Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2024, 22:32
Behavioral task
behavioral1
Sample
4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll
-
Size
100KB
-
MD5
4bb0a7f859cf1655cb57976de10ca539
-
SHA1
9987b581201089e6517051654d22e825965a3e80
-
SHA256
d0eee02693b6e8607870284ec7bf3cc6785062260a65e1d742aae29fc107fc35
-
SHA512
0febe70d1a97bbc3b8677bb967b42feb4764c479ed05784e654430581aba3d98343f2d89b86611611f7b953dfbc4b60c8f4ceaffd4214424d33bd5e0b5a4ee51
-
SSDEEP
3072:6i8OWBS66krGFeIAK/omI4FVmItqEBKf1RHQFiyEux:6KfeGWAHVmeqeKd3ux
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags dwm.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe -
Modifies data under HKEY_USERS 18 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeCreateGlobalPrivilege 17220 dwm.exe Token: SeChangeNotifyPrivilege 17220 dwm.exe Token: 33 17220 dwm.exe Token: SeIncBasePriorityPrivilege 17220 dwm.exe Token: SeShutdownPrivilege 17220 dwm.exe Token: SeCreatePagefilePrivilege 17220 dwm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1648 wrote to memory of 4348 1648 rundll32.exe 82 PID 1648 wrote to memory of 4348 1648 rundll32.exe 82 PID 1648 wrote to memory of 4348 1648 rundll32.exe 82 PID 4348 wrote to memory of 1504 4348 rundll32.exe 83 PID 4348 wrote to memory of 1504 4348 rundll32.exe 83 PID 4348 wrote to memory of 1504 4348 rundll32.exe 83 PID 1504 wrote to memory of 3100 1504 rundll32.exe 84 PID 1504 wrote to memory of 3100 1504 rundll32.exe 84 PID 1504 wrote to memory of 3100 1504 rundll32.exe 84 PID 3100 wrote to memory of 1252 3100 rundll32.exe 85 PID 3100 wrote to memory of 1252 3100 rundll32.exe 85 PID 3100 wrote to memory of 1252 3100 rundll32.exe 85 PID 1252 wrote to memory of 3244 1252 rundll32.exe 87 PID 1252 wrote to memory of 3244 1252 rundll32.exe 87 PID 1252 wrote to memory of 3244 1252 rundll32.exe 87 PID 3244 wrote to memory of 4800 3244 rundll32.exe 88 PID 3244 wrote to memory of 4800 3244 rundll32.exe 88 PID 3244 wrote to memory of 4800 3244 rundll32.exe 88 PID 4800 wrote to memory of 1820 4800 rundll32.exe 89 PID 4800 wrote to memory of 1820 4800 rundll32.exe 89 PID 4800 wrote to memory of 1820 4800 rundll32.exe 89 PID 1820 wrote to memory of 1944 1820 rundll32.exe 90 PID 1820 wrote to memory of 1944 1820 rundll32.exe 90 PID 1820 wrote to memory of 1944 1820 rundll32.exe 90 PID 1944 wrote to memory of 336 1944 rundll32.exe 91 PID 1944 wrote to memory of 336 1944 rundll32.exe 91 PID 1944 wrote to memory of 336 1944 rundll32.exe 91 PID 336 wrote to memory of 4792 336 rundll32.exe 92 PID 336 wrote to memory of 4792 336 rundll32.exe 92 PID 336 wrote to memory of 4792 336 rundll32.exe 92 PID 4792 wrote to memory of 2144 4792 rundll32.exe 93 PID 4792 wrote to memory of 2144 4792 rundll32.exe 93 PID 4792 wrote to memory of 2144 4792 rundll32.exe 93 PID 2144 wrote to memory of 3552 2144 rundll32.exe 94 PID 2144 wrote to memory of 3552 2144 rundll32.exe 94 PID 2144 wrote to memory of 3552 2144 rundll32.exe 94 PID 3552 wrote to memory of 2408 3552 rundll32.exe 95 PID 3552 wrote to memory of 2408 3552 rundll32.exe 95 PID 3552 wrote to memory of 2408 3552 rundll32.exe 95 PID 2408 wrote to memory of 4092 2408 rundll32.exe 96 PID 2408 wrote to memory of 4092 2408 rundll32.exe 96 PID 2408 wrote to memory of 4092 2408 rundll32.exe 96 PID 4092 wrote to memory of 1724 4092 rundll32.exe 97 PID 4092 wrote to memory of 1724 4092 rundll32.exe 97 PID 4092 wrote to memory of 1724 4092 rundll32.exe 97 PID 1724 wrote to memory of 2064 1724 rundll32.exe 99 PID 1724 wrote to memory of 2064 1724 rundll32.exe 99 PID 1724 wrote to memory of 2064 1724 rundll32.exe 99 PID 2064 wrote to memory of 3188 2064 rundll32.exe 100 PID 2064 wrote to memory of 3188 2064 rundll32.exe 100 PID 2064 wrote to memory of 3188 2064 rundll32.exe 100 PID 3188 wrote to memory of 3760 3188 rundll32.exe 101 PID 3188 wrote to memory of 3760 3188 rundll32.exe 101 PID 3188 wrote to memory of 3760 3188 rundll32.exe 101 PID 3760 wrote to memory of 2684 3760 rundll32.exe 102 PID 3760 wrote to memory of 2684 3760 rundll32.exe 102 PID 3760 wrote to memory of 2684 3760 rundll32.exe 102 PID 2684 wrote to memory of 1920 2684 rundll32.exe 104 PID 2684 wrote to memory of 1920 2684 rundll32.exe 104 PID 2684 wrote to memory of 1920 2684 rundll32.exe 104 PID 1920 wrote to memory of 3204 1920 rundll32.exe 105 PID 1920 wrote to memory of 3204 1920 rundll32.exe 105 PID 1920 wrote to memory of 3204 1920 rundll32.exe 105 PID 3204 wrote to memory of 1412 3204 rundll32.exe 106
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#123⤵PID:1412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#124⤵PID:4688
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#125⤵PID:4716
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#126⤵PID:1824
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#127⤵PID:668
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#128⤵PID:3288
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#129⤵PID:1664
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#130⤵PID:1408
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#131⤵PID:2996
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#132⤵PID:820
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#133⤵PID:2588
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#134⤵PID:2120
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#135⤵PID:5060
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#136⤵PID:5016
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#137⤵PID:2264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#138⤵PID:3700
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#139⤵PID:4924
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#140⤵PID:2316
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#141⤵PID:5112
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#142⤵PID:1836
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#143⤵PID:3408
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#144⤵PID:4416
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#145⤵PID:3424
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#146⤵PID:3248
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#147⤵PID:1916
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#148⤵PID:2724
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#149⤵PID:2768
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#150⤵PID:3344
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#151⤵PID:4976
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#152⤵PID:1168
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#153⤵PID:2468
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#154⤵PID:4840
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#155⤵PID:644
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#156⤵PID:4828
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#157⤵PID:4064
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#158⤵PID:3024
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#159⤵PID:572
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#160⤵PID:2604
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#161⤵PID:4692
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#162⤵PID:1988
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#163⤵PID:3840
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#164⤵PID:4596
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#165⤵PID:3780
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#166⤵PID:4660
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#167⤵PID:4988
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#168⤵PID:4184
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#169⤵PID:2972
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#170⤵PID:2628
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#171⤵PID:4652
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#172⤵PID:4280
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#173⤵PID:4804
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#174⤵PID:4908
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#175⤵PID:3980
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#176⤵PID:3200
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#177⤵PID:1652
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#178⤵PID:4456
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#179⤵PID:4156
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#180⤵PID:4812
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#181⤵PID:2448
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#182⤵PID:716
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#183⤵PID:3392
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#184⤵PID:1220
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#185⤵PID:3512
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#186⤵PID:4484
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#187⤵PID:3904
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#188⤵PID:4500
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#189⤵PID:3292
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#190⤵PID:364
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#191⤵PID:876
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#192⤵PID:4864
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#193⤵PID:4948
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#194⤵PID:976
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#195⤵PID:1444
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#196⤵PID:4668
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#197⤵PID:4980
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#198⤵PID:2252
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#199⤵PID:1608
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#1100⤵PID:2256
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#1101⤵PID:2496
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#1102⤵PID:464
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#1103⤵PID:3848
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#1104⤵PID:1976
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#1105⤵PID:2636
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#1106⤵PID:1488
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#1107⤵PID:860
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#1108⤵PID:4584
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#1109⤵PID:5128
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#1110⤵PID:5144
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#1111⤵PID:5156
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#1112⤵PID:5172
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#1113⤵PID:5188
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#1114⤵PID:5204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#1115⤵PID:5220
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#1116⤵PID:5240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#1117⤵PID:5260
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#1118⤵PID:5280
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#1119⤵PID:5296
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#1120⤵PID:5312
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#1121⤵PID:5328
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bb0a7f859cf1655cb57976de10ca539_JaffaCakes118.dll,#1122⤵PID:5344
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-