Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 19:02
Static task
static1
Behavioral task
behavioral1
Sample
4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll
-
Size
12KB
-
MD5
4796f7523400df0e0edfb464c47b373c
-
SHA1
bf25328fad33dfa866c9c936f4b8bd228a54ab6a
-
SHA256
7fe93e58346f2b24d45764358bebadc4914c6872e720e5e816a3b5cbafb7169a
-
SHA512
f6634d2f2ca59daf9d97f9fc2dec950a9226805820851559028ecbd9cbc5ac85e15fc3b2c50e4758b2738a910409c5c43db9d2a005714fe630e11524890c56bd
-
SSDEEP
192:qztwYyagIY6TBh7AJV3CjPcpGKNfmzbtaMo6JBW5a7paMnk0Adsvyp//NHK:q5Pyat37AMPciC6HOaFaMnktJJlq
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4356 wrote to memory of 3368 4356 rundll32.exe 83 PID 4356 wrote to memory of 3368 4356 rundll32.exe 83 PID 4356 wrote to memory of 3368 4356 rundll32.exe 83 PID 3368 wrote to memory of 1276 3368 rundll32.exe 84 PID 3368 wrote to memory of 1276 3368 rundll32.exe 84 PID 3368 wrote to memory of 1276 3368 rundll32.exe 84 PID 1276 wrote to memory of 3388 1276 rundll32.exe 85 PID 1276 wrote to memory of 3388 1276 rundll32.exe 85 PID 1276 wrote to memory of 3388 1276 rundll32.exe 85 PID 3388 wrote to memory of 2532 3388 rundll32.exe 86 PID 3388 wrote to memory of 2532 3388 rundll32.exe 86 PID 3388 wrote to memory of 2532 3388 rundll32.exe 86 PID 2532 wrote to memory of 1580 2532 rundll32.exe 87 PID 2532 wrote to memory of 1580 2532 rundll32.exe 87 PID 2532 wrote to memory of 1580 2532 rundll32.exe 87 PID 1580 wrote to memory of 4608 1580 rundll32.exe 88 PID 1580 wrote to memory of 4608 1580 rundll32.exe 88 PID 1580 wrote to memory of 4608 1580 rundll32.exe 88 PID 4608 wrote to memory of 4536 4608 rundll32.exe 89 PID 4608 wrote to memory of 4536 4608 rundll32.exe 89 PID 4608 wrote to memory of 4536 4608 rundll32.exe 89 PID 4536 wrote to memory of 1420 4536 rundll32.exe 90 PID 4536 wrote to memory of 1420 4536 rundll32.exe 90 PID 4536 wrote to memory of 1420 4536 rundll32.exe 90 PID 1420 wrote to memory of 4964 1420 rundll32.exe 91 PID 1420 wrote to memory of 4964 1420 rundll32.exe 91 PID 1420 wrote to memory of 4964 1420 rundll32.exe 91 PID 4964 wrote to memory of 1696 4964 rundll32.exe 92 PID 4964 wrote to memory of 1696 4964 rundll32.exe 92 PID 4964 wrote to memory of 1696 4964 rundll32.exe 92 PID 1696 wrote to memory of 3240 1696 rundll32.exe 93 PID 1696 wrote to memory of 3240 1696 rundll32.exe 93 PID 1696 wrote to memory of 3240 1696 rundll32.exe 93 PID 3240 wrote to memory of 3720 3240 rundll32.exe 94 PID 3240 wrote to memory of 3720 3240 rundll32.exe 94 PID 3240 wrote to memory of 3720 3240 rundll32.exe 94 PID 3720 wrote to memory of 1712 3720 rundll32.exe 95 PID 3720 wrote to memory of 1712 3720 rundll32.exe 95 PID 3720 wrote to memory of 1712 3720 rundll32.exe 95 PID 1712 wrote to memory of 4544 1712 rundll32.exe 96 PID 1712 wrote to memory of 4544 1712 rundll32.exe 96 PID 1712 wrote to memory of 4544 1712 rundll32.exe 96 PID 4544 wrote to memory of 1800 4544 rundll32.exe 97 PID 4544 wrote to memory of 1800 4544 rundll32.exe 97 PID 4544 wrote to memory of 1800 4544 rundll32.exe 97 PID 1800 wrote to memory of 3872 1800 rundll32.exe 98 PID 1800 wrote to memory of 3872 1800 rundll32.exe 98 PID 1800 wrote to memory of 3872 1800 rundll32.exe 98 PID 3872 wrote to memory of 748 3872 rundll32.exe 99 PID 3872 wrote to memory of 748 3872 rundll32.exe 99 PID 3872 wrote to memory of 748 3872 rundll32.exe 99 PID 748 wrote to memory of 4452 748 rundll32.exe 100 PID 748 wrote to memory of 4452 748 rundll32.exe 100 PID 748 wrote to memory of 4452 748 rundll32.exe 100 PID 4452 wrote to memory of 1416 4452 rundll32.exe 101 PID 4452 wrote to memory of 1416 4452 rundll32.exe 101 PID 4452 wrote to memory of 1416 4452 rundll32.exe 101 PID 1416 wrote to memory of 976 1416 rundll32.exe 102 PID 1416 wrote to memory of 976 1416 rundll32.exe 102 PID 1416 wrote to memory of 976 1416 rundll32.exe 102 PID 976 wrote to memory of 4436 976 rundll32.exe 104 PID 976 wrote to memory of 4436 976 rundll32.exe 104 PID 976 wrote to memory of 4436 976 rundll32.exe 104 PID 4436 wrote to memory of 4408 4436 rundll32.exe 105
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#123⤵PID:4408
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#124⤵PID:3936
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#125⤵PID:1236
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#126⤵PID:4756
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#127⤵PID:4120
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#128⤵PID:4224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#129⤵PID:1436
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#130⤵PID:536
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#131⤵PID:972
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#132⤵PID:4828
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#133⤵PID:1148
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#134⤵PID:5032
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#135⤵PID:3780
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#136⤵PID:4104
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#137⤵PID:5072
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#138⤵PID:5064
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#139⤵PID:3980
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#140⤵PID:4244
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#141⤵PID:336
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#142⤵PID:4472
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#143⤵PID:1468
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#144⤵PID:4192
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#145⤵PID:2172
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#146⤵PID:796
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#147⤵PID:4808
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#148⤵PID:4008
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#149⤵PID:4772
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#150⤵PID:4648
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#151⤵PID:3952
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#152⤵PID:4652
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#153⤵PID:880
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#154⤵PID:2296
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#155⤵PID:3592
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#156⤵PID:3612
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#157⤵PID:4232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#158⤵PID:224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#159⤵PID:2592
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#160⤵PID:3180
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#161⤵PID:1832
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#162⤵PID:4072
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#163⤵PID:3688
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#164⤵PID:1672
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#165⤵PID:4684
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#166⤵PID:928
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#167⤵PID:2880
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#168⤵PID:1112
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#169⤵PID:2968
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#170⤵PID:2328
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#171⤵PID:4668
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#172⤵PID:1300
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#173⤵PID:3364
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#174⤵PID:2264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#175⤵PID:4252
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#176⤵PID:4612
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#177⤵PID:4924
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#178⤵PID:2716
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#179⤵PID:1048
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#180⤵PID:2008
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#181⤵PID:3112
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#182⤵PID:4440
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#183⤵PID:1352
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#184⤵PID:2688
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#185⤵PID:4616
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#186⤵PID:2208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#187⤵PID:2308
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#188⤵PID:3480
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#189⤵PID:4384
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#190⤵PID:3056
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#191⤵PID:4600
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#192⤵PID:3068
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#193⤵PID:3744
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#194⤵PID:1056
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#195⤵PID:4360
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#196⤵PID:2544
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#197⤵PID:4996
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#198⤵PID:220
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#199⤵PID:2212
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#1100⤵PID:4644
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#1101⤵PID:1480
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#1102⤵PID:2288
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#1103⤵PID:1884
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#1104⤵PID:4560
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#1105⤵PID:1408
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#1106⤵PID:2104
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#1107⤵PID:1660
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#1108⤵PID:4320
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#1109⤵PID:4380
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#1110⤵PID:1008
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#1111⤵PID:1360
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#1112⤵PID:3184
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#1113⤵PID:3552
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#1114⤵PID:2180
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#1115⤵PID:4568
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#1116⤵PID:2252
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#1117⤵PID:3376
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#1118⤵PID:2236
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#1119⤵PID:588
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#1120⤵PID:4012
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#1121⤵PID:4764
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4796f7523400df0e0edfb464c47b373c_JaffaCakes118.dll,#1122⤵PID:2744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-