Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2024, 05:08
Static task
static1
Behavioral task
behavioral1
Sample
2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll
-
Size
25KB
-
MD5
2b6851ec823be5d603f3c7def2a1ab42
-
SHA1
b48be43c6e9d7a2b264e5e7cd2e849cb07f7f0ce
-
SHA256
9e848281a344b1fd28126dab6e334d99f0024a4cac3abf2033f3ceab088a4b74
-
SHA512
766b6b987b6e6eaae0f77a9f1e39a4e0d03a605edfa2f456ae9ec3446661afbebed6c95628db78bb34a93122e1e19891a70267604a94b6ebac8f35dc73b9b4b0
-
SSDEEP
768:gJyKbmbJGZ3tTkZTpMb32xXaQqlfx/ZLH:gAbOOFMb32xXaQWfNxH
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4904 wrote to memory of 1428 4904 rundll32.exe 83 PID 4904 wrote to memory of 1428 4904 rundll32.exe 83 PID 4904 wrote to memory of 1428 4904 rundll32.exe 83 PID 1428 wrote to memory of 1016 1428 rundll32.exe 84 PID 1428 wrote to memory of 1016 1428 rundll32.exe 84 PID 1428 wrote to memory of 1016 1428 rundll32.exe 84 PID 1016 wrote to memory of 3740 1016 rundll32.exe 85 PID 1016 wrote to memory of 3740 1016 rundll32.exe 85 PID 1016 wrote to memory of 3740 1016 rundll32.exe 85 PID 3740 wrote to memory of 5024 3740 rundll32.exe 86 PID 3740 wrote to memory of 5024 3740 rundll32.exe 86 PID 3740 wrote to memory of 5024 3740 rundll32.exe 86 PID 5024 wrote to memory of 1600 5024 rundll32.exe 87 PID 5024 wrote to memory of 1600 5024 rundll32.exe 87 PID 5024 wrote to memory of 1600 5024 rundll32.exe 87 PID 1600 wrote to memory of 812 1600 rundll32.exe 88 PID 1600 wrote to memory of 812 1600 rundll32.exe 88 PID 1600 wrote to memory of 812 1600 rundll32.exe 88 PID 812 wrote to memory of 1124 812 rundll32.exe 90 PID 812 wrote to memory of 1124 812 rundll32.exe 90 PID 812 wrote to memory of 1124 812 rundll32.exe 90 PID 1124 wrote to memory of 2940 1124 rundll32.exe 91 PID 1124 wrote to memory of 2940 1124 rundll32.exe 91 PID 1124 wrote to memory of 2940 1124 rundll32.exe 91 PID 2940 wrote to memory of 4480 2940 rundll32.exe 92 PID 2940 wrote to memory of 4480 2940 rundll32.exe 92 PID 2940 wrote to memory of 4480 2940 rundll32.exe 92 PID 4480 wrote to memory of 4860 4480 rundll32.exe 93 PID 4480 wrote to memory of 4860 4480 rundll32.exe 93 PID 4480 wrote to memory of 4860 4480 rundll32.exe 93 PID 4860 wrote to memory of 4896 4860 rundll32.exe 94 PID 4860 wrote to memory of 4896 4860 rundll32.exe 94 PID 4860 wrote to memory of 4896 4860 rundll32.exe 94 PID 4896 wrote to memory of 4300 4896 rundll32.exe 95 PID 4896 wrote to memory of 4300 4896 rundll32.exe 95 PID 4896 wrote to memory of 4300 4896 rundll32.exe 95 PID 4300 wrote to memory of 2572 4300 rundll32.exe 96 PID 4300 wrote to memory of 2572 4300 rundll32.exe 96 PID 4300 wrote to memory of 2572 4300 rundll32.exe 96 PID 2572 wrote to memory of 1908 2572 rundll32.exe 97 PID 2572 wrote to memory of 1908 2572 rundll32.exe 97 PID 2572 wrote to memory of 1908 2572 rundll32.exe 97 PID 1908 wrote to memory of 2096 1908 rundll32.exe 98 PID 1908 wrote to memory of 2096 1908 rundll32.exe 98 PID 1908 wrote to memory of 2096 1908 rundll32.exe 98 PID 2096 wrote to memory of 1956 2096 rundll32.exe 99 PID 2096 wrote to memory of 1956 2096 rundll32.exe 99 PID 2096 wrote to memory of 1956 2096 rundll32.exe 99 PID 1956 wrote to memory of 4744 1956 rundll32.exe 100 PID 1956 wrote to memory of 4744 1956 rundll32.exe 100 PID 1956 wrote to memory of 4744 1956 rundll32.exe 100 PID 4744 wrote to memory of 3232 4744 rundll32.exe 102 PID 4744 wrote to memory of 3232 4744 rundll32.exe 102 PID 4744 wrote to memory of 3232 4744 rundll32.exe 102 PID 3232 wrote to memory of 3528 3232 rundll32.exe 103 PID 3232 wrote to memory of 3528 3232 rundll32.exe 103 PID 3232 wrote to memory of 3528 3232 rundll32.exe 103 PID 3528 wrote to memory of 4420 3528 rundll32.exe 104 PID 3528 wrote to memory of 4420 3528 rundll32.exe 104 PID 3528 wrote to memory of 4420 3528 rundll32.exe 104 PID 4420 wrote to memory of 224 4420 rundll32.exe 105 PID 4420 wrote to memory of 224 4420 rundll32.exe 105 PID 4420 wrote to memory of 224 4420 rundll32.exe 105 PID 224 wrote to memory of 2244 224 rundll32.exe 106
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#116⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#117⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#123⤵PID:2244
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#124⤵
- System Location Discovery: System Language Discovery
PID:212 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#125⤵PID:1012
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#126⤵PID:1184
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#127⤵PID:4624
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#128⤵PID:5032
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#129⤵PID:1968
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#130⤵PID:2040
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#131⤵PID:1488
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#132⤵PID:3288
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#133⤵PID:3260
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#134⤵PID:4192
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#135⤵
- System Location Discovery: System Language Discovery
PID:3484 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#136⤵PID:4260
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#137⤵PID:3412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#138⤵PID:2964
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#139⤵PID:2304
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#140⤵PID:776
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#141⤵PID:1440
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#142⤵PID:4328
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#143⤵PID:1116
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#144⤵PID:4408
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#145⤵PID:1708
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#146⤵PID:3880
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#147⤵PID:3248
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#148⤵PID:4416
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#149⤵PID:3660
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#150⤵PID:2160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#151⤵PID:4652
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#152⤵
- System Location Discovery: System Language Discovery
PID:2224 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#153⤵PID:2860
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#154⤵PID:1148
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#155⤵PID:5088
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#156⤵PID:8
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#157⤵PID:3372
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#158⤵PID:4440
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#159⤵PID:1836
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#160⤵PID:752
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#161⤵PID:3160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#162⤵PID:1172
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#163⤵PID:1656
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#164⤵PID:5100
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#165⤵PID:2660
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#166⤵PID:4448
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#167⤵
- System Location Discovery: System Language Discovery
PID:3500 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#168⤵PID:4784
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#169⤵PID:4508
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#170⤵PID:2276
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#171⤵PID:3348
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#172⤵PID:3416
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#173⤵PID:1084
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#174⤵PID:2252
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#175⤵PID:4880
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#176⤵PID:2880
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#177⤵PID:2604
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#178⤵PID:2508
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#179⤵PID:4040
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#180⤵PID:3428
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#181⤵PID:3836
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#182⤵PID:1536
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#183⤵PID:3520
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#184⤵PID:4280
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#185⤵PID:4244
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#186⤵PID:2608
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#187⤵PID:3712
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#188⤵PID:2328
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#189⤵PID:1988
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#190⤵PID:3408
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#191⤵PID:720
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#192⤵PID:2500
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#193⤵PID:2712
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#194⤵PID:964
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#195⤵PID:3120
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#196⤵PID:320
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#197⤵PID:4320
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#198⤵PID:2080
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#199⤵PID:440
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#1100⤵PID:372
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#1101⤵PID:464
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#1102⤵PID:4700
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#1103⤵
- System Location Discovery: System Language Discovery
PID:4204 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#1104⤵PID:4916
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#1105⤵PID:1984
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#1106⤵PID:5124
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#1107⤵PID:5136
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#1108⤵PID:5152
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#1109⤵PID:5164
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#1110⤵
- System Location Discovery: System Language Discovery
PID:5180 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#1111⤵PID:5196
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#1112⤵PID:5208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#1113⤵PID:5224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#1114⤵PID:5236
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#1115⤵PID:5252
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#1116⤵PID:5264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#1117⤵PID:5280
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#1118⤵PID:5296
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#1119⤵PID:5308
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#1120⤵PID:5324
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#1121⤵
- System Location Discovery: System Language Discovery
PID:5336 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6851ec823be5d603f3c7def2a1ab42_JaffaCakes118.dll,#1122⤵PID:5352
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-