Analysis
-
max time kernel
150s -
max time network
96s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
13-10-2024 22:55
General
-
Target
log sender/System.Windows.Controls.Ribbon.dll
-
Size
717KB
-
MD5
cc525c252df576029f7e57314e6adc70
-
SHA1
494a86031ab56bcd902aaafdce2da075d576e98f
-
SHA256
5247998b746043a4a1ab78f198246c2db06ecd0fd5705f2ea95d7eee8fe3a9a0
-
SHA512
c2540b2c154be72984c9587a3a9fbac8d372042bcf17e2034fe7b04681c9afe21f0466a73c2fa252bb88e6aa9169c5d95c67c18ada6ad0d907ff95a18eb0d391
-
SSDEEP
12288:E4Hw9HSNAqMDcnexymWQxOXlzEOIF6HX6:E2S4nexymWgOXlzEOIF6HX6
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#14⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#15⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#16⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#17⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#18⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#19⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#110⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#111⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#112⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#113⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#114⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#115⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#116⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#117⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#118⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#119⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#120⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#121⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#122⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#123⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#124⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#125⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#126⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#127⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#128⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#129⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#130⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#131⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#132⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#133⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#134⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#135⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#136⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#137⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#138⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#139⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#140⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#141⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#142⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#143⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#144⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#145⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#146⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#147⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#148⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#149⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#150⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#151⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#152⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#153⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#154⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#155⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#156⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#157⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#158⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#159⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#160⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#161⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#162⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#163⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#164⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#165⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#166⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#167⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#168⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#169⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#170⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#171⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#172⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#173⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#174⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#175⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#176⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#177⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#178⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#179⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#180⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#181⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#182⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#183⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#184⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#185⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#186⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#187⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#188⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#189⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#190⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#191⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#192⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#193⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#194⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#195⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#196⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#197⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#198⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#199⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#1100⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#1101⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#1102⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#1103⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#1104⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#1105⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#1106⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#1107⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#1108⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#1109⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#1110⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#1111⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#1112⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#1113⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#1114⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#1115⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#1116⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#1117⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#1118⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#1119⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#1120⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\log sender\System.Windows.Controls.Ribbon.dll",#1121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-