Versions

6.3.9600.16384 (winblue_rtm.130821-1623)	0.63%
6.3.9600.16384 (winblue_rtm.130821-1623)	0.32%
6.2.9200.16384 (win8_rtm.120725-1247)	0.48%
6.2.9200.16384 (win8_rtm.120725-1247)	2.22%
6.1.7600.16385 (win7_rtm.090713-1255)	20.13%
6.1.7600.16385 (win7_rtm.090713-1255)	28.68%
6.1.7600.16385 (win7_rtm.090713-1255)	0.16%
6.0.6000.16386 (vista_rtm.061101-2205)	6.81%
6.0.6000.16386 (vista_rtm.061101-2205)	3.49%
5.2.3790.3959 (srv03_sp2_rtm.070216-1710)	0.16%
5.2.3790.1830 (srv03_sp1_rtm.050324-1447)	0.16%
5.1.2600.5512 (xpsp.080413-2105)	27.10%
5.1.2600.5512 (xpsp.080413-2105)	0.16%
5.1.2600.5512 (xpsp.080413-2105)	0.16%
5.1.2600.5512 (xpsp.080413-2105)	0.16%
5.1.2600.5512 (xpsp.080413-2105)	0.16%
5.1.2600.5512 (xpsp.080413-2105)	0.16%
5.1.2600.5512 (xpsp.080413-2105)	0.16%
5.1.2600.5512 (xpsp.080413-2105)	0.16%
5.1.2600.3311 (xpsp.080212-0004)	0.16%
5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)	8.40%

Relationships

• dbgsvc.exe (Debug Diagnostic Tool by Microsoft Corporation)
• fhautoplay.dll (by Microsoft)
• buildnotification.exe (by Microsoft)
• ehexthost.exe (Media Center Extensibility Host by Microsoft)
• onenoteim.exe (Microsoft OneNote by Microsoft Corporation)
• powershell.exe (Windows PowerShell by Microsoft)
• ipoverusbsvc.exe (Microsoft Windows Operating System by Microsoft Corporation)
• iedvtool.dll (Internet Explorer by Microsoft)
• korime.exe (Microsoft IME by Microsoft)
• chtime.exe (Microsoft IME by Microsoft)
• emet_gui.exe (Enhanced Mitigation Experience Toolkit by Microsoft Corporation)
• emet_agent.exe (Enhanced Mitigation Experience Toolkit by Microsoft Corporation)
• filemanager.exe (OneDrive by Microsoft Corporation)
• mstore.exe (Microsoft Clip Organizer by Microsoft Corporation)
• chsime.exe (Microsoft IME by Microsoft)
• scardsvr.dll (Smart Card Resource Management Server by Microsoft)
• gpsvc.dll (Group Policy Client by Microsoft)
• certprop.dll (Microsoft Smartcard Certificate Propagation Service by Microsoft)
• integratedoffice.exe (Microsoft Office by Microsoft Corporation)
• actioncenter.dll (Action Center by Microsoft)
• f12tools.dll (Internet Explorer by Microsoft)
• ndsm.exe (by Microsoft)
• mdres.exe (Windows Memory Diagnostic by Microsoft)
• wlidsvc.dll (by Microsoft)
• reseteng.dll (by Microsoft)
• numbers.exe (Numbers by Microsoft)
• systemsettings.exe (by Microsoft)

rundll32.exe

Windows host process (Rundll32) by Microsoft

Overview

Programs installed in

Behaviors

• Handler name 'WinampMTPHandler'
• Handler name 'PStarterVideoFilesArrival'
• Handler name 'PStarterPicturesArrival'
• Handler name 'PStarterMusicFilesArrival'
• Handler name 'PStarterMixedCDArrival'
• Handler name 'PStarterDVDBurningOnArrival'
• Handler name 'PStarterBlankCDArrival'
• Handler name 'Power2GoPlayCDAudioOnArrival'
• Handler name 'PDirDVArrival'
• Handler name 'P2GDVDBurningOnArrival'
• Handler name 'P2GCDBurningOnArrival'
• Handler name 'muveeVideoOnArrival'
• Handler name 'muveeVideoCameraArrivalCaptureWizard'
• Handler name 'MSShowPicturesOnArrival'
• Handler name 'MSSHAudioDevHandler'
• Handler name 'MSRipCDAudioOnArrival'
• Handler name 'MediaCapture9VideoCamera'
• Handler name 'MSSdRunBackup'
• Handler name 'MSSdConfigBackup'
• Handler name 'MSPromptEachTimeNoContent'
• Handler name 'MSPromptEachTime'
• Handler name 'MSPhotoAcqHWEventHandler'

• CLSID: {9D687A4C-1404-41ef-A089-883B6FBECDE6}

• The job 'MyTurboPC.com Registration3' runs daily in the path '\MyTurboPC.com Registration3'
• The job 'EasyShare Registration Task' runs daily in the path '\EasyShare Registration Task'
• The task 'PC Utility Kit Registration3' runs daily in the path '\PC Utility Kit Registration3'
• The task 'PC Unleashed Online Registration3' runs daily in the path '\PC Unleashed Online Registration3'
• The task 'SparkTrust Registration3' runs daily in the path '\SparkTrust Registration3'
• The job 'ParetoLogic Registration' runs daily in the path '\ParetoLogic Registration'
• The task 'SpeedMaxPc Registration3' runs daily in the path '\SpeedMaxPc Registration3'
• The job 'ParetoLogic Registration3' runs daily in the path '\ParetoLogic Registration3'
• The task 'SpeedyPC Registration3' runs daily in the path '\SpeedyPC Registration3'
• Entry path '\{DF592278-9ED5-4925-9117-7AD619F1AAA8}'
• Entry path '\{D6488D52-E069-4A39-816E-D1598D5449A4}'
• Entry path '\{C8536D19-006C-4D7C-B8C4-5A4B5160C5ED}'
• Entry path '\{BBA662F7-038F-467B-8873-EB604B5242A2}'
• Entry path '\{B86A1F70-22DB-44E2-850A-04DB8130A83A}'
• Entry path '\{A9F6F357-C7F2-493B-9CA6-BA8096AAF4DF}'
• Entry path '\{8A560E02-3FEE-4E3F-BD2F-E30E081ACB04}'
• Entry path '\{898C3889-ACDA-439E-91B0-36187A01B19B}'
• Entry path '\{0FF765F0-1DE5-461B-9F9B-936450ABA203}'
• Entry path '\{0420CBAC-4E40-4938-9955-4C7C8595BC42}'
• Entry path '\{00BAB955-E3A4-40EE-A715-E595C89513B0}'
• Entry path '\EasyShare Registration Task'
• Entry path '\MyTurboPC.com Registration3'

• 'uprkr' → rundll32.exe ",RetrieveKey

• Shortcut to 'rundll32.exe'
• Shortcut to 'lsass.exe'

• 'CTMasterOnOffMonitor' → Rundll32.exe CTMWatch.dll StartCTMasterOnOffWatch

All file variations of rundll32.exe

Distribution by Windows OS

Distribution by country

Distribution by PC manufacturer