Overview
overview
10Static
static
43.8.1/Blac...al.pdf
windows7-x64
33.8.1/Blac...al.pdf
windows10-2004-x64
33.8.1/Blac...de.pdf
windows7-x64
33.8.1/Blac...de.pdf
windows10-2004-x64
33.8.1/client.exe
windows7-x64
103.8.1/client.exe
windows10-2004-x64
103.8.1/data...~1.dll
windows7-x64
33.8.1/data...~1.dll
windows10-2004-x64
33.8.1/data...~2.dll
windows7-x64
33.8.1/data...~2.dll
windows10-2004-x64
33.8.1/data....2.dll
windows7-x64
33.8.1/data....2.dll
windows10-2004-x64
33.8.1/data....2.dll
windows7-x64
33.8.1/data....2.dll
windows10-2004-x64
3Analysis
-
max time kernel
95s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30-01-2025 08:51
Behavioral task
behavioral1
Sample
3.8.1/Blackshades NET Setup Tutorial.pdf
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
3.8.1/Blackshades NET Setup Tutorial.pdf
Resource
win10v2004-20250129-en
Behavioral task
behavioral3
Sample
3.8.1/Blackshades NET User Guide.pdf
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
3.8.1/Blackshades NET User Guide.pdf
Resource
win10v2004-20250129-en
Behavioral task
behavioral5
Sample
3.8.1/client.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
3.8.1/client.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral7
Sample
3.8.1/data/CODEJO~1.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
3.8.1/data/CODEJO~1.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
3.8.1/data/CODEJO~2.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
3.8.1/data/CODEJO~2.dll
Resource
win10v2004-20250129-en
Behavioral task
behavioral11
Sample
3.8.1/data/Codejock.Controls.Unicode.v12.0.2.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
3.8.1/data/Codejock.Controls.Unicode.v12.0.2.dll
Resource
win10v2004-20250129-en
Behavioral task
behavioral13
Sample
3.8.1/data/Codejock.SkinFramework.v12.0.2.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
3.8.1/data/Codejock.SkinFramework.v12.0.2.dll
Resource
win10v2004-20250129-en
General
-
Target
3.8.1/data/CODEJO~1.dll
-
Size
379KB
-
MD5
928ab3d2ffe0944b9dd8bd648d7042e5
-
SHA1
2d8fb97d80fdbfc86c59f89ce49bb0caba118bf9
-
SHA256
a8cda184b893f8cce4735b9156b0474543b35f26392ae1bddfa3f4ed4157b98e
-
SHA512
5b68167ba0817e1ac65d0ef1f6a3c1fea65fd7d282abf33f4adfd856c1a6007e118e90f23ae7661de70c155d4c7c8c0c0237784fa301bbb8a07d3105f9366994
-
SSDEEP
1536:ixgnD+HS/2FJS2JU5WnoNEFBIgj/Fm2UT0/0OM/MDBAmqezB6YiY9U8ht0mHmNMb:iuDAFI2WD2Fjg2UwWiZUY8m0mEMxZ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3232 wrote to memory of 3156 3232 rundll32.exe 82 PID 3232 wrote to memory of 3156 3232 rundll32.exe 82 PID 3232 wrote to memory of 3156 3232 rundll32.exe 82 PID 3156 wrote to memory of 3704 3156 rundll32.exe 83 PID 3156 wrote to memory of 3704 3156 rundll32.exe 83 PID 3156 wrote to memory of 3704 3156 rundll32.exe 83 PID 3704 wrote to memory of 2060 3704 rundll32.exe 84 PID 3704 wrote to memory of 2060 3704 rundll32.exe 84 PID 3704 wrote to memory of 2060 3704 rundll32.exe 84 PID 2060 wrote to memory of 4868 2060 rundll32.exe 85 PID 2060 wrote to memory of 4868 2060 rundll32.exe 85 PID 2060 wrote to memory of 4868 2060 rundll32.exe 85 PID 4868 wrote to memory of 5088 4868 rundll32.exe 86 PID 4868 wrote to memory of 5088 4868 rundll32.exe 86 PID 4868 wrote to memory of 5088 4868 rundll32.exe 86 PID 5088 wrote to memory of 5112 5088 rundll32.exe 87 PID 5088 wrote to memory of 5112 5088 rundll32.exe 87 PID 5088 wrote to memory of 5112 5088 rundll32.exe 87 PID 5112 wrote to memory of 3708 5112 rundll32.exe 88 PID 5112 wrote to memory of 3708 5112 rundll32.exe 88 PID 5112 wrote to memory of 3708 5112 rundll32.exe 88 PID 3708 wrote to memory of 3876 3708 rundll32.exe 89 PID 3708 wrote to memory of 3876 3708 rundll32.exe 89 PID 3708 wrote to memory of 3876 3708 rundll32.exe 89 PID 3876 wrote to memory of 4168 3876 rundll32.exe 90 PID 3876 wrote to memory of 4168 3876 rundll32.exe 90 PID 3876 wrote to memory of 4168 3876 rundll32.exe 90 PID 4168 wrote to memory of 668 4168 rundll32.exe 91 PID 4168 wrote to memory of 668 4168 rundll32.exe 91 PID 4168 wrote to memory of 668 4168 rundll32.exe 91 PID 668 wrote to memory of 2592 668 rundll32.exe 92 PID 668 wrote to memory of 2592 668 rundll32.exe 92 PID 668 wrote to memory of 2592 668 rundll32.exe 92 PID 2592 wrote to memory of 3536 2592 rundll32.exe 93 PID 2592 wrote to memory of 3536 2592 rundll32.exe 93 PID 2592 wrote to memory of 3536 2592 rundll32.exe 93 PID 3536 wrote to memory of 2364 3536 rundll32.exe 94 PID 3536 wrote to memory of 2364 3536 rundll32.exe 94 PID 3536 wrote to memory of 2364 3536 rundll32.exe 94 PID 2364 wrote to memory of 2728 2364 rundll32.exe 95 PID 2364 wrote to memory of 2728 2364 rundll32.exe 95 PID 2364 wrote to memory of 2728 2364 rundll32.exe 95 PID 2728 wrote to memory of 4720 2728 rundll32.exe 96 PID 2728 wrote to memory of 4720 2728 rundll32.exe 96 PID 2728 wrote to memory of 4720 2728 rundll32.exe 96 PID 4720 wrote to memory of 4844 4720 rundll32.exe 97 PID 4720 wrote to memory of 4844 4720 rundll32.exe 97 PID 4720 wrote to memory of 4844 4720 rundll32.exe 97 PID 4844 wrote to memory of 3748 4844 rundll32.exe 98 PID 4844 wrote to memory of 3748 4844 rundll32.exe 98 PID 4844 wrote to memory of 3748 4844 rundll32.exe 98 PID 3748 wrote to memory of 3508 3748 rundll32.exe 99 PID 3748 wrote to memory of 3508 3748 rundll32.exe 99 PID 3748 wrote to memory of 3508 3748 rundll32.exe 99 PID 3508 wrote to memory of 3964 3508 rundll32.exe 100 PID 3508 wrote to memory of 3964 3508 rundll32.exe 100 PID 3508 wrote to memory of 3964 3508 rundll32.exe 100 PID 3964 wrote to memory of 3372 3964 rundll32.exe 101 PID 3964 wrote to memory of 3372 3964 rundll32.exe 101 PID 3964 wrote to memory of 3372 3964 rundll32.exe 101 PID 3372 wrote to memory of 2552 3372 rundll32.exe 102 PID 3372 wrote to memory of 2552 3372 rundll32.exe 102 PID 3372 wrote to memory of 2552 3372 rundll32.exe 102 PID 2552 wrote to memory of 856 2552 rundll32.exe 103
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#15⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#113⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#123⤵PID:856
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#124⤵PID:3256
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#125⤵PID:2164
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#126⤵PID:824
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#127⤵PID:1936
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#128⤵PID:1084
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#129⤵PID:3044
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#130⤵PID:2692
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#131⤵PID:1292
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#132⤵PID:2756
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#133⤵PID:3344
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#134⤵PID:4724
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#135⤵
- System Location Discovery: System Language Discovery
PID:3000 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#136⤵PID:2380
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#137⤵PID:2916
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#138⤵PID:796
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#139⤵PID:1616
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#140⤵PID:832
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#141⤵PID:2208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#142⤵PID:4436
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#143⤵PID:3264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#144⤵PID:3960
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#145⤵PID:4928
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#146⤵PID:4200
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#147⤵PID:3488
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#148⤵PID:2036
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#149⤵PID:4496
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#150⤵PID:4472
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#151⤵PID:1344
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#152⤵PID:4416
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#153⤵PID:3564
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#154⤵PID:1128
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#155⤵PID:4512
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#156⤵PID:464
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#157⤵PID:3364
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#158⤵PID:2028
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#159⤵PID:2920
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#160⤵PID:5028
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#161⤵PID:716
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#162⤵PID:4520
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#163⤵PID:1268
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#164⤵PID:4208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#165⤵PID:3128
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#166⤵PID:952
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#167⤵PID:1068
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#168⤵PID:2648
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#169⤵
- System Location Discovery: System Language Discovery
PID:588 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#170⤵PID:396
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#171⤵PID:4660
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#172⤵PID:1584
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#173⤵PID:1464
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#174⤵PID:852
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#175⤵PID:3268
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#176⤵
- System Location Discovery: System Language Discovery
PID:1452 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#177⤵PID:2372
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#178⤵
- System Location Discovery: System Language Discovery
PID:5064 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#179⤵
- System Location Discovery: System Language Discovery
PID:3320 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#180⤵PID:4284
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#181⤵PID:4412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#182⤵PID:2936
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#183⤵PID:920
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#184⤵PID:1188
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#185⤵PID:4628
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#186⤵PID:2168
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#187⤵PID:4092
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#188⤵PID:1624
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#189⤵PID:4456
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#190⤵PID:1592
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#191⤵PID:1752
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#192⤵PID:3448
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#193⤵PID:1052
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#194⤵PID:4784
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#195⤵PID:3172
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#196⤵PID:4912
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#197⤵PID:5076
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#198⤵PID:388
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#199⤵PID:2004
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#1100⤵PID:2424
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#1101⤵PID:4832
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#1102⤵PID:2888
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#1103⤵PID:560
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#1104⤵
- System Location Discovery: System Language Discovery
PID:1076 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#1105⤵PID:1808
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#1106⤵PID:4944
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#1107⤵PID:2532
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#1108⤵PID:3996
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#1109⤵PID:2688
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#1110⤵PID:392
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#1111⤵PID:1504
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#1112⤵PID:2044
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#1113⤵PID:440
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#1114⤵PID:1468
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#1115⤵PID:3120
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#1116⤵PID:860
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#1117⤵PID:2412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#1118⤵PID:1836
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#1119⤵
- System Location Discovery: System Language Discovery
PID:1564 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#1120⤵PID:4804
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#1121⤵PID:4360
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.8.1\data\CODEJO~1.dll,#1122⤵PID:2292
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-