Overview
overview
6Static
static
317f57b49b1...18.exe
windows7-x64
317f57b49b1...18.exe
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3$PLUGINSDI...lp.dll
windows7-x64
1$PLUGINSDI...lp.dll
windows10-2004-x64
1$PLUGINSDI...ce.dll
windows7-x64
1$PLUGINSDI...ce.dll
windows10-2004-x64
1$PLUGINSDIR/Setup.dll
windows7-x64
1$PLUGINSDIR/Setup.dll
windows10-2004-x64
1$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3bin/11.0.2...SA.exe
windows7-x64
6bin/11.0.2...SA.exe
windows10-2004-x64
6bin/11.0.2...AX.dll
windows7-x64
1bin/11.0.2...AX.dll
windows10-2004-x64
1bin/11.0.2...ok.dll
windows7-x64
1bin/11.0.2...ok.dll
windows10-2004-x64
1bin/11.0.2...lp.dll
windows7-x64
1bin/11.0.2...lp.dll
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27-06-2024 23:36
Static task
static1
Behavioral task
behavioral1
Sample
17f57b49b15ef5c137f61183af819d98_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
17f57b49b15ef5c137f61183af819d98_JaffaCakes118.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Install.dll
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Install.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/LaunchHelp.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/LaunchHelp.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/Resource.dll
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/Resource.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/Setup.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/Setup.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240611-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
bin/11.0.264.0/HBLiteSA.exe
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
bin/11.0.264.0/HBLiteSA.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
bin/11.0.264.0/HBLiteSAAX.dll
Resource
win7-20240611-en
Behavioral task
behavioral18
Sample
bin/11.0.264.0/HBLiteSAAX.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
bin/11.0.264.0/HBLiteSAHook.dll
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
bin/11.0.264.0/HBLiteSAHook.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
bin/11.0.264.0/LaunchHelp.dll
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
bin/11.0.264.0/LaunchHelp.dll
Resource
win10v2004-20240508-en
General
-
Target
bin/11.0.264.0/HBLiteSAHook.dll
-
Size
146KB
-
MD5
7c7c8ccde8dbf3e9e7f314cfc25abe35
-
SHA1
b8f5d388048b34b6224365e1c042614889456703
-
SHA256
8a0e3d03f170648adca6f058ed026c3e890717a2d7b93969b0ea622bfa3aa038
-
SHA512
42965f0a45fd198b434a7f7add7b392ef647a349bb564f7ed0f4d7f55e0457c631c9ffd610c5de71d4abbd640756fd3ed02d2984764436e57baae8d7f8081487
-
SSDEEP
3072:Yxqe+1qMaH458Y22yBdtUiIBKSk05J5X/a:YDtrPiNV/a
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3420 wrote to memory of 1588 3420 rundll32.exe 80 PID 3420 wrote to memory of 1588 3420 rundll32.exe 80 PID 3420 wrote to memory of 1588 3420 rundll32.exe 80 PID 1588 wrote to memory of 2504 1588 rundll32.exe 81 PID 1588 wrote to memory of 2504 1588 rundll32.exe 81 PID 1588 wrote to memory of 2504 1588 rundll32.exe 81 PID 2504 wrote to memory of 4016 2504 rundll32.exe 82 PID 2504 wrote to memory of 4016 2504 rundll32.exe 82 PID 2504 wrote to memory of 4016 2504 rundll32.exe 82 PID 4016 wrote to memory of 1196 4016 rundll32.exe 83 PID 4016 wrote to memory of 1196 4016 rundll32.exe 83 PID 4016 wrote to memory of 1196 4016 rundll32.exe 83 PID 1196 wrote to memory of 4848 1196 rundll32.exe 84 PID 1196 wrote to memory of 4848 1196 rundll32.exe 84 PID 1196 wrote to memory of 4848 1196 rundll32.exe 84 PID 4848 wrote to memory of 3884 4848 rundll32.exe 85 PID 4848 wrote to memory of 3884 4848 rundll32.exe 85 PID 4848 wrote to memory of 3884 4848 rundll32.exe 85 PID 3884 wrote to memory of 3560 3884 rundll32.exe 86 PID 3884 wrote to memory of 3560 3884 rundll32.exe 86 PID 3884 wrote to memory of 3560 3884 rundll32.exe 86 PID 3560 wrote to memory of 2272 3560 rundll32.exe 87 PID 3560 wrote to memory of 2272 3560 rundll32.exe 87 PID 3560 wrote to memory of 2272 3560 rundll32.exe 87 PID 2272 wrote to memory of 3300 2272 rundll32.exe 88 PID 2272 wrote to memory of 3300 2272 rundll32.exe 88 PID 2272 wrote to memory of 3300 2272 rundll32.exe 88 PID 3300 wrote to memory of 3840 3300 rundll32.exe 89 PID 3300 wrote to memory of 3840 3300 rundll32.exe 89 PID 3300 wrote to memory of 3840 3300 rundll32.exe 89 PID 3840 wrote to memory of 916 3840 rundll32.exe 90 PID 3840 wrote to memory of 916 3840 rundll32.exe 90 PID 3840 wrote to memory of 916 3840 rundll32.exe 90 PID 916 wrote to memory of 2264 916 rundll32.exe 91 PID 916 wrote to memory of 2264 916 rundll32.exe 91 PID 916 wrote to memory of 2264 916 rundll32.exe 91 PID 2264 wrote to memory of 2512 2264 rundll32.exe 92 PID 2264 wrote to memory of 2512 2264 rundll32.exe 92 PID 2264 wrote to memory of 2512 2264 rundll32.exe 92 PID 2512 wrote to memory of 4256 2512 rundll32.exe 93 PID 2512 wrote to memory of 4256 2512 rundll32.exe 93 PID 2512 wrote to memory of 4256 2512 rundll32.exe 93 PID 4256 wrote to memory of 3564 4256 rundll32.exe 94 PID 4256 wrote to memory of 3564 4256 rundll32.exe 94 PID 4256 wrote to memory of 3564 4256 rundll32.exe 94 PID 3564 wrote to memory of 2596 3564 rundll32.exe 95 PID 3564 wrote to memory of 2596 3564 rundll32.exe 95 PID 3564 wrote to memory of 2596 3564 rundll32.exe 95 PID 2596 wrote to memory of 1332 2596 rundll32.exe 96 PID 2596 wrote to memory of 1332 2596 rundll32.exe 96 PID 2596 wrote to memory of 1332 2596 rundll32.exe 96 PID 1332 wrote to memory of 2576 1332 rundll32.exe 97 PID 1332 wrote to memory of 2576 1332 rundll32.exe 97 PID 1332 wrote to memory of 2576 1332 rundll32.exe 97 PID 2576 wrote to memory of 3516 2576 rundll32.exe 98 PID 2576 wrote to memory of 3516 2576 rundll32.exe 98 PID 2576 wrote to memory of 3516 2576 rundll32.exe 98 PID 3516 wrote to memory of 3828 3516 rundll32.exe 99 PID 3516 wrote to memory of 3828 3516 rundll32.exe 99 PID 3516 wrote to memory of 3828 3516 rundll32.exe 99 PID 3828 wrote to memory of 768 3828 rundll32.exe 100 PID 3828 wrote to memory of 768 3828 rundll32.exe 100 PID 3828 wrote to memory of 768 3828 rundll32.exe 100 PID 768 wrote to memory of 3440 768 rundll32.exe 101
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#123⤵PID:3440
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#124⤵PID:2376
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#125⤵PID:512
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#126⤵PID:2000
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#127⤵PID:2940
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#128⤵PID:4076
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#129⤵PID:4572
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#130⤵PID:736
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#131⤵PID:4248
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#132⤵PID:3504
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#133⤵PID:4392
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#134⤵PID:4556
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#135⤵PID:2752
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#136⤵PID:4176
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#137⤵PID:1664
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#138⤵PID:3056
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#139⤵PID:2312
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#140⤵PID:1612
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#141⤵PID:4924
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#142⤵PID:4964
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#143⤵PID:2560
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#144⤵PID:4780
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#145⤵PID:3616
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#146⤵PID:4720
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#147⤵PID:4936
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#148⤵PID:1212
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#149⤵PID:4824
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#150⤵PID:1400
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#151⤵PID:4196
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#152⤵PID:1552
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#153⤵PID:4652
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#154⤵PID:3464
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#155⤵PID:1756
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#156⤵PID:2280
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#157⤵PID:208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#158⤵PID:4396
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#159⤵PID:4060
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#160⤵PID:3496
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#161⤵PID:5040
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#162⤵PID:1920
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#163⤵PID:5016
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#164⤵PID:436
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#165⤵PID:224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#166⤵PID:2500
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#167⤵PID:2984
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#168⤵PID:2124
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#169⤵PID:1976
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#170⤵PID:1276
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#171⤵PID:3184
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#172⤵PID:2960
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#173⤵PID:4760
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#174⤵PID:3704
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#175⤵PID:1648
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#176⤵PID:3964
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#177⤵PID:3332
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#178⤵PID:3948
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#179⤵PID:2244
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#180⤵PID:752
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#181⤵PID:2568
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#182⤵PID:1432
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#183⤵PID:1508
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#184⤵PID:1036
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#185⤵PID:1428
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#186⤵PID:2892
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#187⤵PID:3468
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#188⤵PID:5112
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#189⤵PID:3476
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#190⤵PID:876
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#191⤵PID:4928
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#192⤵PID:1240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#193⤵PID:1012
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#194⤵PID:2096
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#195⤵PID:2412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#196⤵PID:4608
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#197⤵PID:3116
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#198⤵PID:4548
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#199⤵PID:5008
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#1100⤵PID:4032
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#1101⤵PID:3488
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#1102⤵PID:4672
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#1103⤵PID:2232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#1104⤵PID:1404
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#1105⤵PID:2852
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#1106⤵PID:4796
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#1107⤵PID:4480
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#1108⤵PID:2912
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#1109⤵PID:1912
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#1110⤵PID:4304
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#1111⤵PID:1464
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#1112⤵PID:1444
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#1113⤵PID:5144
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#1114⤵PID:5160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#1115⤵PID:5176
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#1116⤵PID:5204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#1117⤵PID:5220
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#1118⤵PID:5244
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#1119⤵PID:5272
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#1120⤵PID:5284
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#1121⤵PID:5304
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#1122⤵PID:5320
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-