Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
51s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/06/2024, 16:44
Static task
static1
Behavioral task
behavioral1
Sample
UltraHook/Rinput.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
UltraHook/Rinput.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
UltraHook/uh.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
UltraHook/uh.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
hl2.exe
Resource
win10v2004-20240508-en
General
-
Target
UltraHook/Rinput.dll
-
Size
278KB
-
MD5
43a453281ae7765d48e7945019c33419
-
SHA1
ef0ad2d74723b95bb73e2069385fc2e7755f5a6e
-
SHA256
1d596ff2b432499c8867666940603970da081080955323024715f87e8fbb3f2c
-
SHA512
0fc0d5624c40929bf536f830f2b0f8c58d8ba9b9ebf0914b371c0ce68ef3a669de6fbc253fa79c24d16ffd21c860d8fac30f31e3f62ef88604e6a073dd66ee10
-
SSDEEP
6144:WT+La7VQpsFoR/I489EJZhofyLa7VQpsFoR/I489ERFdfc:A+LNCoa489IYaLNCoa4894dfc
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3304 wrote to memory of 1412 3304 rundll32.exe 81 PID 3304 wrote to memory of 1412 3304 rundll32.exe 81 PID 3304 wrote to memory of 1412 3304 rundll32.exe 81 PID 1412 wrote to memory of 2744 1412 rundll32.exe 82 PID 1412 wrote to memory of 2744 1412 rundll32.exe 82 PID 1412 wrote to memory of 2744 1412 rundll32.exe 82 PID 2744 wrote to memory of 228 2744 rundll32.exe 83 PID 2744 wrote to memory of 228 2744 rundll32.exe 83 PID 2744 wrote to memory of 228 2744 rundll32.exe 83 PID 228 wrote to memory of 1536 228 rundll32.exe 84 PID 228 wrote to memory of 1536 228 rundll32.exe 84 PID 228 wrote to memory of 1536 228 rundll32.exe 84 PID 1536 wrote to memory of 1360 1536 rundll32.exe 85 PID 1536 wrote to memory of 1360 1536 rundll32.exe 85 PID 1536 wrote to memory of 1360 1536 rundll32.exe 85 PID 1360 wrote to memory of 2816 1360 rundll32.exe 86 PID 1360 wrote to memory of 2816 1360 rundll32.exe 86 PID 1360 wrote to memory of 2816 1360 rundll32.exe 86 PID 2816 wrote to memory of 996 2816 rundll32.exe 87 PID 2816 wrote to memory of 996 2816 rundll32.exe 87 PID 2816 wrote to memory of 996 2816 rundll32.exe 87 PID 996 wrote to memory of 3256 996 rundll32.exe 88 PID 996 wrote to memory of 3256 996 rundll32.exe 88 PID 996 wrote to memory of 3256 996 rundll32.exe 88 PID 3256 wrote to memory of 5064 3256 rundll32.exe 89 PID 3256 wrote to memory of 5064 3256 rundll32.exe 89 PID 3256 wrote to memory of 5064 3256 rundll32.exe 89 PID 5064 wrote to memory of 4396 5064 rundll32.exe 90 PID 5064 wrote to memory of 4396 5064 rundll32.exe 90 PID 5064 wrote to memory of 4396 5064 rundll32.exe 90 PID 4396 wrote to memory of 1216 4396 rundll32.exe 91 PID 4396 wrote to memory of 1216 4396 rundll32.exe 91 PID 4396 wrote to memory of 1216 4396 rundll32.exe 91 PID 1216 wrote to memory of 1868 1216 rundll32.exe 92 PID 1216 wrote to memory of 1868 1216 rundll32.exe 92 PID 1216 wrote to memory of 1868 1216 rundll32.exe 92 PID 1868 wrote to memory of 2640 1868 rundll32.exe 93 PID 1868 wrote to memory of 2640 1868 rundll32.exe 93 PID 1868 wrote to memory of 2640 1868 rundll32.exe 93 PID 2640 wrote to memory of 4992 2640 rundll32.exe 94 PID 2640 wrote to memory of 4992 2640 rundll32.exe 94 PID 2640 wrote to memory of 4992 2640 rundll32.exe 94 PID 4992 wrote to memory of 2904 4992 rundll32.exe 95 PID 4992 wrote to memory of 2904 4992 rundll32.exe 95 PID 4992 wrote to memory of 2904 4992 rundll32.exe 95 PID 2904 wrote to memory of 5016 2904 rundll32.exe 96 PID 2904 wrote to memory of 5016 2904 rundll32.exe 96 PID 2904 wrote to memory of 5016 2904 rundll32.exe 96 PID 5016 wrote to memory of 2252 5016 rundll32.exe 97 PID 5016 wrote to memory of 2252 5016 rundll32.exe 97 PID 5016 wrote to memory of 2252 5016 rundll32.exe 97 PID 2252 wrote to memory of 1336 2252 rundll32.exe 98 PID 2252 wrote to memory of 1336 2252 rundll32.exe 98 PID 2252 wrote to memory of 1336 2252 rundll32.exe 98 PID 1336 wrote to memory of 3592 1336 rundll32.exe 99 PID 1336 wrote to memory of 3592 1336 rundll32.exe 99 PID 1336 wrote to memory of 3592 1336 rundll32.exe 99 PID 3592 wrote to memory of 2512 3592 rundll32.exe 100 PID 3592 wrote to memory of 2512 3592 rundll32.exe 100 PID 3592 wrote to memory of 2512 3592 rundll32.exe 100 PID 2512 wrote to memory of 4672 2512 rundll32.exe 101 PID 2512 wrote to memory of 4672 2512 rundll32.exe 101 PID 2512 wrote to memory of 4672 2512 rundll32.exe 101 PID 4672 wrote to memory of 2864 4672 rundll32.exe 102
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#123⤵PID:2864
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#124⤵PID:3332
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#125⤵PID:3944
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#126⤵PID:3508
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#127⤵PID:4624
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#128⤵PID:5028
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#129⤵PID:3020
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#130⤵PID:4528
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#131⤵PID:3792
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#132⤵PID:2176
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#133⤵PID:4952
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#134⤵PID:2828
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#135⤵PID:4656
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#136⤵PID:1544
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#137⤵PID:640
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#138⤵PID:392
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#139⤵PID:3800
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#140⤵PID:2268
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#141⤵PID:4180
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#142⤵PID:2228
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#143⤵PID:2168
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#144⤵PID:2248
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#145⤵PID:2924
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#146⤵PID:2920
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#147⤵PID:3852
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#148⤵PID:404
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#149⤵PID:1960
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#150⤵PID:4480
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#151⤵PID:2272
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#152⤵PID:3528
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#153⤵PID:4120
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#154⤵PID:2148
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#155⤵PID:4388
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#156⤵PID:316
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#157⤵PID:4116
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#158⤵PID:4812
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#159⤵PID:4580
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#160⤵PID:3776
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#161⤵PID:1404
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#162⤵PID:5056
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#163⤵PID:440
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#164⤵PID:3436
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#165⤵PID:808
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#166⤵PID:1152
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#167⤵PID:1212
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#168⤵PID:688
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#169⤵PID:3212
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#170⤵PID:4604
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#171⤵PID:4264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#172⤵PID:2180
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#173⤵PID:1008
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#174⤵PID:3676
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#175⤵PID:4640
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#176⤵PID:3796
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#177⤵PID:4588
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#178⤵PID:1824
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#179⤵PID:2736
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#180⤵PID:1416
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#181⤵PID:4204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#182⤵PID:4040
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#183⤵PID:2196
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#184⤵PID:3680
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#185⤵PID:948
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#186⤵PID:680
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#187⤵PID:1784
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#188⤵PID:2068
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#189⤵PID:4696
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#190⤵PID:2944
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#191⤵PID:2536
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#192⤵PID:4184
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#193⤵PID:4704
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#194⤵PID:2520
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#195⤵PID:212
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#196⤵PID:544
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#197⤵PID:1852
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#198⤵PID:4728
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#199⤵PID:2092
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#1100⤵PID:1140
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#1101⤵PID:884
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#1102⤵PID:3024
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#1103⤵PID:5112
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#1104⤵PID:3344
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#1105⤵PID:2072
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#1106⤵PID:4276
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#1107⤵PID:968
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#1108⤵PID:2392
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#1109⤵PID:1000
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#1110⤵PID:3812
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#1111⤵PID:5036
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#1112⤵PID:1832
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#1113⤵PID:3844
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#1114⤵PID:4024
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#1115⤵PID:4816
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#1116⤵PID:2884
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#1117⤵PID:4652
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#1118⤵PID:2444
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#1119⤵PID:1568
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#1120⤵PID:3820
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#1121⤵PID:2040
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltraHook\Rinput.dll,#1122⤵PID:1396
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-