Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
340635c25dc...18.exe
windows7-x64
340635c25dc...18.exe
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3CrashReport.exe
windows7-x64
1CrashReport.exe
windows10-2004-x64
1Encrypt.dll
windows7-x64
3Encrypt.dll
windows10-2004-x64
3Funshion.exe
windows7-x64
1Funshion.exe
windows10-2004-x64
1funshionplugin2.dll
windows7-x64
1funshionplugin2.dll
windows10-2004-x64
1Analysis
-
max time kernel
95s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
13/07/2024, 05:34
Static task
static1
Behavioral task
behavioral1
Sample
40635c25dc5c04d37335d63a2ab1dcf7_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
40635c25dc5c04d37335d63a2ab1dcf7_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
CrashReport.exe
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
CrashReport.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
Encrypt.dll
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
Encrypt.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral11
Sample
Funshion.exe
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
Funshion.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
funshionplugin2.dll
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
funshionplugin2.dll
Resource
win10v2004-20240709-en
General
-
Target
funshionplugin2.dll
-
Size
751KB
-
MD5
ca8106415daf0b94da12490d0737e612
-
SHA1
498b57df53d7f8e593f5d33228b8c4f87ef002ed
-
SHA256
6d5e5497f9db7a272b9b8f27c8f953a65d43ff6d673712016dcba67be4e85461
-
SHA512
5f3a356806f0b2b1e758210b4a5a52200efa74711503701793e33b9e8fd77e5a3a048ef455b7abcc3b488bbf4b088412cd7477dea3715726847d3930846abcac
-
SSDEEP
12288:JFhaYjCqVLj9ghFn2nPxVyBcy+DnhC9pkfKDqZ65UjKIpRlAcY0Qvj9:JBGqVLj9gL2nPXM+Dnc9pA65UOI3lDYV
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3340 wrote to memory of 2492 3340 rundll32.exe 84 PID 3340 wrote to memory of 2492 3340 rundll32.exe 84 PID 3340 wrote to memory of 2492 3340 rundll32.exe 84 PID 2492 wrote to memory of 1888 2492 rundll32.exe 87 PID 2492 wrote to memory of 1888 2492 rundll32.exe 87 PID 2492 wrote to memory of 1888 2492 rundll32.exe 87 PID 1888 wrote to memory of 3448 1888 rundll32.exe 88 PID 1888 wrote to memory of 3448 1888 rundll32.exe 88 PID 1888 wrote to memory of 3448 1888 rundll32.exe 88 PID 3448 wrote to memory of 4836 3448 rundll32.exe 89 PID 3448 wrote to memory of 4836 3448 rundll32.exe 89 PID 3448 wrote to memory of 4836 3448 rundll32.exe 89 PID 4836 wrote to memory of 3144 4836 rundll32.exe 90 PID 4836 wrote to memory of 3144 4836 rundll32.exe 90 PID 4836 wrote to memory of 3144 4836 rundll32.exe 90 PID 3144 wrote to memory of 4708 3144 rundll32.exe 91 PID 3144 wrote to memory of 4708 3144 rundll32.exe 91 PID 3144 wrote to memory of 4708 3144 rundll32.exe 91 PID 4708 wrote to memory of 1608 4708 rundll32.exe 92 PID 4708 wrote to memory of 1608 4708 rundll32.exe 92 PID 4708 wrote to memory of 1608 4708 rundll32.exe 92 PID 1608 wrote to memory of 3444 1608 rundll32.exe 93 PID 1608 wrote to memory of 3444 1608 rundll32.exe 93 PID 1608 wrote to memory of 3444 1608 rundll32.exe 93 PID 3444 wrote to memory of 4984 3444 rundll32.exe 94 PID 3444 wrote to memory of 4984 3444 rundll32.exe 94 PID 3444 wrote to memory of 4984 3444 rundll32.exe 94 PID 4984 wrote to memory of 4028 4984 rundll32.exe 95 PID 4984 wrote to memory of 4028 4984 rundll32.exe 95 PID 4984 wrote to memory of 4028 4984 rundll32.exe 95 PID 4028 wrote to memory of 792 4028 rundll32.exe 96 PID 4028 wrote to memory of 792 4028 rundll32.exe 96 PID 4028 wrote to memory of 792 4028 rundll32.exe 96 PID 792 wrote to memory of 4572 792 rundll32.exe 97 PID 792 wrote to memory of 4572 792 rundll32.exe 97 PID 792 wrote to memory of 4572 792 rundll32.exe 97 PID 4572 wrote to memory of 1928 4572 rundll32.exe 98 PID 4572 wrote to memory of 1928 4572 rundll32.exe 98 PID 4572 wrote to memory of 1928 4572 rundll32.exe 98 PID 1928 wrote to memory of 1940 1928 rundll32.exe 99 PID 1928 wrote to memory of 1940 1928 rundll32.exe 99 PID 1928 wrote to memory of 1940 1928 rundll32.exe 99 PID 1940 wrote to memory of 2700 1940 rundll32.exe 100 PID 1940 wrote to memory of 2700 1940 rundll32.exe 100 PID 1940 wrote to memory of 2700 1940 rundll32.exe 100 PID 2700 wrote to memory of 1464 2700 rundll32.exe 101 PID 2700 wrote to memory of 1464 2700 rundll32.exe 101 PID 2700 wrote to memory of 1464 2700 rundll32.exe 101 PID 1464 wrote to memory of 2080 1464 rundll32.exe 102 PID 1464 wrote to memory of 2080 1464 rundll32.exe 102 PID 1464 wrote to memory of 2080 1464 rundll32.exe 102 PID 2080 wrote to memory of 4928 2080 rundll32.exe 103 PID 2080 wrote to memory of 4928 2080 rundll32.exe 103 PID 2080 wrote to memory of 4928 2080 rundll32.exe 103 PID 4928 wrote to memory of 3464 4928 rundll32.exe 104 PID 4928 wrote to memory of 3464 4928 rundll32.exe 104 PID 4928 wrote to memory of 3464 4928 rundll32.exe 104 PID 3464 wrote to memory of 2960 3464 rundll32.exe 105 PID 3464 wrote to memory of 2960 3464 rundll32.exe 105 PID 3464 wrote to memory of 2960 3464 rundll32.exe 105 PID 2960 wrote to memory of 2948 2960 rundll32.exe 106 PID 2960 wrote to memory of 2948 2960 rundll32.exe 106 PID 2960 wrote to memory of 2948 2960 rundll32.exe 106 PID 2948 wrote to memory of 2900 2948 rundll32.exe 107
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#123⤵PID:2900
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#124⤵PID:2452
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#125⤵PID:4992
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#126⤵PID:4184
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#127⤵PID:3024
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#128⤵PID:2860
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#129⤵PID:5016
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#130⤵PID:1816
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#131⤵PID:2276
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#132⤵PID:5088
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#133⤵PID:3388
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#134⤵PID:3492
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#135⤵PID:4444
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#136⤵PID:2284
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#137⤵PID:916
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#138⤵PID:3632
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#139⤵PID:3432
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#140⤵PID:4492
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#141⤵PID:3348
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#142⤵PID:4772
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#143⤵PID:3628
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#144⤵PID:5064
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#145⤵PID:4500
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#146⤵PID:1140
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#147⤵PID:3476
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#148⤵PID:1336
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#149⤵PID:4260
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#150⤵PID:956
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#151⤵PID:2032
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#152⤵PID:2360
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#153⤵PID:2220
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#154⤵PID:3932
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#155⤵PID:4764
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#156⤵PID:1764
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#157⤵PID:4760
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#158⤵PID:3896
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#159⤵PID:1084
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#160⤵PID:1696
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#161⤵PID:3272
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#162⤵PID:4224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#163⤵PID:1972
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#164⤵PID:3968
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#165⤵PID:992
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#166⤵PID:1732
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#167⤵PID:4744
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#168⤵PID:1872
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#169⤵PID:1064
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#170⤵PID:912
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#171⤵PID:3956
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#172⤵PID:2596
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#173⤵PID:4780
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#174⤵PID:2036
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#175⤵PID:3284
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#176⤵PID:1492
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#177⤵PID:5112
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#178⤵PID:324
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#179⤵PID:644
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#180⤵PID:2916
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#181⤵PID:4832
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#182⤵PID:384
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#183⤵PID:2732
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#184⤵PID:2084
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#185⤵PID:3212
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#186⤵PID:3520
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#187⤵PID:1552
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#188⤵PID:4284
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#189⤵PID:2356
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#190⤵PID:3344
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#191⤵PID:1616
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#192⤵PID:1828
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#193⤵PID:2980
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#194⤵PID:4888
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#195⤵PID:2740
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#196⤵PID:4560
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#197⤵PID:4216
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#198⤵PID:1596
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#199⤵PID:2328
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#1100⤵PID:3688
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#1101⤵PID:4800
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#1102⤵PID:4384
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#1103⤵PID:2104
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#1104⤵PID:3620
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#1105⤵PID:2460
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#1106⤵PID:2472
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#1107⤵PID:3056
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#1108⤵PID:2712
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#1109⤵PID:5048
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#1110⤵PID:1576
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#1111⤵PID:5124
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#1112⤵PID:5136
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#1113⤵PID:5152
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#1114⤵PID:5168
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#1115⤵PID:5184
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#1116⤵PID:5196
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#1117⤵PID:5208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#1118⤵PID:5228
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#1119⤵PID:5244
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#1120⤵PID:5260
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#1121⤵PID:5272
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\funshionplugin2.dll,#1122⤵PID:5284
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-