Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
resource tags
arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system -
submitted
15-07-2022 14:50
Behavioral task
behavioral1
Sample
960-57-0x0000000000340000-0x0000000000362000-memory.dll
Resource
win7-20220414-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
960-57-0x0000000000340000-0x0000000000362000-memory.dll
Resource
win10v2004-20220414-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
960-57-0x0000000000340000-0x0000000000362000-memory.dll
-
Size
136KB
-
MD5
2cc04b6fb9cf01114abba4ceaaf1b85f
-
SHA1
3cecaa902a1e13c5cf58c269c1495f0a44d540fe
-
SHA256
8dddd81ab951446e4a4b471461d420e12ab9c29edff1f2a757084882587069a8
-
SHA512
f3373fb01591daab42b9866b306a69f6d6526c38c76f6a082ef0b33f35b9c5423fa9b130ca9b7e20079fd576d464d3e32e309018b1d04e751a8fcb7ad13bd014
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
dwm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 dwm.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
dwm.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe -
Modifies data under HKEY_USERS 18 IoCs
Processes:
dwm.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
dwm.exedescription pid process Token: SeCreateGlobalPrivilege 15944 dwm.exe Token: SeChangeNotifyPrivilege 15944 dwm.exe Token: 33 15944 dwm.exe Token: SeIncBasePriorityPrivilege 15944 dwm.exe Token: SeShutdownPrivilege 15944 dwm.exe Token: SeCreatePagefilePrivilege 15944 dwm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exedescription pid process target process PID 4660 wrote to memory of 3092 4660 rundll32.exe rundll32.exe PID 4660 wrote to memory of 3092 4660 rundll32.exe rundll32.exe PID 4660 wrote to memory of 3092 4660 rundll32.exe rundll32.exe PID 3092 wrote to memory of 2736 3092 rundll32.exe rundll32.exe PID 3092 wrote to memory of 2736 3092 rundll32.exe rundll32.exe PID 3092 wrote to memory of 2736 3092 rundll32.exe rundll32.exe PID 2736 wrote to memory of 4168 2736 rundll32.exe rundll32.exe PID 2736 wrote to memory of 4168 2736 rundll32.exe rundll32.exe PID 2736 wrote to memory of 4168 2736 rundll32.exe rundll32.exe PID 4168 wrote to memory of 5096 4168 rundll32.exe rundll32.exe PID 4168 wrote to memory of 5096 4168 rundll32.exe rundll32.exe PID 4168 wrote to memory of 5096 4168 rundll32.exe rundll32.exe PID 5096 wrote to memory of 4512 5096 rundll32.exe rundll32.exe PID 5096 wrote to memory of 4512 5096 rundll32.exe rundll32.exe PID 5096 wrote to memory of 4512 5096 rundll32.exe rundll32.exe PID 4512 wrote to memory of 4848 4512 rundll32.exe rundll32.exe PID 4512 wrote to memory of 4848 4512 rundll32.exe rundll32.exe PID 4512 wrote to memory of 4848 4512 rundll32.exe rundll32.exe PID 4848 wrote to memory of 4868 4848 rundll32.exe rundll32.exe PID 4848 wrote to memory of 4868 4848 rundll32.exe rundll32.exe PID 4848 wrote to memory of 4868 4848 rundll32.exe rundll32.exe PID 4868 wrote to memory of 1188 4868 rundll32.exe rundll32.exe PID 4868 wrote to memory of 1188 4868 rundll32.exe rundll32.exe PID 4868 wrote to memory of 1188 4868 rundll32.exe rundll32.exe PID 1188 wrote to memory of 1468 1188 rundll32.exe rundll32.exe PID 1188 wrote to memory of 1468 1188 rundll32.exe rundll32.exe PID 1188 wrote to memory of 1468 1188 rundll32.exe rundll32.exe PID 1468 wrote to memory of 1720 1468 rundll32.exe rundll32.exe PID 1468 wrote to memory of 1720 1468 rundll32.exe rundll32.exe PID 1468 wrote to memory of 1720 1468 rundll32.exe rundll32.exe PID 1720 wrote to memory of 2384 1720 rundll32.exe rundll32.exe PID 1720 wrote to memory of 2384 1720 rundll32.exe rundll32.exe PID 1720 wrote to memory of 2384 1720 rundll32.exe rundll32.exe PID 2384 wrote to memory of 2932 2384 rundll32.exe rundll32.exe PID 2384 wrote to memory of 2932 2384 rundll32.exe rundll32.exe PID 2384 wrote to memory of 2932 2384 rundll32.exe rundll32.exe PID 2932 wrote to memory of 4720 2932 rundll32.exe rundll32.exe PID 2932 wrote to memory of 4720 2932 rundll32.exe rundll32.exe PID 2932 wrote to memory of 4720 2932 rundll32.exe rundll32.exe PID 4720 wrote to memory of 4716 4720 rundll32.exe rundll32.exe PID 4720 wrote to memory of 4716 4720 rundll32.exe rundll32.exe PID 4720 wrote to memory of 4716 4720 rundll32.exe rundll32.exe PID 4716 wrote to memory of 3408 4716 rundll32.exe rundll32.exe PID 4716 wrote to memory of 3408 4716 rundll32.exe rundll32.exe PID 4716 wrote to memory of 3408 4716 rundll32.exe rundll32.exe PID 3408 wrote to memory of 4060 3408 rundll32.exe rundll32.exe PID 3408 wrote to memory of 4060 3408 rundll32.exe rundll32.exe PID 3408 wrote to memory of 4060 3408 rundll32.exe rundll32.exe PID 4060 wrote to memory of 1716 4060 rundll32.exe rundll32.exe PID 4060 wrote to memory of 1716 4060 rundll32.exe rundll32.exe PID 4060 wrote to memory of 1716 4060 rundll32.exe rundll32.exe PID 1716 wrote to memory of 4088 1716 rundll32.exe rundll32.exe PID 1716 wrote to memory of 4088 1716 rundll32.exe rundll32.exe PID 1716 wrote to memory of 4088 1716 rundll32.exe rundll32.exe PID 4088 wrote to memory of 4740 4088 rundll32.exe rundll32.exe PID 4088 wrote to memory of 4740 4088 rundll32.exe rundll32.exe PID 4088 wrote to memory of 4740 4088 rundll32.exe rundll32.exe PID 4740 wrote to memory of 1456 4740 rundll32.exe rundll32.exe PID 4740 wrote to memory of 1456 4740 rundll32.exe rundll32.exe PID 4740 wrote to memory of 1456 4740 rundll32.exe rundll32.exe PID 1456 wrote to memory of 1436 1456 rundll32.exe rundll32.exe PID 1456 wrote to memory of 1436 1456 rundll32.exe rundll32.exe PID 1456 wrote to memory of 1436 1456 rundll32.exe rundll32.exe PID 1436 wrote to memory of 4704 1436 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#14⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#15⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#16⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#17⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#18⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#19⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#110⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#111⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#112⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#113⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#114⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#115⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#116⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#117⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#118⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#119⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#120⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#121⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#122⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#123⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#124⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#125⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#126⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#127⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#128⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#129⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#130⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#131⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#132⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#133⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#134⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#135⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#136⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#137⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#138⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#139⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#140⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#141⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#142⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#143⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#144⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#145⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#146⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#147⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#148⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#149⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#150⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#151⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#152⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#153⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#154⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#155⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#156⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#157⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#158⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#159⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#160⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#161⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#162⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#163⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#164⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#165⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#166⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#167⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#168⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#169⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#170⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#171⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#172⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#173⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#174⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#175⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#176⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#177⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#178⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#179⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#180⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#181⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#182⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#183⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#184⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#185⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#186⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#187⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#188⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#189⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#190⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#191⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#192⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#193⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#194⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#195⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#196⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#197⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#198⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#199⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1100⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1101⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1102⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1103⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1104⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1105⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1106⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1107⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1108⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1109⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1110⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1111⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1112⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1113⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1114⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1115⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1116⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1117⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1118⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1119⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1120⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1121⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1122⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1123⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1124⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1125⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1126⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1127⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1128⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1129⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1130⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1131⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1132⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1133⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1134⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1135⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1136⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1137⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1138⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1139⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1140⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1141⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1142⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1143⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1144⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1145⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1146⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1147⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1148⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1149⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1150⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1151⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1152⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1153⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1154⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1155⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1156⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1157⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1158⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1159⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1160⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1161⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1162⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1163⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1164⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1165⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1166⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1167⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1168⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1169⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1170⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1171⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1172⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1173⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1174⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1175⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1176⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1177⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1178⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1179⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1180⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1181⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1182⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1183⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1184⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1185⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1186⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1187⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1188⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1189⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1190⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1191⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1192⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1193⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1194⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1195⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1196⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1197⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1198⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1199⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1200⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1201⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1202⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1203⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1204⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1205⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1206⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1207⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1208⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1209⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1210⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1211⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1212⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1213⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1214⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1215⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1216⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1217⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1218⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1219⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1220⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1221⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1222⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1223⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1224⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1225⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1226⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1227⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1228⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1229⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1230⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1231⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1232⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1233⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1234⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1235⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1236⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1237⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1238⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1239⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1240⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\960-57-0x0000000000340000-0x0000000000362000-memory.dll,#1241⤵