Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3cfeb69db03...18.exe
windows7-x64
3cfeb69db03...18.exe
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3avcodec-51.dll
windows7-x64
3avcodec-51.dll
windows10-2004-x64
3libfontconfig-1.dll
windows7-x64
3libfontconfig-1.dll
windows10-2004-x64
3libfreetype-6.dll
windows7-x64
3libfreetype-6.dll
windows10-2004-x64
3vlc.exe
windows7-x64
1vlc.exe
windows10-2004-x64
3Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/09/2024, 16:03
Static task
static1
Behavioral task
behavioral1
Sample
cfeb69db03998240d2593c880a3cc09d_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
cfeb69db03998240d2593c880a3cc09d_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
avcodec-51.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
avcodec-51.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
libfontconfig-1.dll
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
libfontconfig-1.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
libfreetype-6.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
libfreetype-6.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
vlc.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
vlc.exe
Resource
win10v2004-20240802-en
General
-
Target
avcodec-51.dll
-
Size
4.5MB
-
MD5
0fc81f4d316b9012ef13737c37703ddc
-
SHA1
10ecfa6e23ba18410a399b5c7f43488783f57fbe
-
SHA256
470d0a15c146550e9084b78b230026a6cf8c7c59e8b44ddd4e2373b996595309
-
SHA512
cd394a0746a9dde6205a41cbdf0f63ae9cd3efe95e0fc93c65f1218cb720cff4c3136fdb30248a9665eddc240323d82856f090f9d07e80a0b65278ccf6825fdf
-
SSDEEP
98304:uFikUBFJ5FwBdaO3Gk6FGcUaHMkadd1nnps+Q5kZuZ9xAU00AclIqvlAky6hcMbq:uFikUBFJ5FwBdaO3Gk6FGcUaHMkadzwF
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1512 wrote to memory of 2428 1512 rundll32.exe 85 PID 1512 wrote to memory of 2428 1512 rundll32.exe 85 PID 1512 wrote to memory of 2428 1512 rundll32.exe 85 PID 2428 wrote to memory of 4792 2428 rundll32.exe 86 PID 2428 wrote to memory of 4792 2428 rundll32.exe 86 PID 2428 wrote to memory of 4792 2428 rundll32.exe 86 PID 4792 wrote to memory of 3392 4792 rundll32.exe 87 PID 4792 wrote to memory of 3392 4792 rundll32.exe 87 PID 4792 wrote to memory of 3392 4792 rundll32.exe 87 PID 3392 wrote to memory of 3140 3392 rundll32.exe 88 PID 3392 wrote to memory of 3140 3392 rundll32.exe 88 PID 3392 wrote to memory of 3140 3392 rundll32.exe 88 PID 3140 wrote to memory of 3560 3140 rundll32.exe 89 PID 3140 wrote to memory of 3560 3140 rundll32.exe 89 PID 3140 wrote to memory of 3560 3140 rundll32.exe 89 PID 3560 wrote to memory of 4044 3560 rundll32.exe 90 PID 3560 wrote to memory of 4044 3560 rundll32.exe 90 PID 3560 wrote to memory of 4044 3560 rundll32.exe 90 PID 4044 wrote to memory of 3756 4044 rundll32.exe 91 PID 4044 wrote to memory of 3756 4044 rundll32.exe 91 PID 4044 wrote to memory of 3756 4044 rundll32.exe 91 PID 3756 wrote to memory of 3688 3756 rundll32.exe 92 PID 3756 wrote to memory of 3688 3756 rundll32.exe 92 PID 3756 wrote to memory of 3688 3756 rundll32.exe 92 PID 3688 wrote to memory of 4784 3688 rundll32.exe 93 PID 3688 wrote to memory of 4784 3688 rundll32.exe 93 PID 3688 wrote to memory of 4784 3688 rundll32.exe 93 PID 4784 wrote to memory of 3772 4784 rundll32.exe 94 PID 4784 wrote to memory of 3772 4784 rundll32.exe 94 PID 4784 wrote to memory of 3772 4784 rundll32.exe 94 PID 3772 wrote to memory of 3792 3772 rundll32.exe 95 PID 3772 wrote to memory of 3792 3772 rundll32.exe 95 PID 3772 wrote to memory of 3792 3772 rundll32.exe 95 PID 3792 wrote to memory of 372 3792 rundll32.exe 96 PID 3792 wrote to memory of 372 3792 rundll32.exe 96 PID 3792 wrote to memory of 372 3792 rundll32.exe 96 PID 372 wrote to memory of 4072 372 rundll32.exe 97 PID 372 wrote to memory of 4072 372 rundll32.exe 97 PID 372 wrote to memory of 4072 372 rundll32.exe 97 PID 4072 wrote to memory of 3112 4072 rundll32.exe 98 PID 4072 wrote to memory of 3112 4072 rundll32.exe 98 PID 4072 wrote to memory of 3112 4072 rundll32.exe 98 PID 3112 wrote to memory of 4432 3112 rundll32.exe 99 PID 3112 wrote to memory of 4432 3112 rundll32.exe 99 PID 3112 wrote to memory of 4432 3112 rundll32.exe 99 PID 4432 wrote to memory of 2704 4432 rundll32.exe 100 PID 4432 wrote to memory of 2704 4432 rundll32.exe 100 PID 4432 wrote to memory of 2704 4432 rundll32.exe 100 PID 2704 wrote to memory of 5100 2704 rundll32.exe 101 PID 2704 wrote to memory of 5100 2704 rundll32.exe 101 PID 2704 wrote to memory of 5100 2704 rundll32.exe 101 PID 5100 wrote to memory of 1544 5100 rundll32.exe 102 PID 5100 wrote to memory of 1544 5100 rundll32.exe 102 PID 5100 wrote to memory of 1544 5100 rundll32.exe 102 PID 1544 wrote to memory of 4176 1544 rundll32.exe 103 PID 1544 wrote to memory of 4176 1544 rundll32.exe 103 PID 1544 wrote to memory of 4176 1544 rundll32.exe 103 PID 4176 wrote to memory of 2988 4176 rundll32.exe 104 PID 4176 wrote to memory of 2988 4176 rundll32.exe 104 PID 4176 wrote to memory of 2988 4176 rundll32.exe 104 PID 2988 wrote to memory of 1400 2988 rundll32.exe 105 PID 2988 wrote to memory of 1400 2988 rundll32.exe 105 PID 2988 wrote to memory of 1400 2988 rundll32.exe 105 PID 1400 wrote to memory of 532 1400 rundll32.exe 106
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#122⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#123⤵PID:532
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#124⤵PID:968
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#125⤵PID:1920
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#126⤵PID:764
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#127⤵PID:3212
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#128⤵PID:3552
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#129⤵PID:2992
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#130⤵PID:1968
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#131⤵PID:548
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#132⤵PID:3780
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#133⤵
- System Location Discovery: System Language Discovery
PID:3168 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#134⤵PID:2380
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#135⤵PID:2692
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#136⤵PID:3068
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#137⤵PID:3720
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#138⤵PID:3356
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#139⤵PID:4388
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#140⤵
- System Location Discovery: System Language Discovery
PID:744 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#141⤵PID:2484
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#142⤵PID:1000
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#143⤵PID:3084
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#144⤵
- System Location Discovery: System Language Discovery
PID:5016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#145⤵PID:4820
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#146⤵PID:1496
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#147⤵PID:1584
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#148⤵PID:1124
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#149⤵PID:1044
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#150⤵PID:2456
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#151⤵PID:676
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#152⤵PID:2860
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#153⤵PID:2368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#154⤵PID:2684
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#155⤵PID:864
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#156⤵PID:876
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#157⤵PID:1096
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#158⤵PID:1316
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#159⤵PID:1196
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#160⤵PID:1980
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#161⤵PID:4748
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#162⤵PID:3280
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#163⤵PID:4568
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#164⤵PID:2260
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#165⤵PID:3620
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#166⤵PID:3308
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#167⤵PID:4580
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#168⤵PID:664
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#169⤵PID:948
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#170⤵PID:3064
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#171⤵PID:1128
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#172⤵PID:3268
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#173⤵PID:3496
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#174⤵PID:4256
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#175⤵PID:2736
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#176⤵PID:1640
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#177⤵PID:4296
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#178⤵PID:3272
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#179⤵PID:4236
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#180⤵PID:1716
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#181⤵PID:1192
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#182⤵PID:736
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#183⤵PID:2156
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#184⤵PID:1012
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#185⤵PID:2708
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#186⤵PID:4436
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#187⤵PID:1992
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#188⤵PID:1600
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#189⤵PID:1728
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#190⤵PID:2388
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#191⤵PID:3692
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#192⤵PID:4640
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#193⤵PID:1236
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#194⤵PID:1344
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#195⤵PID:4708
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#196⤵
- System Location Discovery: System Language Discovery
PID:3816 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#197⤵PID:748
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#198⤵PID:4944
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#199⤵PID:2920
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#1100⤵PID:1608
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#1101⤵PID:4520
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#1102⤵PID:2152
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#1103⤵PID:2944
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#1104⤵PID:4076
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#1105⤵PID:4496
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#1106⤵PID:4352
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#1107⤵PID:1704
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#1108⤵PID:4992
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#1109⤵PID:4600
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#1110⤵PID:5136
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#1111⤵PID:5148
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#1112⤵PID:5168
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#1113⤵PID:5180
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#1114⤵PID:5208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#1115⤵PID:5224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#1116⤵PID:5240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#1117⤵PID:5256
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#1118⤵PID:5272
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#1119⤵PID:5288
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#1120⤵PID:5304
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#1121⤵PID:5320
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\avcodec-51.dll,#1122⤵PID:5336
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-