Analysis
-
max time kernel
124s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2024, 02:59
Static task
static1
Behavioral task
behavioral1
Sample
377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll
-
Size
97KB
-
MD5
377337ea24561a8ebdbd56526bb15770
-
SHA1
53d11d17700e83aaf78f161301c9cdc420d7f8ea
-
SHA256
01b1660c2dc01835577a260b5800fbb77583e48139ed81a2b15fa31906f1949a
-
SHA512
a506cbee92194b2d0a8d44ad1a595dee76b1d6d232574de9c8d20acbb2cc7c6882709a429a0a3206774b9f7b5822de6a41fa4f87deb3e90ba2c4430c9927507c
-
SSDEEP
1536:WFCNy6vQjcIGcE+X1Vgme1tbLlvVXWCF7jMCJAY/2sXTHUDHMBnOh9Vt1uW:hczcg1+ZJvVGEjPA+2s6HduW
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe -
Modifies data under HKEY_USERS 18 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeCreateGlobalPrivilege 17264 dwm.exe Token: SeChangeNotifyPrivilege 17264 dwm.exe Token: 33 17264 dwm.exe Token: SeIncBasePriorityPrivilege 17264 dwm.exe Token: SeShutdownPrivilege 17264 dwm.exe Token: SeCreatePagefilePrivilege 17264 dwm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3008 wrote to memory of 5116 3008 rundll32.exe 84 PID 3008 wrote to memory of 5116 3008 rundll32.exe 84 PID 3008 wrote to memory of 5116 3008 rundll32.exe 84 PID 5116 wrote to memory of 2324 5116 rundll32.exe 86 PID 5116 wrote to memory of 2324 5116 rundll32.exe 86 PID 5116 wrote to memory of 2324 5116 rundll32.exe 86 PID 2324 wrote to memory of 4828 2324 rundll32.exe 87 PID 2324 wrote to memory of 4828 2324 rundll32.exe 87 PID 2324 wrote to memory of 4828 2324 rundll32.exe 87 PID 4828 wrote to memory of 848 4828 rundll32.exe 88 PID 4828 wrote to memory of 848 4828 rundll32.exe 88 PID 4828 wrote to memory of 848 4828 rundll32.exe 88 PID 848 wrote to memory of 2812 848 rundll32.exe 89 PID 848 wrote to memory of 2812 848 rundll32.exe 89 PID 848 wrote to memory of 2812 848 rundll32.exe 89 PID 2812 wrote to memory of 4048 2812 rundll32.exe 90 PID 2812 wrote to memory of 4048 2812 rundll32.exe 90 PID 2812 wrote to memory of 4048 2812 rundll32.exe 90 PID 4048 wrote to memory of 944 4048 rundll32.exe 92 PID 4048 wrote to memory of 944 4048 rundll32.exe 92 PID 4048 wrote to memory of 944 4048 rundll32.exe 92 PID 944 wrote to memory of 3548 944 rundll32.exe 93 PID 944 wrote to memory of 3548 944 rundll32.exe 93 PID 944 wrote to memory of 3548 944 rundll32.exe 93 PID 3548 wrote to memory of 3612 3548 rundll32.exe 94 PID 3548 wrote to memory of 3612 3548 rundll32.exe 94 PID 3548 wrote to memory of 3612 3548 rundll32.exe 94 PID 3612 wrote to memory of 1064 3612 rundll32.exe 95 PID 3612 wrote to memory of 1064 3612 rundll32.exe 95 PID 3612 wrote to memory of 1064 3612 rundll32.exe 95 PID 1064 wrote to memory of 3420 1064 rundll32.exe 96 PID 1064 wrote to memory of 3420 1064 rundll32.exe 96 PID 1064 wrote to memory of 3420 1064 rundll32.exe 96 PID 3420 wrote to memory of 2840 3420 rundll32.exe 97 PID 3420 wrote to memory of 2840 3420 rundll32.exe 97 PID 3420 wrote to memory of 2840 3420 rundll32.exe 97 PID 2840 wrote to memory of 3344 2840 rundll32.exe 98 PID 2840 wrote to memory of 3344 2840 rundll32.exe 98 PID 2840 wrote to memory of 3344 2840 rundll32.exe 98 PID 3344 wrote to memory of 2340 3344 rundll32.exe 99 PID 3344 wrote to memory of 2340 3344 rundll32.exe 99 PID 3344 wrote to memory of 2340 3344 rundll32.exe 99 PID 2340 wrote to memory of 1268 2340 rundll32.exe 100 PID 2340 wrote to memory of 1268 2340 rundll32.exe 100 PID 2340 wrote to memory of 1268 2340 rundll32.exe 100 PID 1268 wrote to memory of 3516 1268 rundll32.exe 101 PID 1268 wrote to memory of 3516 1268 rundll32.exe 101 PID 1268 wrote to memory of 3516 1268 rundll32.exe 101 PID 3516 wrote to memory of 3968 3516 rundll32.exe 102 PID 3516 wrote to memory of 3968 3516 rundll32.exe 102 PID 3516 wrote to memory of 3968 3516 rundll32.exe 102 PID 3968 wrote to memory of 816 3968 rundll32.exe 103 PID 3968 wrote to memory of 816 3968 rundll32.exe 103 PID 3968 wrote to memory of 816 3968 rundll32.exe 103 PID 816 wrote to memory of 2652 816 rundll32.exe 104 PID 816 wrote to memory of 2652 816 rundll32.exe 104 PID 816 wrote to memory of 2652 816 rundll32.exe 104 PID 2652 wrote to memory of 2540 2652 rundll32.exe 105 PID 2652 wrote to memory of 2540 2652 rundll32.exe 105 PID 2652 wrote to memory of 2540 2652 rundll32.exe 105 PID 2540 wrote to memory of 1008 2540 rundll32.exe 106 PID 2540 wrote to memory of 1008 2540 rundll32.exe 106 PID 2540 wrote to memory of 1008 2540 rundll32.exe 106 PID 1008 wrote to memory of 788 1008 rundll32.exe 107
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#123⤵PID:788
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#124⤵PID:3044
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#125⤵PID:4548
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#126⤵PID:1212
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#127⤵PID:5096
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#128⤵PID:1956
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#129⤵PID:1424
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#130⤵PID:1292
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#131⤵PID:1204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#132⤵PID:960
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#133⤵PID:2364
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#134⤵PID:1496
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#135⤵PID:1620
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#136⤵PID:2640
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#137⤵PID:3556
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#138⤵PID:3960
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#139⤵PID:3992
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#140⤵PID:4888
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#141⤵PID:2280
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#142⤵PID:672
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#143⤵PID:4628
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#144⤵PID:3268
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#145⤵PID:896
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#146⤵PID:1072
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#147⤵PID:436
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#148⤵PID:1540
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#149⤵PID:1092
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#150⤵PID:3836
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#151⤵PID:3116
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#152⤵PID:4004
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#153⤵PID:4848
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#154⤵PID:1232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#155⤵PID:4664
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#156⤵PID:2444
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#157⤵PID:5064
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#158⤵PID:4656
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#159⤵PID:3188
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#160⤵PID:5104
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#161⤵PID:3284
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#162⤵PID:3976
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#163⤵PID:696
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#164⤵PID:4708
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#165⤵PID:4604
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#166⤵PID:1324
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#167⤵PID:2120
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#168⤵PID:656
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#169⤵PID:4944
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#170⤵PID:2744
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#171⤵PID:4176
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#172⤵PID:1844
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#173⤵PID:4880
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#174⤵PID:3416
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#175⤵PID:3492
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#176⤵PID:2576
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#177⤵PID:3444
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#178⤵PID:2224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#179⤵PID:5000
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#180⤵PID:3640
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#181⤵PID:4320
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#182⤵PID:3668
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#183⤵PID:3984
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#184⤵PID:216
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#185⤵PID:2876
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#186⤵PID:4376
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#187⤵PID:4516
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#188⤵PID:3552
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#189⤵PID:344
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#190⤵PID:4764
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#191⤵PID:4192
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#192⤵PID:1076
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#193⤵PID:2392
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#194⤵PID:4480
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#195⤵PID:1964
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#196⤵PID:1840
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#197⤵PID:2052
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#198⤵PID:2696
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#199⤵PID:1396
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#1100⤵PID:4900
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#1101⤵PID:540
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#1102⤵PID:2580
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#1103⤵PID:1772
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#1104⤵PID:3192
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#1105⤵PID:5124
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#1106⤵PID:5140
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#1107⤵PID:5152
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#1108⤵PID:5168
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#1109⤵PID:5184
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#1110⤵PID:5200
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#1111⤵PID:5216
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#1112⤵PID:5232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#1113⤵PID:5248
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#1114⤵PID:5260
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#1115⤵PID:5276
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#1116⤵PID:5292
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#1117⤵PID:5308
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#1118⤵PID:5324
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#1119⤵PID:5340
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#1120⤵PID:5356
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#1121⤵PID:5368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\377337ea24561a8ebdbd56526bb15770_JaffaCakes118.dll,#1122⤵PID:5384
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-