Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
51s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24/06/2024, 07:54
Static task
static1
Behavioral task
behavioral1
Sample
074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll
-
Size
34KB
-
MD5
074ccfbe57af087ef3fa8263e0e75a11
-
SHA1
9d3045f6f60ac0293e1bf3400253ef7352d0497e
-
SHA256
c0deb0467571a78e0f04512d191ebafcd12a9dd2592ff1bac24ead88dec640a4
-
SHA512
e189ae51e267552c5f3cd6438e73da99a0f62b091378d3f648e85452c127f5930584429d496564ea0d5b6bffd9517cb904097206040098400df14147fbed02d4
-
SSDEEP
768:vEWxQAkJg+wUQ74zmS8pk/sAq7IImTW6uJfljwu1j:MWeEGQ7ymSOapqnhJNjwi
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4608 wrote to memory of 4816 4608 rundll32.exe 81 PID 4608 wrote to memory of 4816 4608 rundll32.exe 81 PID 4608 wrote to memory of 4816 4608 rundll32.exe 81 PID 4816 wrote to memory of 1740 4816 rundll32.exe 82 PID 4816 wrote to memory of 1740 4816 rundll32.exe 82 PID 4816 wrote to memory of 1740 4816 rundll32.exe 82 PID 1740 wrote to memory of 4964 1740 rundll32.exe 83 PID 1740 wrote to memory of 4964 1740 rundll32.exe 83 PID 1740 wrote to memory of 4964 1740 rundll32.exe 83 PID 4964 wrote to memory of 1080 4964 rundll32.exe 84 PID 4964 wrote to memory of 1080 4964 rundll32.exe 84 PID 4964 wrote to memory of 1080 4964 rundll32.exe 84 PID 1080 wrote to memory of 2100 1080 rundll32.exe 85 PID 1080 wrote to memory of 2100 1080 rundll32.exe 85 PID 1080 wrote to memory of 2100 1080 rundll32.exe 85 PID 2100 wrote to memory of 3712 2100 rundll32.exe 86 PID 2100 wrote to memory of 3712 2100 rundll32.exe 86 PID 2100 wrote to memory of 3712 2100 rundll32.exe 86 PID 3712 wrote to memory of 2648 3712 rundll32.exe 87 PID 3712 wrote to memory of 2648 3712 rundll32.exe 87 PID 3712 wrote to memory of 2648 3712 rundll32.exe 87 PID 2648 wrote to memory of 3344 2648 rundll32.exe 88 PID 2648 wrote to memory of 3344 2648 rundll32.exe 88 PID 2648 wrote to memory of 3344 2648 rundll32.exe 88 PID 3344 wrote to memory of 2680 3344 rundll32.exe 89 PID 3344 wrote to memory of 2680 3344 rundll32.exe 89 PID 3344 wrote to memory of 2680 3344 rundll32.exe 89 PID 2680 wrote to memory of 4644 2680 rundll32.exe 90 PID 2680 wrote to memory of 4644 2680 rundll32.exe 90 PID 2680 wrote to memory of 4644 2680 rundll32.exe 90 PID 4644 wrote to memory of 1636 4644 rundll32.exe 91 PID 4644 wrote to memory of 1636 4644 rundll32.exe 91 PID 4644 wrote to memory of 1636 4644 rundll32.exe 91 PID 1636 wrote to memory of 3360 1636 rundll32.exe 92 PID 1636 wrote to memory of 3360 1636 rundll32.exe 92 PID 1636 wrote to memory of 3360 1636 rundll32.exe 92 PID 3360 wrote to memory of 4296 3360 rundll32.exe 93 PID 3360 wrote to memory of 4296 3360 rundll32.exe 93 PID 3360 wrote to memory of 4296 3360 rundll32.exe 93 PID 4296 wrote to memory of 2096 4296 rundll32.exe 94 PID 4296 wrote to memory of 2096 4296 rundll32.exe 94 PID 4296 wrote to memory of 2096 4296 rundll32.exe 94 PID 2096 wrote to memory of 1612 2096 rundll32.exe 95 PID 2096 wrote to memory of 1612 2096 rundll32.exe 95 PID 2096 wrote to memory of 1612 2096 rundll32.exe 95 PID 1612 wrote to memory of 372 1612 rundll32.exe 96 PID 1612 wrote to memory of 372 1612 rundll32.exe 96 PID 1612 wrote to memory of 372 1612 rundll32.exe 96 PID 372 wrote to memory of 1152 372 rundll32.exe 97 PID 372 wrote to memory of 1152 372 rundll32.exe 97 PID 372 wrote to memory of 1152 372 rundll32.exe 97 PID 1152 wrote to memory of 3436 1152 rundll32.exe 98 PID 1152 wrote to memory of 3436 1152 rundll32.exe 98 PID 1152 wrote to memory of 3436 1152 rundll32.exe 98 PID 3436 wrote to memory of 1552 3436 rundll32.exe 99 PID 3436 wrote to memory of 1552 3436 rundll32.exe 99 PID 3436 wrote to memory of 1552 3436 rundll32.exe 99 PID 1552 wrote to memory of 3220 1552 rundll32.exe 100 PID 1552 wrote to memory of 3220 1552 rundll32.exe 100 PID 1552 wrote to memory of 3220 1552 rundll32.exe 100 PID 3220 wrote to memory of 880 3220 rundll32.exe 101 PID 3220 wrote to memory of 880 3220 rundll32.exe 101 PID 3220 wrote to memory of 880 3220 rundll32.exe 101 PID 880 wrote to memory of 3148 880 rundll32.exe 102
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#123⤵PID:3148
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#124⤵PID:4456
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#125⤵PID:3008
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#126⤵PID:1404
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#127⤵PID:2676
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#128⤵PID:1728
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#129⤵PID:2152
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#130⤵PID:4940
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#131⤵PID:4728
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#132⤵PID:4236
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#133⤵PID:2092
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#134⤵PID:1380
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#135⤵PID:2732
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#136⤵PID:1224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#137⤵PID:3056
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#138⤵PID:2464
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#139⤵PID:2044
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#140⤵PID:544
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#141⤵PID:3944
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#142⤵PID:3064
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#143⤵PID:5008
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#144⤵PID:4596
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#145⤵PID:4848
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#146⤵PID:2180
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#147⤵PID:2604
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#148⤵PID:2116
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#149⤵PID:1300
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#150⤵PID:2812
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#151⤵PID:3688
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#152⤵PID:60
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#153⤵PID:1416
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#154⤵PID:2492
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#155⤵PID:5044
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#156⤵PID:3732
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#157⤵PID:4320
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#158⤵PID:4188
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#159⤵PID:516
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#160⤵PID:932
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#161⤵PID:2600
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#162⤵PID:4492
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#163⤵PID:1608
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#164⤵PID:4748
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#165⤵PID:2392
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#166⤵PID:2980
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#167⤵PID:848
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#168⤵PID:2684
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#169⤵PID:2952
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#170⤵PID:4524
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#171⤵PID:3588
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#172⤵PID:2172
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#173⤵PID:3464
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#174⤵PID:3756
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#175⤵PID:1272
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#176⤵PID:3084
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#177⤵PID:1180
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#178⤵PID:2316
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#179⤵PID:652
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#180⤵PID:3348
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#181⤵PID:1644
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#182⤵PID:2808
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#183⤵PID:4544
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#184⤵PID:1796
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#185⤵PID:1828
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#186⤵PID:4684
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#187⤵PID:3748
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#188⤵PID:3248
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#189⤵PID:2692
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#190⤵PID:2240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#191⤵PID:664
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#192⤵PID:768
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#193⤵PID:3952
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#194⤵PID:3232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#195⤵PID:3024
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#196⤵PID:3308
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#197⤵PID:972
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#198⤵PID:1488
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#199⤵PID:2624
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#1100⤵PID:2144
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#1101⤵PID:1988
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#1102⤵PID:3620
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#1103⤵PID:4004
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#1104⤵PID:4168
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#1105⤵PID:5032
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#1106⤵PID:3000
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#1107⤵PID:2320
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#1108⤵PID:2916
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#1109⤵PID:5040
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#1110⤵PID:4800
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#1111⤵PID:2688
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#1112⤵PID:1580
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#1113⤵PID:4876
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#1114⤵PID:3772
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#1115⤵PID:2460
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#1116⤵PID:4144
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#1117⤵PID:4752
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#1118⤵PID:1292
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#1119⤵PID:4068
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#1120⤵PID:2344
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#1121⤵PID:4272
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\074ccfbe57af087ef3fa8263e0e75a11_JaffaCakes118.dll,#1122⤵PID:4312
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-