Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 03:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll
Resource
win7-20240611-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll
-
Size
8KB
-
MD5
a3a2a21df0b7683d9828afad5489198e
-
SHA1
5c23c16f38a1db5718fd582441f5481159acd2d5
-
SHA256
49b7378f0698752ae2712eef82260c1e761948667c15e1a2f5349ca2115e8603
-
SHA512
d46b9637b32cf5e7564bdf761d89ceb0c30604a152e716158ae5bdf9de9773d4b604e5f21baea4e0c1f6a3ac4b0d09da2a42c1d18c66dce76a7a3e7facac36b7
-
SSDEEP
192:YBmutKqNrW2y877rdUQ4EDoPvgU/Hiq5VNZ7I94b:YgutjNJy8sED4IIiwnZ7I94b
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2644 wrote to memory of 4592 2644 rundll32.exe 82 PID 2644 wrote to memory of 4592 2644 rundll32.exe 82 PID 2644 wrote to memory of 4592 2644 rundll32.exe 82 PID 4592 wrote to memory of 1836 4592 rundll32.exe 83 PID 4592 wrote to memory of 1836 4592 rundll32.exe 83 PID 4592 wrote to memory of 1836 4592 rundll32.exe 83 PID 1836 wrote to memory of 1004 1836 rundll32.exe 84 PID 1836 wrote to memory of 1004 1836 rundll32.exe 84 PID 1836 wrote to memory of 1004 1836 rundll32.exe 84 PID 1004 wrote to memory of 1324 1004 rundll32.exe 85 PID 1004 wrote to memory of 1324 1004 rundll32.exe 85 PID 1004 wrote to memory of 1324 1004 rundll32.exe 85 PID 1324 wrote to memory of 3248 1324 rundll32.exe 86 PID 1324 wrote to memory of 3248 1324 rundll32.exe 86 PID 1324 wrote to memory of 3248 1324 rundll32.exe 86 PID 3248 wrote to memory of 2904 3248 rundll32.exe 87 PID 3248 wrote to memory of 2904 3248 rundll32.exe 87 PID 3248 wrote to memory of 2904 3248 rundll32.exe 87 PID 2904 wrote to memory of 2712 2904 rundll32.exe 88 PID 2904 wrote to memory of 2712 2904 rundll32.exe 88 PID 2904 wrote to memory of 2712 2904 rundll32.exe 88 PID 2712 wrote to memory of 2528 2712 rundll32.exe 89 PID 2712 wrote to memory of 2528 2712 rundll32.exe 89 PID 2712 wrote to memory of 2528 2712 rundll32.exe 89 PID 2528 wrote to memory of 4392 2528 rundll32.exe 90 PID 2528 wrote to memory of 4392 2528 rundll32.exe 90 PID 2528 wrote to memory of 4392 2528 rundll32.exe 90 PID 4392 wrote to memory of 2408 4392 rundll32.exe 91 PID 4392 wrote to memory of 2408 4392 rundll32.exe 91 PID 4392 wrote to memory of 2408 4392 rundll32.exe 91 PID 2408 wrote to memory of 1100 2408 rundll32.exe 92 PID 2408 wrote to memory of 1100 2408 rundll32.exe 92 PID 2408 wrote to memory of 1100 2408 rundll32.exe 92 PID 1100 wrote to memory of 4996 1100 rundll32.exe 93 PID 1100 wrote to memory of 4996 1100 rundll32.exe 93 PID 1100 wrote to memory of 4996 1100 rundll32.exe 93 PID 4996 wrote to memory of 4920 4996 rundll32.exe 94 PID 4996 wrote to memory of 4920 4996 rundll32.exe 94 PID 4996 wrote to memory of 4920 4996 rundll32.exe 94 PID 4920 wrote to memory of 5096 4920 rundll32.exe 95 PID 4920 wrote to memory of 5096 4920 rundll32.exe 95 PID 4920 wrote to memory of 5096 4920 rundll32.exe 95 PID 5096 wrote to memory of 2112 5096 rundll32.exe 97 PID 5096 wrote to memory of 2112 5096 rundll32.exe 97 PID 5096 wrote to memory of 2112 5096 rundll32.exe 97 PID 2112 wrote to memory of 4560 2112 rundll32.exe 98 PID 2112 wrote to memory of 4560 2112 rundll32.exe 98 PID 2112 wrote to memory of 4560 2112 rundll32.exe 98 PID 4560 wrote to memory of 3988 4560 rundll32.exe 99 PID 4560 wrote to memory of 3988 4560 rundll32.exe 99 PID 4560 wrote to memory of 3988 4560 rundll32.exe 99 PID 3988 wrote to memory of 1360 3988 rundll32.exe 100 PID 3988 wrote to memory of 1360 3988 rundll32.exe 100 PID 3988 wrote to memory of 1360 3988 rundll32.exe 100 PID 1360 wrote to memory of 3272 1360 rundll32.exe 101 PID 1360 wrote to memory of 3272 1360 rundll32.exe 101 PID 1360 wrote to memory of 3272 1360 rundll32.exe 101 PID 3272 wrote to memory of 1948 3272 rundll32.exe 102 PID 3272 wrote to memory of 1948 3272 rundll32.exe 102 PID 3272 wrote to memory of 1948 3272 rundll32.exe 102 PID 1948 wrote to memory of 1940 1948 rundll32.exe 103 PID 1948 wrote to memory of 1940 1948 rundll32.exe 103 PID 1948 wrote to memory of 1940 1948 rundll32.exe 103 PID 1940 wrote to memory of 1412 1940 rundll32.exe 104
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#123⤵PID:1412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#124⤵PID:1332
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#125⤵PID:2264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#126⤵PID:2192
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#127⤵PID:184
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#128⤵PID:4584
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#129⤵PID:2360
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#130⤵PID:1208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#131⤵PID:3756
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#132⤵PID:1908
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#133⤵PID:4076
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#134⤵PID:1968
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#135⤵PID:3320
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#136⤵PID:4836
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#137⤵PID:1692
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#138⤵PID:1548
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#139⤵PID:856
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#140⤵PID:3600
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#141⤵PID:1336
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#142⤵PID:1236
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#143⤵PID:1576
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#144⤵PID:964
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#145⤵PID:3564
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#146⤵PID:4892
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#147⤵PID:5088
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#148⤵PID:3016
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#149⤵PID:1872
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#150⤵PID:2924
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#151⤵PID:1728
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#152⤵PID:3260
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#153⤵PID:2960
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#154⤵PID:1040
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#155⤵PID:5020
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#156⤵PID:5004
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#157⤵PID:3180
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#158⤵PID:1580
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#159⤵PID:4136
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#160⤵PID:400
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#161⤵PID:3904
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#162⤵PID:2636
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#163⤵PID:2300
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#164⤵PID:4072
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#165⤵PID:820
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#166⤵PID:2684
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#167⤵PID:1388
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#168⤵PID:2628
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#169⤵PID:2536
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#170⤵PID:3360
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#171⤵PID:3312
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#172⤵PID:4184
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#173⤵PID:3792
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#174⤵PID:3976
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#175⤵PID:4604
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#176⤵PID:3160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#177⤵PID:3800
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#178⤵PID:3472
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#179⤵PID:3504
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#180⤵PID:3956
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#181⤵PID:3204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#182⤵PID:4332
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#183⤵PID:3952
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#184⤵PID:3720
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#185⤵PID:4476
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#186⤵PID:404
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#187⤵PID:672
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#188⤵PID:3644
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#189⤵PID:3464
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#190⤵PID:3536
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#191⤵PID:1544
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#192⤵PID:1488
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#193⤵PID:1464
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#194⤵PID:3768
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#195⤵PID:2888
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#196⤵PID:2136
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#197⤵PID:1724
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#198⤵PID:2656
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#199⤵PID:432
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#1100⤵PID:3268
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#1101⤵PID:4404
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#1102⤵PID:1164
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#1103⤵PID:4248
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#1104⤵PID:2668
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#1105⤵PID:4196
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#1106⤵PID:3912
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#1107⤵PID:1652
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#1108⤵PID:5028
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#1109⤵PID:2020
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#1110⤵PID:5124
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#1111⤵PID:5140
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#1112⤵PID:5156
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#1113⤵PID:5172
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#1114⤵PID:5188
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#1115⤵PID:5204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#1116⤵PID:5224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#1117⤵PID:5240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#1118⤵PID:5256
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#1119⤵PID:5272
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#1120⤵PID:5288
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#1121⤵PID:5300
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a2a21df0b7683d9828afad5489198e_JaffaCakes118.dll,#1122⤵PID:5312
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-