Overview
overview
7Static
static
38275337624...18.exe
windows7-x64
38275337624...18.exe
windows10-2004-x64
3$PLUGINSDI...nt.dll
windows7-x64
3$PLUGINSDI...nt.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...ck.dll
windows7-x64
3$PLUGINSDI...ck.dll
windows10-2004-x64
3$SYSDIR/ff_vfw.dll
windows7-x64
3$SYSDIR/ff_vfw.dll
windows10-2004-x64
3$SYSDIR/msvcr71.dll
windows7-x64
3$SYSDIR/msvcr71.dll
windows10-2004-x64
3$TEMP/cfco...te.exe
windows7-x64
7$TEMP/cfco...te.exe
windows10-2004-x64
7$PLUGINSDI...te.dll
windows7-x64
3$PLUGINSDI...te.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...ck.dll
windows7-x64
3$PLUGINSDI...ck.dll
windows10-2004-x64
3$_6_/divx5/DivX.dll
windows7-x64
3$_6_/divx5/DivX.dll
windows10-2004-x64
3$_6_/divx5/PSIKey.dll
windows7-x64
3$_6_/divx5/PSIKey.dll
windows10-2004-x64
3$_6_/ffdsh...ow.dll
windows7-x64
3$_6_/ffdsh...ow.dll
windows10-2004-x64
3$_6_/ffdsh...ff.dll
windows7-x64
3$_6_/ffdsh...ff.dll
windows10-2004-x64
3$_6_/ffdsh...ID.dll
windows7-x64
3$_6_/ffdsh...ID.dll
windows10-2004-x64
3Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31-10-2024 08:27
Static task
static1
Behavioral task
behavioral1
Sample
8275337624b2c795196952c0ef0f22d1_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8275337624b2c795196952c0ef0f22d1_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/DLLWebCount.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/DLLWebCount.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/ServiceBlock.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/ServiceBlock.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
$SYSDIR/ff_vfw.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
$SYSDIR/ff_vfw.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
$SYSDIR/msvcr71.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
$SYSDIR/msvcr71.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
$TEMP/cfcodecdelete.exe
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
$TEMP/cfcodecdelete.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/FRNDelete.dll
Resource
win7-20241010-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/FRNDelete.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/ServiceBlock.dll
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/ServiceBlock.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
$_6_/divx5/DivX.dll
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
$_6_/divx5/DivX.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
$_6_/divx5/PSIKey.dll
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
$_6_/divx5/PSIKey.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
$_6_/ffdshow/FLT_ffdshow.dll
Resource
win7-20241010-en
Behavioral task
behavioral28
Sample
$_6_/ffdshow/FLT_ffdshow.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
$_6_/ffdshow/TomsMoComp_ff.dll
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
$_6_/ffdshow/TomsMoComp_ff.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
$_6_/ffdshow/WinCPUID.dll
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
$_6_/ffdshow/WinCPUID.dll
Resource
win10v2004-20241007-en
General
-
Target
$_6_/divx5/PSIKey.dll
-
Size
1.2MB
-
MD5
521d996daa9845cdbd66db1cf84e4834
-
SHA1
b6fea32f8ef2aa599932b016ebe35482940821a8
-
SHA256
60c9d7edcd84c0a98f3386e8b7adebf1c24c62af2b3faa121e72ad293d93e9f0
-
SHA512
77b0c2c8fa067c352fd6d58e7e56bbd5d881f3dd502e750dfc370d780fdeb312c35087563869eb71a4532ff4895beddbb8f0a20f29388587dc1b03584d435ea5
-
SSDEEP
24576:+phpMPO4FnkiCuVexgXm1zUnQOxKy9ogOpE23flSY:tVkiCWeK22NozE23flSY
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4884 wrote to memory of 3896 4884 rundll32.exe 84 PID 4884 wrote to memory of 3896 4884 rundll32.exe 84 PID 4884 wrote to memory of 3896 4884 rundll32.exe 84 PID 3896 wrote to memory of 692 3896 rundll32.exe 86 PID 3896 wrote to memory of 692 3896 rundll32.exe 86 PID 3896 wrote to memory of 692 3896 rundll32.exe 86 PID 692 wrote to memory of 3980 692 rundll32.exe 87 PID 692 wrote to memory of 3980 692 rundll32.exe 87 PID 692 wrote to memory of 3980 692 rundll32.exe 87 PID 3980 wrote to memory of 2796 3980 rundll32.exe 88 PID 3980 wrote to memory of 2796 3980 rundll32.exe 88 PID 3980 wrote to memory of 2796 3980 rundll32.exe 88 PID 2796 wrote to memory of 3268 2796 rundll32.exe 89 PID 2796 wrote to memory of 3268 2796 rundll32.exe 89 PID 2796 wrote to memory of 3268 2796 rundll32.exe 89 PID 3268 wrote to memory of 4228 3268 rundll32.exe 90 PID 3268 wrote to memory of 4228 3268 rundll32.exe 90 PID 3268 wrote to memory of 4228 3268 rundll32.exe 90 PID 4228 wrote to memory of 2512 4228 rundll32.exe 91 PID 4228 wrote to memory of 2512 4228 rundll32.exe 91 PID 4228 wrote to memory of 2512 4228 rundll32.exe 91 PID 2512 wrote to memory of 2212 2512 rundll32.exe 92 PID 2512 wrote to memory of 2212 2512 rundll32.exe 92 PID 2512 wrote to memory of 2212 2512 rundll32.exe 92 PID 2212 wrote to memory of 64 2212 rundll32.exe 93 PID 2212 wrote to memory of 64 2212 rundll32.exe 93 PID 2212 wrote to memory of 64 2212 rundll32.exe 93 PID 64 wrote to memory of 1116 64 rundll32.exe 94 PID 64 wrote to memory of 1116 64 rundll32.exe 94 PID 64 wrote to memory of 1116 64 rundll32.exe 94 PID 1116 wrote to memory of 4360 1116 rundll32.exe 95 PID 1116 wrote to memory of 4360 1116 rundll32.exe 95 PID 1116 wrote to memory of 4360 1116 rundll32.exe 95 PID 4360 wrote to memory of 3052 4360 rundll32.exe 96 PID 4360 wrote to memory of 3052 4360 rundll32.exe 96 PID 4360 wrote to memory of 3052 4360 rundll32.exe 96 PID 3052 wrote to memory of 1372 3052 rundll32.exe 97 PID 3052 wrote to memory of 1372 3052 rundll32.exe 97 PID 3052 wrote to memory of 1372 3052 rundll32.exe 97 PID 1372 wrote to memory of 4712 1372 rundll32.exe 98 PID 1372 wrote to memory of 4712 1372 rundll32.exe 98 PID 1372 wrote to memory of 4712 1372 rundll32.exe 98 PID 4712 wrote to memory of 4620 4712 rundll32.exe 100 PID 4712 wrote to memory of 4620 4712 rundll32.exe 100 PID 4712 wrote to memory of 4620 4712 rundll32.exe 100 PID 4620 wrote to memory of 1004 4620 rundll32.exe 101 PID 4620 wrote to memory of 1004 4620 rundll32.exe 101 PID 4620 wrote to memory of 1004 4620 rundll32.exe 101 PID 1004 wrote to memory of 5008 1004 rundll32.exe 102 PID 1004 wrote to memory of 5008 1004 rundll32.exe 102 PID 1004 wrote to memory of 5008 1004 rundll32.exe 102 PID 5008 wrote to memory of 4924 5008 rundll32.exe 103 PID 5008 wrote to memory of 4924 5008 rundll32.exe 103 PID 5008 wrote to memory of 4924 5008 rundll32.exe 103 PID 4924 wrote to memory of 4084 4924 rundll32.exe 104 PID 4924 wrote to memory of 4084 4924 rundll32.exe 104 PID 4924 wrote to memory of 4084 4924 rundll32.exe 104 PID 4084 wrote to memory of 224 4084 rundll32.exe 105 PID 4084 wrote to memory of 224 4084 rundll32.exe 105 PID 4084 wrote to memory of 224 4084 rundll32.exe 105 PID 224 wrote to memory of 5064 224 rundll32.exe 106 PID 224 wrote to memory of 5064 224 rundll32.exe 106 PID 224 wrote to memory of 5064 224 rundll32.exe 106 PID 5064 wrote to memory of 5012 5064 rundll32.exe 107
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#123⤵PID:5012
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#124⤵PID:3640
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#125⤵PID:2828
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#126⤵PID:4080
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#127⤵PID:2832
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#128⤵PID:700
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#129⤵PID:2580
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#130⤵PID:2792
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#131⤵PID:4116
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#132⤵PID:4056
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#133⤵PID:5004
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#134⤵PID:2344
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#135⤵PID:3488
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#136⤵PID:2164
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#137⤵PID:3092
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#138⤵PID:1900
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#139⤵PID:4364
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#140⤵PID:2032
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#141⤵PID:2056
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#142⤵PID:3060
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#143⤵
- System Location Discovery: System Language Discovery
PID:1068 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#144⤵PID:4992
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#145⤵PID:4640
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#146⤵PID:3912
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#147⤵PID:3728
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#148⤵PID:2864
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#149⤵PID:3272
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#150⤵PID:2428
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#151⤵PID:5060
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#152⤵
- System Location Discovery: System Language Discovery
PID:628 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#153⤵PID:2992
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#154⤵PID:2336
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#155⤵PID:952
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#156⤵PID:4396
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#157⤵PID:1020
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#158⤵PID:1672
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#159⤵PID:2600
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#160⤵PID:3628
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#161⤵PID:2340
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#162⤵PID:1352
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#163⤵PID:3024
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#164⤵PID:3504
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#165⤵PID:3428
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#166⤵PID:2168
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#167⤵PID:3124
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#168⤵PID:2552
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#169⤵PID:468
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#170⤵PID:1684
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#171⤵PID:4040
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#172⤵
- System Location Discovery: System Language Discovery
PID:4628 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#173⤵PID:552
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#174⤵PID:1552
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#175⤵PID:3376
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#176⤵PID:3676
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#177⤵PID:3240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#178⤵PID:4100
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#179⤵
- System Location Discovery: System Language Discovery
PID:3552 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#180⤵PID:1092
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#181⤵PID:4156
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#182⤵PID:4636
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#183⤵PID:3436
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#184⤵PID:1768
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#185⤵PID:5068
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#186⤵PID:1772
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#187⤵PID:3644
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#188⤵PID:4232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#189⤵PID:4436
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#190⤵PID:860
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#191⤵PID:2772
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#192⤵PID:3096
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#193⤵PID:1932
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#194⤵PID:1704
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#195⤵PID:2500
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#196⤵PID:2360
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#197⤵PID:5124
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#198⤵PID:5140
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#199⤵PID:5156
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#1100⤵PID:5172
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#1101⤵PID:5188
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#1102⤵PID:5204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#1103⤵PID:5216
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#1104⤵
- System Location Discovery: System Language Discovery
PID:5232 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#1105⤵PID:5248
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#1106⤵PID:5264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#1107⤵PID:5280
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#1108⤵PID:5296
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#1109⤵
- System Location Discovery: System Language Discovery
PID:5308 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#1110⤵PID:5328
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#1111⤵PID:5344
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#1112⤵PID:5360
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#1113⤵PID:5376
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#1114⤵PID:5392
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#1115⤵PID:5404
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#1116⤵PID:5420
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#1117⤵PID:5436
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#1118⤵PID:5452
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#1119⤵PID:5468
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#1120⤵PID:5484
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#1121⤵PID:5500
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_6_\divx5\PSIKey.dll,#1122⤵PID:5512
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-