Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/11/2024, 14:26
Static task
static1
Behavioral task
behavioral1
Sample
2024-11-19_5fcd7daf512e42fad78ab5836cadc1e2_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-11-19_5fcd7daf512e42fad78ab5836cadc1e2_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-11-19_5fcd7daf512e42fad78ab5836cadc1e2_mafia.exe
-
Size
487KB
-
MD5
5fcd7daf512e42fad78ab5836cadc1e2
-
SHA1
3ba4344fa6cb35451b5307b3802e288b607423d4
-
SHA256
95620503eb84010d627c9c8f11c119c12440dde461c322db0cf87e7f99d4b390
-
SHA512
f68b3f49717be49f4ed3bc64968bb7fad9750d5e3ce4fbea9e79db1cae3c59bc98bbe676c825a00217c8d756630cb2534fa3ead097655adf4fdf03860406c60e
-
SSDEEP
12288:HU5rCOTeiJQ7COocobS+QzmnAR8OV//x41DNMOTvNZ:HUQOJJQ0c0PQCqlZ41DlDN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1720 A16D.tmp 1608 A1FA.tmp 1972 A313.tmp 2936 A3DD.tmp 2944 A4A8.tmp 3028 A563.tmp 2416 A62E.tmp 2888 A6DA.tmp 2120 A795.tmp 2640 A812.tmp 2716 A8DD.tmp 2624 A998.tmp 2808 AA53.tmp 2732 AAFF.tmp 2544 ABBA.tmp 2492 AC75.tmp 2572 AD40.tmp 764 AE0B.tmp 1772 AEA7.tmp 1224 AF62.tmp 1616 B01D.tmp 1344 B0C9.tmp 1952 B165.tmp 1576 B1B3.tmp 1796 B210.tmp 1948 B25E.tmp 1208 B2BC.tmp 2012 B2FA.tmp 2780 B358.tmp 536 B3A6.tmp 484 B403.tmp 2832 B461.tmp 612 B4BF.tmp 2844 B51C.tmp 1756 B56A.tmp 544 B5A9.tmp 576 B606.tmp 2092 B664.tmp 804 B6C1.tmp 1360 B700.tmp 2776 B75D.tmp 1668 B7AB.tmp 1392 B7F9.tmp 1844 B847.tmp 1692 B895.tmp 1100 B8F3.tmp 1540 B951.tmp 2920 B99F.tmp 2328 B9FC.tmp 320 BA5A.tmp 1792 BAA8.tmp 1744 BB05.tmp 2064 BB63.tmp 2480 BBB1.tmp 2304 BBFF.tmp 1600 BC3D.tmp 2272 BC9B.tmp 2264 BCE9.tmp 2580 BD47.tmp 1972 BD95.tmp 2820 BDE3.tmp 2892 BE31.tmp 3020 BE7F.tmp 2260 BEDC.tmp -
Loads dropped DLL 64 IoCs
pid Process 1636 2024-11-19_5fcd7daf512e42fad78ab5836cadc1e2_mafia.exe 1720 A16D.tmp 1608 A1FA.tmp 1972 A313.tmp 2936 A3DD.tmp 2944 A4A8.tmp 3028 A563.tmp 2416 A62E.tmp 2888 A6DA.tmp 2120 A795.tmp 2640 A812.tmp 2716 A8DD.tmp 2624 A998.tmp 2808 AA53.tmp 2732 AAFF.tmp 2544 ABBA.tmp 2492 AC75.tmp 2572 AD40.tmp 764 AE0B.tmp 1772 AEA7.tmp 1224 AF62.tmp 1616 B01D.tmp 1344 B0C9.tmp 1952 B165.tmp 1576 B1B3.tmp 1796 B210.tmp 1948 B25E.tmp 1208 B2BC.tmp 2012 B2FA.tmp 2780 B358.tmp 536 B3A6.tmp 484 B403.tmp 2832 B461.tmp 612 B4BF.tmp 2844 B51C.tmp 1756 B56A.tmp 544 B5A9.tmp 576 B606.tmp 2092 B664.tmp 804 B6C1.tmp 1360 B700.tmp 2776 B75D.tmp 1668 B7AB.tmp 1392 B7F9.tmp 1844 B847.tmp 1692 B895.tmp 1100 B8F3.tmp 1540 B951.tmp 2920 B99F.tmp 2328 B9FC.tmp 320 BA5A.tmp 1792 BAA8.tmp 1744 BB05.tmp 2064 BB63.tmp 2480 BBB1.tmp 2304 BBFF.tmp 1600 BC3D.tmp 2272 BC9B.tmp 2264 BCE9.tmp 2580 BD47.tmp 1972 BD95.tmp 2820 BDE3.tmp 2892 BE31.tmp 3020 BE7F.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8057.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F779.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9750.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D93F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D45F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7002.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D26C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5792.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEDC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C513.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D401.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2BC.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1636 wrote to memory of 1720 1636 2024-11-19_5fcd7daf512e42fad78ab5836cadc1e2_mafia.exe 28 PID 1636 wrote to memory of 1720 1636 2024-11-19_5fcd7daf512e42fad78ab5836cadc1e2_mafia.exe 28 PID 1636 wrote to memory of 1720 1636 2024-11-19_5fcd7daf512e42fad78ab5836cadc1e2_mafia.exe 28 PID 1636 wrote to memory of 1720 1636 2024-11-19_5fcd7daf512e42fad78ab5836cadc1e2_mafia.exe 28 PID 1720 wrote to memory of 1608 1720 A16D.tmp 29 PID 1720 wrote to memory of 1608 1720 A16D.tmp 29 PID 1720 wrote to memory of 1608 1720 A16D.tmp 29 PID 1720 wrote to memory of 1608 1720 A16D.tmp 29 PID 1608 wrote to memory of 1972 1608 A1FA.tmp 30 PID 1608 wrote to memory of 1972 1608 A1FA.tmp 30 PID 1608 wrote to memory of 1972 1608 A1FA.tmp 30 PID 1608 wrote to memory of 1972 1608 A1FA.tmp 30 PID 1972 wrote to memory of 2936 1972 A313.tmp 31 PID 1972 wrote to memory of 2936 1972 A313.tmp 31 PID 1972 wrote to memory of 2936 1972 A313.tmp 31 PID 1972 wrote to memory of 2936 1972 A313.tmp 31 PID 2936 wrote to memory of 2944 2936 A3DD.tmp 32 PID 2936 wrote to memory of 2944 2936 A3DD.tmp 32 PID 2936 wrote to memory of 2944 2936 A3DD.tmp 32 PID 2936 wrote to memory of 2944 2936 A3DD.tmp 32 PID 2944 wrote to memory of 3028 2944 A4A8.tmp 33 PID 2944 wrote to memory of 3028 2944 A4A8.tmp 33 PID 2944 wrote to memory of 3028 2944 A4A8.tmp 33 PID 2944 wrote to memory of 3028 2944 A4A8.tmp 33 PID 3028 wrote to memory of 2416 3028 A563.tmp 34 PID 3028 wrote to memory of 2416 3028 A563.tmp 34 PID 3028 wrote to memory of 2416 3028 A563.tmp 34 PID 3028 wrote to memory of 2416 3028 A563.tmp 34 PID 2416 wrote to memory of 2888 2416 A62E.tmp 35 PID 2416 wrote to memory of 2888 2416 A62E.tmp 35 PID 2416 wrote to memory of 2888 2416 A62E.tmp 35 PID 2416 wrote to memory of 2888 2416 A62E.tmp 35 PID 2888 wrote to memory of 2120 2888 A6DA.tmp 36 PID 2888 wrote to memory of 2120 2888 A6DA.tmp 36 PID 2888 wrote to memory of 2120 2888 A6DA.tmp 36 PID 2888 wrote to memory of 2120 2888 A6DA.tmp 36 PID 2120 wrote to memory of 2640 2120 A795.tmp 37 PID 2120 wrote to memory of 2640 2120 A795.tmp 37 PID 2120 wrote to memory of 2640 2120 A795.tmp 37 PID 2120 wrote to memory of 2640 2120 A795.tmp 37 PID 2640 wrote to memory of 2716 2640 A812.tmp 38 PID 2640 wrote to memory of 2716 2640 A812.tmp 38 PID 2640 wrote to memory of 2716 2640 A812.tmp 38 PID 2640 wrote to memory of 2716 2640 A812.tmp 38 PID 2716 wrote to memory of 2624 2716 A8DD.tmp 39 PID 2716 wrote to memory of 2624 2716 A8DD.tmp 39 PID 2716 wrote to memory of 2624 2716 A8DD.tmp 39 PID 2716 wrote to memory of 2624 2716 A8DD.tmp 39 PID 2624 wrote to memory of 2808 2624 A998.tmp 40 PID 2624 wrote to memory of 2808 2624 A998.tmp 40 PID 2624 wrote to memory of 2808 2624 A998.tmp 40 PID 2624 wrote to memory of 2808 2624 A998.tmp 40 PID 2808 wrote to memory of 2732 2808 AA53.tmp 41 PID 2808 wrote to memory of 2732 2808 AA53.tmp 41 PID 2808 wrote to memory of 2732 2808 AA53.tmp 41 PID 2808 wrote to memory of 2732 2808 AA53.tmp 41 PID 2732 wrote to memory of 2544 2732 AAFF.tmp 42 PID 2732 wrote to memory of 2544 2732 AAFF.tmp 42 PID 2732 wrote to memory of 2544 2732 AAFF.tmp 42 PID 2732 wrote to memory of 2544 2732 AAFF.tmp 42 PID 2544 wrote to memory of 2492 2544 ABBA.tmp 43 PID 2544 wrote to memory of 2492 2544 ABBA.tmp 43 PID 2544 wrote to memory of 2492 2544 ABBA.tmp 43 PID 2544 wrote to memory of 2492 2544 ABBA.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-19_5fcd7daf512e42fad78ab5836cadc1e2_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-19_5fcd7daf512e42fad78ab5836cadc1e2_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\A16D.tmp"C:\Users\Admin\AppData\Local\Temp\A16D.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\A1FA.tmp"C:\Users\Admin\AppData\Local\Temp\A1FA.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\A313.tmp"C:\Users\Admin\AppData\Local\Temp\A313.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\A3DD.tmp"C:\Users\Admin\AppData\Local\Temp\A3DD.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\A4A8.tmp"C:\Users\Admin\AppData\Local\Temp\A4A8.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\A563.tmp"C:\Users\Admin\AppData\Local\Temp\A563.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\A62E.tmp"C:\Users\Admin\AppData\Local\Temp\A62E.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\A6DA.tmp"C:\Users\Admin\AppData\Local\Temp\A6DA.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\A795.tmp"C:\Users\Admin\AppData\Local\Temp\A795.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\A812.tmp"C:\Users\Admin\AppData\Local\Temp\A812.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\A8DD.tmp"C:\Users\Admin\AppData\Local\Temp\A8DD.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\A998.tmp"C:\Users\Admin\AppData\Local\Temp\A998.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\AA53.tmp"C:\Users\Admin\AppData\Local\Temp\AA53.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\AAFF.tmp"C:\Users\Admin\AppData\Local\Temp\AAFF.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\ABBA.tmp"C:\Users\Admin\AppData\Local\Temp\ABBA.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\AC75.tmp"C:\Users\Admin\AppData\Local\Temp\AC75.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\AD40.tmp"C:\Users\Admin\AppData\Local\Temp\AD40.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\AE0B.tmp"C:\Users\Admin\AppData\Local\Temp\AE0B.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:764 -
C:\Users\Admin\AppData\Local\Temp\AEA7.tmp"C:\Users\Admin\AppData\Local\Temp\AEA7.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\AF62.tmp"C:\Users\Admin\AppData\Local\Temp\AF62.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\B01D.tmp"C:\Users\Admin\AppData\Local\Temp\B01D.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\B0C9.tmp"C:\Users\Admin\AppData\Local\Temp\B0C9.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\B165.tmp"C:\Users\Admin\AppData\Local\Temp\B165.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\B1B3.tmp"C:\Users\Admin\AppData\Local\Temp\B1B3.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\B210.tmp"C:\Users\Admin\AppData\Local\Temp\B210.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\B25E.tmp"C:\Users\Admin\AppData\Local\Temp\B25E.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\B2FA.tmp"C:\Users\Admin\AppData\Local\Temp\B2FA.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\B358.tmp"C:\Users\Admin\AppData\Local\Temp\B358.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\B3A6.tmp"C:\Users\Admin\AppData\Local\Temp\B3A6.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:536 -
C:\Users\Admin\AppData\Local\Temp\B403.tmp"C:\Users\Admin\AppData\Local\Temp\B403.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:484 -
C:\Users\Admin\AppData\Local\Temp\B461.tmp"C:\Users\Admin\AppData\Local\Temp\B461.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\B4BF.tmp"C:\Users\Admin\AppData\Local\Temp\B4BF.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:612 -
C:\Users\Admin\AppData\Local\Temp\B51C.tmp"C:\Users\Admin\AppData\Local\Temp\B51C.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\B56A.tmp"C:\Users\Admin\AppData\Local\Temp\B56A.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\B5A9.tmp"C:\Users\Admin\AppData\Local\Temp\B5A9.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:544 -
C:\Users\Admin\AppData\Local\Temp\B606.tmp"C:\Users\Admin\AppData\Local\Temp\B606.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:576 -
C:\Users\Admin\AppData\Local\Temp\B664.tmp"C:\Users\Admin\AppData\Local\Temp\B664.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\B6C1.tmp"C:\Users\Admin\AppData\Local\Temp\B6C1.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:804 -
C:\Users\Admin\AppData\Local\Temp\B700.tmp"C:\Users\Admin\AppData\Local\Temp\B700.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\B75D.tmp"C:\Users\Admin\AppData\Local\Temp\B75D.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\B7AB.tmp"C:\Users\Admin\AppData\Local\Temp\B7AB.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\B7F9.tmp"C:\Users\Admin\AppData\Local\Temp\B7F9.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\B847.tmp"C:\Users\Admin\AppData\Local\Temp\B847.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\B895.tmp"C:\Users\Admin\AppData\Local\Temp\B895.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\B8F3.tmp"C:\Users\Admin\AppData\Local\Temp\B8F3.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\B951.tmp"C:\Users\Admin\AppData\Local\Temp\B951.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\B99F.tmp"C:\Users\Admin\AppData\Local\Temp\B99F.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\B9FC.tmp"C:\Users\Admin\AppData\Local\Temp\B9FC.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\BA5A.tmp"C:\Users\Admin\AppData\Local\Temp\BA5A.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\BAA8.tmp"C:\Users\Admin\AppData\Local\Temp\BAA8.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\BB05.tmp"C:\Users\Admin\AppData\Local\Temp\BB05.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\BB63.tmp"C:\Users\Admin\AppData\Local\Temp\BB63.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\BBB1.tmp"C:\Users\Admin\AppData\Local\Temp\BBB1.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\BBFF.tmp"C:\Users\Admin\AppData\Local\Temp\BBFF.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\BC3D.tmp"C:\Users\Admin\AppData\Local\Temp\BC3D.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\BC9B.tmp"C:\Users\Admin\AppData\Local\Temp\BC9B.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\BCE9.tmp"C:\Users\Admin\AppData\Local\Temp\BCE9.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\BD47.tmp"C:\Users\Admin\AppData\Local\Temp\BD47.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\BD95.tmp"C:\Users\Admin\AppData\Local\Temp\BD95.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\BDE3.tmp"C:\Users\Admin\AppData\Local\Temp\BDE3.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\BE31.tmp"C:\Users\Admin\AppData\Local\Temp\BE31.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\BE7F.tmp"C:\Users\Admin\AppData\Local\Temp\BE7F.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\BEDC.tmp"C:\Users\Admin\AppData\Local\Temp\BEDC.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\BF2A.tmp"C:\Users\Admin\AppData\Local\Temp\BF2A.tmp"66⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\BF78.tmp"C:\Users\Admin\AppData\Local\Temp\BF78.tmp"67⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"68⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\C014.tmp"C:\Users\Admin\AppData\Local\Temp\C014.tmp"69⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\C062.tmp"C:\Users\Admin\AppData\Local\Temp\C062.tmp"70⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"71⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"72⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"73⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"74⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"75⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\C236.tmp"C:\Users\Admin\AppData\Local\Temp\C236.tmp"76⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\C284.tmp"C:\Users\Admin\AppData\Local\Temp\C284.tmp"77⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\C2D2.tmp"C:\Users\Admin\AppData\Local\Temp\C2D2.tmp"78⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\C330.tmp"C:\Users\Admin\AppData\Local\Temp\C330.tmp"79⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\C38D.tmp"C:\Users\Admin\AppData\Local\Temp\C38D.tmp"80⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\C3EB.tmp"C:\Users\Admin\AppData\Local\Temp\C3EB.tmp"81⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\C439.tmp"C:\Users\Admin\AppData\Local\Temp\C439.tmp"82⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\C487.tmp"C:\Users\Admin\AppData\Local\Temp\C487.tmp"83⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\C4E5.tmp"C:\Users\Admin\AppData\Local\Temp\C4E5.tmp"84⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\C542.tmp"C:\Users\Admin\AppData\Local\Temp\C542.tmp"85⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\C590.tmp"C:\Users\Admin\AppData\Local\Temp\C590.tmp"86⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\C5DE.tmp"C:\Users\Admin\AppData\Local\Temp\C5DE.tmp"87⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\C62C.tmp"C:\Users\Admin\AppData\Local\Temp\C62C.tmp"88⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\C67A.tmp"C:\Users\Admin\AppData\Local\Temp\C67A.tmp"89⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\C6C8.tmp"C:\Users\Admin\AppData\Local\Temp\C6C8.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\C716.tmp"C:\Users\Admin\AppData\Local\Temp\C716.tmp"91⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\C774.tmp"C:\Users\Admin\AppData\Local\Temp\C774.tmp"92⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\C7C2.tmp"C:\Users\Admin\AppData\Local\Temp\C7C2.tmp"93⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\C810.tmp"C:\Users\Admin\AppData\Local\Temp\C810.tmp"94⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\C85E.tmp"C:\Users\Admin\AppData\Local\Temp\C85E.tmp"95⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\C8BB.tmp"C:\Users\Admin\AppData\Local\Temp\C8BB.tmp"96⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\C919.tmp"C:\Users\Admin\AppData\Local\Temp\C919.tmp"97⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\C967.tmp"C:\Users\Admin\AppData\Local\Temp\C967.tmp"98⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\C9B5.tmp"C:\Users\Admin\AppData\Local\Temp\C9B5.tmp"99⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\CA03.tmp"C:\Users\Admin\AppData\Local\Temp\CA03.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\CA51.tmp"C:\Users\Admin\AppData\Local\Temp\CA51.tmp"101⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\CA9F.tmp"C:\Users\Admin\AppData\Local\Temp\CA9F.tmp"102⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\CAED.tmp"C:\Users\Admin\AppData\Local\Temp\CAED.tmp"103⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\CB4B.tmp"C:\Users\Admin\AppData\Local\Temp\CB4B.tmp"104⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\CB99.tmp"C:\Users\Admin\AppData\Local\Temp\CB99.tmp"105⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"106⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\CC54.tmp"C:\Users\Admin\AppData\Local\Temp\CC54.tmp"107⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\CCB1.tmp"C:\Users\Admin\AppData\Local\Temp\CCB1.tmp"108⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"109⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\CD3E.tmp"C:\Users\Admin\AppData\Local\Temp\CD3E.tmp"110⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\CD8C.tmp"C:\Users\Admin\AppData\Local\Temp\CD8C.tmp"111⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\CDE9.tmp"C:\Users\Admin\AppData\Local\Temp\CDE9.tmp"112⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\CE37.tmp"C:\Users\Admin\AppData\Local\Temp\CE37.tmp"113⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\CE85.tmp"C:\Users\Admin\AppData\Local\Temp\CE85.tmp"114⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\CED3.tmp"C:\Users\Admin\AppData\Local\Temp\CED3.tmp"115⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\CF31.tmp"C:\Users\Admin\AppData\Local\Temp\CF31.tmp"116⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\CF7F.tmp"C:\Users\Admin\AppData\Local\Temp\CF7F.tmp"117⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\CFCD.tmp"C:\Users\Admin\AppData\Local\Temp\CFCD.tmp"118⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\D01B.tmp"C:\Users\Admin\AppData\Local\Temp\D01B.tmp"119⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\D079.tmp"C:\Users\Admin\AppData\Local\Temp\D079.tmp"120⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\D0C7.tmp"C:\Users\Admin\AppData\Local\Temp\D0C7.tmp"121⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\D124.tmp"C:\Users\Admin\AppData\Local\Temp\D124.tmp"122⤵PID:2292
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-