Analysis
-
max time kernel
51s -
max time network
54s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-06-2024 15:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll
-
Size
92KB
-
MD5
0ea987aec28cb06d1fcc2aa67e15da1e
-
SHA1
6e0cd216be0f38afa8dc8d8cff74b14890560e63
-
SHA256
a9b6c5ec8921643eae598108f0505b098bbeeb03cbff519279df20cd18b53148
-
SHA512
59905f039a016d2bb8df4b2a3e3d7eeeac33826fcf40b0768879bcec650c07426074b92e804d16648469c64cbaaf3fb6757b008a803847e411416da47b0613c5
-
SSDEEP
1536:lFDUIYkK4cEui1gNNx0eW6QPB/4ZW1ck8zHhTduu+qjIk9WkD2oHxzt0:7hYZ4z1sxtbjIUWnoRzm
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5040 wrote to memory of 216 5040 rundll32.exe 80 PID 5040 wrote to memory of 216 5040 rundll32.exe 80 PID 5040 wrote to memory of 216 5040 rundll32.exe 80 PID 216 wrote to memory of 2200 216 rundll32.exe 81 PID 216 wrote to memory of 2200 216 rundll32.exe 81 PID 216 wrote to memory of 2200 216 rundll32.exe 81 PID 2200 wrote to memory of 4832 2200 rundll32.exe 82 PID 2200 wrote to memory of 4832 2200 rundll32.exe 82 PID 2200 wrote to memory of 4832 2200 rundll32.exe 82 PID 4832 wrote to memory of 3448 4832 rundll32.exe 83 PID 4832 wrote to memory of 3448 4832 rundll32.exe 83 PID 4832 wrote to memory of 3448 4832 rundll32.exe 83 PID 3448 wrote to memory of 3900 3448 rundll32.exe 84 PID 3448 wrote to memory of 3900 3448 rundll32.exe 84 PID 3448 wrote to memory of 3900 3448 rundll32.exe 84 PID 3900 wrote to memory of 1280 3900 rundll32.exe 85 PID 3900 wrote to memory of 1280 3900 rundll32.exe 85 PID 3900 wrote to memory of 1280 3900 rundll32.exe 85 PID 1280 wrote to memory of 4500 1280 rundll32.exe 86 PID 1280 wrote to memory of 4500 1280 rundll32.exe 86 PID 1280 wrote to memory of 4500 1280 rundll32.exe 86 PID 4500 wrote to memory of 4888 4500 rundll32.exe 87 PID 4500 wrote to memory of 4888 4500 rundll32.exe 87 PID 4500 wrote to memory of 4888 4500 rundll32.exe 87 PID 4888 wrote to memory of 4068 4888 rundll32.exe 88 PID 4888 wrote to memory of 4068 4888 rundll32.exe 88 PID 4888 wrote to memory of 4068 4888 rundll32.exe 88 PID 4068 wrote to memory of 4160 4068 rundll32.exe 89 PID 4068 wrote to memory of 4160 4068 rundll32.exe 89 PID 4068 wrote to memory of 4160 4068 rundll32.exe 89 PID 4160 wrote to memory of 5016 4160 rundll32.exe 90 PID 4160 wrote to memory of 5016 4160 rundll32.exe 90 PID 4160 wrote to memory of 5016 4160 rundll32.exe 90 PID 5016 wrote to memory of 4848 5016 rundll32.exe 91 PID 5016 wrote to memory of 4848 5016 rundll32.exe 91 PID 5016 wrote to memory of 4848 5016 rundll32.exe 91 PID 4848 wrote to memory of 2240 4848 rundll32.exe 92 PID 4848 wrote to memory of 2240 4848 rundll32.exe 92 PID 4848 wrote to memory of 2240 4848 rundll32.exe 92 PID 2240 wrote to memory of 3432 2240 rundll32.exe 93 PID 2240 wrote to memory of 3432 2240 rundll32.exe 93 PID 2240 wrote to memory of 3432 2240 rundll32.exe 93 PID 3432 wrote to memory of 3880 3432 rundll32.exe 94 PID 3432 wrote to memory of 3880 3432 rundll32.exe 94 PID 3432 wrote to memory of 3880 3432 rundll32.exe 94 PID 3880 wrote to memory of 3424 3880 rundll32.exe 95 PID 3880 wrote to memory of 3424 3880 rundll32.exe 95 PID 3880 wrote to memory of 3424 3880 rundll32.exe 95 PID 3424 wrote to memory of 2108 3424 rundll32.exe 96 PID 3424 wrote to memory of 2108 3424 rundll32.exe 96 PID 3424 wrote to memory of 2108 3424 rundll32.exe 96 PID 2108 wrote to memory of 4584 2108 rundll32.exe 97 PID 2108 wrote to memory of 4584 2108 rundll32.exe 97 PID 2108 wrote to memory of 4584 2108 rundll32.exe 97 PID 4584 wrote to memory of 3412 4584 rundll32.exe 98 PID 4584 wrote to memory of 3412 4584 rundll32.exe 98 PID 4584 wrote to memory of 3412 4584 rundll32.exe 98 PID 3412 wrote to memory of 2804 3412 rundll32.exe 99 PID 3412 wrote to memory of 2804 3412 rundll32.exe 99 PID 3412 wrote to memory of 2804 3412 rundll32.exe 99 PID 2804 wrote to memory of 4808 2804 rundll32.exe 100 PID 2804 wrote to memory of 4808 2804 rundll32.exe 100 PID 2804 wrote to memory of 4808 2804 rundll32.exe 100 PID 4808 wrote to memory of 992 4808 rundll32.exe 101
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#123⤵PID:992
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#124⤵PID:1400
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#125⤵PID:3668
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#126⤵PID:4628
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#127⤵PID:4488
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#128⤵PID:3652
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#129⤵PID:1452
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#130⤵PID:3248
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#131⤵PID:432
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#132⤵PID:3256
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#133⤵PID:724
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#134⤵PID:2484
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#135⤵PID:4632
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#136⤵PID:3188
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#137⤵PID:4036
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#138⤵PID:2400
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#139⤵PID:740
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#140⤵PID:1080
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#141⤵PID:620
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#142⤵PID:1964
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#143⤵PID:1412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#144⤵PID:2652
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#145⤵PID:2924
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#146⤵PID:3664
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#147⤵PID:2720
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#148⤵PID:2740
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#149⤵PID:4304
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#150⤵PID:2512
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#151⤵PID:4376
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#152⤵PID:1264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#153⤵PID:1000
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#154⤵PID:2280
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#155⤵PID:2204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#156⤵PID:2888
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#157⤵PID:4576
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#158⤵PID:5044
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#159⤵PID:4984
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#160⤵PID:1616
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#161⤵PID:2172
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#162⤵PID:2772
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#163⤵PID:4928
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#164⤵PID:4504
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#165⤵PID:5072
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#166⤵PID:3408
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#167⤵PID:828
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#168⤵PID:3296
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#169⤵PID:4660
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#170⤵PID:4688
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#171⤵PID:2768
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#172⤵PID:4352
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#173⤵PID:1876
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#174⤵PID:4924
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#175⤵PID:4656
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#176⤵PID:1560
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#177⤵PID:3272
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#178⤵PID:636
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#179⤵PID:2656
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#180⤵PID:4280
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#181⤵PID:4440
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#182⤵PID:4292
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#183⤵PID:4816
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#184⤵PID:2448
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#185⤵PID:5052
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#186⤵PID:3156
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#187⤵PID:1072
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#188⤵PID:720
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#189⤵PID:4940
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#190⤵PID:2828
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#191⤵PID:2468
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#192⤵PID:4484
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#193⤵PID:2676
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#194⤵PID:380
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#195⤵PID:5048
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#196⤵PID:4672
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#197⤵PID:1604
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#198⤵PID:1172
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#199⤵PID:2476
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#1100⤵PID:3688
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#1101⤵PID:716
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#1102⤵PID:1668
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#1103⤵PID:1208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#1104⤵PID:4904
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#1105⤵PID:1988
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#1106⤵PID:64
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#1107⤵PID:428
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#1108⤵PID:4932
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#1109⤵PID:1240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#1110⤵PID:2332
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#1111⤵PID:4724
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#1112⤵PID:2352
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#1113⤵PID:2100
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#1114⤵PID:676
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#1115⤵PID:1496
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#1116⤵PID:1320
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#1117⤵PID:804
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#1118⤵PID:760
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#1119⤵PID:2808
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#1120⤵PID:4788
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#1121⤵PID:4000
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ea987aec28cb06d1fcc2aa67e15da1e_JaffaCakes118.dll,#1122⤵PID:4704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-