Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 02:52
Static task
static1
Behavioral task
behavioral1
Sample
0c34a36d8b72a6ba60fd5f8619ef4ecc.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0c34a36d8b72a6ba60fd5f8619ef4ecc.dll
Resource
win10v2004-20231215-en
General
-
Target
0c34a36d8b72a6ba60fd5f8619ef4ecc.dll
-
Size
57KB
-
MD5
0c34a36d8b72a6ba60fd5f8619ef4ecc
-
SHA1
6dc883c4de6ada2cba39657a5424b3ca1e2309c9
-
SHA256
659da823a11e6e41288b2bf15d7882aff0e2f4abd9e64d945d3713e29f270d19
-
SHA512
e887511550508743c4ba93a8158555ecd94ec09181f93d873c7c465de0bb735c5667e8857e4eb1c38fe220aa53393638538fb012cdceb5c30a6b9b3bae237cb1
-
SSDEEP
1536:D3I8ToqUymIPlZRjJWLoh/gjzMaZCsw4jTb+:D33TTPt4MCjBvj3a
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID dwm.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe -
Modifies data under HKEY_USERS 18 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeCreateGlobalPrivilege 17184 dwm.exe Token: SeChangeNotifyPrivilege 17184 dwm.exe Token: 33 17184 dwm.exe Token: SeIncBasePriorityPrivilege 17184 dwm.exe Token: SeShutdownPrivilege 17184 dwm.exe Token: SeCreatePagefilePrivilege 17184 dwm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4684 wrote to memory of 5104 4684 rundll32.exe 90 PID 4684 wrote to memory of 5104 4684 rundll32.exe 90 PID 4684 wrote to memory of 5104 4684 rundll32.exe 90 PID 5104 wrote to memory of 1740 5104 rundll32.exe 91 PID 5104 wrote to memory of 1740 5104 rundll32.exe 91 PID 5104 wrote to memory of 1740 5104 rundll32.exe 91 PID 1740 wrote to memory of 4372 1740 rundll32.exe 92 PID 1740 wrote to memory of 4372 1740 rundll32.exe 92 PID 1740 wrote to memory of 4372 1740 rundll32.exe 92 PID 4372 wrote to memory of 2968 4372 rundll32.exe 93 PID 4372 wrote to memory of 2968 4372 rundll32.exe 93 PID 4372 wrote to memory of 2968 4372 rundll32.exe 93 PID 2968 wrote to memory of 2124 2968 rundll32.exe 94 PID 2968 wrote to memory of 2124 2968 rundll32.exe 94 PID 2968 wrote to memory of 2124 2968 rundll32.exe 94 PID 2124 wrote to memory of 1744 2124 rundll32.exe 95 PID 2124 wrote to memory of 1744 2124 rundll32.exe 95 PID 2124 wrote to memory of 1744 2124 rundll32.exe 95 PID 1744 wrote to memory of 2220 1744 rundll32.exe 96 PID 1744 wrote to memory of 2220 1744 rundll32.exe 96 PID 1744 wrote to memory of 2220 1744 rundll32.exe 96 PID 2220 wrote to memory of 2232 2220 rundll32.exe 97 PID 2220 wrote to memory of 2232 2220 rundll32.exe 97 PID 2220 wrote to memory of 2232 2220 rundll32.exe 97 PID 2232 wrote to memory of 2516 2232 rundll32.exe 98 PID 2232 wrote to memory of 2516 2232 rundll32.exe 98 PID 2232 wrote to memory of 2516 2232 rundll32.exe 98 PID 2516 wrote to memory of 3524 2516 rundll32.exe 99 PID 2516 wrote to memory of 3524 2516 rundll32.exe 99 PID 2516 wrote to memory of 3524 2516 rundll32.exe 99 PID 3524 wrote to memory of 1868 3524 rundll32.exe 101 PID 3524 wrote to memory of 1868 3524 rundll32.exe 101 PID 3524 wrote to memory of 1868 3524 rundll32.exe 101 PID 1868 wrote to memory of 5080 1868 rundll32.exe 102 PID 1868 wrote to memory of 5080 1868 rundll32.exe 102 PID 1868 wrote to memory of 5080 1868 rundll32.exe 102 PID 5080 wrote to memory of 3464 5080 rundll32.exe 103 PID 5080 wrote to memory of 3464 5080 rundll32.exe 103 PID 5080 wrote to memory of 3464 5080 rundll32.exe 103 PID 3464 wrote to memory of 1556 3464 rundll32.exe 104 PID 3464 wrote to memory of 1556 3464 rundll32.exe 104 PID 3464 wrote to memory of 1556 3464 rundll32.exe 104 PID 1556 wrote to memory of 2932 1556 rundll32.exe 105 PID 1556 wrote to memory of 2932 1556 rundll32.exe 105 PID 1556 wrote to memory of 2932 1556 rundll32.exe 105 PID 2932 wrote to memory of 2344 2932 rundll32.exe 106 PID 2932 wrote to memory of 2344 2932 rundll32.exe 106 PID 2932 wrote to memory of 2344 2932 rundll32.exe 106 PID 2344 wrote to memory of 1148 2344 rundll32.exe 107 PID 2344 wrote to memory of 1148 2344 rundll32.exe 107 PID 2344 wrote to memory of 1148 2344 rundll32.exe 107 PID 1148 wrote to memory of 4972 1148 rundll32.exe 108 PID 1148 wrote to memory of 4972 1148 rundll32.exe 108 PID 1148 wrote to memory of 4972 1148 rundll32.exe 108 PID 4972 wrote to memory of 4908 4972 rundll32.exe 109 PID 4972 wrote to memory of 4908 4972 rundll32.exe 109 PID 4972 wrote to memory of 4908 4972 rundll32.exe 109 PID 4908 wrote to memory of 2696 4908 rundll32.exe 110 PID 4908 wrote to memory of 2696 4908 rundll32.exe 110 PID 4908 wrote to memory of 2696 4908 rundll32.exe 110 PID 2696 wrote to memory of 3380 2696 rundll32.exe 111 PID 2696 wrote to memory of 3380 2696 rundll32.exe 111 PID 2696 wrote to memory of 3380 2696 rundll32.exe 111 PID 3380 wrote to memory of 4592 3380 rundll32.exe 112
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#123⤵PID:4592
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#124⤵PID:2836
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#125⤵PID:4252
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#126⤵PID:5084
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#127⤵PID:3268
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#128⤵PID:4948
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#129⤵PID:3208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#130⤵PID:3472
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#131⤵PID:3900
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#132⤵PID:4424
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#133⤵PID:3176
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#134⤵PID:1732
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#135⤵PID:4396
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#136⤵PID:4716
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#137⤵PID:5012
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#138⤵PID:4924
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#139⤵PID:2840
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#140⤵PID:5004
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#141⤵PID:868
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#142⤵PID:3012
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#143⤵PID:1428
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#144⤵PID:3272
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#145⤵PID:3292
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#146⤵PID:4884
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#147⤵PID:2100
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#148⤵PID:3408
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#149⤵PID:1516
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#150⤵PID:2336
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#151⤵PID:1928
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#152⤵PID:2092
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#153⤵PID:116
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#154⤵PID:4632
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#155⤵PID:1648
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#156⤵PID:532
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#157⤵PID:2552
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#158⤵PID:2116
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#159⤵PID:5068
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#160⤵PID:2212
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#161⤵PID:4068
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#162⤵PID:3596
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#163⤵PID:4140
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#164⤵PID:1440
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#165⤵PID:4600
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#166⤵PID:4088
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#167⤵PID:4428
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#168⤵PID:2176
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#169⤵PID:4412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#170⤵PID:3740
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#171⤵PID:1580
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#172⤵PID:1916
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#173⤵PID:3952
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#174⤵PID:2224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#175⤵PID:4080
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#176⤵PID:4608
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#177⤵PID:5132
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#178⤵PID:5156
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#179⤵PID:5176
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#180⤵PID:5192
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#181⤵PID:5208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#182⤵PID:5220
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#183⤵PID:5240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#184⤵PID:5264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#185⤵PID:5280
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#186⤵PID:5292
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#187⤵PID:5312
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#188⤵PID:5324
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#189⤵PID:5348
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#190⤵PID:5364
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#191⤵PID:5380
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#192⤵PID:5396
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#193⤵PID:5412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#194⤵PID:5428
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#195⤵PID:5444
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#196⤵PID:5456
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#197⤵PID:5468
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#198⤵PID:5480
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#199⤵PID:5492
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#1100⤵PID:5512
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#1101⤵PID:5524
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#1102⤵PID:5540
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#1103⤵PID:5560
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#1104⤵PID:5576
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#1105⤵PID:5592
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#1106⤵PID:5604
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#1107⤵PID:5620
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#1108⤵PID:5636
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#1109⤵PID:5652
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#1110⤵PID:5668
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#1111⤵PID:5680
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#1112⤵PID:5692
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#1113⤵PID:5712
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#1114⤵PID:5736
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#1115⤵PID:5748
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#1116⤵PID:5776
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#1117⤵PID:5792
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#1118⤵PID:5820
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#1119⤵PID:5836
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#1120⤵PID:5852
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#1121⤵PID:5864
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c34a36d8b72a6ba60fd5f8619ef4ecc.dll,#1122⤵PID:5880
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-