Overview
overview
3Static
static
3cvery.comv...er.vbs
windows7-x64
1cvery.comv...er.vbs
windows10-2004-x64
1cvery.comv...m1.vbs
windows7-x64
1cvery.comv...m1.vbs
windows10-2004-x64
1cvery.comv...l1.vbs
windows7-x64
1cvery.comv...l1.vbs
windows10-2004-x64
1cvery.comv...ar.dll
windows7-x64
1cvery.comv...ar.dll
windows10-2004-x64
1cvery.comv...sh.dll
windows7-x64
1cvery.comv...sh.dll
windows10-2004-x64
1cvery.comv...m1.vbs
windows7-x64
1cvery.comv...m1.vbs
windows10-2004-x64
1cvery.comv...m2.vbs
windows7-x64
1cvery.comv...m2.vbs
windows10-2004-x64
1cvery.comv...nd.vbs
windows7-x64
1cvery.comv...nd.vbs
windows10-2004-x64
1cvery.comv...ND.vbs
windows7-x64
1cvery.comv...ND.vbs
windows10-2004-x64
1cvery.comv...in.vbs
windows7-x64
1cvery.comv...in.vbs
windows10-2004-x64
1cvery.comv...sh.vbs
windows7-x64
1cvery.comv...sh.vbs
windows10-2004-x64
1cvery.comv...ay.vbs
windows7-x64
1cvery.comv...ay.vbs
windows10-2004-x64
1cvery.comv...DB.vbs
windows7-x64
1cvery.comv...DB.vbs
windows10-2004-x64
1cvery.comv...n4.dll
windows7-x64
1cvery.comv...n4.dll
windows10-2004-x64
1cvery.comv...n4.dll
windows7-x64
1cvery.comv...n4.dll
windows10-2004-x64
1cvery.comv...ut.vbs
windows7-x64
1cvery.comv...ut.vbs
windows10-2004-x64
1Analysis
-
max time kernel
141s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22-07-2024 08:43
Static task
static1
Behavioral task
behavioral1
Sample
cvery.comvb9144523534524/server/FrmServer.vbs
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
cvery.comvb9144523534524/server/FrmServer.vbs
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
cvery.comvb9144523534524/wjl/ColXpProgressBar/Form1.vbs
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
cvery.comvb9144523534524/wjl/ColXpProgressBar/Form1.vbs
Resource
win10v2004-20240704-en
Behavioral task
behavioral5
Sample
cvery.comvb9144523534524/wjl/ColXpProgressBar/UserControl1.vbs
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
cvery.comvb9144523534524/wjl/ColXpProgressBar/UserControl1.vbs
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
cvery.comvb9144523534524/wjl/ColXpProgressBar/XpProgressBar.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
cvery.comvb9144523534524/wjl/ColXpProgressBar/XpProgressBar.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
cvery.comvb9144523534524/wjl/Flash.dll
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
cvery.comvb9144523534524/wjl/Flash.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
cvery.comvb9144523534524/wjl/Form1.vbs
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
cvery.comvb9144523534524/wjl/Form1.vbs
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
cvery.comvb9144523534524/wjl/Form2.vbs
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
cvery.comvb9144523534524/wjl/Form2.vbs
Resource
win10v2004-20240704-en
Behavioral task
behavioral15
Sample
cvery.comvb9144523534524/wjl/FrmFind.vbs
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
cvery.comvb9144523534524/wjl/FrmFind.vbs
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
cvery.comvb9144523534524/wjl/FrmFindEND.vbs
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
cvery.comvb9144523534524/wjl/FrmFindEND.vbs
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
cvery.comvb9144523534524/wjl/FrmMain.vbs
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
cvery.comvb9144523534524/wjl/FrmMain.vbs
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
cvery.comvb9144523534524/wjl/FrmWish.vbs
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
cvery.comvb9144523534524/wjl/FrmWish.vbs
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
cvery.comvb9144523534524/wjl/ModDay.vbs
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
cvery.comvb9144523534524/wjl/ModDay.vbs
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
cvery.comvb9144523534524/wjl/ModOponDB.vbs
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
cvery.comvb9144523534524/wjl/ModOponDB.vbs
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
cvery.comvb9144523534524/wjl/actskin4.dll
Resource
win7-20240705-en
Behavioral task
behavioral28
Sample
cvery.comvb9144523534524/wjl/actskin4.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
cvery.comvb9144523534524/wjl/actskin4.dll
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
cvery.comvb9144523534524/wjl/actskin4.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral31
Sample
cvery.comvb9144523534524/wjl/frmAbout.vbs
Resource
win7-20240705-en
Behavioral task
behavioral32
Sample
cvery.comvb9144523534524/wjl/frmAbout.vbs
Resource
win10v2004-20240709-en
General
-
Target
cvery.comvb9144523534524/wjl/ColXpProgressBar/XpProgressBar.dll
-
Size
19KB
-
MD5
3988e63e05666f93dc5e8a8959f2169b
-
SHA1
f996498046204082d504cd7d43f6f4b0649c0bdf
-
SHA256
ff774c4aa831b544b68dfa00d6db25973823bd918be1dd2fbfc3a7658ec6d8ac
-
SHA512
01979c18bdf2b320a4b64444e16d93684eb0a5b4c1a92a5ac45db7d3b485723086a01f570085d55af7cf684feb72efbe197d7912e7eab5195f1a375c547e0e37
-
SSDEEP
384:eUZyBEzU08liipC+TDkiI97/0NF+8XO+c08N:eU0EzcI+TgiI9gWex
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3528 wrote to memory of 2076 3528 rundll32.exe 84 PID 3528 wrote to memory of 2076 3528 rundll32.exe 84 PID 3528 wrote to memory of 2076 3528 rundll32.exe 84 PID 2076 wrote to memory of 1300 2076 rundll32.exe 86 PID 2076 wrote to memory of 1300 2076 rundll32.exe 86 PID 2076 wrote to memory of 1300 2076 rundll32.exe 86 PID 1300 wrote to memory of 2492 1300 rundll32.exe 87 PID 1300 wrote to memory of 2492 1300 rundll32.exe 87 PID 1300 wrote to memory of 2492 1300 rundll32.exe 87 PID 2492 wrote to memory of 2680 2492 rundll32.exe 88 PID 2492 wrote to memory of 2680 2492 rundll32.exe 88 PID 2492 wrote to memory of 2680 2492 rundll32.exe 88 PID 2680 wrote to memory of 4608 2680 rundll32.exe 90 PID 2680 wrote to memory of 4608 2680 rundll32.exe 90 PID 2680 wrote to memory of 4608 2680 rundll32.exe 90 PID 4608 wrote to memory of 1852 4608 rundll32.exe 91 PID 4608 wrote to memory of 1852 4608 rundll32.exe 91 PID 4608 wrote to memory of 1852 4608 rundll32.exe 91 PID 1852 wrote to memory of 532 1852 rundll32.exe 92 PID 1852 wrote to memory of 532 1852 rundll32.exe 92 PID 1852 wrote to memory of 532 1852 rundll32.exe 92 PID 532 wrote to memory of 1148 532 rundll32.exe 93 PID 532 wrote to memory of 1148 532 rundll32.exe 93 PID 532 wrote to memory of 1148 532 rundll32.exe 93 PID 1148 wrote to memory of 552 1148 rundll32.exe 94 PID 1148 wrote to memory of 552 1148 rundll32.exe 94 PID 1148 wrote to memory of 552 1148 rundll32.exe 94 PID 552 wrote to memory of 4300 552 rundll32.exe 95 PID 552 wrote to memory of 4300 552 rundll32.exe 95 PID 552 wrote to memory of 4300 552 rundll32.exe 95 PID 4300 wrote to memory of 3272 4300 rundll32.exe 96 PID 4300 wrote to memory of 3272 4300 rundll32.exe 96 PID 4300 wrote to memory of 3272 4300 rundll32.exe 96 PID 3272 wrote to memory of 4116 3272 rundll32.exe 97 PID 3272 wrote to memory of 4116 3272 rundll32.exe 97 PID 3272 wrote to memory of 4116 3272 rundll32.exe 97 PID 4116 wrote to memory of 3052 4116 rundll32.exe 98 PID 4116 wrote to memory of 3052 4116 rundll32.exe 98 PID 4116 wrote to memory of 3052 4116 rundll32.exe 98 PID 3052 wrote to memory of 1320 3052 rundll32.exe 99 PID 3052 wrote to memory of 1320 3052 rundll32.exe 99 PID 3052 wrote to memory of 1320 3052 rundll32.exe 99 PID 1320 wrote to memory of 692 1320 rundll32.exe 100 PID 1320 wrote to memory of 692 1320 rundll32.exe 100 PID 1320 wrote to memory of 692 1320 rundll32.exe 100 PID 692 wrote to memory of 4216 692 rundll32.exe 101 PID 692 wrote to memory of 4216 692 rundll32.exe 101 PID 692 wrote to memory of 4216 692 rundll32.exe 101 PID 4216 wrote to memory of 3472 4216 rundll32.exe 102 PID 4216 wrote to memory of 3472 4216 rundll32.exe 102 PID 4216 wrote to memory of 3472 4216 rundll32.exe 102 PID 3472 wrote to memory of 2092 3472 rundll32.exe 103 PID 3472 wrote to memory of 2092 3472 rundll32.exe 103 PID 3472 wrote to memory of 2092 3472 rundll32.exe 103 PID 2092 wrote to memory of 3460 2092 rundll32.exe 104 PID 2092 wrote to memory of 3460 2092 rundll32.exe 104 PID 2092 wrote to memory of 3460 2092 rundll32.exe 104 PID 3460 wrote to memory of 2036 3460 rundll32.exe 106 PID 3460 wrote to memory of 2036 3460 rundll32.exe 106 PID 3460 wrote to memory of 2036 3460 rundll32.exe 106 PID 2036 wrote to memory of 1464 2036 rundll32.exe 107 PID 2036 wrote to memory of 1464 2036 rundll32.exe 107 PID 2036 wrote to memory of 1464 2036 rundll32.exe 107 PID 1464 wrote to memory of 1244 1464 rundll32.exe 108
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#123⤵PID:1244
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#124⤵PID:3136
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#125⤵PID:5088
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#126⤵PID:2760
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#127⤵PID:1528
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#128⤵PID:3940
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#129⤵PID:4704
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#130⤵PID:2316
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#131⤵PID:3468
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#132⤵PID:2240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#133⤵PID:4332
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#134⤵PID:5064
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#135⤵PID:912
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#136⤵PID:4512
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#137⤵PID:3036
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#138⤵PID:3960
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#139⤵PID:5036
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#140⤵PID:444
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#141⤵PID:3680
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#142⤵PID:4880
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#143⤵PID:1824
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#144⤵PID:1972
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#145⤵PID:2928
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#146⤵PID:2656
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#147⤵PID:4456
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#148⤵PID:3008
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#149⤵PID:3796
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#150⤵PID:1124
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#151⤵PID:2228
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#152⤵PID:956
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#153⤵PID:4676
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#154⤵PID:4996
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#155⤵PID:4328
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#156⤵PID:4808
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#157⤵PID:1684
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#158⤵PID:4752
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#159⤵PID:3716
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#160⤵PID:3252
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#161⤵PID:2420
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#162⤵PID:2088
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#163⤵PID:1708
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#164⤵PID:3364
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#165⤵PID:4380
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#166⤵PID:4780
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#167⤵PID:3152
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#168⤵PID:2160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#169⤵PID:3300
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#170⤵PID:5108
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#171⤵PID:3596
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#172⤵PID:2524
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#173⤵PID:4612
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#174⤵PID:4136
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#175⤵PID:4200
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#176⤵PID:1508
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#177⤵PID:3876
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#178⤵PID:4776
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#179⤵PID:4992
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#180⤵PID:3384
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#181⤵PID:4564
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#182⤵PID:5044
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#183⤵PID:1608
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#184⤵PID:4032
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#185⤵PID:1736
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#186⤵PID:4960
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#187⤵PID:4708
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#188⤵PID:2440
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#189⤵PID:3888
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#190⤵PID:3448
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#191⤵PID:3108
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#192⤵PID:4268
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#193⤵PID:1700
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#194⤵PID:116
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#195⤵PID:1584
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#196⤵PID:4908
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#197⤵PID:4592
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#198⤵PID:2116
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#199⤵PID:1720
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#1100⤵PID:3588
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#1101⤵PID:1228
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#1102⤵PID:5128
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#1103⤵PID:5144
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#1104⤵PID:5160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#1105⤵PID:5172
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#1106⤵PID:5188
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#1107⤵PID:5204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#1108⤵PID:5220
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#1109⤵PID:5236
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#1110⤵PID:5248
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#1111⤵PID:5280
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#1112⤵PID:5296
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#1113⤵PID:5316
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#1114⤵PID:5360
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#1115⤵PID:5384
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#1116⤵PID:5416
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#1117⤵PID:5436
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#1118⤵PID:5448
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#1119⤵PID:5484
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#1120⤵PID:5516
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#1121⤵PID:5564
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvb9144523534524\wjl\ColXpProgressBar\XpProgressBar.dll,#1122⤵PID:5584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-