Analysis
-
max time kernel
111s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2022, 22:37
Behavioral task
behavioral1
Sample
1668-57-0x0000000000160000-0x0000000000182000-memory.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1668-57-0x0000000000160000-0x0000000000182000-memory.dll
Resource
win10v2004-20220812-en
General
-
Target
1668-57-0x0000000000160000-0x0000000000182000-memory.dll
-
Size
136KB
-
MD5
7c7b721ad4a481ac3aca9cafb9de37be
-
SHA1
d9cb5a24490fddd530e434634c6b4d90576ab7f3
-
SHA256
f0e76fb2b631554f0ce210b0edce39bab6f12ce9df027cb039096f1ca81b7ca8
-
SHA512
fbceb712d12721e72146c737357a60afc7cc945d7c511b82b978e812f1c1ce5ccf11838ba19fcccb5cd4d28b4fc73f77cc0f4ef93b0bcbf3568c0a2aae246690
-
SSDEEP
3072:24sJq26Cvn0sLSAIJ2aHUYtlTBfdUeZT:fCkCvnt3IJnHUUlTB17Z
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID dwm.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe -
Modifies data under HKEY_USERS 18 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeCreateGlobalPrivilege 17116 dwm.exe Token: SeChangeNotifyPrivilege 17116 dwm.exe Token: 33 17116 dwm.exe Token: SeIncBasePriorityPrivilege 17116 dwm.exe Token: SeShutdownPrivilege 17116 dwm.exe Token: SeCreatePagefilePrivilege 17116 dwm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1856 wrote to memory of 3484 1856 rundll32.exe 80 PID 1856 wrote to memory of 3484 1856 rundll32.exe 80 PID 1856 wrote to memory of 3484 1856 rundll32.exe 80 PID 3484 wrote to memory of 1080 3484 rundll32.exe 81 PID 3484 wrote to memory of 1080 3484 rundll32.exe 81 PID 3484 wrote to memory of 1080 3484 rundll32.exe 81 PID 1080 wrote to memory of 1172 1080 rundll32.exe 82 PID 1080 wrote to memory of 1172 1080 rundll32.exe 82 PID 1080 wrote to memory of 1172 1080 rundll32.exe 82 PID 1172 wrote to memory of 4924 1172 rundll32.exe 83 PID 1172 wrote to memory of 4924 1172 rundll32.exe 83 PID 1172 wrote to memory of 4924 1172 rundll32.exe 83 PID 4924 wrote to memory of 2860 4924 rundll32.exe 84 PID 4924 wrote to memory of 2860 4924 rundll32.exe 84 PID 4924 wrote to memory of 2860 4924 rundll32.exe 84 PID 2860 wrote to memory of 4824 2860 rundll32.exe 85 PID 2860 wrote to memory of 4824 2860 rundll32.exe 85 PID 2860 wrote to memory of 4824 2860 rundll32.exe 85 PID 4824 wrote to memory of 4880 4824 rundll32.exe 86 PID 4824 wrote to memory of 4880 4824 rundll32.exe 86 PID 4824 wrote to memory of 4880 4824 rundll32.exe 86 PID 4880 wrote to memory of 4896 4880 rundll32.exe 87 PID 4880 wrote to memory of 4896 4880 rundll32.exe 87 PID 4880 wrote to memory of 4896 4880 rundll32.exe 87 PID 4896 wrote to memory of 1628 4896 rundll32.exe 88 PID 4896 wrote to memory of 1628 4896 rundll32.exe 88 PID 4896 wrote to memory of 1628 4896 rundll32.exe 88 PID 1628 wrote to memory of 1340 1628 rundll32.exe 89 PID 1628 wrote to memory of 1340 1628 rundll32.exe 89 PID 1628 wrote to memory of 1340 1628 rundll32.exe 89 PID 1340 wrote to memory of 3508 1340 rundll32.exe 90 PID 1340 wrote to memory of 3508 1340 rundll32.exe 90 PID 1340 wrote to memory of 3508 1340 rundll32.exe 90 PID 3508 wrote to memory of 1240 3508 rundll32.exe 91 PID 3508 wrote to memory of 1240 3508 rundll32.exe 91 PID 3508 wrote to memory of 1240 3508 rundll32.exe 91 PID 1240 wrote to memory of 368 1240 rundll32.exe 92 PID 1240 wrote to memory of 368 1240 rundll32.exe 92 PID 1240 wrote to memory of 368 1240 rundll32.exe 92 PID 368 wrote to memory of 4580 368 rundll32.exe 93 PID 368 wrote to memory of 4580 368 rundll32.exe 93 PID 368 wrote to memory of 4580 368 rundll32.exe 93 PID 4580 wrote to memory of 4496 4580 rundll32.exe 94 PID 4580 wrote to memory of 4496 4580 rundll32.exe 94 PID 4580 wrote to memory of 4496 4580 rundll32.exe 94 PID 4496 wrote to memory of 1776 4496 rundll32.exe 95 PID 4496 wrote to memory of 1776 4496 rundll32.exe 95 PID 4496 wrote to memory of 1776 4496 rundll32.exe 95 PID 1776 wrote to memory of 3744 1776 rundll32.exe 96 PID 1776 wrote to memory of 3744 1776 rundll32.exe 96 PID 1776 wrote to memory of 3744 1776 rundll32.exe 96 PID 3744 wrote to memory of 2368 3744 rundll32.exe 97 PID 3744 wrote to memory of 2368 3744 rundll32.exe 97 PID 3744 wrote to memory of 2368 3744 rundll32.exe 97 PID 2368 wrote to memory of 2984 2368 rundll32.exe 98 PID 2368 wrote to memory of 2984 2368 rundll32.exe 98 PID 2368 wrote to memory of 2984 2368 rundll32.exe 98 PID 2984 wrote to memory of 1536 2984 rundll32.exe 99 PID 2984 wrote to memory of 1536 2984 rundll32.exe 99 PID 2984 wrote to memory of 1536 2984 rundll32.exe 99 PID 1536 wrote to memory of 3728 1536 rundll32.exe 100 PID 1536 wrote to memory of 3728 1536 rundll32.exe 100 PID 1536 wrote to memory of 3728 1536 rundll32.exe 100 PID 3728 wrote to memory of 2124 3728 rundll32.exe 101
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#123⤵PID:2124
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#124⤵PID:2204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#125⤵PID:4620
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#126⤵PID:1936
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#127⤵PID:2612
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#128⤵PID:2604
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#129⤵PID:2796
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#130⤵PID:1252
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#131⤵PID:4936
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#132⤵PID:4592
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#133⤵PID:488
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#134⤵PID:3988
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#135⤵PID:1292
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#136⤵PID:3672
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#137⤵PID:928
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#138⤵PID:1948
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#139⤵PID:4308
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#140⤵PID:2044
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#141⤵PID:4380
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#142⤵PID:4536
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#143⤵PID:3416
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#144⤵PID:964
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#145⤵PID:1416
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#146⤵PID:3496
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#147⤵PID:1700
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#148⤵PID:5092
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#149⤵PID:1768
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#150⤵PID:3572
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#151⤵PID:4840
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#152⤵PID:3204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#153⤵PID:2112
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#154⤵PID:2404
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#155⤵PID:3860
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#156⤵PID:1012
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#157⤵PID:2036
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#158⤵PID:4520
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#159⤵PID:4716
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#160⤵PID:2172
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#161⤵PID:2884
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#162⤵PID:3980
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#163⤵PID:5104
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#164⤵PID:2304
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#165⤵PID:5012
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#166⤵PID:2776
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#167⤵PID:1860
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#168⤵PID:2284
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#169⤵PID:744
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#170⤵PID:4240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#171⤵PID:4984
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#172⤵PID:2052
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#173⤵PID:3356
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#174⤵PID:868
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#175⤵PID:2972
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#176⤵PID:2572
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#177⤵PID:4228
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#178⤵PID:2528
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#179⤵PID:1376
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#180⤵PID:3592
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#181⤵PID:2616
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#182⤵PID:4608
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#183⤵PID:2236
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#184⤵PID:2224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#185⤵PID:4952
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#186⤵PID:3172
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#187⤵PID:3148
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#188⤵PID:396
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#189⤵PID:3316
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#190⤵PID:5080
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#191⤵PID:1364
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#192⤵PID:4444
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#193⤵PID:4368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#194⤵PID:1164
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#195⤵PID:4996
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#196⤵PID:4316
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#197⤵PID:4860
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#198⤵PID:2772
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#199⤵PID:4068
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#1100⤵PID:2692
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#1101⤵PID:4272
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#1102⤵PID:4180
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#1103⤵PID:4704
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#1104⤵PID:4932
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#1105⤵PID:4904
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#1106⤵PID:1644
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#1107⤵PID:1624
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#1108⤵PID:1552
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#1109⤵PID:4372
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#1110⤵PID:1092
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#1111⤵PID:3684
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#1112⤵PID:2492
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#1113⤵PID:2480
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#1114⤵PID:332
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#1115⤵PID:2180
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#1116⤵PID:3656
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#1117⤵PID:1892
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#1118⤵PID:1932
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#1119⤵PID:5084
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#1120⤵PID:1312
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#1121⤵PID:4196
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#1122⤵PID:2496
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-