Overview
overview
6Static
static
3PECompact2/PEC2.exe
windows7-x64
3PECompact2/PEC2.exe
windows10-2004-x64
3PECompact2/lzma.exe
windows7-x64
1PECompact2/lzma.exe
windows10-2004-x64
3PECompact2...ib.dll
windows7-x64
3PECompact2...ib.dll
windows10-2004-x64
3PECompact2...lz.dll
windows7-x64
3PECompact2...lz.dll
windows10-2004-x64
3PECompact2...py.dll
windows7-x64
3PECompact2...py.dll
windows10-2004-x64
3PECompact2...32.dll
windows7-x64
3PECompact2...32.dll
windows10-2004-x64
3PECompact2...ce.dll
windows7-x64
3PECompact2...ce.dll
windows10-2004-x64
3PECompact2...nv.dll
windows7-x64
3PECompact2...nv.dll
windows10-2004-x64
3PECompact2...g1.dll
windows7-x64
3PECompact2...g1.dll
windows10-2004-x64
3PECompact2...ma.dll
windows7-x64
3PECompact2...ma.dll
windows10-2004-x64
3PECompact2...a2.dll
windows7-x64
3PECompact2...a2.dll
windows10-2004-x64
3PECompact2...ox.dll
windows7-x64
3PECompact2...ox.dll
windows10-2004-x64
3PECompact2...rd.dll
windows7-x64
3PECompact2...rd.dll
windows10-2004-x64
3PECompact2...lt.dll
windows7-x64
3PECompact2...lt.dll
windows10-2004-x64
3Parser2.dll
windows7-x64
3Parser2.dll
windows10-2004-x64
3Parser2.exe
windows7-x64
6Parser2.exe
windows10-2004-x64
6Analysis
-
max time kernel
140s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/08/2024, 04:46
Static task
static1
Behavioral task
behavioral1
Sample
PECompact2/PEC2.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
PECompact2/PEC2.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
PECompact2/lzma.exe
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
PECompact2/lzma.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
PECompact2/pec2codec_aplib.dll
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
PECompact2/pec2codec_aplib.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
PECompact2/pec2codec_brieflz.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
PECompact2/pec2codec_brieflz.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
PECompact2/pec2codec_copy.dll
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
PECompact2/pec2codec_copy.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
PECompact2/pec2codec_crc32.dll
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
PECompact2/pec2codec_crc32.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
PECompact2/pec2codec_ffce.dll
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
PECompact2/pec2codec_ffce.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
PECompact2/pec2codec_inv.dll
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
PECompact2/pec2codec_inv.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
PECompact2/pec2codec_jcalg1.dll
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
PECompact2/pec2codec_jcalg1.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
PECompact2/pec2codec_lzma.dll
Resource
win7-20240729-en
Behavioral task
behavioral20
Sample
PECompact2/pec2codec_lzma.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
PECompact2/pec2codec_lzma2.dll
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
PECompact2/pec2codec_lzma2.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
PECompact2/pec2codec_messagebox.dll
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
PECompact2/pec2codec_messagebox.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
PECompact2/pec2codec_password.dll
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
PECompact2/pec2codec_password.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
PECompact2/pec2ldr_default.dll
Resource
win7-20240705-en
Behavioral task
behavioral28
Sample
PECompact2/pec2ldr_default.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
Parser2.dll
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
Parser2.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
Parser2.exe
Resource
win7-20240708-en
General
-
Target
Parser2.dll
-
Size
105KB
-
MD5
1bc6308d27a67d778809c9fc8a254d4e
-
SHA1
50de7c2d93a73c72ecc9c243222af93ee520e7e0
-
SHA256
5706494ba548011ee0672c2154143ba3b83d56eb485cabd16b4df7ba0316e6e1
-
SHA512
37900eb63914ac7324029f21b90f8f9e1c6107b726ba3ec36daa4c9eec96dc7b827db8c11ef996729f99f70a62cf062a62edd4465af5e8e8b2b2e6f02dac5627
-
SSDEEP
1536:VKeI1oUCNS4ayZ46ovgEijVj+t2FgWGhvDWn1zMZcSSfTNXn3ZkNVQXag7jlpibQ:VU1zCXayhVe7b0MvQN3Wwu
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2444 wrote to memory of 3852 2444 rundll32.exe 84 PID 2444 wrote to memory of 3852 2444 rundll32.exe 84 PID 2444 wrote to memory of 3852 2444 rundll32.exe 84 PID 3852 wrote to memory of 2576 3852 rundll32.exe 86 PID 3852 wrote to memory of 2576 3852 rundll32.exe 86 PID 3852 wrote to memory of 2576 3852 rundll32.exe 86 PID 2576 wrote to memory of 8 2576 rundll32.exe 87 PID 2576 wrote to memory of 8 2576 rundll32.exe 87 PID 2576 wrote to memory of 8 2576 rundll32.exe 87 PID 8 wrote to memory of 2280 8 rundll32.exe 88 PID 8 wrote to memory of 2280 8 rundll32.exe 88 PID 8 wrote to memory of 2280 8 rundll32.exe 88 PID 2280 wrote to memory of 2196 2280 rundll32.exe 89 PID 2280 wrote to memory of 2196 2280 rundll32.exe 89 PID 2280 wrote to memory of 2196 2280 rundll32.exe 89 PID 2196 wrote to memory of 3916 2196 rundll32.exe 90 PID 2196 wrote to memory of 3916 2196 rundll32.exe 90 PID 2196 wrote to memory of 3916 2196 rundll32.exe 90 PID 3916 wrote to memory of 3128 3916 rundll32.exe 91 PID 3916 wrote to memory of 3128 3916 rundll32.exe 91 PID 3916 wrote to memory of 3128 3916 rundll32.exe 91 PID 3128 wrote to memory of 3680 3128 rundll32.exe 93 PID 3128 wrote to memory of 3680 3128 rundll32.exe 93 PID 3128 wrote to memory of 3680 3128 rundll32.exe 93 PID 3680 wrote to memory of 1488 3680 rundll32.exe 94 PID 3680 wrote to memory of 1488 3680 rundll32.exe 94 PID 3680 wrote to memory of 1488 3680 rundll32.exe 94 PID 1488 wrote to memory of 3952 1488 rundll32.exe 95 PID 1488 wrote to memory of 3952 1488 rundll32.exe 95 PID 1488 wrote to memory of 3952 1488 rundll32.exe 95 PID 3952 wrote to memory of 4828 3952 rundll32.exe 96 PID 3952 wrote to memory of 4828 3952 rundll32.exe 96 PID 3952 wrote to memory of 4828 3952 rundll32.exe 96 PID 4828 wrote to memory of 2964 4828 rundll32.exe 97 PID 4828 wrote to memory of 2964 4828 rundll32.exe 97 PID 4828 wrote to memory of 2964 4828 rundll32.exe 97 PID 2964 wrote to memory of 4912 2964 rundll32.exe 98 PID 2964 wrote to memory of 4912 2964 rundll32.exe 98 PID 2964 wrote to memory of 4912 2964 rundll32.exe 98 PID 4912 wrote to memory of 1176 4912 rundll32.exe 99 PID 4912 wrote to memory of 1176 4912 rundll32.exe 99 PID 4912 wrote to memory of 1176 4912 rundll32.exe 99 PID 1176 wrote to memory of 3196 1176 rundll32.exe 100 PID 1176 wrote to memory of 3196 1176 rundll32.exe 100 PID 1176 wrote to memory of 3196 1176 rundll32.exe 100 PID 3196 wrote to memory of 4884 3196 rundll32.exe 101 PID 3196 wrote to memory of 4884 3196 rundll32.exe 101 PID 3196 wrote to memory of 4884 3196 rundll32.exe 101 PID 4884 wrote to memory of 464 4884 rundll32.exe 102 PID 4884 wrote to memory of 464 4884 rundll32.exe 102 PID 4884 wrote to memory of 464 4884 rundll32.exe 102 PID 464 wrote to memory of 4492 464 rundll32.exe 104 PID 464 wrote to memory of 4492 464 rundll32.exe 104 PID 464 wrote to memory of 4492 464 rundll32.exe 104 PID 4492 wrote to memory of 2228 4492 rundll32.exe 105 PID 4492 wrote to memory of 2228 4492 rundll32.exe 105 PID 4492 wrote to memory of 2228 4492 rundll32.exe 105 PID 2228 wrote to memory of 400 2228 rundll32.exe 106 PID 2228 wrote to memory of 400 2228 rundll32.exe 106 PID 2228 wrote to memory of 400 2228 rundll32.exe 106 PID 400 wrote to memory of 4816 400 rundll32.exe 107 PID 400 wrote to memory of 4816 400 rundll32.exe 107 PID 400 wrote to memory of 4816 400 rundll32.exe 107 PID 4816 wrote to memory of 1076 4816 rundll32.exe 108
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#120⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#123⤵PID:1076
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#124⤵PID:3864
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#125⤵PID:4040
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#126⤵PID:3136
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#127⤵PID:2744
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#128⤵PID:3348
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#129⤵PID:5004
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#130⤵PID:3644
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#131⤵PID:3080
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#132⤵PID:3500
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#133⤵PID:3468
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#134⤵PID:5084
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#135⤵PID:2448
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#136⤵
- System Location Discovery: System Language Discovery
PID:2636 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#137⤵PID:2256
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#138⤵PID:1524
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#139⤵PID:540
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#140⤵PID:456
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#141⤵PID:1648
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#142⤵PID:4704
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#143⤵PID:5048
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#144⤵PID:5024
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#145⤵PID:3472
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#146⤵
- System Location Discovery: System Language Discovery
PID:412 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#147⤵
- System Location Discovery: System Language Discovery
PID:4460 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#148⤵PID:1328
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#149⤵PID:4088
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#150⤵PID:4536
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#151⤵PID:2220
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#152⤵PID:4712
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#153⤵PID:1452
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#154⤵PID:5052
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#155⤵PID:3112
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#156⤵PID:3396
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#157⤵PID:1868
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#158⤵PID:2904
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#159⤵PID:4880
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#160⤵PID:1836
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#161⤵
- System Location Discovery: System Language Discovery
PID:1944 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#162⤵PID:1428
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#163⤵PID:2436
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#164⤵PID:4660
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#165⤵PID:2464
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#166⤵PID:2096
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#167⤵PID:4876
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#168⤵PID:1808
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#169⤵PID:4860
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#170⤵PID:3028
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#171⤵PID:3620
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#172⤵PID:3924
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#173⤵PID:1548
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#174⤵PID:1776
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#175⤵PID:2644
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#176⤵PID:2312
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#177⤵PID:3484
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#178⤵PID:1876
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#179⤵PID:3232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#180⤵
- System Location Discovery: System Language Discovery
PID:2116 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#181⤵PID:2428
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#182⤵PID:3228
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#183⤵PID:1668
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#184⤵PID:4544
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#185⤵PID:4728
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#186⤵PID:3856
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#187⤵PID:4248
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#188⤵PID:4432
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#189⤵PID:4652
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#190⤵PID:1700
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#191⤵PID:1504
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#192⤵PID:2524
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#193⤵PID:2296
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#194⤵PID:1160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#195⤵PID:4308
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#196⤵PID:4468
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#197⤵PID:3452
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#198⤵PID:5128
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#199⤵PID:5144
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#1100⤵PID:5160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#1101⤵PID:5172
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#1102⤵PID:5188
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#1103⤵PID:5208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#1104⤵PID:5224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#1105⤵PID:5240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#1106⤵PID:5256
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#1107⤵PID:5272
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#1108⤵PID:5284
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#1109⤵PID:5296
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#1110⤵PID:5316
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#1111⤵PID:5332
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#1112⤵PID:5348
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#1113⤵PID:5364
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#1114⤵PID:5376
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#1115⤵PID:5388
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#1116⤵PID:5404
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#1117⤵PID:5416
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#1118⤵PID:5432
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#1119⤵PID:5448
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#1120⤵PID:5464
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#1121⤵PID:5480
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Parser2.dll,#1122⤵PID:5496
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-