Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
file.dll

Overview

General Information

Sample name:file.dll
(renamed file extension from exe to dll)
Original sample name:file.exe
Analysis ID:1521608
MD5:6d8722b257230e3f691197715ec2b4b1
SHA1:bf141f3aff5b5e1cd2f02a5d81125931ba4a842d
SHA256:175a75ca524b269b25fb5144dc0abb4ac9b1673852df3abfbd4f6c449e01827d
Tags:dllexex64user-jstrosch
Infos:

Detection

Score:3
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Checks if the current process is being debugged
Creates a process in suspended mode (likely to inject code)
PE file does not import any functions
Program does not show much activity (idle)
Sample execution stops while process was sleeping (likely an evasion)
Uses 32bit PE files

Classification

Process Tree

  • System is w10x64
  • loaddll64.exe (PID: 3576 cmdline: loaddll64.exe "C:\Users\user\Desktop\file.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)
    • conhost.exe (PID: 6184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 6044 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\file.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • rundll32.exe (PID: 5796 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 4724 cmdline: rundll32.exe C:\Users\user\Desktop\file.dll,ClearEnd MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 6220 cmdline: rundll32.exe C:\Users\user\Desktop\file.dll,ClearStart MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 4760 cmdline: rundll32.exe C:\Users\user\Desktop\file.dll,CodeReplaceEnd MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 384 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",ClearEnd MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 6532 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",ClearStart MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 412 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",CodeReplaceEnd MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 6572 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",VMStart MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 2228 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",VMEnd MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 6200 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",UnregisteredStart MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 4324 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",UnregisteredEnd MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 5004 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",UnprotectedStart MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 1200 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",UnprotectedEnd MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 6004 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",StrEncryptWStart MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 5436 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",StrEncryptWEnd MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 6352 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",StrEncryptStart MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 4564 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",StrEncryptEnd MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 4952 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",SECheckVirtualPC MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 5588 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",SECheckRegistration MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 1848 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",SECheckProtection MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 6528 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",SECheckDebugger MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 7092 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",SECheckCodeIntegrity MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 3292 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",RegisteredVMStart MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 1272 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",RegisteredVMEnd MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 6488 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",RegisteredStart MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 6468 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",RegisteredEnd MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 6752 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",MutateStart MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 2284 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",MutateEnd MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 3924 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",EncodeStart MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 6592 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",EncodeEnd MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 5804 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",CustomVM00000499_Start MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 2076 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",CustomVM00000499_End MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 6584 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",CustomVM00000498_Start MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 6444 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",CustomVM00000498_End MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 7172 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",CustomVM00000497_Start MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 7180 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",CustomVM00000497_End MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 7188 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",CustomVM00000496_Start MD5: EF3179D498793BF4234F708D3BE28633)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: file.dllStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DLL
Source: file.dllStatic PE information: No import functions for PE file found
Source: file.dllStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DLL
Source: classification engineClassification label: clean3.winDLL@126/0@0/0
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6184:120:WilError_03
Source: file.dllStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\loaddll64.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\file.dll,ClearEnd
Source: unknownProcess created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\file.dll"
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\file.dll",#1
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\file.dll,ClearEnd
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",#1
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\file.dll,ClearStart
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\file.dll,CodeReplaceEnd
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",ClearEnd
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",ClearStart
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",CodeReplaceEnd
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",VMStart
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",VMEnd
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",UnregisteredStart
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",UnregisteredEnd
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",UnprotectedStart
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",UnprotectedEnd
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",StrEncryptWStart
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",StrEncryptWEnd
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",StrEncryptStart
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",StrEncryptEnd
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",SECheckVirtualPC
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",SECheckRegistration
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",SECheckProtection
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",SECheckDebugger
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",SECheckCodeIntegrity
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",RegisteredVMStart
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",RegisteredVMEnd
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",RegisteredStart
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",RegisteredEnd
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",MutateStart
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",MutateEnd
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",EncodeStart
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",EncodeEnd
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",CustomVM00000499_Start
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",CustomVM00000499_End
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",CustomVM00000498_Start
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",CustomVM00000498_End
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",CustomVM00000497_Start
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",CustomVM00000497_End
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",CustomVM00000496_Start
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\file.dll",#1Jump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\file.dll,ClearEndJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\file.dll,ClearStartJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\file.dll,CodeReplaceEndJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",ClearEndJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",ClearStartJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",CodeReplaceEndJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",VMStartJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",VMEndJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",UnregisteredStartJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",UnregisteredEndJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",UnprotectedStartJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",UnprotectedEndJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",StrEncryptWStartJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",StrEncryptWEndJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",StrEncryptStartJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",StrEncryptEndJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",SECheckVirtualPCJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",SECheckRegistrationJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",SECheckProtectionJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",SECheckDebuggerJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",SECheckCodeIntegrityJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",RegisteredVMStartJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",RegisteredVMEndJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",RegisteredStartJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",RegisteredEndJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",MutateStartJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",MutateEndJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",EncodeStartJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",EncodeEndJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",CustomVM00000499_StartJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",CustomVM00000499_EndJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",CustomVM00000498_StartJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",CustomVM00000498_EndJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",CustomVM00000497_StartJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",CustomVM00000497_EndJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",CustomVM00000496_StartJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",#1Jump to behavior
Source: C:\Windows\System32\loaddll64.exeSection loaded: apphelp.dllJump to behavior
Source: file.dllStatic PE information: More than 826 > 100 exports found
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\rundll32.exeProcess queried: DebugPortJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess queried: DebugPortJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess queried: DebugPortJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess queried: DebugPortJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess queried: DebugPortJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess queried: DebugPortJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess queried: DebugPortJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess queried: DebugPortJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess queried: DebugPortJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess queried: DebugPortJump to behavior
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",#1Jump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
DLL Side-Loading		11
Process Injection		1
Virtualization/Sandbox Evasion		OS Credential Dumping1
Security Software Discovery		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
Rundll32		LSASS Memory1
Virtualization/Sandbox Evasion		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)11
Process Injection		Security Account Manager1
System Information Discovery		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
DLL Side-Loading		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1521608 Sample: file.exe Startdate: 29/09/2024 Architecture: WINDOWS Score: 3 6 loaddll64.exe 1 2->6         started        process3 8 cmd.exe 1 6->8         started        10 conhost.exe 6->10         started        12 rundll32.exe 6->12         started        14 35 other processes 6->14 process4 16 rundll32.exe 8->16         started       

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
file.dll0%ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1521608
Start date and time:2024-09-29 01:03:36 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 5m 25s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:default.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:42
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:file.dll
(renamed file extension from exe to dll)
Original Sample Name:file.exe
Detection:CLEAN
Classification:clean3.winDLL@126/0@0/0
EGA Information:Failed
HCA Information:
  • Successful, ratio: 100%
  • Number of executed functions: 0
  • Number of non-executed functions: 0

Warnings

  • Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe
  • Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
  • Not all processes where analyzed, report is missing behavior information
  • VT rate limit hit for: file.dll

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):5.080629490994506
TrID:
  • Win64 Dynamic Link Library (generic) (102004/3) 86.43%
  • Win64 Executable (generic) (12005/4) 10.17%
  • Generic Win/DOS Executable (2004/3) 1.70%
  • DOS Executable Generic (2002/1) 1.70%
  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:file.dll
File size:28'672 bytes
MD5:6d8722b257230e3f691197715ec2b4b1
SHA1:bf141f3aff5b5e1cd2f02a5d81125931ba4a842d
SHA256:175a75ca524b269b25fb5144dc0abb4ac9b1673852df3abfbd4f6c449e01827d
SHA512:b6d077c57780ab6d58649cee36a1016573adfcafcfa8c823297a19f8bb1d1ea0c1b613044076bcd805a0c18dc37a78208ebaa4d0e19c192b65415028355f1069
SSDEEP:192:3Mi08s5GvuxBdzbNEQaSpqX5xS5haVWUcSAfMVIBizxhv:cdZxBhaHfSsA0V
TLSH:48D2ACAF04B56EFBF91D1CF4059F3A9822C3F3D22DF4866D636E418401EA81B655F289
File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..g-..g-..g-.DoP..g-.DoW..g-.DoU..g-.Rich.g-.................PE..d....s.^...........!.........h.............................

File Icon

Icon Hash:7ae282899bbab082

Static PE Info

General

Entrypoint:0x10001000
Entrypoint Section:.text
Digitally signed:false
Imagebase:0x10000000
Subsystem:windows gui
Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DLL
DLL Characteristics:
Time Stamp:0x5E9D739D [Mon Apr 20 10:04:13 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:4
OS Version Minor:0
File Version Major:4
File Version Minor:0
Subsystem Version Major:4
Subsystem Version Minor:0
Import Hash:

Entrypoint Preview

Instruction
mov eax, 00000001h
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
mov dword ptr [ecx], edx
ret
mov dword ptr [ecx], edx
ret
mov dword ptr [ecx], edx
ret
mov dword ptr [ecx], edx
ret
mov dword ptr [ecx], edx
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret

Data Directories

NameVirtual AddressVirtual Size Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT0x20000x67f6.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_RESOURCE0x00x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
IMAGE_DIRECTORY_ENTRY_TLS0x00x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IAT0x00x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

Sections

NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
.text0x10000x34b0x400dacca4b3adbfe3dfc3619aec1b14e4d2False0.0283203125COM executable for DOS0.7873419124289012IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata0x20000x67f60x680050e5d698d849ce02fb2409013c6ac710False0.25296724759615385data5.112471806217395IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Exports

NameOrdinalAddress
ClearEnd100x1000100f
ClearStart90x1000100e
CodeReplaceEnd40x10001009
CodeReplaceStart30x10001008
CustomVM00000100_End5000x100011bb
CustomVM00000100_Start1000x1000102b
CustomVM00000101_End5010x100011bc
CustomVM00000101_Start1010x1000102c
CustomVM00000102_End5020x100011bd
CustomVM00000102_Start1020x1000102d
CustomVM00000103_End5030x100011be
CustomVM00000103_Start1030x1000102e
CustomVM00000104_End5040x100011bf
CustomVM00000104_Start1040x1000102f
CustomVM00000105_End5050x100011c0
CustomVM00000105_Start1050x10001030
CustomVM00000106_End5060x100011c1
CustomVM00000106_Start1060x10001031
CustomVM00000107_End5070x100011c2
CustomVM00000107_Start1070x10001032
CustomVM00000108_End5080x100011c3
CustomVM00000108_Start1080x10001033
CustomVM00000109_End5090x100011c4
CustomVM00000109_Start1090x10001034
CustomVM00000110_End5100x100011c5
CustomVM00000110_Start1100x10001035
CustomVM00000111_End5110x100011c6
CustomVM00000111_Start1110x10001036
CustomVM00000112_End5120x100011c7
CustomVM00000112_Start1120x10001037
CustomVM00000113_End5130x100011c8
CustomVM00000113_Start1130x10001038
CustomVM00000114_End5140x100011c9
CustomVM00000114_Start1140x10001039
CustomVM00000115_End5150x100011ca
CustomVM00000115_Start1150x1000103a
CustomVM00000116_End5160x100011cb
CustomVM00000116_Start1160x1000103b
CustomVM00000117_End5170x100011cc
CustomVM00000117_Start1170x1000103c
CustomVM00000118_End5180x100011cd
CustomVM00000118_Start1180x1000103d
CustomVM00000119_End5190x100011ce
CustomVM00000119_Start1190x1000103e
CustomVM00000120_End5200x100011cf
CustomVM00000120_Start1200x1000103f
CustomVM00000121_End5210x100011d0
CustomVM00000121_Start1210x10001040
CustomVM00000122_End5220x100011d1
CustomVM00000122_Start1220x10001041
CustomVM00000123_End5230x100011d2
CustomVM00000123_Start1230x10001042
CustomVM00000124_End5240x100011d3
CustomVM00000124_Start1240x10001043
CustomVM00000125_End5250x100011d4
CustomVM00000125_Start1250x10001044
CustomVM00000126_End5260x100011d5
CustomVM00000126_Start1260x10001045
CustomVM00000127_End5270x100011d6
CustomVM00000127_Start1270x10001046
CustomVM00000128_End5280x100011d7
CustomVM00000128_Start1280x10001047
CustomVM00000129_End5290x100011d8
CustomVM00000129_Start1290x10001048
CustomVM00000130_End5300x100011d9
CustomVM00000130_Start1300x10001049
CustomVM00000131_End5310x100011da
CustomVM00000131_Start1310x1000104a
CustomVM00000132_End5320x100011db
CustomVM00000132_Start1320x1000104b
CustomVM00000133_End5330x100011dc
CustomVM00000133_Start1330x1000104c
CustomVM00000134_End5340x100011dd
CustomVM00000134_Start1340x1000104d
CustomVM00000135_End5350x100011de
CustomVM00000135_Start1350x1000104e
CustomVM00000136_End5360x100011df
CustomVM00000136_Start1360x1000104f
CustomVM00000137_End5370x100011e0
CustomVM00000137_Start1370x10001050
CustomVM00000138_End5380x100011e1
CustomVM00000138_Start1380x10001051
CustomVM00000139_End5390x100011e2
CustomVM00000139_Start1390x10001052
CustomVM00000140_End5400x100011e3
CustomVM00000140_Start1400x10001053
CustomVM00000141_End5410x100011e4
CustomVM00000141_Start1410x10001054
CustomVM00000142_End5420x100011e5
CustomVM00000142_Start1420x10001055
CustomVM00000143_End5430x100011e6
CustomVM00000143_Start1430x10001056
CustomVM00000144_End5440x100011e7
CustomVM00000144_Start1440x10001057
CustomVM00000145_End5450x100011e8
CustomVM00000145_Start1450x10001058
CustomVM00000146_End5460x100011e9
CustomVM00000146_Start1460x10001059
CustomVM00000147_End5470x100011ea
CustomVM00000147_Start1470x1000105a
CustomVM00000148_End5480x100011eb
CustomVM00000148_Start1480x1000105b
CustomVM00000149_End5490x100011ec
CustomVM00000149_Start1490x1000105c
CustomVM00000150_End5500x100011ed
CustomVM00000150_Start1500x1000105d
CustomVM00000151_End5510x100011ee
CustomVM00000151_Start1510x1000105e
CustomVM00000152_End5520x100011ef
CustomVM00000152_Start1520x1000105f
CustomVM00000153_End5530x100011f0
CustomVM00000153_Start1530x10001060
CustomVM00000154_End5540x100011f1
CustomVM00000154_Start1540x10001061
CustomVM00000155_End5550x100011f2
CustomVM00000155_Start1550x10001062
CustomVM00000156_End5560x100011f3
CustomVM00000156_Start1560x10001063
CustomVM00000157_End5570x100011f4
CustomVM00000157_Start1570x10001064
CustomVM00000158_End5580x100011f5
CustomVM00000158_Start1580x10001065
CustomVM00000159_End5590x100011f6
CustomVM00000159_Start1590x10001066
CustomVM00000160_End5600x100011f7
CustomVM00000160_Start1600x10001067
CustomVM00000161_End5610x100011f8
CustomVM00000161_Start1610x10001068
CustomVM00000162_End5620x100011f9
CustomVM00000162_Start1620x10001069
CustomVM00000163_End5630x100011fa
CustomVM00000163_Start1630x1000106a
CustomVM00000164_End5640x100011fb
CustomVM00000164_Start1640x1000106b
CustomVM00000165_End5650x100011fc
CustomVM00000165_Start1650x1000106c
CustomVM00000166_End5660x100011fd
CustomVM00000166_Start1660x1000106d
CustomVM00000167_End5670x100011fe
CustomVM00000167_Start1670x1000106e
CustomVM00000168_End5680x100011ff
CustomVM00000168_Start1680x1000106f
CustomVM00000169_End5690x10001200
CustomVM00000169_Start1690x10001070
CustomVM00000170_End5700x10001201
CustomVM00000170_Start1700x10001071
CustomVM00000171_End5710x10001202
CustomVM00000171_Start1710x10001072
CustomVM00000172_End5720x10001203
CustomVM00000172_Start1720x10001073
CustomVM00000173_End5730x10001204
CustomVM00000173_Start1730x10001074
CustomVM00000174_End5740x10001205
CustomVM00000174_Start1740x10001075
CustomVM00000175_End5750x10001206
CustomVM00000175_Start1750x10001076
CustomVM00000176_End5760x10001207
CustomVM00000176_Start1760x10001077
CustomVM00000177_End5770x10001208
CustomVM00000177_Start1770x10001078
CustomVM00000178_End5780x10001209
CustomVM00000178_Start1780x10001079
CustomVM00000179_End5790x1000120a
CustomVM00000179_Start1790x1000107a
CustomVM00000180_End5800x1000120b
CustomVM00000180_Start1800x1000107b
CustomVM00000181_End5810x1000120c
CustomVM00000181_Start1810x1000107c
CustomVM00000182_End5820x1000120d
CustomVM00000182_Start1820x1000107d
CustomVM00000183_End5830x1000120e
CustomVM00000183_Start1830x1000107e
CustomVM00000184_End5840x1000120f
CustomVM00000184_Start1840x1000107f
CustomVM00000185_End5850x10001210
CustomVM00000185_Start1850x10001080
CustomVM00000186_End5860x10001211
CustomVM00000186_Start1860x10001081
CustomVM00000187_End5870x10001212
CustomVM00000187_Start1870x10001082
CustomVM00000188_End5880x10001213
CustomVM00000188_Start1880x10001083
CustomVM00000189_End5890x10001214
CustomVM00000189_Start1890x10001084
CustomVM00000190_End5900x10001215
CustomVM00000190_Start1900x10001085
CustomVM00000191_End5910x10001216
CustomVM00000191_Start1910x10001086
CustomVM00000192_End5920x10001217
CustomVM00000192_Start1920x10001087
CustomVM00000193_End5930x10001218
CustomVM00000193_Start1930x10001088
CustomVM00000194_End5940x10001219
CustomVM00000194_Start1940x10001089
CustomVM00000195_End5950x1000121a
CustomVM00000195_Start1950x1000108a
CustomVM00000196_End5960x1000121b
CustomVM00000196_Start1960x1000108b
CustomVM00000197_End5970x1000121c
CustomVM00000197_Start1970x1000108c
CustomVM00000198_End5980x1000121d
CustomVM00000198_Start1980x1000108d
CustomVM00000199_End5990x1000121e
CustomVM00000199_Start1990x1000108e
CustomVM00000200_End6000x1000121f
CustomVM00000200_Start2000x1000108f
CustomVM00000201_End6010x10001220
CustomVM00000201_Start2010x10001090
CustomVM00000202_End6020x10001221
CustomVM00000202_Start2020x10001091
CustomVM00000203_End6030x10001222
CustomVM00000203_Start2030x10001092
CustomVM00000204_End6040x10001223
CustomVM00000204_Start2040x10001093
CustomVM00000205_End6050x10001224
CustomVM00000205_Start2050x10001094
CustomVM00000206_End6060x10001225
CustomVM00000206_Start2060x10001095
CustomVM00000207_End6070x10001226
CustomVM00000207_Start2070x10001096
CustomVM00000208_End6080x10001227
CustomVM00000208_Start2080x10001097
CustomVM00000209_End6090x10001228
CustomVM00000209_Start2090x10001098
CustomVM00000210_End6100x10001229
CustomVM00000210_Start2100x10001099
CustomVM00000211_End6110x1000122a
CustomVM00000211_Start2110x1000109a
CustomVM00000212_End6120x1000122b
CustomVM00000212_Start2120x1000109b
CustomVM00000213_End6130x1000122c
CustomVM00000213_Start2130x1000109c
CustomVM00000214_End6140x1000122d
CustomVM00000214_Start2140x1000109d
CustomVM00000215_End6150x1000122e
CustomVM00000215_Start2150x1000109e
CustomVM00000216_End6160x1000122f
CustomVM00000216_Start2160x1000109f
CustomVM00000217_End6170x10001230
CustomVM00000217_Start2170x100010a0
CustomVM00000218_End6180x10001231
CustomVM00000218_Start2180x100010a1
CustomVM00000219_End6190x10001232
CustomVM00000219_Start2190x100010a2
CustomVM00000220_End6200x10001233
CustomVM00000220_Start2200x100010a3
CustomVM00000221_End6210x10001234
CustomVM00000221_Start2210x100010a4
CustomVM00000222_End6220x10001235
CustomVM00000222_Start2220x100010a5
CustomVM00000223_End6230x10001236
CustomVM00000223_Start2230x100010a6
CustomVM00000224_End6240x10001237
CustomVM00000224_Start2240x100010a7
CustomVM00000225_End6250x10001238
CustomVM00000225_Start2250x100010a8
CustomVM00000226_End6260x10001239
CustomVM00000226_Start2260x100010a9
CustomVM00000227_End6270x1000123a
CustomVM00000227_Start2270x100010aa
CustomVM00000228_End6280x1000123b
CustomVM00000228_Start2280x100010ab
CustomVM00000229_End6290x1000123c
CustomVM00000229_Start2290x100010ac
CustomVM00000230_End6300x1000123d
CustomVM00000230_Start2300x100010ad
CustomVM00000231_End6310x1000123e
CustomVM00000231_Start2310x100010ae
CustomVM00000232_End6320x1000123f
CustomVM00000232_Start2320x100010af
CustomVM00000233_End6330x10001240
CustomVM00000233_Start2330x100010b0
CustomVM00000234_End6340x10001241
CustomVM00000234_Start2340x100010b1
CustomVM00000235_End6350x10001242
CustomVM00000235_Start2350x100010b2
CustomVM00000236_End6360x10001243
CustomVM00000236_Start2360x100010b3
CustomVM00000237_End6370x10001244
CustomVM00000237_Start2370x100010b4
CustomVM00000238_End6380x10001245
CustomVM00000238_Start2380x100010b5
CustomVM00000239_End6390x10001246
CustomVM00000239_Start2390x100010b6
CustomVM00000240_End6400x10001247
CustomVM00000240_Start2400x100010b7
CustomVM00000241_End6410x10001248
CustomVM00000241_Start2410x100010b8
CustomVM00000242_End6420x10001249
CustomVM00000242_Start2420x100010b9
CustomVM00000243_End6430x1000124a
CustomVM00000243_Start2430x100010ba
CustomVM00000244_End6440x1000124b
CustomVM00000244_Start2440x100010bb
CustomVM00000245_End6450x1000124c
CustomVM00000245_Start2450x100010bc
CustomVM00000246_End6460x1000124d
CustomVM00000246_Start2460x100010bd
CustomVM00000247_End6470x1000124e
CustomVM00000247_Start2470x100010be
CustomVM00000248_End6480x1000124f
CustomVM00000248_Start2480x100010bf
CustomVM00000249_End6490x10001250
CustomVM00000249_Start2490x100010c0
CustomVM00000250_End6500x10001251
CustomVM00000250_Start2500x100010c1
CustomVM00000251_End6510x10001252
CustomVM00000251_Start2510x100010c2
CustomVM00000252_End6520x10001253
CustomVM00000252_Start2520x100010c3
CustomVM00000253_End6530x10001254
CustomVM00000253_Start2530x100010c4
CustomVM00000254_End6540x10001255
CustomVM00000254_Start2540x100010c5
CustomVM00000255_End6550x10001256
CustomVM00000255_Start2550x100010c6
CustomVM00000256_End6560x10001257
CustomVM00000256_Start2560x100010c7
CustomVM00000257_End6570x10001258
CustomVM00000257_Start2570x100010c8
CustomVM00000258_End6580x10001259
CustomVM00000258_Start2580x100010c9
CustomVM00000259_End6590x1000125a
CustomVM00000259_Start2590x100010ca
CustomVM00000260_End6600x1000125b
CustomVM00000260_Start2600x100010cb
CustomVM00000261_End6610x1000125c
CustomVM00000261_Start2610x100010cc
CustomVM00000262_End6620x1000125d
CustomVM00000262_Start2620x100010cd
CustomVM00000263_End6630x1000125e
CustomVM00000263_Start2630x100010ce
CustomVM00000264_End6640x1000125f
CustomVM00000264_Start2640x100010cf
CustomVM00000265_End6650x10001260
CustomVM00000265_Start2650x100010d0
CustomVM00000266_End6660x10001261
CustomVM00000266_Start2660x100010d1
CustomVM00000267_End6670x10001262
CustomVM00000267_Start2670x100010d2
CustomVM00000268_End6680x10001263
CustomVM00000268_Start2680x100010d3
CustomVM00000269_End6690x10001264
CustomVM00000269_Start2690x100010d4
CustomVM00000270_End6700x10001265
CustomVM00000270_Start2700x100010d5
CustomVM00000271_End6710x10001266
CustomVM00000271_Start2710x100010d6
CustomVM00000272_End6720x10001267
CustomVM00000272_Start2720x100010d7
CustomVM00000273_End6730x10001268
CustomVM00000273_Start2730x100010d8
CustomVM00000274_End6740x10001269
CustomVM00000274_Start2740x100010d9
CustomVM00000275_End6750x1000126a
CustomVM00000275_Start2750x100010da
CustomVM00000276_End6760x1000126b
CustomVM00000276_Start2760x100010db
CustomVM00000277_End6770x1000126c
CustomVM00000277_Start2770x100010dc
CustomVM00000278_End6780x1000126d
CustomVM00000278_Start2780x100010dd
CustomVM00000279_End6790x1000126e
CustomVM00000279_Start2790x100010de
CustomVM00000280_End6800x1000126f
CustomVM00000280_Start2800x100010df
CustomVM00000281_End6810x10001270
CustomVM00000281_Start2810x100010e0
CustomVM00000282_End6820x10001271
CustomVM00000282_Start2820x100010e1
CustomVM00000283_End6830x10001272
CustomVM00000283_Start2830x100010e2
CustomVM00000284_End6840x10001273
CustomVM00000284_Start2840x100010e3
CustomVM00000285_End6850x10001274
CustomVM00000285_Start2850x100010e4
CustomVM00000286_End6860x10001275
CustomVM00000286_Start2860x100010e5
CustomVM00000287_End6870x10001276
CustomVM00000287_Start2870x100010e6
CustomVM00000288_End6880x10001277
CustomVM00000288_Start2880x100010e7
CustomVM00000289_End6890x10001278
CustomVM00000289_Start2890x100010e8
CustomVM00000290_End6900x10001279
CustomVM00000290_Start2900x100010e9
CustomVM00000291_End6910x1000127a
CustomVM00000291_Start2910x100010ea
CustomVM00000292_End6920x1000127b
CustomVM00000292_Start2920x100010eb
CustomVM00000293_End6930x1000127c
CustomVM00000293_Start2930x100010ec
CustomVM00000294_End6940x1000127d
CustomVM00000294_Start2940x100010ed
CustomVM00000295_End6950x1000127e
CustomVM00000295_Start2950x100010ee
CustomVM00000296_End6960x1000127f
CustomVM00000296_Start2960x100010ef
CustomVM00000297_End6970x10001280
CustomVM00000297_Start2970x100010f0
CustomVM00000298_End6980x10001281
CustomVM00000298_Start2980x100010f1
CustomVM00000299_End6990x10001282
CustomVM00000299_Start2990x100010f2
CustomVM00000300_End7000x10001283
CustomVM00000300_Start3000x100010f3
CustomVM00000301_End7010x10001284
CustomVM00000301_Start3010x100010f4
CustomVM00000302_End7020x10001285
CustomVM00000302_Start3020x100010f5
CustomVM00000303_End7030x10001286
CustomVM00000303_Start3030x100010f6
CustomVM00000304_End7040x10001287
CustomVM00000304_Start3040x100010f7
CustomVM00000305_End7050x10001288
CustomVM00000305_Start3050x100010f8
CustomVM00000306_End7060x10001289
CustomVM00000306_Start3060x100010f9
CustomVM00000307_End7070x1000128a
CustomVM00000307_Start3070x100010fa
CustomVM00000308_End7080x1000128b
CustomVM00000308_Start3080x100010fb
CustomVM00000309_End7090x1000128c
CustomVM00000309_Start3090x100010fc
CustomVM00000310_End7100x1000128d
CustomVM00000310_Start3100x100010fd
CustomVM00000311_End7110x1000128e
CustomVM00000311_Start3110x100010fe
CustomVM00000312_End7120x1000128f
CustomVM00000312_Start3120x100010ff
CustomVM00000313_End7130x10001290
CustomVM00000313_Start3130x10001100
CustomVM00000314_End7140x10001291
CustomVM00000314_Start3140x10001101
CustomVM00000315_End7150x10001292
CustomVM00000315_Start3150x10001102
CustomVM00000316_End7160x10001293
CustomVM00000316_Start3160x10001103
CustomVM00000317_End7170x10001294
CustomVM00000317_Start3170x10001104
CustomVM00000318_End7180x10001295
CustomVM00000318_Start3180x10001105
CustomVM00000319_End7190x10001296
CustomVM00000319_Start3190x10001106
CustomVM00000320_End7200x10001297
CustomVM00000320_Start3200x10001107
CustomVM00000321_End7210x10001298
CustomVM00000321_Start3210x10001108
CustomVM00000322_End7220x10001299
CustomVM00000322_Start3220x10001109
CustomVM00000323_End7230x1000129a
CustomVM00000323_Start3230x1000110a
CustomVM00000324_End7240x1000129b
CustomVM00000324_Start3240x1000110b
CustomVM00000325_End7250x1000129c
CustomVM00000325_Start3250x1000110c
CustomVM00000326_End7260x1000129d
CustomVM00000326_Start3260x1000110d
CustomVM00000327_End7270x1000129e
CustomVM00000327_Start3270x1000110e
CustomVM00000328_End7280x1000129f
CustomVM00000328_Start3280x1000110f
CustomVM00000329_End7290x100012a0
CustomVM00000329_Start3290x10001110
CustomVM00000330_End7300x100012a1
CustomVM00000330_Start3300x10001111
CustomVM00000331_End7310x100012a2
CustomVM00000331_Start3310x10001112
CustomVM00000332_End7320x100012a3
CustomVM00000332_Start3320x10001113
CustomVM00000333_End7330x100012a4
CustomVM00000333_Start3330x10001114
CustomVM00000334_End7340x100012a5
CustomVM00000334_Start3340x10001115
CustomVM00000335_End7350x100012a6
CustomVM00000335_Start3350x10001116
CustomVM00000336_End7360x100012a7
CustomVM00000336_Start3360x10001117
CustomVM00000337_End7370x100012a8
CustomVM00000337_Start3370x10001118
CustomVM00000338_End7380x100012a9
CustomVM00000338_Start3380x10001119
CustomVM00000339_End7390x100012aa
CustomVM00000339_Start3390x1000111a
CustomVM00000340_End7400x100012ab
CustomVM00000340_Start3400x1000111b
CustomVM00000341_End7410x100012ac
CustomVM00000341_Start3410x1000111c
CustomVM00000342_End7420x100012ad
CustomVM00000342_Start3420x1000111d
CustomVM00000343_End7430x100012ae
CustomVM00000343_Start3430x1000111e
CustomVM00000344_End7440x100012af
CustomVM00000344_Start3440x1000111f
CustomVM00000345_End7450x100012b0
CustomVM00000345_Start3450x10001120
CustomVM00000346_End7460x100012b1
CustomVM00000346_Start3460x10001121
CustomVM00000347_End7470x100012b2
CustomVM00000347_Start3470x10001122
CustomVM00000348_End7480x100012b3
CustomVM00000348_Start3480x10001123
CustomVM00000349_End7490x100012b4
CustomVM00000349_Start3490x10001124
CustomVM00000350_End7500x100012b5
CustomVM00000350_Start3500x10001125
CustomVM00000351_End7510x100012b6
CustomVM00000351_Start3510x10001126
CustomVM00000352_End7520x100012b7
CustomVM00000352_Start3520x10001127
CustomVM00000353_End7530x100012b8
CustomVM00000353_Start3530x10001128
CustomVM00000354_End7540x100012b9
CustomVM00000354_Start3540x10001129
CustomVM00000355_End7550x100012ba
CustomVM00000355_Start3550x1000112a
CustomVM00000356_End7560x100012bb
CustomVM00000356_Start3560x1000112b
CustomVM00000357_End7570x100012bc
CustomVM00000357_Start3570x1000112c
CustomVM00000358_End7580x100012bd
CustomVM00000358_Start3580x1000112d
CustomVM00000359_End7590x100012be
CustomVM00000359_Start3590x1000112e
CustomVM00000360_End7600x100012bf
CustomVM00000360_Start3600x1000112f
CustomVM00000361_End7610x100012c0
CustomVM00000361_Start3610x10001130
CustomVM00000362_End7620x100012c1
CustomVM00000362_Start3620x10001131
CustomVM00000363_End7630x100012c2
CustomVM00000363_Start3630x10001132
CustomVM00000364_End7640x100012c3
CustomVM00000364_Start3640x10001133
CustomVM00000365_End7650x100012c4
CustomVM00000365_Start3650x10001134
CustomVM00000366_End7660x100012c5
CustomVM00000366_Start3660x10001135
CustomVM00000367_End7670x100012c6
CustomVM00000367_Start3670x10001136
CustomVM00000368_End7680x100012c7
CustomVM00000368_Start3680x10001137
CustomVM00000369_End7690x100012c8
CustomVM00000369_Start3690x10001138
CustomVM00000370_End7700x100012c9
CustomVM00000370_Start3700x10001139
CustomVM00000371_End7710x100012ca
CustomVM00000371_Start3710x1000113a
CustomVM00000372_End7720x100012cb
CustomVM00000372_Start3720x1000113b
CustomVM00000373_End7730x100012cc
CustomVM00000373_Start3730x1000113c
CustomVM00000374_End7740x100012cd
CustomVM00000374_Start3740x1000113d
CustomVM00000375_End7750x100012ce
CustomVM00000375_Start3750x1000113e
CustomVM00000376_End7760x100012cf
CustomVM00000376_Start3760x1000113f
CustomVM00000377_End7770x100012d0
CustomVM00000377_Start3770x10001140
CustomVM00000378_End7780x100012d1
CustomVM00000378_Start3780x10001141
CustomVM00000379_End7790x100012d2
CustomVM00000379_Start3790x10001142
CustomVM00000380_End7800x100012d3
CustomVM00000380_Start3800x10001143
CustomVM00000381_End7810x100012d4
CustomVM00000381_Start3810x10001144
CustomVM00000382_End7820x100012d5
CustomVM00000382_Start3820x10001145
CustomVM00000383_End7830x100012d6
CustomVM00000383_Start3830x10001146
CustomVM00000384_End7840x100012d7
CustomVM00000384_Start3840x10001147
CustomVM00000385_End7850x100012d8
CustomVM00000385_Start3850x10001148
CustomVM00000386_End7860x100012d9
CustomVM00000386_Start3860x10001149
CustomVM00000387_End7870x100012da
CustomVM00000387_Start3870x1000114a
CustomVM00000388_End7880x100012db
CustomVM00000388_Start3880x1000114b
CustomVM00000389_End7890x100012dc
CustomVM00000389_Start3890x1000114c
CustomVM00000390_End7900x100012dd
CustomVM00000390_Start3900x1000114d
CustomVM00000391_End7910x100012de
CustomVM00000391_Start3910x1000114e
CustomVM00000392_End7920x100012df
CustomVM00000392_Start3920x1000114f
CustomVM00000393_End7930x100012e0
CustomVM00000393_Start3930x10001150
CustomVM00000394_End7940x100012e1
CustomVM00000394_Start3940x10001151
CustomVM00000395_End7950x100012e2
CustomVM00000395_Start3950x10001152
CustomVM00000396_End7960x100012e3
CustomVM00000396_Start3960x10001153
CustomVM00000397_End7970x100012e4
CustomVM00000397_Start3970x10001154
CustomVM00000398_End7980x100012e5
CustomVM00000398_Start3980x10001155
CustomVM00000399_End7990x100012e6
CustomVM00000399_Start3990x10001156
CustomVM00000400_End8000x100012e7
CustomVM00000400_Start4000x10001157
CustomVM00000401_End8010x100012e8
CustomVM00000401_Start4010x10001158
CustomVM00000402_End8020x100012e9
CustomVM00000402_Start4020x10001159
CustomVM00000403_End8030x100012ea
CustomVM00000403_Start4030x1000115a
CustomVM00000404_End8040x100012eb
CustomVM00000404_Start4040x1000115b
CustomVM00000405_End8050x100012ec
CustomVM00000405_Start4050x1000115c
CustomVM00000406_End8060x100012ed
CustomVM00000406_Start4060x1000115d
CustomVM00000407_End8070x100012ee
CustomVM00000407_Start4070x1000115e
CustomVM00000408_End8080x100012ef
CustomVM00000408_Start4080x1000115f
CustomVM00000409_End8090x100012f0
CustomVM00000409_Start4090x10001160
CustomVM00000410_End8100x100012f1
CustomVM00000410_Start4100x10001161
CustomVM00000411_End8110x100012f2
CustomVM00000411_Start4110x10001162
CustomVM00000412_End8120x100012f3
CustomVM00000412_Start4120x10001163
CustomVM00000413_End8130x100012f4
CustomVM00000413_Start4130x10001164
CustomVM00000414_End8140x100012f5
CustomVM00000414_Start4140x10001165
CustomVM00000415_End8150x100012f6
CustomVM00000415_Start4150x10001166
CustomVM00000416_End8160x100012f7
CustomVM00000416_Start4160x10001167
CustomVM00000417_End8170x100012f8
CustomVM00000417_Start4170x10001168
CustomVM00000418_End8180x100012f9
CustomVM00000418_Start4180x10001169
CustomVM00000419_End8190x100012fa
CustomVM00000419_Start4190x1000116a
CustomVM00000420_End8200x100012fb
CustomVM00000420_Start4200x1000116b
CustomVM00000421_End8210x100012fc
CustomVM00000421_Start4210x1000116c
CustomVM00000422_End8220x100012fd
CustomVM00000422_Start4220x1000116d
CustomVM00000423_End8230x100012fe
CustomVM00000423_Start4230x1000116e
CustomVM00000424_End8240x100012ff
CustomVM00000424_Start4240x1000116f
CustomVM00000425_End8250x10001300
CustomVM00000425_Start4250x10001170
CustomVM00000426_End8260x10001301
CustomVM00000426_Start4260x10001171
CustomVM00000427_End8270x10001302
CustomVM00000427_Start4270x10001172
CustomVM00000428_End8280x10001303
CustomVM00000428_Start4280x10001173
CustomVM00000429_End8290x10001304
CustomVM00000429_Start4290x10001174
CustomVM00000430_End8300x10001305
CustomVM00000430_Start4300x10001175
CustomVM00000431_End8310x10001306
CustomVM00000431_Start4310x10001176
CustomVM00000432_End8320x10001307
CustomVM00000432_Start4320x10001177
CustomVM00000433_End8330x10001308
CustomVM00000433_Start4330x10001178
CustomVM00000434_End8340x10001309
CustomVM00000434_Start4340x10001179
CustomVM00000435_End8350x1000130a
CustomVM00000435_Start4350x1000117a
CustomVM00000436_End8360x1000130b
CustomVM00000436_Start4360x1000117b
CustomVM00000437_End8370x1000130c
CustomVM00000437_Start4370x1000117c
CustomVM00000438_End8380x1000130d
CustomVM00000438_Start4380x1000117d
CustomVM00000439_End8390x1000130e
CustomVM00000439_Start4390x1000117e
CustomVM00000440_End8400x1000130f
CustomVM00000440_Start4400x1000117f
CustomVM00000441_End8410x10001310
CustomVM00000441_Start4410x10001180
CustomVM00000442_End8420x10001311
CustomVM00000442_Start4420x10001181
CustomVM00000443_End8430x10001312
CustomVM00000443_Start4430x10001182
CustomVM00000444_End8440x10001313
CustomVM00000444_Start4440x10001183
CustomVM00000445_End8450x10001314
CustomVM00000445_Start4450x10001184
CustomVM00000446_End8460x10001315
CustomVM00000446_Start4460x10001185
CustomVM00000447_End8470x10001316
CustomVM00000447_Start4470x10001186
CustomVM00000448_End8480x10001317
CustomVM00000448_Start4480x10001187
CustomVM00000449_End8490x10001318
CustomVM00000449_Start4490x10001188
CustomVM00000450_End8500x10001319
CustomVM00000450_Start4500x10001189
CustomVM00000451_End8510x1000131a
CustomVM00000451_Start4510x1000118a
CustomVM00000452_End8520x1000131b
CustomVM00000452_Start4520x1000118b
CustomVM00000453_End8530x1000131c
CustomVM00000453_Start4530x1000118c
CustomVM00000454_End8540x1000131d
CustomVM00000454_Start4540x1000118d
CustomVM00000455_End8550x1000131e
CustomVM00000455_Start4550x1000118e
CustomVM00000456_End8560x1000131f
CustomVM00000456_Start4560x1000118f
CustomVM00000457_End8570x10001320
CustomVM00000457_Start4570x10001190
CustomVM00000458_End8580x10001321
CustomVM00000458_Start4580x10001191
CustomVM00000459_End8590x10001322
CustomVM00000459_Start4590x10001192
CustomVM00000460_End8600x10001323
CustomVM00000460_Start4600x10001193
CustomVM00000461_End8610x10001324
CustomVM00000461_Start4610x10001194
CustomVM00000462_End8620x10001325
CustomVM00000462_Start4620x10001195
CustomVM00000463_End8630x10001326
CustomVM00000463_Start4630x10001196
CustomVM00000464_End8640x10001327
CustomVM00000464_Start4640x10001197
CustomVM00000465_End8650x10001328
CustomVM00000465_Start4650x10001198
CustomVM00000466_End8660x10001329
CustomVM00000466_Start4660x10001199
CustomVM00000467_End8670x1000132a
CustomVM00000467_Start4670x1000119a
CustomVM00000468_End8680x1000132b
CustomVM00000468_Start4680x1000119b
CustomVM00000469_End8690x1000132c
CustomVM00000469_Start4690x1000119c
CustomVM00000470_End8700x1000132d
CustomVM00000470_Start4700x1000119d
CustomVM00000471_End8710x1000132e
CustomVM00000471_Start4710x1000119e
CustomVM00000472_End8720x1000132f
CustomVM00000472_Start4720x1000119f
CustomVM00000473_End8730x10001330
CustomVM00000473_Start4730x100011a0
CustomVM00000474_End8740x10001331
CustomVM00000474_Start4740x100011a1
CustomVM00000475_End8750x10001332
CustomVM00000475_Start4750x100011a2
CustomVM00000476_End8760x10001333
CustomVM00000476_Start4760x100011a3
CustomVM00000477_End8770x10001334
CustomVM00000477_Start4770x100011a4
CustomVM00000478_End8780x10001335
CustomVM00000478_Start4780x100011a5
CustomVM00000479_End8790x10001336
CustomVM00000479_Start4790x100011a6
CustomVM00000480_End8800x10001337
CustomVM00000480_Start4800x100011a7
CustomVM00000481_End8810x10001338
CustomVM00000481_Start4810x100011a8
CustomVM00000482_End8820x10001339
CustomVM00000482_Start4820x100011a9
CustomVM00000483_End8830x1000133a
CustomVM00000483_Start4830x100011aa
CustomVM00000484_End8840x1000133b
CustomVM00000484_Start4840x100011ab
CustomVM00000485_End8850x1000133c
CustomVM00000485_Start4850x100011ac
CustomVM00000486_End8860x1000133d
CustomVM00000486_Start4860x100011ad
CustomVM00000487_End8870x1000133e
CustomVM00000487_Start4870x100011ae
CustomVM00000488_End8880x1000133f
CustomVM00000488_Start4880x100011af
CustomVM00000489_End8890x10001340
CustomVM00000489_Start4890x100011b0
CustomVM00000490_End8900x10001341
CustomVM00000490_Start4900x100011b1
CustomVM00000491_End8910x10001342
CustomVM00000491_Start4910x100011b2
CustomVM00000492_End8920x10001343
CustomVM00000492_Start4920x100011b3
CustomVM00000493_End8930x10001344
CustomVM00000493_Start4930x100011b4
CustomVM00000494_End8940x10001345
CustomVM00000494_Start4940x100011b5
CustomVM00000495_End8950x10001346
CustomVM00000495_Start4950x100011b6
CustomVM00000496_End8960x10001347
CustomVM00000496_Start4960x100011b7
CustomVM00000497_End8970x10001348
CustomVM00000497_Start4970x100011b8
CustomVM00000498_End8980x10001349
CustomVM00000498_Start4980x100011b9
CustomVM00000499_End8990x1000134a
CustomVM00000499_Start4990x100011ba
EncodeEnd80x1000100d
EncodeStart70x1000100c
MutateEnd220x10001011
MutateStart210x10001010
RegisteredEnd60x1000100b
RegisteredStart50x1000100a
RegisteredVMEnd140x10001015
RegisteredVMStart130x10001014
SECheckCodeIntegrity180x1000101f
SECheckDebugger290x10001028
SECheckProtection170x1000101c
SECheckRegistration190x10001022
SECheckVirtualPC200x10001025
StrEncryptEnd240x10001019
StrEncryptStart230x10001018
StrEncryptWEnd280x1000101b
StrEncryptWStart270x1000101a
UnprotectedEnd160x10001017
UnprotectedStart150x10001016
UnregisteredEnd120x10001013
UnregisteredStart110x10001012
VMEnd20x10001007
VMStart10x10001006

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

General

Target ID:0
Start time:19:04:25
Start date:28/09/2024
Path:C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):false
Commandline:loaddll64.exe "C:\Users\user\Desktop\file.dll"
Imagebase:0x7ff74bca0000
File size:165'888 bytes
MD5 hash:763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:false

General

Target ID:1
Start time:19:04:25
Start date:28/09/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:false

General

Target ID:2
Start time:19:04:25
Start date:28/09/2024
Path:C:\Windows\System32\cmd.exe
Wow64 process (32bit):false
Commandline:cmd.exe /C rundll32.exe "C:\Users\user\Desktop\file.dll",#1
Imagebase:0x7ff6a6f50000
File size:289'792 bytes
MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

General

Target ID:3
Start time:19:04:25
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe C:\Users\user\Desktop\file.dll,ClearEnd
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

General

Target ID:4
Start time:19:04:25
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe "C:\Users\user\Desktop\file.dll",#1
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

General

Target ID:6
Start time:19:04:28
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe C:\Users\user\Desktop\file.dll,ClearStart
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

General

Target ID:7
Start time:19:04:31
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe C:\Users\user\Desktop\file.dll,CodeReplaceEnd
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

General

Target ID:8
Start time:19:04:34
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe "C:\Users\user\Desktop\file.dll",ClearEnd
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:9
Start time:19:04:34
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe "C:\Users\user\Desktop\file.dll",ClearStart
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:10
Start time:19:04:34
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe "C:\Users\user\Desktop\file.dll",CodeReplaceEnd
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:11
Start time:19:04:34
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe "C:\Users\user\Desktop\file.dll",VMStart
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:12
Start time:19:04:34
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe "C:\Users\user\Desktop\file.dll",VMEnd
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:13
Start time:19:04:34
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe "C:\Users\user\Desktop\file.dll",UnregisteredStart
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:14
Start time:19:04:34
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe "C:\Users\user\Desktop\file.dll",UnregisteredEnd
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:15
Start time:19:04:34
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe "C:\Users\user\Desktop\file.dll",UnprotectedStart
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:16
Start time:19:04:34
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe "C:\Users\user\Desktop\file.dll",UnprotectedEnd
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:17
Start time:19:04:34
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe "C:\Users\user\Desktop\file.dll",StrEncryptWStart
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:18
Start time:19:04:34
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe "C:\Users\user\Desktop\file.dll",StrEncryptWEnd
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:19
Start time:19:04:34
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe "C:\Users\user\Desktop\file.dll",StrEncryptStart
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:20
Start time:19:04:34
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe "C:\Users\user\Desktop\file.dll",StrEncryptEnd
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:21
Start time:19:04:34
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe "C:\Users\user\Desktop\file.dll",SECheckVirtualPC
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:22
Start time:19:04:34
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe "C:\Users\user\Desktop\file.dll",SECheckRegistration
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:23
Start time:19:04:34
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe "C:\Users\user\Desktop\file.dll",SECheckProtection
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:24
Start time:19:04:34
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe "C:\Users\user\Desktop\file.dll",SECheckDebugger
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:25
Start time:19:04:34
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe "C:\Users\user\Desktop\file.dll",SECheckCodeIntegrity
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:27
Start time:19:04:34
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe "C:\Users\user\Desktop\file.dll",RegisteredVMStart
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:28
Start time:19:04:34
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe "C:\Users\user\Desktop\file.dll",RegisteredVMEnd
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:29
Start time:19:04:34
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe "C:\Users\user\Desktop\file.dll",RegisteredStart
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:30
Start time:19:04:34
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe "C:\Users\user\Desktop\file.dll",RegisteredEnd
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:31
Start time:19:04:34
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe "C:\Users\user\Desktop\file.dll",MutateStart
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:32
Start time:19:04:34
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe "C:\Users\user\Desktop\file.dll",MutateEnd
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:33
Start time:19:04:34
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe "C:\Users\user\Desktop\file.dll",EncodeStart
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:34
Start time:19:04:34
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe "C:\Users\user\Desktop\file.dll",EncodeEnd
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:35
Start time:19:04:34
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe "C:\Users\user\Desktop\file.dll",CustomVM00000499_Start
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:36
Start time:19:04:35
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe "C:\Users\user\Desktop\file.dll",CustomVM00000499_End
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:37
Start time:19:04:35
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe "C:\Users\user\Desktop\file.dll",CustomVM00000498_Start
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:38
Start time:19:04:35
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe "C:\Users\user\Desktop\file.dll",CustomVM00000498_End
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:39
Start time:19:04:35
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe "C:\Users\user\Desktop\file.dll",CustomVM00000497_Start
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:40
Start time:19:04:35
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe "C:\Users\user\Desktop\file.dll",CustomVM00000497_End
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:41
Start time:19:04:35
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe "C:\Users\user\Desktop\file.dll",CustomVM00000496_Start
Imagebase:0x7ff614de0000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

Disassembly

⊘No disassembly