Analysis
- max time kernel
93s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
10/07/2024, 21:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll
Resource
win7-20240708-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll
Resource
win10v2004-20240709-en
1 signatures
150 seconds
General
- Target 36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll
- Size 94KB
- Sample240710-z3pm4ssfph
- SHA256 8bb32dfaa4e66cd6d9885da75fffcfb38be754cd9165b14fef3ea41ad3ca120d
- MD5 36685ab10cbc45f6201f3e4386a7e808
- SHA1 40a4e5dcdb2a470dd9221b34db3f0333b74d3212
- SHA512 09e3a2c3078552449853600dc476884d7a68f85bd869ff3ed11fae91641364c3229d0bcbd33dd7133bca66a3b1af3cc08cc63d17b91be4ab7ad02708852e398d
- SSDEEP 1536:ctd0NcgCzI+BOZcuI/N+Z1kLmnNg4TotPOhr/nuwUzoYH9v:+d0rCa9qN+Z1JRTo9wUVt
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 664 wrote to memory of 4524 664 rundll32.exe 83 PID 664 wrote to memory of 4524 664 rundll32.exe 83 PID 664 wrote to memory of 4524 664 rundll32.exe 83 PID 4524 wrote to memory of 4844 4524 rundll32.exe 85 PID 4524 wrote to memory of 4844 4524 rundll32.exe 85 PID 4524 wrote to memory of 4844 4524 rundll32.exe 85 PID 4844 wrote to memory of 2528 4844 rundll32.exe 86 PID 4844 wrote to memory of 2528 4844 rundll32.exe 86 PID 4844 wrote to memory of 2528 4844 rundll32.exe 86 PID 2528 wrote to memory of 4604 2528 rundll32.exe 87 PID 2528 wrote to memory of 4604 2528 rundll32.exe 87 PID 2528 wrote to memory of 4604 2528 rundll32.exe 87 PID 4604 wrote to memory of 1656 4604 rundll32.exe 88 PID 4604 wrote to memory of 1656 4604 rundll32.exe 88 PID 4604 wrote to memory of 1656 4604 rundll32.exe 88 PID 1656 wrote to memory of 1892 1656 rundll32.exe 89 PID 1656 wrote to memory of 1892 1656 rundll32.exe 89 PID 1656 wrote to memory of 1892 1656 rundll32.exe 89 PID 1892 wrote to memory of 2272 1892 rundll32.exe 91 PID 1892 wrote to memory of 2272 1892 rundll32.exe 91 PID 1892 wrote to memory of 2272 1892 rundll32.exe 91 PID 2272 wrote to memory of 876 2272 rundll32.exe 92 PID 2272 wrote to memory of 876 2272 rundll32.exe 92 PID 2272 wrote to memory of 876 2272 rundll32.exe 92 PID 876 wrote to memory of 2960 876 rundll32.exe 93 PID 876 wrote to memory of 2960 876 rundll32.exe 93 PID 876 wrote to memory of 2960 876 rundll32.exe 93 PID 2960 wrote to memory of 3168 2960 rundll32.exe 94 PID 2960 wrote to memory of 3168 2960 rundll32.exe 94 PID 2960 wrote to memory of 3168 2960 rundll32.exe 94 PID 3168 wrote to memory of 3516 3168 rundll32.exe 95 PID 3168 wrote to memory of 3516 3168 rundll32.exe 95 PID 3168 wrote to memory of 3516 3168 rundll32.exe 95 PID 3516 wrote to memory of 3532 3516 rundll32.exe 96 PID 3516 wrote to memory of 3532 3516 rundll32.exe 96 PID 3516 wrote to memory of 3532 3516 rundll32.exe 96 PID 3532 wrote to memory of 3816 3532 rundll32.exe 97 PID 3532 wrote to memory of 3816 3532 rundll32.exe 97 PID 3532 wrote to memory of 3816 3532 rundll32.exe 97 PID 3816 wrote to memory of 1980 3816 rundll32.exe 98 PID 3816 wrote to memory of 1980 3816 rundll32.exe 98 PID 3816 wrote to memory of 1980 3816 rundll32.exe 98 PID 1980 wrote to memory of 3368 1980 rundll32.exe 100 PID 1980 wrote to memory of 3368 1980 rundll32.exe 100 PID 1980 wrote to memory of 3368 1980 rundll32.exe 100 PID 3368 wrote to memory of 220 3368 rundll32.exe 101 PID 3368 wrote to memory of 220 3368 rundll32.exe 101 PID 3368 wrote to memory of 220 3368 rundll32.exe 101 PID 220 wrote to memory of 4972 220 rundll32.exe 102 PID 220 wrote to memory of 4972 220 rundll32.exe 102 PID 220 wrote to memory of 4972 220 rundll32.exe 102 PID 4972 wrote to memory of 3192 4972 rundll32.exe 103 PID 4972 wrote to memory of 3192 4972 rundll32.exe 103 PID 4972 wrote to memory of 3192 4972 rundll32.exe 103 PID 3192 wrote to memory of 3112 3192 rundll32.exe 104 PID 3192 wrote to memory of 3112 3192 rundll32.exe 104 PID 3192 wrote to memory of 3112 3192 rundll32.exe 104 PID 3112 wrote to memory of 3912 3112 rundll32.exe 105 PID 3112 wrote to memory of 3912 3112 rundll32.exe 105 PID 3112 wrote to memory of 3912 3112 rundll32.exe 105 PID 3912 wrote to memory of 3264 3912 rundll32.exe 106 PID 3912 wrote to memory of 3264 3912 rundll32.exe 106 PID 3912 wrote to memory of 3264 3912 rundll32.exe 106 PID 3264 wrote to memory of 2440 3264 rundll32.exe 107
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#123⤵PID:2440
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#124⤵PID:2308
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#125⤵PID:3620
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#126⤵PID:2688
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#127⤵PID:5084
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#128⤵PID:2832
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#129⤵PID:2336
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#130⤵PID:1096
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#131⤵PID:1936
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#132⤵PID:3048
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#133⤵PID:2880
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#134⤵PID:3260
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#135⤵PID:3696
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#136⤵PID:2588
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#137⤵PID:3224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#138⤵PID:4880
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#139⤵PID:1812
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#140⤵PID:4436
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#141⤵PID:2712
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#142⤵PID:2380
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#143⤵PID:2096
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#144⤵PID:3136
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#145⤵PID:2900
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#146⤵PID:5040
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#147⤵PID:3732
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#148⤵PID:3776
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#149⤵PID:3156
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#150⤵PID:1604
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#151⤵PID:1296
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#152⤵PID:4920
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#153⤵PID:4148
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#154⤵PID:3372
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#155⤵PID:2008
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#156⤵PID:4452
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#157⤵PID:3220
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#158⤵PID:5112
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#159⤵PID:1848
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#160⤵PID:3256
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#161⤵PID:2604
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#162⤵PID:4292
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#163⤵PID:1000
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#164⤵PID:2044
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#165⤵PID:3012
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#166⤵PID:5072
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#167⤵PID:4052
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#168⤵PID:1916
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#169⤵PID:2616
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#170⤵PID:4056
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#171⤵PID:4816
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#172⤵PID:4600
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#173⤵PID:4520
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#174⤵PID:536
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#175⤵PID:1960
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#176⤵PID:1448
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#177⤵PID:3780
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#178⤵PID:4332
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#179⤵PID:4324
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#180⤵PID:668
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#181⤵PID:224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#182⤵PID:4868
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#183⤵PID:4564
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#184⤵PID:4204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#185⤵PID:5116
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#186⤵PID:4776
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#187⤵PID:2692
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#188⤵PID:5076
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#189⤵PID:2092
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#190⤵PID:4864
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#191⤵PID:3020
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#192⤵PID:5056
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#193⤵PID:4140
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#194⤵PID:4420
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#195⤵PID:3180
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#196⤵PID:376
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#197⤵PID:2080
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#198⤵PID:3584
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#199⤵PID:1028
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#1100⤵PID:3976
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#1101⤵PID:5128
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#1102⤵PID:5144
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#1103⤵PID:5160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#1104⤵PID:5180
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#1105⤵PID:5196
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#1106⤵PID:5208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#1107⤵PID:5244
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#1108⤵PID:5260
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#1109⤵PID:5276
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#1110⤵PID:5296
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#1111⤵PID:5316
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#1112⤵PID:5336
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#1113⤵PID:5352
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#1114⤵PID:5364
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#1115⤵PID:5380
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#1116⤵PID:5392
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#1117⤵PID:5424
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#1118⤵PID:5440
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#1119⤵PID:5456
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#1120⤵PID:5468
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#1121⤵PID:5488
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36685ab10cbc45f6201f3e4386a7e808_JaffaCakes118.dll,#1122⤵PID:5500
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-