Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30-04-2024 13:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll
-
Size
12KB
-
MD5
09d5d41f89fdab618940f0f1113e5ea5
-
SHA1
9185d3710be6656f7014956978d6a57c10f642c8
-
SHA256
445c5110fd5439392b06d8ff9e68291706009aa147ff6ec0f9ee328b3dc129db
-
SHA512
480bfdee84cb7bcb89d258175d570d1aee6e72e421dac96e80a9db90c044aba325ab5da35101ee7b46b852cebe63735d24b7613450ef7977fb122f87869a4c41
-
SSDEEP
192:MXjGOSBbSQAoeAXDGhbAPeWEGDI58bYKlaMfbp5Tx1seVkDCn/hQVYpFWaHtW:1GA6Rvuo8bXtfbfrsOkm/hyYpFWaHtW
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3764 wrote to memory of 3568 3764 rundll32.exe 83 PID 3764 wrote to memory of 3568 3764 rundll32.exe 83 PID 3764 wrote to memory of 3568 3764 rundll32.exe 83 PID 3568 wrote to memory of 3040 3568 rundll32.exe 84 PID 3568 wrote to memory of 3040 3568 rundll32.exe 84 PID 3568 wrote to memory of 3040 3568 rundll32.exe 84 PID 3040 wrote to memory of 3172 3040 rundll32.exe 85 PID 3040 wrote to memory of 3172 3040 rundll32.exe 85 PID 3040 wrote to memory of 3172 3040 rundll32.exe 85 PID 3172 wrote to memory of 3152 3172 rundll32.exe 86 PID 3172 wrote to memory of 3152 3172 rundll32.exe 86 PID 3172 wrote to memory of 3152 3172 rundll32.exe 86 PID 3152 wrote to memory of 4392 3152 rundll32.exe 87 PID 3152 wrote to memory of 4392 3152 rundll32.exe 87 PID 3152 wrote to memory of 4392 3152 rundll32.exe 87 PID 4392 wrote to memory of 220 4392 rundll32.exe 88 PID 4392 wrote to memory of 220 4392 rundll32.exe 88 PID 4392 wrote to memory of 220 4392 rundll32.exe 88 PID 220 wrote to memory of 3620 220 rundll32.exe 89 PID 220 wrote to memory of 3620 220 rundll32.exe 89 PID 220 wrote to memory of 3620 220 rundll32.exe 89 PID 3620 wrote to memory of 3400 3620 rundll32.exe 90 PID 3620 wrote to memory of 3400 3620 rundll32.exe 90 PID 3620 wrote to memory of 3400 3620 rundll32.exe 90 PID 3400 wrote to memory of 3128 3400 rundll32.exe 91 PID 3400 wrote to memory of 3128 3400 rundll32.exe 91 PID 3400 wrote to memory of 3128 3400 rundll32.exe 91 PID 3128 wrote to memory of 3744 3128 rundll32.exe 92 PID 3128 wrote to memory of 3744 3128 rundll32.exe 92 PID 3128 wrote to memory of 3744 3128 rundll32.exe 92 PID 3744 wrote to memory of 1264 3744 rundll32.exe 93 PID 3744 wrote to memory of 1264 3744 rundll32.exe 93 PID 3744 wrote to memory of 1264 3744 rundll32.exe 93 PID 1264 wrote to memory of 4008 1264 rundll32.exe 94 PID 1264 wrote to memory of 4008 1264 rundll32.exe 94 PID 1264 wrote to memory of 4008 1264 rundll32.exe 94 PID 4008 wrote to memory of 928 4008 rundll32.exe 95 PID 4008 wrote to memory of 928 4008 rundll32.exe 95 PID 4008 wrote to memory of 928 4008 rundll32.exe 95 PID 928 wrote to memory of 4664 928 rundll32.exe 96 PID 928 wrote to memory of 4664 928 rundll32.exe 96 PID 928 wrote to memory of 4664 928 rundll32.exe 96 PID 4664 wrote to memory of 1196 4664 rundll32.exe 97 PID 4664 wrote to memory of 1196 4664 rundll32.exe 97 PID 4664 wrote to memory of 1196 4664 rundll32.exe 97 PID 1196 wrote to memory of 1516 1196 rundll32.exe 98 PID 1196 wrote to memory of 1516 1196 rundll32.exe 98 PID 1196 wrote to memory of 1516 1196 rundll32.exe 98 PID 1516 wrote to memory of 412 1516 rundll32.exe 99 PID 1516 wrote to memory of 412 1516 rundll32.exe 99 PID 1516 wrote to memory of 412 1516 rundll32.exe 99 PID 412 wrote to memory of 3148 412 rundll32.exe 100 PID 412 wrote to memory of 3148 412 rundll32.exe 100 PID 412 wrote to memory of 3148 412 rundll32.exe 100 PID 3148 wrote to memory of 1328 3148 rundll32.exe 101 PID 3148 wrote to memory of 1328 3148 rundll32.exe 101 PID 3148 wrote to memory of 1328 3148 rundll32.exe 101 PID 1328 wrote to memory of 4240 1328 rundll32.exe 102 PID 1328 wrote to memory of 4240 1328 rundll32.exe 102 PID 1328 wrote to memory of 4240 1328 rundll32.exe 102 PID 4240 wrote to memory of 3008 4240 rundll32.exe 103 PID 4240 wrote to memory of 3008 4240 rundll32.exe 103 PID 4240 wrote to memory of 3008 4240 rundll32.exe 103 PID 3008 wrote to memory of 1008 3008 rundll32.exe 105
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#123⤵PID:1008
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#124⤵PID:2252
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#125⤵PID:1736
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#126⤵PID:1980
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#127⤵PID:4232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#128⤵PID:3408
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#129⤵PID:3948
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#130⤵PID:1976
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#131⤵PID:4604
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#132⤵PID:3184
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#133⤵PID:3180
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#134⤵PID:5096
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#135⤵PID:3884
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#136⤵PID:748
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#137⤵PID:4464
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#138⤵PID:1420
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#139⤵PID:1756
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#140⤵PID:2880
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#141⤵PID:1364
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#142⤵PID:4928
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#143⤵PID:1376
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#144⤵PID:4964
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#145⤵PID:856
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#146⤵PID:4124
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#147⤵PID:3772
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#148⤵PID:2272
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#149⤵PID:2568
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#150⤵PID:1204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#151⤵PID:1064
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#152⤵PID:2660
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#153⤵PID:1964
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#154⤵PID:1716
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#155⤵PID:4120
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#156⤵PID:1700
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#157⤵PID:1512
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#158⤵PID:1816
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#159⤵PID:3736
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#160⤵PID:3308
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#161⤵PID:4596
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#162⤵PID:1712
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#163⤵PID:4676
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#164⤵PID:4504
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#165⤵PID:4156
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#166⤵PID:432
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#167⤵PID:4916
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#168⤵PID:2548
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#169⤵PID:2484
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#170⤵PID:4012
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#171⤵PID:1088
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#172⤵PID:4612
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#173⤵PID:2704
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#174⤵PID:2016
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#175⤵PID:4516
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#176⤵PID:4564
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#177⤵PID:1464
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#178⤵PID:2032
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#179⤵PID:2940
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#180⤵PID:3220
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#181⤵PID:2520
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#182⤵PID:4424
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#183⤵PID:3956
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#184⤵PID:4436
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#185⤵PID:2064
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#186⤵PID:2632
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#187⤵PID:1344
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#188⤵PID:808
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#189⤵PID:4380
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#190⤵PID:4488
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#191⤵PID:1080
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#192⤵PID:2256
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#193⤵PID:3716
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#194⤵PID:4016
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#195⤵PID:1884
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#196⤵PID:1412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#197⤵PID:1336
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#198⤵PID:5040
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#199⤵PID:2068
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#1100⤵PID:2584
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#1101⤵PID:860
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#1102⤵PID:5084
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#1103⤵PID:5128
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#1104⤵PID:5148
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#1105⤵PID:5164
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#1106⤵PID:5176
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#1107⤵PID:5188
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#1108⤵PID:5204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#1109⤵PID:5224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#1110⤵PID:5240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#1111⤵PID:5260
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#1112⤵PID:5276
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#1113⤵PID:5292
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#1114⤵PID:5308
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#1115⤵PID:5324
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#1116⤵PID:5336
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#1117⤵PID:5360
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#1118⤵PID:5376
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#1119⤵PID:5396
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#1120⤵PID:5412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#1121⤵PID:5460
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09d5d41f89fdab618940f0f1113e5ea5_JaffaCakes118.dll,#1122⤵PID:5488
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-