Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 19:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7692a8e2861cebd69a997088753470da_JaffaCakes118.dll
Resource
win7-20240215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
7692a8e2861cebd69a997088753470da_JaffaCakes118.dll
Resource
win10v2004-20240426-en
1 signatures
150 seconds
General
-
Target
7692a8e2861cebd69a997088753470da_JaffaCakes118.dll
-
Size
240KB
-
MD5
7692a8e2861cebd69a997088753470da
-
SHA1
ca8f8f966e5fa5c2c4f79e04131a56c15652be6d
-
SHA256
4093d9e7ade87f8deb3585870f9748350c0181fdde14164c0c6b3cc7bbb7b141
-
SHA512
3834bd5733ef4c8c42aad75e320fdacf41adc72f558957a15c880bb22ef6957ec36959e02b59c10b6b2905c12af5fac9c4853a0b13c8732a89e5a7b845a5b853
-
SSDEEP
6144:KnOry/ad24pzTq5DtIomp2qUjE25W50Uk:KnOW/ahpKQ2qD25WPk
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2720 wrote to memory of 848 2720 rundll32.exe 81 PID 2720 wrote to memory of 848 2720 rundll32.exe 81 PID 2720 wrote to memory of 848 2720 rundll32.exe 81 PID 848 wrote to memory of 460 848 rundll32.exe 82 PID 848 wrote to memory of 460 848 rundll32.exe 82 PID 848 wrote to memory of 460 848 rundll32.exe 82 PID 460 wrote to memory of 3980 460 rundll32.exe 83 PID 460 wrote to memory of 3980 460 rundll32.exe 83 PID 460 wrote to memory of 3980 460 rundll32.exe 83 PID 3980 wrote to memory of 2832 3980 rundll32.exe 84 PID 3980 wrote to memory of 2832 3980 rundll32.exe 84 PID 3980 wrote to memory of 2832 3980 rundll32.exe 84 PID 2832 wrote to memory of 3696 2832 rundll32.exe 85 PID 2832 wrote to memory of 3696 2832 rundll32.exe 85 PID 2832 wrote to memory of 3696 2832 rundll32.exe 85 PID 3696 wrote to memory of 3052 3696 rundll32.exe 86 PID 3696 wrote to memory of 3052 3696 rundll32.exe 86 PID 3696 wrote to memory of 3052 3696 rundll32.exe 86 PID 3052 wrote to memory of 4352 3052 rundll32.exe 87 PID 3052 wrote to memory of 4352 3052 rundll32.exe 87 PID 3052 wrote to memory of 4352 3052 rundll32.exe 87 PID 4352 wrote to memory of 2388 4352 rundll32.exe 88 PID 4352 wrote to memory of 2388 4352 rundll32.exe 88 PID 4352 wrote to memory of 2388 4352 rundll32.exe 88 PID 2388 wrote to memory of 4244 2388 rundll32.exe 89 PID 2388 wrote to memory of 4244 2388 rundll32.exe 89 PID 2388 wrote to memory of 4244 2388 rundll32.exe 89 PID 4244 wrote to memory of 1748 4244 rundll32.exe 90 PID 4244 wrote to memory of 1748 4244 rundll32.exe 90 PID 4244 wrote to memory of 1748 4244 rundll32.exe 90 PID 1748 wrote to memory of 1524 1748 rundll32.exe 91 PID 1748 wrote to memory of 1524 1748 rundll32.exe 91 PID 1748 wrote to memory of 1524 1748 rundll32.exe 91 PID 1524 wrote to memory of 2964 1524 rundll32.exe 92 PID 1524 wrote to memory of 2964 1524 rundll32.exe 92 PID 1524 wrote to memory of 2964 1524 rundll32.exe 92 PID 2964 wrote to memory of 1732 2964 rundll32.exe 93 PID 2964 wrote to memory of 1732 2964 rundll32.exe 93 PID 2964 wrote to memory of 1732 2964 rundll32.exe 93 PID 1732 wrote to memory of 944 1732 rundll32.exe 94 PID 1732 wrote to memory of 944 1732 rundll32.exe 94 PID 1732 wrote to memory of 944 1732 rundll32.exe 94 PID 944 wrote to memory of 2672 944 rundll32.exe 95 PID 944 wrote to memory of 2672 944 rundll32.exe 95 PID 944 wrote to memory of 2672 944 rundll32.exe 95 PID 2672 wrote to memory of 772 2672 rundll32.exe 96 PID 2672 wrote to memory of 772 2672 rundll32.exe 96 PID 2672 wrote to memory of 772 2672 rundll32.exe 96 PID 772 wrote to memory of 3880 772 rundll32.exe 97 PID 772 wrote to memory of 3880 772 rundll32.exe 97 PID 772 wrote to memory of 3880 772 rundll32.exe 97 PID 3880 wrote to memory of 1424 3880 rundll32.exe 98 PID 3880 wrote to memory of 1424 3880 rundll32.exe 98 PID 3880 wrote to memory of 1424 3880 rundll32.exe 98 PID 1424 wrote to memory of 3724 1424 rundll32.exe 99 PID 1424 wrote to memory of 3724 1424 rundll32.exe 99 PID 1424 wrote to memory of 3724 1424 rundll32.exe 99 PID 3724 wrote to memory of 4488 3724 rundll32.exe 100 PID 3724 wrote to memory of 4488 3724 rundll32.exe 100 PID 3724 wrote to memory of 4488 3724 rundll32.exe 100 PID 4488 wrote to memory of 1228 4488 rundll32.exe 101 PID 4488 wrote to memory of 1228 4488 rundll32.exe 101 PID 4488 wrote to memory of 1228 4488 rundll32.exe 101 PID 1228 wrote to memory of 1112 1228 rundll32.exe 102
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#123⤵PID:1112
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#124⤵PID:1972
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#125⤵PID:3772
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#126⤵PID:3664
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#127⤵PID:3248
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#128⤵PID:404
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#129⤵PID:748
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#130⤵PID:1940
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#131⤵PID:1236
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#132⤵PID:1332
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#133⤵PID:2816
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#134⤵PID:3984
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#135⤵PID:3692
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#136⤵PID:3444
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#137⤵PID:3652
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#138⤵PID:4476
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#139⤵PID:980
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#140⤵PID:4564
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#141⤵PID:3576
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#142⤵PID:3412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#143⤵PID:3084
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#144⤵PID:568
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#145⤵PID:5088
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#146⤵PID:2148
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#147⤵PID:2392
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#148⤵PID:4364
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#149⤵PID:620
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#150⤵PID:5060
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#151⤵PID:2940
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#152⤵PID:3580
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#153⤵PID:1404
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#154⤵PID:4108
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#155⤵PID:1664
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#156⤵PID:2468
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#157⤵PID:1784
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#158⤵PID:4916
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#159⤵PID:1348
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#160⤵PID:4940
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#161⤵PID:1160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#162⤵PID:812
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#163⤵PID:2332
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#164⤵PID:2752
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#165⤵PID:4528
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#166⤵PID:3448
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#167⤵PID:4760
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#168⤵PID:4672
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#169⤵PID:1984
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#170⤵PID:4584
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#171⤵PID:3892
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#172⤵PID:2328
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#173⤵PID:3864
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#174⤵PID:2600
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#175⤵PID:4700
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#176⤵PID:2608
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#177⤵PID:3256
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#178⤵PID:3820
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#179⤵PID:1492
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#180⤵PID:3680
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#181⤵PID:4164
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#182⤵PID:2528
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#183⤵PID:1224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#184⤵PID:4296
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#185⤵PID:1432
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#186⤵PID:1476
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#187⤵PID:4088
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#188⤵PID:3480
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#189⤵PID:1048
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#190⤵PID:720
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#191⤵PID:3832
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#192⤵PID:4484
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#193⤵PID:3876
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#194⤵PID:4804
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#195⤵PID:4636
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#196⤵PID:1244
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#197⤵PID:1996
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#198⤵PID:1416
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#199⤵PID:2132
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#1100⤵PID:4416
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#1101⤵PID:4392
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#1102⤵PID:1672
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#1103⤵PID:4936
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#1104⤵PID:4808
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#1105⤵PID:1728
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#1106⤵PID:444
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#1107⤵PID:3908
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#1108⤵PID:1172
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#1109⤵PID:5132
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#1110⤵PID:5144
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#1111⤵PID:5156
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#1112⤵PID:5172
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#1113⤵PID:5192
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#1114⤵PID:5208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#1115⤵PID:5224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#1116⤵PID:5236
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#1117⤵PID:5256
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#1118⤵PID:5272
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#1119⤵PID:5288
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#1120⤵PID:5300
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#1121⤵PID:5320
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7692a8e2861cebd69a997088753470da_JaffaCakes118.dll,#1122⤵PID:5340
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-