Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 01:56
Behavioral task
behavioral1
Sample
185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll
Resource
win7-20240508-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll
-
Size
172KB
-
MD5
185f736a606a34373919f6e16ae1b68d
-
SHA1
071a01c2654103f3fc86475cb45a84ae82fcd850
-
SHA256
92cee38b78b849dbe5214c6c29eeefe43c1a0c088500b06ca2702c6c28830259
-
SHA512
849edd87d206f08d77f3543c687fa4090cee23f637e9f3ce38935db18ea8d98207de20b487c73e34c345090cfa31db914be3dc3e71574bd864ce76ecfd680acb
-
SSDEEP
3072:QT4wiMOULEYbsD78pcQrQmXo4jrM2iQlWdQ21UEE//fnEdwiuTsALG5hVa7Ywb//:QEwiMOuE5D76vQrUkQlqn1Uj/fji3ecm
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 968 wrote to memory of 4200 968 rundll32.exe 80 PID 968 wrote to memory of 4200 968 rundll32.exe 80 PID 968 wrote to memory of 4200 968 rundll32.exe 80 PID 4200 wrote to memory of 3308 4200 rundll32.exe 81 PID 4200 wrote to memory of 3308 4200 rundll32.exe 81 PID 4200 wrote to memory of 3308 4200 rundll32.exe 81 PID 3308 wrote to memory of 3408 3308 rundll32.exe 82 PID 3308 wrote to memory of 3408 3308 rundll32.exe 82 PID 3308 wrote to memory of 3408 3308 rundll32.exe 82 PID 3408 wrote to memory of 4592 3408 rundll32.exe 83 PID 3408 wrote to memory of 4592 3408 rundll32.exe 83 PID 3408 wrote to memory of 4592 3408 rundll32.exe 83 PID 4592 wrote to memory of 1104 4592 rundll32.exe 84 PID 4592 wrote to memory of 1104 4592 rundll32.exe 84 PID 4592 wrote to memory of 1104 4592 rundll32.exe 84 PID 1104 wrote to memory of 3908 1104 rundll32.exe 85 PID 1104 wrote to memory of 3908 1104 rundll32.exe 85 PID 1104 wrote to memory of 3908 1104 rundll32.exe 85 PID 3908 wrote to memory of 5080 3908 rundll32.exe 86 PID 3908 wrote to memory of 5080 3908 rundll32.exe 86 PID 3908 wrote to memory of 5080 3908 rundll32.exe 86 PID 5080 wrote to memory of 4356 5080 rundll32.exe 87 PID 5080 wrote to memory of 4356 5080 rundll32.exe 87 PID 5080 wrote to memory of 4356 5080 rundll32.exe 87 PID 4356 wrote to memory of 1868 4356 rundll32.exe 88 PID 4356 wrote to memory of 1868 4356 rundll32.exe 88 PID 4356 wrote to memory of 1868 4356 rundll32.exe 88 PID 1868 wrote to memory of 3504 1868 rundll32.exe 89 PID 1868 wrote to memory of 3504 1868 rundll32.exe 89 PID 1868 wrote to memory of 3504 1868 rundll32.exe 89 PID 3504 wrote to memory of 2824 3504 rundll32.exe 90 PID 3504 wrote to memory of 2824 3504 rundll32.exe 90 PID 3504 wrote to memory of 2824 3504 rundll32.exe 90 PID 2824 wrote to memory of 4448 2824 rundll32.exe 91 PID 2824 wrote to memory of 4448 2824 rundll32.exe 91 PID 2824 wrote to memory of 4448 2824 rundll32.exe 91 PID 4448 wrote to memory of 948 4448 rundll32.exe 92 PID 4448 wrote to memory of 948 4448 rundll32.exe 92 PID 4448 wrote to memory of 948 4448 rundll32.exe 92 PID 948 wrote to memory of 1312 948 rundll32.exe 93 PID 948 wrote to memory of 1312 948 rundll32.exe 93 PID 948 wrote to memory of 1312 948 rundll32.exe 93 PID 1312 wrote to memory of 964 1312 rundll32.exe 94 PID 1312 wrote to memory of 964 1312 rundll32.exe 94 PID 1312 wrote to memory of 964 1312 rundll32.exe 94 PID 964 wrote to memory of 3448 964 rundll32.exe 95 PID 964 wrote to memory of 3448 964 rundll32.exe 95 PID 964 wrote to memory of 3448 964 rundll32.exe 95 PID 3448 wrote to memory of 1136 3448 rundll32.exe 96 PID 3448 wrote to memory of 1136 3448 rundll32.exe 96 PID 3448 wrote to memory of 1136 3448 rundll32.exe 96 PID 1136 wrote to memory of 212 1136 rundll32.exe 97 PID 1136 wrote to memory of 212 1136 rundll32.exe 97 PID 1136 wrote to memory of 212 1136 rundll32.exe 97 PID 212 wrote to memory of 3588 212 rundll32.exe 98 PID 212 wrote to memory of 3588 212 rundll32.exe 98 PID 212 wrote to memory of 3588 212 rundll32.exe 98 PID 3588 wrote to memory of 448 3588 rundll32.exe 99 PID 3588 wrote to memory of 448 3588 rundll32.exe 99 PID 3588 wrote to memory of 448 3588 rundll32.exe 99 PID 448 wrote to memory of 3240 448 rundll32.exe 100 PID 448 wrote to memory of 3240 448 rundll32.exe 100 PID 448 wrote to memory of 3240 448 rundll32.exe 100 PID 3240 wrote to memory of 412 3240 rundll32.exe 101
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#123⤵PID:412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#124⤵PID:1632
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#125⤵PID:4204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#126⤵PID:3192
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#127⤵PID:4004
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#128⤵PID:1408
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#129⤵PID:2828
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#130⤵PID:1176
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#131⤵PID:864
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#132⤵PID:1688
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#133⤵PID:1888
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#134⤵PID:4584
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#135⤵PID:400
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#136⤵PID:4332
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#137⤵PID:3080
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#138⤵PID:3936
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#139⤵PID:2460
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#140⤵PID:2672
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#141⤵PID:2900
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#142⤵PID:2524
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#143⤵PID:884
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#144⤵PID:1728
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#145⤵PID:2324
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#146⤵PID:3476
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#147⤵PID:3132
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#148⤵PID:4748
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#149⤵PID:1664
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#150⤵PID:1580
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#151⤵PID:3396
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#152⤵PID:2060
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#153⤵PID:3400
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#154⤵PID:4044
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#155⤵PID:3772
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#156⤵PID:4060
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#157⤵PID:4212
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#158⤵PID:3812
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#159⤵PID:1748
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#160⤵PID:3700
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#161⤵PID:3348
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#162⤵PID:1348
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#163⤵PID:404
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#164⤵PID:4632
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#165⤵PID:4048
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#166⤵PID:2224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#167⤵PID:4308
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#168⤵PID:1576
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#169⤵PID:1660
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#170⤵PID:5048
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#171⤵PID:2860
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#172⤵PID:1944
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#173⤵PID:1272
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#174⤵PID:2000
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#175⤵PID:100
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#176⤵PID:916
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#177⤵PID:1412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#178⤵PID:4848
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#179⤵PID:1824
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#180⤵PID:4000
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#181⤵PID:868
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#182⤵PID:1276
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#183⤵PID:748
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#184⤵PID:4132
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#185⤵PID:4092
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#186⤵PID:3844
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#187⤵PID:1060
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#188⤵PID:2608
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#189⤵PID:208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#190⤵PID:4736
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#191⤵PID:3920
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#192⤵PID:8
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#193⤵PID:2624
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#194⤵PID:2436
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#195⤵PID:996
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#196⤵PID:2016
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#197⤵PID:3584
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#198⤵PID:3604
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#199⤵PID:4324
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#1100⤵PID:4768
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#1101⤵PID:2768
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#1102⤵PID:4032
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#1103⤵PID:2428
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#1104⤵PID:2404
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#1105⤵PID:5004
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#1106⤵PID:4424
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#1107⤵PID:4444
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#1108⤵PID:4232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#1109⤵PID:3948
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#1110⤵PID:1548
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#1111⤵PID:1340
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#1112⤵PID:2232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#1113⤵PID:1976
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#1114⤵PID:4648
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#1115⤵PID:5108
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#1116⤵PID:3216
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#1117⤵PID:1420
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#1118⤵PID:4008
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#1119⤵PID:4564
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#1120⤵PID:4604
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#1121⤵PID:1048
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\185f736a606a34373919f6e16ae1b68d_JaffaCakes118.dll,#1122⤵PID:1652
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-