Analysis
-
max time kernel
137s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2024, 10:51
Static task
static1
Behavioral task
behavioral1
Sample
a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll
-
Size
222KB
-
MD5
a67fc0dfa3fe373eafdce312341671e4
-
SHA1
cde25f8d9c24b2c66c3abcfbc0ce5aa479098e31
-
SHA256
39a497903dba88cf6c67c31a5b50ff9bb73fbe1147e19e913411afbc5ae1d91d
-
SHA512
0ec3e162dd45b5546a20f6ab379a41261f79588d6d6e9ce496dedefa2e0c004b79f957091e9934a5c638e00ebb070bf4b865ed35c5c35449b0d2ca4dcb5a0f8a
-
SSDEEP
3072:bdx1dB2+CCJJKRDi/bUnJXWZr0ge1GbPelZl3sMQmtoFfZVF5p0VVW:bdx9JJFbeWLPelXdopZVWO
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4256 wrote to memory of 4140 4256 rundll32.exe 84 PID 4256 wrote to memory of 4140 4256 rundll32.exe 84 PID 4256 wrote to memory of 4140 4256 rundll32.exe 84 PID 4140 wrote to memory of 5084 4140 rundll32.exe 85 PID 4140 wrote to memory of 5084 4140 rundll32.exe 85 PID 4140 wrote to memory of 5084 4140 rundll32.exe 85 PID 5084 wrote to memory of 2328 5084 rundll32.exe 86 PID 5084 wrote to memory of 2328 5084 rundll32.exe 86 PID 5084 wrote to memory of 2328 5084 rundll32.exe 86 PID 2328 wrote to memory of 3832 2328 rundll32.exe 87 PID 2328 wrote to memory of 3832 2328 rundll32.exe 87 PID 2328 wrote to memory of 3832 2328 rundll32.exe 87 PID 3832 wrote to memory of 2028 3832 rundll32.exe 88 PID 3832 wrote to memory of 2028 3832 rundll32.exe 88 PID 3832 wrote to memory of 2028 3832 rundll32.exe 88 PID 2028 wrote to memory of 2448 2028 rundll32.exe 89 PID 2028 wrote to memory of 2448 2028 rundll32.exe 89 PID 2028 wrote to memory of 2448 2028 rundll32.exe 89 PID 2448 wrote to memory of 5092 2448 rundll32.exe 90 PID 2448 wrote to memory of 5092 2448 rundll32.exe 90 PID 2448 wrote to memory of 5092 2448 rundll32.exe 90 PID 5092 wrote to memory of 1968 5092 rundll32.exe 91 PID 5092 wrote to memory of 1968 5092 rundll32.exe 91 PID 5092 wrote to memory of 1968 5092 rundll32.exe 91 PID 1968 wrote to memory of 4976 1968 rundll32.exe 92 PID 1968 wrote to memory of 4976 1968 rundll32.exe 92 PID 1968 wrote to memory of 4976 1968 rundll32.exe 92 PID 4976 wrote to memory of 1756 4976 rundll32.exe 93 PID 4976 wrote to memory of 1756 4976 rundll32.exe 93 PID 4976 wrote to memory of 1756 4976 rundll32.exe 93 PID 1756 wrote to memory of 3228 1756 rundll32.exe 94 PID 1756 wrote to memory of 3228 1756 rundll32.exe 94 PID 1756 wrote to memory of 3228 1756 rundll32.exe 94 PID 3228 wrote to memory of 2412 3228 rundll32.exe 95 PID 3228 wrote to memory of 2412 3228 rundll32.exe 95 PID 3228 wrote to memory of 2412 3228 rundll32.exe 95 PID 2412 wrote to memory of 1884 2412 rundll32.exe 96 PID 2412 wrote to memory of 1884 2412 rundll32.exe 96 PID 2412 wrote to memory of 1884 2412 rundll32.exe 96 PID 1884 wrote to memory of 1940 1884 rundll32.exe 97 PID 1884 wrote to memory of 1940 1884 rundll32.exe 97 PID 1884 wrote to memory of 1940 1884 rundll32.exe 97 PID 1940 wrote to memory of 4232 1940 rundll32.exe 98 PID 1940 wrote to memory of 4232 1940 rundll32.exe 98 PID 1940 wrote to memory of 4232 1940 rundll32.exe 98 PID 4232 wrote to memory of 2104 4232 rundll32.exe 99 PID 4232 wrote to memory of 2104 4232 rundll32.exe 99 PID 4232 wrote to memory of 2104 4232 rundll32.exe 99 PID 2104 wrote to memory of 412 2104 rundll32.exe 100 PID 2104 wrote to memory of 412 2104 rundll32.exe 100 PID 2104 wrote to memory of 412 2104 rundll32.exe 100 PID 412 wrote to memory of 4584 412 rundll32.exe 101 PID 412 wrote to memory of 4584 412 rundll32.exe 101 PID 412 wrote to memory of 4584 412 rundll32.exe 101 PID 4584 wrote to memory of 4992 4584 rundll32.exe 102 PID 4584 wrote to memory of 4992 4584 rundll32.exe 102 PID 4584 wrote to memory of 4992 4584 rundll32.exe 102 PID 4992 wrote to memory of 2876 4992 rundll32.exe 103 PID 4992 wrote to memory of 2876 4992 rundll32.exe 103 PID 4992 wrote to memory of 2876 4992 rundll32.exe 103 PID 2876 wrote to memory of 5016 2876 rundll32.exe 104 PID 2876 wrote to memory of 5016 2876 rundll32.exe 104 PID 2876 wrote to memory of 5016 2876 rundll32.exe 104 PID 5016 wrote to memory of 320 5016 rundll32.exe 105
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#113⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#123⤵PID:320
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#124⤵PID:456
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#125⤵PID:2972
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#126⤵PID:448
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#127⤵PID:5056
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#128⤵PID:4224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#129⤵PID:3160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#130⤵PID:4892
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#131⤵PID:1664
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#132⤵PID:64
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#133⤵PID:2096
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#134⤵PID:4040
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#135⤵PID:4772
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#136⤵PID:3928
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#137⤵PID:3264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#138⤵PID:1796
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#139⤵PID:1460
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#140⤵PID:5108
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#141⤵PID:3300
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#142⤵PID:2484
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#143⤵PID:3552
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#144⤵PID:1980
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#145⤵PID:4764
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#146⤵PID:1288
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#147⤵PID:400
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#148⤵PID:4492
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#149⤵PID:3980
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#150⤵PID:1912
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#151⤵PID:2428
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#152⤵PID:5104
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#153⤵PID:2640
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#154⤵PID:2292
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#155⤵PID:2476
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#156⤵PID:3152
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#157⤵PID:1916
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#158⤵PID:1868
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#159⤵PID:4280
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#160⤵PID:1196
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#161⤵PID:4576
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#162⤵PID:3192
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#163⤵PID:856
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#164⤵PID:4304
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#165⤵PID:3268
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#166⤵PID:4560
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#167⤵PID:4860
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#168⤵
- System Location Discovery: System Language Discovery
PID:1104 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#169⤵PID:4064
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#170⤵PID:4852
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#171⤵PID:4800
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#172⤵PID:5096
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#173⤵PID:1080
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#174⤵PID:2492
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#175⤵PID:4768
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#176⤵PID:2728
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#177⤵PID:3608
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#178⤵PID:4528
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#179⤵PID:3604
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#180⤵PID:3000
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#181⤵PID:4308
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#182⤵
- System Location Discovery: System Language Discovery
PID:4964 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#183⤵PID:940
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#184⤵
- System Location Discovery: System Language Discovery
PID:3948 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#185⤵PID:4920
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#186⤵PID:2660
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#187⤵PID:2844
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#188⤵PID:3872
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#189⤵PID:1328
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#190⤵
- System Location Discovery: System Language Discovery
PID:4112 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#191⤵PID:4356
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#192⤵PID:4328
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#193⤵PID:2884
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#194⤵PID:4312
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#195⤵PID:5068
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#196⤵PID:1652
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#197⤵PID:828
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#198⤵PID:4816
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#199⤵PID:5136
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#1100⤵PID:5148
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#1101⤵PID:5164
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#1102⤵PID:5200
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#1103⤵PID:5224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#1104⤵PID:5240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#1105⤵PID:5264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#1106⤵PID:5300
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#1107⤵PID:5320
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#1108⤵PID:5332
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#1109⤵PID:5352
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#1110⤵PID:5368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#1111⤵PID:5380
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#1112⤵PID:5396
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#1113⤵PID:5412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#1114⤵PID:5428
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#1115⤵PID:5448
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#1116⤵PID:5472
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#1117⤵PID:5488
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#1118⤵PID:5508
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#1119⤵PID:5520
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#1120⤵PID:5532
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#1121⤵PID:5548
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67fc0dfa3fe373eafdce312341671e4_JaffaCakes118.dll,#1122⤵PID:5564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-