ComputerDefaults.exe
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4560
            • C:\ProgramData\AuOFEDnGNJVvwiXlmlZzSamkkqGpQlLM.Ptr\IbAxfXMpQpmgezksqXNygcgBxQbScTlv.jKD.exe
              "IbAxfXMpQpmgezksqXNygcgBxQbScTlv.jKD.exe"
              5⤵
              • Executes dropped EXE
              PID:3932
        • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
          /c "C:\Windows\System32\ComputerDefaults.exe"
          3⤵
          • Executes dropped EXE
          PID:3968
          • C:\Windows\SysWOW64\ComputerDefaults.exe
            C:\Windows\System32\ComputerDefaults.exe
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4844
            • C:\ProgramData\wIUQSCWxVPlvRGRvgycHZLeEMUJuswLY.cCn\XmhPZIShvtuoUyGKYUjUQHumOWvBtNCd.SiZ.exe
              "XmhPZIShvtuoUyGKYUjUQHumOWvBtNCd.SiZ.exe"
              5⤵
              • Executes dropped EXE
              PID:5412
        • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
          /c "C:\Windows\System32\ComputerDefaults.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1940
          • C:\Windows\SysWOW64\ComputerDefaults.exe
            C:\Windows\System32\ComputerDefaults.exe
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2816
            • C:\ProgramData\FszgDSDKbmCZjrXZZjUnsfSGhhoMzgEE.GYG\tEPuEwAbJQiPejJslsWeAUwnvVtMiAVj.aEq.exe
              "tEPuEwAbJQiPejJslsWeAUwnvVtMiAVj.aEq.exe"
              5⤵
                PID:796
          • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
            /c "C:\Windows\System32\ComputerDefaults.exe"
            3⤵
              PID:2756
              • C:\Windows\SysWOW64\ComputerDefaults.exe
                C:\Windows\System32\ComputerDefaults.exe
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1332
                • C:\ProgramData\ArZwqroIucYmzXmzTOBuIEnXRgbDOZBF.Ene\WWngjRFRXailqybNDIblYwnEhVLjKepk.ahX.exe
                  "WWngjRFRXailqybNDIblYwnEhVLjKepk.ahX.exe"
                  5⤵
                    PID:4224
              • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
                /c "C:\Windows\System32\ComputerDefaults.exe"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:5652
                • C:\Windows\SysWOW64\ComputerDefaults.exe
                  C:\Windows\System32\ComputerDefaults.exe
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:2524
                  • C:\ProgramData\UiCmjGWCtyKhRDCtaKoohdhEPNpkYKfe.bbx\lTbPLywegPRniNXrjbaXvZOAfnCjeWNu.HFg.exe
                    "lTbPLywegPRniNXrjbaXvZOAfnCjeWNu.HFg.exe"
                    5⤵
                      PID:5808
                • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
                  /c "C:\Windows\System32\ComputerDefaults.exe"
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:716
                  • C:\Windows\SysWOW64\ComputerDefaults.exe
                    C:\Windows\System32\ComputerDefaults.exe
                    4⤵
                      PID:2200
                      • C:\ProgramData\AzngfSzAgvPUsLvsHIWhrlYCzOiHUxeX.MpU\IbetsgFVDLoKxFxdOPrkJEArUDKMwRkZ.xVi.exe
                        "IbetsgFVDLoKxFxdOPrkJEArUDKMwRkZ.xVi.exe"
                        5⤵
                          PID:820
                    • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
                      /c "C:\Windows\System32\ComputerDefaults.exe"
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:888
                      • C:\Windows\SysWOW64\ComputerDefaults.exe
                        C:\Windows\System32\ComputerDefaults.exe
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:3252
                        • C:\ProgramData\HmeIStaSFyTsKOskUCqflArbBLniaOPo.bsJ\fLYjKwDwhqaLkjGtJoVBNGeHgkvxNZhb.HPf.exe
                          "fLYjKwDwhqaLkjGtJoVBNGeHgkvxNZhb.HPf.exe"
                          5⤵
                            PID:1472
                      • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
                        /c "C:\Windows\System32\ComputerDefaults.exe"
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:5052
                        • C:\Windows\SysWOW64\ComputerDefaults.exe
                          C:\Windows\System32\ComputerDefaults.exe
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:2572
                          • C:\ProgramData\tnOKElLfqKdaoyKaIFMmcqHahxBsoDra.OSW\QVlHmfOuIXnWsFXOcatYJRdKVJkeJTMB.vnf.exe
                            "QVlHmfOuIXnWsFXOcatYJRdKVJkeJTMB.vnf.exe"
                            5⤵
                              PID:3732
                        • C:\Users\Admin\AppData\Local\Temp\CMD.EXE
                          /c "C:\Windows\System32\ComputerDefaults.exe"
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:3944
                          • C:\Windows\SysWOW64\ComputerDefaults.exe
                            C:\Windows\System32\ComputerDefaults.exe
                            4⤵
                              PID:2372
                              • C:\ProgramData\BsfTNPfpaJpTGMOlBPRrVvfVgBLIauDr.ZRz\OUkrhSEVefdcrkMrwDmMDDtKHCtbojUL.oap.exe
                                "OUkrhSEVefdcrkMrwDmMDDtKHCtbojUL.oap.exe"
                                5⤵
                                  PID:3700
                        • C:\Users\Public\WINDOWSAPPS\`OTmgnkJ4647\1154.mjUF
                          C:\Users\Public\WINDOWSAPPS\`OTmgnkJ4647\1154.mjUF
                          1⤵
                          • Executes dropped EXE
                          PID:4364
                        • C:\Users\Public\WINDOWSAPPS\`OTmgnkJ4647\186.aIY
                          C:\Users\Public\WINDOWSAPPS\`OTmgnkJ4647\186.aIY
                          1⤵
                          • Executes dropped EXE
                          PID:6016

                        Network

                              MITRE ATT&CK Enterprise v16

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              PdFcOrE8.DlL
                              • Path C:\ProgramData\EEXPCJsOReZQgvRSoqsLIDmWlwXjUEpq.rEZ\PdFcOrE8.DlL
                              • Size 2.7MB
                              • SHA256 b582ef710b7e37384e1979604342c3921af48f92c67d161d641811dac750372c
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              PdFcOrE8.DlL.rtf
                              • Path C:\ProgramData\EEXPCJsOReZQgvRSoqsLIDmWlwXjUEpq.rEZ\PdFcOrE8.DlL.rtf
                              • Size 2.7MB
                              • SHA256 426d2619d8e32bcca4653ee6fe626495e90078b2e6ea827e829aa16a7c970553
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              KjYnVWMAMVLFPUTmrHKQbOaFyuCVNTwB.XfD.exe
                              • Path C:\ProgramData\HUjmXSaJnYZUzPsReKATewIBfWolwrMH.men\KjYnVWMAMVLFPUTmrHKQbOaFyuCVNTwB.XfD.exe
                              • Size 51KB
                              • SHA256 ce6bb7eddc83762c708d4a41709ae00371dbdc09b2a380f28fa60b1edf917473
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              CMD.EXE
                              • Path C:\Users\Admin\AppData\Local\Temp\CMD.EXE
                              • Size 247KB
                              • SHA256 66c09b9350a906c30d45cf00e8193c6a65862736aceb55ef8c9eb6f2b1aeca53
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              1154.mjUF
                              • Path C:\Users\Public\WindowsApps\`OTmgnkJ4647\1154.mjUF
                              • Size 17KB
                              • SHA256 671e564fa73da5f33f6591d27eef6d3f02264c94f4cf85328bab1412a7fcb687
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              1154.mjUF.rtf
                              • Path C:\Users\Public\WindowsApps\`OTmgnkJ4647\1154.mjUF.rtf
                              • Size 17KB
                              • SHA256 df84fd6a0fd2735b117295de2f0564ef877a243706cc717eeb6fb906cad2d3fd
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              186.aIY
                              • Path C:\Users\Public\WindowsApps\`OTmgnkJ4647\186.aIY
                              • Size 32KB
                              • SHA256 fb1c10d2d9e89ae8263faaed9b211bd1585896fc8eb4bc21622942a8a22cee09
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              186.aIY.rtf
                              • Path C:\Users\Public\WindowsApps\`OTmgnkJ4647\186.aIY.rtf
                              • Size 32KB
                              • SHA256 20d34744171ed9e3ff682f62a655a0514ce73fcfaf7950ba63a8235f4a39bad8
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              memory/4364-4-0x0000000000010000-0x0000000000017000-memory.dmp
                              Download