Overview

overview

7

Static

static

3

0dffb146a7...09.dll

windows10-2004-x64

7

0dffb146a7...09.dll

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/09/2026, 11:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    0dffb146a78c68ed68846ec7006d945d54606f8a01911db9e58c7a8c3db4a609.dll
  • Size 7.9MB
  • Sample260924-npg6bscf52
  • SHA256 0dffb146a78c68ed68846ec7006d945d54606f8a01911db9e58c7a8c3db4a609
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 39 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 55 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\0dffb146a78c68ed68846ec7006d945d54606f8a01911db9e58c7a8c3db4a609.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4776
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\0dffb146a78c68ed68846ec7006d945d54606f8a01911db9e58c7a8c3db4a609.dll,#1
      2⤵
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2248
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4844
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4828
          • C:\ProgramData\CHHSasKOhTdydMHsKHajjBVREHhCiKbD.UjN\ceUoItQMvzhYEeyBpIDLchjeFhbXCjjS.ZYf.exe
            "ceUoItQMvzhYEeyBpIDLchjeFhbXCjjS.ZYf.exe"
            5⤵
            • Executes dropped EXE
            PID:3140
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4304
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2980
          • C:\ProgramData\IhlJnWQCZJysHeDRMhTtDtKsYVIzjXkj.RWw\tIlmLJWcjkdwNBewxJyKUIMWahwufmxv.Puo.exe
            "tIlmLJWcjkdwNBewxJyKUIMWahwufmxv.Puo.exe"
            5⤵
            • Executes dropped EXE
            PID:4664
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4540
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3344
          • C:\ProgramData\JVVLdWkawdOGySgUTBLLcrmNxfRvDUZn.MdF\gBNnQtdtdkUIDuEbPdqaClyAzYhlZheu.qMx.exe
            "gBNnQtdtdkUIDuEbPdqaClyAzYhlZheu.qMx.exe"
            5⤵
            • Executes dropped EXE
            PID:4312
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2960
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:5180
          • C:\ProgramData\VkVIPcddYZOjfwjnuSiMxlntqrKlPRAi.JFJ\KcgYOmIfoaBfSiVXezlecYWXFWqPRmhc.YlX.exe
            "KcgYOmIfoaBfSiVXezlecYWXFWqPRmhc.YlX.exe"
            5⤵
            • Executes dropped EXE
            PID:4948
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:432
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:672
          • C:\ProgramData\kCSLWANZjiRkoGwxiBulTdxjGJHjUyZe.LUx\zpyDeVQEuoOZWtHBzcjmpoMwaRuIrbkT.NLQ.exe
            "zpyDeVQEuoOZWtHBzcjmpoMwaRuIrbkT.NLQ.exe"
            5⤵
            • Executes dropped EXE
            PID:3580
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4344
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5540
          • C:\ProgramData\AUxyXrQvFGuREksdjooEdmgbRmoebzsc.KAf\zBfMtScRvBrJQgIogaaAKyrjeNwajSIQ.YJT.exe
            "zBfMtScRvBrJQgIogaaAKyrjeNwajSIQ.YJT.exe"
            5⤵
            • Executes dropped EXE
            PID:5980
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3528
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3016
          • C:\ProgramData\GkoCPdprVHCXcfUdMIgJiUdTgGftfCyI.TkB\fWAWLywNcfcTbCpwbqEPvVvAmNKmFKgJ.Vad.exe
            "fWAWLywNcfcTbCpwbqEPvVvAmNKmFKgJ.Vad.exe"
            5⤵
            • Executes dropped EXE
            PID:1340
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4736
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:504
          • C:\ProgramData\hOTxUenOLeEllHGUjlwROKKfDufmyjmf.jkx\UHkWbePsidUXYyfrWOlwAMxITPiXJaTa.qUx.exe
            "UHkWbePsidUXYyfrWOlwAMxITPiXJaTa.qUx.exe"
            5⤵
            • Executes dropped EXE
            PID:6068
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3204
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4620
          • C:\ProgramData\sGECCUafDnXoHKoPlpgVOpLmpdrBQtNJ.xjv\hOOdCHRyxhwBlUoBEYcSEXTfuawlFNFG.XLU.exe
            "hOOdCHRyxhwBlUoBEYcSEXTfuawlFNFG.XLU.exe"
            5⤵
            • Executes dropped EXE
            PID:4120
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3524
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:124
          • C:\ProgramData\yFQRizVstruWmdjbjuMlMvWVcIrBevrI.XQG\SHiOyorZChiDgVBIkiQHpRzzlXSsFabP.dJX.exe
            "SHiOyorZChiDgVBIkiQHpRzzlXSsFabP.dJX.exe"
            5⤵
            • Executes dropped EXE
            PID:4276
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5248
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2704
          • C:\ProgramData\ioIFpNzIHUQoJVmBCnFplnnEQOXnQvgd.TVe\qGkhBePsmOuGhcAPoTbvOZQkReZwkUFc.NuM.exe
            "qGkhBePsmOuGhcAPoTbvOZQkReZwkUFc.NuM.exe"
            5⤵
            • Executes dropped EXE
            PID:5332
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1404
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2616
          • C:\ProgramData\ndKBXxobGaPVcUuOOwIdRCCVKzATpawl.vNC\UBqfTfUSzdDlnyVXgrAZVMgUhkOEpKGm.eKQ.exe
            "UBqfTfUSzdDlnyVXgrAZVMgUhkOEpKGm.eKQ.exe"
            5⤵
            • Executes dropped EXE
            PID:6044
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5172
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:204
          • C:\ProgramData\QbgRHKUscJUYEzktsbyDaNvxEwFzrcuy.Bik\nlvFmmPdEaLIJmaKYVpCkADRNeQlzsXU.wVc.exe
            "nlvFmmPdEaLIJmaKYVpCkADRNeQlzsXU.wVc.exe"
            5⤵
            • Executes dropped EXE
            PID:5900
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4368
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3552
          • C:\ProgramData\GPIOhmsDZVXRULociyzRUGbUzTjcISxY.Rfo\eIssNEKLBPtzwLNLXvFpworzTdaTfmWL.hUz.exe
            "eIssNEKLBPtzwLNLXvFpworzTdaTfmWL.hUz.exe"
            5⤵
            • Executes dropped EXE
            PID:4300
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1664
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4080
          • C:\ProgramData\tgqiZwhySNxTWqJLIudLoIiPbaiWGZBA.CNj\jTgTypzjFgLDYzAWQvsZUiCTmMgzniTQ.iRy.exe
            "jTgTypzjFgLDYzAWQvsZUiCTmMgzniTQ.iRy.exe"
            5⤵
            • Executes dropped EXE
            PID:4076
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3128
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5892
          • C:\ProgramData\zRvjTaZIYIoTcFMnMrycSIdmPpaDJDaj.SAK\XhtvugHEVFsNiCAVkqIfthalQfOSthFx.pMh.exe
            "XhtvugHEVFsNiCAVkqIfthalQfOSthFx.pMh.exe"
            5⤵
            • Executes dropped EXE
            PID:620
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1604
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4916
          • C:\ProgramData\KssZPdjWzmBxhZrgTwHAQKuIfMMjfNHK.dMM\ndPwtYreXupPlLQPKdIOWZkexaQuLCmp.GiT.exe
            "ndPwtYreXupPlLQPKdIOWZkexaQuLCmp.GiT.exe"
            5⤵
            • Executes dropped EXE
            PID:2132
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5296
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5340
          • C:\ProgramData\tgKWOWUiQmnFFaUiUwHWIwFCSeDcCdXq.DMp\GHqgPpSVtNyPkZHUSjRbYYwhoRExlFgp.kAG.exe
            "GHqgPpSVtNyPkZHUSjRbYYwhoRExlFgp.kAG.exe"
            5⤵
            • Executes dropped EXE
            PID:3000
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2828
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3012
          • C:\ProgramData\CwbiBbpUDtgyWHRtQZhnutbyCVOXVnIY.RAR\MdkQKzpjglfCTnbOKpegYZdktYAnLEQS.Hov.exe
            "MdkQKzpjglfCTnbOKpegYZdktYAnLEQS.Hov.exe"
            5⤵
            • Executes dropped EXE
            PID:2896
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1524
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1496
          • C:\ProgramData\aPDBmnfvfdTQhvHJbogflqPKDnguCBOU.Wda\dWqZyLqptSviJeGCwdOWSRtDrrkKXBBi.SzZ.exe
            "dWqZyLqptSviJeGCwdOWSRtDrrkKXBBi.SzZ.exe"
            5⤵
            • Executes dropped EXE
            PID:2916
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3580
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2352
          • C:\ProgramData\nMVlwnQghRjBxxuMKmimzTUpLTHGsnVO.KCi\YzCMKRqtSpNcrBWcRdQDTGwDiDKSRFjo.MuN.exe
            "YzCMKRqtSpNcrBWcRdQDTGwDiDKSRFjo.MuN.exe"
            5⤵
            • Executes dropped EXE
            PID:4760
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4008
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:6040
          • C:\ProgramData\EqLZSuMOFnZJZZdrBnamVBvFYBWPtFQf.iVn\swNHLedRKZGbXsHXKSMgIojNeSQsTXlJ.voB.exe
            "swNHLedRKZGbXsHXKSMgIojNeSQsTXlJ.voB.exe"
            5⤵
            • Executes dropped EXE
            PID:756
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4792
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1340
          • C:\ProgramData\NnqLBvjgVyFaIFIKGuYkxjgrfALOFDEB.VEp\kLrhucRnpgQKEKXNoTAkTkvriICfzucZ.ODz.exe
            "kLrhucRnpgQKEKXNoTAkTkvriICfzucZ.ODz.exe"
            5⤵
            • Executes dropped EXE
            PID:4264
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4252
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5312
          • C:\ProgramData\eZpiIuwyJvSjWKlXuGsDiLFFgwDCPfuA.Qcv\fBeTVNnIpzxRQocyiDkeKeNQCoBTzpmP.lAC.exe
            "fBeTVNnIpzxRQocyiDkeKeNQCoBTzpmP.lAC.exe"
            5⤵
            • Executes dropped EXE
            PID:2608
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2324
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
            PID:1668
            • C:\ProgramData\GBzfxazBXugXOFzRJYLRWATDFIcVFGyF.vTN\YtftZOnamYmGOcamchddPkXHcrKkLnCy.xSL.exe
              "YtftZOnamYmGOcamchddPkXHcrKkLnCy.xSL.exe"
              5⤵
              • Executes dropped EXE
              PID:3544
        • C:\Windows\SysWOW64\cmd.exe
          /c "C:\Windows\System32\ComputerDefaults.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4272
          • C:\Windows\SysWOW64\ComputerDefaults.exe
            C:\Windows\System32\ComputerDefaults.exe
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4784
            • C:\ProgramData\hDiVuQnreZclfdgixLTmWBdGZPaUkTXB.YHm\sBLFqCrJXzeKwKIDNbqEygWqgoNjlJKj.xoT.exe
              "sBLFqCrJXzeKwKIDNbqEygWqgoNjlJKj.xoT.exe"
              5⤵
              • Executes dropped EXE
              PID:1972
        • C:\Windows\SysWOW64\cmd.exe
          /c "C:\Windows\System32\ComputerDefaults.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4036
          • C:\Windows\SysWOW64\ComputerDefaults.exe
            C:\Windows\System32\ComputerDefaults.exe
            4⤵
            • System Location Discovery: System Language Discovery
            PID:6108
            • C:\ProgramData\nmpmPgUpMeLNIRtZimKPNnWikUjXMnnD.wrx\ypvbgyskMeUnNMdBsTgBJqgOCFkhsezt.zee.exe
              "ypvbgyskMeUnNMdBsTgBJqgOCFkhsezt.zee.exe"
              5⤵
              • Executes dropped EXE
              PID:5360
        • C:\Windows\SysWOW64\cmd.exe
          /c "C:\Windows\System32\ComputerDefaults.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:5332
          • C:\Windows\SysWOW64\ComputerDefaults.exe
            C:\Windows\System32\ComputerDefaults.exe
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1988
            • C:\ProgramData\vyxbRnPpfASdTXhyYBUyYvQlkBAXPWkr.UHf\PoQHgshrweoQldBJcFnQJRAkvQVMTxhh.TVX.exe
              "PoQHgshrweoQldBJcFnQJRAkvQVMTxhh.TVX.exe"
              5⤵
              • Executes dropped EXE
              PID:3376
        • C:\Windows\SysWOW64\cmd.exe
          /c "C:\Windows\System32\ComputerDefaults.exe"
          3⤵
            PID:4188
            • C:\Windows\SysWOW64\ComputerDefaults.exe
              C:\Windows\System32\ComputerDefaults.exe
              4⤵
                PID:5916
                • C:\ProgramData\oiAjRngewzxfVVLTHTLkeBPCXaBSBdKI.hiS\oPKWeKhsPyiSRWynokmGOXCjWwtQtoFp.oBG.exe
                  "oPKWeKhsPyiSRWynokmGOXCjWwtQtoFp.oBG.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:5536
            • C:\Windows\SysWOW64\cmd.exe
              /c "C:\Windows\System32\ComputerDefaults.exe"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1596
              • C:\Windows\SysWOW64\ComputerDefaults.exe
                C:\Windows\System32\ComputerDefaults.exe
                4⤵
                • System Location Discovery: System Language Discovery
                PID:5132
                • C:\ProgramData\BqHVKYaenLKbWpBVqcPsGsZWfRobJLIa.gfH\XXGteYgltzphgsjkTkdXlpNWFqfsjklx.uNE.exe
                  "XXGteYgltzphgsjkTkdXlpNWFqfsjklx.uNE.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:2924
            • C:\Windows\SysWOW64\cmd.exe
              /c "C:\Windows\System32\ComputerDefaults.exe"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2428
              • C:\Windows\SysWOW64\ComputerDefaults.exe
                C:\Windows\System32\ComputerDefaults.exe
                4⤵
                • System Location Discovery: System Language Discovery
                PID:4696
                • C:\ProgramData\FXeQngIKQMthTpIJzCDGYNOKpyKONJZQ.UNS\IWkdjiuxdbuocgGsLsoEWPgLmLHvqRxv.FkE.exe
                  "IWkdjiuxdbuocgGsLsoEWPgLmLHvqRxv.FkE.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:4376
            • C:\Windows\SysWOW64\cmd.exe
              /c "C:\Windows\System32\ComputerDefaults.exe"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2504
              • C:\Windows\SysWOW64\ComputerDefaults.exe
                C:\Windows\System32\ComputerDefaults.exe
                4⤵
                  PID:1932
                  • C:\ProgramData\knhkMqFIdZVODQNpoigfLUcuQwQynhOW.lNh\qSSXACaOoXPnhhRaIkHzRlbRmyWBwjQg.unT.exe
                    "qSSXACaOoXPnhhRaIkHzRlbRmyWBwjQg.unT.exe"
                    5⤵
                    • Executes dropped EXE
                    PID:3020
              • C:\Windows\SysWOW64\cmd.exe
                /c "C:\Windows\System32\ComputerDefaults.exe"
                3⤵
                  PID:1872
                  • C:\Windows\SysWOW64\ComputerDefaults.exe
                    C:\Windows\System32\ComputerDefaults.exe
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:2832
                    • C:\ProgramData\AwAYJoxdvhfEciNfNFDueIqvGkqZYceo.QWo\wyIlPKySGBtsEDJgrEMmEIjbozuUYnmL.rCp.exe
                      "wyIlPKySGBtsEDJgrEMmEIjbozuUYnmL.rCp.exe"
                      5⤵
                      • Executes dropped EXE
                      PID:5708
                • C:\Windows\SysWOW64\cmd.exe
                  /c "C:\Windows\System32\ComputerDefaults.exe"
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:2944
                  • C:\Windows\SysWOW64\ComputerDefaults.exe
                    C:\Windows\System32\ComputerDefaults.exe
                    4⤵
                      PID:368
                      • C:\ProgramData\SFtZdTtZqDhAAzBsalEbnWPYxNhOhJBY.ohA\QizJYRUyLUDSncxcZiJMgguBTOgxOOsm.Ofo.exe
                        "QizJYRUyLUDSncxcZiJMgguBTOgxOOsm.Ofo.exe"
                        5⤵
                        • Executes dropped EXE
                        PID:2844
                  • C:\Windows\SysWOW64\cmd.exe
                    /c "C:\Windows\System32\ComputerDefaults.exe"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:3048
                    • C:\Windows\SysWOW64\ComputerDefaults.exe
                      C:\Windows\System32\ComputerDefaults.exe
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:2388
                      • C:\ProgramData\jfYGFpsRAXQAYAGXKCOJVvaAxcMEcnqj.Unx\WGRVdBtpTWmULfWaJaTmBPCnwTRHrDAW.yhw.exe
                        "WGRVdBtpTWmULfWaJaTmBPCnwTRHrDAW.yhw.exe"
                        5⤵
                        • Executes dropped EXE
                        PID:2120
                  • C:\Windows\SysWOW64\cmd.exe
                    /c "C:\Windows\System32\ComputerDefaults.exe"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:2468
                    • C:\Windows\SysWOW64\ComputerDefaults.exe
                      C:\Windows\System32\ComputerDefaults.exe
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:5004
                      • C:\ProgramData\PYtLtjEvJEaanWagsdMMnXFmLvBOvfvE.uJi\wGwDqdciEkvYgKrvTxanzCJnQIouKyrs.cKq.exe
                        "wGwDqdciEkvYgKrvTxanzCJnQIouKyrs.cKq.exe"
                        5⤵
                        • Executes dropped EXE
                        PID:5424
                  • C:\Windows\SysWOW64\cmd.exe
                    /c "C:\Windows\System32\ComputerDefaults.exe"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:6080
                    • C:\Windows\SysWOW64\ComputerDefaults.exe
                      C:\Windows\System32\ComputerDefaults.exe
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:3064
                      • C:\ProgramData\qzWYGoGnBtQyVeeNpmbDibVcJCuRhQev.EDv\SPxKuiVDPMCBcBweFWAYCaeSaTrDlHHo.Tuv.exe
                        "SPxKuiVDPMCBcBweFWAYCaeSaTrDlHHo.Tuv.exe"
                        5⤵
                        • Executes dropped EXE
                        PID:3220
              • C:\Users\Public\WINDOWSAPPS\ixs++`GtW\4246.FnE
                C:\Users\Public\WINDOWSAPPS\ixs++`GtW\4246.FnE
                1⤵
                • Executes dropped EXE
                PID:2580
              • C:\Users\Public\WINDOWSAPPS\ixs++`GtW\584.ITZ
                C:\Users\Public\WINDOWSAPPS\ixs++`GtW\584.ITZ
                1⤵
                • Executes dropped EXE
                PID:1400

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    ceUoItQMvzhYEeyBpIDLchjeFhbXCjjS.ZYf.exe
                    • Path C:\ProgramData\CHHSasKOhTdydMHsKHajjBVREHhCiKbD.UjN\ceUoItQMvzhYEeyBpIDLchjeFhbXCjjS.ZYf.exe
                    • Size 51KB
                    • SHA256 ce6bb7eddc83762c708d4a41709ae00371dbdc09b2a380f28fa60b1edf917473
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pdfCOre8.Dll
                    • Path C:\ProgramData\JVVLdWkawdOGySgUTBLLcrmNxfRvDUZn.MdF\pdfCOre8.Dll
                    • Size 2.7MB
                    • SHA256 b582ef710b7e37384e1979604342c3921af48f92c67d161d641811dac750372c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pdfCOre8.Dll.rtf
                    • Path C:\ProgramData\JVVLdWkawdOGySgUTBLLcrmNxfRvDUZn.MdF\pdfCOre8.Dll.rtf
                    • Size 2.7MB
                    • SHA256 426d2619d8e32bcca4653ee6fe626495e90078b2e6ea827e829aa16a7c970553
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    4246.FnE
                    • Path C:\Users\Public\WindowsApps\ixs++`GtW\4246.FnE
                    • Size 17KB
                    • SHA256 671e564fa73da5f33f6591d27eef6d3f02264c94f4cf85328bab1412a7fcb687
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    4246.FnE.rtf
                    • Path C:\Users\Public\WindowsApps\ixs++`GtW\4246.FnE.rtf
                    • Size 17KB
                    • SHA256 df84fd6a0fd2735b117295de2f0564ef877a243706cc717eeb6fb906cad2d3fd
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    584.ITZ
                    • Path C:\Users\Public\WindowsApps\ixs++`GtW\584.ITZ
                    • Size 32KB
                    • SHA256 fb1c10d2d9e89ae8263faaed9b211bd1585896fc8eb4bc21622942a8a22cee09
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    584.ITZ.rtf
                    • Path C:\Users\Public\WindowsApps\ixs++`GtW\584.ITZ.rtf
                    • Size 32KB
                    • SHA256 20d34744171ed9e3ff682f62a655a0514ce73fcfaf7950ba63a8235f4a39bad8
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    memory/2580-4-0x0000000000010000-0x0000000000017000-memory.dmp
                    Download