Overview

overview

7

Static

static

5

855f6404df...d4.dll

windows10-2004-x64

7

855f6404df...d4.dll

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/09/2026, 10:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    855f6404df38fca309c85ed4673501fe8e7583dec0105eda02929d7111224bd4.dll
  • Size 7.9MB
  • Sample260924-ml6tvabe24
  • SHA256 855f6404df38fca309c85ed4673501fe8e7583dec0105eda02929d7111224bd4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 37 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 62 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 55 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\855f6404df38fca309c85ed4673501fe8e7583dec0105eda02929d7111224bd4.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2888
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\855f6404df38fca309c85ed4673501fe8e7583dec0105eda02929d7111224bd4.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2524
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1428
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3292
          • C:\ProgramData\oSsuRrKDeKpVzhfFCgkEMILHBVLxiwTn.OLf\qzvgwpKWjyxeRPRpmaPaZRDjueousFCh.Kvr.exe
            "qzvgwpKWjyxeRPRpmaPaZRDjueousFCh.Kvr.exe"
            5⤵
            • Executes dropped EXE
            PID:4744
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5540
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5112
          • C:\ProgramData\bKfeluYGwxeywTTQkYhHMrrEWzrzLXDF.Zzl\rjzRVZpGPGRoacItUlWvWuYzWtjYGYPL.zbu.exe
            "rjzRVZpGPGRoacItUlWvWuYzWtjYGYPL.zbu.exe"
            5⤵
            • Executes dropped EXE
            PID:236
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3892
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4488
          • C:\ProgramData\KHcsNVijfabHTvOnNXwyNHJfOJerGMJj.lFY\evaQIOXSnUoETeuiwyelUQqNZSFcSQEg.xOY.exe
            "evaQIOXSnUoETeuiwyelUQqNZSFcSQEg.xOY.exe"
            5⤵
            • Executes dropped EXE
            PID:1956
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4636
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3388
          • C:\ProgramData\qRbivkiLTKjlsgcRTXmjEtCZuFbHcuke.rkc\AeDxkYaxhotHfyUZjOEGaWTLWVVwnBLS.KWl.exe
            "AeDxkYaxhotHfyUZjOEGaWTLWVVwnBLS.KWl.exe"
            5⤵
            • Executes dropped EXE
            PID:1224
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4364
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3864
          • C:\ProgramData\iMjtUxOxdCJjAICrldHANBGodMsVZjcX.Iyn\ZYmvCZcgqdClbJBcScVPtrPhGkjKxdbk.RPW.exe
            "ZYmvCZcgqdClbJBcScVPtrPhGkjKxdbk.RPW.exe"
            5⤵
            • Executes dropped EXE
            PID:4796
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2900
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1560
          • C:\ProgramData\ndPkhkdrseFqzwLZdumBZjxxdcPSaqKB.Dwj\BByScjaseUCAnnToSnUpInBmzvQLPhsM.cIO.exe
            "BByScjaseUCAnnToSnUpInBmzvQLPhsM.cIO.exe"
            5⤵
            • Executes dropped EXE
            PID:868
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4572
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1844
          • C:\ProgramData\WOgXEcfwpfQfHZLhHvBLJxGVPGgpdlJG.Suv\ehoIqoFZOrgUBIQIyvTcAYvQgsTGRXPX.gia.exe
            "ehoIqoFZOrgUBIQIyvTcAYvQgsTGRXPX.gia.exe"
            5⤵
            • Executes dropped EXE
            PID:2584
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3256
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:5820
          • C:\ProgramData\LJSRpJtissFObRORcsQmpvKimZnwGWFa.EQd\VVMMWspRojLwDtPsKhPuIYVdmZxeqINC.fzY.exe
            "VVMMWspRojLwDtPsKhPuIYVdmZxeqINC.fzY.exe"
            5⤵
            • Executes dropped EXE
            PID:2924
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3184
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5188
          • C:\ProgramData\VqzhiGGxUMcxHpNVCUdDTtADbIJeNJDm.Lzg\toRqxiyfNxWZANlWgOzQYhgRUuvvFfXs.bEm.exe
            "toRqxiyfNxWZANlWgOzQYhgRUuvvFfXs.bEm.exe"
            5⤵
            • Executes dropped EXE
            PID:5140
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4628
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3644
          • C:\ProgramData\LAuMhzNVHcxFhlAUSbDzrPNzbssDTEwl.ATS\bLbvOIHlyUYkEwzxnEPYiZOLuNqbjSxP.AJB.exe
            "bLbvOIHlyUYkEwzxnEPYiZOLuNqbjSxP.AJB.exe"
            5⤵
            • Executes dropped EXE
            PID:5308
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3112
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4244
          • C:\ProgramData\VEHClLXLKkgADexNiOYDDhsTcRbjGVtk.hVS\FUtZFgstQspBukkmBynRFKpqyctBJPQp.VQV.exe
            "FUtZFgstQspBukkmBynRFKpqyctBJPQp.VQV.exe"
            5⤵
            • Executes dropped EXE
            PID:2152
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4500
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5116
          • C:\ProgramData\CxYFZohnRrjMZcuLojiWbuhSETDnOEMM.ESG\tHAQRJdGrEIFmPqVjdFuvSBGZqoRmRyh.sOr.exe
            "tHAQRJdGrEIFmPqVjdFuvSBGZqoRmRyh.sOr.exe"
            5⤵
            • Executes dropped EXE
            PID:5632
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5652
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2400
          • C:\ProgramData\LoVgQkWHVsjaLAfLyyXwOmDXyEvaXQXQ.hHk\IRBqpJGpBtBeBWHXINxnqxASityGdcRe.NWF.exe
            "IRBqpJGpBtBeBWHXINxnqxASityGdcRe.NWF.exe"
            5⤵
            • Executes dropped EXE
            PID:2012
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5708
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3204
          • C:\ProgramData\uDlODsoUfpmpLAdBlanAPbVBQDTkCGQj.yvq\zjMeLIvDJysJBqBQwmkaBqdRYSIsLcnl.oir.exe
            "zjMeLIvDJysJBqBQwmkaBqdRYSIsLcnl.oir.exe"
            5⤵
            • Executes dropped EXE
            PID:1964
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1788
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4716
          • C:\ProgramData\REZacgeIAKMDRDtmUBYZhBHturjXEkGa.rTH\pGljggYJFaCagIWUTxNrmvwSfHaNcZLM.fUZ.exe
            "pGljggYJFaCagIWUTxNrmvwSfHaNcZLM.fUZ.exe"
            5⤵
            • Executes dropped EXE
            PID:3612
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3452
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3844
          • C:\ProgramData\VBbuJLNnvdmhnZUtRBCDSZzWUXmDdIsu.WyZ\tpXYSkklqNeGnfLvbfPDdnayBotYoqYM.Ynt.exe
            "tpXYSkklqNeGnfLvbfPDdnayBotYoqYM.Ynt.exe"
            5⤵
            • Executes dropped EXE
            PID:3896
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2860
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2704
          • C:\ProgramData\BMCVGdlepUOAErhtjMLWiCzaGdCIUKtm.uQq\jlXEsMmoawNWTWuZEVPLTRoSEPUXMgRU.KpB.exe
            "jlXEsMmoawNWTWuZEVPLTRoSEPUXMgRU.KpB.exe"
            5⤵
            • Executes dropped EXE
            PID:5772
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5020
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4632
          • C:\ProgramData\wEcsZyOAAwKMffRKqtSkCcixzbuOGTUg.crH\ORHWorFscJvzXPAiCSfBynCnCapXpknu.fCk.exe
            "ORHWorFscJvzXPAiCSfBynCnCapXpknu.fCk.exe"
            5⤵
            • Executes dropped EXE
            PID:4796
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2160
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3900
          • C:\ProgramData\YQkaxqmBwpQbkifCnYgnjixrHSKdsbfh.tjs\aUWtyhHjieBFtZWHidFzoEAbVbRmissY.aFL.exe
            "aUWtyhHjieBFtZWHidFzoEAbVbRmissY.aFL.exe"
            5⤵
            • Executes dropped EXE
            PID:1996
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2988
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2776
          • C:\ProgramData\HKTbiOjquHwuulZLjwqTXSdQtUJHNvSv.GfJ\ZFhnxrNPObfBNcqPkUXhTMYjmVUOXfWn.GbQ.exe
            "ZFhnxrNPObfBNcqPkUXhTMYjmVUOXfWn.GbQ.exe"
            5⤵
            • Executes dropped EXE
            PID:3136
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2508
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:5556
          • C:\ProgramData\umBIFXWwnLnAiDWyUvODSzcbadTHLDwV.tzA\aGcAgVVPIyIWabVjoOxzVqMTCfKGiwyT.afn.exe
            "aGcAgVVPIyIWabVjoOxzVqMTCfKGiwyT.afn.exe"
            5⤵
            • Executes dropped EXE
            PID:4504
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4460
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3472
          • C:\ProgramData\llAfmmMiQEHjznWspDvEdUAgNDkjHAcF.NtM\VQEiFEINoifJGfyAOZcnuRFbgchtRDdG.oTA.exe
            "VQEiFEINoifJGfyAOZcnuRFbgchtRDdG.oTA.exe"
            5⤵
            • Executes dropped EXE
            PID:2960
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3556
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2408
          • C:\ProgramData\ummFmWbyJCFPhOqkmuMKaQUJNzXXNMPB.ont\rcKMNokWWzYVbwKgZRiXwQsRxJFyhQGv.wRJ.exe
            "rcKMNokWWzYVbwKgZRiXwQsRxJFyhQGv.wRJ.exe"
            5⤵
            • Executes dropped EXE
            PID:4616
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
          PID:1924
          • C:\Windows\SysWOW64\ComputerDefaults.exe
            C:\Windows\System32\ComputerDefaults.exe
            4⤵
            • System Location Discovery: System Language Discovery
            PID:5572
            • C:\ProgramData\ROZMDudUjtMprkooMVPXHXndephcJqWt.uvF\yJeGDRrfUzThyLtlQtRsASbRvMqIjKxT.mID.exe
              "yJeGDRrfUzThyLtlQtRsASbRvMqIjKxT.mID.exe"
              5⤵
              • Executes dropped EXE
              PID:4644
        • C:\Windows\SysWOW64\cmd.exe
          /c "C:\Windows\System32\ComputerDefaults.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:5596
          • C:\Windows\SysWOW64\ComputerDefaults.exe
            C:\Windows\System32\ComputerDefaults.exe
            4⤵
            • System Location Discovery: System Language Discovery
            PID:3408
            • C:\ProgramData\tePXjGkIQQuEEIZPmkhrWahNsuSLYtyX.OqB\eqxOySoPwgIwGdOyvLhfBABwUlnQNUTZ.Cyi.exe
              "eqxOySoPwgIwGdOyvLhfBABwUlnQNUTZ.Cyi.exe"
              5⤵
              • Executes dropped EXE
              PID:3416
        • C:\Windows\SysWOW64\cmd.exe
          /c "C:\Windows\System32\ComputerDefaults.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4548
          • C:\Windows\SysWOW64\ComputerDefaults.exe
            C:\Windows\System32\ComputerDefaults.exe
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2436
            • C:\ProgramData\AQtHpTWtsLXlaDqVoHMQyfVxjPivauwX.lrm\ULbyRgfTeZFBtxBbDPvTJzffudfgPlzi.jxh.exe
              "ULbyRgfTeZFBtxBbDPvTJzffudfgPlzi.jxh.exe"
              5⤵
              • Executes dropped EXE
              PID:5788
        • C:\Windows\SysWOW64\cmd.exe
          /c "C:\Windows\System32\ComputerDefaults.exe"
          3⤵
            PID:5420
            • C:\Windows\SysWOW64\ComputerDefaults.exe
              C:\Windows\System32\ComputerDefaults.exe
              4⤵
              • System Location Discovery: System Language Discovery
              PID:3764
              • C:\ProgramData\bPTRIwTQpYNKgFZYecgCcTMYiGoTtHsx.iMk\SYMgxEiLnnJBSQBUYamNucAUfvgwAxym.uZl.exe
                "SYMgxEiLnnJBSQBUYamNucAUfvgwAxym.uZl.exe"
                5⤵
                • Executes dropped EXE
                PID:2456
          • C:\Windows\SysWOW64\cmd.exe
            /c "C:\Windows\System32\ComputerDefaults.exe"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2076
            • C:\Windows\SysWOW64\ComputerDefaults.exe
              C:\Windows\System32\ComputerDefaults.exe
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2416
              • C:\ProgramData\pWWyToObiUaAYjsOLuOaEcvUpYMXZwrK.wZH\eqHazDUKXxOXkMboRQkqODFMjaNtVxAY.xVC.exe
                "eqHazDUKXxOXkMboRQkqODFMjaNtVxAY.xVC.exe"
                5⤵
                • Executes dropped EXE
                PID:3748
          • C:\Windows\SysWOW64\cmd.exe
            /c "C:\Windows\System32\ComputerDefaults.exe"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:4388
            • C:\Windows\SysWOW64\ComputerDefaults.exe
              C:\Windows\System32\ComputerDefaults.exe
              4⤵
              • System Location Discovery: System Language Discovery
              PID:1964
              • C:\ProgramData\DkgKXfRsKjnUHbXHcQxVBOmdrYMTAvIk.HmM\kyeiMYoHkHryoOaAHTzSMHrvsdPmsXNo.ftV.exe
                "kyeiMYoHkHryoOaAHTzSMHrvsdPmsXNo.ftV.exe"
                5⤵
                • Executes dropped EXE
                PID:5800
          • C:\Windows\SysWOW64\cmd.exe
            /c "C:\Windows\System32\ComputerDefaults.exe"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:5900
            • C:\Windows\SysWOW64\ComputerDefaults.exe
              C:\Windows\System32\ComputerDefaults.exe
              4⤵
              • System Location Discovery: System Language Discovery
              PID:1108
              • C:\ProgramData\gthnbisiqYDggwVuyGxUsHoZIPYoxWHG.ePm\oLtHVIQHYPxKONyTxCoCLfMxqvTDRbTA.IAQ.exe
                "oLtHVIQHYPxKONyTxCoCLfMxqvTDRbTA.IAQ.exe"
                5⤵
                • Executes dropped EXE
                PID:120
          • C:\Windows\SysWOW64\cmd.exe
            /c "C:\Windows\System32\ComputerDefaults.exe"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:1696
            • C:\Windows\SysWOW64\ComputerDefaults.exe
              C:\Windows\System32\ComputerDefaults.exe
              4⤵
              • System Location Discovery: System Language Discovery
              PID:5620
              • C:\ProgramData\nNzGZrrdMbRJnZLBtwcmFDUXYhstdsWD.btK\TlhhTPfNvDDQrHHeZqIgULLWcTfWNmZF.eGy.exe
                "TlhhTPfNvDDQrHHeZqIgULLWcTfWNmZF.eGy.exe"
                5⤵
                • Executes dropped EXE
                PID:5156
          • C:\Windows\SysWOW64\cmd.exe
            /c "C:\Windows\System32\ComputerDefaults.exe"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:4880
            • C:\Windows\SysWOW64\ComputerDefaults.exe
              C:\Windows\System32\ComputerDefaults.exe
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2132
              • C:\ProgramData\qFuknZptpBBSLsvmlKDZVYgeEppYuNbD.ukL\DzuVZbOEOujvHbxutdCdAiwEHRuDVRSS.bue.exe
                "DzuVZbOEOujvHbxutdCdAiwEHRuDVRSS.bue.exe"
                5⤵
                • Executes dropped EXE
                PID:1724
          • C:\Windows\SysWOW64\cmd.exe
            /c "C:\Windows\System32\ComputerDefaults.exe"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:5580
            • C:\Windows\SysWOW64\ComputerDefaults.exe
              C:\Windows\System32\ComputerDefaults.exe
              4⤵
                PID:5648
                • C:\ProgramData\vgtQVmhXeotdklbBkNRWmlJcXmxAbDCT.YxT\BWKDfCiaWFAuUVypXwmaGtwGVlIDVrMY.yGM.exe
                  "BWKDfCiaWFAuUVypXwmaGtwGVlIDVrMY.yGM.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:3148
            • C:\Windows\SysWOW64\cmd.exe
              /c "C:\Windows\System32\ComputerDefaults.exe"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:916
              • C:\Windows\SysWOW64\ComputerDefaults.exe
                C:\Windows\System32\ComputerDefaults.exe
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2292
                • C:\ProgramData\GvGHmuBYAZiNVZtQyykAXtzwAYtEwrzt.sqw\KJrZUvJQspTNkvjjcieYDHJfJvlYgGOd.Fmf.exe
                  "KJrZUvJQspTNkvjjcieYDHJfJvlYgGOd.Fmf.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:6008
            • C:\Windows\SysWOW64\cmd.exe
              /c "C:\Windows\System32\ComputerDefaults.exe"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:4292
              • C:\Windows\SysWOW64\ComputerDefaults.exe
                C:\Windows\System32\ComputerDefaults.exe
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2128
                • C:\ProgramData\VVEKUQYZODLZmVheeHYhgzkKrCSHtASD.EIJ\cnAHpgFDLdOZjzLFzdyfTNzEWfvBozRE.Xje.exe
                  "cnAHpgFDLdOZjzLFzdyfTNzEWfvBozRE.Xje.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:4328
            • C:\Windows\SysWOW64\cmd.exe
              /c "C:\Windows\System32\ComputerDefaults.exe"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:3220
              • C:\Windows\SysWOW64\ComputerDefaults.exe
                C:\Windows\System32\ComputerDefaults.exe
                4⤵
                • System Location Discovery: System Language Discovery
                PID:4104
                • C:\ProgramData\tjAOPixSVajfuAFktAJKaNBtzEbDhAgD.cde\goovgYmSISlePxglDwWwYgjaclETVHwr.ZHT.exe
                  "goovgYmSISlePxglDwWwYgjaclETVHwr.ZHT.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:5104
            • C:\Windows\SysWOW64\cmd.exe
              /c "C:\Windows\System32\ComputerDefaults.exe"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:4336
              • C:\Windows\SysWOW64\ComputerDefaults.exe
                C:\Windows\System32\ComputerDefaults.exe
                4⤵
                • System Location Discovery: System Language Discovery
                PID:5712
                • C:\ProgramData\TINyKzPtnWWwEDgtieRwjVGNHTaXmGiS.FGt\HmYRKohgxKjsgukQlABPZNwwRQGAZgpg.qkQ.exe
                  "HmYRKohgxKjsgukQlABPZNwwRQGAZgpg.qkQ.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:5244

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              PDfcoRE8.DLl
              • Path C:\ProgramData\KHcsNVijfabHTvOnNXwyNHJfOJerGMJj.lFY\PDfcoRE8.DLl
              • Size 2.7MB
              • SHA256 b582ef710b7e37384e1979604342c3921af48f92c67d161d641811dac750372c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PDfcoRE8.DLl.rtf
              • Path C:\ProgramData\KHcsNVijfabHTvOnNXwyNHJfOJerGMJj.lFY\PDfcoRE8.DLl.rtf
              • Size 2.7MB
              • SHA256 426d2619d8e32bcca4653ee6fe626495e90078b2e6ea827e829aa16a7c970553
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              qzvgwpKWjyxeRPRpmaPaZRDjueousFCh.Kvr.exe
              • Path C:\ProgramData\oSsuRrKDeKpVzhfFCgkEMILHBVLxiwTn.OLf\qzvgwpKWjyxeRPRpmaPaZRDjueousFCh.Kvr.exe
              • Size 51KB
              • SHA256 ce6bb7eddc83762c708d4a41709ae00371dbdc09b2a380f28fa60b1edf917473
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              5369.sOb
              • Path C:\Users\Public\WindowsApps\ikt`),inX\5369.sOb
              • Size 17KB
              • SHA256 671e564fa73da5f33f6591d27eef6d3f02264c94f4cf85328bab1412a7fcb687
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              5369.sOb.rtf
              • Path C:\Users\Public\WindowsApps\ikt`),inX\5369.sOb.rtf
              • Size 17KB
              • SHA256 df84fd6a0fd2735b117295de2f0564ef877a243706cc717eeb6fb906cad2d3fd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              782.dWJ
              • Path C:\Users\Public\WindowsApps\ikt`),inX\782.dWJ
              • Size 32KB
              • SHA256 fb1c10d2d9e89ae8263faaed9b211bd1585896fc8eb4bc21622942a8a22cee09
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              782.dWJ.rtf
              • Path C:\Users\Public\WindowsApps\ikt`),inX\782.dWJ.rtf
              • Size 32KB
              • SHA256 20d34744171ed9e3ff682f62a655a0514ce73fcfaf7950ba63a8235f4a39bad8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download