Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
24-06-2022 20:36
Static task
static1
Behavioral task
behavioral1
Sample
1796-57-0x00000000001F0000-0x0000000000212000-memory.dll
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
1796-57-0x00000000001F0000-0x0000000000212000-memory.dll
Resource
win10v2004-20220414-en
General
-
Target
1796-57-0x00000000001F0000-0x0000000000212000-memory.dll
-
Size
136KB
-
MD5
35e96e99303783ff5307056772b0ade3
-
SHA1
79806b14df66b5b7ebd503b9e8af6864b559c443
-
SHA256
983ab29803b4e82654a114965e36f78fdd37f05fe91b493231a4b943241d1de8
-
SHA512
444476c54ef44fd9943275b42f69d5914dfcd73ec0bf117e7c969f9576621c4f1750982caac09323ae381b01e032e1ab20d8c9b9ac971f016b7ef8e97052bb03
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 17200 17024 WerFault.exe dwm.exe -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
dwm.exedwm.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
Processes:
dwm.exedwm.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe -
Modifies data under HKEY_USERS 36 IoCs
Processes:
dwm.exedwm.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
dwm.exedwm.exedescription pid process Token: SeCreateGlobalPrivilege 17024 dwm.exe Token: SeChangeNotifyPrivilege 17024 dwm.exe Token: 33 17024 dwm.exe Token: SeIncBasePriorityPrivilege 17024 dwm.exe Token: SeCreateGlobalPrivilege 17312 dwm.exe Token: SeChangeNotifyPrivilege 17312 dwm.exe Token: 33 17312 dwm.exe Token: SeIncBasePriorityPrivilege 17312 dwm.exe Token: SeShutdownPrivilege 17312 dwm.exe Token: SeCreatePagefilePrivilege 17312 dwm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exedescription pid process target process PID 5048 wrote to memory of 1016 5048 rundll32.exe rundll32.exe PID 5048 wrote to memory of 1016 5048 rundll32.exe rundll32.exe PID 5048 wrote to memory of 1016 5048 rundll32.exe rundll32.exe PID 1016 wrote to memory of 2496 1016 rundll32.exe rundll32.exe PID 1016 wrote to memory of 2496 1016 rundll32.exe rundll32.exe PID 1016 wrote to memory of 2496 1016 rundll32.exe rundll32.exe PID 2496 wrote to memory of 4808 2496 rundll32.exe rundll32.exe PID 2496 wrote to memory of 4808 2496 rundll32.exe rundll32.exe PID 2496 wrote to memory of 4808 2496 rundll32.exe rundll32.exe PID 4808 wrote to memory of 2256 4808 rundll32.exe rundll32.exe PID 4808 wrote to memory of 2256 4808 rundll32.exe rundll32.exe PID 4808 wrote to memory of 2256 4808 rundll32.exe rundll32.exe PID 2256 wrote to memory of 1088 2256 rundll32.exe rundll32.exe PID 2256 wrote to memory of 1088 2256 rundll32.exe rundll32.exe PID 2256 wrote to memory of 1088 2256 rundll32.exe rundll32.exe PID 1088 wrote to memory of 516 1088 rundll32.exe rundll32.exe PID 1088 wrote to memory of 516 1088 rundll32.exe rundll32.exe PID 1088 wrote to memory of 516 1088 rundll32.exe rundll32.exe PID 516 wrote to memory of 1196 516 rundll32.exe rundll32.exe PID 516 wrote to memory of 1196 516 rundll32.exe rundll32.exe PID 516 wrote to memory of 1196 516 rundll32.exe rundll32.exe PID 1196 wrote to memory of 1612 1196 rundll32.exe rundll32.exe PID 1196 wrote to memory of 1612 1196 rundll32.exe rundll32.exe PID 1196 wrote to memory of 1612 1196 rundll32.exe rundll32.exe PID 1612 wrote to memory of 1852 1612 rundll32.exe rundll32.exe PID 1612 wrote to memory of 1852 1612 rundll32.exe rundll32.exe PID 1612 wrote to memory of 1852 1612 rundll32.exe rundll32.exe PID 1852 wrote to memory of 2728 1852 rundll32.exe rundll32.exe PID 1852 wrote to memory of 2728 1852 rundll32.exe rundll32.exe PID 1852 wrote to memory of 2728 1852 rundll32.exe rundll32.exe PID 2728 wrote to memory of 2960 2728 rundll32.exe rundll32.exe PID 2728 wrote to memory of 2960 2728 rundll32.exe rundll32.exe PID 2728 wrote to memory of 2960 2728 rundll32.exe rundll32.exe PID 2960 wrote to memory of 3756 2960 rundll32.exe rundll32.exe PID 2960 wrote to memory of 3756 2960 rundll32.exe rundll32.exe PID 2960 wrote to memory of 3756 2960 rundll32.exe rundll32.exe PID 3756 wrote to memory of 3692 3756 rundll32.exe rundll32.exe PID 3756 wrote to memory of 3692 3756 rundll32.exe rundll32.exe PID 3756 wrote to memory of 3692 3756 rundll32.exe rundll32.exe PID 3692 wrote to memory of 1676 3692 rundll32.exe rundll32.exe PID 3692 wrote to memory of 1676 3692 rundll32.exe rundll32.exe PID 3692 wrote to memory of 1676 3692 rundll32.exe rundll32.exe PID 1676 wrote to memory of 772 1676 rundll32.exe rundll32.exe PID 1676 wrote to memory of 772 1676 rundll32.exe rundll32.exe PID 1676 wrote to memory of 772 1676 rundll32.exe rundll32.exe PID 772 wrote to memory of 4832 772 rundll32.exe rundll32.exe PID 772 wrote to memory of 4832 772 rundll32.exe rundll32.exe PID 772 wrote to memory of 4832 772 rundll32.exe rundll32.exe PID 4832 wrote to memory of 4876 4832 rundll32.exe rundll32.exe PID 4832 wrote to memory of 4876 4832 rundll32.exe rundll32.exe PID 4832 wrote to memory of 4876 4832 rundll32.exe rundll32.exe PID 4876 wrote to memory of 2820 4876 rundll32.exe rundll32.exe PID 4876 wrote to memory of 2820 4876 rundll32.exe rundll32.exe PID 4876 wrote to memory of 2820 4876 rundll32.exe rundll32.exe PID 2820 wrote to memory of 5068 2820 rundll32.exe rundll32.exe PID 2820 wrote to memory of 5068 2820 rundll32.exe rundll32.exe PID 2820 wrote to memory of 5068 2820 rundll32.exe rundll32.exe PID 5068 wrote to memory of 3960 5068 rundll32.exe rundll32.exe PID 5068 wrote to memory of 3960 5068 rundll32.exe rundll32.exe PID 5068 wrote to memory of 3960 5068 rundll32.exe rundll32.exe PID 3960 wrote to memory of 5012 3960 rundll32.exe rundll32.exe PID 3960 wrote to memory of 5012 3960 rundll32.exe rundll32.exe PID 3960 wrote to memory of 5012 3960 rundll32.exe rundll32.exe PID 5012 wrote to memory of 4840 5012 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#14⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#15⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#16⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#17⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#18⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#19⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#110⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#111⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#112⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#113⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#114⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#115⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#116⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#117⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#118⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#119⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#120⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#121⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#122⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#123⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#124⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#125⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#126⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#127⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#128⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#129⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#130⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#131⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#132⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#133⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#134⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#135⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#136⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#137⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#138⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#139⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#140⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#141⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#142⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#143⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#144⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#145⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#146⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#147⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#148⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#149⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#150⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#151⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#152⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#153⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#154⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#155⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#156⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#157⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#158⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#159⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#160⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#161⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#162⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#163⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#164⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#165⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#166⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#167⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#168⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#169⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#170⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#171⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#172⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#173⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#174⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#175⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#176⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#177⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#178⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#179⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#180⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#181⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#182⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#183⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#184⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#185⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#186⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#187⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#188⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#189⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#190⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#191⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#192⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#193⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#194⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#195⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#196⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#197⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#198⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#199⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1100⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1101⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1102⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1103⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1104⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1105⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1106⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1107⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1108⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1109⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1110⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1111⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1112⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1113⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1114⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1115⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1116⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1117⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1118⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1119⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1120⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1121⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1122⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1123⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1124⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1125⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1126⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1127⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1128⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1129⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1130⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1131⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1132⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1133⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1134⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1135⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1136⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1137⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1138⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1139⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1140⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1141⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1142⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1143⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1144⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1145⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1146⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1147⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1148⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1149⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1150⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1151⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1152⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1153⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1154⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1155⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1156⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1157⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1158⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1159⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1160⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1161⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1162⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1163⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1164⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1165⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1166⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1167⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1168⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1169⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1170⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1171⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1172⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1173⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1174⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1175⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1176⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1177⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1178⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1179⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1180⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1181⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1182⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1183⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1184⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1185⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1186⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1187⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1188⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1189⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1190⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1191⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1192⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1193⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1194⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1195⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1196⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1197⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1198⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1199⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1200⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1201⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1202⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1203⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1204⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1205⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1206⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1207⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1208⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1209⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1210⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1211⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1212⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1213⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1214⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1215⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1216⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1217⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1218⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1219⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1220⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1221⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1222⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1223⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1224⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1225⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1226⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1227⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1228⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1229⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1230⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1231⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1232⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1233⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1234⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1235⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1236⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1237⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1238⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1239⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1240⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001F0000-0x0000000000212000-memory.dll,#1241⤵