Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
01/07/2024, 07:31
Static task
static1
Behavioral task
behavioral1
Sample
0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll
-
Size
162KB
-
MD5
0f25a3cd7d33ca394c80f511e30df31c
-
SHA1
0ae4a5e588df2b0d07582683a4540f7a975c0700
-
SHA256
42c1ceb2c04c2f7d781ddd4325d55a6b45f4d25490a0ce65cdf7b0fac8283bba
-
SHA512
64bb8cdd4c9d95d01925688ce34795cadbf529c775daef8dd2a4f16277e4f815e2097f34d7abb78b94b6545c1809e1a102773cb39f4fa7f747dcad61392d6543
-
SSDEEP
3072:JX/VvZy8cwFhnAEzp/KFN/uX8FqxmW5F8U927fwbB2dSgypMZg5tmuSeyZjr:JXNhy87nAU/K2XKqAW5Fy1Sag/gr
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4684 wrote to memory of 3588 4684 rundll32.exe 92 PID 4684 wrote to memory of 3588 4684 rundll32.exe 92 PID 4684 wrote to memory of 3588 4684 rundll32.exe 92 PID 3588 wrote to memory of 4780 3588 rundll32.exe 93 PID 3588 wrote to memory of 4780 3588 rundll32.exe 93 PID 3588 wrote to memory of 4780 3588 rundll32.exe 93 PID 4780 wrote to memory of 2260 4780 rundll32.exe 94 PID 4780 wrote to memory of 2260 4780 rundll32.exe 94 PID 4780 wrote to memory of 2260 4780 rundll32.exe 94 PID 2260 wrote to memory of 4512 2260 rundll32.exe 95 PID 2260 wrote to memory of 4512 2260 rundll32.exe 95 PID 2260 wrote to memory of 4512 2260 rundll32.exe 95 PID 4512 wrote to memory of 3776 4512 rundll32.exe 96 PID 4512 wrote to memory of 3776 4512 rundll32.exe 96 PID 4512 wrote to memory of 3776 4512 rundll32.exe 96 PID 3776 wrote to memory of 4384 3776 rundll32.exe 97 PID 3776 wrote to memory of 4384 3776 rundll32.exe 97 PID 3776 wrote to memory of 4384 3776 rundll32.exe 97 PID 4384 wrote to memory of 3220 4384 rundll32.exe 98 PID 4384 wrote to memory of 3220 4384 rundll32.exe 98 PID 4384 wrote to memory of 3220 4384 rundll32.exe 98 PID 3220 wrote to memory of 3888 3220 rundll32.exe 99 PID 3220 wrote to memory of 3888 3220 rundll32.exe 99 PID 3220 wrote to memory of 3888 3220 rundll32.exe 99 PID 3888 wrote to memory of 4460 3888 rundll32.exe 100 PID 3888 wrote to memory of 4460 3888 rundll32.exe 100 PID 3888 wrote to memory of 4460 3888 rundll32.exe 100 PID 4460 wrote to memory of 2988 4460 rundll32.exe 101 PID 4460 wrote to memory of 2988 4460 rundll32.exe 101 PID 4460 wrote to memory of 2988 4460 rundll32.exe 101 PID 2988 wrote to memory of 1936 2988 rundll32.exe 102 PID 2988 wrote to memory of 1936 2988 rundll32.exe 102 PID 2988 wrote to memory of 1936 2988 rundll32.exe 102 PID 1936 wrote to memory of 4008 1936 rundll32.exe 103 PID 1936 wrote to memory of 4008 1936 rundll32.exe 103 PID 1936 wrote to memory of 4008 1936 rundll32.exe 103 PID 4008 wrote to memory of 4452 4008 rundll32.exe 104 PID 4008 wrote to memory of 4452 4008 rundll32.exe 104 PID 4008 wrote to memory of 4452 4008 rundll32.exe 104 PID 4452 wrote to memory of 3732 4452 rundll32.exe 105 PID 4452 wrote to memory of 3732 4452 rundll32.exe 105 PID 4452 wrote to memory of 3732 4452 rundll32.exe 105 PID 3732 wrote to memory of 4736 3732 rundll32.exe 106 PID 3732 wrote to memory of 4736 3732 rundll32.exe 106 PID 3732 wrote to memory of 4736 3732 rundll32.exe 106 PID 4736 wrote to memory of 1384 4736 rundll32.exe 107 PID 4736 wrote to memory of 1384 4736 rundll32.exe 107 PID 4736 wrote to memory of 1384 4736 rundll32.exe 107 PID 1384 wrote to memory of 2900 1384 rundll32.exe 108 PID 1384 wrote to memory of 2900 1384 rundll32.exe 108 PID 1384 wrote to memory of 2900 1384 rundll32.exe 108 PID 2900 wrote to memory of 844 2900 rundll32.exe 109 PID 2900 wrote to memory of 844 2900 rundll32.exe 109 PID 2900 wrote to memory of 844 2900 rundll32.exe 109 PID 844 wrote to memory of 5012 844 rundll32.exe 110 PID 844 wrote to memory of 5012 844 rundll32.exe 110 PID 844 wrote to memory of 5012 844 rundll32.exe 110 PID 5012 wrote to memory of 5092 5012 rundll32.exe 111 PID 5012 wrote to memory of 5092 5012 rundll32.exe 111 PID 5012 wrote to memory of 5092 5012 rundll32.exe 111 PID 5092 wrote to memory of 4084 5092 rundll32.exe 112 PID 5092 wrote to memory of 4084 5092 rundll32.exe 112 PID 5092 wrote to memory of 4084 5092 rundll32.exe 112 PID 4084 wrote to memory of 3312 4084 rundll32.exe 113
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#123⤵PID:3312
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#124⤵PID:4404
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#125⤵PID:4624
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#126⤵PID:4188
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#127⤵PID:2536
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#128⤵PID:3864
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#129⤵PID:736
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#130⤵PID:1088
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#131⤵PID:4500
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#132⤵PID:1724
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#133⤵PID:3636
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#134⤵PID:4228
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#135⤵PID:1800
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#136⤵PID:4632
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#137⤵PID:2344
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#138⤵PID:1708
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#139⤵PID:976
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#140⤵PID:4952
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#141⤵PID:2524
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#142⤵PID:1920
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#143⤵PID:4776
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#144⤵PID:5088
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#145⤵PID:3428
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#146⤵PID:4264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#147⤵PID:5008
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#148⤵PID:212
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#149⤵PID:4820
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#150⤵PID:1744
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#151⤵PID:3520
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#152⤵PID:472
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#153⤵PID:4320
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#154⤵PID:1260
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#155⤵PID:1808
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#156⤵PID:4984
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#157⤵PID:1552
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#158⤵PID:4996
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#159⤵PID:3592
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#160⤵PID:5004
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#161⤵PID:2884
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#162⤵PID:1720
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#163⤵PID:2184
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#164⤵PID:4020
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#165⤵PID:3448
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#166⤵PID:1892
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#167⤵PID:4552
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#168⤵PID:3516
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#169⤵PID:1620
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#170⤵PID:3308
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#171⤵PID:1516
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#172⤵PID:5128
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#173⤵PID:5140
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#174⤵PID:5160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#175⤵PID:5176
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#176⤵PID:5196
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#177⤵PID:5208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#178⤵PID:5228
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#179⤵PID:5240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#180⤵PID:5260
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#181⤵PID:5276
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#182⤵PID:5292
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#183⤵PID:5308
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#184⤵PID:5320
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#185⤵PID:5340
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#186⤵PID:5352
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#187⤵PID:5372
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#188⤵PID:5392
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#189⤵PID:5412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#190⤵PID:5432
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#191⤵PID:5452
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#192⤵PID:5468
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#193⤵PID:5488
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#194⤵PID:5504
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#195⤵PID:5524
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#196⤵PID:5540
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#197⤵PID:5552
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#198⤵PID:5568
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#199⤵PID:5584
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#1100⤵PID:5600
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#1101⤵PID:5620
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#1102⤵PID:5644
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#1103⤵PID:5656
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#1104⤵PID:5672
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#1105⤵PID:5688
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#1106⤵PID:5704
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#1107⤵PID:5720
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#1108⤵PID:5736
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#1109⤵PID:5756
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#1110⤵PID:5772
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#1111⤵PID:5784
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#1112⤵PID:5828
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#1113⤵PID:5856
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#1114⤵PID:5884
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#1115⤵PID:5904
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#1116⤵PID:5916
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#1117⤵PID:5936
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#1118⤵PID:5952
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#1119⤵PID:5964
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#1120⤵PID:5984
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#1121⤵PID:5996
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f25a3cd7d33ca394c80f511e30df31c_JaffaCakes118.dll,#1122⤵PID:6012
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-