Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2024, 10:07
Static task
static1
Behavioral task
behavioral1
Sample
12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll
-
Size
65KB
-
MD5
12e4611e8b9112757321ca0e46c03883
-
SHA1
f95925b5151b8ad4997411955cdf3631fb5b06d3
-
SHA256
b513929390add9bb2d80c4b325d34aabf82351cccd0c88d9b0e9339b22ca6c50
-
SHA512
200c03681dcf628a596182b0b4db71a12d3e136e7c7c3d02a863050c32f888ca4d2381067618bbb63c152505f41952170e7dee8a52ab7ec997ed6d1453c955b0
-
SSDEEP
1536:zv9FvxpmEyYVQixN60KC3aG6ktt2rXGRQTS6vjx48:zvFgrG60KCKG6wtW0+f
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3408 wrote to memory of 1160 3408 rundll32.exe 82 PID 3408 wrote to memory of 1160 3408 rundll32.exe 82 PID 3408 wrote to memory of 1160 3408 rundll32.exe 82 PID 1160 wrote to memory of 3980 1160 rundll32.exe 83 PID 1160 wrote to memory of 3980 1160 rundll32.exe 83 PID 1160 wrote to memory of 3980 1160 rundll32.exe 83 PID 3980 wrote to memory of 2736 3980 rundll32.exe 84 PID 3980 wrote to memory of 2736 3980 rundll32.exe 84 PID 3980 wrote to memory of 2736 3980 rundll32.exe 84 PID 2736 wrote to memory of 756 2736 rundll32.exe 85 PID 2736 wrote to memory of 756 2736 rundll32.exe 85 PID 2736 wrote to memory of 756 2736 rundll32.exe 85 PID 756 wrote to memory of 4900 756 rundll32.exe 86 PID 756 wrote to memory of 4900 756 rundll32.exe 86 PID 756 wrote to memory of 4900 756 rundll32.exe 86 PID 4900 wrote to memory of 4316 4900 rundll32.exe 87 PID 4900 wrote to memory of 4316 4900 rundll32.exe 87 PID 4900 wrote to memory of 4316 4900 rundll32.exe 87 PID 4316 wrote to memory of 3620 4316 rundll32.exe 88 PID 4316 wrote to memory of 3620 4316 rundll32.exe 88 PID 4316 wrote to memory of 3620 4316 rundll32.exe 88 PID 3620 wrote to memory of 3488 3620 rundll32.exe 89 PID 3620 wrote to memory of 3488 3620 rundll32.exe 89 PID 3620 wrote to memory of 3488 3620 rundll32.exe 89 PID 3488 wrote to memory of 3512 3488 rundll32.exe 90 PID 3488 wrote to memory of 3512 3488 rundll32.exe 90 PID 3488 wrote to memory of 3512 3488 rundll32.exe 90 PID 3512 wrote to memory of 2300 3512 rundll32.exe 91 PID 3512 wrote to memory of 2300 3512 rundll32.exe 91 PID 3512 wrote to memory of 2300 3512 rundll32.exe 91 PID 2300 wrote to memory of 4084 2300 rundll32.exe 92 PID 2300 wrote to memory of 4084 2300 rundll32.exe 92 PID 2300 wrote to memory of 4084 2300 rundll32.exe 92 PID 4084 wrote to memory of 4004 4084 rundll32.exe 93 PID 4084 wrote to memory of 4004 4084 rundll32.exe 93 PID 4084 wrote to memory of 4004 4084 rundll32.exe 93 PID 4004 wrote to memory of 4928 4004 rundll32.exe 94 PID 4004 wrote to memory of 4928 4004 rundll32.exe 94 PID 4004 wrote to memory of 4928 4004 rundll32.exe 94 PID 4928 wrote to memory of 4372 4928 rundll32.exe 95 PID 4928 wrote to memory of 4372 4928 rundll32.exe 95 PID 4928 wrote to memory of 4372 4928 rundll32.exe 95 PID 4372 wrote to memory of 1760 4372 rundll32.exe 96 PID 4372 wrote to memory of 1760 4372 rundll32.exe 96 PID 4372 wrote to memory of 1760 4372 rundll32.exe 96 PID 1760 wrote to memory of 4716 1760 rundll32.exe 97 PID 1760 wrote to memory of 4716 1760 rundll32.exe 97 PID 1760 wrote to memory of 4716 1760 rundll32.exe 97 PID 4716 wrote to memory of 2292 4716 rundll32.exe 98 PID 4716 wrote to memory of 2292 4716 rundll32.exe 98 PID 4716 wrote to memory of 2292 4716 rundll32.exe 98 PID 2292 wrote to memory of 992 2292 rundll32.exe 99 PID 2292 wrote to memory of 992 2292 rundll32.exe 99 PID 2292 wrote to memory of 992 2292 rundll32.exe 99 PID 992 wrote to memory of 5112 992 rundll32.exe 100 PID 992 wrote to memory of 5112 992 rundll32.exe 100 PID 992 wrote to memory of 5112 992 rundll32.exe 100 PID 5112 wrote to memory of 3944 5112 rundll32.exe 101 PID 5112 wrote to memory of 3944 5112 rundll32.exe 101 PID 5112 wrote to memory of 3944 5112 rundll32.exe 101 PID 3944 wrote to memory of 2220 3944 rundll32.exe 102 PID 3944 wrote to memory of 2220 3944 rundll32.exe 102 PID 3944 wrote to memory of 2220 3944 rundll32.exe 102 PID 2220 wrote to memory of 4676 2220 rundll32.exe 103
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#19⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#111⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#113⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#119⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#123⤵PID:4676
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#124⤵PID:1832
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#125⤵PID:1628
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#126⤵PID:3352
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#127⤵PID:5064
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#128⤵PID:1192
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#129⤵PID:5096
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#130⤵PID:880
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#131⤵PID:556
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#132⤵PID:2744
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#133⤵PID:4108
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#134⤵PID:232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#135⤵PID:4856
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#136⤵PID:1552
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#137⤵PID:4360
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#138⤵PID:4924
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#139⤵PID:3860
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#140⤵PID:3252
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#141⤵PID:3056
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#142⤵PID:4904
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#143⤵PID:1216
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#144⤵PID:4888
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#145⤵
- System Location Discovery: System Language Discovery
PID:4896 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#146⤵PID:4528
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#147⤵PID:4732
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#148⤵PID:2244
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#149⤵PID:3952
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#150⤵PID:1712
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#151⤵PID:1816
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#152⤵PID:3528
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#153⤵PID:3160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#154⤵PID:4956
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#155⤵PID:2180
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#156⤵PID:4476
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#157⤵PID:4568
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#158⤵PID:4804
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#159⤵PID:1240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#160⤵PID:2160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#161⤵PID:2280
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#162⤵
- System Location Discovery: System Language Discovery
PID:1528 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#163⤵PID:3644
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#164⤵
- System Location Discovery: System Language Discovery
PID:4228 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#165⤵PID:4564
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#166⤵PID:4144
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#167⤵PID:1312
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#168⤵PID:856
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#169⤵PID:1616
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#170⤵PID:1264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#171⤵PID:1464
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#172⤵PID:4356
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#173⤵PID:2156
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#174⤵
- System Location Discovery: System Language Discovery
PID:2640 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#175⤵PID:3068
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#176⤵PID:4712
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#177⤵PID:792
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#178⤵PID:2660
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#179⤵
- System Location Discovery: System Language Discovery
PID:4404 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#180⤵PID:3872
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#181⤵
- System Location Discovery: System Language Discovery
PID:3812 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#182⤵
- System Location Discovery: System Language Discovery
PID:3480 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#183⤵PID:3032
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#184⤵PID:1744
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#185⤵PID:900
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#186⤵PID:1648
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#187⤵PID:3088
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#188⤵PID:4560
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#189⤵PID:1072
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#190⤵PID:2892
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#191⤵PID:1728
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#192⤵PID:4332
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#193⤵PID:4164
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#194⤵PID:2356
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#195⤵PID:3972
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#196⤵PID:4756
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#197⤵PID:3928
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#198⤵PID:3920
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#199⤵PID:2264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#1100⤵PID:2068
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#1101⤵PID:1956
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#1102⤵PID:4104
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#1103⤵
- System Location Discovery: System Language Discovery
PID:964 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#1104⤵PID:4816
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#1105⤵PID:1448
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#1106⤵PID:4932
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#1107⤵PID:3008
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#1108⤵PID:4700
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#1109⤵PID:1732
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#1110⤵PID:1984
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#1111⤵PID:4884
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#1112⤵PID:4996
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#1113⤵
- System Location Discovery: System Language Discovery
PID:2600 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#1114⤵PID:4656
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#1115⤵PID:2864
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#1116⤵PID:3876
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#1117⤵PID:4288
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#1118⤵PID:4020
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#1119⤵
- System Location Discovery: System Language Discovery
PID:8 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#1120⤵PID:4232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#1121⤵PID:1344
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e4611e8b9112757321ca0e46c03883_JaffaCakes118.dll,#1122⤵PID:4664
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-