Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
130s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2024, 04:31
Static task
static1
Behavioral task
behavioral1
Sample
2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll
-
Size
104KB
-
MD5
2f0068df368cb6ba4ee840dec59ecaf9
-
SHA1
61e827f091da099cfc2c66e788b97ac56db5c609
-
SHA256
416d0a61dcdf599800dc4529501379ac67b86bc5e9f4f12e4c33bd052e8cfbf7
-
SHA512
70e46dcbac6dccc79f57ff1adb1b20a52973c62f8f67de6ca412a061cea11f6fa4a2b1915c848ce70030116a3a75957610c496be6f9a9ad82a8e336291de42d3
-
SSDEEP
1536:07qru/RzWj9LXNxDvtmgMbFuovfIR38mHY1/JRBju7p5KWhVcEtYEWYzQRg:FipzWj9LX/Ag0FuBsm4a7p5/YEWYzQRg
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5036 wrote to memory of 4576 5036 rundll32.exe 89 PID 5036 wrote to memory of 4576 5036 rundll32.exe 89 PID 5036 wrote to memory of 4576 5036 rundll32.exe 89 PID 4576 wrote to memory of 5108 4576 rundll32.exe 90 PID 4576 wrote to memory of 5108 4576 rundll32.exe 90 PID 4576 wrote to memory of 5108 4576 rundll32.exe 90 PID 5108 wrote to memory of 4876 5108 rundll32.exe 91 PID 5108 wrote to memory of 4876 5108 rundll32.exe 91 PID 5108 wrote to memory of 4876 5108 rundll32.exe 91 PID 4876 wrote to memory of 3216 4876 rundll32.exe 92 PID 4876 wrote to memory of 3216 4876 rundll32.exe 92 PID 4876 wrote to memory of 3216 4876 rundll32.exe 92 PID 3216 wrote to memory of 3964 3216 rundll32.exe 93 PID 3216 wrote to memory of 3964 3216 rundll32.exe 93 PID 3216 wrote to memory of 3964 3216 rundll32.exe 93 PID 3964 wrote to memory of 2072 3964 rundll32.exe 94 PID 3964 wrote to memory of 2072 3964 rundll32.exe 94 PID 3964 wrote to memory of 2072 3964 rundll32.exe 94 PID 2072 wrote to memory of 4056 2072 rundll32.exe 95 PID 2072 wrote to memory of 4056 2072 rundll32.exe 95 PID 2072 wrote to memory of 4056 2072 rundll32.exe 95 PID 4056 wrote to memory of 4632 4056 rundll32.exe 96 PID 4056 wrote to memory of 4632 4056 rundll32.exe 96 PID 4056 wrote to memory of 4632 4056 rundll32.exe 96 PID 4632 wrote to memory of 2112 4632 rundll32.exe 97 PID 4632 wrote to memory of 2112 4632 rundll32.exe 97 PID 4632 wrote to memory of 2112 4632 rundll32.exe 97 PID 2112 wrote to memory of 3236 2112 rundll32.exe 98 PID 2112 wrote to memory of 3236 2112 rundll32.exe 98 PID 2112 wrote to memory of 3236 2112 rundll32.exe 98 PID 3236 wrote to memory of 4268 3236 rundll32.exe 99 PID 3236 wrote to memory of 4268 3236 rundll32.exe 99 PID 3236 wrote to memory of 4268 3236 rundll32.exe 99 PID 4268 wrote to memory of 4976 4268 rundll32.exe 101 PID 4268 wrote to memory of 4976 4268 rundll32.exe 101 PID 4268 wrote to memory of 4976 4268 rundll32.exe 101 PID 4976 wrote to memory of 2388 4976 rundll32.exe 102 PID 4976 wrote to memory of 2388 4976 rundll32.exe 102 PID 4976 wrote to memory of 2388 4976 rundll32.exe 102 PID 2388 wrote to memory of 4144 2388 rundll32.exe 103 PID 2388 wrote to memory of 4144 2388 rundll32.exe 103 PID 2388 wrote to memory of 4144 2388 rundll32.exe 103 PID 4144 wrote to memory of 4372 4144 rundll32.exe 104 PID 4144 wrote to memory of 4372 4144 rundll32.exe 104 PID 4144 wrote to memory of 4372 4144 rundll32.exe 104 PID 4372 wrote to memory of 4028 4372 rundll32.exe 105 PID 4372 wrote to memory of 4028 4372 rundll32.exe 105 PID 4372 wrote to memory of 4028 4372 rundll32.exe 105 PID 4028 wrote to memory of 796 4028 rundll32.exe 106 PID 4028 wrote to memory of 796 4028 rundll32.exe 106 PID 4028 wrote to memory of 796 4028 rundll32.exe 106 PID 796 wrote to memory of 3876 796 rundll32.exe 107 PID 796 wrote to memory of 3876 796 rundll32.exe 107 PID 796 wrote to memory of 3876 796 rundll32.exe 107 PID 3876 wrote to memory of 4080 3876 rundll32.exe 109 PID 3876 wrote to memory of 4080 3876 rundll32.exe 109 PID 3876 wrote to memory of 4080 3876 rundll32.exe 109 PID 4080 wrote to memory of 768 4080 rundll32.exe 110 PID 4080 wrote to memory of 768 4080 rundll32.exe 110 PID 4080 wrote to memory of 768 4080 rundll32.exe 110 PID 768 wrote to memory of 1512 768 rundll32.exe 111 PID 768 wrote to memory of 1512 768 rundll32.exe 111 PID 768 wrote to memory of 1512 768 rundll32.exe 111 PID 1512 wrote to memory of 4484 1512 rundll32.exe 112
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#123⤵PID:4484
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#124⤵PID:4752
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#125⤵PID:4608
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#126⤵PID:4048
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#127⤵PID:4076
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#128⤵PID:1688
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#129⤵PID:4628
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#130⤵PID:3796
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#131⤵PID:3880
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#132⤵PID:3932
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#133⤵PID:2188
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#134⤵PID:2904
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#135⤵PID:3600
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#136⤵PID:1800
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#137⤵PID:3204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#138⤵PID:4640
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#139⤵PID:4620
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#140⤵PID:2864
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#141⤵PID:1168
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#142⤵PID:1420
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#143⤵PID:456
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#144⤵PID:3028
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#145⤵PID:4828
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#146⤵PID:1428
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#147⤵PID:2196
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#148⤵PID:4280
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#149⤵PID:3824
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#150⤵PID:1344
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#151⤵PID:3940
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#152⤵PID:872
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#153⤵PID:4416
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#154⤵PID:5068
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#155⤵PID:3900
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#156⤵PID:4644
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#157⤵PID:976
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#158⤵PID:4272
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#159⤵PID:4764
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#160⤵PID:4836
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#161⤵PID:3088
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#162⤵PID:4476
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#163⤵PID:1500
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#164⤵PID:2192
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#165⤵PID:3464
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#166⤵PID:4856
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#167⤵PID:1312
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#168⤵PID:1600
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#169⤵PID:4388
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#170⤵PID:4488
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#171⤵PID:2544
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#172⤵PID:1948
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#173⤵PID:3400
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#174⤵PID:3580
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#175⤵PID:1060
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#176⤵PID:684
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#177⤵PID:2148
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#178⤵PID:5132
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#179⤵PID:5144
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#180⤵PID:5160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#181⤵PID:5176
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#182⤵PID:5192
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#183⤵PID:5204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#184⤵PID:5228
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#185⤵PID:5248
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#186⤵PID:5264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#187⤵PID:5276
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#188⤵PID:5296
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#189⤵PID:5312
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#190⤵PID:5340
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#191⤵PID:5372
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#192⤵PID:5388
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#193⤵PID:5404
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#194⤵PID:5420
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#195⤵PID:5436
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#196⤵PID:5452
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#197⤵PID:5464
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#198⤵PID:5480
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#199⤵PID:5492
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#1100⤵PID:5508
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#1101⤵PID:5520
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#1102⤵PID:5536
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#1103⤵PID:5552
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#1104⤵PID:5568
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#1105⤵PID:5584
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#1106⤵PID:5600
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#1107⤵PID:5616
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#1108⤵PID:5640
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#1109⤵PID:5652
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#1110⤵PID:5672
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#1111⤵PID:5688
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#1112⤵PID:5704
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#1113⤵PID:5716
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#1114⤵PID:5728
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#1115⤵PID:5744
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#1116⤵PID:5760
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#1117⤵PID:5772
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#1118⤵PID:5792
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#1119⤵PID:5808
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#1120⤵PID:5824
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#1121⤵PID:5836
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0068df368cb6ba4ee840dec59ecaf9_JaffaCakes118.dll,#1122⤵PID:5848
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-