Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27/12/2022, 21:24
Behavioral task
behavioral1
Sample
1704-57-0x0000000000140000-0x0000000000162000-memory.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1704-57-0x0000000000140000-0x0000000000162000-memory.dll
Resource
win10v2004-20220812-en
General
-
Target
1704-57-0x0000000000140000-0x0000000000162000-memory.dll
-
Size
136KB
-
MD5
919b138b7d6545735f91ab485bfbde37
-
SHA1
66de5e28ef0c86cfae6e15f6a21742125286c5fa
-
SHA256
c243df1a82755fa05aa27fbcead17863a78dee1874b6d575998dc67c60a59c83
-
SHA512
51e76ac08fa65f900c86d6a27ed42531fa5e72f09aab30203a4feff806e353cc362fa311bc9f341634b7ba28f49fa60ca36265c2541ad4326bc25cf434df1a60
-
SSDEEP
1536:MCf1pg43ZwsCJ28qerxgmtszKiSMQhABArbMJNq0ecUIOpnToIfp9cegrzst:MCmTqETtsxOgAkJA0L6BTBfpWept
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4612 wrote to memory of 1388 4612 rundll32.exe 80 PID 4612 wrote to memory of 1388 4612 rundll32.exe 80 PID 4612 wrote to memory of 1388 4612 rundll32.exe 80 PID 1388 wrote to memory of 3500 1388 rundll32.exe 81 PID 1388 wrote to memory of 3500 1388 rundll32.exe 81 PID 1388 wrote to memory of 3500 1388 rundll32.exe 81 PID 3500 wrote to memory of 2176 3500 rundll32.exe 82 PID 3500 wrote to memory of 2176 3500 rundll32.exe 82 PID 3500 wrote to memory of 2176 3500 rundll32.exe 82 PID 2176 wrote to memory of 5024 2176 rundll32.exe 83 PID 2176 wrote to memory of 5024 2176 rundll32.exe 83 PID 2176 wrote to memory of 5024 2176 rundll32.exe 83 PID 5024 wrote to memory of 320 5024 rundll32.exe 84 PID 5024 wrote to memory of 320 5024 rundll32.exe 84 PID 5024 wrote to memory of 320 5024 rundll32.exe 84 PID 320 wrote to memory of 3776 320 rundll32.exe 85 PID 320 wrote to memory of 3776 320 rundll32.exe 85 PID 320 wrote to memory of 3776 320 rundll32.exe 85 PID 3776 wrote to memory of 1432 3776 rundll32.exe 86 PID 3776 wrote to memory of 1432 3776 rundll32.exe 86 PID 3776 wrote to memory of 1432 3776 rundll32.exe 86 PID 1432 wrote to memory of 4396 1432 rundll32.exe 87 PID 1432 wrote to memory of 4396 1432 rundll32.exe 87 PID 1432 wrote to memory of 4396 1432 rundll32.exe 87 PID 4396 wrote to memory of 844 4396 rundll32.exe 88 PID 4396 wrote to memory of 844 4396 rundll32.exe 88 PID 4396 wrote to memory of 844 4396 rundll32.exe 88 PID 844 wrote to memory of 2112 844 rundll32.exe 89 PID 844 wrote to memory of 2112 844 rundll32.exe 89 PID 844 wrote to memory of 2112 844 rundll32.exe 89 PID 2112 wrote to memory of 4616 2112 rundll32.exe 90 PID 2112 wrote to memory of 4616 2112 rundll32.exe 90 PID 2112 wrote to memory of 4616 2112 rundll32.exe 90 PID 4616 wrote to memory of 5076 4616 rundll32.exe 91 PID 4616 wrote to memory of 5076 4616 rundll32.exe 91 PID 4616 wrote to memory of 5076 4616 rundll32.exe 91 PID 5076 wrote to memory of 4300 5076 rundll32.exe 92 PID 5076 wrote to memory of 4300 5076 rundll32.exe 92 PID 5076 wrote to memory of 4300 5076 rundll32.exe 92 PID 4300 wrote to memory of 3572 4300 rundll32.exe 93 PID 4300 wrote to memory of 3572 4300 rundll32.exe 93 PID 4300 wrote to memory of 3572 4300 rundll32.exe 93 PID 3572 wrote to memory of 4984 3572 rundll32.exe 94 PID 3572 wrote to memory of 4984 3572 rundll32.exe 94 PID 3572 wrote to memory of 4984 3572 rundll32.exe 94 PID 4984 wrote to memory of 2360 4984 rundll32.exe 95 PID 4984 wrote to memory of 2360 4984 rundll32.exe 95 PID 4984 wrote to memory of 2360 4984 rundll32.exe 95 PID 2360 wrote to memory of 2292 2360 rundll32.exe 96 PID 2360 wrote to memory of 2292 2360 rundll32.exe 96 PID 2360 wrote to memory of 2292 2360 rundll32.exe 96 PID 2292 wrote to memory of 3348 2292 rundll32.exe 97 PID 2292 wrote to memory of 3348 2292 rundll32.exe 97 PID 2292 wrote to memory of 3348 2292 rundll32.exe 97 PID 3348 wrote to memory of 4620 3348 rundll32.exe 98 PID 3348 wrote to memory of 4620 3348 rundll32.exe 98 PID 3348 wrote to memory of 4620 3348 rundll32.exe 98 PID 4620 wrote to memory of 1112 4620 rundll32.exe 99 PID 4620 wrote to memory of 1112 4620 rundll32.exe 99 PID 4620 wrote to memory of 1112 4620 rundll32.exe 99 PID 1112 wrote to memory of 4608 1112 rundll32.exe 100 PID 1112 wrote to memory of 4608 1112 rundll32.exe 100 PID 1112 wrote to memory of 4608 1112 rundll32.exe 100 PID 4608 wrote to memory of 512 4608 rundll32.exe 101
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#123⤵PID:512
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#124⤵PID:1720
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#125⤵PID:4496
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#126⤵PID:2648
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#127⤵PID:3180
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#128⤵PID:368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#129⤵PID:4292
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#130⤵PID:2732
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#131⤵PID:3412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#132⤵PID:4604
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#133⤵PID:3392
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#134⤵PID:3368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#135⤵PID:112
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#136⤵PID:228
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#137⤵PID:2260
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#138⤵PID:4700
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#139⤵PID:3296
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#140⤵PID:3964
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#141⤵PID:2760
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#142⤵PID:3932
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#143⤵PID:3788
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#144⤵PID:4856
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#145⤵PID:1344
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#146⤵PID:1256
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#147⤵PID:3808
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#148⤵PID:1904
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#149⤵PID:340
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#150⤵PID:992
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#151⤵PID:4936
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#152⤵PID:1244
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#153⤵PID:3208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#154⤵PID:3936
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#155⤵PID:2804
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#156⤵PID:1308
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#157⤵PID:3128
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#158⤵PID:4660
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#159⤵PID:4540
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#160⤵PID:3136
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#161⤵PID:3056
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#162⤵PID:716
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#163⤵PID:1580
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#164⤵PID:2168
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#165⤵PID:3036
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#166⤵PID:3592
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#167⤵PID:3016
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#168⤵PID:2084
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#169⤵PID:532
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#170⤵PID:3856
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#171⤵PID:4408
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#172⤵PID:4456
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#173⤵PID:4672
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#174⤵PID:1288
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#175⤵PID:4304
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#176⤵PID:4696
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#177⤵PID:2392
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#178⤵PID:4744
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#179⤵PID:2240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#180⤵PID:3980
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#181⤵PID:2348
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#182⤵PID:3704
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#183⤵PID:980
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#184⤵PID:3512
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#185⤵PID:4784
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#186⤵PID:544
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#187⤵PID:3120
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#188⤵PID:1488
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#189⤵PID:2960
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#190⤵PID:820
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#191⤵PID:2628
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#192⤵PID:4024
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#193⤵PID:4060
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#194⤵PID:2252
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#195⤵PID:1484
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#196⤵PID:1492
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#197⤵PID:5032
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#198⤵PID:5056
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#199⤵PID:4760
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#1100⤵PID:1704
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#1101⤵PID:3600
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#1102⤵PID:1032
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#1103⤵PID:1316
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#1104⤵PID:1176
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#1105⤵PID:176
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#1106⤵PID:216
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#1107⤵PID:1136
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#1108⤵PID:1128
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#1109⤵PID:4736
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#1110⤵PID:3988
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#1111⤵PID:4632
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#1112⤵PID:1332
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#1113⤵PID:664
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#1114⤵PID:2208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#1115⤵PID:1712
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#1116⤵PID:4564
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#1117⤵PID:404
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#1118⤵PID:1076
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#1119⤵PID:2276
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#1120⤵PID:4152
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#1121⤵PID:1512
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000000140000-0x0000000000162000-memory.dll,#1122⤵PID:4492
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-