Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
24/06/2024, 17:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll
Resource
win7-20240220-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll
Resource
win10v2004-20240611-en
2 signatures
150 seconds
General
-
Target
09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll
-
Size
16KB
-
MD5
09ed20538607db375b470d5fff9909e4
-
SHA1
1fbc9924449c65871979c980f0a4b66f27240885
-
SHA256
dc0688b054c8a9c7a8fc31a1eea0ece03b9db8557a7cb1a0f0336dd34bd6e73c
-
SHA512
651556a9af5c12a18c2393f5d7a3e974439373816dcf666e9a9d1f276be20f33e9a8e60e26e619ab6dc1ba378bd8d66822348cd085bcac0bbf16161481964b68
-
SSDEEP
192://IZyT2Gf9LUF37cliayL69ifa+s/OVkX+CG1f6S4R6xIFjV:/gLGfm6vwFs2VkuNBLIFB
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 17456 3540 WerFault.exe 980 -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4904 wrote to memory of 1500 4904 rundll32.exe 84 PID 4904 wrote to memory of 1500 4904 rundll32.exe 84 PID 4904 wrote to memory of 1500 4904 rundll32.exe 84 PID 1500 wrote to memory of 1560 1500 rundll32.exe 85 PID 1500 wrote to memory of 1560 1500 rundll32.exe 85 PID 1500 wrote to memory of 1560 1500 rundll32.exe 85 PID 1560 wrote to memory of 3308 1560 rundll32.exe 86 PID 1560 wrote to memory of 3308 1560 rundll32.exe 86 PID 1560 wrote to memory of 3308 1560 rundll32.exe 86 PID 3308 wrote to memory of 5660 3308 rundll32.exe 87 PID 3308 wrote to memory of 5660 3308 rundll32.exe 87 PID 3308 wrote to memory of 5660 3308 rundll32.exe 87 PID 5660 wrote to memory of 5404 5660 rundll32.exe 88 PID 5660 wrote to memory of 5404 5660 rundll32.exe 88 PID 5660 wrote to memory of 5404 5660 rundll32.exe 88 PID 5404 wrote to memory of 1492 5404 rundll32.exe 89 PID 5404 wrote to memory of 1492 5404 rundll32.exe 89 PID 5404 wrote to memory of 1492 5404 rundll32.exe 89 PID 1492 wrote to memory of 376 1492 rundll32.exe 90 PID 1492 wrote to memory of 376 1492 rundll32.exe 90 PID 1492 wrote to memory of 376 1492 rundll32.exe 90 PID 376 wrote to memory of 1616 376 rundll32.exe 91 PID 376 wrote to memory of 1616 376 rundll32.exe 91 PID 376 wrote to memory of 1616 376 rundll32.exe 91 PID 1616 wrote to memory of 2916 1616 rundll32.exe 92 PID 1616 wrote to memory of 2916 1616 rundll32.exe 92 PID 1616 wrote to memory of 2916 1616 rundll32.exe 92 PID 2916 wrote to memory of 1372 2916 rundll32.exe 93 PID 2916 wrote to memory of 1372 2916 rundll32.exe 93 PID 2916 wrote to memory of 1372 2916 rundll32.exe 93 PID 1372 wrote to memory of 3204 1372 rundll32.exe 94 PID 1372 wrote to memory of 3204 1372 rundll32.exe 94 PID 1372 wrote to memory of 3204 1372 rundll32.exe 94 PID 3204 wrote to memory of 5672 3204 rundll32.exe 95 PID 3204 wrote to memory of 5672 3204 rundll32.exe 95 PID 3204 wrote to memory of 5672 3204 rundll32.exe 95 PID 5672 wrote to memory of 4344 5672 rundll32.exe 96 PID 5672 wrote to memory of 4344 5672 rundll32.exe 96 PID 5672 wrote to memory of 4344 5672 rundll32.exe 96 PID 4344 wrote to memory of 4952 4344 rundll32.exe 97 PID 4344 wrote to memory of 4952 4344 rundll32.exe 97 PID 4344 wrote to memory of 4952 4344 rundll32.exe 97 PID 4952 wrote to memory of 764 4952 rundll32.exe 98 PID 4952 wrote to memory of 764 4952 rundll32.exe 98 PID 4952 wrote to memory of 764 4952 rundll32.exe 98 PID 764 wrote to memory of 4860 764 rundll32.exe 99 PID 764 wrote to memory of 4860 764 rundll32.exe 99 PID 764 wrote to memory of 4860 764 rundll32.exe 99 PID 4860 wrote to memory of 2948 4860 rundll32.exe 100 PID 4860 wrote to memory of 2948 4860 rundll32.exe 100 PID 4860 wrote to memory of 2948 4860 rundll32.exe 100 PID 2948 wrote to memory of 4292 2948 rundll32.exe 101 PID 2948 wrote to memory of 4292 2948 rundll32.exe 101 PID 2948 wrote to memory of 4292 2948 rundll32.exe 101 PID 4292 wrote to memory of 6140 4292 rundll32.exe 102 PID 4292 wrote to memory of 6140 4292 rundll32.exe 102 PID 4292 wrote to memory of 6140 4292 rundll32.exe 102 PID 6140 wrote to memory of 4284 6140 rundll32.exe 103 PID 6140 wrote to memory of 4284 6140 rundll32.exe 103 PID 6140 wrote to memory of 4284 6140 rundll32.exe 103 PID 4284 wrote to memory of 5736 4284 rundll32.exe 104 PID 4284 wrote to memory of 5736 4284 rundll32.exe 104 PID 4284 wrote to memory of 5736 4284 rundll32.exe 104 PID 5736 wrote to memory of 3036 5736 rundll32.exe 105
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#123⤵PID:3036
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#124⤵PID:532
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#125⤵PID:4764
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#126⤵PID:4772
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#127⤵PID:2560
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#128⤵PID:2868
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#129⤵PID:3992
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#130⤵PID:5392
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#131⤵PID:5052
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#132⤵PID:3196
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#133⤵PID:684
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#134⤵PID:2540
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#135⤵PID:5748
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#136⤵PID:5648
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#137⤵PID:2876
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#138⤵PID:4440
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#139⤵PID:4056
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#140⤵PID:2028
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#141⤵PID:4700
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#142⤵PID:5476
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#143⤵PID:4044
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#144⤵PID:3416
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#145⤵PID:2168
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#146⤵PID:5880
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#147⤵PID:4136
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#148⤵PID:4800
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#149⤵PID:5516
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#150⤵PID:432
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#151⤵PID:4796
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#152⤵PID:5556
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#153⤵PID:2040
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#154⤵PID:4048
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#155⤵PID:2248
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#156⤵PID:5788
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#157⤵PID:5816
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#158⤵PID:2404
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#159⤵PID:3496
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#160⤵PID:5196
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#161⤵PID:552
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#162⤵PID:1544
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#163⤵PID:468
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#164⤵PID:5704
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#165⤵PID:4536
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#166⤵PID:1108
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#167⤵PID:1996
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#168⤵PID:3168
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#169⤵PID:3296
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#170⤵PID:2496
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#171⤵PID:2260
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#172⤵PID:6012
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#173⤵PID:5984
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#174⤵PID:5224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#175⤵PID:1456
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#176⤵PID:5236
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#177⤵PID:5148
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#178⤵PID:956
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#179⤵PID:1672
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#180⤵PID:3940
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#181⤵PID:2296
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#182⤵PID:4564
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#183⤵PID:3040
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#184⤵PID:3688
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#185⤵PID:5276
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#186⤵PID:5068
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#187⤵PID:2864
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#188⤵PID:1864
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#189⤵PID:1668
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#190⤵PID:4480
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#191⤵PID:5988
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#192⤵PID:2368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#193⤵PID:2548
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#194⤵PID:1780
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#195⤵PID:1680
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#196⤵PID:4656
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#197⤵PID:4712
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#198⤵PID:5048
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#199⤵PID:6048
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#1100⤵PID:4936
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#1101⤵PID:2676
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#1102⤵PID:5872
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#1103⤵PID:5684
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#1104⤵PID:1504
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#1105⤵PID:3920
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#1106⤵PID:448
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#1107⤵PID:3116
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#1108⤵PID:3208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#1109⤵PID:1204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#1110⤵PID:3896
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#1111⤵PID:5840
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#1112⤵PID:3592
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#1113⤵PID:5256
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#1114⤵PID:2072
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#1115⤵PID:3064
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#1116⤵PID:5512
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#1117⤵PID:5768
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#1118⤵PID:1448
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#1119⤵PID:2848
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#1120⤵PID:2572
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#1121⤵PID:368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\09ed20538607db375b470d5fff9909e4_JaffaCakes118.dll,#1122⤵PID:3788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-