Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/08/2024, 21:00
Static task
static1
Behavioral task
behavioral1
Sample
8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll
-
Size
217KB
-
MD5
8bf47db8541e4a6d1e5e5f1a74064b7f
-
SHA1
93ab7f279cc6622f65b2d274114d02f5faf5d0d3
-
SHA256
4804ead6370e9465e3005fc0d7c615d047dcc90e7d262c97e640fb647ca19c09
-
SHA512
6554e6b4ff7f97fcf6598ee9e8d0202c8b1a17947284562fc27d34d178d67de2cbe3629f37716df6f4e90386004f5e251a314fe8ee668b698036e6c3a3dc87e1
-
SSDEEP
6144:JXNhy87nAU/K2XKqAW5Fy1Sag/g3yqn1UWX:zhXnrVXKjWW11l3NWQ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4720 wrote to memory of 3428 4720 rundll32.exe 84 PID 4720 wrote to memory of 3428 4720 rundll32.exe 84 PID 4720 wrote to memory of 3428 4720 rundll32.exe 84 PID 3428 wrote to memory of 556 3428 rundll32.exe 85 PID 3428 wrote to memory of 556 3428 rundll32.exe 85 PID 3428 wrote to memory of 556 3428 rundll32.exe 85 PID 556 wrote to memory of 2728 556 rundll32.exe 86 PID 556 wrote to memory of 2728 556 rundll32.exe 86 PID 556 wrote to memory of 2728 556 rundll32.exe 86 PID 2728 wrote to memory of 1400 2728 rundll32.exe 87 PID 2728 wrote to memory of 1400 2728 rundll32.exe 87 PID 2728 wrote to memory of 1400 2728 rundll32.exe 87 PID 1400 wrote to memory of 4856 1400 rundll32.exe 88 PID 1400 wrote to memory of 4856 1400 rundll32.exe 88 PID 1400 wrote to memory of 4856 1400 rundll32.exe 88 PID 4856 wrote to memory of 4848 4856 rundll32.exe 89 PID 4856 wrote to memory of 4848 4856 rundll32.exe 89 PID 4856 wrote to memory of 4848 4856 rundll32.exe 89 PID 4848 wrote to memory of 4652 4848 rundll32.exe 90 PID 4848 wrote to memory of 4652 4848 rundll32.exe 90 PID 4848 wrote to memory of 4652 4848 rundll32.exe 90 PID 4652 wrote to memory of 3764 4652 rundll32.exe 91 PID 4652 wrote to memory of 3764 4652 rundll32.exe 91 PID 4652 wrote to memory of 3764 4652 rundll32.exe 91 PID 3764 wrote to memory of 692 3764 rundll32.exe 93 PID 3764 wrote to memory of 692 3764 rundll32.exe 93 PID 3764 wrote to memory of 692 3764 rundll32.exe 93 PID 692 wrote to memory of 5044 692 rundll32.exe 94 PID 692 wrote to memory of 5044 692 rundll32.exe 94 PID 692 wrote to memory of 5044 692 rundll32.exe 94 PID 5044 wrote to memory of 4260 5044 rundll32.exe 95 PID 5044 wrote to memory of 4260 5044 rundll32.exe 95 PID 5044 wrote to memory of 4260 5044 rundll32.exe 95 PID 4260 wrote to memory of 1920 4260 rundll32.exe 96 PID 4260 wrote to memory of 1920 4260 rundll32.exe 96 PID 4260 wrote to memory of 1920 4260 rundll32.exe 96 PID 1920 wrote to memory of 1456 1920 rundll32.exe 97 PID 1920 wrote to memory of 1456 1920 rundll32.exe 97 PID 1920 wrote to memory of 1456 1920 rundll32.exe 97 PID 1456 wrote to memory of 3576 1456 rundll32.exe 98 PID 1456 wrote to memory of 3576 1456 rundll32.exe 98 PID 1456 wrote to memory of 3576 1456 rundll32.exe 98 PID 3576 wrote to memory of 1492 3576 rundll32.exe 99 PID 3576 wrote to memory of 1492 3576 rundll32.exe 99 PID 3576 wrote to memory of 1492 3576 rundll32.exe 99 PID 1492 wrote to memory of 2668 1492 rundll32.exe 100 PID 1492 wrote to memory of 2668 1492 rundll32.exe 100 PID 1492 wrote to memory of 2668 1492 rundll32.exe 100 PID 2668 wrote to memory of 4108 2668 rundll32.exe 101 PID 2668 wrote to memory of 4108 2668 rundll32.exe 101 PID 2668 wrote to memory of 4108 2668 rundll32.exe 101 PID 4108 wrote to memory of 212 4108 rundll32.exe 102 PID 4108 wrote to memory of 212 4108 rundll32.exe 102 PID 4108 wrote to memory of 212 4108 rundll32.exe 102 PID 212 wrote to memory of 4612 212 rundll32.exe 103 PID 212 wrote to memory of 4612 212 rundll32.exe 103 PID 212 wrote to memory of 4612 212 rundll32.exe 103 PID 4612 wrote to memory of 1960 4612 rundll32.exe 104 PID 4612 wrote to memory of 1960 4612 rundll32.exe 104 PID 4612 wrote to memory of 1960 4612 rundll32.exe 104 PID 1960 wrote to memory of 2720 1960 rundll32.exe 105 PID 1960 wrote to memory of 2720 1960 rundll32.exe 105 PID 1960 wrote to memory of 2720 1960 rundll32.exe 105 PID 2720 wrote to memory of 4704 2720 rundll32.exe 106
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#112⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#123⤵PID:4704
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#124⤵PID:904
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#125⤵PID:4860
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#126⤵PID:4572
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#127⤵PID:2704
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#128⤵PID:892
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#129⤵PID:3600
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#130⤵PID:3540
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#131⤵
- System Location Discovery: System Language Discovery
PID:4216 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#132⤵PID:3492
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#133⤵PID:1036
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#134⤵PID:2596
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#135⤵PID:4168
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#136⤵PID:4176
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#137⤵PID:1540
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#138⤵PID:4692
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#139⤵PID:4236
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#140⤵PID:4976
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#141⤵PID:872
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#142⤵PID:2608
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#143⤵PID:2736
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#144⤵PID:4984
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#145⤵
- System Location Discovery: System Language Discovery
PID:3272 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#146⤵PID:4212
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#147⤵PID:1900
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#148⤵PID:4300
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#149⤵PID:2412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#150⤵PID:4736
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#151⤵PID:4436
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#152⤵PID:2152
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#153⤵PID:4592
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#154⤵PID:2356
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#155⤵PID:2060
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#156⤵
- System Location Discovery: System Language Discovery
PID:1516 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#157⤵PID:640
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#158⤵PID:4336
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#159⤵
- System Location Discovery: System Language Discovery
PID:3432 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#160⤵PID:5012
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#161⤵PID:4588
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#162⤵PID:2964
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#163⤵PID:2656
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#164⤵PID:2492
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#165⤵PID:4512
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#166⤵PID:1632
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#167⤵PID:1408
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#168⤵PID:4792
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#169⤵PID:4072
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#170⤵PID:3032
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#171⤵PID:3360
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#172⤵PID:3484
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#173⤵PID:2944
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#174⤵PID:3012
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#175⤵PID:4084
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#176⤵PID:876
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#177⤵
- System Location Discovery: System Language Discovery
PID:4232 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#178⤵PID:3088
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#179⤵PID:3700
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#180⤵PID:456
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#181⤵PID:4172
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#182⤵PID:3852
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#183⤵PID:4904
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#184⤵PID:4568
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#185⤵PID:4028
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#186⤵PID:2912
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#187⤵
- System Location Discovery: System Language Discovery
PID:4180 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#188⤵PID:3280
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#189⤵PID:3860
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#190⤵PID:4872
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#191⤵PID:2644
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#192⤵PID:4368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#193⤵PID:4372
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#194⤵PID:3488
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#195⤵PID:700
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#196⤵PID:2932
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#197⤵PID:2848
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#198⤵PID:2372
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#199⤵PID:2660
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#1100⤵PID:4444
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#1101⤵PID:2688
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#1102⤵PID:5136
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#1103⤵PID:5152
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#1104⤵PID:5164
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#1105⤵PID:5180
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#1106⤵PID:5196
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#1107⤵PID:5212
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#1108⤵PID:5228
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#1109⤵PID:5248
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#1110⤵PID:5260
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#1111⤵
- System Location Discovery: System Language Discovery
PID:5280 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#1112⤵
- System Location Discovery: System Language Discovery
PID:5292 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#1113⤵PID:5308
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#1114⤵PID:5332
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#1115⤵PID:5364
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#1116⤵PID:5400
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#1117⤵PID:5412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#1118⤵PID:5432
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#1119⤵
- System Location Discovery: System Language Discovery
PID:5444 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#1120⤵PID:5464
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#1121⤵PID:5484
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8bf47db8541e4a6d1e5e5f1a74064b7f_JaffaCakes118.dll,#1122⤵PID:5500
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-