Analysis
-
max time kernel
98s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12-03-2024 12:03
Behavioral task
behavioral1
Sample
1920-55-0x0000000010000000-0x0000000010024000-memory.dll
Resource
win7-20240220-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
1920-55-0x0000000010000000-0x0000000010024000-memory.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
1920-55-0x0000000010000000-0x0000000010024000-memory.dll
-
Size
144KB
-
MD5
a468377a96da4b446955c61c37726eeb
-
SHA1
d2467859a691284bd700b25c7162e42b0cd3c911
-
SHA256
4289e3595b6613c0d8432ce98cbf1a8368f09b728f3ff79935705657fd290350
-
SHA512
098e1c8ff50dddaa12c6a47ed84641edbb46e201f5a2040ca6b7eb72902cb238ca339bd5272f45d42db575dbb642bf8f73a6edb0d61288cb7723c1929dee1ac2
-
SSDEEP
3072:5ajYySWFPnCBAvkcCgIgAhtJ9mRfa8TBfwInbEwqX:WCBAv7CbVhtJgRfa8TBIIb9
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exedescription pid Process procid_target PID 2792 wrote to memory of 3472 2792 rundll32.exe 87 PID 2792 wrote to memory of 3472 2792 rundll32.exe 87 PID 2792 wrote to memory of 3472 2792 rundll32.exe 87 PID 3472 wrote to memory of 384 3472 rundll32.exe 91 PID 3472 wrote to memory of 384 3472 rundll32.exe 91 PID 3472 wrote to memory of 384 3472 rundll32.exe 91 PID 384 wrote to memory of 3400 384 rundll32.exe 92 PID 384 wrote to memory of 3400 384 rundll32.exe 92 PID 384 wrote to memory of 3400 384 rundll32.exe 92 PID 3400 wrote to memory of 1440 3400 rundll32.exe 93 PID 3400 wrote to memory of 1440 3400 rundll32.exe 93 PID 3400 wrote to memory of 1440 3400 rundll32.exe 93 PID 1440 wrote to memory of 1444 1440 rundll32.exe 94 PID 1440 wrote to memory of 1444 1440 rundll32.exe 94 PID 1440 wrote to memory of 1444 1440 rundll32.exe 94 PID 1444 wrote to memory of 448 1444 rundll32.exe 95 PID 1444 wrote to memory of 448 1444 rundll32.exe 95 PID 1444 wrote to memory of 448 1444 rundll32.exe 95 PID 448 wrote to memory of 4300 448 rundll32.exe 96 PID 448 wrote to memory of 4300 448 rundll32.exe 96 PID 448 wrote to memory of 4300 448 rundll32.exe 96 PID 4300 wrote to memory of 3512 4300 rundll32.exe 97 PID 4300 wrote to memory of 3512 4300 rundll32.exe 97 PID 4300 wrote to memory of 3512 4300 rundll32.exe 97 PID 3512 wrote to memory of 3112 3512 rundll32.exe 98 PID 3512 wrote to memory of 3112 3512 rundll32.exe 98 PID 3512 wrote to memory of 3112 3512 rundll32.exe 98 PID 3112 wrote to memory of 1980 3112 rundll32.exe 100 PID 3112 wrote to memory of 1980 3112 rundll32.exe 100 PID 3112 wrote to memory of 1980 3112 rundll32.exe 100 PID 1980 wrote to memory of 4712 1980 rundll32.exe 101 PID 1980 wrote to memory of 4712 1980 rundll32.exe 101 PID 1980 wrote to memory of 4712 1980 rundll32.exe 101 PID 4712 wrote to memory of 1252 4712 rundll32.exe 102 PID 4712 wrote to memory of 1252 4712 rundll32.exe 102 PID 4712 wrote to memory of 1252 4712 rundll32.exe 102 PID 1252 wrote to memory of 2196 1252 rundll32.exe 103 PID 1252 wrote to memory of 2196 1252 rundll32.exe 103 PID 1252 wrote to memory of 2196 1252 rundll32.exe 103 PID 2196 wrote to memory of 1856 2196 rundll32.exe 104 PID 2196 wrote to memory of 1856 2196 rundll32.exe 104 PID 2196 wrote to memory of 1856 2196 rundll32.exe 104 PID 1856 wrote to memory of 1000 1856 rundll32.exe 105 PID 1856 wrote to memory of 1000 1856 rundll32.exe 105 PID 1856 wrote to memory of 1000 1856 rundll32.exe 105 PID 1000 wrote to memory of 4152 1000 rundll32.exe 106 PID 1000 wrote to memory of 4152 1000 rundll32.exe 106 PID 1000 wrote to memory of 4152 1000 rundll32.exe 106 PID 4152 wrote to memory of 216 4152 rundll32.exe 107 PID 4152 wrote to memory of 216 4152 rundll32.exe 107 PID 4152 wrote to memory of 216 4152 rundll32.exe 107 PID 216 wrote to memory of 368 216 rundll32.exe 108 PID 216 wrote to memory of 368 216 rundll32.exe 108 PID 216 wrote to memory of 368 216 rundll32.exe 108 PID 368 wrote to memory of 1132 368 rundll32.exe 109 PID 368 wrote to memory of 1132 368 rundll32.exe 109 PID 368 wrote to memory of 1132 368 rundll32.exe 109 PID 1132 wrote to memory of 1824 1132 rundll32.exe 110 PID 1132 wrote to memory of 1824 1132 rundll32.exe 110 PID 1132 wrote to memory of 1824 1132 rundll32.exe 110 PID 1824 wrote to memory of 3144 1824 rundll32.exe 111 PID 1824 wrote to memory of 3144 1824 rundll32.exe 111 PID 1824 wrote to memory of 3144 1824 rundll32.exe 111 PID 3144 wrote to memory of 4104 3144 rundll32.exe 112
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#123⤵PID:4104
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#124⤵PID:3328
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#125⤵PID:4576
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#126⤵PID:2700
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#127⤵PID:4492
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#128⤵PID:4696
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#129⤵PID:3252
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#130⤵PID:1416
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#131⤵PID:4388
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#132⤵PID:752
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#133⤵PID:2352
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#134⤵PID:3120
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#135⤵PID:4656
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#136⤵PID:1436
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#137⤵PID:4568
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#138⤵PID:1324
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#139⤵PID:3848
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#140⤵PID:3632
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#141⤵PID:3764
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#142⤵PID:864
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#143⤵PID:2904
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#144⤵PID:4904
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#145⤵PID:3924
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#146⤵PID:4996
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#147⤵PID:3228
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#148⤵PID:3816
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#149⤵PID:2688
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#150⤵PID:2580
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#151⤵PID:4608
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#152⤵PID:5088
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#153⤵PID:1680
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#154⤵PID:3480
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#155⤵PID:4528
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#156⤵PID:5020
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#157⤵PID:2404
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#158⤵PID:3492
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#159⤵PID:3448
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#160⤵PID:3868
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#161⤵PID:2472
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#162⤵PID:3332
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#163⤵PID:5000
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#164⤵PID:4140
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#165⤵PID:3140
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#166⤵PID:1196
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#167⤵PID:4912
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#168⤵PID:3148
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#169⤵PID:744
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#170⤵PID:708
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#171⤵PID:2236
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#172⤵PID:3204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#173⤵PID:3720
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#174⤵PID:4476
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#175⤵PID:1224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#176⤵PID:3264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#177⤵PID:3532
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#178⤵PID:2600
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#179⤵PID:5004
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#180⤵PID:316
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#181⤵PID:1088
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#182⤵PID:3404
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#183⤵PID:2284
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#184⤵PID:4940
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#185⤵PID:4280
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#186⤵PID:4320
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#187⤵PID:3392
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#188⤵PID:3344
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#189⤵PID:4068
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#190⤵PID:1936
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#191⤵PID:5128
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#192⤵PID:5144
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#193⤵PID:5160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#194⤵PID:5180
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#195⤵PID:5196
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#196⤵PID:5212
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#197⤵PID:5228
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#198⤵PID:5240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#199⤵PID:5276
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#1100⤵PID:5288
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#1101⤵PID:5304
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#1102⤵PID:5328
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#1103⤵PID:5352
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#1104⤵PID:5372
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#1105⤵PID:5396
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#1106⤵PID:5412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#1107⤵PID:5436
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#1108⤵PID:5452
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#1109⤵PID:5468
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#1110⤵PID:5488
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#1111⤵PID:5504
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#1112⤵PID:5520
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#1113⤵PID:5532
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#1114⤵PID:5544
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#1115⤵PID:5560
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#1116⤵PID:5572
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#1117⤵PID:5588
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#1118⤵PID:5600
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#1119⤵PID:5616
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#1120⤵PID:5628
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#1121⤵PID:5644
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1920-55-0x0000000010000000-0x0000000010024000-memory.dll,#1122⤵PID:5656
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-