Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
26/08/2023, 14:33
Static task
static1
Behavioral task
behavioral1
Sample
a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll
Resource
win7-20230824-en
Behavioral task
behavioral2
Sample
a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll
Resource
win10v2004-20230703-en
General
-
Target
a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll
-
Size
4.7MB
-
MD5
331da35d81d042fc2c96b94e10f2ed85
-
SHA1
938e9754a275e8287da29af1c63a75ba6430ae71
-
SHA256
a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4
-
SHA512
0ecc01ea0dd4a6fed974d21d4d2edcee27754c93a632ebf5ad489e58a2326e15a98a3bdb4ed34c74501ccfb789190fb1ca7c2e0612afd24b58c6fe1d62868c11
-
SSDEEP
98304:/U+9X5+01Y0sC5qNddE+Qu7mwEIvd/uNcOKLMPwO7qa21svhjWUV:hX5+01D5qzdTh3VUWpUFHV
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4612 wrote to memory of 1016 4612 rundll32.exe 82 PID 4612 wrote to memory of 1016 4612 rundll32.exe 82 PID 4612 wrote to memory of 1016 4612 rundll32.exe 82 PID 1016 wrote to memory of 2204 1016 rundll32.exe 83 PID 1016 wrote to memory of 2204 1016 rundll32.exe 83 PID 1016 wrote to memory of 2204 1016 rundll32.exe 83 PID 2204 wrote to memory of 4448 2204 rundll32.exe 84 PID 2204 wrote to memory of 4448 2204 rundll32.exe 84 PID 2204 wrote to memory of 4448 2204 rundll32.exe 84 PID 4448 wrote to memory of 4092 4448 rundll32.exe 85 PID 4448 wrote to memory of 4092 4448 rundll32.exe 85 PID 4448 wrote to memory of 4092 4448 rundll32.exe 85 PID 4092 wrote to memory of 5036 4092 rundll32.exe 86 PID 4092 wrote to memory of 5036 4092 rundll32.exe 86 PID 4092 wrote to memory of 5036 4092 rundll32.exe 86 PID 5036 wrote to memory of 4396 5036 rundll32.exe 87 PID 5036 wrote to memory of 4396 5036 rundll32.exe 87 PID 5036 wrote to memory of 4396 5036 rundll32.exe 87 PID 4396 wrote to memory of 3872 4396 rundll32.exe 88 PID 4396 wrote to memory of 3872 4396 rundll32.exe 88 PID 4396 wrote to memory of 3872 4396 rundll32.exe 88 PID 3872 wrote to memory of 3812 3872 rundll32.exe 89 PID 3872 wrote to memory of 3812 3872 rundll32.exe 89 PID 3872 wrote to memory of 3812 3872 rundll32.exe 89 PID 3812 wrote to memory of 1760 3812 rundll32.exe 90 PID 3812 wrote to memory of 1760 3812 rundll32.exe 90 PID 3812 wrote to memory of 1760 3812 rundll32.exe 90 PID 1760 wrote to memory of 3708 1760 rundll32.exe 91 PID 1760 wrote to memory of 3708 1760 rundll32.exe 91 PID 1760 wrote to memory of 3708 1760 rundll32.exe 91 PID 3708 wrote to memory of 4468 3708 rundll32.exe 92 PID 3708 wrote to memory of 4468 3708 rundll32.exe 92 PID 3708 wrote to memory of 4468 3708 rundll32.exe 92 PID 4468 wrote to memory of 2100 4468 rundll32.exe 93 PID 4468 wrote to memory of 2100 4468 rundll32.exe 93 PID 4468 wrote to memory of 2100 4468 rundll32.exe 93 PID 2100 wrote to memory of 3192 2100 rundll32.exe 94 PID 2100 wrote to memory of 3192 2100 rundll32.exe 94 PID 2100 wrote to memory of 3192 2100 rundll32.exe 94 PID 3192 wrote to memory of 4364 3192 rundll32.exe 95 PID 3192 wrote to memory of 4364 3192 rundll32.exe 95 PID 3192 wrote to memory of 4364 3192 rundll32.exe 95 PID 4364 wrote to memory of 216 4364 rundll32.exe 96 PID 4364 wrote to memory of 216 4364 rundll32.exe 96 PID 4364 wrote to memory of 216 4364 rundll32.exe 96 PID 216 wrote to memory of 2528 216 rundll32.exe 97 PID 216 wrote to memory of 2528 216 rundll32.exe 97 PID 216 wrote to memory of 2528 216 rundll32.exe 97 PID 2528 wrote to memory of 4436 2528 rundll32.exe 98 PID 2528 wrote to memory of 4436 2528 rundll32.exe 98 PID 2528 wrote to memory of 4436 2528 rundll32.exe 98 PID 4436 wrote to memory of 2088 4436 rundll32.exe 99 PID 4436 wrote to memory of 2088 4436 rundll32.exe 99 PID 4436 wrote to memory of 2088 4436 rundll32.exe 99 PID 2088 wrote to memory of 1736 2088 rundll32.exe 100 PID 2088 wrote to memory of 1736 2088 rundll32.exe 100 PID 2088 wrote to memory of 1736 2088 rundll32.exe 100 PID 1736 wrote to memory of 2920 1736 rundll32.exe 101 PID 1736 wrote to memory of 2920 1736 rundll32.exe 101 PID 1736 wrote to memory of 2920 1736 rundll32.exe 101 PID 2920 wrote to memory of 3976 2920 rundll32.exe 102 PID 2920 wrote to memory of 3976 2920 rundll32.exe 102 PID 2920 wrote to memory of 3976 2920 rundll32.exe 102 PID 3976 wrote to memory of 1796 3976 rundll32.exe 103
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#123⤵PID:1796
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#124⤵PID:3252
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#125⤵PID:1556
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#126⤵PID:1876
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#127⤵PID:4300
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#128⤵PID:4620
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#129⤵PID:752
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#130⤵PID:2688
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#131⤵PID:2912
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#132⤵PID:1368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#133⤵PID:5024
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#134⤵PID:4424
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#135⤵PID:1364
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#136⤵PID:4776
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#137⤵PID:1732
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#138⤵PID:4720
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#139⤵PID:2532
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#140⤵PID:4784
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#141⤵PID:4728
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#142⤵PID:3424
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#143⤵PID:1632
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#144⤵PID:4692
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#145⤵PID:4580
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#146⤵PID:1828
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#147⤵PID:4408
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#148⤵PID:2468
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#149⤵PID:1536
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#150⤵PID:1496
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#151⤵PID:4716
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#152⤵PID:556
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#153⤵PID:704
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#154⤵PID:1840
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#155⤵PID:2368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#156⤵PID:4116
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#157⤵PID:948
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#158⤵PID:2128
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#159⤵PID:772
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#160⤵PID:1572
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#161⤵PID:1744
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#162⤵PID:3692
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#163⤵PID:3980
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#164⤵PID:224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#165⤵PID:2076
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#166⤵PID:584
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#167⤵PID:3676
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#168⤵PID:3600
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#169⤵PID:808
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#170⤵PID:1308
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#171⤵PID:1592
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#172⤵PID:2672
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#173⤵PID:3432
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#174⤵PID:1712
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#175⤵PID:2440
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#176⤵PID:2272
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#177⤵PID:492
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#178⤵PID:8
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#179⤵PID:4936
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#180⤵PID:4256
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#181⤵PID:3484
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#182⤵PID:5080
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#183⤵PID:2420
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#184⤵PID:2276
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#185⤵PID:4252
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#186⤵PID:4072
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#187⤵PID:4060
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#188⤵PID:1492
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#189⤵PID:4000
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#190⤵PID:2656
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#191⤵PID:4908
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#192⤵PID:2232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#193⤵PID:3684
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#194⤵PID:4676
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#195⤵PID:4004
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#196⤵PID:3348
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#197⤵PID:2652
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#198⤵PID:2960
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#199⤵PID:2816
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#1100⤵PID:4328
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#1101⤵PID:4380
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#1102⤵PID:1892
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#1103⤵PID:1564
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#1104⤵PID:4180
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#1105⤵PID:2640
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#1106⤵PID:4196
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#1107⤵PID:1156
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#1108⤵PID:4524
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#1109⤵PID:2520
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#1110⤵PID:3620
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#1111⤵PID:844
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#1112⤵PID:5156
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#1113⤵PID:5176
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#1114⤵PID:5188
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#1115⤵PID:5204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#1116⤵PID:5216
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#1117⤵PID:5228
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#1118⤵PID:5240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#1119⤵PID:5256
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#1120⤵PID:5268
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#1121⤵PID:5284
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9afb3c712d3014db164b0f6f1f7dd23ecea8449558eb11f6056e729928488c4.dll,#1122⤵PID:5300
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-