Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2024, 10:42
Static task
static1
Behavioral task
behavioral1
Sample
a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll
-
Size
3KB
-
MD5
a238fcfb3d829350a3bd72bc5dd9e391
-
SHA1
b0c5d11033c195a7a2a1f11ee61c8bcfb3533aff
-
SHA256
9dff88b06692c4a7827856085b3a97ef672585da16e796103d1c7ccd82abe661
-
SHA512
9fd75f638fef98df413499dc64d5b2f8f69b878c92bf470875c362c4a83f60eb33fa4573266ec0d0d5866f3b54c8b5aba44820a0c596faee398bad24f13895e0
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3900 wrote to memory of 4516 3900 rundll32.exe 83 PID 3900 wrote to memory of 4516 3900 rundll32.exe 83 PID 3900 wrote to memory of 4516 3900 rundll32.exe 83 PID 4516 wrote to memory of 2044 4516 rundll32.exe 84 PID 4516 wrote to memory of 2044 4516 rundll32.exe 84 PID 4516 wrote to memory of 2044 4516 rundll32.exe 84 PID 2044 wrote to memory of 4556 2044 rundll32.exe 85 PID 2044 wrote to memory of 4556 2044 rundll32.exe 85 PID 2044 wrote to memory of 4556 2044 rundll32.exe 85 PID 4556 wrote to memory of 2664 4556 rundll32.exe 86 PID 4556 wrote to memory of 2664 4556 rundll32.exe 86 PID 4556 wrote to memory of 2664 4556 rundll32.exe 86 PID 2664 wrote to memory of 3476 2664 rundll32.exe 87 PID 2664 wrote to memory of 3476 2664 rundll32.exe 87 PID 2664 wrote to memory of 3476 2664 rundll32.exe 87 PID 3476 wrote to memory of 1964 3476 rundll32.exe 88 PID 3476 wrote to memory of 1964 3476 rundll32.exe 88 PID 3476 wrote to memory of 1964 3476 rundll32.exe 88 PID 1964 wrote to memory of 3380 1964 rundll32.exe 89 PID 1964 wrote to memory of 3380 1964 rundll32.exe 89 PID 1964 wrote to memory of 3380 1964 rundll32.exe 89 PID 3380 wrote to memory of 4148 3380 rundll32.exe 90 PID 3380 wrote to memory of 4148 3380 rundll32.exe 90 PID 3380 wrote to memory of 4148 3380 rundll32.exe 90 PID 4148 wrote to memory of 3488 4148 rundll32.exe 91 PID 4148 wrote to memory of 3488 4148 rundll32.exe 91 PID 4148 wrote to memory of 3488 4148 rundll32.exe 91 PID 3488 wrote to memory of 1996 3488 rundll32.exe 92 PID 3488 wrote to memory of 1996 3488 rundll32.exe 92 PID 3488 wrote to memory of 1996 3488 rundll32.exe 92 PID 1996 wrote to memory of 1872 1996 rundll32.exe 94 PID 1996 wrote to memory of 1872 1996 rundll32.exe 94 PID 1996 wrote to memory of 1872 1996 rundll32.exe 94 PID 1872 wrote to memory of 64 1872 rundll32.exe 95 PID 1872 wrote to memory of 64 1872 rundll32.exe 95 PID 1872 wrote to memory of 64 1872 rundll32.exe 95 PID 64 wrote to memory of 4072 64 rundll32.exe 96 PID 64 wrote to memory of 4072 64 rundll32.exe 96 PID 64 wrote to memory of 4072 64 rundll32.exe 96 PID 4072 wrote to memory of 1008 4072 rundll32.exe 97 PID 4072 wrote to memory of 1008 4072 rundll32.exe 97 PID 4072 wrote to memory of 1008 4072 rundll32.exe 97 PID 1008 wrote to memory of 1220 1008 rundll32.exe 98 PID 1008 wrote to memory of 1220 1008 rundll32.exe 98 PID 1008 wrote to memory of 1220 1008 rundll32.exe 98 PID 1220 wrote to memory of 2624 1220 rundll32.exe 99 PID 1220 wrote to memory of 2624 1220 rundll32.exe 99 PID 1220 wrote to memory of 2624 1220 rundll32.exe 99 PID 2624 wrote to memory of 2584 2624 rundll32.exe 100 PID 2624 wrote to memory of 2584 2624 rundll32.exe 100 PID 2624 wrote to memory of 2584 2624 rundll32.exe 100 PID 2584 wrote to memory of 4552 2584 rundll32.exe 101 PID 2584 wrote to memory of 4552 2584 rundll32.exe 101 PID 2584 wrote to memory of 4552 2584 rundll32.exe 101 PID 4552 wrote to memory of 5060 4552 rundll32.exe 102 PID 4552 wrote to memory of 5060 4552 rundll32.exe 102 PID 4552 wrote to memory of 5060 4552 rundll32.exe 102 PID 5060 wrote to memory of 3152 5060 rundll32.exe 103 PID 5060 wrote to memory of 3152 5060 rundll32.exe 103 PID 5060 wrote to memory of 3152 5060 rundll32.exe 103 PID 3152 wrote to memory of 4944 3152 rundll32.exe 104 PID 3152 wrote to memory of 4944 3152 rundll32.exe 104 PID 3152 wrote to memory of 4944 3152 rundll32.exe 104 PID 4944 wrote to memory of 2932 4944 rundll32.exe 105
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#15⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#123⤵PID:2932
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#124⤵PID:1488
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#125⤵PID:2260
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#126⤵PID:964
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#127⤵PID:2300
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#128⤵PID:3196
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#129⤵PID:3068
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#130⤵PID:2052
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#131⤵PID:2128
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#132⤵PID:3880
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#133⤵
- System Location Discovery: System Language Discovery
PID:3968 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#134⤵PID:1480
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#135⤵PID:4916
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#136⤵PID:2188
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#137⤵PID:2248
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#138⤵PID:1136
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#139⤵PID:4652
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#140⤵PID:2148
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#141⤵PID:1380
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#142⤵PID:2280
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#143⤵
- System Location Discovery: System Language Discovery
PID:1052 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#144⤵PID:3716
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#145⤵PID:3916
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#146⤵PID:1576
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#147⤵PID:3660
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#148⤵PID:4164
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#149⤵PID:4200
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#150⤵PID:4688
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#151⤵PID:1960
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#152⤵PID:3320
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#153⤵PID:1180
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#154⤵PID:1788
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#155⤵
- System Location Discovery: System Language Discovery
PID:3560 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#156⤵PID:184
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#157⤵PID:320
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#158⤵PID:3640
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#159⤵
- System Location Discovery: System Language Discovery
PID:1292 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#160⤵PID:3248
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#161⤵PID:2316
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#162⤵PID:592
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#163⤵PID:4184
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#164⤵
- System Location Discovery: System Language Discovery
PID:2024 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#165⤵PID:1520
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#166⤵PID:4472
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#167⤵PID:2296
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#168⤵PID:2340
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#169⤵PID:2680
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#170⤵PID:1844
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#171⤵PID:4388
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#172⤵PID:3736
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#173⤵PID:1368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#174⤵PID:2200
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#175⤵PID:3960
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#176⤵PID:4832
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#177⤵PID:4884
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#178⤵PID:2864
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#179⤵
- System Location Discovery: System Language Discovery
PID:3972 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#180⤵PID:2832
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#181⤵
- System Location Discovery: System Language Discovery
PID:804 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#182⤵PID:4828
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#183⤵PID:4252
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#184⤵PID:1512
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#185⤵PID:2652
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#186⤵PID:2312
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#187⤵PID:3608
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#188⤵PID:3056
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#189⤵PID:4792
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#190⤵PID:1748
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#191⤵PID:4224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#192⤵PID:1504
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#193⤵PID:2400
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#194⤵PID:3188
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#195⤵PID:2788
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#196⤵PID:4292
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#197⤵PID:4384
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#198⤵PID:1608
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#199⤵PID:892
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#1100⤵PID:3112
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#1101⤵PID:1412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#1102⤵PID:3552
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#1103⤵PID:5124
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#1104⤵PID:5136
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#1105⤵PID:5156
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#1106⤵PID:5168
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#1107⤵PID:5180
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#1108⤵PID:5204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#1109⤵PID:5224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#1110⤵PID:5244
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#1111⤵PID:5256
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#1112⤵PID:5276
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#1113⤵PID:5292
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#1114⤵
- System Location Discovery: System Language Discovery
PID:5308 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#1115⤵PID:5324
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#1116⤵
- System Location Discovery: System Language Discovery
PID:5340 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#1117⤵PID:5356
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#1118⤵PID:5368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#1119⤵PID:5384
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#1120⤵PID:5396
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#1121⤵PID:5420
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a238fcfb3d829350a3bd72bc5dd9e391_JaffaCakes118.dll,#1122⤵PID:5436
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-