Analysis
-
max time kernel
136s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
19/07/2024, 00:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll
Resource
win7-20240705-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll
Resource
win10v2004-20240709-en
1 signatures
150 seconds
General
-
Target
59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll
-
Size
235KB
-
MD5
59a584e68c2efcbd00685361f430a612
-
SHA1
2ac8fb1454766c4a4130f5e73af09063b2a8fde5
-
SHA256
dca203663913ba6b6ed1fedd9acf117c990cb60be8017e22af8513b9e2782799
-
SHA512
fe39ed97cf3a23e9d05f6c3bdfc83619b13703dee1d286e4ffaf0f4e2958ab38ce6998f59a96b499f2ad8df5ec08a96e4fe0ad973e25fee22613b9a5a62199eb
-
SSDEEP
3072:3pR/j8Mui4vNaJZEVU67FC52k99geYK4W6mHHvv7VCirTcmS5AIg01+WpgXXDrcP:5ecdZElQ52klB4WLH7785dzVCaxNl8u/
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2528 wrote to memory of 4732 2528 rundll32.exe 85 PID 2528 wrote to memory of 4732 2528 rundll32.exe 85 PID 2528 wrote to memory of 4732 2528 rundll32.exe 85 PID 4732 wrote to memory of 1516 4732 rundll32.exe 86 PID 4732 wrote to memory of 1516 4732 rundll32.exe 86 PID 4732 wrote to memory of 1516 4732 rundll32.exe 86 PID 1516 wrote to memory of 2040 1516 rundll32.exe 87 PID 1516 wrote to memory of 2040 1516 rundll32.exe 87 PID 1516 wrote to memory of 2040 1516 rundll32.exe 87 PID 2040 wrote to memory of 1384 2040 rundll32.exe 88 PID 2040 wrote to memory of 1384 2040 rundll32.exe 88 PID 2040 wrote to memory of 1384 2040 rundll32.exe 88 PID 1384 wrote to memory of 1064 1384 rundll32.exe 89 PID 1384 wrote to memory of 1064 1384 rundll32.exe 89 PID 1384 wrote to memory of 1064 1384 rundll32.exe 89 PID 1064 wrote to memory of 1376 1064 rundll32.exe 90 PID 1064 wrote to memory of 1376 1064 rundll32.exe 90 PID 1064 wrote to memory of 1376 1064 rundll32.exe 90 PID 1376 wrote to memory of 4460 1376 rundll32.exe 91 PID 1376 wrote to memory of 4460 1376 rundll32.exe 91 PID 1376 wrote to memory of 4460 1376 rundll32.exe 91 PID 4460 wrote to memory of 3292 4460 rundll32.exe 92 PID 4460 wrote to memory of 3292 4460 rundll32.exe 92 PID 4460 wrote to memory of 3292 4460 rundll32.exe 92 PID 3292 wrote to memory of 988 3292 rundll32.exe 93 PID 3292 wrote to memory of 988 3292 rundll32.exe 93 PID 3292 wrote to memory of 988 3292 rundll32.exe 93 PID 988 wrote to memory of 1504 988 rundll32.exe 94 PID 988 wrote to memory of 1504 988 rundll32.exe 94 PID 988 wrote to memory of 1504 988 rundll32.exe 94 PID 1504 wrote to memory of 2780 1504 rundll32.exe 95 PID 1504 wrote to memory of 2780 1504 rundll32.exe 95 PID 1504 wrote to memory of 2780 1504 rundll32.exe 95 PID 2780 wrote to memory of 3056 2780 rundll32.exe 96 PID 2780 wrote to memory of 3056 2780 rundll32.exe 96 PID 2780 wrote to memory of 3056 2780 rundll32.exe 96 PID 3056 wrote to memory of 2072 3056 rundll32.exe 97 PID 3056 wrote to memory of 2072 3056 rundll32.exe 97 PID 3056 wrote to memory of 2072 3056 rundll32.exe 97 PID 2072 wrote to memory of 2432 2072 rundll32.exe 98 PID 2072 wrote to memory of 2432 2072 rundll32.exe 98 PID 2072 wrote to memory of 2432 2072 rundll32.exe 98 PID 2432 wrote to memory of 3560 2432 rundll32.exe 99 PID 2432 wrote to memory of 3560 2432 rundll32.exe 99 PID 2432 wrote to memory of 3560 2432 rundll32.exe 99 PID 3560 wrote to memory of 4312 3560 rundll32.exe 100 PID 3560 wrote to memory of 4312 3560 rundll32.exe 100 PID 3560 wrote to memory of 4312 3560 rundll32.exe 100 PID 4312 wrote to memory of 2776 4312 rundll32.exe 101 PID 4312 wrote to memory of 2776 4312 rundll32.exe 101 PID 4312 wrote to memory of 2776 4312 rundll32.exe 101 PID 2776 wrote to memory of 4508 2776 rundll32.exe 102 PID 2776 wrote to memory of 4508 2776 rundll32.exe 102 PID 2776 wrote to memory of 4508 2776 rundll32.exe 102 PID 4508 wrote to memory of 4276 4508 rundll32.exe 103 PID 4508 wrote to memory of 4276 4508 rundll32.exe 103 PID 4508 wrote to memory of 4276 4508 rundll32.exe 103 PID 4276 wrote to memory of 4152 4276 rundll32.exe 104 PID 4276 wrote to memory of 4152 4276 rundll32.exe 104 PID 4276 wrote to memory of 4152 4276 rundll32.exe 104 PID 4152 wrote to memory of 2884 4152 rundll32.exe 105 PID 4152 wrote to memory of 2884 4152 rundll32.exe 105 PID 4152 wrote to memory of 2884 4152 rundll32.exe 105 PID 2884 wrote to memory of 1732 2884 rundll32.exe 106
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#123⤵PID:1732
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#124⤵PID:4720
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#125⤵PID:1560
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#126⤵PID:2448
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#127⤵PID:3676
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#128⤵PID:2916
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#129⤵PID:2460
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#130⤵PID:2360
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#131⤵PID:1592
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#132⤵PID:4700
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#133⤵PID:3888
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#134⤵PID:740
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#135⤵PID:3848
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#136⤵PID:1576
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#137⤵PID:1644
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#138⤵PID:2240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#139⤵PID:3976
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#140⤵PID:4668
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#141⤵PID:632
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#142⤵PID:1804
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#143⤵PID:4100
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#144⤵PID:2784
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#145⤵PID:2024
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#146⤵PID:2620
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#147⤵PID:1096
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#148⤵PID:2308
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#149⤵PID:3524
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#150⤵PID:3324
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#151⤵PID:1040
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#152⤵PID:3356
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#153⤵PID:4532
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#154⤵PID:4648
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#155⤵PID:2032
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#156⤵PID:3936
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#157⤵PID:2420
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#158⤵PID:5100
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#159⤵PID:956
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#160⤵PID:1088
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#161⤵PID:1692
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#162⤵PID:3824
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#163⤵PID:1612
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#164⤵PID:220
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#165⤵PID:2052
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#166⤵PID:2180
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#167⤵PID:3932
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#168⤵PID:3696
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#169⤵PID:4776
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#170⤵PID:1060
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#171⤵PID:3988
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#172⤵PID:1996
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#173⤵PID:5072
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#174⤵PID:4504
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#175⤵PID:368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#176⤵PID:4608
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#177⤵PID:2640
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#178⤵PID:4704
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#179⤵PID:2688
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#180⤵PID:4156
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#181⤵PID:2436
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#182⤵PID:4536
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#183⤵PID:4568
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#184⤵PID:2016
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#185⤵PID:440
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#186⤵PID:4988
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#187⤵PID:2972
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#188⤵PID:112
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#189⤵PID:540
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#190⤵PID:4604
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#191⤵PID:2008
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#192⤵PID:4444
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#193⤵PID:4120
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#194⤵PID:4136
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#195⤵PID:4128
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#196⤵PID:5140
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#197⤵PID:5152
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#198⤵PID:5168
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#199⤵PID:5184
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#1100⤵PID:5204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#1101⤵PID:5216
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#1102⤵PID:5228
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#1103⤵PID:5244
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#1104⤵PID:5256
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#1105⤵PID:5272
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#1106⤵PID:5288
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#1107⤵PID:5304
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#1108⤵PID:5320
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#1109⤵PID:5340
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#1110⤵PID:5352
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#1111⤵PID:5384
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#1112⤵PID:5416
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#1113⤵PID:5444
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#1114⤵PID:5464
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#1115⤵PID:5480
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#1116⤵PID:5512
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#1117⤵PID:5532
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#1118⤵PID:5548
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#1119⤵PID:5572
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#1120⤵PID:5588
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#1121⤵PID:5612
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59a584e68c2efcbd00685361f430a612_JaffaCakes118.dll,#1122⤵PID:5624
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-