Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2024, 10:33
Static task
static1
Behavioral task
behavioral1
Sample
4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll
-
Size
167KB
-
MD5
4967a971f16fdae1b8fbfe74621162da
-
SHA1
49b0766d33dd4a4df2ca0deb8307bc85537dd1bf
-
SHA256
6ca1048cd5c9171fdf470d5caddea47d00e31640fe2bc25406f80e8503da8d26
-
SHA512
3a8c03891cf89b42316109814a7ed931709eb441b24b7a5af632acad816f7874c503714500b2a74bd319a30b6c8351a886dd39b8730ed8c19ac8b2618c2ffadc
-
SSDEEP
3072:pcPWJ8t6fkk+t1Mp64c8NzTfEM0b3IHTQirbgjWZ:p2s8k+t1Y64c85fEl3IzzrEyZ
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 768 wrote to memory of 3624 768 rundll32.exe 83 PID 768 wrote to memory of 3624 768 rundll32.exe 83 PID 768 wrote to memory of 3624 768 rundll32.exe 83 PID 3624 wrote to memory of 4900 3624 rundll32.exe 85 PID 3624 wrote to memory of 4900 3624 rundll32.exe 85 PID 3624 wrote to memory of 4900 3624 rundll32.exe 85 PID 4900 wrote to memory of 3532 4900 rundll32.exe 86 PID 4900 wrote to memory of 3532 4900 rundll32.exe 86 PID 4900 wrote to memory of 3532 4900 rundll32.exe 86 PID 3532 wrote to memory of 1864 3532 rundll32.exe 87 PID 3532 wrote to memory of 1864 3532 rundll32.exe 87 PID 3532 wrote to memory of 1864 3532 rundll32.exe 87 PID 1864 wrote to memory of 896 1864 rundll32.exe 88 PID 1864 wrote to memory of 896 1864 rundll32.exe 88 PID 1864 wrote to memory of 896 1864 rundll32.exe 88 PID 896 wrote to memory of 2812 896 rundll32.exe 89 PID 896 wrote to memory of 2812 896 rundll32.exe 89 PID 896 wrote to memory of 2812 896 rundll32.exe 89 PID 2812 wrote to memory of 3036 2812 rundll32.exe 90 PID 2812 wrote to memory of 3036 2812 rundll32.exe 90 PID 2812 wrote to memory of 3036 2812 rundll32.exe 90 PID 3036 wrote to memory of 2624 3036 rundll32.exe 91 PID 3036 wrote to memory of 2624 3036 rundll32.exe 91 PID 3036 wrote to memory of 2624 3036 rundll32.exe 91 PID 2624 wrote to memory of 3780 2624 rundll32.exe 92 PID 2624 wrote to memory of 3780 2624 rundll32.exe 92 PID 2624 wrote to memory of 3780 2624 rundll32.exe 92 PID 3780 wrote to memory of 3196 3780 rundll32.exe 94 PID 3780 wrote to memory of 3196 3780 rundll32.exe 94 PID 3780 wrote to memory of 3196 3780 rundll32.exe 94 PID 3196 wrote to memory of 680 3196 rundll32.exe 95 PID 3196 wrote to memory of 680 3196 rundll32.exe 95 PID 3196 wrote to memory of 680 3196 rundll32.exe 95 PID 680 wrote to memory of 1028 680 rundll32.exe 96 PID 680 wrote to memory of 1028 680 rundll32.exe 96 PID 680 wrote to memory of 1028 680 rundll32.exe 96 PID 1028 wrote to memory of 1584 1028 rundll32.exe 97 PID 1028 wrote to memory of 1584 1028 rundll32.exe 97 PID 1028 wrote to memory of 1584 1028 rundll32.exe 97 PID 1584 wrote to memory of 2348 1584 rundll32.exe 98 PID 1584 wrote to memory of 2348 1584 rundll32.exe 98 PID 1584 wrote to memory of 2348 1584 rundll32.exe 98 PID 2348 wrote to memory of 2468 2348 rundll32.exe 99 PID 2348 wrote to memory of 2468 2348 rundll32.exe 99 PID 2348 wrote to memory of 2468 2348 rundll32.exe 99 PID 2468 wrote to memory of 2452 2468 rundll32.exe 100 PID 2468 wrote to memory of 2452 2468 rundll32.exe 100 PID 2468 wrote to memory of 2452 2468 rundll32.exe 100 PID 2452 wrote to memory of 1420 2452 rundll32.exe 101 PID 2452 wrote to memory of 1420 2452 rundll32.exe 101 PID 2452 wrote to memory of 1420 2452 rundll32.exe 101 PID 1420 wrote to memory of 3992 1420 rundll32.exe 102 PID 1420 wrote to memory of 3992 1420 rundll32.exe 102 PID 1420 wrote to memory of 3992 1420 rundll32.exe 102 PID 3992 wrote to memory of 3724 3992 rundll32.exe 104 PID 3992 wrote to memory of 3724 3992 rundll32.exe 104 PID 3992 wrote to memory of 3724 3992 rundll32.exe 104 PID 3724 wrote to memory of 2956 3724 rundll32.exe 105 PID 3724 wrote to memory of 2956 3724 rundll32.exe 105 PID 3724 wrote to memory of 2956 3724 rundll32.exe 105 PID 2956 wrote to memory of 5000 2956 rundll32.exe 106 PID 2956 wrote to memory of 5000 2956 rundll32.exe 106 PID 2956 wrote to memory of 5000 2956 rundll32.exe 106 PID 5000 wrote to memory of 3220 5000 rundll32.exe 107
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#123⤵PID:3220
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#124⤵PID:1424
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#125⤵PID:4444
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#126⤵PID:1040
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#127⤵PID:4288
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#128⤵PID:3556
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#129⤵PID:220
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#130⤵PID:4424
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#131⤵PID:2336
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#132⤵PID:3496
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#133⤵PID:4260
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#134⤵PID:2300
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#135⤵PID:1804
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#136⤵PID:4652
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#137⤵PID:860
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#138⤵PID:3548
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#139⤵PID:4852
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#140⤵PID:944
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#141⤵PID:4392
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#142⤵PID:932
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#143⤵PID:3988
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#144⤵PID:4896
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#145⤵PID:3648
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#146⤵PID:1712
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#147⤵PID:2396
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#148⤵PID:1352
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#149⤵PID:4012
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#150⤵PID:1316
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#151⤵PID:1232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#152⤵PID:1020
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#153⤵PID:3316
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#154⤵PID:4380
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#155⤵PID:2984
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#156⤵PID:900
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#157⤵PID:316
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#158⤵PID:2344
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#159⤵PID:1120
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#160⤵PID:4352
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#161⤵PID:2372
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#162⤵PID:1108
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#163⤵PID:4344
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#164⤵PID:1792
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#165⤵PID:1892
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#166⤵PID:2644
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#167⤵PID:692
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#168⤵PID:3208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#169⤵PID:4508
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#170⤵PID:1904
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#171⤵PID:1528
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#172⤵PID:1260
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#173⤵PID:5080
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#174⤵PID:1524
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#175⤵PID:1372
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#176⤵PID:3888
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#177⤵PID:3272
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#178⤵PID:1484
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#179⤵PID:3512
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#180⤵PID:4552
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#181⤵PID:4440
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#182⤵PID:400
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#183⤵PID:2212
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#184⤵PID:3924
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#185⤵PID:4776
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#186⤵PID:244
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#187⤵PID:4660
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#188⤵PID:4068
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#189⤵PID:4832
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#190⤵PID:4328
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#191⤵PID:4488
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#192⤵PID:2128
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#193⤵PID:3020
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#194⤵PID:1772
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#195⤵PID:980
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#196⤵PID:3952
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#197⤵PID:3112
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#198⤵PID:3764
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#199⤵PID:3308
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#1100⤵PID:5084
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#1101⤵PID:872
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#1102⤵PID:3552
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#1103⤵PID:4108
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#1104⤵PID:3212
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#1105⤵PID:3612
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#1106⤵PID:3312
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#1107⤵PID:3700
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#1108⤵PID:1504
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#1109⤵PID:4144
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#1110⤵PID:1868
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#1111⤵PID:4840
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#1112⤵PID:548
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#1113⤵PID:5124
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#1114⤵PID:5140
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#1115⤵PID:5156
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#1116⤵PID:5172
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#1117⤵PID:5188
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#1118⤵PID:5204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#1119⤵PID:5216
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#1120⤵PID:5232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#1121⤵PID:5248
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4967a971f16fdae1b8fbfe74621162da_JaffaCakes118.dll,#1122⤵PID:5264
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-