Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
79s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
10/03/2025, 17:42
Behavioral task
behavioral1
Sample
1156-0-0x0000000010000000-0x00000000104B5000-memory.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1156-0-0x0000000010000000-0x00000000104B5000-memory.dll
Resource
win10v2004-20250217-en
General
-
Target
1156-0-0x0000000010000000-0x00000000104B5000-memory.dll
-
Size
4.7MB
-
MD5
f095f80f65a17ca934460ce668d7bf7d
-
SHA1
4aab4b67728347e53bad43abbbdae8df5784d392
-
SHA256
21b1c9da844a5022e4b5cfe7e29d7e8a375493561b4234ccb3580c2bf59d24d3
-
SHA512
6b577150b8bc23f88a93ede7cb0c3d927e53b248257847a7fb3624790b871cb1361137f4ab33de94c76e988065405220c433de2877fbed14a8d26b25911a7c5b
-
SSDEEP
98304:2r7rt1Pwknx3fDcL0HiPN4DleqDvzCkyooSFwPD+8th5X+:2r7rjwkx3fDcAcN+leqD7CkyoiA
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4452 wrote to memory of 3260 4452 rundll32.exe 87 PID 4452 wrote to memory of 3260 4452 rundll32.exe 87 PID 4452 wrote to memory of 3260 4452 rundll32.exe 87 PID 3260 wrote to memory of 1384 3260 rundll32.exe 88 PID 3260 wrote to memory of 1384 3260 rundll32.exe 88 PID 3260 wrote to memory of 1384 3260 rundll32.exe 88 PID 1384 wrote to memory of 4932 1384 rundll32.exe 89 PID 1384 wrote to memory of 4932 1384 rundll32.exe 89 PID 1384 wrote to memory of 4932 1384 rundll32.exe 89 PID 4932 wrote to memory of 5008 4932 rundll32.exe 90 PID 4932 wrote to memory of 5008 4932 rundll32.exe 90 PID 4932 wrote to memory of 5008 4932 rundll32.exe 90 PID 5008 wrote to memory of 388 5008 rundll32.exe 91 PID 5008 wrote to memory of 388 5008 rundll32.exe 91 PID 5008 wrote to memory of 388 5008 rundll32.exe 91 PID 388 wrote to memory of 4736 388 rundll32.exe 92 PID 388 wrote to memory of 4736 388 rundll32.exe 92 PID 388 wrote to memory of 4736 388 rundll32.exe 92 PID 4736 wrote to memory of 4164 4736 rundll32.exe 93 PID 4736 wrote to memory of 4164 4736 rundll32.exe 93 PID 4736 wrote to memory of 4164 4736 rundll32.exe 93 PID 4164 wrote to memory of 1624 4164 rundll32.exe 94 PID 4164 wrote to memory of 1624 4164 rundll32.exe 94 PID 4164 wrote to memory of 1624 4164 rundll32.exe 94 PID 1624 wrote to memory of 1644 1624 rundll32.exe 95 PID 1624 wrote to memory of 1644 1624 rundll32.exe 95 PID 1624 wrote to memory of 1644 1624 rundll32.exe 95 PID 1644 wrote to memory of 3308 1644 rundll32.exe 96 PID 1644 wrote to memory of 3308 1644 rundll32.exe 96 PID 1644 wrote to memory of 3308 1644 rundll32.exe 96 PID 3308 wrote to memory of 4644 3308 rundll32.exe 97 PID 3308 wrote to memory of 4644 3308 rundll32.exe 97 PID 3308 wrote to memory of 4644 3308 rundll32.exe 97 PID 4644 wrote to memory of 4704 4644 rundll32.exe 98 PID 4644 wrote to memory of 4704 4644 rundll32.exe 98 PID 4644 wrote to memory of 4704 4644 rundll32.exe 98 PID 4704 wrote to memory of 2716 4704 rundll32.exe 99 PID 4704 wrote to memory of 2716 4704 rundll32.exe 99 PID 4704 wrote to memory of 2716 4704 rundll32.exe 99 PID 2716 wrote to memory of 5108 2716 rundll32.exe 100 PID 2716 wrote to memory of 5108 2716 rundll32.exe 100 PID 2716 wrote to memory of 5108 2716 rundll32.exe 100 PID 5108 wrote to memory of 2132 5108 rundll32.exe 101 PID 5108 wrote to memory of 2132 5108 rundll32.exe 101 PID 5108 wrote to memory of 2132 5108 rundll32.exe 101 PID 2132 wrote to memory of 3196 2132 rundll32.exe 102 PID 2132 wrote to memory of 3196 2132 rundll32.exe 102 PID 2132 wrote to memory of 3196 2132 rundll32.exe 102 PID 3196 wrote to memory of 2568 3196 rundll32.exe 103 PID 3196 wrote to memory of 2568 3196 rundll32.exe 103 PID 3196 wrote to memory of 2568 3196 rundll32.exe 103 PID 2568 wrote to memory of 2204 2568 rundll32.exe 104 PID 2568 wrote to memory of 2204 2568 rundll32.exe 104 PID 2568 wrote to memory of 2204 2568 rundll32.exe 104 PID 2204 wrote to memory of 4600 2204 rundll32.exe 105 PID 2204 wrote to memory of 4600 2204 rundll32.exe 105 PID 2204 wrote to memory of 4600 2204 rundll32.exe 105 PID 4600 wrote to memory of 4928 4600 rundll32.exe 106 PID 4600 wrote to memory of 4928 4600 rundll32.exe 106 PID 4600 wrote to memory of 4928 4600 rundll32.exe 106 PID 4928 wrote to memory of 1088 4928 rundll32.exe 108 PID 4928 wrote to memory of 1088 4928 rundll32.exe 108 PID 4928 wrote to memory of 1088 4928 rundll32.exe 108 PID 1088 wrote to memory of 1392 1088 rundll32.exe 109
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#15⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#117⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#123⤵PID:1392
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#124⤵PID:3472
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#125⤵PID:2116
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#126⤵
- System Location Discovery: System Language Discovery
PID:4140 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#127⤵PID:1896
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#128⤵PID:3108
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#129⤵PID:3688
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#130⤵PID:804
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#131⤵PID:544
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#132⤵PID:1992
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#133⤵PID:3476
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#134⤵PID:3756
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#135⤵PID:792
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#136⤵PID:4952
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#137⤵PID:4280
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#138⤵PID:2332
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#139⤵PID:4064
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#140⤵PID:3564
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#141⤵PID:1300
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#142⤵PID:4960
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#143⤵PID:1772
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#144⤵
- System Location Discovery: System Language Discovery
PID:2420 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#145⤵PID:3736
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#146⤵PID:2208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#147⤵PID:5028
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#148⤵PID:4552
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#149⤵PID:1932
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#150⤵PID:404
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#151⤵PID:4160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#152⤵
- System Location Discovery: System Language Discovery
PID:392 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#153⤵PID:4152
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#154⤵PID:4192
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#155⤵PID:3492
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#156⤵PID:1472
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#157⤵PID:2748
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#158⤵PID:3872
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#159⤵PID:4788
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#160⤵PID:4912
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#161⤵PID:3092
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#162⤵PID:4040
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#163⤵
- System Location Discovery: System Language Discovery
PID:1916 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#164⤵PID:3192
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#165⤵PID:4748
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#166⤵PID:3992
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#167⤵PID:2288
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#168⤵PID:2572
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#169⤵PID:3984
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#170⤵PID:2840
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#171⤵
- System Location Discovery: System Language Discovery
PID:2856 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#172⤵PID:2756
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#173⤵PID:672
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#174⤵PID:2024
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#175⤵PID:3428
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#176⤵PID:2588
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#177⤵PID:3228
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#178⤵PID:668
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#179⤵
- System Location Discovery: System Language Discovery
PID:60 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#180⤵PID:3732
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#181⤵PID:4592
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#182⤵PID:1936
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#183⤵PID:2484
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#184⤵PID:4508
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#185⤵PID:4620
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#186⤵PID:4656
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#187⤵PID:1664
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#188⤵PID:2368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#189⤵PID:2128
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#190⤵PID:468
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#191⤵PID:3548
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#192⤵PID:5124
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#193⤵
- System Location Discovery: System Language Discovery
PID:5136 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#194⤵PID:5160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#195⤵PID:5172
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#196⤵PID:5188
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#197⤵PID:5204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#198⤵PID:5220
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#199⤵PID:5232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#1100⤵PID:5248
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#1101⤵PID:5264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#1102⤵
- System Location Discovery: System Language Discovery
PID:5296 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#1103⤵PID:5324
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#1104⤵PID:5340
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#1105⤵PID:5356
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#1106⤵PID:5376
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#1107⤵PID:5396
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#1108⤵PID:5408
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#1109⤵PID:5420
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#1110⤵PID:5440
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#1111⤵PID:5456
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#1112⤵PID:5472
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#1113⤵PID:5488
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#1114⤵
- System Location Discovery: System Language Discovery
PID:5520 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#1115⤵PID:5536
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#1116⤵PID:5556
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#1117⤵PID:5572
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#1118⤵PID:5588
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#1119⤵PID:5604
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#1120⤵PID:5624
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#1121⤵PID:5640
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1156-0-0x0000000010000000-0x00000000104B5000-memory.dll,#1122⤵PID:5656
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-