Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
33d9fabd4c0...18.exe
windows7-x64
13d9fabd4c0...18.exe
windows10-2004-x64
1$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ol.dll
windows7-x64
3$PLUGINSDI...ol.dll
windows10-2004-x64
3Basement.dll
windows7-x64
1Basement.dll
windows10-2004-x64
1ImEngine.dll
windows7-x64
1ImEngine.dll
windows10-2004-x64
1MediaEngine.dll
windows7-x64
1MediaEngine.dll
windows10-2004-x64
1PEngine.dll
windows7-x64
1PEngine.dll
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
12/07/2024, 13:46
Static task
static1
Behavioral task
behavioral1
Sample
3d9fabd4c0a43457ab08a5fa4b306d91_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3d9fabd4c0a43457ab08a5fa4b306d91_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/UACTool.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/UACTool.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
Basement.dll
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
Basement.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
ImEngine.dll
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
ImEngine.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral11
Sample
MediaEngine.dll
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
MediaEngine.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
PEngine.dll
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
PEngine.dll
Resource
win10v2004-20240709-en
General
-
Target
MediaEngine.dll
-
Size
729KB
-
MD5
ff7f92c7a42a865143a639c10e1cc6d6
-
SHA1
799f9fcef95c14449b0a92a37469a714b289f9d4
-
SHA256
c98357516d7758fc2b2cd12e65bbbac151061d25904fdbdc56d1279774a7797e
-
SHA512
4f50ef29fab8e51b3eb5484c45c0603d75729e496a53a4e9a22e3d03fdd6480c5e96211b7e5b7b0884ef60ee5bde613fe36e9ad5167aca4212eb94fd56cabcb4
-
SSDEEP
12288:KvnO87oehO/eXzd8ahqjtT1f6ge8M7KuLucnAWwWoEXr48xrt6mm7Uco:KGS2eR8ltpQhoEXr4wt98o
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4428 wrote to memory of 2496 4428 rundll32.exe 84 PID 4428 wrote to memory of 2496 4428 rundll32.exe 84 PID 4428 wrote to memory of 2496 4428 rundll32.exe 84 PID 2496 wrote to memory of 2308 2496 rundll32.exe 85 PID 2496 wrote to memory of 2308 2496 rundll32.exe 85 PID 2496 wrote to memory of 2308 2496 rundll32.exe 85 PID 2308 wrote to memory of 5004 2308 rundll32.exe 86 PID 2308 wrote to memory of 5004 2308 rundll32.exe 86 PID 2308 wrote to memory of 5004 2308 rundll32.exe 86 PID 5004 wrote to memory of 4028 5004 rundll32.exe 87 PID 5004 wrote to memory of 4028 5004 rundll32.exe 87 PID 5004 wrote to memory of 4028 5004 rundll32.exe 87 PID 4028 wrote to memory of 520 4028 rundll32.exe 88 PID 4028 wrote to memory of 520 4028 rundll32.exe 88 PID 4028 wrote to memory of 520 4028 rundll32.exe 88 PID 520 wrote to memory of 5040 520 rundll32.exe 89 PID 520 wrote to memory of 5040 520 rundll32.exe 89 PID 520 wrote to memory of 5040 520 rundll32.exe 89 PID 5040 wrote to memory of 1132 5040 rundll32.exe 90 PID 5040 wrote to memory of 1132 5040 rundll32.exe 90 PID 5040 wrote to memory of 1132 5040 rundll32.exe 90 PID 1132 wrote to memory of 3792 1132 rundll32.exe 91 PID 1132 wrote to memory of 3792 1132 rundll32.exe 91 PID 1132 wrote to memory of 3792 1132 rundll32.exe 91 PID 3792 wrote to memory of 1808 3792 rundll32.exe 92 PID 3792 wrote to memory of 1808 3792 rundll32.exe 92 PID 3792 wrote to memory of 1808 3792 rundll32.exe 92 PID 1808 wrote to memory of 236 1808 rundll32.exe 93 PID 1808 wrote to memory of 236 1808 rundll32.exe 93 PID 1808 wrote to memory of 236 1808 rundll32.exe 93 PID 236 wrote to memory of 1668 236 rundll32.exe 94 PID 236 wrote to memory of 1668 236 rundll32.exe 94 PID 236 wrote to memory of 1668 236 rundll32.exe 94 PID 1668 wrote to memory of 2472 1668 rundll32.exe 95 PID 1668 wrote to memory of 2472 1668 rundll32.exe 95 PID 1668 wrote to memory of 2472 1668 rundll32.exe 95 PID 2472 wrote to memory of 3420 2472 rundll32.exe 96 PID 2472 wrote to memory of 3420 2472 rundll32.exe 96 PID 2472 wrote to memory of 3420 2472 rundll32.exe 96 PID 3420 wrote to memory of 5088 3420 rundll32.exe 97 PID 3420 wrote to memory of 5088 3420 rundll32.exe 97 PID 3420 wrote to memory of 5088 3420 rundll32.exe 97 PID 5088 wrote to memory of 1800 5088 rundll32.exe 98 PID 5088 wrote to memory of 1800 5088 rundll32.exe 98 PID 5088 wrote to memory of 1800 5088 rundll32.exe 98 PID 1800 wrote to memory of 2300 1800 rundll32.exe 99 PID 1800 wrote to memory of 2300 1800 rundll32.exe 99 PID 1800 wrote to memory of 2300 1800 rundll32.exe 99 PID 2300 wrote to memory of 4872 2300 rundll32.exe 100 PID 2300 wrote to memory of 4872 2300 rundll32.exe 100 PID 2300 wrote to memory of 4872 2300 rundll32.exe 100 PID 4872 wrote to memory of 1044 4872 rundll32.exe 101 PID 4872 wrote to memory of 1044 4872 rundll32.exe 101 PID 4872 wrote to memory of 1044 4872 rundll32.exe 101 PID 1044 wrote to memory of 2520 1044 rundll32.exe 102 PID 1044 wrote to memory of 2520 1044 rundll32.exe 102 PID 1044 wrote to memory of 2520 1044 rundll32.exe 102 PID 2520 wrote to memory of 732 2520 rundll32.exe 103 PID 2520 wrote to memory of 732 2520 rundll32.exe 103 PID 2520 wrote to memory of 732 2520 rundll32.exe 103 PID 732 wrote to memory of 4896 732 rundll32.exe 104 PID 732 wrote to memory of 4896 732 rundll32.exe 104 PID 732 wrote to memory of 4896 732 rundll32.exe 104 PID 4896 wrote to memory of 2980 4896 rundll32.exe 105
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#123⤵PID:2980
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#124⤵PID:3576
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#125⤵PID:2976
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#126⤵PID:4220
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#127⤵PID:3976
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#128⤵PID:1264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#129⤵PID:416
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#130⤵PID:4404
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#131⤵PID:2540
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#132⤵PID:3500
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#133⤵PID:1200
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#134⤵PID:1564
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#135⤵PID:2260
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#136⤵PID:564
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#137⤵PID:1424
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#138⤵PID:4784
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#139⤵PID:1364
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#140⤵PID:3768
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#141⤵PID:1776
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#142⤵PID:1068
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#143⤵PID:1752
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#144⤵PID:4772
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#145⤵PID:1680
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#146⤵PID:1588
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#147⤵PID:3672
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#148⤵PID:3416
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#149⤵PID:1248
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#150⤵PID:2220
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#151⤵PID:4692
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#152⤵PID:3452
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#153⤵PID:904
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#154⤵PID:3092
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#155⤵PID:5044
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#156⤵PID:2036
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#157⤵PID:1988
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#158⤵PID:2672
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#159⤵PID:1492
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#160⤵PID:2084
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#161⤵PID:1488
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#162⤵PID:3248
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#163⤵PID:4412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#164⤵PID:3160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#165⤵PID:1996
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#166⤵PID:2956
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#167⤵PID:1560
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#168⤵PID:4280
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#169⤵PID:3752
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#170⤵PID:4920
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#171⤵PID:4320
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#172⤵PID:408
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#173⤵PID:2992
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#174⤵PID:2412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#175⤵PID:4880
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#176⤵PID:4020
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#177⤵PID:2780
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#178⤵PID:4628
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#179⤵PID:4968
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#180⤵PID:992
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#181⤵PID:4460
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#182⤵PID:1556
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#183⤵PID:1164
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#184⤵PID:5024
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#185⤵PID:2876
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#186⤵PID:3580
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#187⤵PID:2964
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#188⤵PID:2176
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#189⤵PID:3044
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#190⤵PID:5084
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#191⤵PID:2204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#192⤵PID:552
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#193⤵PID:4264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#194⤵PID:4328
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#195⤵PID:4292
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#196⤵PID:4380
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#197⤵PID:5124
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#198⤵PID:5140
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#199⤵PID:5156
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#1100⤵PID:5172
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#1101⤵PID:5188
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#1102⤵PID:5204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#1103⤵PID:5220
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#1104⤵PID:5244
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#1105⤵PID:5256
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#1106⤵PID:5272
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#1107⤵PID:5288
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#1108⤵PID:5304
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#1109⤵PID:5320
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#1110⤵PID:5336
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#1111⤵PID:5352
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#1112⤵PID:5368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#1113⤵PID:5384
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#1114⤵PID:5400
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#1115⤵PID:5416
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#1116⤵PID:5428
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#1117⤵PID:5444
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#1118⤵PID:5464
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#1119⤵PID:5480
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#1120⤵PID:5496
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#1121⤵PID:5512
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MediaEngine.dll,#1122⤵PID:5528
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-