Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24/11/2024, 02:15
Behavioral task
behavioral1
Sample
4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll
Resource
win10v2004-20241007-en
General
-
Target
4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll
-
Size
31KB
-
MD5
3c6af39c908b2aa5bdf49f1c1795d6d1
-
SHA1
8a3df4ca6aea04774ad11cb20872ade854c2fdf0
-
SHA256
4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612
-
SHA512
4a8641fe4810229ac0d749178d8b08810d687ddc9f9990b5cbd13c86da2ccc083314c0534f55dbbb5e1b3a5580f53b3993f20a6b41f1e331e4bed48b66e7b99a
-
SSDEEP
768:lLnV2kFH4zm9CabMbANcbAidGQRkMszDVlhaig9D1:dV2IH4zmMa0AwAicQAzBG95
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 dwm.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe -
Modifies data under HKEY_USERS 18 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeCreateGlobalPrivilege 1360 dwm.exe Token: SeChangeNotifyPrivilege 1360 dwm.exe Token: 33 1360 dwm.exe Token: SeIncBasePriorityPrivilege 1360 dwm.exe Token: SeShutdownPrivilege 1360 dwm.exe Token: SeCreatePagefilePrivilege 1360 dwm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3472 wrote to memory of 2908 3472 rundll32.exe 83 PID 3472 wrote to memory of 2908 3472 rundll32.exe 83 PID 3472 wrote to memory of 2908 3472 rundll32.exe 83 PID 2908 wrote to memory of 4576 2908 rundll32.exe 84 PID 2908 wrote to memory of 4576 2908 rundll32.exe 84 PID 2908 wrote to memory of 4576 2908 rundll32.exe 84 PID 4576 wrote to memory of 1396 4576 rundll32.exe 85 PID 4576 wrote to memory of 1396 4576 rundll32.exe 85 PID 4576 wrote to memory of 1396 4576 rundll32.exe 85 PID 1396 wrote to memory of 4228 1396 rundll32.exe 86 PID 1396 wrote to memory of 4228 1396 rundll32.exe 86 PID 1396 wrote to memory of 4228 1396 rundll32.exe 86 PID 4228 wrote to memory of 5052 4228 rundll32.exe 87 PID 4228 wrote to memory of 5052 4228 rundll32.exe 87 PID 4228 wrote to memory of 5052 4228 rundll32.exe 87 PID 5052 wrote to memory of 2608 5052 rundll32.exe 88 PID 5052 wrote to memory of 2608 5052 rundll32.exe 88 PID 5052 wrote to memory of 2608 5052 rundll32.exe 88 PID 2608 wrote to memory of 1372 2608 rundll32.exe 89 PID 2608 wrote to memory of 1372 2608 rundll32.exe 89 PID 2608 wrote to memory of 1372 2608 rundll32.exe 89 PID 1372 wrote to memory of 3308 1372 rundll32.exe 90 PID 1372 wrote to memory of 3308 1372 rundll32.exe 90 PID 1372 wrote to memory of 3308 1372 rundll32.exe 90 PID 3308 wrote to memory of 4036 3308 rundll32.exe 91 PID 3308 wrote to memory of 4036 3308 rundll32.exe 91 PID 3308 wrote to memory of 4036 3308 rundll32.exe 91 PID 4036 wrote to memory of 2356 4036 rundll32.exe 92 PID 4036 wrote to memory of 2356 4036 rundll32.exe 92 PID 4036 wrote to memory of 2356 4036 rundll32.exe 92 PID 2356 wrote to memory of 4952 2356 rundll32.exe 93 PID 2356 wrote to memory of 4952 2356 rundll32.exe 93 PID 2356 wrote to memory of 4952 2356 rundll32.exe 93 PID 4952 wrote to memory of 4348 4952 rundll32.exe 94 PID 4952 wrote to memory of 4348 4952 rundll32.exe 94 PID 4952 wrote to memory of 4348 4952 rundll32.exe 94 PID 4348 wrote to memory of 2316 4348 rundll32.exe 95 PID 4348 wrote to memory of 2316 4348 rundll32.exe 95 PID 4348 wrote to memory of 2316 4348 rundll32.exe 95 PID 2316 wrote to memory of 1596 2316 rundll32.exe 96 PID 2316 wrote to memory of 1596 2316 rundll32.exe 96 PID 2316 wrote to memory of 1596 2316 rundll32.exe 96 PID 1596 wrote to memory of 2088 1596 rundll32.exe 97 PID 1596 wrote to memory of 2088 1596 rundll32.exe 97 PID 1596 wrote to memory of 2088 1596 rundll32.exe 97 PID 2088 wrote to memory of 3180 2088 rundll32.exe 98 PID 2088 wrote to memory of 3180 2088 rundll32.exe 98 PID 2088 wrote to memory of 3180 2088 rundll32.exe 98 PID 3180 wrote to memory of 1264 3180 rundll32.exe 99 PID 3180 wrote to memory of 1264 3180 rundll32.exe 99 PID 3180 wrote to memory of 1264 3180 rundll32.exe 99 PID 1264 wrote to memory of 836 1264 rundll32.exe 100 PID 1264 wrote to memory of 836 1264 rundll32.exe 100 PID 1264 wrote to memory of 836 1264 rundll32.exe 100 PID 836 wrote to memory of 4860 836 rundll32.exe 101 PID 836 wrote to memory of 4860 836 rundll32.exe 101 PID 836 wrote to memory of 4860 836 rundll32.exe 101 PID 4860 wrote to memory of 2252 4860 rundll32.exe 102 PID 4860 wrote to memory of 2252 4860 rundll32.exe 102 PID 4860 wrote to memory of 2252 4860 rundll32.exe 102 PID 2252 wrote to memory of 1600 2252 rundll32.exe 103 PID 2252 wrote to memory of 1600 2252 rundll32.exe 103 PID 2252 wrote to memory of 1600 2252 rundll32.exe 103 PID 1600 wrote to memory of 3696 1600 rundll32.exe 104
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#123⤵PID:3696
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#124⤵PID:1084
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#125⤵
- System Location Discovery: System Language Discovery
PID:32 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#126⤵PID:5112
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#127⤵
- System Location Discovery: System Language Discovery
PID:2552 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#128⤵PID:1156
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#129⤵PID:4288
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#130⤵PID:1548
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#131⤵PID:1996
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#132⤵PID:2580
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#133⤵PID:3664
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#134⤵PID:3644
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#135⤵PID:3836
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#136⤵PID:3556
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#137⤵
- System Location Discovery: System Language Discovery
PID:3184 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#138⤵PID:3640
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#139⤵PID:3272
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#140⤵PID:764
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#141⤵
- System Location Discovery: System Language Discovery
PID:4768 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#142⤵PID:4872
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#143⤵PID:2680
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#144⤵PID:4644
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#145⤵PID:620
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#146⤵PID:1560
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#147⤵PID:540
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#148⤵PID:4088
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#149⤵PID:3584
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#150⤵PID:3368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#151⤵PID:4140
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#152⤵PID:624
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#153⤵PID:1012
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#154⤵PID:2984
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#155⤵PID:2768
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#156⤵PID:3468
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#157⤵PID:3864
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#158⤵PID:3244
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#159⤵PID:4956
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#160⤵PID:3280
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#161⤵PID:3996
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#162⤵PID:1900
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#163⤵PID:4820
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#164⤵PID:4588
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#165⤵PID:1676
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#166⤵PID:4372
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#167⤵PID:4304
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#168⤵PID:3048
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#169⤵PID:64
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#170⤵PID:4708
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#171⤵PID:1140
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#172⤵PID:4180
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#173⤵PID:1944
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#174⤵PID:4864
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#175⤵
- System Location Discovery: System Language Discovery
PID:3320 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#176⤵PID:5016
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#177⤵PID:4812
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#178⤵PID:1988
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#179⤵PID:3628
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#180⤵PID:1136
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#181⤵PID:4120
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#182⤵PID:1124
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#183⤵PID:4488
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#184⤵PID:4992
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#185⤵PID:4668
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#186⤵PID:1480
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#187⤵PID:2192
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#188⤵PID:4328
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#189⤵PID:2248
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#190⤵PID:2000
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#191⤵PID:740
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#192⤵PID:4632
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#193⤵PID:1296
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#194⤵PID:3492
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#195⤵
- System Location Discovery: System Language Discovery
PID:2504 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#196⤵PID:2144
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#197⤵PID:1516
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#198⤵PID:4648
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#199⤵PID:4260
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#1100⤵PID:4012
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#1101⤵PID:3080
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#1102⤵
- System Location Discovery: System Language Discovery
PID:1048 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#1103⤵PID:3684
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#1104⤵PID:4040
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#1105⤵PID:2548
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#1106⤵PID:4076
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#1107⤵PID:5116
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#1108⤵PID:5128
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#1109⤵PID:5144
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#1110⤵PID:5160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#1111⤵PID:5180
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#1112⤵PID:5192
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#1113⤵PID:5208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#1114⤵PID:5220
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#1115⤵PID:5232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#1116⤵PID:5264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#1117⤵PID:5292
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#1118⤵PID:5324
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#1119⤵PID:5336
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#1120⤵PID:5352
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#1121⤵PID:5368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ff7055f7eed166402358ed2facb75355cfe275472a0e1f2afa54f9f4bfd1612.dll,#1122⤵PID:5384
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-