| ZeroBOX

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_aes256gcm_abytes
108
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_aes256gcm_abytes
  2496
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_aes256gcm_decrypt
2236
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_aes256gcm_decrypt
  2548
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_aes256gcm_beforenm
2144
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_aes256gcm_beforenm
  2608
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_aes256gcm_decrypt_afternm
2324
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_aes256gcm_decrypt_afternm
  2640
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_aes256gcm_decrypt_detached
2416
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_aes256gcm_decrypt_detached
  2792
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_aes256gcm_decrypt_detached_afternm
2576
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_aes256gcm_decrypt_detached_afternm
  2856
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_aes256gcm_encrypt
2772
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_aes256gcm_encrypt
  2972
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_aes256gcm_encrypt_afternm
2952
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_aes256gcm_encrypt_afternm
  2492
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_aes256gcm_encrypt_detached
2180
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_aes256gcm_encrypt_detached
  2544
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_aes256gcm_encrypt_detached_afternm
2408
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_aes256gcm_encrypt_detached_afternm
  2944
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_aes256gcm_is_available
2872
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_aes256gcm_is_available
  2368
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_aes256gcm_keybytes
2292
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_aes256gcm_keybytes
  2376
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_aes256gcm_keygen
3012
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_aes256gcm_keygen
  2464
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_aes256gcm_messagebytes_max
2536
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_aes256gcm_messagebytes_max
  2788
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_aes256gcm_npubbytes
1836
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_aes256gcm_npubbytes
  3104
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_aes256gcm_nsecbytes
2164
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_aes256gcm_nsecbytes
  3316
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_aes256gcm_statebytes
3208
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_aes256gcm_statebytes
  3488
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_abytes
3308
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_abytes
  3532
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_decrypt
3440
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_decrypt
  3724
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_decrypt_detached
3612
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_decrypt_detached
  3792
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_encrypt
3712
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_encrypt
  3936
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_encrypt_detached
3892
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_encrypt_detached
  3164
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_ietf_abytes
4048
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_ietf_abytes
  3380
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_ietf_decrypt
3272
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_ietf_decrypt
  3600
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_ietf_decrypt_detached
3520
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_ietf_decrypt_detached
  3836
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_ietf_encrypt
3884
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_ietf_encrypt
  3120
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_ietf_encrypt_detached
4088
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_ietf_encrypt_detached
  3676
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_ietf_keybytes
3368
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_ietf_keybytes
  1940
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_ietf_keygen
3912
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_ietf_keygen
  3560
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_ietf_messagebytes_max
3352
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_ietf_messagebytes_max
  3808
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_ietf_npubbytes
3288
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_ietf_npubbytes
  3764
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_ietf_nsecbytes
2832
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_ietf_nsecbytes
  4276
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_keybytes
3384
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_keybytes
  4324
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_keygen
4208
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_keygen
  4744
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_messagebytes_max
4372
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_messagebytes_max
  4524
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_npubbytes
4476
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_npubbytes
  4832
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_nsecbytes
4620
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_chacha20poly1305_nsecbytes
  4804
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_xchacha20poly1305_ietf_abytes
4712
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_xchacha20poly1305_ietf_abytes
  5060
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_xchacha20poly1305_ietf_decrypt
4932
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_xchacha20poly1305_ietf_decrypt
  3816
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_xchacha20poly1305_ietf_decrypt_detached
5032
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_xchacha20poly1305_ietf_decrypt_detached
  4292
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_xchacha20poly1305_ietf_encrypt
4132
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_xchacha20poly1305_ietf_encrypt
  4488
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_xchacha20poly1305_ietf_encrypt_detached
4420
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_xchacha20poly1305_ietf_encrypt_detached
  4736
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_xchacha20poly1305_ietf_keybytes
4268
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_xchacha20poly1305_ietf_keybytes
  4396
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_xchacha20poly1305_ietf_keygen
4976
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_xchacha20poly1305_ietf_keygen
  4700
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_xchacha20poly1305_ietf_messagebytes_max
5108
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_xchacha20poly1305_ietf_messagebytes_max
  4916
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_xchacha20poly1305_ietf_npubbytes
4308
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_xchacha20poly1305_ietf_npubbytes
  5104
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_xchacha20poly1305_ietf_nsecbytes
4320
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_aead_xchacha20poly1305_ietf_nsecbytes
  4716
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth
3240
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth
  4728
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_bytes
4768
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_bytes
  4280
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha256
4228
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha256
  4368
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha256_bytes
4956
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha256_bytes
  4972
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha256_final
5012
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha256_final
  5180
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha256_init
5144
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha256_init
  5424
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha256_keybytes
5292
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha256_keybytes
  5516
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha256_keygen
5468
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha256_keygen
  5744
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha256_statebytes
5620
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha256_statebytes
  5788
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha256_update
5736
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha256_update
  5988
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha256_verify
5916
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha256_verify
  6096
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha512
6048
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha512
  5488
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha512256
5236
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha512256
  5700
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha512256_bytes
5396
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha512256_bytes
  5936
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha512256_final
5644
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha512256_final
  6064
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha512256_init
5928
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha512256_init
  5604
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha512256_keybytes
5224
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha512256_keybytes
  5768
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha512256_keygen
5836
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha512256_keygen
  5716
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha512256_statebytes
6076
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha512256_statebytes
  5200
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha512256_update
5568
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha512256_update
  5444
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha512256_verify
5176
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha512256_verify
  5316
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha512_bytes
6072
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha512_final
6240
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\berr.php.dll,rrypto_auth_hmacsha512_init
6396

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents