Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2024, 21:23
Static task
static1
Behavioral task
behavioral1
Sample
b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll
-
Size
238KB
-
MD5
b5181fba6a74b97660cf93d72dcad711
-
SHA1
9794f246a6905a7b17baeca54e2b2de874cf6b1d
-
SHA256
3e7e57bf3297c9b4d84a4de4a23ac907c34d49337fa45b91c028f247caf37437
-
SHA512
d2d795263cf206a633ee9e5e9d8d8348d710872db6851c2bab805af2c88c8791fadf3dd893a780b854507e20d9cabaf2524118368aef20fddd513a6300159dd6
-
SSDEEP
6144:nWteGEC/Zk2NiU32HRQXF4YGvzm2GSOlYkbYFjpQ:W7l0RPYJxekbuj+
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1896 wrote to memory of 2240 1896 rundll32.exe 84 PID 1896 wrote to memory of 2240 1896 rundll32.exe 84 PID 1896 wrote to memory of 2240 1896 rundll32.exe 84 PID 2240 wrote to memory of 4556 2240 rundll32.exe 85 PID 2240 wrote to memory of 4556 2240 rundll32.exe 85 PID 2240 wrote to memory of 4556 2240 rundll32.exe 85 PID 4556 wrote to memory of 3528 4556 rundll32.exe 86 PID 4556 wrote to memory of 3528 4556 rundll32.exe 86 PID 4556 wrote to memory of 3528 4556 rundll32.exe 86 PID 3528 wrote to memory of 2504 3528 rundll32.exe 87 PID 3528 wrote to memory of 2504 3528 rundll32.exe 87 PID 3528 wrote to memory of 2504 3528 rundll32.exe 87 PID 2504 wrote to memory of 4340 2504 rundll32.exe 88 PID 2504 wrote to memory of 4340 2504 rundll32.exe 88 PID 2504 wrote to memory of 4340 2504 rundll32.exe 88 PID 4340 wrote to memory of 3308 4340 rundll32.exe 89 PID 4340 wrote to memory of 3308 4340 rundll32.exe 89 PID 4340 wrote to memory of 3308 4340 rundll32.exe 89 PID 3308 wrote to memory of 5100 3308 rundll32.exe 90 PID 3308 wrote to memory of 5100 3308 rundll32.exe 90 PID 3308 wrote to memory of 5100 3308 rundll32.exe 90 PID 5100 wrote to memory of 3648 5100 rundll32.exe 91 PID 5100 wrote to memory of 3648 5100 rundll32.exe 91 PID 5100 wrote to memory of 3648 5100 rundll32.exe 91 PID 3648 wrote to memory of 220 3648 rundll32.exe 92 PID 3648 wrote to memory of 220 3648 rundll32.exe 92 PID 3648 wrote to memory of 220 3648 rundll32.exe 92 PID 220 wrote to memory of 3940 220 rundll32.exe 93 PID 220 wrote to memory of 3940 220 rundll32.exe 93 PID 220 wrote to memory of 3940 220 rundll32.exe 93 PID 3940 wrote to memory of 3288 3940 rundll32.exe 94 PID 3940 wrote to memory of 3288 3940 rundll32.exe 94 PID 3940 wrote to memory of 3288 3940 rundll32.exe 94 PID 3288 wrote to memory of 1956 3288 rundll32.exe 95 PID 3288 wrote to memory of 1956 3288 rundll32.exe 95 PID 3288 wrote to memory of 1956 3288 rundll32.exe 95 PID 1956 wrote to memory of 3728 1956 rundll32.exe 96 PID 1956 wrote to memory of 3728 1956 rundll32.exe 96 PID 1956 wrote to memory of 3728 1956 rundll32.exe 96 PID 3728 wrote to memory of 3696 3728 rundll32.exe 97 PID 3728 wrote to memory of 3696 3728 rundll32.exe 97 PID 3728 wrote to memory of 3696 3728 rundll32.exe 97 PID 3696 wrote to memory of 1400 3696 rundll32.exe 98 PID 3696 wrote to memory of 1400 3696 rundll32.exe 98 PID 3696 wrote to memory of 1400 3696 rundll32.exe 98 PID 1400 wrote to memory of 1752 1400 rundll32.exe 99 PID 1400 wrote to memory of 1752 1400 rundll32.exe 99 PID 1400 wrote to memory of 1752 1400 rundll32.exe 99 PID 1752 wrote to memory of 1620 1752 rundll32.exe 100 PID 1752 wrote to memory of 1620 1752 rundll32.exe 100 PID 1752 wrote to memory of 1620 1752 rundll32.exe 100 PID 1620 wrote to memory of 4636 1620 rundll32.exe 101 PID 1620 wrote to memory of 4636 1620 rundll32.exe 101 PID 1620 wrote to memory of 4636 1620 rundll32.exe 101 PID 4636 wrote to memory of 1492 4636 rundll32.exe 102 PID 4636 wrote to memory of 1492 4636 rundll32.exe 102 PID 4636 wrote to memory of 1492 4636 rundll32.exe 102 PID 1492 wrote to memory of 2008 1492 rundll32.exe 103 PID 1492 wrote to memory of 2008 1492 rundll32.exe 103 PID 1492 wrote to memory of 2008 1492 rundll32.exe 103 PID 2008 wrote to memory of 1284 2008 rundll32.exe 104 PID 2008 wrote to memory of 1284 2008 rundll32.exe 104 PID 2008 wrote to memory of 1284 2008 rundll32.exe 104 PID 1284 wrote to memory of 4396 1284 rundll32.exe 105
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#19⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#123⤵PID:4396
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#124⤵PID:1472
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#125⤵PID:1236
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#126⤵PID:1968
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#127⤵
- System Location Discovery: System Language Discovery
PID:3436 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#128⤵PID:1852
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#129⤵PID:692
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#130⤵PID:3992
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#131⤵PID:4964
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#132⤵PID:2408
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#133⤵PID:4476
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#134⤵PID:1960
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#135⤵PID:1900
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#136⤵PID:4072
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#137⤵PID:2412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#138⤵PID:5072
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#139⤵PID:1440
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#140⤵PID:3400
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#141⤵PID:2328
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#142⤵PID:916
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#143⤵PID:2472
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#144⤵PID:5104
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#145⤵PID:4380
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#146⤵PID:3600
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#147⤵
- System Location Discovery: System Language Discovery
PID:1016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#148⤵PID:396
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#149⤵PID:2540
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#150⤵PID:1716
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#151⤵PID:1384
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#152⤵PID:1336
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#153⤵PID:4628
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#154⤵PID:2844
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#155⤵PID:1972
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#156⤵PID:3816
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#157⤵PID:2076
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#158⤵PID:4824
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#159⤵PID:424
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#160⤵PID:3520
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#161⤵PID:432
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#162⤵PID:3512
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#163⤵PID:4832
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#164⤵
- System Location Discovery: System Language Discovery
PID:3116 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#165⤵PID:2140
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#166⤵PID:460
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#167⤵PID:2032
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#168⤵PID:720
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#169⤵PID:1692
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#170⤵PID:4544
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#171⤵PID:4836
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#172⤵PID:1340
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#173⤵PID:4892
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#174⤵PID:3664
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#175⤵PID:2356
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#176⤵PID:3832
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#177⤵PID:1696
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#178⤵PID:1680
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#179⤵PID:3572
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#180⤵PID:4872
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#181⤵PID:4360
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#182⤵PID:2288
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#183⤵PID:3568
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#184⤵PID:1784
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#185⤵PID:4796
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#186⤵
- System Location Discovery: System Language Discovery
PID:4424 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#187⤵PID:3292
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#188⤵
- System Location Discovery: System Language Discovery
PID:1488 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#189⤵PID:2172
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#190⤵PID:4260
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#191⤵PID:2892
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#192⤵PID:60
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#193⤵PID:2232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#194⤵PID:2984
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#195⤵PID:4208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#196⤵PID:4572
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#197⤵PID:3068
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#198⤵PID:4416
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#199⤵PID:4284
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#1100⤵PID:3124
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#1101⤵
- System Location Discovery: System Language Discovery
PID:4828 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#1102⤵PID:2264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#1103⤵PID:2064
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#1104⤵PID:4652
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#1105⤵PID:544
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#1106⤵PID:5124
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#1107⤵PID:5148
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#1108⤵PID:5196
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#1109⤵PID:5212
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#1110⤵PID:5228
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#1111⤵PID:5244
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#1112⤵PID:5260
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#1113⤵PID:5276
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#1114⤵PID:5288
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#1115⤵PID:5312
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#1116⤵PID:5344
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#1117⤵PID:5360
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#1118⤵PID:5376
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#1119⤵PID:5396
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#1120⤵PID:5412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#1121⤵PID:5428
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5181fba6a74b97660cf93d72dcad711_JaffaCakes118.dll,#1122⤵PID:5444
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-