Overview
overview
10Static
static
43.8.1/Blac...al.pdf
windows7-x64
33.8.1/Blac...al.pdf
windows10-2004-x64
33.8.1/Blac...de.pdf
windows7-x64
33.8.1/Blac...de.pdf
windows10-2004-x64
33.8.1/client.exe
windows7-x64
103.8.1/client.exe
windows10-2004-x64
103.8.1/data...~1.dll
windows7-x64
33.8.1/data...~1.dll
windows10-2004-x64
33.8.1/data...~2.dll
windows7-x64
33.8.1/data...~2.dll
windows10-2004-x64
33.8.1/data....2.dll
windows7-x64
33.8.1/data....2.dll
windows10-2004-x64
33.8.1/data....2.dll
windows7-x64
33.8.1/data....2.dll
windows10-2004-x64
3Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
30-01-2025 08:51
Behavioral task
behavioral1
Sample
3.8.1/Blackshades NET Setup Tutorial.pdf
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
3.8.1/Blackshades NET Setup Tutorial.pdf
Resource
win10v2004-20250129-en
Behavioral task
behavioral3
Sample
3.8.1/Blackshades NET User Guide.pdf
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
3.8.1/Blackshades NET User Guide.pdf
Resource
win10v2004-20250129-en
Behavioral task
behavioral5
Sample
3.8.1/client.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
3.8.1/client.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral7
Sample
3.8.1/data/CODEJO~1.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
3.8.1/data/CODEJO~1.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
3.8.1/data/CODEJO~2.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
3.8.1/data/CODEJO~2.dll
Resource
win10v2004-20250129-en
Behavioral task
behavioral11
Sample
3.8.1/data/Codejock.Controls.Unicode.v12.0.2.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
3.8.1/data/Codejock.Controls.Unicode.v12.0.2.dll
Resource
win10v2004-20250129-en
Behavioral task
behavioral13
Sample
3.8.1/data/Codejock.SkinFramework.v12.0.2.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
3.8.1/data/Codejock.SkinFramework.v12.0.2.dll
Resource
win10v2004-20250129-en
General
-
Target
3.8.1/data/CODEJO~2.dll
-
Size
17KB
-
MD5
25f7cc50f4bbf81ff82c243f20cde0c7
-
SHA1
8d075894e6001135e3d85d30907f828b2afb9107
-
SHA256
6f44c09546b1f7b44f3025d3e285210d013c42b05cc7aae4849950523787d38e
-
SHA512
8487e9d0e68fd7ae568a8145ffba71b408f5debde070d16df5123a77b103a21312ff65bd3aa6de38d2e7fc7dd362a0dbb96851a99d3640d53010ed84ae3e10c0
-
SSDEEP
192:YHRJM6KPvZl/QK0aCr8fhvBF28Mp/7DvvOTGFJIGT0wabAhw:X6Knx3w7p/7DvvOTGFJIG8A
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4192 wrote to memory of 3952 4192 rundll32.exe 84 PID 4192 wrote to memory of 3952 4192 rundll32.exe 84 PID 4192 wrote to memory of 3952 4192 rundll32.exe 84 PID 3952 wrote to memory of 3292 3952 rundll32.exe 85 PID 3952 wrote to memory of 3292 3952 rundll32.exe 85 PID 3952 wrote to memory of 3292 3952 rundll32.exe 85 PID 3292 wrote to memory of 3540 3292 rundll32.exe 86 PID 3292 wrote to memory of 3540 3292 rundll32.exe 86 PID 3292 wrote to memory of 3540 3292 rundll32.exe 86 PID 3540 wrote to memory of 2584 3540 rundll32.exe 87 PID 3540 wrote to memory of 2584 3540 rundll32.exe 87 PID 3540 wrote to memory of 2584 3540 rundll32.exe 87 PID 2584 wrote to memory of 3608 2584 rundll32.exe 88 PID 2584 wrote to memory of 3608 2584 rundll32.exe 88 PID 2584 wrote to memory of 3608 2584 rundll32.exe 88 PID 3608 wrote to memory of 1128 3608 rundll32.exe 89 PID 3608 wrote to memory of 1128 3608 rundll32.exe 89 PID 3608 wrote to memory of 1128 3608 rundll32.exe 89 PID 1128 wrote to memory of 4032 1128 rundll32.exe 90 PID 1128 wrote to memory of 4032 1128 rundll32.exe 90 PID 1128 wrote to memory of 4032 1128 rundll32.exe 90 PID 4032 wrote to memory of 5040 4032 rundll32.exe 91 PID 4032 wrote to memory of 5040 4032 rundll32.exe 91 PID 4032 wrote to memory of 5040 4032 rundll32.exe 91 PID 5040 wrote to memory of 4836 5040 rundll32.exe 92 PID 5040 wrote to memory of 4836 5040 rundll32.exe 92 PID 5040 wrote to memory of 4836 5040 rundll32.exe 92 PID 4836 wrote to memory of 4876 4836 rundll32.exe 93 PID 4836 wrote to memory of 4876 4836 rundll32.exe 93 PID 4836 wrote to memory of 4876 4836 rundll32.exe 93 PID 4876 wrote to memory of 64 4876 rundll32.exe 94 PID 4876 wrote to memory of 64 4876 rundll32.exe 94 PID 4876 wrote to memory of 64 4876 rundll32.exe 94 PID 64 wrote to memory of 624 64 rundll32.exe 95 PID 64 wrote to memory of 624 64 rundll32.exe 95 PID 64 wrote to memory of 624 64 rundll32.exe 95 PID 624 wrote to memory of 4980 624 rundll32.exe 96 PID 624 wrote to memory of 4980 624 rundll32.exe 96 PID 624 wrote to memory of 4980 624 rundll32.exe 96 PID 4980 wrote to memory of 3480 4980 rundll32.exe 97 PID 4980 wrote to memory of 3480 4980 rundll32.exe 97 PID 4980 wrote to memory of 3480 4980 rundll32.exe 97 PID 3480 wrote to memory of 4928 3480 rundll32.exe 98 PID 3480 wrote to memory of 4928 3480 rundll32.exe 98 PID 3480 wrote to memory of 4928 3480 rundll32.exe 98 PID 4928 wrote to memory of 1688 4928 rundll32.exe 99 PID 4928 wrote to memory of 1688 4928 rundll32.exe 99 PID 4928 wrote to memory of 1688 4928 rundll32.exe 99 PID 1688 wrote to memory of 1156 1688 rundll32.exe 100 PID 1688 wrote to memory of 1156 1688 rundll32.exe 100 PID 1688 wrote to memory of 1156 1688 rundll32.exe 100 PID 1156 wrote to memory of 4332 1156 rundll32.exe 101 PID 1156 wrote to memory of 4332 1156 rundll32.exe 101 PID 1156 wrote to memory of 4332 1156 rundll32.exe 101 PID 4332 wrote to memory of 100 4332 rundll32.exe 102 PID 4332 wrote to memory of 100 4332 rundll32.exe 102 PID 4332 wrote to memory of 100 4332 rundll32.exe 102 PID 100 wrote to memory of 3028 100 rundll32.exe 103 PID 100 wrote to memory of 3028 100 rundll32.exe 103 PID 100 wrote to memory of 3028 100 rundll32.exe 103 PID 3028 wrote to memory of 908 3028 rundll32.exe 104 PID 3028 wrote to memory of 908 3028 rundll32.exe 104 PID 3028 wrote to memory of 908 3028 rundll32.exe 104 PID 908 wrote to memory of 352 908 rundll32.exe 105
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:100 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#123⤵
- System Location Discovery: System Language Discovery
PID:352 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#124⤵PID:3640
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#125⤵PID:4464
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#126⤵PID:2124
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#127⤵PID:3860
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#128⤵PID:628
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#129⤵
- System Location Discovery: System Language Discovery
PID:1816 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#130⤵PID:1160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#131⤵PID:2192
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#132⤵PID:5076
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#133⤵PID:4228
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#134⤵PID:2992
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#135⤵PID:2824
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#136⤵PID:836
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#137⤵
- System Location Discovery: System Language Discovery
PID:4712 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#138⤵
- System Location Discovery: System Language Discovery
PID:4940 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#139⤵PID:444
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#140⤵PID:4880
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#141⤵PID:4688
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#142⤵PID:4680
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#143⤵PID:3396
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#144⤵PID:1908
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#145⤵PID:2236
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#146⤵PID:4924
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#147⤵PID:4672
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#148⤵PID:4120
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#149⤵PID:632
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#150⤵
- System Location Discovery: System Language Discovery
PID:5032 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#151⤵PID:2116
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#152⤵PID:3960
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#153⤵PID:4884
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#154⤵PID:3812
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#155⤵PID:1872
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#156⤵PID:3992
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#157⤵PID:3476
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#158⤵PID:4636
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#159⤵PID:2416
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#160⤵PID:3956
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#161⤵PID:460
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#162⤵PID:2028
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#163⤵PID:4828
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#164⤵PID:5092
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#165⤵PID:1712
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#166⤵PID:1984
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#167⤵PID:4368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#168⤵PID:1208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#169⤵PID:3216
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#170⤵PID:1760
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#171⤵PID:3916
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#172⤵PID:2080
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#173⤵PID:4036
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#174⤵PID:2684
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#175⤵PID:3212
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#176⤵PID:5084
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#177⤵
- System Location Discovery: System Language Discovery
PID:3512 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#178⤵PID:3932
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#179⤵PID:3592
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#180⤵PID:4516
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#181⤵PID:2812
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#182⤵PID:1368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#183⤵PID:4504
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#184⤵PID:2356
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#185⤵PID:116
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#186⤵PID:3576
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#187⤵PID:1772
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#188⤵PID:4612
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#189⤵PID:4728
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#190⤵PID:4900
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#191⤵PID:4812
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#192⤵PID:3680
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#193⤵PID:4456
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#194⤵PID:4644
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#195⤵PID:2896
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#196⤵PID:1240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#197⤵PID:2140
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#198⤵PID:1256
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#199⤵PID:4268
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#1100⤵PID:4320
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#1101⤵PID:2836
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#1102⤵PID:3804
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#1103⤵PID:2972
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#1104⤵PID:3208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#1105⤵PID:1492
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#1106⤵PID:1408
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#1107⤵PID:4684
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#1108⤵PID:2712
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#1109⤵PID:1596
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#1110⤵PID:4348
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#1111⤵PID:2292
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#1112⤵PID:5124
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#1113⤵PID:5140
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#1114⤵PID:5156
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#1115⤵PID:5172
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#1116⤵PID:5184
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#1117⤵PID:5204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#1118⤵PID:5216
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#1119⤵PID:5228
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#1120⤵PID:5248
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#1121⤵PID:5264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~2.dll,#1122⤵PID:5280
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-