Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 17:10
Static task
static1
Behavioral task
behavioral1
Sample
74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll
-
Size
81KB
-
MD5
74f736eed8446f3f4fe4e821ddf7fbed
-
SHA1
02d3b131ffcd443e1bbfcd14b16e5ac3a45c599b
-
SHA256
16d193f5d83df3eee2bb3a442adbca0a4f4cd4a33136bb59ccefa568e033fc75
-
SHA512
0cd9a2ea58a146536b3231b3bfedbbe210043f5d1d24461252768b169451c895001d1056b483ac8f80f0a92a86c1e430c57bdcd5c3961921106c40cc362ba4c0
-
SSDEEP
1536:47tCr4fRbd/yAJK1L8GoiqeBCJ4jPERbSQZgCIFm8ymk8D/fCi:4ZO4Rd/yv8GoZegvVSbymnDSi
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2232 wrote to memory of 4540 2232 rundll32.exe 85 PID 2232 wrote to memory of 4540 2232 rundll32.exe 85 PID 2232 wrote to memory of 4540 2232 rundll32.exe 85 PID 4540 wrote to memory of 4832 4540 rundll32.exe 86 PID 4540 wrote to memory of 4832 4540 rundll32.exe 86 PID 4540 wrote to memory of 4832 4540 rundll32.exe 86 PID 4832 wrote to memory of 1128 4832 rundll32.exe 87 PID 4832 wrote to memory of 1128 4832 rundll32.exe 87 PID 4832 wrote to memory of 1128 4832 rundll32.exe 87 PID 1128 wrote to memory of 4476 1128 rundll32.exe 88 PID 1128 wrote to memory of 4476 1128 rundll32.exe 88 PID 1128 wrote to memory of 4476 1128 rundll32.exe 88 PID 4476 wrote to memory of 4896 4476 rundll32.exe 90 PID 4476 wrote to memory of 4896 4476 rundll32.exe 90 PID 4476 wrote to memory of 4896 4476 rundll32.exe 90 PID 4896 wrote to memory of 384 4896 rundll32.exe 91 PID 4896 wrote to memory of 384 4896 rundll32.exe 91 PID 4896 wrote to memory of 384 4896 rundll32.exe 91 PID 384 wrote to memory of 2888 384 rundll32.exe 92 PID 384 wrote to memory of 2888 384 rundll32.exe 92 PID 384 wrote to memory of 2888 384 rundll32.exe 92 PID 2888 wrote to memory of 4192 2888 rundll32.exe 93 PID 2888 wrote to memory of 4192 2888 rundll32.exe 93 PID 2888 wrote to memory of 4192 2888 rundll32.exe 93 PID 4192 wrote to memory of 4448 4192 rundll32.exe 94 PID 4192 wrote to memory of 4448 4192 rundll32.exe 94 PID 4192 wrote to memory of 4448 4192 rundll32.exe 94 PID 4448 wrote to memory of 4016 4448 rundll32.exe 95 PID 4448 wrote to memory of 4016 4448 rundll32.exe 95 PID 4448 wrote to memory of 4016 4448 rundll32.exe 95 PID 4016 wrote to memory of 3520 4016 rundll32.exe 96 PID 4016 wrote to memory of 3520 4016 rundll32.exe 96 PID 4016 wrote to memory of 3520 4016 rundll32.exe 96 PID 3520 wrote to memory of 3088 3520 rundll32.exe 97 PID 3520 wrote to memory of 3088 3520 rundll32.exe 97 PID 3520 wrote to memory of 3088 3520 rundll32.exe 97 PID 3088 wrote to memory of 3524 3088 rundll32.exe 98 PID 3088 wrote to memory of 3524 3088 rundll32.exe 98 PID 3088 wrote to memory of 3524 3088 rundll32.exe 98 PID 3524 wrote to memory of 2984 3524 rundll32.exe 99 PID 3524 wrote to memory of 2984 3524 rundll32.exe 99 PID 3524 wrote to memory of 2984 3524 rundll32.exe 99 PID 2984 wrote to memory of 2172 2984 rundll32.exe 100 PID 2984 wrote to memory of 2172 2984 rundll32.exe 100 PID 2984 wrote to memory of 2172 2984 rundll32.exe 100 PID 2172 wrote to memory of 688 2172 rundll32.exe 101 PID 2172 wrote to memory of 688 2172 rundll32.exe 101 PID 2172 wrote to memory of 688 2172 rundll32.exe 101 PID 688 wrote to memory of 5076 688 rundll32.exe 102 PID 688 wrote to memory of 5076 688 rundll32.exe 102 PID 688 wrote to memory of 5076 688 rundll32.exe 102 PID 5076 wrote to memory of 1220 5076 rundll32.exe 103 PID 5076 wrote to memory of 1220 5076 rundll32.exe 103 PID 5076 wrote to memory of 1220 5076 rundll32.exe 103 PID 1220 wrote to memory of 2924 1220 rundll32.exe 104 PID 1220 wrote to memory of 2924 1220 rundll32.exe 104 PID 1220 wrote to memory of 2924 1220 rundll32.exe 104 PID 2924 wrote to memory of 2372 2924 rundll32.exe 105 PID 2924 wrote to memory of 2372 2924 rundll32.exe 105 PID 2924 wrote to memory of 2372 2924 rundll32.exe 105 PID 2372 wrote to memory of 4312 2372 rundll32.exe 106 PID 2372 wrote to memory of 4312 2372 rundll32.exe 106 PID 2372 wrote to memory of 4312 2372 rundll32.exe 106 PID 4312 wrote to memory of 3112 4312 rundll32.exe 108
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#19⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#115⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#121⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#123⤵PID:3112
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#124⤵PID:932
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#125⤵
- System Location Discovery: System Language Discovery
PID:1880 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#126⤵PID:4000
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#127⤵PID:3104
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#128⤵PID:3276
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#129⤵PID:3164
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#130⤵PID:4672
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#131⤵PID:4556
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#132⤵
- System Location Discovery: System Language Discovery
PID:2764 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#133⤵PID:2056
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#134⤵PID:3512
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#135⤵PID:4904
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#136⤵PID:1172
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#137⤵PID:2248
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#138⤵PID:1244
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#139⤵PID:3904
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#140⤵PID:3848
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#141⤵PID:2444
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#142⤵PID:4848
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#143⤵PID:4100
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#144⤵PID:2020
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#145⤵PID:4184
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#146⤵PID:2880
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#147⤵PID:3544
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#148⤵
- System Location Discovery: System Language Discovery
PID:4260 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#149⤵PID:3784
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#150⤵PID:3940
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#151⤵PID:4232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#152⤵PID:3988
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#153⤵PID:5028
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#154⤵PID:4640
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#155⤵PID:2840
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#156⤵PID:4872
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#157⤵PID:5000
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#158⤵
- System Location Discovery: System Language Discovery
PID:692 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#159⤵PID:1060
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#160⤵PID:3608
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#161⤵PID:1692
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#162⤵PID:5064
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#163⤵PID:1660
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#164⤵PID:1612
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#165⤵PID:1784
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#166⤵PID:2668
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#167⤵PID:2492
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#168⤵PID:2012
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#169⤵PID:1672
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#170⤵PID:4452
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#171⤵PID:5036
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#172⤵PID:2272
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#173⤵PID:1096
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#174⤵PID:2300
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#175⤵PID:4124
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#176⤵PID:1640
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#177⤵PID:2044
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#178⤵
- System Location Discovery: System Language Discovery
PID:4776 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#179⤵PID:2996
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#180⤵PID:1148
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#181⤵PID:1436
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#182⤵PID:4928
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#183⤵PID:4836
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#184⤵PID:4852
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#185⤵PID:3016
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#186⤵PID:1440
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#187⤵PID:3960
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#188⤵PID:3920
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#189⤵PID:1636
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#190⤵PID:512
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#191⤵PID:4340
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#192⤵PID:2792
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#193⤵PID:2200
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#194⤵PID:4284
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#195⤵
- System Location Discovery: System Language Discovery
PID:2496 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#196⤵PID:3436
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#197⤵
- System Location Discovery: System Language Discovery
PID:3644 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#198⤵PID:1884
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#199⤵PID:4876
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#1100⤵PID:5136
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#1101⤵PID:5160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#1102⤵PID:5192
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#1103⤵PID:5228
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#1104⤵PID:5244
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#1105⤵PID:5260
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#1106⤵PID:5280
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#1107⤵PID:5292
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#1108⤵PID:5304
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#1109⤵PID:5316
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#1110⤵PID:5332
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#1111⤵PID:5344
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#1112⤵PID:5360
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#1113⤵PID:5380
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#1114⤵
- System Location Discovery: System Language Discovery
PID:5392 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#1115⤵PID:5408
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#1116⤵PID:5424
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#1117⤵PID:5440
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#1118⤵PID:5460
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#1119⤵PID:5472
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#1120⤵
- System Location Discovery: System Language Discovery
PID:5488 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#1121⤵PID:5500
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f736eed8446f3f4fe4e821ddf7fbed_JaffaCakes118.dll,#1122⤵PID:5512
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-