Analysis
-
max time kernel
125s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
06/07/2024, 21:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll
Resource
win7-20240705-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll
Resource
win10v2004-20240704-en
1 signatures
150 seconds
General
-
Target
295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll
-
Size
97KB
-
MD5
295cdd29c38b49bb9edc3f91fd1a9b68
-
SHA1
8a9d63dc6739db5e416285527588dc05c67c0e27
-
SHA256
6bd34800fecf6e3febab1fc21811baf40bb369c7c2a654e8bc8f602e78396010
-
SHA512
dce4032514d8f82db734bcfbea861a686c98b60fdcab9d6bad4b981dee04977da9d5c33d531ec8048ffa472291738f48caf4f3feaf98bc52bbfa6a8de0dd7797
-
SSDEEP
3072:yYoVKEzKDJJe8rOI49oJvNdfCe77oiLa8n:yYphK8J49oJvzf/PfLPn
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3268 wrote to memory of 692 3268 rundll32.exe 89 PID 3268 wrote to memory of 692 3268 rundll32.exe 89 PID 3268 wrote to memory of 692 3268 rundll32.exe 89 PID 692 wrote to memory of 3908 692 rundll32.exe 92 PID 692 wrote to memory of 3908 692 rundll32.exe 92 PID 692 wrote to memory of 3908 692 rundll32.exe 92 PID 3908 wrote to memory of 4856 3908 rundll32.exe 93 PID 3908 wrote to memory of 4856 3908 rundll32.exe 93 PID 3908 wrote to memory of 4856 3908 rundll32.exe 93 PID 4856 wrote to memory of 2540 4856 rundll32.exe 94 PID 4856 wrote to memory of 2540 4856 rundll32.exe 94 PID 4856 wrote to memory of 2540 4856 rundll32.exe 94 PID 2540 wrote to memory of 2284 2540 rundll32.exe 95 PID 2540 wrote to memory of 2284 2540 rundll32.exe 95 PID 2540 wrote to memory of 2284 2540 rundll32.exe 95 PID 2284 wrote to memory of 2140 2284 rundll32.exe 96 PID 2284 wrote to memory of 2140 2284 rundll32.exe 96 PID 2284 wrote to memory of 2140 2284 rundll32.exe 96 PID 2140 wrote to memory of 4292 2140 rundll32.exe 97 PID 2140 wrote to memory of 4292 2140 rundll32.exe 97 PID 2140 wrote to memory of 4292 2140 rundll32.exe 97 PID 4292 wrote to memory of 2656 4292 rundll32.exe 98 PID 4292 wrote to memory of 2656 4292 rundll32.exe 98 PID 4292 wrote to memory of 2656 4292 rundll32.exe 98 PID 2656 wrote to memory of 3368 2656 rundll32.exe 99 PID 2656 wrote to memory of 3368 2656 rundll32.exe 99 PID 2656 wrote to memory of 3368 2656 rundll32.exe 99 PID 3368 wrote to memory of 1876 3368 rundll32.exe 100 PID 3368 wrote to memory of 1876 3368 rundll32.exe 100 PID 3368 wrote to memory of 1876 3368 rundll32.exe 100 PID 1876 wrote to memory of 1448 1876 rundll32.exe 101 PID 1876 wrote to memory of 1448 1876 rundll32.exe 101 PID 1876 wrote to memory of 1448 1876 rundll32.exe 101 PID 1448 wrote to memory of 1092 1448 rundll32.exe 103 PID 1448 wrote to memory of 1092 1448 rundll32.exe 103 PID 1448 wrote to memory of 1092 1448 rundll32.exe 103 PID 1092 wrote to memory of 4348 1092 rundll32.exe 104 PID 1092 wrote to memory of 4348 1092 rundll32.exe 104 PID 1092 wrote to memory of 4348 1092 rundll32.exe 104 PID 4348 wrote to memory of 1860 4348 rundll32.exe 105 PID 4348 wrote to memory of 1860 4348 rundll32.exe 105 PID 4348 wrote to memory of 1860 4348 rundll32.exe 105 PID 1860 wrote to memory of 612 1860 rundll32.exe 106 PID 1860 wrote to memory of 612 1860 rundll32.exe 106 PID 1860 wrote to memory of 612 1860 rundll32.exe 106 PID 612 wrote to memory of 436 612 rundll32.exe 107 PID 612 wrote to memory of 436 612 rundll32.exe 107 PID 612 wrote to memory of 436 612 rundll32.exe 107 PID 436 wrote to memory of 4388 436 rundll32.exe 108 PID 436 wrote to memory of 4388 436 rundll32.exe 108 PID 436 wrote to memory of 4388 436 rundll32.exe 108 PID 4388 wrote to memory of 2024 4388 rundll32.exe 109 PID 4388 wrote to memory of 2024 4388 rundll32.exe 109 PID 4388 wrote to memory of 2024 4388 rundll32.exe 109 PID 2024 wrote to memory of 1488 2024 rundll32.exe 110 PID 2024 wrote to memory of 1488 2024 rundll32.exe 110 PID 2024 wrote to memory of 1488 2024 rundll32.exe 110 PID 1488 wrote to memory of 1828 1488 rundll32.exe 111 PID 1488 wrote to memory of 1828 1488 rundll32.exe 111 PID 1488 wrote to memory of 1828 1488 rundll32.exe 111 PID 1828 wrote to memory of 3316 1828 rundll32.exe 112 PID 1828 wrote to memory of 3316 1828 rundll32.exe 112 PID 1828 wrote to memory of 3316 1828 rundll32.exe 112 PID 3316 wrote to memory of 3032 3316 rundll32.exe 113
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#123⤵PID:3032
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#124⤵PID:3424
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#125⤵PID:4048
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#126⤵PID:2344
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#127⤵PID:3920
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#128⤵PID:3036
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#129⤵PID:4696
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#130⤵PID:4992
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#131⤵PID:2848
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#132⤵PID:2904
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#133⤵PID:4460
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#134⤵PID:1220
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#135⤵PID:748
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#136⤵PID:1040
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#137⤵PID:3780
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#138⤵PID:3944
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#139⤵PID:1052
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#140⤵PID:4256
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#141⤵PID:3584
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#142⤵PID:1800
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#143⤵PID:3828
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#144⤵PID:4836
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#145⤵PID:3956
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#146⤵PID:340
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#147⤵PID:556
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#148⤵PID:4128
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#149⤵PID:1288
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#150⤵PID:4012
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#151⤵PID:2536
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#152⤵PID:1032
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#153⤵PID:4488
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#154⤵PID:2664
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#155⤵PID:4596
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#156⤵PID:1044
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#157⤵PID:2508
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#158⤵PID:2888
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#159⤵PID:1196
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#160⤵PID:3568
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#161⤵PID:3880
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#162⤵PID:2348
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#163⤵PID:4420
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#164⤵PID:4320
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#165⤵PID:640
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#166⤵PID:4932
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#167⤵PID:3564
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#168⤵PID:4364
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#169⤵PID:2844
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#170⤵PID:4552
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#171⤵PID:3632
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#172⤵PID:5128
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#173⤵PID:5140
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#174⤵PID:5156
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#175⤵PID:5172
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#176⤵PID:5188
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#177⤵PID:5204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#178⤵PID:5224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#179⤵PID:5240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#180⤵PID:5252
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#181⤵PID:5276
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#182⤵PID:5292
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#183⤵PID:5304
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#184⤵PID:5336
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#185⤵PID:5348
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#186⤵PID:5364
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#187⤵PID:5384
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#188⤵PID:5404
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#189⤵PID:5420
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#190⤵PID:5436
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#191⤵PID:5452
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#192⤵PID:5464
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#193⤵PID:5480
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#194⤵PID:5496
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#195⤵PID:5512
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#196⤵PID:5524
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#197⤵PID:5544
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#198⤵PID:5560
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#199⤵PID:5576
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#1100⤵PID:5592
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#1101⤵PID:5608
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#1102⤵PID:5624
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#1103⤵PID:5640
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#1104⤵PID:5652
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#1105⤵PID:5668
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#1106⤵PID:5684
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#1107⤵PID:5700
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#1108⤵PID:5716
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#1109⤵PID:5732
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#1110⤵PID:5748
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#1111⤵PID:5764
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#1112⤵PID:5780
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#1113⤵PID:5796
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#1114⤵PID:5812
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#1115⤵PID:5828
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#1116⤵PID:5844
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#1117⤵PID:5868
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#1118⤵PID:5880
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#1119⤵PID:5900
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#1120⤵PID:5916
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#1121⤵PID:5932
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\295cdd29c38b49bb9edc3f91fd1a9b68_JaffaCakes118.dll,#1122⤵PID:5948
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-