Overview
overview
3Static
static
347e810d266...7f.exe
windows7-x64
347e810d266...7f.exe
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3Syncplay.exe
windows7-x64
1Syncplay.exe
windows10-2004-x64
1SyncplayConsole.exe
windows7-x64
1SyncplayConsole.exe
windows10-2004-x64
1lib/PySide...re.dll
windows7-x64
1lib/PySide...re.dll
windows10-2004-x64
1lib/PySide2.QtGui.dll
windows7-x64
1lib/PySide2.QtGui.dll
windows10-2004-x64
1lib/PySide...rk.dll
windows7-x64
1lib/PySide...rk.dll
windows10-2004-x64
1lib/PySide...ns.dll
windows7-x64
1lib/PySide...ns.dll
windows10-2004-x64
1lib/PySide...s2.dll
windows7-x64
1lib/PySide...s2.dll
windows10-2004-x64
1lib/PySide...ts.dll
windows7-x64
1lib/PySide...ts.dll
windows10-2004-x64
1lib/PySide...pt.dll
windows7-x64
1lib/PySide...pt.dll
windows10-2004-x64
1lib/PySide...ls.dll
windows7-x64
1lib/PySide...ls.dll
windows10-2004-x64
1lib/PySide...rt.dll
windows7-x64
1lib/PySide...rt.dll
windows10-2004-x64
1lib/PySide...ts.dll
windows7-x64
1lib/PySide...ts.dll
windows10-2004-x64
1Analysis
-
max time kernel
147s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2024, 02:19
Static task
static1
Behavioral task
behavioral1
Sample
47e810d2661b47d7419c6ca876feeeaa900ae86880c00627a218d2c4d918927f.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
47e810d2661b47d7419c6ca876feeeaa900ae86880c00627a218d2c4d918927f.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240319-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
Syncplay.exe
Resource
win7-20240215-en
Behavioral task
behavioral10
Sample
Syncplay.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
SyncplayConsole.exe
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
SyncplayConsole.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
lib/PySide2.QtCore.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
lib/PySide2.QtCore.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral15
Sample
lib/PySide2.QtGui.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
lib/PySide2.QtGui.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral17
Sample
lib/PySide2.QtNetwork.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
lib/PySide2.QtNetwork.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral19
Sample
lib/PySide2.QtOpenGLFunctions.dll
Resource
win7-20240319-en
Behavioral task
behavioral20
Sample
lib/PySide2.QtOpenGLFunctions.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
lib/PySide2.QtQuickControls2.dll
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
lib/PySide2.QtQuickControls2.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral23
Sample
lib/PySide2.QtRemoteObjects.dll
Resource
win7-20240215-en
Behavioral task
behavioral24
Sample
lib/PySide2.QtRemoteObjects.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral25
Sample
lib/PySide2.QtScript.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
lib/PySide2.QtScript.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral27
Sample
lib/PySide2.QtScriptTools.dll
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
lib/PySide2.QtScriptTools.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral29
Sample
lib/PySide2.QtSerialPort.dll
Resource
win7-20240319-en
Behavioral task
behavioral30
Sample
lib/PySide2.QtSerialPort.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral31
Sample
lib/PySide2.QtWidgets.dll
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
lib/PySide2.QtWidgets.dll
Resource
win10v2004-20240412-en
General
-
Target
lib/PySide2.QtGui.dll
-
Size
3.2MB
-
MD5
26e826f03f551b5f3b958ac90892aef6
-
SHA1
0c0b41eebbe82e180adb65a3038b52e0e6d92e3e
-
SHA256
b3eddef583bbfa00f940db601f2b3ce50c453c7a770976336c57e6f1ba6cdf01
-
SHA512
d714302b0d82c969e77bedc48383d4deb325ff4c21cdcb15460bb9418a4ba2cfef6eb7a35889855e2322731dd63e82a4febe6a2eb005782cac6b10142de7a72c
-
SSDEEP
24576:KAtIHtZxF6ALD27coOXffJDgow/2HHyPzD7LJFRWk+iLa/XCs9Gzq:RaNzIA6jpqHSn7LJFXk/XCskm
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe -
Modifies data under HKEY_USERS 18 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeCreateGlobalPrivilege 9800 dwm.exe Token: SeChangeNotifyPrivilege 9800 dwm.exe Token: 33 9800 dwm.exe Token: SeIncBasePriorityPrivilege 9800 dwm.exe Token: SeShutdownPrivilege 9800 dwm.exe Token: SeCreatePagefilePrivilege 9800 dwm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1484 wrote to memory of 3172 1484 rundll32.exe 84 PID 1484 wrote to memory of 3172 1484 rundll32.exe 84 PID 1484 wrote to memory of 3172 1484 rundll32.exe 84 PID 3172 wrote to memory of 4344 3172 rundll32.exe 85 PID 3172 wrote to memory of 4344 3172 rundll32.exe 85 PID 3172 wrote to memory of 4344 3172 rundll32.exe 85 PID 4344 wrote to memory of 3468 4344 rundll32.exe 86 PID 4344 wrote to memory of 3468 4344 rundll32.exe 86 PID 4344 wrote to memory of 3468 4344 rundll32.exe 86 PID 3468 wrote to memory of 8 3468 rundll32.exe 87 PID 3468 wrote to memory of 8 3468 rundll32.exe 87 PID 3468 wrote to memory of 8 3468 rundll32.exe 87 PID 8 wrote to memory of 3596 8 rundll32.exe 88 PID 8 wrote to memory of 3596 8 rundll32.exe 88 PID 8 wrote to memory of 3596 8 rundll32.exe 88 PID 3596 wrote to memory of 4928 3596 rundll32.exe 89 PID 3596 wrote to memory of 4928 3596 rundll32.exe 89 PID 3596 wrote to memory of 4928 3596 rundll32.exe 89 PID 4928 wrote to memory of 5016 4928 rundll32.exe 90 PID 4928 wrote to memory of 5016 4928 rundll32.exe 90 PID 4928 wrote to memory of 5016 4928 rundll32.exe 90 PID 5016 wrote to memory of 4136 5016 rundll32.exe 91 PID 5016 wrote to memory of 4136 5016 rundll32.exe 91 PID 5016 wrote to memory of 4136 5016 rundll32.exe 91 PID 4136 wrote to memory of 1108 4136 rundll32.exe 92 PID 4136 wrote to memory of 1108 4136 rundll32.exe 92 PID 4136 wrote to memory of 1108 4136 rundll32.exe 92 PID 1108 wrote to memory of 448 1108 rundll32.exe 93 PID 1108 wrote to memory of 448 1108 rundll32.exe 93 PID 1108 wrote to memory of 448 1108 rundll32.exe 93 PID 448 wrote to memory of 620 448 rundll32.exe 94 PID 448 wrote to memory of 620 448 rundll32.exe 94 PID 448 wrote to memory of 620 448 rundll32.exe 94 PID 620 wrote to memory of 2760 620 rundll32.exe 96 PID 620 wrote to memory of 2760 620 rundll32.exe 96 PID 620 wrote to memory of 2760 620 rundll32.exe 96 PID 2760 wrote to memory of 3512 2760 rundll32.exe 97 PID 2760 wrote to memory of 3512 2760 rundll32.exe 97 PID 2760 wrote to memory of 3512 2760 rundll32.exe 97 PID 3512 wrote to memory of 2300 3512 rundll32.exe 98 PID 3512 wrote to memory of 2300 3512 rundll32.exe 98 PID 3512 wrote to memory of 2300 3512 rundll32.exe 98 PID 2300 wrote to memory of 388 2300 rundll32.exe 99 PID 2300 wrote to memory of 388 2300 rundll32.exe 99 PID 2300 wrote to memory of 388 2300 rundll32.exe 99 PID 388 wrote to memory of 2128 388 rundll32.exe 100 PID 388 wrote to memory of 2128 388 rundll32.exe 100 PID 388 wrote to memory of 2128 388 rundll32.exe 100 PID 2128 wrote to memory of 3020 2128 rundll32.exe 101 PID 2128 wrote to memory of 3020 2128 rundll32.exe 101 PID 2128 wrote to memory of 3020 2128 rundll32.exe 101 PID 3020 wrote to memory of 2976 3020 rundll32.exe 102 PID 3020 wrote to memory of 2976 3020 rundll32.exe 102 PID 3020 wrote to memory of 2976 3020 rundll32.exe 102 PID 2976 wrote to memory of 4740 2976 rundll32.exe 103 PID 2976 wrote to memory of 4740 2976 rundll32.exe 103 PID 2976 wrote to memory of 4740 2976 rundll32.exe 103 PID 4740 wrote to memory of 440 4740 rundll32.exe 104 PID 4740 wrote to memory of 440 4740 rundll32.exe 104 PID 4740 wrote to memory of 440 4740 rundll32.exe 104 PID 440 wrote to memory of 488 440 rundll32.exe 105 PID 440 wrote to memory of 488 440 rundll32.exe 105 PID 440 wrote to memory of 488 440 rundll32.exe 105 PID 488 wrote to memory of 792 488 rundll32.exe 106
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:488 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#123⤵PID:792
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#124⤵PID:3312
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#125⤵PID:3860
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#126⤵PID:4368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#127⤵PID:3556
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#128⤵PID:952
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#129⤵PID:4640
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#130⤵PID:4780
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#131⤵PID:1916
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#132⤵PID:1596
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#133⤵PID:4676
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#134⤵PID:648
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#135⤵PID:1572
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#136⤵PID:1632
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#137⤵PID:1708
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#138⤵PID:1260
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#139⤵PID:1472
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#140⤵PID:1908
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#141⤵PID:3616
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#142⤵PID:1176
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#143⤵PID:3244
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#144⤵PID:4684
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#145⤵PID:4888
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#146⤵PID:1400
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#147⤵PID:4052
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#148⤵PID:4524
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#149⤵PID:2780
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#150⤵PID:5040
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#151⤵PID:3456
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#152⤵PID:2800
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#153⤵PID:3820
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#154⤵PID:2184
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#155⤵PID:4932
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#156⤵PID:2568
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#157⤵PID:4444
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#158⤵PID:1928
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#159⤵PID:4668
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#160⤵PID:1068
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#161⤵PID:4100
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#162⤵PID:2232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#163⤵PID:372
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#164⤵PID:4572
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#165⤵PID:3892
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#166⤵PID:1184
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#167⤵PID:3640
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#168⤵PID:2124
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#169⤵PID:4432
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#170⤵PID:1736
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#171⤵PID:3428
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#172⤵PID:228
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#173⤵PID:1376
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#174⤵PID:540
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#175⤵PID:4416
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#176⤵PID:456
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#177⤵PID:1816
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#178⤵PID:3684
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#179⤵PID:1012
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#180⤵PID:1644
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#181⤵PID:3176
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#182⤵PID:1412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#183⤵PID:2548
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#184⤵PID:2648
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#185⤵PID:1156
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#186⤵PID:4956
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#187⤵PID:1368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#188⤵PID:1020
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#189⤵PID:3464
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#190⤵PID:4536
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#191⤵PID:5132
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#192⤵PID:5152
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#193⤵PID:5168
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#194⤵PID:5184
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#195⤵PID:5200
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#196⤵PID:5216
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#197⤵PID:5232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#198⤵PID:5248
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#199⤵PID:5264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#1100⤵PID:5280
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#1101⤵PID:5296
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#1102⤵PID:5312
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#1103⤵PID:5328
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#1104⤵PID:5344
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#1105⤵PID:5360
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#1106⤵PID:5376
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#1107⤵PID:5392
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#1108⤵PID:5408
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#1109⤵PID:5428
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#1110⤵PID:5444
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#1111⤵PID:5460
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#1112⤵PID:5480
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#1113⤵PID:5496
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#1114⤵PID:5512
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#1115⤵PID:5528
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#1116⤵PID:5544
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#1117⤵PID:5564
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#1118⤵PID:5576
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#1119⤵PID:5596
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#1120⤵PID:5612
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#1121⤵PID:5628
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtGui.dll,#1122⤵PID:5644
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-