Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2024, 19:13
Static task
static1
Behavioral task
behavioral1
Sample
3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll
-
Size
19KB
-
MD5
3a6749d378e53fd505b060c1501e12cc
-
SHA1
c1d4ba15edb88855d88d2e991d0b47cc54ebd9e4
-
SHA256
2d54fff927e61071866458abda1c887b7007b5208ad10767ea814b45f5364d85
-
SHA512
5be2ca06e047e4583097e149faefddfd797ac7134d0de8f4a30c48e6fae171ef7b0dcf2ee80167273dd6957f4fdc75f62ac69249cb33bd5572bd0b2d67f962f5
-
SSDEEP
384:D1lREHt4rgAbgzCMVrx00nH3ZUX0V+FA1EocPK2iJ8uPg7wQF:DKHtRZCcpyX0coEoc5uSF
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3264 wrote to memory of 1096 3264 rundll32.exe 84 PID 3264 wrote to memory of 1096 3264 rundll32.exe 84 PID 3264 wrote to memory of 1096 3264 rundll32.exe 84 PID 1096 wrote to memory of 924 1096 rundll32.exe 87 PID 1096 wrote to memory of 924 1096 rundll32.exe 87 PID 1096 wrote to memory of 924 1096 rundll32.exe 87 PID 924 wrote to memory of 2812 924 rundll32.exe 88 PID 924 wrote to memory of 2812 924 rundll32.exe 88 PID 924 wrote to memory of 2812 924 rundll32.exe 88 PID 2812 wrote to memory of 4416 2812 rundll32.exe 89 PID 2812 wrote to memory of 4416 2812 rundll32.exe 89 PID 2812 wrote to memory of 4416 2812 rundll32.exe 89 PID 4416 wrote to memory of 1272 4416 rundll32.exe 90 PID 4416 wrote to memory of 1272 4416 rundll32.exe 90 PID 4416 wrote to memory of 1272 4416 rundll32.exe 90 PID 1272 wrote to memory of 3672 1272 rundll32.exe 91 PID 1272 wrote to memory of 3672 1272 rundll32.exe 91 PID 1272 wrote to memory of 3672 1272 rundll32.exe 91 PID 3672 wrote to memory of 1200 3672 rundll32.exe 92 PID 3672 wrote to memory of 1200 3672 rundll32.exe 92 PID 3672 wrote to memory of 1200 3672 rundll32.exe 92 PID 1200 wrote to memory of 1064 1200 rundll32.exe 93 PID 1200 wrote to memory of 1064 1200 rundll32.exe 93 PID 1200 wrote to memory of 1064 1200 rundll32.exe 93 PID 1064 wrote to memory of 2860 1064 rundll32.exe 94 PID 1064 wrote to memory of 2860 1064 rundll32.exe 94 PID 1064 wrote to memory of 2860 1064 rundll32.exe 94 PID 2860 wrote to memory of 4100 2860 rundll32.exe 95 PID 2860 wrote to memory of 4100 2860 rundll32.exe 95 PID 2860 wrote to memory of 4100 2860 rundll32.exe 95 PID 4100 wrote to memory of 1476 4100 rundll32.exe 96 PID 4100 wrote to memory of 1476 4100 rundll32.exe 96 PID 4100 wrote to memory of 1476 4100 rundll32.exe 96 PID 1476 wrote to memory of 768 1476 rundll32.exe 97 PID 1476 wrote to memory of 768 1476 rundll32.exe 97 PID 1476 wrote to memory of 768 1476 rundll32.exe 97 PID 768 wrote to memory of 3516 768 rundll32.exe 98 PID 768 wrote to memory of 3516 768 rundll32.exe 98 PID 768 wrote to memory of 3516 768 rundll32.exe 98 PID 3516 wrote to memory of 744 3516 rundll32.exe 99 PID 3516 wrote to memory of 744 3516 rundll32.exe 99 PID 3516 wrote to memory of 744 3516 rundll32.exe 99 PID 744 wrote to memory of 3176 744 rundll32.exe 100 PID 744 wrote to memory of 3176 744 rundll32.exe 100 PID 744 wrote to memory of 3176 744 rundll32.exe 100 PID 3176 wrote to memory of 3496 3176 rundll32.exe 101 PID 3176 wrote to memory of 3496 3176 rundll32.exe 101 PID 3176 wrote to memory of 3496 3176 rundll32.exe 101 PID 3496 wrote to memory of 3840 3496 rundll32.exe 102 PID 3496 wrote to memory of 3840 3496 rundll32.exe 102 PID 3496 wrote to memory of 3840 3496 rundll32.exe 102 PID 3840 wrote to memory of 1776 3840 rundll32.exe 103 PID 3840 wrote to memory of 1776 3840 rundll32.exe 103 PID 3840 wrote to memory of 1776 3840 rundll32.exe 103 PID 1776 wrote to memory of 3044 1776 rundll32.exe 104 PID 1776 wrote to memory of 3044 1776 rundll32.exe 104 PID 1776 wrote to memory of 3044 1776 rundll32.exe 104 PID 3044 wrote to memory of 4548 3044 rundll32.exe 105 PID 3044 wrote to memory of 4548 3044 rundll32.exe 105 PID 3044 wrote to memory of 4548 3044 rundll32.exe 105 PID 4548 wrote to memory of 4472 4548 rundll32.exe 106 PID 4548 wrote to memory of 4472 4548 rundll32.exe 106 PID 4548 wrote to memory of 4472 4548 rundll32.exe 106 PID 4472 wrote to memory of 1468 4472 rundll32.exe 107
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#123⤵PID:1468
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#124⤵PID:1684
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#125⤵PID:1440
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#126⤵PID:1108
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#127⤵PID:3540
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#128⤵PID:4032
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#129⤵PID:2364
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#130⤵PID:1620
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#131⤵PID:3556
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#132⤵PID:2152
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#133⤵PID:908
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#134⤵PID:4888
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#135⤵PID:2280
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#136⤵PID:672
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#137⤵PID:4044
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#138⤵PID:1624
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#139⤵PID:1072
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#140⤵PID:3636
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#141⤵PID:1092
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#142⤵PID:3836
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#143⤵PID:1812
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#144⤵PID:3920
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#145⤵PID:4848
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#146⤵PID:1696
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#147⤵PID:932
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#148⤵PID:4988
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#149⤵PID:1636
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#150⤵PID:3188
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#151⤵PID:4296
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#152⤵PID:2992
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#153⤵PID:3456
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#154⤵PID:692
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#155⤵PID:4604
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#156⤵PID:3412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#157⤵PID:2204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#158⤵PID:656
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#159⤵PID:4876
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#160⤵PID:2744
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#161⤵PID:4176
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#162⤵PID:4788
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#163⤵PID:4252
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#164⤵PID:3492
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#165⤵PID:3828
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#166⤵PID:3444
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#167⤵PID:3640
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#168⤵PID:2756
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#169⤵PID:1404
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#170⤵PID:4420
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#171⤵PID:3900
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#172⤵PID:3424
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#173⤵PID:4456
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#174⤵PID:4460
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#175⤵PID:4368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#176⤵PID:4516
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#177⤵PID:1484
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#178⤵PID:2544
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#179⤵PID:848
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#180⤵PID:2520
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#181⤵PID:972
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#182⤵PID:4448
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#183⤵PID:1112
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#184⤵PID:1612
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#185⤵PID:2368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#186⤵PID:4308
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#187⤵PID:2656
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#188⤵PID:2660
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#189⤵PID:844
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#190⤵PID:4484
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#191⤵PID:2908
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#192⤵PID:1540
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#193⤵PID:1184
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#194⤵PID:1856
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#195⤵PID:4480
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#196⤵PID:660
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#197⤵PID:1352
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#198⤵PID:3696
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#199⤵PID:4764
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#1100⤵PID:1396
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#1101⤵PID:5060
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#1102⤵PID:540
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#1103⤵PID:4076
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#1104⤵PID:1920
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#1105⤵PID:1708
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#1106⤵PID:4084
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#1107⤵PID:5132
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#1108⤵PID:5148
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#1109⤵PID:5160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#1110⤵PID:5176
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#1111⤵PID:5196
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#1112⤵PID:5212
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#1113⤵PID:5228
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#1114⤵PID:5244
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#1115⤵PID:5264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#1116⤵PID:5280
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#1117⤵PID:5304
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#1118⤵PID:5320
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#1119⤵PID:5336
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#1120⤵PID:5352
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#1121⤵PID:5372
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a6749d378e53fd505b060c1501e12cc_JaffaCakes118.dll,#1122⤵PID:5388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-