Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
10/03/2025, 17:17
Behavioral task
behavioral1
Sample
2188-14-0x0000000010000000-0x00000000104B5000-memory.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2188-14-0x0000000010000000-0x00000000104B5000-memory.dll
Resource
win10v2004-20250217-en
General
-
Target
2188-14-0x0000000010000000-0x00000000104B5000-memory.dll
-
Size
4.7MB
-
MD5
461977e700c8319f88f341aa323beb6f
-
SHA1
819196ebd4b3e1a3de967b352ba9b8d32712ae78
-
SHA256
fdbb0d4c78f4e4ee23b38de86186c59ed35ce08510a70d5f187a905f446df176
-
SHA512
67efd707947facbab92eb3ae20466c8afe571be4447d2b025641ed7f39b00219e0e9f8bc31445067f94a378ff9b41bd0c9d8535826fb5196ed8ada51db031e4d
-
SSDEEP
98304:HiDKwqik0QTmj01I4u1RBHmeqD4zCky9dgFwPD+8th5h:HiDKxiktTmj0iPRxmeqDkCky9N
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1992 wrote to memory of 3192 1992 rundll32.exe 86 PID 1992 wrote to memory of 3192 1992 rundll32.exe 86 PID 1992 wrote to memory of 3192 1992 rundll32.exe 86 PID 3192 wrote to memory of 4752 3192 rundll32.exe 87 PID 3192 wrote to memory of 4752 3192 rundll32.exe 87 PID 3192 wrote to memory of 4752 3192 rundll32.exe 87 PID 4752 wrote to memory of 1156 4752 rundll32.exe 88 PID 4752 wrote to memory of 1156 4752 rundll32.exe 88 PID 4752 wrote to memory of 1156 4752 rundll32.exe 88 PID 1156 wrote to memory of 3872 1156 rundll32.exe 89 PID 1156 wrote to memory of 3872 1156 rundll32.exe 89 PID 1156 wrote to memory of 3872 1156 rundll32.exe 89 PID 3872 wrote to memory of 1712 3872 rundll32.exe 90 PID 3872 wrote to memory of 1712 3872 rundll32.exe 90 PID 3872 wrote to memory of 1712 3872 rundll32.exe 90 PID 1712 wrote to memory of 4684 1712 rundll32.exe 91 PID 1712 wrote to memory of 4684 1712 rundll32.exe 91 PID 1712 wrote to memory of 4684 1712 rundll32.exe 91 PID 4684 wrote to memory of 4048 4684 rundll32.exe 92 PID 4684 wrote to memory of 4048 4684 rundll32.exe 92 PID 4684 wrote to memory of 4048 4684 rundll32.exe 92 PID 4048 wrote to memory of 4444 4048 rundll32.exe 93 PID 4048 wrote to memory of 4444 4048 rundll32.exe 93 PID 4048 wrote to memory of 4444 4048 rundll32.exe 93 PID 4444 wrote to memory of 2240 4444 rundll32.exe 94 PID 4444 wrote to memory of 2240 4444 rundll32.exe 94 PID 4444 wrote to memory of 2240 4444 rundll32.exe 94 PID 2240 wrote to memory of 3676 2240 rundll32.exe 95 PID 2240 wrote to memory of 3676 2240 rundll32.exe 95 PID 2240 wrote to memory of 3676 2240 rundll32.exe 95 PID 3676 wrote to memory of 1128 3676 rundll32.exe 96 PID 3676 wrote to memory of 1128 3676 rundll32.exe 96 PID 3676 wrote to memory of 1128 3676 rundll32.exe 96 PID 1128 wrote to memory of 544 1128 rundll32.exe 97 PID 1128 wrote to memory of 544 1128 rundll32.exe 97 PID 1128 wrote to memory of 544 1128 rundll32.exe 97 PID 544 wrote to memory of 2188 544 rundll32.exe 98 PID 544 wrote to memory of 2188 544 rundll32.exe 98 PID 544 wrote to memory of 2188 544 rundll32.exe 98 PID 2188 wrote to memory of 3604 2188 rundll32.exe 99 PID 2188 wrote to memory of 3604 2188 rundll32.exe 99 PID 2188 wrote to memory of 3604 2188 rundll32.exe 99 PID 3604 wrote to memory of 4856 3604 rundll32.exe 100 PID 3604 wrote to memory of 4856 3604 rundll32.exe 100 PID 3604 wrote to memory of 4856 3604 rundll32.exe 100 PID 4856 wrote to memory of 2164 4856 rundll32.exe 101 PID 4856 wrote to memory of 2164 4856 rundll32.exe 101 PID 4856 wrote to memory of 2164 4856 rundll32.exe 101 PID 2164 wrote to memory of 3772 2164 rundll32.exe 102 PID 2164 wrote to memory of 3772 2164 rundll32.exe 102 PID 2164 wrote to memory of 3772 2164 rundll32.exe 102 PID 3772 wrote to memory of 4492 3772 rundll32.exe 103 PID 3772 wrote to memory of 4492 3772 rundll32.exe 103 PID 3772 wrote to memory of 4492 3772 rundll32.exe 103 PID 4492 wrote to memory of 3568 4492 rundll32.exe 104 PID 4492 wrote to memory of 3568 4492 rundll32.exe 104 PID 4492 wrote to memory of 3568 4492 rundll32.exe 104 PID 3568 wrote to memory of 3056 3568 rundll32.exe 105 PID 3568 wrote to memory of 3056 3568 rundll32.exe 105 PID 3568 wrote to memory of 3056 3568 rundll32.exe 105 PID 3056 wrote to memory of 4816 3056 rundll32.exe 106 PID 3056 wrote to memory of 4816 3056 rundll32.exe 106 PID 3056 wrote to memory of 4816 3056 rundll32.exe 106 PID 4816 wrote to memory of 732 4816 rundll32.exe 107
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#117⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#123⤵PID:732
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#124⤵PID:1652
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#125⤵PID:4104
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#126⤵PID:1244
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#127⤵PID:4796
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#128⤵PID:1212
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#129⤵PID:3956
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#130⤵PID:2156
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#131⤵PID:1828
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#132⤵PID:3572
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#133⤵PID:3168
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#134⤵PID:2544
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#135⤵PID:4240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#136⤵PID:3116
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#137⤵PID:1568
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#138⤵PID:3496
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#139⤵PID:2268
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#140⤵PID:4604
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#141⤵PID:1508
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#142⤵PID:2860
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#143⤵PID:4340
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#144⤵PID:3612
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#145⤵PID:4720
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#146⤵PID:1976
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#147⤵PID:3920
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#148⤵PID:4472
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#149⤵PID:4740
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#150⤵PID:4296
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#151⤵PID:4504
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#152⤵PID:2752
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#153⤵PID:3608
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#154⤵PID:436
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#155⤵PID:4716
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#156⤵PID:396
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#157⤵PID:5092
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#158⤵PID:2864
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#159⤵
- System Location Discovery: System Language Discovery
PID:2428 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#160⤵PID:1140
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#161⤵PID:4396
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#162⤵PID:1012
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#163⤵PID:4232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#164⤵PID:4616
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#165⤵PID:2480
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#166⤵PID:1880
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#167⤵PID:2684
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#168⤵PID:2316
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#169⤵PID:3240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#170⤵PID:4556
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#171⤵PID:1068
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#172⤵PID:4376
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#173⤵PID:1052
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#174⤵PID:4284
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#175⤵
- System Location Discovery: System Language Discovery
PID:2432 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#176⤵PID:4608
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#177⤵
- System Location Discovery: System Language Discovery
PID:4596 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#178⤵PID:2368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#179⤵PID:3252
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#180⤵PID:3480
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#181⤵PID:3800
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#182⤵PID:4588
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#183⤵PID:452
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#184⤵PID:4336
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#185⤵PID:2060
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#186⤵PID:1908
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#187⤵PID:1080
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#188⤵PID:4700
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#189⤵
- System Location Discovery: System Language Discovery
PID:5080 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#190⤵PID:916
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#191⤵
- System Location Discovery: System Language Discovery
PID:4732 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#192⤵PID:5132
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#193⤵PID:5144
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#194⤵PID:5164
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#195⤵PID:5188
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#196⤵PID:5204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#197⤵PID:5216
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#198⤵PID:5228
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#199⤵PID:5244
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#1100⤵PID:5260
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#1101⤵PID:5272
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#1102⤵PID:5296
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#1103⤵PID:5316
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#1104⤵PID:5332
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#1105⤵PID:5356
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#1106⤵PID:5376
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#1107⤵PID:5392
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#1108⤵PID:5408
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#1109⤵PID:5424
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#1110⤵PID:5448
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#1111⤵PID:5460
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#1112⤵PID:5480
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#1113⤵PID:5496
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#1114⤵PID:5508
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#1115⤵PID:5524
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#1116⤵PID:5544
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#1117⤵PID:5564
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#1118⤵PID:5580
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#1119⤵PID:5600
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#1120⤵PID:5616
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#1121⤵
- System Location Discovery: System Language Discovery
PID:5632 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#1122⤵PID:5660
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-