Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2024, 22:34
Static task
static1
Behavioral task
behavioral1
Sample
6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll
-
Size
213KB
-
MD5
6938469cb3cd9996f8741e0fe4f0da5e
-
SHA1
03dfb5fe5c7be525fd183e08233b9059cd5d1a64
-
SHA256
144139168bd9a8ab047977a1ab6e45a5cdfda1a14cf75b9082280b6c1233e30d
-
SHA512
05c7d347f18aec548798d6203679624ec62dc784a90139cc83afaecb605dc10f7f141ee77bc16f20e686a735d72f99b62def53b5a1643e84a846d3f5be52304b
-
SSDEEP
3072:4ZO4Rd/yv8GoZegvVSbymnDSnyHOTgkTCxktFy7JHVtWZdncjlqDDHgXJYVXZ:F4r/iEIznun5gsdW7NVtWDcqkYVXZ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2772 wrote to memory of 3784 2772 rundll32.exe 84 PID 2772 wrote to memory of 3784 2772 rundll32.exe 84 PID 2772 wrote to memory of 3784 2772 rundll32.exe 84 PID 3784 wrote to memory of 4292 3784 rundll32.exe 85 PID 3784 wrote to memory of 4292 3784 rundll32.exe 85 PID 3784 wrote to memory of 4292 3784 rundll32.exe 85 PID 4292 wrote to memory of 4516 4292 rundll32.exe 86 PID 4292 wrote to memory of 4516 4292 rundll32.exe 86 PID 4292 wrote to memory of 4516 4292 rundll32.exe 86 PID 4516 wrote to memory of 3800 4516 rundll32.exe 87 PID 4516 wrote to memory of 3800 4516 rundll32.exe 87 PID 4516 wrote to memory of 3800 4516 rundll32.exe 87 PID 3800 wrote to memory of 2140 3800 rundll32.exe 88 PID 3800 wrote to memory of 2140 3800 rundll32.exe 88 PID 3800 wrote to memory of 2140 3800 rundll32.exe 88 PID 2140 wrote to memory of 4500 2140 rundll32.exe 89 PID 2140 wrote to memory of 4500 2140 rundll32.exe 89 PID 2140 wrote to memory of 4500 2140 rundll32.exe 89 PID 4500 wrote to memory of 1428 4500 rundll32.exe 90 PID 4500 wrote to memory of 1428 4500 rundll32.exe 90 PID 4500 wrote to memory of 1428 4500 rundll32.exe 90 PID 1428 wrote to memory of 316 1428 rundll32.exe 91 PID 1428 wrote to memory of 316 1428 rundll32.exe 91 PID 1428 wrote to memory of 316 1428 rundll32.exe 91 PID 316 wrote to memory of 1192 316 rundll32.exe 92 PID 316 wrote to memory of 1192 316 rundll32.exe 92 PID 316 wrote to memory of 1192 316 rundll32.exe 92 PID 1192 wrote to memory of 2512 1192 rundll32.exe 93 PID 1192 wrote to memory of 2512 1192 rundll32.exe 93 PID 1192 wrote to memory of 2512 1192 rundll32.exe 93 PID 2512 wrote to memory of 1892 2512 rundll32.exe 94 PID 2512 wrote to memory of 1892 2512 rundll32.exe 94 PID 2512 wrote to memory of 1892 2512 rundll32.exe 94 PID 1892 wrote to memory of 1216 1892 rundll32.exe 95 PID 1892 wrote to memory of 1216 1892 rundll32.exe 95 PID 1892 wrote to memory of 1216 1892 rundll32.exe 95 PID 1216 wrote to memory of 2436 1216 rundll32.exe 96 PID 1216 wrote to memory of 2436 1216 rundll32.exe 96 PID 1216 wrote to memory of 2436 1216 rundll32.exe 96 PID 2436 wrote to memory of 2148 2436 rundll32.exe 97 PID 2436 wrote to memory of 2148 2436 rundll32.exe 97 PID 2436 wrote to memory of 2148 2436 rundll32.exe 97 PID 2148 wrote to memory of 324 2148 rundll32.exe 98 PID 2148 wrote to memory of 324 2148 rundll32.exe 98 PID 2148 wrote to memory of 324 2148 rundll32.exe 98 PID 324 wrote to memory of 3144 324 rundll32.exe 99 PID 324 wrote to memory of 3144 324 rundll32.exe 99 PID 324 wrote to memory of 3144 324 rundll32.exe 99 PID 3144 wrote to memory of 1532 3144 rundll32.exe 100 PID 3144 wrote to memory of 1532 3144 rundll32.exe 100 PID 3144 wrote to memory of 1532 3144 rundll32.exe 100 PID 1532 wrote to memory of 4600 1532 rundll32.exe 101 PID 1532 wrote to memory of 4600 1532 rundll32.exe 101 PID 1532 wrote to memory of 4600 1532 rundll32.exe 101 PID 4600 wrote to memory of 2028 4600 rundll32.exe 102 PID 4600 wrote to memory of 2028 4600 rundll32.exe 102 PID 4600 wrote to memory of 2028 4600 rundll32.exe 102 PID 2028 wrote to memory of 2224 2028 rundll32.exe 103 PID 2028 wrote to memory of 2224 2028 rundll32.exe 103 PID 2028 wrote to memory of 2224 2028 rundll32.exe 103 PID 2224 wrote to memory of 3240 2224 rundll32.exe 105 PID 2224 wrote to memory of 3240 2224 rundll32.exe 105 PID 2224 wrote to memory of 3240 2224 rundll32.exe 105 PID 3240 wrote to memory of 2416 3240 rundll32.exe 106
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#115⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#117⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#123⤵PID:2416
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#124⤵PID:4744
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#125⤵PID:3768
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#126⤵PID:2104
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#127⤵PID:4176
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#128⤵PID:4624
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#129⤵PID:964
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#130⤵PID:4648
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#131⤵PID:4628
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#132⤵PID:2040
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#133⤵PID:4712
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#134⤵PID:1792
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#135⤵PID:2752
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#136⤵PID:4848
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#137⤵PID:2860
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#138⤵
- System Location Discovery: System Language Discovery
PID:3608 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#139⤵PID:4308
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#140⤵PID:4716
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#141⤵PID:60
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#142⤵PID:2208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#143⤵PID:3068
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#144⤵PID:2408
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#145⤵PID:1084
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#146⤵PID:3692
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#147⤵PID:5044
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#148⤵PID:2268
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#149⤵PID:3812
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#150⤵PID:2312
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#151⤵PID:3700
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#152⤵PID:3624
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#153⤵PID:5028
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#154⤵PID:852
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#155⤵
- System Location Discovery: System Language Discovery
PID:4264 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#156⤵PID:5108
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#157⤵PID:3808
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#158⤵PID:4232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#159⤵
- System Location Discovery: System Language Discovery
PID:3572 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#160⤵PID:4764
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#161⤵PID:4188
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#162⤵PID:4152
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#163⤵PID:3360
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#164⤵PID:4836
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#165⤵PID:3668
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#166⤵PID:4116
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#167⤵PID:1804
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#168⤵PID:4324
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#169⤵PID:2496
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#170⤵PID:1172
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#171⤵PID:4184
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#172⤵PID:4896
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#173⤵PID:4216
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#174⤵PID:3108
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#175⤵PID:4028
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#176⤵PID:3060
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#177⤵PID:748
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#178⤵PID:4384
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#179⤵
- System Location Discovery: System Language Discovery
PID:2640 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#180⤵PID:3404
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#181⤵PID:744
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#182⤵PID:1748
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#183⤵PID:4612
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#184⤵PID:2368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#185⤵PID:3556
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#186⤵PID:3484
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#187⤵PID:3976
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#188⤵PID:1508
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#189⤵PID:4780
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#190⤵PID:4452
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#191⤵PID:756
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#192⤵PID:1480
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#193⤵PID:396
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#194⤵PID:3104
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#195⤵PID:2540
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#196⤵
- System Location Discovery: System Language Discovery
PID:2392 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#197⤵PID:2648
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#198⤵PID:408
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#199⤵PID:4420
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#1100⤵PID:5128
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#1101⤵PID:5144
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#1102⤵PID:5160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#1103⤵
- System Location Discovery: System Language Discovery
PID:5176 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#1104⤵PID:5188
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#1105⤵PID:5212
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#1106⤵PID:5236
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#1107⤵PID:5252
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#1108⤵PID:5268
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#1109⤵PID:5308
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#1110⤵
- System Location Discovery: System Language Discovery
PID:5320 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#1111⤵PID:5340
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#1112⤵PID:5356
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#1113⤵PID:5372
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#1114⤵PID:5388
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#1115⤵PID:5400
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#1116⤵
- System Location Discovery: System Language Discovery
PID:5420 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#1117⤵PID:5436
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#1118⤵PID:5460
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#1119⤵PID:5476
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#1120⤵PID:5492
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#1121⤵PID:5508
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#1122⤵PID:5524
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-