Analysis
-
max time kernel
141s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2024, 15:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll
Resource
win7-20240708-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll
Resource
win10v2004-20240709-en
1 signatures
150 seconds
General
-
Target
63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll
-
Size
62KB
-
MD5
63c372007334941c504ae03c8fbe85e7
-
SHA1
35a308d7238fb2783289dfa6500906eb9e16afa5
-
SHA256
42f306546865400924aaadd6b5ef6fcc2567fcd6ff527a0e23cfa6db9b38539f
-
SHA512
b3125eba6f7e7b772d4d317b14e06689cb61ccc1cf2d247b0c7193e9584b93f579950dc641963e87b15eff465c093418a78dca3cdd05e21f30f23801401794ef
-
SSDEEP
768:x4aq5rvM8tBPT8198dXnr3R0mr7lyYzoiy325xhgwqBFW+L7C0T/Wx7sS:GaSvM828FnKA7sYzoiy6GwUL7CgumS
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2956 wrote to memory of 4284 2956 rundll32.exe 84 PID 2956 wrote to memory of 4284 2956 rundll32.exe 84 PID 2956 wrote to memory of 4284 2956 rundll32.exe 84 PID 4284 wrote to memory of 4776 4284 rundll32.exe 85 PID 4284 wrote to memory of 4776 4284 rundll32.exe 85 PID 4284 wrote to memory of 4776 4284 rundll32.exe 85 PID 4776 wrote to memory of 4760 4776 rundll32.exe 86 PID 4776 wrote to memory of 4760 4776 rundll32.exe 86 PID 4776 wrote to memory of 4760 4776 rundll32.exe 86 PID 4760 wrote to memory of 988 4760 rundll32.exe 87 PID 4760 wrote to memory of 988 4760 rundll32.exe 87 PID 4760 wrote to memory of 988 4760 rundll32.exe 87 PID 988 wrote to memory of 3660 988 rundll32.exe 88 PID 988 wrote to memory of 3660 988 rundll32.exe 88 PID 988 wrote to memory of 3660 988 rundll32.exe 88 PID 3660 wrote to memory of 1876 3660 rundll32.exe 89 PID 3660 wrote to memory of 1876 3660 rundll32.exe 89 PID 3660 wrote to memory of 1876 3660 rundll32.exe 89 PID 1876 wrote to memory of 4368 1876 rundll32.exe 90 PID 1876 wrote to memory of 4368 1876 rundll32.exe 90 PID 1876 wrote to memory of 4368 1876 rundll32.exe 90 PID 4368 wrote to memory of 756 4368 rundll32.exe 91 PID 4368 wrote to memory of 756 4368 rundll32.exe 91 PID 4368 wrote to memory of 756 4368 rundll32.exe 91 PID 756 wrote to memory of 4600 756 rundll32.exe 92 PID 756 wrote to memory of 4600 756 rundll32.exe 92 PID 756 wrote to memory of 4600 756 rundll32.exe 92 PID 4600 wrote to memory of 3744 4600 rundll32.exe 93 PID 4600 wrote to memory of 3744 4600 rundll32.exe 93 PID 4600 wrote to memory of 3744 4600 rundll32.exe 93 PID 3744 wrote to memory of 2264 3744 rundll32.exe 94 PID 3744 wrote to memory of 2264 3744 rundll32.exe 94 PID 3744 wrote to memory of 2264 3744 rundll32.exe 94 PID 2264 wrote to memory of 3532 2264 rundll32.exe 95 PID 2264 wrote to memory of 3532 2264 rundll32.exe 95 PID 2264 wrote to memory of 3532 2264 rundll32.exe 95 PID 3532 wrote to memory of 4260 3532 rundll32.exe 96 PID 3532 wrote to memory of 4260 3532 rundll32.exe 96 PID 3532 wrote to memory of 4260 3532 rundll32.exe 96 PID 4260 wrote to memory of 1840 4260 rundll32.exe 97 PID 4260 wrote to memory of 1840 4260 rundll32.exe 97 PID 4260 wrote to memory of 1840 4260 rundll32.exe 97 PID 1840 wrote to memory of 4912 1840 rundll32.exe 99 PID 1840 wrote to memory of 4912 1840 rundll32.exe 99 PID 1840 wrote to memory of 4912 1840 rundll32.exe 99 PID 4912 wrote to memory of 3052 4912 rundll32.exe 100 PID 4912 wrote to memory of 3052 4912 rundll32.exe 100 PID 4912 wrote to memory of 3052 4912 rundll32.exe 100 PID 3052 wrote to memory of 3964 3052 rundll32.exe 101 PID 3052 wrote to memory of 3964 3052 rundll32.exe 101 PID 3052 wrote to memory of 3964 3052 rundll32.exe 101 PID 3964 wrote to memory of 1052 3964 rundll32.exe 102 PID 3964 wrote to memory of 1052 3964 rundll32.exe 102 PID 3964 wrote to memory of 1052 3964 rundll32.exe 102 PID 1052 wrote to memory of 2132 1052 rundll32.exe 103 PID 1052 wrote to memory of 2132 1052 rundll32.exe 103 PID 1052 wrote to memory of 2132 1052 rundll32.exe 103 PID 2132 wrote to memory of 2400 2132 rundll32.exe 104 PID 2132 wrote to memory of 2400 2132 rundll32.exe 104 PID 2132 wrote to memory of 2400 2132 rundll32.exe 104 PID 2400 wrote to memory of 3616 2400 rundll32.exe 106 PID 2400 wrote to memory of 3616 2400 rundll32.exe 106 PID 2400 wrote to memory of 3616 2400 rundll32.exe 106 PID 3616 wrote to memory of 216 3616 rundll32.exe 107
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#123⤵PID:216
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#124⤵PID:3588
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#125⤵PID:4100
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#126⤵PID:5040
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#127⤵PID:3844
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#128⤵PID:3120
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#129⤵PID:1448
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#130⤵PID:3452
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#131⤵PID:5020
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#132⤵PID:2904
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#133⤵PID:3032
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#134⤵PID:4460
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#135⤵PID:2596
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#136⤵PID:1468
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#137⤵PID:1600
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#138⤵PID:3040
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#139⤵PID:3060
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#140⤵PID:4244
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#141⤵PID:3696
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#142⤵PID:3480
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#143⤵PID:1556
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#144⤵PID:3236
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#145⤵PID:2160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#146⤵PID:4868
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#147⤵PID:2876
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#148⤵PID:3412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#149⤵PID:2912
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#150⤵PID:2220
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#151⤵PID:2716
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#152⤵PID:1356
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#153⤵PID:2060
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#154⤵PID:368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#155⤵PID:4520
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#156⤵PID:2128
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#157⤵PID:2848
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#158⤵PID:4060
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#159⤵PID:3628
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#160⤵PID:804
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#161⤵PID:2964
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#162⤵PID:2540
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#163⤵PID:1808
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#164⤵PID:3260
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#165⤵PID:1756
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#166⤵PID:348
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#167⤵PID:1276
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#168⤵PID:2380
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#169⤵PID:3912
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#170⤵PID:964
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#171⤵PID:1684
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#172⤵PID:1580
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#173⤵PID:2832
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#174⤵PID:1856
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#175⤵PID:1036
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#176⤵PID:3496
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#177⤵PID:4432
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#178⤵PID:4536
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#179⤵PID:4716
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#180⤵PID:4268
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#181⤵PID:456
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#182⤵PID:3708
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#183⤵PID:3168
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#184⤵PID:2772
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#185⤵PID:400
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#186⤵PID:2248
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#187⤵PID:3472
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#188⤵PID:4604
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#189⤵PID:4356
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#190⤵PID:4472
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#191⤵PID:2764
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#192⤵PID:3932
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#193⤵PID:3676
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#194⤵PID:4620
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#195⤵PID:3556
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#196⤵PID:3300
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#197⤵PID:2768
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#198⤵PID:3716
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#199⤵PID:3724
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#1100⤵PID:4480
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#1101⤵PID:3688
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#1102⤵PID:2704
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#1103⤵PID:4704
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#1104⤵PID:2888
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#1105⤵PID:2860
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#1106⤵PID:3832
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#1107⤵PID:4524
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#1108⤵PID:2640
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#1109⤵PID:5128
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#1110⤵PID:5148
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#1111⤵PID:5160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#1112⤵PID:5180
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#1113⤵PID:5196
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#1114⤵PID:5212
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#1115⤵PID:5236
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#1116⤵PID:5268
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#1117⤵PID:5304
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#1118⤵PID:5320
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#1119⤵PID:5332
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#1120⤵PID:5344
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#1121⤵PID:5356
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63c372007334941c504ae03c8fbe85e7_JaffaCakes118.dll,#1122⤵PID:5372
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-