Analysis
-
max time kernel
93s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2024, 11:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll
Resource
win7-20240705-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll
Resource
win10v2004-20240704-en
1 signatures
150 seconds
General
-
Target
303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll
-
Size
48KB
-
MD5
303ad5b0b231440ff8586da89afb6f76
-
SHA1
84393baf0e505f27415e5e7d0f6a4be6b41a3f92
-
SHA256
cbb967b72fd122df66e8b979fed2d003b0dfb84f9d0037e363ff93c2c3c18b0e
-
SHA512
d44728b7b4c2945938559350ccbd63d72ba4839bf289e5bd8fe96ace1425f2c9a8298fe5f5e1f2a7f2c5b30fae7e341feb1facb1fcd1eb994a11c8e63b55ebfd
-
SSDEEP
768:TPUc5F0gaQwGz72ENnbDCtHRrRe3M9ezXJxVetUjFB:TPj5F0gaQ72EN0e3rtxVeOp
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4412 wrote to memory of 3732 4412 rundll32.exe 82 PID 4412 wrote to memory of 3732 4412 rundll32.exe 82 PID 4412 wrote to memory of 3732 4412 rundll32.exe 82 PID 3732 wrote to memory of 4452 3732 rundll32.exe 83 PID 3732 wrote to memory of 4452 3732 rundll32.exe 83 PID 3732 wrote to memory of 4452 3732 rundll32.exe 83 PID 4452 wrote to memory of 4052 4452 rundll32.exe 84 PID 4452 wrote to memory of 4052 4452 rundll32.exe 84 PID 4452 wrote to memory of 4052 4452 rundll32.exe 84 PID 4052 wrote to memory of 4396 4052 rundll32.exe 85 PID 4052 wrote to memory of 4396 4052 rundll32.exe 85 PID 4052 wrote to memory of 4396 4052 rundll32.exe 85 PID 4396 wrote to memory of 4692 4396 rundll32.exe 87 PID 4396 wrote to memory of 4692 4396 rundll32.exe 87 PID 4396 wrote to memory of 4692 4396 rundll32.exe 87 PID 4692 wrote to memory of 1176 4692 rundll32.exe 88 PID 4692 wrote to memory of 1176 4692 rundll32.exe 88 PID 4692 wrote to memory of 1176 4692 rundll32.exe 88 PID 1176 wrote to memory of 400 1176 rundll32.exe 89 PID 1176 wrote to memory of 400 1176 rundll32.exe 89 PID 1176 wrote to memory of 400 1176 rundll32.exe 89 PID 400 wrote to memory of 3420 400 rundll32.exe 90 PID 400 wrote to memory of 3420 400 rundll32.exe 90 PID 400 wrote to memory of 3420 400 rundll32.exe 90 PID 3420 wrote to memory of 3864 3420 rundll32.exe 91 PID 3420 wrote to memory of 3864 3420 rundll32.exe 91 PID 3420 wrote to memory of 3864 3420 rundll32.exe 91 PID 3864 wrote to memory of 680 3864 rundll32.exe 92 PID 3864 wrote to memory of 680 3864 rundll32.exe 92 PID 3864 wrote to memory of 680 3864 rundll32.exe 92 PID 680 wrote to memory of 4932 680 rundll32.exe 93 PID 680 wrote to memory of 4932 680 rundll32.exe 93 PID 680 wrote to memory of 4932 680 rundll32.exe 93 PID 4932 wrote to memory of 1044 4932 rundll32.exe 94 PID 4932 wrote to memory of 1044 4932 rundll32.exe 94 PID 4932 wrote to memory of 1044 4932 rundll32.exe 94 PID 1044 wrote to memory of 740 1044 rundll32.exe 95 PID 1044 wrote to memory of 740 1044 rundll32.exe 95 PID 1044 wrote to memory of 740 1044 rundll32.exe 95 PID 740 wrote to memory of 4536 740 rundll32.exe 96 PID 740 wrote to memory of 4536 740 rundll32.exe 96 PID 740 wrote to memory of 4536 740 rundll32.exe 96 PID 4536 wrote to memory of 3808 4536 rundll32.exe 97 PID 4536 wrote to memory of 3808 4536 rundll32.exe 97 PID 4536 wrote to memory of 3808 4536 rundll32.exe 97 PID 3808 wrote to memory of 4812 3808 rundll32.exe 98 PID 3808 wrote to memory of 4812 3808 rundll32.exe 98 PID 3808 wrote to memory of 4812 3808 rundll32.exe 98 PID 4812 wrote to memory of 452 4812 rundll32.exe 100 PID 4812 wrote to memory of 452 4812 rundll32.exe 100 PID 4812 wrote to memory of 452 4812 rundll32.exe 100 PID 452 wrote to memory of 2492 452 rundll32.exe 101 PID 452 wrote to memory of 2492 452 rundll32.exe 101 PID 452 wrote to memory of 2492 452 rundll32.exe 101 PID 2492 wrote to memory of 4320 2492 rundll32.exe 102 PID 2492 wrote to memory of 4320 2492 rundll32.exe 102 PID 2492 wrote to memory of 4320 2492 rundll32.exe 102 PID 4320 wrote to memory of 1924 4320 rundll32.exe 103 PID 4320 wrote to memory of 1924 4320 rundll32.exe 103 PID 4320 wrote to memory of 1924 4320 rundll32.exe 103 PID 1924 wrote to memory of 2972 1924 rundll32.exe 104 PID 1924 wrote to memory of 2972 1924 rundll32.exe 104 PID 1924 wrote to memory of 2972 1924 rundll32.exe 104 PID 2972 wrote to memory of 948 2972 rundll32.exe 105
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#123⤵PID:948
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#124⤵PID:2880
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#125⤵PID:2856
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#126⤵PID:2380
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#127⤵PID:4508
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#128⤵PID:4952
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#129⤵PID:5020
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#130⤵PID:2996
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#131⤵PID:3148
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#132⤵PID:652
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#133⤵PID:552
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#134⤵PID:4904
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#135⤵PID:664
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#136⤵PID:2420
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#137⤵PID:1520
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#138⤵PID:684
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#139⤵PID:3176
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#140⤵PID:4644
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#141⤵PID:5088
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#142⤵PID:3580
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#143⤵PID:5016
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#144⤵PID:3496
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#145⤵PID:2308
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#146⤵PID:1832
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#147⤵PID:1088
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#148⤵PID:3244
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#149⤵PID:2240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#150⤵PID:3060
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#151⤵PID:1000
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#152⤵PID:2832
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#153⤵PID:4676
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#154⤵PID:4980
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#155⤵PID:3016
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#156⤵PID:224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#157⤵PID:4988
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#158⤵PID:2004
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#159⤵PID:3848
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#160⤵PID:1964
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#161⤵PID:2052
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#162⤵PID:4176
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#163⤵PID:1540
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#164⤵PID:3548
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#165⤵PID:1048
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#166⤵PID:2128
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#167⤵PID:1588
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#168⤵PID:4148
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#169⤵PID:3520
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#170⤵PID:924
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#171⤵PID:4960
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#172⤵PID:760
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#173⤵PID:2540
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#174⤵PID:2876
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#175⤵PID:2848
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#176⤵PID:2624
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#177⤵PID:4792
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#178⤵PID:2816
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#179⤵PID:4924
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#180⤵PID:3268
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#181⤵PID:1416
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#182⤵PID:4836
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#183⤵PID:3596
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#184⤵PID:3172
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#185⤵PID:2820
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#186⤵PID:4788
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#187⤵PID:2888
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#188⤵PID:972
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#189⤵PID:3412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#190⤵PID:1600
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#191⤵PID:2384
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#192⤵PID:4212
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#193⤵PID:1332
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#194⤵PID:4472
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#195⤵PID:4308
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#196⤵PID:2176
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#197⤵PID:868
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#198⤵PID:4456
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#199⤵PID:3164
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#1100⤵PID:5068
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#1101⤵PID:2728
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#1102⤵PID:2680
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#1103⤵PID:4324
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#1104⤵PID:4332
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#1105⤵PID:4328
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#1106⤵PID:1708
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#1107⤵PID:1404
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#1108⤵PID:2416
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#1109⤵PID:4772
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#1110⤵PID:3636
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#1111⤵PID:3908
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#1112⤵PID:5124
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#1113⤵PID:5140
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#1114⤵PID:5152
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#1115⤵PID:5168
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#1116⤵PID:5184
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#1117⤵PID:5200
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#1118⤵PID:5216
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#1119⤵PID:5232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#1120⤵PID:5248
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#1121⤵PID:5264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\303ad5b0b231440ff8586da89afb6f76_JaffaCakes118.dll,#1122⤵PID:5276
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-