Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/10/2024, 13:38
Static task
static1
Behavioral task
behavioral1
Sample
184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll
-
Size
198KB
-
MD5
184e775fc07d4677500f186f8b0da7b4
-
SHA1
e7d905546c834ab3c7a9b6d75643b1a9312abe5f
-
SHA256
aef4f1dbb82e57ff2b0830b87619536a74f68f3989952f3f4ec035d144055467
-
SHA512
7989d7f2a43221e959ac47229b599cb7a33a1510014388a8d857204978ada3624da2cff017f552cc0e524f2870ba62144ace50c54a1250bf2d308cca1051ff38
-
SSDEEP
6144:CkpwiamMltw4SFuVze6rUPrJz07ngezPq:1p1a3U4SFvcUPYng0C
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3312 wrote to memory of 2232 3312 rundll32.exe 82 PID 3312 wrote to memory of 2232 3312 rundll32.exe 82 PID 3312 wrote to memory of 2232 3312 rundll32.exe 82 PID 2232 wrote to memory of 2192 2232 rundll32.exe 83 PID 2232 wrote to memory of 2192 2232 rundll32.exe 83 PID 2232 wrote to memory of 2192 2232 rundll32.exe 83 PID 2192 wrote to memory of 3844 2192 rundll32.exe 84 PID 2192 wrote to memory of 3844 2192 rundll32.exe 84 PID 2192 wrote to memory of 3844 2192 rundll32.exe 84 PID 3844 wrote to memory of 3280 3844 rundll32.exe 85 PID 3844 wrote to memory of 3280 3844 rundll32.exe 85 PID 3844 wrote to memory of 3280 3844 rundll32.exe 85 PID 3280 wrote to memory of 1332 3280 rundll32.exe 86 PID 3280 wrote to memory of 1332 3280 rundll32.exe 86 PID 3280 wrote to memory of 1332 3280 rundll32.exe 86 PID 1332 wrote to memory of 3812 1332 rundll32.exe 87 PID 1332 wrote to memory of 3812 1332 rundll32.exe 87 PID 1332 wrote to memory of 3812 1332 rundll32.exe 87 PID 3812 wrote to memory of 4472 3812 rundll32.exe 88 PID 3812 wrote to memory of 4472 3812 rundll32.exe 88 PID 3812 wrote to memory of 4472 3812 rundll32.exe 88 PID 4472 wrote to memory of 2860 4472 rundll32.exe 89 PID 4472 wrote to memory of 2860 4472 rundll32.exe 89 PID 4472 wrote to memory of 2860 4472 rundll32.exe 89 PID 2860 wrote to memory of 2328 2860 rundll32.exe 90 PID 2860 wrote to memory of 2328 2860 rundll32.exe 90 PID 2860 wrote to memory of 2328 2860 rundll32.exe 90 PID 2328 wrote to memory of 3120 2328 rundll32.exe 91 PID 2328 wrote to memory of 3120 2328 rundll32.exe 91 PID 2328 wrote to memory of 3120 2328 rundll32.exe 91 PID 3120 wrote to memory of 1664 3120 rundll32.exe 92 PID 3120 wrote to memory of 1664 3120 rundll32.exe 92 PID 3120 wrote to memory of 1664 3120 rundll32.exe 92 PID 1664 wrote to memory of 624 1664 rundll32.exe 93 PID 1664 wrote to memory of 624 1664 rundll32.exe 93 PID 1664 wrote to memory of 624 1664 rundll32.exe 93 PID 624 wrote to memory of 3080 624 rundll32.exe 94 PID 624 wrote to memory of 3080 624 rundll32.exe 94 PID 624 wrote to memory of 3080 624 rundll32.exe 94 PID 3080 wrote to memory of 4652 3080 rundll32.exe 95 PID 3080 wrote to memory of 4652 3080 rundll32.exe 95 PID 3080 wrote to memory of 4652 3080 rundll32.exe 95 PID 4652 wrote to memory of 2268 4652 rundll32.exe 96 PID 4652 wrote to memory of 2268 4652 rundll32.exe 96 PID 4652 wrote to memory of 2268 4652 rundll32.exe 96 PID 2268 wrote to memory of 3012 2268 rundll32.exe 97 PID 2268 wrote to memory of 3012 2268 rundll32.exe 97 PID 2268 wrote to memory of 3012 2268 rundll32.exe 97 PID 3012 wrote to memory of 1212 3012 rundll32.exe 98 PID 3012 wrote to memory of 1212 3012 rundll32.exe 98 PID 3012 wrote to memory of 1212 3012 rundll32.exe 98 PID 1212 wrote to memory of 3496 1212 rundll32.exe 99 PID 1212 wrote to memory of 3496 1212 rundll32.exe 99 PID 1212 wrote to memory of 3496 1212 rundll32.exe 99 PID 3496 wrote to memory of 5096 3496 rundll32.exe 100 PID 3496 wrote to memory of 5096 3496 rundll32.exe 100 PID 3496 wrote to memory of 5096 3496 rundll32.exe 100 PID 5096 wrote to memory of 4840 5096 rundll32.exe 101 PID 5096 wrote to memory of 4840 5096 rundll32.exe 101 PID 5096 wrote to memory of 4840 5096 rundll32.exe 101 PID 4840 wrote to memory of 4624 4840 rundll32.exe 102 PID 4840 wrote to memory of 4624 4840 rundll32.exe 102 PID 4840 wrote to memory of 4624 4840 rundll32.exe 102 PID 4624 wrote to memory of 1844 4624 rundll32.exe 103
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#15⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#112⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#123⤵PID:1844
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#124⤵PID:732
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#125⤵PID:4204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#126⤵PID:4924
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#127⤵PID:1236
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#128⤵PID:3660
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#129⤵PID:2608
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#130⤵PID:2188
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#131⤵PID:4760
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#132⤵PID:400
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#133⤵PID:1588
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#134⤵PID:952
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#135⤵PID:1072
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#136⤵PID:3204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#137⤵PID:5108
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#138⤵
- System Location Discovery: System Language Discovery
PID:4604 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#139⤵PID:2540
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#140⤵PID:3284
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#141⤵PID:1744
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#142⤵PID:448
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#143⤵PID:2068
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#144⤵PID:1652
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#145⤵PID:4284
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#146⤵PID:4328
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#147⤵PID:512
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#148⤵PID:1924
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#149⤵PID:3316
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#150⤵PID:2424
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#151⤵PID:4912
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#152⤵PID:3720
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#153⤵PID:2996
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#154⤵PID:1788
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#155⤵PID:4244
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#156⤵PID:4440
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#157⤵PID:364
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#158⤵PID:4068
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#159⤵PID:536
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#160⤵PID:2460
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#161⤵PID:2764
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#162⤵
- System Location Discovery: System Language Discovery
PID:1628 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#163⤵PID:1852
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#164⤵PID:1928
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#165⤵PID:2348
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#166⤵PID:4928
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#167⤵PID:2320
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#168⤵PID:1492
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#169⤵PID:4524
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#170⤵PID:1856
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#171⤵PID:1196
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#172⤵PID:2716
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#173⤵PID:1388
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#174⤵PID:2216
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#175⤵PID:1444
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#176⤵PID:2696
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#177⤵PID:1900
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#178⤵PID:2504
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#179⤵PID:3140
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#180⤵PID:8
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#181⤵PID:1940
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#182⤵PID:2240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#183⤵PID:2580
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#184⤵PID:2892
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#185⤵PID:4544
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#186⤵
- System Location Discovery: System Language Discovery
PID:2252 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#187⤵PID:3536
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#188⤵PID:832
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#189⤵PID:3184
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#190⤵PID:1792
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#191⤵PID:3244
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#192⤵PID:4512
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#193⤵
- System Location Discovery: System Language Discovery
PID:4768 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#194⤵PID:1228
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#195⤵PID:1808
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#196⤵PID:3236
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#197⤵PID:2524
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#198⤵PID:3124
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#199⤵PID:4956
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#1100⤵PID:4612
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#1101⤵
- System Location Discovery: System Language Discovery
PID:4128 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#1102⤵PID:4008
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#1103⤵PID:5000
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#1104⤵
- System Location Discovery: System Language Discovery
PID:880 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#1105⤵PID:4836
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#1106⤵
- System Location Discovery: System Language Discovery
PID:5064 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#1107⤵PID:244
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#1108⤵PID:3996
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#1109⤵PID:4340
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#1110⤵PID:4516
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#1111⤵PID:3724
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#1112⤵
- System Location Discovery: System Language Discovery
PID:3228 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#1113⤵PID:2272
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#1114⤵
- System Location Discovery: System Language Discovery
PID:2472 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#1115⤵PID:5132
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#1116⤵PID:5148
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#1117⤵PID:5172
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#1118⤵
- System Location Discovery: System Language Discovery
PID:5188 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#1119⤵PID:5204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#1120⤵PID:5220
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#1121⤵PID:5236
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\184e775fc07d4677500f186f8b0da7b4_JaffaCakes118.dll,#1122⤵PID:5252
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-