Analysis
-
max time kernel
143s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
14-03-2023 17:22
Behavioral task
behavioral1
Sample
2044-57-0x0000000004130000-0x0000000004153000-memory.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2044-57-0x0000000004130000-0x0000000004153000-memory.dll
Resource
win10v2004-20230220-en
General
-
Target
2044-57-0x0000000004130000-0x0000000004153000-memory.dll
-
Size
140KB
-
MD5
971c0cc66f6fc343d3591b94ba5089ca
-
SHA1
26b2ffeea143139520110274fde7b4754d9a5a6e
-
SHA256
60b8d9b4c87ab32ada3da59608aa0ad722bae4d351acdbeaf90b61729863ee25
-
SHA512
cc04e30b30c303daa2e1f5876d8a85b47b8cd63d4a5fa70c54523dd594db771ded6c4793a6afc59052369c78956f007ef398b76fd7cc194e9d1d82de7ba33c1d
-
SSDEEP
3072:uVHCiSexeeIbkaitjnt/5CAEJ5UVHMTBffk1/BIMv+n:uJxAkaCjn/HEJqVHMTB3kFBRv
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
dwm.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID dwm.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
dwm.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe -
Modifies data under HKEY_USERS 18 IoCs
Processes:
dwm.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
dwm.exedescription pid process Token: SeCreateGlobalPrivilege 13924 dwm.exe Token: SeChangeNotifyPrivilege 13924 dwm.exe Token: 33 13924 dwm.exe Token: SeIncBasePriorityPrivilege 13924 dwm.exe Token: SeShutdownPrivilege 13924 dwm.exe Token: SeCreatePagefilePrivilege 13924 dwm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exedescription pid process target process PID 1944 wrote to memory of 1988 1944 rundll32.exe rundll32.exe PID 1944 wrote to memory of 1988 1944 rundll32.exe rundll32.exe PID 1944 wrote to memory of 1988 1944 rundll32.exe rundll32.exe PID 1988 wrote to memory of 1780 1988 rundll32.exe rundll32.exe PID 1988 wrote to memory of 1780 1988 rundll32.exe rundll32.exe PID 1988 wrote to memory of 1780 1988 rundll32.exe rundll32.exe PID 1780 wrote to memory of 2580 1780 rundll32.exe rundll32.exe PID 1780 wrote to memory of 2580 1780 rundll32.exe rundll32.exe PID 1780 wrote to memory of 2580 1780 rundll32.exe rundll32.exe PID 2580 wrote to memory of 1388 2580 rundll32.exe rundll32.exe PID 2580 wrote to memory of 1388 2580 rundll32.exe rundll32.exe PID 2580 wrote to memory of 1388 2580 rundll32.exe rundll32.exe PID 1388 wrote to memory of 4200 1388 rundll32.exe rundll32.exe PID 1388 wrote to memory of 4200 1388 rundll32.exe rundll32.exe PID 1388 wrote to memory of 4200 1388 rundll32.exe rundll32.exe PID 4200 wrote to memory of 3112 4200 rundll32.exe rundll32.exe PID 4200 wrote to memory of 3112 4200 rundll32.exe rundll32.exe PID 4200 wrote to memory of 3112 4200 rundll32.exe rundll32.exe PID 3112 wrote to memory of 3688 3112 rundll32.exe rundll32.exe PID 3112 wrote to memory of 3688 3112 rundll32.exe rundll32.exe PID 3112 wrote to memory of 3688 3112 rundll32.exe rundll32.exe PID 3688 wrote to memory of 3380 3688 rundll32.exe rundll32.exe PID 3688 wrote to memory of 3380 3688 rundll32.exe rundll32.exe PID 3688 wrote to memory of 3380 3688 rundll32.exe rundll32.exe PID 3380 wrote to memory of 3540 3380 rundll32.exe rundll32.exe PID 3380 wrote to memory of 3540 3380 rundll32.exe rundll32.exe PID 3380 wrote to memory of 3540 3380 rundll32.exe rundll32.exe PID 3540 wrote to memory of 4184 3540 rundll32.exe rundll32.exe PID 3540 wrote to memory of 4184 3540 rundll32.exe rundll32.exe PID 3540 wrote to memory of 4184 3540 rundll32.exe rundll32.exe PID 4184 wrote to memory of 4464 4184 rundll32.exe rundll32.exe PID 4184 wrote to memory of 4464 4184 rundll32.exe rundll32.exe PID 4184 wrote to memory of 4464 4184 rundll32.exe rundll32.exe PID 4464 wrote to memory of 4028 4464 rundll32.exe rundll32.exe PID 4464 wrote to memory of 4028 4464 rundll32.exe rundll32.exe PID 4464 wrote to memory of 4028 4464 rundll32.exe rundll32.exe PID 4028 wrote to memory of 2084 4028 rundll32.exe rundll32.exe PID 4028 wrote to memory of 2084 4028 rundll32.exe rundll32.exe PID 4028 wrote to memory of 2084 4028 rundll32.exe rundll32.exe PID 2084 wrote to memory of 1060 2084 rundll32.exe rundll32.exe PID 2084 wrote to memory of 1060 2084 rundll32.exe rundll32.exe PID 2084 wrote to memory of 1060 2084 rundll32.exe rundll32.exe PID 1060 wrote to memory of 4444 1060 rundll32.exe rundll32.exe PID 1060 wrote to memory of 4444 1060 rundll32.exe rundll32.exe PID 1060 wrote to memory of 4444 1060 rundll32.exe rundll32.exe PID 4444 wrote to memory of 3756 4444 rundll32.exe rundll32.exe PID 4444 wrote to memory of 3756 4444 rundll32.exe rundll32.exe PID 4444 wrote to memory of 3756 4444 rundll32.exe rundll32.exe PID 3756 wrote to memory of 3676 3756 rundll32.exe rundll32.exe PID 3756 wrote to memory of 3676 3756 rundll32.exe rundll32.exe PID 3756 wrote to memory of 3676 3756 rundll32.exe rundll32.exe PID 3676 wrote to memory of 1692 3676 rundll32.exe rundll32.exe PID 3676 wrote to memory of 1692 3676 rundll32.exe rundll32.exe PID 3676 wrote to memory of 1692 3676 rundll32.exe rundll32.exe PID 1692 wrote to memory of 4596 1692 rundll32.exe rundll32.exe PID 1692 wrote to memory of 4596 1692 rundll32.exe rundll32.exe PID 1692 wrote to memory of 4596 1692 rundll32.exe rundll32.exe PID 4596 wrote to memory of 1768 4596 rundll32.exe rundll32.exe PID 4596 wrote to memory of 1768 4596 rundll32.exe rundll32.exe PID 4596 wrote to memory of 1768 4596 rundll32.exe rundll32.exe PID 1768 wrote to memory of 4868 1768 rundll32.exe rundll32.exe PID 1768 wrote to memory of 4868 1768 rundll32.exe rundll32.exe PID 1768 wrote to memory of 4868 1768 rundll32.exe rundll32.exe PID 4868 wrote to memory of 4460 4868 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#14⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#15⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#16⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#17⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#18⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#19⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#110⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#111⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#112⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#113⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#114⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#115⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#116⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#117⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#118⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#119⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#120⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#121⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#122⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#123⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#124⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#125⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#126⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#127⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#128⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#129⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#130⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#131⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#132⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#133⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#134⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#135⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#136⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#137⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#138⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#139⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#140⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#141⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#142⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#143⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#144⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#145⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#146⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#147⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#148⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#149⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#150⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#151⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#152⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#153⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#154⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#155⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#156⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#157⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#158⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#159⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#160⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#161⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#162⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#163⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#164⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#165⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#166⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#167⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#168⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#169⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#170⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#171⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#172⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#173⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#174⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#175⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#176⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#177⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#178⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#179⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#180⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#181⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#182⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#183⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#184⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#185⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#186⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#187⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#188⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#189⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#190⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#191⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#192⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#193⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#194⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#195⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#196⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#197⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#198⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#199⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1100⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1101⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1102⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1103⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1104⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1105⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1106⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1107⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1108⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1109⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1110⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1111⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1112⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1113⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1114⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1115⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1116⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1117⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1118⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1119⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1120⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1121⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1122⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1123⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1124⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1125⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1126⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1127⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1128⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1129⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1130⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1131⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1132⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1133⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1134⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1135⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1136⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1137⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1138⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1139⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1140⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1141⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1142⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1143⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1144⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1145⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1146⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1147⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1148⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1149⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1150⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1151⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1152⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1153⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1154⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1155⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1156⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1157⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1158⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1159⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1160⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1161⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1162⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1163⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1164⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1165⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1166⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1167⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1168⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1169⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1170⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1171⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1172⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1173⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1174⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1175⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1176⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1177⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1178⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1179⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1180⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1181⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1182⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1183⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1184⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1185⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1186⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1187⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1188⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1189⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1190⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1191⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1192⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1193⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1194⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1195⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1196⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1197⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1198⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1199⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1200⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1201⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1202⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1203⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1204⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1205⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1206⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1207⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1208⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1209⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1210⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1211⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1212⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1213⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1214⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1215⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1216⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1217⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1218⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1219⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1220⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1221⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1222⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1223⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1224⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1225⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1226⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1227⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1228⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1229⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1230⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1231⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1232⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1233⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1234⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1235⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1236⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1237⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1238⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1239⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1240⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2044-57-0x0000000004130000-0x0000000004153000-memory.dll,#1241⤵