Analysis
-
max time kernel
94s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2024, 21:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll
Resource
win7-20240705-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll
Resource
win10v2004-20240709-en
1 signatures
150 seconds
General
-
Target
320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll
-
Size
408KB
-
MD5
320958bccfbdb1a44697611809a795dc
-
SHA1
5ba2159db5d9591085a17912664fa66eb03e1cb4
-
SHA256
6e7181722cc71e853056eaf88d65d278fefecba1fc4af4c0d280bc1be6344d6d
-
SHA512
c7cd8912a2ce0b2ce90d50228e8086155b41fc2e6cca5c2e29d329a07beff32f5ae3154e67e1f46c419a1a906fc39177505cf16c5fb4bae76425d879f3830124
-
SSDEEP
12288:mlDHJQhwsOpA6jogrmXz75APKNeFJxUZ15U:SpTsOC6joGYzDeLxUZ15U
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4944 wrote to memory of 2288 4944 rundll32.exe 81 PID 4944 wrote to memory of 2288 4944 rundll32.exe 81 PID 4944 wrote to memory of 2288 4944 rundll32.exe 81 PID 2288 wrote to memory of 3024 2288 rundll32.exe 84 PID 2288 wrote to memory of 3024 2288 rundll32.exe 84 PID 2288 wrote to memory of 3024 2288 rundll32.exe 84 PID 3024 wrote to memory of 2948 3024 rundll32.exe 85 PID 3024 wrote to memory of 2948 3024 rundll32.exe 85 PID 3024 wrote to memory of 2948 3024 rundll32.exe 85 PID 2948 wrote to memory of 3048 2948 rundll32.exe 86 PID 2948 wrote to memory of 3048 2948 rundll32.exe 86 PID 2948 wrote to memory of 3048 2948 rundll32.exe 86 PID 3048 wrote to memory of 4580 3048 rundll32.exe 87 PID 3048 wrote to memory of 4580 3048 rundll32.exe 87 PID 3048 wrote to memory of 4580 3048 rundll32.exe 87 PID 4580 wrote to memory of 3440 4580 rundll32.exe 88 PID 4580 wrote to memory of 3440 4580 rundll32.exe 88 PID 4580 wrote to memory of 3440 4580 rundll32.exe 88 PID 3440 wrote to memory of 4376 3440 rundll32.exe 89 PID 3440 wrote to memory of 4376 3440 rundll32.exe 89 PID 3440 wrote to memory of 4376 3440 rundll32.exe 89 PID 4376 wrote to memory of 1032 4376 rundll32.exe 90 PID 4376 wrote to memory of 1032 4376 rundll32.exe 90 PID 4376 wrote to memory of 1032 4376 rundll32.exe 90 PID 1032 wrote to memory of 4592 1032 rundll32.exe 91 PID 1032 wrote to memory of 4592 1032 rundll32.exe 91 PID 1032 wrote to memory of 4592 1032 rundll32.exe 91 PID 4592 wrote to memory of 4496 4592 rundll32.exe 92 PID 4592 wrote to memory of 4496 4592 rundll32.exe 92 PID 4592 wrote to memory of 4496 4592 rundll32.exe 92 PID 4496 wrote to memory of 1324 4496 rundll32.exe 93 PID 4496 wrote to memory of 1324 4496 rundll32.exe 93 PID 4496 wrote to memory of 1324 4496 rundll32.exe 93 PID 1324 wrote to memory of 4004 1324 rundll32.exe 94 PID 1324 wrote to memory of 4004 1324 rundll32.exe 94 PID 1324 wrote to memory of 4004 1324 rundll32.exe 94 PID 4004 wrote to memory of 432 4004 rundll32.exe 95 PID 4004 wrote to memory of 432 4004 rundll32.exe 95 PID 4004 wrote to memory of 432 4004 rundll32.exe 95 PID 432 wrote to memory of 2556 432 rundll32.exe 97 PID 432 wrote to memory of 2556 432 rundll32.exe 97 PID 432 wrote to memory of 2556 432 rundll32.exe 97 PID 2556 wrote to memory of 3356 2556 rundll32.exe 98 PID 2556 wrote to memory of 3356 2556 rundll32.exe 98 PID 2556 wrote to memory of 3356 2556 rundll32.exe 98 PID 3356 wrote to memory of 1836 3356 rundll32.exe 99 PID 3356 wrote to memory of 1836 3356 rundll32.exe 99 PID 3356 wrote to memory of 1836 3356 rundll32.exe 99 PID 1836 wrote to memory of 2744 1836 rundll32.exe 100 PID 1836 wrote to memory of 2744 1836 rundll32.exe 100 PID 1836 wrote to memory of 2744 1836 rundll32.exe 100 PID 2744 wrote to memory of 4880 2744 rundll32.exe 101 PID 2744 wrote to memory of 4880 2744 rundll32.exe 101 PID 2744 wrote to memory of 4880 2744 rundll32.exe 101 PID 4880 wrote to memory of 4476 4880 rundll32.exe 102 PID 4880 wrote to memory of 4476 4880 rundll32.exe 102 PID 4880 wrote to memory of 4476 4880 rundll32.exe 102 PID 4476 wrote to memory of 1444 4476 rundll32.exe 103 PID 4476 wrote to memory of 1444 4476 rundll32.exe 103 PID 4476 wrote to memory of 1444 4476 rundll32.exe 103 PID 1444 wrote to memory of 216 1444 rundll32.exe 104 PID 1444 wrote to memory of 216 1444 rundll32.exe 104 PID 1444 wrote to memory of 216 1444 rundll32.exe 104 PID 216 wrote to memory of 4936 216 rundll32.exe 105
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#123⤵PID:4936
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#124⤵PID:868
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#125⤵PID:1188
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#126⤵PID:2412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#127⤵PID:1952
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#128⤵PID:1412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#129⤵PID:1536
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#130⤵PID:2940
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#131⤵PID:2796
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#132⤵PID:2340
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#133⤵PID:348
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#134⤵PID:1168
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#135⤵PID:2996
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#136⤵PID:456
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#137⤵PID:552
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#138⤵PID:3716
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#139⤵PID:4748
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#140⤵PID:1156
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#141⤵PID:2512
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#142⤵PID:2620
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#143⤵PID:3620
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#144⤵PID:540
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#145⤵PID:3812
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#146⤵PID:2292
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#147⤵PID:1364
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#148⤵PID:3236
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#149⤵PID:2140
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#150⤵PID:3600
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#151⤵PID:924
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#152⤵PID:4456
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#153⤵PID:4384
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#154⤵PID:1056
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#155⤵PID:1820
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#156⤵PID:4916
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#157⤵PID:2264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#158⤵PID:2776
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#159⤵PID:4584
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#160⤵PID:4964
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#161⤵PID:3900
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#162⤵PID:1300
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#163⤵PID:4148
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#164⤵PID:2064
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#165⤵PID:1652
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#166⤵PID:1040
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#167⤵PID:3232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#168⤵PID:3204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#169⤵PID:1840
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#170⤵PID:1608
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#171⤵PID:2332
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#172⤵PID:60
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#173⤵PID:1440
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#174⤵PID:752
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#175⤵PID:1988
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#176⤵PID:1500
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#177⤵PID:4464
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#178⤵PID:4720
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#179⤵PID:1424
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#180⤵PID:4000
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#181⤵PID:3852
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#182⤵PID:1052
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#183⤵PID:2860
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#184⤵PID:636
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#185⤵PID:3420
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#186⤵PID:4272
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#187⤵PID:624
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#188⤵PID:2212
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#189⤵PID:3308
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#190⤵PID:3768
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#191⤵PID:2920
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#192⤵PID:1764
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#193⤵PID:2992
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#194⤵PID:3448
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#195⤵PID:1104
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#196⤵PID:5096
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#197⤵PID:4840
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#198⤵PID:4252
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#199⤵PID:2596
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#1100⤵PID:4428
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#1101⤵PID:3736
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#1102⤵PID:4008
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#1103⤵PID:3588
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#1104⤵PID:4444
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#1105⤵PID:4232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#1106⤵PID:4940
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#1107⤵PID:3060
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#1108⤵PID:2572
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#1109⤵PID:1640
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#1110⤵PID:4308
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#1111⤵PID:1992
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#1112⤵PID:4236
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#1113⤵PID:2344
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#1114⤵PID:2712
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#1115⤵PID:2132
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#1116⤵PID:3432
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#1117⤵PID:5016
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#1118⤵PID:3032
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#1119⤵PID:3596
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#1120⤵PID:4684
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#1121⤵PID:1476
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\320958bccfbdb1a44697611809a795dc_JaffaCakes118.dll,#1122⤵PID:4680
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-