Analysis
-
max time kernel
132s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 01:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll
Resource
win7-20240508-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll
-
Size
4KB
-
MD5
706ce36e04d1313881e7a2a993a90994
-
SHA1
fe3827183e76dae5f38c0468f55f95cee667d90b
-
SHA256
5b09a74b17c23ae1e2ba1b07ca9b48046a180eec26102aff0b955245e21a8ce5
-
SHA512
d7a33074cf26039644005b411bc8bb0e94c66b66cc48080ef3af716542c07f0a90f7b56023573fc742d94217b0a8a527e9a49442615b9bc319e2331473d8252d
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4132 wrote to memory of 4564 4132 rundll32.exe 83 PID 4132 wrote to memory of 4564 4132 rundll32.exe 83 PID 4132 wrote to memory of 4564 4132 rundll32.exe 83 PID 4564 wrote to memory of 3132 4564 rundll32.exe 84 PID 4564 wrote to memory of 3132 4564 rundll32.exe 84 PID 4564 wrote to memory of 3132 4564 rundll32.exe 84 PID 3132 wrote to memory of 3740 3132 rundll32.exe 85 PID 3132 wrote to memory of 3740 3132 rundll32.exe 85 PID 3132 wrote to memory of 3740 3132 rundll32.exe 85 PID 3740 wrote to memory of 1924 3740 rundll32.exe 86 PID 3740 wrote to memory of 1924 3740 rundll32.exe 86 PID 3740 wrote to memory of 1924 3740 rundll32.exe 86 PID 1924 wrote to memory of 2824 1924 rundll32.exe 87 PID 1924 wrote to memory of 2824 1924 rundll32.exe 87 PID 1924 wrote to memory of 2824 1924 rundll32.exe 87 PID 2824 wrote to memory of 2908 2824 rundll32.exe 88 PID 2824 wrote to memory of 2908 2824 rundll32.exe 88 PID 2824 wrote to memory of 2908 2824 rundll32.exe 88 PID 2908 wrote to memory of 4796 2908 rundll32.exe 89 PID 2908 wrote to memory of 4796 2908 rundll32.exe 89 PID 2908 wrote to memory of 4796 2908 rundll32.exe 89 PID 4796 wrote to memory of 4520 4796 rundll32.exe 90 PID 4796 wrote to memory of 4520 4796 rundll32.exe 90 PID 4796 wrote to memory of 4520 4796 rundll32.exe 90 PID 4520 wrote to memory of 3372 4520 rundll32.exe 91 PID 4520 wrote to memory of 3372 4520 rundll32.exe 91 PID 4520 wrote to memory of 3372 4520 rundll32.exe 91 PID 3372 wrote to memory of 2232 3372 rundll32.exe 92 PID 3372 wrote to memory of 2232 3372 rundll32.exe 92 PID 3372 wrote to memory of 2232 3372 rundll32.exe 92 PID 2232 wrote to memory of 496 2232 rundll32.exe 93 PID 2232 wrote to memory of 496 2232 rundll32.exe 93 PID 2232 wrote to memory of 496 2232 rundll32.exe 93 PID 496 wrote to memory of 2004 496 rundll32.exe 94 PID 496 wrote to memory of 2004 496 rundll32.exe 94 PID 496 wrote to memory of 2004 496 rundll32.exe 94 PID 2004 wrote to memory of 1428 2004 rundll32.exe 95 PID 2004 wrote to memory of 1428 2004 rundll32.exe 95 PID 2004 wrote to memory of 1428 2004 rundll32.exe 95 PID 1428 wrote to memory of 3340 1428 rundll32.exe 96 PID 1428 wrote to memory of 3340 1428 rundll32.exe 96 PID 1428 wrote to memory of 3340 1428 rundll32.exe 96 PID 3340 wrote to memory of 4948 3340 rundll32.exe 97 PID 3340 wrote to memory of 4948 3340 rundll32.exe 97 PID 3340 wrote to memory of 4948 3340 rundll32.exe 97 PID 4948 wrote to memory of 3728 4948 rundll32.exe 98 PID 4948 wrote to memory of 3728 4948 rundll32.exe 98 PID 4948 wrote to memory of 3728 4948 rundll32.exe 98 PID 3728 wrote to memory of 996 3728 rundll32.exe 99 PID 3728 wrote to memory of 996 3728 rundll32.exe 99 PID 3728 wrote to memory of 996 3728 rundll32.exe 99 PID 996 wrote to memory of 1140 996 rundll32.exe 100 PID 996 wrote to memory of 1140 996 rundll32.exe 100 PID 996 wrote to memory of 1140 996 rundll32.exe 100 PID 1140 wrote to memory of 1944 1140 rundll32.exe 101 PID 1140 wrote to memory of 1944 1140 rundll32.exe 101 PID 1140 wrote to memory of 1944 1140 rundll32.exe 101 PID 1944 wrote to memory of 1404 1944 rundll32.exe 102 PID 1944 wrote to memory of 1404 1944 rundll32.exe 102 PID 1944 wrote to memory of 1404 1944 rundll32.exe 102 PID 1404 wrote to memory of 632 1404 rundll32.exe 103 PID 1404 wrote to memory of 632 1404 rundll32.exe 103 PID 1404 wrote to memory of 632 1404 rundll32.exe 103 PID 632 wrote to memory of 1916 632 rundll32.exe 104
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:496 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#123⤵PID:1916
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#124⤵PID:2960
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#125⤵PID:2148
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#126⤵PID:4844
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#127⤵PID:2064
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#128⤵PID:1824
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#129⤵PID:4840
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#130⤵PID:1756
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#131⤵PID:4036
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#132⤵PID:4916
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#133⤵PID:5044
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#134⤵PID:4988
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#135⤵PID:1224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#136⤵PID:3668
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#137⤵PID:3704
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#138⤵PID:2720
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#139⤵PID:2752
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#140⤵PID:4800
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#141⤵PID:4548
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#142⤵PID:4468
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#143⤵PID:776
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#144⤵PID:4576
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#145⤵PID:3816
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#146⤵PID:4528
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#147⤵PID:2168
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#148⤵PID:3044
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#149⤵PID:1052
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#150⤵PID:3428
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#151⤵PID:4776
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#152⤵PID:4020
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#153⤵PID:928
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#154⤵PID:684
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#155⤵PID:1532
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#156⤵PID:640
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#157⤵PID:3260
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#158⤵PID:1568
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#159⤵PID:4296
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#160⤵PID:1676
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#161⤵PID:1700
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#162⤵PID:2124
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#163⤵PID:4712
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#164⤵PID:4556
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#165⤵PID:1300
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#166⤵PID:4016
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#167⤵PID:1380
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#168⤵PID:4080
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#169⤵PID:3592
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#170⤵PID:3604
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#171⤵PID:2596
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#172⤵PID:4568
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#173⤵PID:2764
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#174⤵PID:3216
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#175⤵PID:3520
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#176⤵PID:932
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#177⤵PID:1872
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#178⤵PID:2924
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#179⤵PID:2440
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#180⤵PID:4900
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#181⤵PID:2608
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#182⤵PID:1720
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#183⤵PID:828
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#184⤵PID:2380
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#185⤵PID:1548
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#186⤵PID:1460
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#187⤵PID:64
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#188⤵PID:3660
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#189⤵PID:924
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#190⤵PID:2104
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#191⤵PID:116
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#192⤵PID:232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#193⤵PID:4428
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#194⤵PID:3228
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#195⤵PID:904
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#196⤵PID:1244
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#197⤵PID:4716
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#198⤵PID:2756
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#199⤵PID:4968
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#1100⤵PID:2200
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#1101⤵PID:1972
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#1102⤵PID:5132
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#1103⤵PID:5152
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#1104⤵PID:5176
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#1105⤵PID:5188
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#1106⤵PID:5204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#1107⤵PID:5220
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#1108⤵PID:5236
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#1109⤵PID:5252
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#1110⤵PID:5264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#1111⤵PID:5284
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#1112⤵PID:5300
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#1113⤵PID:5312
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#1114⤵PID:5332
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#1115⤵PID:5348
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#1116⤵PID:5360
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#1117⤵PID:5388
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#1118⤵PID:5408
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#1119⤵PID:5428
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#1120⤵PID:5444
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#1121⤵PID:5456
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\706ce36e04d1313881e7a2a993a90994_JaffaCakes118.dll,#1122⤵PID:5472
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-