Analysis
-
max time kernel
140s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
24-06-2024 00:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll
-
Size
78KB
-
MD5
063a1f172d1dd1ad63bd39b1b67b9de0
-
SHA1
62c9dd4c1bf880f05b1ff6705a74408b2e6137e8
-
SHA256
c3ce897ba19ba4e51899a636c44a54b8045df25410dc7b22a8a1167b9202db7b
-
SHA512
2d05005d276ff67ce422b297638b61258cd3587e02796b6d3cb4df9651eb4c096f0ba4525bae79525ac27c42be7179a36b3c6db71713515a549d3bfe147705d4
-
SSDEEP
1536:epDF/FbUc7SvexVqCGoKlC2igBQItEABnqF05ZquJLnQdpL:a3bTSvedGoKlCDgBwGqG5Z/UpL
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4112 wrote to memory of 488 4112 rundll32.exe 86 PID 4112 wrote to memory of 488 4112 rundll32.exe 86 PID 4112 wrote to memory of 488 4112 rundll32.exe 86 PID 488 wrote to memory of 1328 488 rundll32.exe 87 PID 488 wrote to memory of 1328 488 rundll32.exe 87 PID 488 wrote to memory of 1328 488 rundll32.exe 87 PID 1328 wrote to memory of 2396 1328 rundll32.exe 88 PID 1328 wrote to memory of 2396 1328 rundll32.exe 88 PID 1328 wrote to memory of 2396 1328 rundll32.exe 88 PID 2396 wrote to memory of 1168 2396 rundll32.exe 89 PID 2396 wrote to memory of 1168 2396 rundll32.exe 89 PID 2396 wrote to memory of 1168 2396 rundll32.exe 89 PID 1168 wrote to memory of 1576 1168 rundll32.exe 90 PID 1168 wrote to memory of 1576 1168 rundll32.exe 90 PID 1168 wrote to memory of 1576 1168 rundll32.exe 90 PID 1576 wrote to memory of 2232 1576 rundll32.exe 91 PID 1576 wrote to memory of 2232 1576 rundll32.exe 91 PID 1576 wrote to memory of 2232 1576 rundll32.exe 91 PID 2232 wrote to memory of 2876 2232 rundll32.exe 92 PID 2232 wrote to memory of 2876 2232 rundll32.exe 92 PID 2232 wrote to memory of 2876 2232 rundll32.exe 92 PID 2876 wrote to memory of 3020 2876 rundll32.exe 93 PID 2876 wrote to memory of 3020 2876 rundll32.exe 93 PID 2876 wrote to memory of 3020 2876 rundll32.exe 93 PID 3020 wrote to memory of 2996 3020 rundll32.exe 94 PID 3020 wrote to memory of 2996 3020 rundll32.exe 94 PID 3020 wrote to memory of 2996 3020 rundll32.exe 94 PID 2996 wrote to memory of 208 2996 rundll32.exe 95 PID 2996 wrote to memory of 208 2996 rundll32.exe 95 PID 2996 wrote to memory of 208 2996 rundll32.exe 95 PID 208 wrote to memory of 4696 208 rundll32.exe 96 PID 208 wrote to memory of 4696 208 rundll32.exe 96 PID 208 wrote to memory of 4696 208 rundll32.exe 96 PID 4696 wrote to memory of 4392 4696 rundll32.exe 97 PID 4696 wrote to memory of 4392 4696 rundll32.exe 97 PID 4696 wrote to memory of 4392 4696 rundll32.exe 97 PID 4392 wrote to memory of 2008 4392 rundll32.exe 98 PID 4392 wrote to memory of 2008 4392 rundll32.exe 98 PID 4392 wrote to memory of 2008 4392 rundll32.exe 98 PID 2008 wrote to memory of 4032 2008 rundll32.exe 99 PID 2008 wrote to memory of 4032 2008 rundll32.exe 99 PID 2008 wrote to memory of 4032 2008 rundll32.exe 99 PID 4032 wrote to memory of 4248 4032 rundll32.exe 100 PID 4032 wrote to memory of 4248 4032 rundll32.exe 100 PID 4032 wrote to memory of 4248 4032 rundll32.exe 100 PID 4248 wrote to memory of 4472 4248 rundll32.exe 101 PID 4248 wrote to memory of 4472 4248 rundll32.exe 101 PID 4248 wrote to memory of 4472 4248 rundll32.exe 101 PID 4472 wrote to memory of 1840 4472 rundll32.exe 102 PID 4472 wrote to memory of 1840 4472 rundll32.exe 102 PID 4472 wrote to memory of 1840 4472 rundll32.exe 102 PID 1840 wrote to memory of 4760 1840 rundll32.exe 103 PID 1840 wrote to memory of 4760 1840 rundll32.exe 103 PID 1840 wrote to memory of 4760 1840 rundll32.exe 103 PID 4760 wrote to memory of 4388 4760 rundll32.exe 104 PID 4760 wrote to memory of 4388 4760 rundll32.exe 104 PID 4760 wrote to memory of 4388 4760 rundll32.exe 104 PID 4388 wrote to memory of 2036 4388 rundll32.exe 105 PID 4388 wrote to memory of 2036 4388 rundll32.exe 105 PID 4388 wrote to memory of 2036 4388 rundll32.exe 105 PID 2036 wrote to memory of 3716 2036 rundll32.exe 106 PID 2036 wrote to memory of 3716 2036 rundll32.exe 106 PID 2036 wrote to memory of 3716 2036 rundll32.exe 106 PID 3716 wrote to memory of 4008 3716 rundll32.exe 107
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:488 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#123⤵PID:4008
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#124⤵PID:1948
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#125⤵PID:3140
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#126⤵PID:5104
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#127⤵PID:1320
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#128⤵PID:2356
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#129⤵PID:2892
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#130⤵PID:1788
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#131⤵PID:3360
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#132⤵PID:4620
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#133⤵PID:3424
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#134⤵PID:660
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#135⤵PID:5072
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#136⤵PID:5076
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#137⤵PID:2004
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#138⤵PID:3572
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#139⤵PID:1420
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#140⤵PID:3720
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#141⤵PID:4796
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#142⤵PID:2452
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#143⤵PID:3996
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#144⤵PID:1156
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#145⤵PID:2020
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#146⤵PID:5084
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#147⤵PID:1824
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#148⤵PID:3344
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#149⤵PID:3488
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#150⤵PID:2908
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#151⤵PID:1196
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#152⤵PID:4512
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#153⤵PID:3676
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#154⤵PID:440
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#155⤵PID:4784
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#156⤵PID:3268
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#157⤵PID:3884
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#158⤵PID:64
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#159⤵PID:2228
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#160⤵PID:1192
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#161⤵PID:4700
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#162⤵PID:1480
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#163⤵PID:1204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#164⤵PID:1636
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#165⤵PID:4736
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#166⤵PID:4660
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#167⤵PID:3060
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#168⤵PID:4844
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#169⤵PID:3800
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#170⤵PID:1740
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#171⤵PID:4536
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#172⤵PID:1596
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#173⤵PID:2384
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#174⤵PID:3724
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#175⤵PID:3436
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#176⤵PID:2820
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#177⤵PID:3740
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#178⤵PID:2212
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#179⤵PID:4752
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#180⤵PID:4064
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#181⤵PID:3900
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#182⤵PID:4220
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#183⤵PID:3524
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#184⤵PID:4228
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#185⤵PID:4540
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#186⤵PID:4216
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#187⤵PID:3332
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#188⤵PID:1072
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#189⤵PID:2976
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#190⤵PID:2104
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#191⤵PID:3152
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#192⤵PID:2024
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#193⤵PID:5136
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#194⤵PID:5160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#195⤵PID:5176
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#196⤵PID:5196
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#197⤵PID:5208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#198⤵PID:5224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#199⤵PID:5240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#1100⤵PID:5256
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#1101⤵PID:5276
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#1102⤵PID:5288
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#1103⤵PID:5308
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#1104⤵PID:5328
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#1105⤵PID:5340
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#1106⤵PID:5356
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#1107⤵PID:5372
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#1108⤵PID:5388
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#1109⤵PID:5428
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#1110⤵PID:5464
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#1111⤵PID:5476
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#1112⤵PID:5492
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#1113⤵PID:5508
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#1114⤵PID:5524
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#1115⤵PID:5548
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#1116⤵PID:5564
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#1117⤵PID:5576
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#1118⤵PID:5588
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#1119⤵PID:5604
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#1120⤵PID:5620
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#1121⤵PID:5632
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1f172d1dd1ad63bd39b1b67b9de0_JaffaCakes118.dll,#1122⤵PID:5652
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-