File details
File name: rundll32.exe
Name: Windows host process (Rundll32)
Description: Microsoft® Windows® Operating System
Version: 6.1.7600.16385 (win7_rtm.090713-1255)
Product version: 6.1.7600.16385
Size: 44.5 KB
Original file name: RUNDLL32.EXE.MUI
Windows file protection:
Yes
Resource utilization
 | CPU utilization averages |
Total CPU: 0.0001026343%
Privileged CPU:
0.0000972554%

User CPU:
0.00000537890420%

Privileged CPU time: 327.6 ms
Privileged CPU time /min: 0 ms
CPU cycle count:
1,032,629,148
CPU cycle count /min: 23,949
 | Memory utilization averages |
Committed memory:
82.56 MB
Peak committed memory: 88.77 MB
Paged memory:
6.21 MB
Peak paged memory: 6.51 MB
Paged system memory:
142.34 KB
Non-paged system memory: 16.73 KB
Working set memory:
7.2 MB
Peak working set memory: 15.78 MB
Min working set memory: 6.99 MB
Private memory:
6.21 MB
Page faults:
6,056
Page faults /min: 1
 | Process I/O averages |
Total read operations:
585
Total read transfer: 649.8 KB
Total other operations:
608
Other operations /min: 1
Total other transfer: 145.87 KB
Other Transfer /min: 0 Bytes
 | GUI Object Averages |
GDI objects:
19
Peak GDI objects: 21
USER objects:
9
Peak USER objects: 10
Resources
Handle count average: 161
Thread count average: 11
Thread resource averages
Total CPU: 0.000264254176%
Privileged CPU: 0.000179692840%
User CPU: 0.000084561336%
CPU Cycle count /sec: 6,007
Module memory size: 60 KB
Total CPU: 0.000084240624%
Privileged CPU: 0.000081364025%
User CPU: 0.000002876599%
CPU Cycle count /sec: 3,173
Module memory size: 56 KB
mmdevapi.dll

Total CPU: 0.000005285175%
Privileged CPU: 0.000000000000%
User CPU: 0.000005285175%
CPU Cycle count /sec: 46
Module memory size: 300 KB
Process details
Runs as (owner): User
Integrety level: Medium
Windows platform: 64-bit
Hosted Process
Parent Process
Process Commands
"C:\Windows\System32\rundll32.exe" "C:\users\user\appdata\Local\Google\Chrome\User Data\Default\Extensions\jbkceikmmebhmgcjiemejoaeholbnnjl\10.14.251.3_0\plugins\ChromeAutoApproveTB.dll" RunUP ExtensionId=jbkceikmmebhmgcjiemejoaeholbnnjl;IsSmartbar=true
"C:\Windows\System32\rundll32.exe" CTMWatch.dll StartCTMasterOnOffWatch
"C:\Windows\System32\rundll32.exe" "C:\Program Files\DriveTheLife\DrvCache.dll" DrvCacheInit de331c31ffaab236b909143d89b9343b19a6df5a2ed9635f7fb85b504a297053573b8ceb2bb03ced28c486e31869ade18ded4596aa46e081e2f08b89c37df58ecf2f6f8ef78a5983be3a688a9ebad9c20a6739f532fa0be76909bde452b80dec47f4f65f3b
Rundll32.exe "C:\Program Files\DriveTheLife\HwInfo.dll" LocalInfo de30182ee7a2a430be16153b8bb93c3c1bb8925c23c6665a7aa45e184b3878541b
Autoplay handler details
Name: WinampMTPHandler
Command: SOFTWARE\Microsoft\Windows\ CurrentVersion\Explorer\AutoplayHandlers\Handlers\WinampMTPHandler
Approved shell extension details
CLSID: {9D687A4C-1404-41ef-A089-883B6FBECDE6}
Scheduled task details
Name: PC Utility Kit Registration3
Command: \PC Utility Kit Registration3
Startup files (user) run details
Name: uprkr
Command: rundll32.exe ",RetrieveKey
User start menu folder details
Name: rundll32.exe
Startup files (all users) run details
Name: CTMasterOnOffMonitor
Command: Rundll32.exe CTMWatch.dll StartCTMasterOnOffWatch
Network connectivity
UDP: LISTENING on port 52875
UDP: LISTENING on port 57292
Image hashes
MD5: dd81d91ff3b0763c392422865c9ac12e
SHA-1: 963b55acc8c566876364716d5aafa353995812a8
SHA-256: f5691b8f200e3196e6808e932630e862f8f26f31cd949981373f23c9d87db8b9
PE image details
Subsystem: Windows GUI
Langauge*: Microsoft Visual C++
File entropy: 6.05669
File packed: No
Import Table
api-ms-win-core-path-l1-1-0.dll

imagehlp.dll

ImageDirectoryEntryToData
kernel32.dll

ExitProcess
GetCommandLineW
EncodePointer
GetNativeSystemInfo
SetFilePointer
SetErrorMode
FreeLibrary
CreateProcessW
LoadLibraryExW
GetCurrentProcess
SetProcessDEPPolicy
WaitForSingleObject
SetEvent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetSystemDirectoryW
WideCharToMultiByte
FormatMessageW
ReadFile
CreateFileW
ReleaseSRWLockShared
Wow64EnableWow64FsRedirection
GetLastError
GetProcAddress
LocalAlloc
IsWow64Process
CreateEventW
DecodePointer
HeapSetInformation
AcquireSRWLockShared
GetCurrentThreadId
CloseHandle
LocalFree
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
InterlockedExchange
Sleep
QueryPerformanceCounter
GetCurrentProcessId
GetModuleHandleA
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
TerminateProcess
QueryActCtxW
SearchPathW
SetSearchPathMode
GetModuleHandleW
CreateActCtxW
ActivateActCtx
ResolveDelayLoadedAPI
DelayLoadFailureHook
ReleaseActCtx
GetFileAttributesW
DeactivateActCtx
CompareStringW
lstrlenA
lstrlenW
LoadLibraryW
LoadLibraryA
LoadLibraryExA
msvcrt.dll
ntdll.dll

NtOpenProcessToken
NtQueryInformationToken
NtSetInformationToken
NtClose
RtlNtStatusToDosError
RtlImageNtHeader
NtSetInformationProcess
shlwapi.dll

PathIsRelativeW
SHSetThreadRef
user32.dll

CreateWindowExW
SetWindowLongW
GetClassNameW
SetClassLongW
RegisterClassW
LoadIconW
GetClassLongW
DestroyWindow
GetMessageW
DefWindowProcW
GetWindow
CharNextW
GetWindowLongW
LoadCursorW
TranslateMessage
LoadStringW
PostThreadMessageW
MessageBoxW
DispatchMessageW