Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/07/2024, 14:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll
Resource
win7-20240508-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll
Resource
win10v2004-20240508-en
1 signatures
150 seconds
General
-
Target
1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll
-
Size
326KB
-
MD5
1bb03a5b5cb95e7feecff050fd47f4d9
-
SHA1
5cc7152104cc577ca4806dc95be6bf184fc3b32f
-
SHA256
84a8f43e616969b6737de67129461eedb35abc9be0dec614ca7ef5b9af22bb5f
-
SHA512
8be06f89126dc346c94c6e787bdb7c7a0d17c90d3612bbdc61978a41aba6d480ab1187bf6d56fe57c9d3fcd2e0a40fd87b373405be8dbf227cf3c58d5b2399bc
-
SSDEEP
6144:/HYPIDN76X61gADzOAF4XrcXhpVBa2Rib2oHcyPf2FBIyz9evewYq4fSrbesCGL/:HDN76XvADzxF3oHRY8
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2116 wrote to memory of 4640 2116 rundll32.exe 81 PID 2116 wrote to memory of 4640 2116 rundll32.exe 81 PID 2116 wrote to memory of 4640 2116 rundll32.exe 81 PID 4640 wrote to memory of 1756 4640 rundll32.exe 82 PID 4640 wrote to memory of 1756 4640 rundll32.exe 82 PID 4640 wrote to memory of 1756 4640 rundll32.exe 82 PID 1756 wrote to memory of 1912 1756 rundll32.exe 83 PID 1756 wrote to memory of 1912 1756 rundll32.exe 83 PID 1756 wrote to memory of 1912 1756 rundll32.exe 83 PID 1912 wrote to memory of 2948 1912 rundll32.exe 84 PID 1912 wrote to memory of 2948 1912 rundll32.exe 84 PID 1912 wrote to memory of 2948 1912 rundll32.exe 84 PID 2948 wrote to memory of 2372 2948 rundll32.exe 85 PID 2948 wrote to memory of 2372 2948 rundll32.exe 85 PID 2948 wrote to memory of 2372 2948 rundll32.exe 85 PID 2372 wrote to memory of 468 2372 rundll32.exe 86 PID 2372 wrote to memory of 468 2372 rundll32.exe 86 PID 2372 wrote to memory of 468 2372 rundll32.exe 86 PID 468 wrote to memory of 848 468 rundll32.exe 87 PID 468 wrote to memory of 848 468 rundll32.exe 87 PID 468 wrote to memory of 848 468 rundll32.exe 87 PID 848 wrote to memory of 1420 848 rundll32.exe 88 PID 848 wrote to memory of 1420 848 rundll32.exe 88 PID 848 wrote to memory of 1420 848 rundll32.exe 88 PID 1420 wrote to memory of 640 1420 rundll32.exe 89 PID 1420 wrote to memory of 640 1420 rundll32.exe 89 PID 1420 wrote to memory of 640 1420 rundll32.exe 89 PID 640 wrote to memory of 4484 640 rundll32.exe 90 PID 640 wrote to memory of 4484 640 rundll32.exe 90 PID 640 wrote to memory of 4484 640 rundll32.exe 90 PID 4484 wrote to memory of 4136 4484 rundll32.exe 91 PID 4484 wrote to memory of 4136 4484 rundll32.exe 91 PID 4484 wrote to memory of 4136 4484 rundll32.exe 91 PID 4136 wrote to memory of 3204 4136 rundll32.exe 92 PID 4136 wrote to memory of 3204 4136 rundll32.exe 92 PID 4136 wrote to memory of 3204 4136 rundll32.exe 92 PID 3204 wrote to memory of 3996 3204 rundll32.exe 93 PID 3204 wrote to memory of 3996 3204 rundll32.exe 93 PID 3204 wrote to memory of 3996 3204 rundll32.exe 93 PID 3996 wrote to memory of 1092 3996 rundll32.exe 94 PID 3996 wrote to memory of 1092 3996 rundll32.exe 94 PID 3996 wrote to memory of 1092 3996 rundll32.exe 94 PID 1092 wrote to memory of 732 1092 rundll32.exe 95 PID 1092 wrote to memory of 732 1092 rundll32.exe 95 PID 1092 wrote to memory of 732 1092 rundll32.exe 95 PID 732 wrote to memory of 3212 732 rundll32.exe 96 PID 732 wrote to memory of 3212 732 rundll32.exe 96 PID 732 wrote to memory of 3212 732 rundll32.exe 96 PID 3212 wrote to memory of 2416 3212 rundll32.exe 97 PID 3212 wrote to memory of 2416 3212 rundll32.exe 97 PID 3212 wrote to memory of 2416 3212 rundll32.exe 97 PID 2416 wrote to memory of 4012 2416 rundll32.exe 98 PID 2416 wrote to memory of 4012 2416 rundll32.exe 98 PID 2416 wrote to memory of 4012 2416 rundll32.exe 98 PID 4012 wrote to memory of 1012 4012 rundll32.exe 99 PID 4012 wrote to memory of 1012 4012 rundll32.exe 99 PID 4012 wrote to memory of 1012 4012 rundll32.exe 99 PID 1012 wrote to memory of 3932 1012 rundll32.exe 100 PID 1012 wrote to memory of 3932 1012 rundll32.exe 100 PID 1012 wrote to memory of 3932 1012 rundll32.exe 100 PID 3932 wrote to memory of 4788 3932 rundll32.exe 101 PID 3932 wrote to memory of 4788 3932 rundll32.exe 101 PID 3932 wrote to memory of 4788 3932 rundll32.exe 101 PID 4788 wrote to memory of 3088 4788 rundll32.exe 102
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#123⤵PID:3088
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#124⤵PID:1340
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#125⤵PID:4356
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#126⤵PID:1404
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#127⤵PID:4544
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#128⤵PID:4004
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#129⤵PID:1896
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#130⤵PID:1364
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#131⤵PID:1252
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#132⤵PID:4112
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#133⤵PID:824
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#134⤵PID:4576
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#135⤵PID:1664
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#136⤵PID:2720
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#137⤵PID:2104
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#138⤵PID:3160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#139⤵PID:4552
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#140⤵PID:4104
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#141⤵PID:3492
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#142⤵PID:3944
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#143⤵PID:4472
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#144⤵PID:376
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#145⤵PID:4540
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#146⤵PID:4216
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#147⤵PID:2140
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#148⤵PID:880
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#149⤵PID:3936
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#150⤵PID:432
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#151⤵PID:2744
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#152⤵PID:1704
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#153⤵PID:1640
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#154⤵PID:4960
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#155⤵PID:2192
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#156⤵PID:1608
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#157⤵PID:4872
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#158⤵PID:3304
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#159⤵PID:2448
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#160⤵PID:3736
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#161⤵PID:4624
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#162⤵PID:3512
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#163⤵PID:1216
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#164⤵PID:2508
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#165⤵PID:2904
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#166⤵PID:904
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#167⤵PID:1916
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#168⤵PID:4532
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#169⤵PID:5048
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#170⤵PID:1108
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#171⤵PID:4520
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#172⤵PID:5032
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#173⤵PID:1132
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#174⤵PID:3144
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#175⤵PID:5052
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#176⤵PID:1508
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#177⤵PID:4256
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#178⤵PID:1060
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#179⤵PID:1300
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#180⤵PID:3292
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#181⤵PID:3588
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#182⤵PID:1348
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#183⤵PID:1516
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#184⤵PID:3644
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#185⤵PID:3620
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#186⤵PID:2444
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#187⤵PID:3096
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#188⤵PID:2088
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#189⤵PID:1636
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#190⤵PID:3108
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#191⤵PID:2896
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#192⤵PID:4148
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#193⤵PID:2500
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#194⤵PID:3008
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#195⤵PID:3680
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#196⤵PID:2716
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#197⤵PID:756
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#198⤵PID:4076
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#199⤵PID:4244
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#1100⤵PID:396
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#1101⤵PID:4340
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#1102⤵PID:2920
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#1103⤵PID:4572
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#1104⤵PID:2092
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#1105⤵PID:4108
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#1106⤵PID:3048
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#1107⤵PID:4644
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#1108⤵PID:3964
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#1109⤵PID:2728
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#1110⤵PID:2096
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#1111⤵PID:2000
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#1112⤵PID:1040
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#1113⤵PID:1076
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#1114⤵PID:4508
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#1115⤵PID:4596
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#1116⤵PID:4712
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#1117⤵PID:3232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#1118⤵PID:4948
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#1119⤵PID:5100
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#1120⤵PID:728
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#1121⤵PID:4688
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb03a5b5cb95e7feecff050fd47f4d9_JaffaCakes118.dll,#1122⤵PID:3140
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-