Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
67s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
26/04/2023, 11:25
Behavioral task
behavioral1
Sample
1376-54-0x0000000010000000-0x0000000010015000-memory.dll
Resource
win7-20230220-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
1376-54-0x0000000010000000-0x0000000010015000-memory.dll
Resource
win10v2004-20230220-en
1 signatures
150 seconds
General
-
Target
1376-54-0x0000000010000000-0x0000000010015000-memory.dll
-
Size
84KB
-
MD5
ae9212b9676494d2b0c5d130f3563c17
-
SHA1
8a11f7c7962bdad4650f4f213c8686468b2a7a5b
-
SHA256
74c8d1e6a13ce450a783ebfc0a5c326fd9c3dc38aa8c3c81ae8d5a0d30df3e2a
-
SHA512
81bfc1a489ca4e092d8a8ec93a0fee1c3b7fe3c514ed2d67783d6cfdcbf3b1d88054a1f7d2f233de1d3b10a330bb358ac6bbf29b181265fa51cc025c3fbb2875
-
SSDEEP
1536:iTsenhY8kwtuwL7hSm1RhoIOdnToIfAUfegGHE:SsEY8mwnhStVTBfAUfeHE
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4232 wrote to memory of 3396 4232 rundll32.exe 82 PID 4232 wrote to memory of 3396 4232 rundll32.exe 82 PID 4232 wrote to memory of 3396 4232 rundll32.exe 82 PID 3396 wrote to memory of 2404 3396 rundll32.exe 83 PID 3396 wrote to memory of 2404 3396 rundll32.exe 83 PID 3396 wrote to memory of 2404 3396 rundll32.exe 83 PID 2404 wrote to memory of 2152 2404 rundll32.exe 84 PID 2404 wrote to memory of 2152 2404 rundll32.exe 84 PID 2404 wrote to memory of 2152 2404 rundll32.exe 84 PID 2152 wrote to memory of 4116 2152 rundll32.exe 85 PID 2152 wrote to memory of 4116 2152 rundll32.exe 85 PID 2152 wrote to memory of 4116 2152 rundll32.exe 85 PID 4116 wrote to memory of 3484 4116 rundll32.exe 86 PID 4116 wrote to memory of 3484 4116 rundll32.exe 86 PID 4116 wrote to memory of 3484 4116 rundll32.exe 86 PID 3484 wrote to memory of 1632 3484 rundll32.exe 87 PID 3484 wrote to memory of 1632 3484 rundll32.exe 87 PID 3484 wrote to memory of 1632 3484 rundll32.exe 87 PID 1632 wrote to memory of 3968 1632 rundll32.exe 88 PID 1632 wrote to memory of 3968 1632 rundll32.exe 88 PID 1632 wrote to memory of 3968 1632 rundll32.exe 88 PID 3968 wrote to memory of 2596 3968 rundll32.exe 89 PID 3968 wrote to memory of 2596 3968 rundll32.exe 89 PID 3968 wrote to memory of 2596 3968 rundll32.exe 89 PID 2596 wrote to memory of 1260 2596 rundll32.exe 90 PID 2596 wrote to memory of 1260 2596 rundll32.exe 90 PID 2596 wrote to memory of 1260 2596 rundll32.exe 90 PID 1260 wrote to memory of 3944 1260 rundll32.exe 91 PID 1260 wrote to memory of 3944 1260 rundll32.exe 91 PID 1260 wrote to memory of 3944 1260 rundll32.exe 91 PID 3944 wrote to memory of 3352 3944 rundll32.exe 92 PID 3944 wrote to memory of 3352 3944 rundll32.exe 92 PID 3944 wrote to memory of 3352 3944 rundll32.exe 92 PID 3352 wrote to memory of 1992 3352 rundll32.exe 93 PID 3352 wrote to memory of 1992 3352 rundll32.exe 93 PID 3352 wrote to memory of 1992 3352 rundll32.exe 93 PID 1992 wrote to memory of 1940 1992 rundll32.exe 94 PID 1992 wrote to memory of 1940 1992 rundll32.exe 94 PID 1992 wrote to memory of 1940 1992 rundll32.exe 94 PID 1940 wrote to memory of 3844 1940 rundll32.exe 95 PID 1940 wrote to memory of 3844 1940 rundll32.exe 95 PID 1940 wrote to memory of 3844 1940 rundll32.exe 95 PID 3844 wrote to memory of 1452 3844 rundll32.exe 96 PID 3844 wrote to memory of 1452 3844 rundll32.exe 96 PID 3844 wrote to memory of 1452 3844 rundll32.exe 96 PID 1452 wrote to memory of 4388 1452 rundll32.exe 97 PID 1452 wrote to memory of 4388 1452 rundll32.exe 97 PID 1452 wrote to memory of 4388 1452 rundll32.exe 97 PID 4388 wrote to memory of 4036 4388 rundll32.exe 98 PID 4388 wrote to memory of 4036 4388 rundll32.exe 98 PID 4388 wrote to memory of 4036 4388 rundll32.exe 98 PID 4036 wrote to memory of 3748 4036 rundll32.exe 99 PID 4036 wrote to memory of 3748 4036 rundll32.exe 99 PID 4036 wrote to memory of 3748 4036 rundll32.exe 99 PID 3748 wrote to memory of 1620 3748 rundll32.exe 100 PID 3748 wrote to memory of 1620 3748 rundll32.exe 100 PID 3748 wrote to memory of 1620 3748 rundll32.exe 100 PID 1620 wrote to memory of 4896 1620 rundll32.exe 101 PID 1620 wrote to memory of 4896 1620 rundll32.exe 101 PID 1620 wrote to memory of 4896 1620 rundll32.exe 101 PID 4896 wrote to memory of 3356 4896 rundll32.exe 102 PID 4896 wrote to memory of 3356 4896 rundll32.exe 102 PID 4896 wrote to memory of 3356 4896 rundll32.exe 102 PID 3356 wrote to memory of 216 3356 rundll32.exe 103
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#123⤵PID:216
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#124⤵PID:2184
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#125⤵PID:4940
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#126⤵PID:5024
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#127⤵PID:3616
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#128⤵PID:644
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#129⤵PID:4648
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#130⤵PID:1860
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#131⤵PID:3756
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#132⤵PID:2028
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#133⤵PID:3064
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#134⤵PID:2272
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#135⤵PID:848
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#136⤵PID:872
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#137⤵PID:4204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#138⤵PID:3672
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#139⤵PID:1264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#140⤵PID:3332
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#141⤵PID:2872
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#142⤵PID:2476
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#143⤵PID:5104
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#144⤵PID:1500
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#145⤵PID:3604
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#146⤵PID:3984
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#147⤵PID:4512
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#148⤵PID:2820
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#149⤵PID:3348
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#150⤵PID:1424
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#151⤵PID:4392
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#152⤵PID:4404
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#153⤵PID:2524
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#154⤵PID:1232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#155⤵PID:4008
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#156⤵PID:2888
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#157⤵PID:1888
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#158⤵PID:2352
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#159⤵PID:2876
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#160⤵PID:2356
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#161⤵PID:2156
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#162⤵PID:2688
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#163⤵PID:4656
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#164⤵PID:1240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#165⤵PID:3936
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#166⤵PID:3856
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#167⤵PID:3080
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#168⤵PID:2648
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#169⤵PID:1440
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#170⤵PID:1644
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#171⤵PID:4268
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#172⤵PID:4804
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#173⤵PID:1788
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#174⤵PID:3340
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#175⤵PID:3304
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#176⤵PID:4572
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#177⤵PID:1072
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#178⤵PID:1800
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#179⤵PID:1988
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#180⤵PID:3972
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#181⤵PID:2560
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#182⤵PID:2792
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#183⤵PID:1468
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#184⤵PID:3136
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#185⤵PID:1716
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#186⤵PID:408
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#187⤵PID:2772
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#188⤵PID:4640
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#189⤵PID:1476
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#190⤵PID:1532
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#191⤵PID:412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#192⤵PID:4208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#193⤵PID:1804
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#194⤵PID:432
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#195⤵PID:4320
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#196⤵PID:4828
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#197⤵PID:2064
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#198⤵PID:2932
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#199⤵PID:2504
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#1100⤵PID:1680
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#1101⤵PID:1344
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#1102⤵PID:952
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#1103⤵PID:5124
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#1104⤵PID:5136
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#1105⤵PID:5148
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#1106⤵PID:5164
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#1107⤵PID:5176
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#1108⤵PID:5192
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#1109⤵PID:5208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#1110⤵PID:5220
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#1111⤵PID:5232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#1112⤵PID:5248
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#1113⤵PID:5260
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#1114⤵PID:5276
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#1115⤵PID:5292
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#1116⤵PID:5304
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#1117⤵PID:5340
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#1118⤵PID:5368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#1119⤵PID:5384
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#1120⤵PID:5400
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#1121⤵PID:5416
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1376-54-0x0000000010000000-0x0000000010015000-memory.dll,#1122⤵PID:5428
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-