Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23/08/2024, 07:44
Static task
static1
Behavioral task
behavioral1
Sample
bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll
-
Size
48KB
-
MD5
bae1554a661bba058b7ba9a61fed42ba
-
SHA1
dac69a524b5fe28c8366760eb2c365077778857d
-
SHA256
0163d689a037fd192ee60e03395ffb11b2003a1e98388b80637bb3dfa433b474
-
SHA512
98bc4238ad25d37e1c5b4446c5f027aaedb0c66ed8db8869e7ccbcc1d23376f05303b7bb23984938e0bdb178df436abec78dedc7b119742e6946dc495d08f4e6
-
SSDEEP
384:JToHhcb6TfV9jhe6kuW/UVsFL7bScMzZ3jy4lJ4X6ulX+cA/8oKHQxLqbT9K:JTbGT99dT9VsFLa5jZJ4X6ie/8ofY9
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4452 wrote to memory of 4128 4452 rundll32.exe 84 PID 4452 wrote to memory of 4128 4452 rundll32.exe 84 PID 4452 wrote to memory of 4128 4452 rundll32.exe 84 PID 4128 wrote to memory of 4516 4128 rundll32.exe 85 PID 4128 wrote to memory of 4516 4128 rundll32.exe 85 PID 4128 wrote to memory of 4516 4128 rundll32.exe 85 PID 4516 wrote to memory of 4556 4516 rundll32.exe 86 PID 4516 wrote to memory of 4556 4516 rundll32.exe 86 PID 4516 wrote to memory of 4556 4516 rundll32.exe 86 PID 4556 wrote to memory of 400 4556 rundll32.exe 87 PID 4556 wrote to memory of 400 4556 rundll32.exe 87 PID 4556 wrote to memory of 400 4556 rundll32.exe 87 PID 400 wrote to memory of 4824 400 rundll32.exe 88 PID 400 wrote to memory of 4824 400 rundll32.exe 88 PID 400 wrote to memory of 4824 400 rundll32.exe 88 PID 4824 wrote to memory of 5056 4824 rundll32.exe 89 PID 4824 wrote to memory of 5056 4824 rundll32.exe 89 PID 4824 wrote to memory of 5056 4824 rundll32.exe 89 PID 5056 wrote to memory of 5112 5056 rundll32.exe 90 PID 5056 wrote to memory of 5112 5056 rundll32.exe 90 PID 5056 wrote to memory of 5112 5056 rundll32.exe 90 PID 5112 wrote to memory of 2360 5112 rundll32.exe 91 PID 5112 wrote to memory of 2360 5112 rundll32.exe 91 PID 5112 wrote to memory of 2360 5112 rundll32.exe 91 PID 2360 wrote to memory of 1240 2360 rundll32.exe 92 PID 2360 wrote to memory of 1240 2360 rundll32.exe 92 PID 2360 wrote to memory of 1240 2360 rundll32.exe 92 PID 1240 wrote to memory of 2672 1240 rundll32.exe 93 PID 1240 wrote to memory of 2672 1240 rundll32.exe 93 PID 1240 wrote to memory of 2672 1240 rundll32.exe 93 PID 2672 wrote to memory of 2128 2672 rundll32.exe 94 PID 2672 wrote to memory of 2128 2672 rundll32.exe 94 PID 2672 wrote to memory of 2128 2672 rundll32.exe 94 PID 2128 wrote to memory of 1936 2128 rundll32.exe 95 PID 2128 wrote to memory of 1936 2128 rundll32.exe 95 PID 2128 wrote to memory of 1936 2128 rundll32.exe 95 PID 1936 wrote to memory of 972 1936 rundll32.exe 96 PID 1936 wrote to memory of 972 1936 rundll32.exe 96 PID 1936 wrote to memory of 972 1936 rundll32.exe 96 PID 972 wrote to memory of 4880 972 rundll32.exe 97 PID 972 wrote to memory of 4880 972 rundll32.exe 97 PID 972 wrote to memory of 4880 972 rundll32.exe 97 PID 4880 wrote to memory of 2796 4880 rundll32.exe 98 PID 4880 wrote to memory of 2796 4880 rundll32.exe 98 PID 4880 wrote to memory of 2796 4880 rundll32.exe 98 PID 2796 wrote to memory of 1244 2796 rundll32.exe 99 PID 2796 wrote to memory of 1244 2796 rundll32.exe 99 PID 2796 wrote to memory of 1244 2796 rundll32.exe 99 PID 1244 wrote to memory of 1400 1244 rundll32.exe 100 PID 1244 wrote to memory of 1400 1244 rundll32.exe 100 PID 1244 wrote to memory of 1400 1244 rundll32.exe 100 PID 1400 wrote to memory of 2560 1400 rundll32.exe 101 PID 1400 wrote to memory of 2560 1400 rundll32.exe 101 PID 1400 wrote to memory of 2560 1400 rundll32.exe 101 PID 2560 wrote to memory of 1072 2560 rundll32.exe 103 PID 2560 wrote to memory of 1072 2560 rundll32.exe 103 PID 2560 wrote to memory of 1072 2560 rundll32.exe 103 PID 1072 wrote to memory of 100 1072 rundll32.exe 104 PID 1072 wrote to memory of 100 1072 rundll32.exe 104 PID 1072 wrote to memory of 100 1072 rundll32.exe 104 PID 100 wrote to memory of 264 100 rundll32.exe 105 PID 100 wrote to memory of 264 100 rundll32.exe 105 PID 100 wrote to memory of 264 100 rundll32.exe 105 PID 264 wrote to memory of 4668 264 rundll32.exe 106
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#120⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:100 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#123⤵PID:4668
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#124⤵PID:1264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#125⤵PID:2956
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#126⤵PID:4328
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#127⤵PID:3152
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#128⤵PID:1752
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#129⤵PID:3280
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#130⤵PID:2196
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#131⤵PID:4996
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#132⤵PID:3628
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#133⤵PID:4836
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#134⤵PID:4404
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#135⤵PID:2940
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#136⤵PID:1548
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#137⤵PID:3472
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#138⤵PID:4592
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#139⤵PID:3292
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#140⤵PID:1044
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#141⤵PID:4356
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#142⤵PID:428
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#143⤵PID:4788
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#144⤵PID:4784
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#145⤵PID:4976
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#146⤵PID:3240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#147⤵PID:2088
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#148⤵PID:1544
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#149⤵PID:3012
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#150⤵PID:4412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#151⤵PID:1788
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#152⤵
- System Location Discovery: System Language Discovery
PID:4580 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#153⤵
- System Location Discovery: System Language Discovery
PID:2820 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#154⤵PID:3552
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#155⤵PID:828
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#156⤵PID:5068
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#157⤵PID:2064
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#158⤵PID:3332
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#159⤵
- System Location Discovery: System Language Discovery
PID:1076 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#160⤵PID:2580
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#161⤵PID:4104
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#162⤵
- System Location Discovery: System Language Discovery
PID:1108 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#163⤵PID:3256
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#164⤵PID:4400
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#165⤵PID:1800
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#166⤵PID:3888
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#167⤵PID:2408
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#168⤵PID:3312
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#169⤵PID:1056
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#170⤵PID:4848
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#171⤵PID:1756
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#172⤵PID:1084
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#173⤵PID:1180
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#174⤵PID:752
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#175⤵PID:1612
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#176⤵PID:624
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#177⤵PID:3052
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#178⤵PID:4144
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#179⤵PID:872
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#180⤵PID:2392
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#181⤵PID:4364
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#182⤵PID:3440
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#183⤵PID:4944
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#184⤵PID:3616
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#185⤵PID:4616
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#186⤵
- System Location Discovery: System Language Discovery
PID:1392 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#187⤵PID:4352
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#188⤵PID:548
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#189⤵PID:760
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#190⤵PID:3324
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#191⤵PID:4340
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#192⤵PID:2524
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#193⤵PID:4240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#194⤵PID:432
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#195⤵PID:3936
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#196⤵PID:2756
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#197⤵PID:2340
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#198⤵PID:3900
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#199⤵
- System Location Discovery: System Language Discovery
PID:5124 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#1100⤵PID:5144
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#1101⤵PID:5160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#1102⤵PID:5172
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#1103⤵
- System Location Discovery: System Language Discovery
PID:5188 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#1104⤵PID:5208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#1105⤵PID:5224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#1106⤵PID:5244
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#1107⤵PID:5264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#1108⤵PID:5292
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#1109⤵PID:5308
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#1110⤵PID:5320
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#1111⤵PID:5336
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#1112⤵PID:5356
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#1113⤵PID:5368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#1114⤵PID:5384
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#1115⤵PID:5404
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#1116⤵PID:5420
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#1117⤵PID:5456
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#1118⤵PID:5476
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#1119⤵PID:5488
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#1120⤵PID:5500
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#1121⤵PID:5520
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1554a661bba058b7ba9a61fed42ba_JaffaCakes118.dll,#1122⤵PID:5536
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-