Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
12/07/2024, 14:52
Static task
static1
Behavioral task
behavioral1
Sample
3dd30311614dde53918eda740c1db959_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3dd30311614dde53918eda740c1db959_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3dd30311614dde53918eda740c1db959_JaffaCakes118.dll
-
Size
118KB
-
MD5
3dd30311614dde53918eda740c1db959
-
SHA1
e5c77807e835e07ac9ea746f60bf99508b3b4636
-
SHA256
1b74cc63429dd67f045f290dfd1b4b2fd8299d03345451fac1f676b8e9dccd94
-
SHA512
1e24fa380a50e3c439ef92ecde6291ea77ed87a0251a9ec8e311760298ce6de2d85c91379976ec885b29adb940712cc6d5545e5463671629d9b8029cdd426b85
-
SSDEEP
3072:jHyP5HyZJ4tjPAwGMwNKJqlQ7lya2xk5GZ+tGNkBbUVjK:jHOHgJYPAwGMTql4lVAYjLB4xK
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2928 wrote to memory of 4576 2928 rundll32.exe 83 PID 2928 wrote to memory of 4576 2928 rundll32.exe 83 PID 2928 wrote to memory of 4576 2928 rundll32.exe 83 PID 4576 wrote to memory of 2312 4576 rundll32.exe 85 PID 4576 wrote to memory of 2312 4576 rundll32.exe 85 PID 4576 wrote to memory of 2312 4576 rundll32.exe 85 PID 2312 wrote to memory of 1900 2312 rundll32.exe 86 PID 2312 wrote to memory of 1900 2312 rundll32.exe 86 PID 2312 wrote to memory of 1900 2312 rundll32.exe 86 PID 1900 wrote to memory of 2000 1900 rundll32.exe 87 PID 1900 wrote to memory of 2000 1900 rundll32.exe 87 PID 1900 wrote to memory of 2000 1900 rundll32.exe 87 PID 2000 wrote to memory of 2620 2000 rundll32.exe 88 PID 2000 wrote to memory of 2620 2000 rundll32.exe 88 PID 2000 wrote to memory of 2620 2000 rundll32.exe 88 PID 2620 wrote to memory of 1184 2620 rundll32.exe 89 PID 2620 wrote to memory of 1184 2620 rundll32.exe 89 PID 2620 wrote to memory of 1184 2620 rundll32.exe 89 PID 1184 wrote to memory of 3248 1184 rundll32.exe 90 PID 1184 wrote to memory of 3248 1184 rundll32.exe 90 PID 1184 wrote to memory of 3248 1184 rundll32.exe 90 PID 3248 wrote to memory of 3172 3248 rundll32.exe 91 PID 3248 wrote to memory of 3172 3248 rundll32.exe 91 PID 3248 wrote to memory of 3172 3248 rundll32.exe 91 PID 3172 wrote to memory of 3540 3172 rundll32.exe 92 PID 3172 wrote to memory of 3540 3172 rundll32.exe 92 PID 3172 wrote to memory of 3540 3172 rundll32.exe 92 PID 3540 wrote to memory of 4688 3540 rundll32.exe 94 PID 3540 wrote to memory of 4688 3540 rundll32.exe 94 PID 3540 wrote to memory of 4688 3540 rundll32.exe 94 PID 4688 wrote to memory of 4492 4688 rundll32.exe 95 PID 4688 wrote to memory of 4492 4688 rundll32.exe 95 PID 4688 wrote to memory of 4492 4688 rundll32.exe 95 PID 4492 wrote to memory of 2680 4492 rundll32.exe 96 PID 4492 wrote to memory of 2680 4492 rundll32.exe 96 PID 4492 wrote to memory of 2680 4492 rundll32.exe 96 PID 2680 wrote to memory of 3816 2680 rundll32.exe 97 PID 2680 wrote to memory of 3816 2680 rundll32.exe 97 PID 2680 wrote to memory of 3816 2680 rundll32.exe 97 PID 3816 wrote to memory of 4420 3816 rundll32.exe 98 PID 3816 wrote to memory of 4420 3816 rundll32.exe 98 PID 3816 wrote to memory of 4420 3816 rundll32.exe 98 PID 4420 wrote to memory of 992 4420 rundll32.exe 99 PID 4420 wrote to memory of 992 4420 rundll32.exe 99 PID 4420 wrote to memory of 992 4420 rundll32.exe 99 PID 992 wrote to memory of 944 992 rundll32.exe 100 PID 992 wrote to memory of 944 992 rundll32.exe 100 PID 992 wrote to memory of 944 992 rundll32.exe 100 PID 944 wrote to memory of 2924 944 rundll32.exe 101 PID 944 wrote to memory of 2924 944 rundll32.exe 101 PID 944 wrote to memory of 2924 944 rundll32.exe 101 PID 2924 wrote to memory of 644 2924 rundll32.exe 102 PID 2924 wrote to memory of 644 2924 rundll32.exe 102 PID 2924 wrote to memory of 644 2924 rundll32.exe 102 PID 644 wrote to memory of 4964 644 rundll32.exe 103 PID 644 wrote to memory of 4964 644 rundll32.exe 103 PID 644 wrote to memory of 4964 644 rundll32.exe 103 PID 4964 wrote to memory of 1948 4964 rundll32.exe 105 PID 4964 wrote to memory of 1948 4964 rundll32.exe 105 PID 4964 wrote to memory of 1948 4964 rundll32.exe 105 PID 1948 wrote to memory of 2764 1948 rundll32.exe 106 PID 1948 wrote to memory of 2764 1948 rundll32.exe 106 PID 1948 wrote to memory of 2764 1948 rundll32.exe 106 PID 2764 wrote to memory of 4888 2764 rundll32.exe 107
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#123⤵PID:4888
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#124⤵PID:952
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#125⤵PID:808
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#126⤵PID:1156
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#127⤵PID:1304
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#128⤵PID:3028
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#129⤵PID:1788
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#130⤵PID:2428
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#131⤵PID:2120
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#132⤵PID:2412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#133⤵PID:1516
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#134⤵PID:3916
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#135⤵PID:1672
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#136⤵PID:4360
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#137⤵PID:5020
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#138⤵PID:4840
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#139⤵PID:2768
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#140⤵PID:2096
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#141⤵PID:2348
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#142⤵PID:4264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#143⤵PID:3724
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#144⤵PID:1528
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#145⤵PID:1992
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#146⤵PID:452
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#147⤵PID:5048
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#148⤵PID:760
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#149⤵PID:2212
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#150⤵PID:3920
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#151⤵PID:3736
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#152⤵PID:3160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#153⤵PID:3864
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#154⤵PID:2104
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#155⤵PID:4860
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#156⤵PID:3472
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#157⤵PID:4580
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#158⤵PID:3300
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#159⤵PID:1268
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#160⤵PID:4440
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#161⤵PID:1444
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#162⤵PID:3084
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#163⤵PID:2168
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#164⤵PID:368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#165⤵PID:3980
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#166⤵PID:1220
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#167⤵PID:536
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#168⤵PID:4152
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#169⤵PID:396
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#170⤵PID:1636
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#171⤵PID:3652
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#172⤵PID:552
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#173⤵PID:4724
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#174⤵PID:3788
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#175⤵PID:4356
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#176⤵PID:1544
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#177⤵PID:2152
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#178⤵PID:1608
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#179⤵PID:4540
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#180⤵PID:4252
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#181⤵PID:2316
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#182⤵PID:556
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#183⤵PID:4024
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#184⤵PID:3640
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#185⤵PID:4692
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#186⤵PID:4488
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#187⤵PID:3224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#188⤵PID:2496
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#189⤵PID:2068
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#190⤵PID:4124
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#191⤵PID:1396
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#192⤵PID:560
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#193⤵PID:3412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#194⤵PID:5112
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#195⤵PID:4336
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#196⤵PID:3036
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#197⤵PID:4020
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#198⤵PID:2332
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#199⤵PID:3484
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#1100⤵PID:4900
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#1101⤵PID:4300
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#1102⤵PID:2060
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#1103⤵PID:2344
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#1104⤵PID:4916
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#1105⤵PID:2972
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#1106⤵PID:1408
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#1107⤵PID:3552
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#1108⤵PID:2836
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#1109⤵PID:3712
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#1110⤵PID:5100
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#1111⤵PID:4232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#1112⤵PID:5136
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#1113⤵PID:5152
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#1114⤵PID:5168
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#1115⤵PID:5184
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#1116⤵PID:5196
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#1117⤵PID:5212
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#1118⤵PID:5224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#1119⤵PID:5240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#1120⤵PID:5256
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#1121⤵PID:5272
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dd30311614dde53918eda740c1db959_JaffaCakes118.dll,#1122⤵PID:5288
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-