Analysis
-
max time kernel
137s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2024, 18:36
Static task
static1
Behavioral task
behavioral1
Sample
ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll
-
Size
288KB
-
MD5
ac1e3ae93673911c7675f4d5773b2f8a
-
SHA1
29d21d5b5fbedf5b5111c415295124b44b7aaed9
-
SHA256
68da9725a43db9fae1592e7e15165cd19f4f7f19ed10b3a825a996dc25bd6c22
-
SHA512
2fb97b428cf5c0bf13e47a041b23994f8938e8346e53a5859689d8ee9fbda18078c34267f252f5fedae3c43cdc4ba5a7bd31e164b115ee0d727ad202f9bf2f1b
-
SSDEEP
6144:8fLKaAA11ig1hxgsjtXeEiPvyGTRVQuQrbtLqYiOiu5xa5uuq20R:8fLKaJ1Ig1hxgsjtuEiCKRVQuQrbxauB
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3056 wrote to memory of 4788 3056 rundll32.exe 84 PID 3056 wrote to memory of 4788 3056 rundll32.exe 84 PID 3056 wrote to memory of 4788 3056 rundll32.exe 84 PID 4788 wrote to memory of 2224 4788 rundll32.exe 85 PID 4788 wrote to memory of 2224 4788 rundll32.exe 85 PID 4788 wrote to memory of 2224 4788 rundll32.exe 85 PID 2224 wrote to memory of 1096 2224 rundll32.exe 86 PID 2224 wrote to memory of 1096 2224 rundll32.exe 86 PID 2224 wrote to memory of 1096 2224 rundll32.exe 86 PID 1096 wrote to memory of 1008 1096 rundll32.exe 87 PID 1096 wrote to memory of 1008 1096 rundll32.exe 87 PID 1096 wrote to memory of 1008 1096 rundll32.exe 87 PID 1008 wrote to memory of 4964 1008 rundll32.exe 88 PID 1008 wrote to memory of 4964 1008 rundll32.exe 88 PID 1008 wrote to memory of 4964 1008 rundll32.exe 88 PID 4964 wrote to memory of 4212 4964 rundll32.exe 89 PID 4964 wrote to memory of 4212 4964 rundll32.exe 89 PID 4964 wrote to memory of 4212 4964 rundll32.exe 89 PID 4212 wrote to memory of 3740 4212 rundll32.exe 90 PID 4212 wrote to memory of 3740 4212 rundll32.exe 90 PID 4212 wrote to memory of 3740 4212 rundll32.exe 90 PID 3740 wrote to memory of 1860 3740 rundll32.exe 91 PID 3740 wrote to memory of 1860 3740 rundll32.exe 91 PID 3740 wrote to memory of 1860 3740 rundll32.exe 91 PID 1860 wrote to memory of 1696 1860 rundll32.exe 92 PID 1860 wrote to memory of 1696 1860 rundll32.exe 92 PID 1860 wrote to memory of 1696 1860 rundll32.exe 92 PID 1696 wrote to memory of 952 1696 rundll32.exe 93 PID 1696 wrote to memory of 952 1696 rundll32.exe 93 PID 1696 wrote to memory of 952 1696 rundll32.exe 93 PID 952 wrote to memory of 4056 952 rundll32.exe 94 PID 952 wrote to memory of 4056 952 rundll32.exe 94 PID 952 wrote to memory of 4056 952 rundll32.exe 94 PID 4056 wrote to memory of 5040 4056 rundll32.exe 95 PID 4056 wrote to memory of 5040 4056 rundll32.exe 95 PID 4056 wrote to memory of 5040 4056 rundll32.exe 95 PID 5040 wrote to memory of 2412 5040 rundll32.exe 96 PID 5040 wrote to memory of 2412 5040 rundll32.exe 96 PID 5040 wrote to memory of 2412 5040 rundll32.exe 96 PID 2412 wrote to memory of 4440 2412 rundll32.exe 97 PID 2412 wrote to memory of 4440 2412 rundll32.exe 97 PID 2412 wrote to memory of 4440 2412 rundll32.exe 97 PID 4440 wrote to memory of 4904 4440 rundll32.exe 98 PID 4440 wrote to memory of 4904 4440 rundll32.exe 98 PID 4440 wrote to memory of 4904 4440 rundll32.exe 98 PID 4904 wrote to memory of 768 4904 rundll32.exe 99 PID 4904 wrote to memory of 768 4904 rundll32.exe 99 PID 4904 wrote to memory of 768 4904 rundll32.exe 99 PID 768 wrote to memory of 892 768 rundll32.exe 100 PID 768 wrote to memory of 892 768 rundll32.exe 100 PID 768 wrote to memory of 892 768 rundll32.exe 100 PID 892 wrote to memory of 4516 892 rundll32.exe 101 PID 892 wrote to memory of 4516 892 rundll32.exe 101 PID 892 wrote to memory of 4516 892 rundll32.exe 101 PID 4516 wrote to memory of 1204 4516 rundll32.exe 102 PID 4516 wrote to memory of 1204 4516 rundll32.exe 102 PID 4516 wrote to memory of 1204 4516 rundll32.exe 102 PID 1204 wrote to memory of 1236 1204 rundll32.exe 103 PID 1204 wrote to memory of 1236 1204 rundll32.exe 103 PID 1204 wrote to memory of 1236 1204 rundll32.exe 103 PID 1236 wrote to memory of 2300 1236 rundll32.exe 104 PID 1236 wrote to memory of 2300 1236 rundll32.exe 104 PID 1236 wrote to memory of 2300 1236 rundll32.exe 104 PID 2300 wrote to memory of 5020 2300 rundll32.exe 105
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#120⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#123⤵PID:5020
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#124⤵PID:5060
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#125⤵PID:4020
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#126⤵PID:1652
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#127⤵PID:2756
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#128⤵PID:4928
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#129⤵PID:932
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#130⤵PID:3612
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#131⤵
- System Location Discovery: System Language Discovery
PID:5048 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#132⤵PID:1768
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#133⤵PID:4932
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#134⤵PID:2280
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#135⤵PID:4228
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#136⤵PID:2252
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#137⤵PID:1260
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#138⤵PID:4828
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#139⤵PID:4204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#140⤵PID:4196
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#141⤵PID:4508
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#142⤵PID:1160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#143⤵PID:1148
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#144⤵PID:812
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#145⤵PID:4520
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#146⤵PID:1408
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#147⤵PID:4276
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#148⤵PID:1412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#149⤵PID:4988
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#150⤵PID:456
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#151⤵PID:1672
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#152⤵PID:5012
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#153⤵PID:4912
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#154⤵PID:2332
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#155⤵PID:2308
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#156⤵PID:3824
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#157⤵PID:4116
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#158⤵PID:2228
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#159⤵PID:3376
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#160⤵PID:3688
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#161⤵PID:1044
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#162⤵PID:2844
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#163⤵PID:2124
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#164⤵PID:2504
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#165⤵PID:4400
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#166⤵PID:348
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#167⤵PID:4808
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#168⤵PID:3796
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#169⤵PID:944
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#170⤵PID:2532
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#171⤵PID:3068
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#172⤵PID:1716
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#173⤵PID:1636
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#174⤵
- System Location Discovery: System Language Discovery
PID:3908 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#175⤵PID:464
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#176⤵PID:4044
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#177⤵PID:4300
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#178⤵PID:2232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#179⤵PID:3352
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#180⤵PID:3368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#181⤵PID:2580
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#182⤵PID:4984
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#183⤵PID:4684
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#184⤵PID:2384
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#185⤵PID:3572
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#186⤵PID:3240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#187⤵PID:4780
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#188⤵PID:2312
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#189⤵PID:2976
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#190⤵PID:2148
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#191⤵PID:3732
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#192⤵PID:1676
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#193⤵PID:4428
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#194⤵PID:220
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#195⤵PID:2808
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#196⤵
- System Location Discovery: System Language Discovery
PID:2920 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#197⤵PID:1032
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#198⤵PID:1336
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#199⤵PID:4752
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#1100⤵PID:4908
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#1101⤵PID:1840
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#1102⤵PID:4080
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#1103⤵PID:4796
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#1104⤵PID:5136
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#1105⤵PID:5156
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#1106⤵
- System Location Discovery: System Language Discovery
PID:5172 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#1107⤵PID:5188
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#1108⤵
- System Location Discovery: System Language Discovery
PID:5212 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#1109⤵PID:5228
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#1110⤵PID:5248
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#1111⤵PID:5260
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#1112⤵PID:5276
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#1113⤵PID:5292
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#1114⤵PID:5308
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#1115⤵PID:5324
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#1116⤵PID:5344
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#1117⤵PID:5372
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#1118⤵PID:5388
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#1119⤵PID:5428
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#1120⤵PID:5444
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#1121⤵PID:5460
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1e3ae93673911c7675f4d5773b2f8a_JaffaCakes118.dll,#1122⤵PID:5476
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-