dddbb1c8190926d578769b59c0a38e2bc78c0842d2589b76ab65acb562f02d3e

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 13:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a4cc4c1b7f2ec21c66e87f1788c2d69.exe
Size

119KB
MD5

1a4cc4c1b7f2ec21c66e87f1788c2d69
SHA1

b143a4d875daaddf0277a0037cd52ab5a357dd64
SHA256

dddbb1c8190926d578769b59c0a38e2bc78c0842d2589b76ab65acb562f02d3e
SHA512

8e06a5d23358fb30f242765ea648dd04575eaf1d074a8b6acdc874294a634cce71f3dbfa33e92c41196c41c85d91098816554d86fea47d1c55b5a1d4a12717ec
SSDEEP

1536:jChTmJ28iM6w2tDJzQS70+LeAj0dz+nprIO2FnToIfuWV:9J2dJzP0+LeAj0dzED2tTBfuWV

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4860	notepad.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\notepad.exe	1a4cc4c1b7f2ec21c66e87f1788c2d69.exe
File opened for modification	C:\Program Files (x86)\Common Files\notepad.exe	1a4cc4c1b7f2ec21c66e87f1788c2d69.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4860	notepad.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 4860	4356	1a4cc4c1b7f2ec21c66e87f1788c2d69.exe	473
PID 4356 wrote to memory of 4860	4356	1a4cc4c1b7f2ec21c66e87f1788c2d69.exe	473
PID 4356 wrote to memory of 4860	4356	1a4cc4c1b7f2ec21c66e87f1788c2d69.exe	473
PID 4860 wrote to memory of 4668	4860	notepad.exe	472
PID 4860 wrote to memory of 4668	4860	notepad.exe	472
PID 4860 wrote to memory of 4668	4860	notepad.exe	472
PID 4668 wrote to memory of 1044	4668	rundll32.exe	22
PID 4668 wrote to memory of 1044	4668	rundll32.exe	22
PID 4668 wrote to memory of 1044	4668	rundll32.exe	22
PID 1044 wrote to memory of 4292	1044	rundll32.exe	471
PID 1044 wrote to memory of 4292	1044	rundll32.exe	471
PID 1044 wrote to memory of 4292	1044	rundll32.exe	471
PID 4292 wrote to memory of 3216	4292	rundll32.exe	23
PID 4292 wrote to memory of 3216	4292	rundll32.exe	23
PID 4292 wrote to memory of 3216	4292	rundll32.exe	23
PID 3216 wrote to memory of 4988	3216	rundll32.exe	470
PID 3216 wrote to memory of 4988	3216	rundll32.exe	470
PID 3216 wrote to memory of 4988	3216	rundll32.exe	470
PID 4988 wrote to memory of 2056	4988	rundll32.exe	24
PID 4988 wrote to memory of 2056	4988	rundll32.exe	24
PID 4988 wrote to memory of 2056	4988	rundll32.exe	24
PID 2056 wrote to memory of 3536	2056	rundll32.exe	469
PID 2056 wrote to memory of 3536	2056	rundll32.exe	469
PID 2056 wrote to memory of 3536	2056	rundll32.exe	469
PID 3536 wrote to memory of 1596	3536	rundll32.exe	25
PID 3536 wrote to memory of 1596	3536	rundll32.exe	25
PID 3536 wrote to memory of 1596	3536	rundll32.exe	25
PID 1596 wrote to memory of 2412	1596	rundll32.exe	467
PID 1596 wrote to memory of 2412	1596	rundll32.exe	467
PID 1596 wrote to memory of 2412	1596	rundll32.exe	467
PID 2412 wrote to memory of 5064	2412	rundll32.exe	26
PID 2412 wrote to memory of 5064	2412	rundll32.exe	26
PID 2412 wrote to memory of 5064	2412	rundll32.exe	26
PID 5064 wrote to memory of 4488	5064	rundll32.exe	466
PID 5064 wrote to memory of 4488	5064	rundll32.exe	466
PID 5064 wrote to memory of 4488	5064	rundll32.exe	466
PID 4488 wrote to memory of 2988	4488	rundll32.exe	27
PID 4488 wrote to memory of 2988	4488	rundll32.exe	27
PID 4488 wrote to memory of 2988	4488	rundll32.exe	27
PID 2988 wrote to memory of 3036	2988	rundll32.exe	28
PID 2988 wrote to memory of 3036	2988	rundll32.exe	28
PID 2988 wrote to memory of 3036	2988	rundll32.exe	28
PID 3036 wrote to memory of 4644	3036	rundll32.exe	29
PID 3036 wrote to memory of 4644	3036	rundll32.exe	29
PID 3036 wrote to memory of 4644	3036	rundll32.exe	29
PID 4644 wrote to memory of 948	4644	rundll32.exe	30
PID 4644 wrote to memory of 948	4644	rundll32.exe	30
PID 4644 wrote to memory of 948	4644	rundll32.exe	30
PID 948 wrote to memory of 952	948	rundll32.exe	465
PID 948 wrote to memory of 952	948	rundll32.exe	465
PID 948 wrote to memory of 952	948	rundll32.exe	465
PID 952 wrote to memory of 744	952	rundll32.exe	31
PID 952 wrote to memory of 744	952	rundll32.exe	31
PID 952 wrote to memory of 744	952	rundll32.exe	31
PID 744 wrote to memory of 1368	744	rundll32.exe	464
PID 744 wrote to memory of 1368	744	rundll32.exe	464
PID 744 wrote to memory of 1368	744	rundll32.exe	464
PID 1368 wrote to memory of 2556	1368	rundll32.exe	32
PID 1368 wrote to memory of 2556	1368	rundll32.exe	32
PID 1368 wrote to memory of 2556	1368	rundll32.exe	32
PID 2556 wrote to memory of 448	2556	rundll32.exe	463
PID 2556 wrote to memory of 448	2556	rundll32.exe	463
PID 2556 wrote to memory of 448	2556	rundll32.exe	463
PID 448 wrote to memory of 4476	448	rundll32.exe	462

C:\Users\Admin\AppData\Local\Temp\1a4cc4c1b7f2ec21c66e87f1788c2d69.exe
"C:\Users\Admin\AppData\Local\Temp\1a4cc4c1b7f2ec21c66e87f1788c2d69.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Program Files (x86)\Common Files\notepad.exe
  "C:\Program Files (x86)\Common Files\notepad.exe" C:\Users\Admin\AppData\Local\Temp\1a4cc4c1b7f2ec21c66e87f1788c2d69.exe
  2⤵
  - Executes dropped EXE
  - Opens file in notepad (likely ransom note)
  - Suspicious use of WriteProcessMemory
  PID:4860

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4292

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4988

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3536

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2412

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4488

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4644
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:948
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:952

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1368

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:448

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:1416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:4724
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:792

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:2684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:4996
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:3732

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:1128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:3756

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:4584
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:3020

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:3432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:4312
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:4804

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:2164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:3872

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:3668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:4272
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:2004
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:4580

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:4060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:4600

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:2760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:2968
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:1872

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:3024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:4528

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:3076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:3436

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:2320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:4664
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:1584

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:3248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:732

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:2512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:2016
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:4592
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:2636
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:1396

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:3328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:3084
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:3180
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:244

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:4876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:2508
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:4540

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:2908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:4672
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:2912

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:4408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:4504

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:5044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:5028
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:4624

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:5096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:4980
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:2224

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:4372
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:4636
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:5136

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:5152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:5168
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:5184

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:5196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:5212
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:5236

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:5256
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:5272

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:5292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:5308

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:5324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:5340
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:5360
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:5376

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:5388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:5408

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:5424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:5440
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:5456

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:5472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:5488
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:5500
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:5516

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:5528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:5540

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:5556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:5572
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:5588
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:5604

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:5620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:5636
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:5648
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:5660

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:5680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:5696

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:5712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:5724

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:5736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:5756
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:5772
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:5788
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:5804

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:5816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:5832
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:5848

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:5864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:5880
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:5896

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:5908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:5920

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:5936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:5948

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:5964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:5980

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:5996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:6012

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:6028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:6048
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:6068

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:6084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:6100

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:6124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:6140

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:5280
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:6156
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:6172

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:6188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:6204
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:6220
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:6236
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:6256

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:6272
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:6288
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:6304
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:6320
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:6336

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:6348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:6364
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:6380
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:6392

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:6408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:6424
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:6440
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:6456
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:6472
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        6⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        7⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        8⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        9⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        10⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        11⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        12⤵
        
        PID:6572

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:6592
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:6604
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:6620

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:6636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:6652
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:6672
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:6688
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:6700
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        6⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        7⤵
        
        PID:6728

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:6744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:6760

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:6776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:6792
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:6808
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:6820

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:6836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:6852
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:6864

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:6880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:6896
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:6908
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:6924

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:6936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:6960

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:6976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:6992
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:7004

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:7016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:7036
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:7060
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:7076
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:7092
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        6⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        7⤵
        
        PID:7124

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:7140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:7156
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:6108

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:1708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:4788
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:3108
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:64

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:4596
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:4548
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:4824
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:7180

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:7196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:7208

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:7224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:7240
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:7256
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:7268

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:7288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:7304
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:7320
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:7336
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:7352
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        6⤵
        
        PID:7368

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:7380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:7400
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:7416

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:7428
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:7444
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:7460

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:7476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:7496
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:7512
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:7528
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:7544
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        6⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        7⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        8⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        9⤵
        
        PID:7604

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:7620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:7636
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:7656
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:7672
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:7688
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        6⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        7⤵
        
        PID:7720

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:7732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:7748
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:7764

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:7780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:7796
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:7816

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:7832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:7848

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:7864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:7880
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:7892

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:7908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:7924
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:7940

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:7956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:7968
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:7984

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:8000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:8016
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:8032

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:8048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:8064
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:8076

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:8108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:8124
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:8140

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:8092

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:8156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:8172
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:8188
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:5032

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:2052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:4240

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:1908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:8204
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:8220
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:8236

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:8252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:8268
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:8284
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:8300

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:8316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:8332
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:8348

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:8360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:8376
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:8392
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:8408

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:8424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:8440
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:8456

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:8472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:8488
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:8504
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:8520
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:8536
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        6⤵
        
        PID:8552

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:8568
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:8584
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:8600

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:8616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:8632
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:8644
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:8664
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:8680
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        6⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        7⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        8⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        9⤵
        
        PID:8748

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:8764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:8780
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:8796

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:8812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:8828
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:8844
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:8856
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:8872

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:8888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:8904
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:8920
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:8936
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:8952
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        6⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        7⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        8⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        9⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        10⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        11⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        12⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        13⤵
        
        PID:9080

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:9092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:9108
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:9124
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:9140
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:9156

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:9172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:9188
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:9204

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:1480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:548
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:3852

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:4816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:9224
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:9240
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:9260
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:9276

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:9292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:9308
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:9324
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:9340
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:9356

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:9372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:9388
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:9404
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:9416
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:9432
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        6⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        7⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        8⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        9⤵
        
        PID:9492

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:9508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:9524
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:9540

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:9552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:9568

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:9584
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:9600
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:9616

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:9628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:9644
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:9660
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:9676
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:9692

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:9704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:9724

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:9740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:9756
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:9772
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:9788
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:9804

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:9820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:9836
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:9856
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:9872
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:9888
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        6⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        7⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        8⤵
        
        PID:9932

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:9948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:9964
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:9980
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:9996
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:10012

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:10032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:10044
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:10064

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:10080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:10096
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:10112
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:10124

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:10140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:10156
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:10172
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:10188

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:10204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:10220
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:10236
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:4864
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:10244
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        6⤵
        
        PID:10260

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:10276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:10292

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:10308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:10324
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:10340
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:10356
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:10372
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        6⤵
        
        PID:10388
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        7⤵
        
        PID:10408

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:10424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:10440
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:10456
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:10472
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:10488
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        6⤵
        
        PID:10500

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:10520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:10536
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:10552
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:10568

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:10584
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:10600
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:10616
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:10632
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:10648

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:10664
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:10680
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:10696
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:10712
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:10728

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:4476

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
- Suspicious use of WriteProcessMemory
PID:4668

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:10748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:10764
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:10776
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:10792
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:10804
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        6⤵
        
        PID:10820

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:10836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:10848
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:10864
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:10880

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:10896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:10912

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:10928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:10944
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:10960

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:10976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:10996
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:11012
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:11028
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:11044
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        6⤵
        
        PID:11060
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        7⤵
        
        PID:11076

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:11092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:11104
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:11120
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:11136
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:11152

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:11168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:11184
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:11196
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:11212
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:11228
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        6⤵
        
        PID:11244
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        7⤵
        
        PID:11260

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:10872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:11280
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:11296

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:11308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:11324
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:11340

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:11356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:11372
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:11388
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:11404
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:11420
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        6⤵
        
        PID:11436
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        7⤵
        
        PID:11452
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        8⤵
        
        PID:11468
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        9⤵
        
        PID:11484
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        10⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        11⤵
        
        PID:11512
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        12⤵
        
        PID:11532
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        13⤵
        
        PID:11548
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        14⤵
        
        PID:11564
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        15⤵
        
        PID:11584
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        16⤵
        
        PID:11600
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        17⤵
        
        PID:11616
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        18⤵
        
        PID:11628
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        19⤵
        
        PID:11640
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        20⤵
        
        PID:11656
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        21⤵
        
        PID:11668
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        22⤵
        
        PID:11680
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        23⤵
        
        PID:11696
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        24⤵
        
        PID:11712
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        25⤵
        
        PID:11724
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        26⤵
        
        PID:11736
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        27⤵
        
        PID:11756
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        28⤵
        
        PID:11772
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        29⤵
        
        PID:11788
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        30⤵
        
        PID:11804
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        31⤵
        
        PID:11820
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        32⤵
        
        PID:11836
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        33⤵
        
        PID:11848
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        34⤵
        
        PID:11868
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        35⤵
        
        PID:11892

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:11916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:11936

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:11904

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:11952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:11968

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:11984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:12000
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:12016

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:12032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:12048
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:12064
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:12080
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:12096

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:12112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:12128
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:12144
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:12160
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:12180
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        6⤵
        
        PID:12200
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        7⤵
        
        PID:12212
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        8⤵
        
        PID:12228
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        9⤵
        
        PID:12244
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        10⤵
        
        PID:12256
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        11⤵
        
        PID:12272

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:11412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:11744

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:12304
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:12320
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:12336
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:12352

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:12368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:12380
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:12396
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:12412
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:12428
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        6⤵
        
        PID:12444
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        7⤵
        
        PID:12460
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        8⤵
        
        PID:12476
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        9⤵
        
        PID:12492
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        10⤵
        
        PID:12504
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        11⤵
        
        PID:12520
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        12⤵
        
        PID:12536
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        13⤵
        
        PID:12552

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:12568
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:12588
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:12604
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:12616

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:12632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:12648
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:12664
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:12676
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:12688

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:12704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:12720

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:12736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:12756
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:12776

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:12792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:12812
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:12828
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:12840
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:12852
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        6⤵
        
        PID:12868
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        7⤵
        
        PID:12884

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:12900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:12916

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:12936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:12952
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:12968

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:12984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:13004
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:13016
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:13032

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:13048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:13064
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:13080

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:13096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:13112
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:13128

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:13144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:13160
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:13176

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:13192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:13208
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:13224
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:13240
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:13256
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        6⤵
        
        PID:13272
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        7⤵
        
        PID:13288
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        8⤵
        
        PID:13304
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        9⤵
        
        PID:12576
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        10⤵
        
        PID:13320
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        11⤵
        
        PID:13336

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:13352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:13364
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:13380
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:13396

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:13412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:13428
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:13444

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:13464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:13480
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:13492
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:13508

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:13524
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:13540
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:13556
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:13568
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:13588
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        6⤵
        
        PID:13600
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        7⤵
        
        PID:13616
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        8⤵
        
        PID:13632
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        9⤵
        
        PID:13648
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        10⤵
        
        PID:13664
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        11⤵
        
        PID:13680
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        12⤵
        
        PID:13700
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        13⤵
        
        PID:13716
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        14⤵
        
        PID:13728
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        15⤵
        
        PID:13748
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        16⤵
        
        PID:13764
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        17⤵
        
        PID:13776
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        18⤵
        
        PID:13792
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        19⤵
        
        PID:13808
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        20⤵
        
        PID:13824
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        21⤵
        
        PID:13840
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        22⤵
        
        PID:13856
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        23⤵
        
        PID:13872

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:13888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:13904
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:13920

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:13940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:13952
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:13968

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:13984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:14000
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:14016
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:14032

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:14048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:14064
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:14080
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:14096
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:14112
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        6⤵
        
        PID:14128
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        7⤵
        
        PID:14144
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        8⤵
        
        PID:14160
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        9⤵
        
        PID:14176
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        10⤵
        
        PID:14188
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        11⤵
        
        PID:14204
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        12⤵
        
        PID:14220

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:14236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:14252
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:14268
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:14284

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:14300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:14320
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:14332
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:14340
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:14356

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:14376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:14392
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:14408
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:14424
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:14440

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:14456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:14472
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:14488
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:14504

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:14520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:14536
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:14548
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:14564

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:14580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:14596
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:14612
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:14628
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:14644
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        6⤵
        
        PID:14664
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        7⤵
        
        PID:14676
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        8⤵
        
        PID:14696
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        9⤵
        
        PID:14708
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        10⤵
        
        PID:14724
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        11⤵
        
        PID:14744
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        12⤵
        
        PID:14768
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        13⤵
        
        PID:14784
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        14⤵
        
        PID:14800

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:14812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:14824
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:14836

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:14852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:14868
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:14884

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:14900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:14916
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:14940
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:14960
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:14976
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        6⤵
        
        PID:14992

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:15008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:15020

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:15036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:15052
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:15072

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:15088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:15104
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:15120
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:15136
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:15148
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        6⤵
        
        PID:15164
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        7⤵
        
        PID:15224
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        8⤵
        
        PID:15276
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        9⤵
        
        PID:15292
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        10⤵
        
        PID:15308
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        11⤵
        
        PID:15324
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        12⤵
        
        PID:15340
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        13⤵
        
        PID:212
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        14⤵
        
        PID:15060
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        15⤵
        
        PID:1792
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        16⤵
        
        PID:1364
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        17⤵
        
        PID:932
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        18⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        19⤵
        
        PID:3644
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        20⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        21⤵
        
        PID:2732
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        22⤵
        
        PID:1116
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        23⤵
        
        PID:2312
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        24⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        25⤵
        
        PID:3744
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        26⤵
        
        PID:3956
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        27⤵
        
        PID:4132

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:4144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:2544
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:3304

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:2560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:316
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:5116

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:3484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:4464
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:2300

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:4872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:3932
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:2496
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:1288
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:3540
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        6⤵
        
        PID:112
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        7⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        8⤵
        
        PID:384
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        9⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        10⤵
        
        PID:3312
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        11⤵
        
        PID:4160
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        12⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        13⤵
        
        PID:4064
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        14⤵
        
        PID:3592
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        15⤵
        
        PID:5144

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:5180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:15200
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:5232
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:5268

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:5300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:5336
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:5352
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:5384
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:5416
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        6⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        7⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        8⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        9⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        10⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        11⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        12⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        13⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        14⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        15⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        16⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        17⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        18⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        19⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        20⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        21⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        22⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        23⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        24⤵
        
        PID:4928
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        25⤵
        
        PID:3696
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        26⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        27⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        28⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        29⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        30⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        31⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        32⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        33⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        34⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        35⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        36⤵
        
        PID:2848
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        37⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        38⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        39⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        40⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        41⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        42⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        43⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        44⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        45⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        46⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        47⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        48⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        49⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        50⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        51⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        52⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        53⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        54⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        55⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        56⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        57⤵
        
        PID:1236
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        58⤵
        
        PID:2932
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        59⤵
        
        PID:3944
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        60⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        61⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        62⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        63⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        64⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        65⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        66⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        67⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        68⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        69⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        70⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        71⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        72⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        73⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        74⤵
        
        PID:7808

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:7888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:7932

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:7964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:7992

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:8028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:8072

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:8104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:8136
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:8168

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:1512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:8216

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
1⤵
PID:8248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
  2⤵
  PID:8260
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
    3⤵
    PID:8296
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
      4⤵
      PID:8340
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        5⤵
        
        PID:8372
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        6⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        7⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        8⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        9⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        10⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        11⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        12⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        13⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        14⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        15⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        16⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        17⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        18⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        19⤵
        
        PID:15204
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        20⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp" "8A'+ [=[SCMR'8[='U"
        21⤵
        
        PID:8948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\notepad.exe

Filesize
119KB

MD5
1a4cc4c1b7f2ec21c66e87f1788c2d69

SHA1
b143a4d875daaddf0277a0037cd52ab5a357dd64

SHA256
dddbb1c8190926d578769b59c0a38e2bc78c0842d2589b76ab65acb562f02d3e

SHA512
8e06a5d23358fb30f242765ea648dd04575eaf1d074a8b6acdc874294a634cce71f3dbfa33e92c41196c41c85d91098816554d86fea47d1c55b5a1d4a12717ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp

Filesize
100KB

MD5
5300681ce61ca77432a1553c0111a9fe

SHA1
a3b08f5ef002bb54e4d908f2eff61b4e3f06fee8

SHA256
670af486e5257d15fcfd72e185efcef979a9792845860141eae73698ccbcc37f

SHA512
b8f52f2a1d4a6b98f0792d3b1bb96daba7152974f2592c1ddb6e728d087704d325b29c8020677a4045c6a70cbc8cb9ce8b0763f9d0f589c3c39d305f597d7b60

Download Submit
memory/4356-6-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4860-5-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads