Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2024, 23:14
Static task
static1
Behavioral task
behavioral1
Sample
65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll
-
Size
16KB
-
MD5
65305c54851fcc6b87c05c8a0ae1f585
-
SHA1
1f5e77dd7de3cafc80e0df5e6241780706ecfdb5
-
SHA256
06de8665df0346a0f5dc8d20c1c4a5d182420d2b3ceb1f9dc8e0f247e53de8d7
-
SHA512
66665a7f817fc240d6a2844b97b6cba3774fe584ba18e8ea510ed1d84d4c564ab4a0d24df59a206568b103715c6107f28510c45bdff0541e5c429e9a29539e97
-
SSDEEP
384:pO+IirYOgmA9x2ojy0+kjzjhUlmbuDJihqSHuJWN7uCiCfOze:pKiOtxAGfhUlvDJuJHue
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 620 wrote to memory of 1344 620 rundll32.exe 84 PID 620 wrote to memory of 1344 620 rundll32.exe 84 PID 620 wrote to memory of 1344 620 rundll32.exe 84 PID 1344 wrote to memory of 2164 1344 rundll32.exe 85 PID 1344 wrote to memory of 2164 1344 rundll32.exe 85 PID 1344 wrote to memory of 2164 1344 rundll32.exe 85 PID 2164 wrote to memory of 3524 2164 rundll32.exe 86 PID 2164 wrote to memory of 3524 2164 rundll32.exe 86 PID 2164 wrote to memory of 3524 2164 rundll32.exe 86 PID 3524 wrote to memory of 3900 3524 rundll32.exe 87 PID 3524 wrote to memory of 3900 3524 rundll32.exe 87 PID 3524 wrote to memory of 3900 3524 rundll32.exe 87 PID 3900 wrote to memory of 1520 3900 rundll32.exe 88 PID 3900 wrote to memory of 1520 3900 rundll32.exe 88 PID 3900 wrote to memory of 1520 3900 rundll32.exe 88 PID 1520 wrote to memory of 1496 1520 rundll32.exe 89 PID 1520 wrote to memory of 1496 1520 rundll32.exe 89 PID 1520 wrote to memory of 1496 1520 rundll32.exe 89 PID 1496 wrote to memory of 1412 1496 rundll32.exe 90 PID 1496 wrote to memory of 1412 1496 rundll32.exe 90 PID 1496 wrote to memory of 1412 1496 rundll32.exe 90 PID 1412 wrote to memory of 3808 1412 rundll32.exe 91 PID 1412 wrote to memory of 3808 1412 rundll32.exe 91 PID 1412 wrote to memory of 3808 1412 rundll32.exe 91 PID 3808 wrote to memory of 3932 3808 rundll32.exe 92 PID 3808 wrote to memory of 3932 3808 rundll32.exe 92 PID 3808 wrote to memory of 3932 3808 rundll32.exe 92 PID 3932 wrote to memory of 4560 3932 rundll32.exe 93 PID 3932 wrote to memory of 4560 3932 rundll32.exe 93 PID 3932 wrote to memory of 4560 3932 rundll32.exe 93 PID 4560 wrote to memory of 4900 4560 rundll32.exe 94 PID 4560 wrote to memory of 4900 4560 rundll32.exe 94 PID 4560 wrote to memory of 4900 4560 rundll32.exe 94 PID 4900 wrote to memory of 4332 4900 rundll32.exe 95 PID 4900 wrote to memory of 4332 4900 rundll32.exe 95 PID 4900 wrote to memory of 4332 4900 rundll32.exe 95 PID 4332 wrote to memory of 3456 4332 rundll32.exe 96 PID 4332 wrote to memory of 3456 4332 rundll32.exe 96 PID 4332 wrote to memory of 3456 4332 rundll32.exe 96 PID 3456 wrote to memory of 1008 3456 rundll32.exe 97 PID 3456 wrote to memory of 1008 3456 rundll32.exe 97 PID 3456 wrote to memory of 1008 3456 rundll32.exe 97 PID 1008 wrote to memory of 228 1008 rundll32.exe 99 PID 1008 wrote to memory of 228 1008 rundll32.exe 99 PID 1008 wrote to memory of 228 1008 rundll32.exe 99 PID 228 wrote to memory of 1108 228 rundll32.exe 100 PID 228 wrote to memory of 1108 228 rundll32.exe 100 PID 228 wrote to memory of 1108 228 rundll32.exe 100 PID 1108 wrote to memory of 3204 1108 rundll32.exe 101 PID 1108 wrote to memory of 3204 1108 rundll32.exe 101 PID 1108 wrote to memory of 3204 1108 rundll32.exe 101 PID 3204 wrote to memory of 4944 3204 rundll32.exe 102 PID 3204 wrote to memory of 4944 3204 rundll32.exe 102 PID 3204 wrote to memory of 4944 3204 rundll32.exe 102 PID 4944 wrote to memory of 948 4944 rundll32.exe 103 PID 4944 wrote to memory of 948 4944 rundll32.exe 103 PID 4944 wrote to memory of 948 4944 rundll32.exe 103 PID 948 wrote to memory of 3944 948 rundll32.exe 104 PID 948 wrote to memory of 3944 948 rundll32.exe 104 PID 948 wrote to memory of 3944 948 rundll32.exe 104 PID 3944 wrote to memory of 3680 3944 rundll32.exe 105 PID 3944 wrote to memory of 3680 3944 rundll32.exe 105 PID 3944 wrote to memory of 3680 3944 rundll32.exe 105 PID 3680 wrote to memory of 2416 3680 rundll32.exe 107
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#123⤵PID:2416
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#124⤵PID:3228
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#125⤵PID:2360
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#126⤵PID:2472
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#127⤵PID:4400
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#128⤵PID:2964
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#129⤵PID:4328
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#130⤵PID:2436
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#131⤵PID:1536
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#132⤵PID:2592
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#133⤵PID:2088
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#134⤵PID:4988
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#135⤵PID:2988
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#136⤵PID:4112
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#137⤵PID:4024
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#138⤵PID:4128
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#139⤵PID:1244
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#140⤵PID:1628
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#141⤵PID:1424
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#142⤵PID:2944
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#143⤵PID:2052
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#144⤵PID:2344
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#145⤵PID:4060
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#146⤵PID:1832
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#147⤵PID:2032
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#148⤵PID:2464
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#149⤵PID:2320
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#150⤵PID:4340
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#151⤵PID:4652
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#152⤵PID:3848
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#153⤵PID:3720
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#154⤵PID:3208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#155⤵PID:2368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#156⤵PID:2372
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#157⤵PID:1232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#158⤵PID:4028
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#159⤵PID:2816
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#160⤵PID:2840
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#161⤵PID:1920
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#162⤵PID:4132
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#163⤵PID:2612
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#164⤵PID:1632
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#165⤵PID:2808
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#166⤵PID:2636
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#167⤵PID:2888
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#168⤵PID:5092
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#169⤵PID:3608
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#170⤵PID:3032
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#171⤵PID:1136
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#172⤵PID:3748
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#173⤵PID:2196
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#174⤵PID:3904
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#175⤵PID:4600
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#176⤵PID:4008
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#177⤵PID:2960
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#178⤵PID:2136
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#179⤵PID:2040
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#180⤵PID:4320
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#181⤵PID:3556
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#182⤵PID:3500
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#183⤵PID:4004
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#184⤵PID:3416
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#185⤵PID:3316
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#186⤵PID:4304
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#187⤵PID:3404
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#188⤵PID:4052
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#189⤵PID:2096
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#190⤵PID:3700
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#191⤵PID:604
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#192⤵PID:1592
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#193⤵PID:2480
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#194⤵PID:4868
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#195⤵PID:4640
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#196⤵PID:3468
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#197⤵PID:4508
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#198⤵PID:3336
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#199⤵PID:3192
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#1100⤵PID:216
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#1101⤵PID:1564
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#1102⤵PID:2280
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#1103⤵PID:4492
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#1104⤵PID:2624
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#1105⤵PID:4516
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#1106⤵PID:3436
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#1107⤵PID:2692
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#1108⤵PID:4644
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#1109⤵PID:3960
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#1110⤵PID:2116
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#1111⤵PID:2924
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#1112⤵PID:904
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#1113⤵PID:2140
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#1114⤵PID:5128
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#1115⤵PID:5144
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#1116⤵PID:5160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#1117⤵PID:5196
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#1118⤵PID:5216
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#1119⤵PID:5232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#1120⤵PID:5248
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#1121⤵PID:5264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65305c54851fcc6b87c05c8a0ae1f585_JaffaCakes118.dll,#1122⤵PID:5276
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-