Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2024, 00:35
Static task
static1
Behavioral task
behavioral1
Sample
370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll
-
Size
39KB
-
MD5
370933e01c5b51e58f6119c1b72b6148
-
SHA1
2a08044ecac5c297befcd18f5236136538f7be98
-
SHA256
d60f664ff9f92305fe2625bf39000433e78c85c5fd82d4cc63d198b70a3fe15b
-
SHA512
a9fa9f6d50f99aa61fd8ccbe999c832547c1033afab3a77ff3fe483510bd5c4552e6f0e128c760d6e69a4f5706d364718a13b101447c4e5859981844b96d9343
-
SSDEEP
768:d5hTz4bQt6eDiC9zItTjOWp/NWZTyPbTLd9gKyzNW:jhT8neDbzaHOA/NMCyKz
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags dwm.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe -
Modifies data under HKEY_USERS 18 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeCreateGlobalPrivilege 17364 dwm.exe Token: SeChangeNotifyPrivilege 17364 dwm.exe Token: 33 17364 dwm.exe Token: SeIncBasePriorityPrivilege 17364 dwm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3316 wrote to memory of 5100 3316 rundll32.exe 83 PID 3316 wrote to memory of 5100 3316 rundll32.exe 83 PID 3316 wrote to memory of 5100 3316 rundll32.exe 83 PID 5100 wrote to memory of 4964 5100 rundll32.exe 84 PID 5100 wrote to memory of 4964 5100 rundll32.exe 84 PID 5100 wrote to memory of 4964 5100 rundll32.exe 84 PID 4964 wrote to memory of 4652 4964 rundll32.exe 85 PID 4964 wrote to memory of 4652 4964 rundll32.exe 85 PID 4964 wrote to memory of 4652 4964 rundll32.exe 85 PID 4652 wrote to memory of 4344 4652 rundll32.exe 86 PID 4652 wrote to memory of 4344 4652 rundll32.exe 86 PID 4652 wrote to memory of 4344 4652 rundll32.exe 86 PID 4344 wrote to memory of 4460 4344 rundll32.exe 87 PID 4344 wrote to memory of 4460 4344 rundll32.exe 87 PID 4344 wrote to memory of 4460 4344 rundll32.exe 87 PID 4460 wrote to memory of 2748 4460 rundll32.exe 88 PID 4460 wrote to memory of 2748 4460 rundll32.exe 88 PID 4460 wrote to memory of 2748 4460 rundll32.exe 88 PID 2748 wrote to memory of 392 2748 rundll32.exe 89 PID 2748 wrote to memory of 392 2748 rundll32.exe 89 PID 2748 wrote to memory of 392 2748 rundll32.exe 89 PID 392 wrote to memory of 2808 392 rundll32.exe 90 PID 392 wrote to memory of 2808 392 rundll32.exe 90 PID 392 wrote to memory of 2808 392 rundll32.exe 90 PID 2808 wrote to memory of 3164 2808 rundll32.exe 91 PID 2808 wrote to memory of 3164 2808 rundll32.exe 91 PID 2808 wrote to memory of 3164 2808 rundll32.exe 91 PID 3164 wrote to memory of 2596 3164 rundll32.exe 92 PID 3164 wrote to memory of 2596 3164 rundll32.exe 92 PID 3164 wrote to memory of 2596 3164 rundll32.exe 92 PID 2596 wrote to memory of 3968 2596 rundll32.exe 93 PID 2596 wrote to memory of 3968 2596 rundll32.exe 93 PID 2596 wrote to memory of 3968 2596 rundll32.exe 93 PID 3968 wrote to memory of 1272 3968 rundll32.exe 94 PID 3968 wrote to memory of 1272 3968 rundll32.exe 94 PID 3968 wrote to memory of 1272 3968 rundll32.exe 94 PID 1272 wrote to memory of 4868 1272 rundll32.exe 95 PID 1272 wrote to memory of 4868 1272 rundll32.exe 95 PID 1272 wrote to memory of 4868 1272 rundll32.exe 95 PID 4868 wrote to memory of 4800 4868 rundll32.exe 97 PID 4868 wrote to memory of 4800 4868 rundll32.exe 97 PID 4868 wrote to memory of 4800 4868 rundll32.exe 97 PID 4800 wrote to memory of 4068 4800 rundll32.exe 98 PID 4800 wrote to memory of 4068 4800 rundll32.exe 98 PID 4800 wrote to memory of 4068 4800 rundll32.exe 98 PID 4068 wrote to memory of 2400 4068 rundll32.exe 99 PID 4068 wrote to memory of 2400 4068 rundll32.exe 99 PID 4068 wrote to memory of 2400 4068 rundll32.exe 99 PID 2400 wrote to memory of 5060 2400 rundll32.exe 100 PID 2400 wrote to memory of 5060 2400 rundll32.exe 100 PID 2400 wrote to memory of 5060 2400 rundll32.exe 100 PID 5060 wrote to memory of 3728 5060 rundll32.exe 101 PID 5060 wrote to memory of 3728 5060 rundll32.exe 101 PID 5060 wrote to memory of 3728 5060 rundll32.exe 101 PID 3728 wrote to memory of 1292 3728 rundll32.exe 103 PID 3728 wrote to memory of 1292 3728 rundll32.exe 103 PID 3728 wrote to memory of 1292 3728 rundll32.exe 103 PID 1292 wrote to memory of 440 1292 rundll32.exe 104 PID 1292 wrote to memory of 440 1292 rundll32.exe 104 PID 1292 wrote to memory of 440 1292 rundll32.exe 104 PID 440 wrote to memory of 3552 440 rundll32.exe 105 PID 440 wrote to memory of 3552 440 rundll32.exe 105 PID 440 wrote to memory of 3552 440 rundll32.exe 105 PID 3552 wrote to memory of 4300 3552 rundll32.exe 106
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#123⤵PID:4300
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#124⤵PID:2036
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#125⤵PID:3656
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#126⤵PID:3708
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#127⤵PID:3920
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#128⤵PID:3192
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#129⤵PID:3436
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#130⤵PID:3496
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#131⤵PID:5012
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#132⤵PID:4636
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#133⤵PID:2108
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#134⤵PID:1080
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#135⤵PID:3924
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#136⤵PID:4164
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#137⤵PID:60
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#138⤵PID:3520
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#139⤵PID:4304
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#140⤵PID:4276
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#141⤵PID:2092
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#142⤵PID:3140
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#143⤵PID:4064
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#144⤵PID:2820
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#145⤵PID:4352
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#146⤵PID:836
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#147⤵PID:1500
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#148⤵PID:4356
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#149⤵PID:3224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#150⤵PID:4820
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#151⤵PID:748
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#152⤵PID:2420
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#153⤵PID:4680
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#154⤵PID:2776
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#155⤵PID:2360
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#156⤵PID:3664
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#157⤵PID:2720
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#158⤵PID:4980
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#159⤵PID:2032
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#160⤵PID:1476
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#161⤵PID:1404
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#162⤵PID:3980
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#163⤵PID:1780
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#164⤵PID:4960
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#165⤵PID:4504
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#166⤵PID:1420
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#167⤵PID:2488
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#168⤵PID:388
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#169⤵PID:1908
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#170⤵PID:3324
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#171⤵PID:3696
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#172⤵PID:2992
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#173⤵PID:544
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#174⤵PID:3720
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#175⤵PID:4448
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#176⤵PID:2448
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#177⤵PID:1016
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#178⤵PID:4380
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#179⤵PID:1488
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#180⤵PID:4160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#181⤵PID:3852
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#182⤵PID:4028
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#183⤵PID:3704
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#184⤵PID:5036
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#185⤵PID:2228
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#186⤵PID:5128
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#187⤵PID:5144
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#188⤵PID:5160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#189⤵PID:5176
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#190⤵PID:5192
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#191⤵PID:5208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#192⤵PID:5224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#193⤵PID:5240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#194⤵PID:5256
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#195⤵PID:5276
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#196⤵PID:5292
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#197⤵PID:5304
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#198⤵PID:5328
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#199⤵PID:5340
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#1100⤵PID:5360
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#1101⤵PID:5376
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#1102⤵PID:5396
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#1103⤵PID:5412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#1104⤵PID:5424
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#1105⤵PID:5440
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#1106⤵PID:5452
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#1107⤵PID:5468
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#1108⤵PID:5488
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#1109⤵PID:5500
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#1110⤵PID:5516
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#1111⤵PID:5532
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#1112⤵PID:5548
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#1113⤵PID:5564
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#1114⤵PID:5580
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#1115⤵PID:5592
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#1116⤵PID:5608
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#1117⤵PID:5620
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#1118⤵PID:5636
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#1119⤵PID:5652
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#1120⤵PID:5668
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#1121⤵PID:5680
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\370933e01c5b51e58f6119c1b72b6148_JaffaCakes118.dll,#1122⤵PID:5692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-