Overview
overview
3Static
static
347e810d266...7f.exe
windows7-x64
347e810d266...7f.exe
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3Syncplay.exe
windows7-x64
1Syncplay.exe
windows10-2004-x64
1SyncplayConsole.exe
windows7-x64
1SyncplayConsole.exe
windows10-2004-x64
1lib/PySide...re.dll
windows7-x64
1lib/PySide...re.dll
windows10-2004-x64
1lib/PySide2.QtGui.dll
windows7-x64
1lib/PySide2.QtGui.dll
windows10-2004-x64
1lib/PySide...rk.dll
windows7-x64
1lib/PySide...rk.dll
windows10-2004-x64
1lib/PySide...ns.dll
windows7-x64
1lib/PySide...ns.dll
windows10-2004-x64
1lib/PySide...s2.dll
windows7-x64
1lib/PySide...s2.dll
windows10-2004-x64
1lib/PySide...ts.dll
windows7-x64
1lib/PySide...ts.dll
windows10-2004-x64
1lib/PySide...pt.dll
windows7-x64
1lib/PySide...pt.dll
windows10-2004-x64
1lib/PySide...ls.dll
windows7-x64
1lib/PySide...ls.dll
windows10-2004-x64
1lib/PySide...rt.dll
windows7-x64
1lib/PySide...rt.dll
windows10-2004-x64
1lib/PySide...ts.dll
windows7-x64
1lib/PySide...ts.dll
windows10-2004-x64
1Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2024, 02:19
Static task
static1
Behavioral task
behavioral1
Sample
47e810d2661b47d7419c6ca876feeeaa900ae86880c00627a218d2c4d918927f.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
47e810d2661b47d7419c6ca876feeeaa900ae86880c00627a218d2c4d918927f.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240319-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
Syncplay.exe
Resource
win7-20240215-en
Behavioral task
behavioral10
Sample
Syncplay.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
SyncplayConsole.exe
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
SyncplayConsole.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
lib/PySide2.QtCore.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
lib/PySide2.QtCore.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral15
Sample
lib/PySide2.QtGui.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
lib/PySide2.QtGui.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral17
Sample
lib/PySide2.QtNetwork.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
lib/PySide2.QtNetwork.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral19
Sample
lib/PySide2.QtOpenGLFunctions.dll
Resource
win7-20240319-en
Behavioral task
behavioral20
Sample
lib/PySide2.QtOpenGLFunctions.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
lib/PySide2.QtQuickControls2.dll
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
lib/PySide2.QtQuickControls2.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral23
Sample
lib/PySide2.QtRemoteObjects.dll
Resource
win7-20240215-en
Behavioral task
behavioral24
Sample
lib/PySide2.QtRemoteObjects.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral25
Sample
lib/PySide2.QtScript.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
lib/PySide2.QtScript.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral27
Sample
lib/PySide2.QtScriptTools.dll
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
lib/PySide2.QtScriptTools.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral29
Sample
lib/PySide2.QtSerialPort.dll
Resource
win7-20240319-en
Behavioral task
behavioral30
Sample
lib/PySide2.QtSerialPort.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral31
Sample
lib/PySide2.QtWidgets.dll
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
lib/PySide2.QtWidgets.dll
Resource
win10v2004-20240412-en
General
-
Target
lib/PySide2.QtScriptTools.dll
-
Size
57KB
-
MD5
05998d9e51b74740398c7bd93a2c246f
-
SHA1
bc35363460f9cb86098bce26e810ca626d8a198c
-
SHA256
3c001d52aa0848b4178d341f842f9c7bb85bef44fccba44179eca6b0b89ac78a
-
SHA512
354bbc351ae4f4ac6b588c45308d05d61a63bbbf69a02b7f7c7b7fd20c8fb9c841c0094cdf62a54025b36848664d6d184be98539d790603dd8f133bd47d55d44
-
SSDEEP
1536:UX9yrtfdyPu0MarZOp28kuF+T8zsgQgKOonPs6s5:UX9E26F+T8zsqKaD
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 dwm.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe -
Modifies data under HKEY_USERS 18 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeCreateGlobalPrivilege 9048 dwm.exe Token: SeChangeNotifyPrivilege 9048 dwm.exe Token: 33 9048 dwm.exe Token: SeIncBasePriorityPrivilege 9048 dwm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1248 wrote to memory of 3564 1248 rundll32.exe 83 PID 1248 wrote to memory of 3564 1248 rundll32.exe 83 PID 1248 wrote to memory of 3564 1248 rundll32.exe 83 PID 3564 wrote to memory of 1764 3564 rundll32.exe 84 PID 3564 wrote to memory of 1764 3564 rundll32.exe 84 PID 3564 wrote to memory of 1764 3564 rundll32.exe 84 PID 1764 wrote to memory of 4564 1764 rundll32.exe 85 PID 1764 wrote to memory of 4564 1764 rundll32.exe 85 PID 1764 wrote to memory of 4564 1764 rundll32.exe 85 PID 4564 wrote to memory of 828 4564 rundll32.exe 86 PID 4564 wrote to memory of 828 4564 rundll32.exe 86 PID 4564 wrote to memory of 828 4564 rundll32.exe 86 PID 828 wrote to memory of 1856 828 rundll32.exe 87 PID 828 wrote to memory of 1856 828 rundll32.exe 87 PID 828 wrote to memory of 1856 828 rundll32.exe 87 PID 1856 wrote to memory of 3568 1856 rundll32.exe 88 PID 1856 wrote to memory of 3568 1856 rundll32.exe 88 PID 1856 wrote to memory of 3568 1856 rundll32.exe 88 PID 3568 wrote to memory of 2652 3568 rundll32.exe 89 PID 3568 wrote to memory of 2652 3568 rundll32.exe 89 PID 3568 wrote to memory of 2652 3568 rundll32.exe 89 PID 2652 wrote to memory of 3128 2652 rundll32.exe 90 PID 2652 wrote to memory of 3128 2652 rundll32.exe 90 PID 2652 wrote to memory of 3128 2652 rundll32.exe 90 PID 3128 wrote to memory of 4044 3128 rundll32.exe 91 PID 3128 wrote to memory of 4044 3128 rundll32.exe 91 PID 3128 wrote to memory of 4044 3128 rundll32.exe 91 PID 4044 wrote to memory of 984 4044 rundll32.exe 92 PID 4044 wrote to memory of 984 4044 rundll32.exe 92 PID 4044 wrote to memory of 984 4044 rundll32.exe 92 PID 984 wrote to memory of 1240 984 rundll32.exe 93 PID 984 wrote to memory of 1240 984 rundll32.exe 93 PID 984 wrote to memory of 1240 984 rundll32.exe 93 PID 1240 wrote to memory of 1888 1240 rundll32.exe 94 PID 1240 wrote to memory of 1888 1240 rundll32.exe 94 PID 1240 wrote to memory of 1888 1240 rundll32.exe 94 PID 1888 wrote to memory of 2904 1888 rundll32.exe 95 PID 1888 wrote to memory of 2904 1888 rundll32.exe 95 PID 1888 wrote to memory of 2904 1888 rundll32.exe 95 PID 2904 wrote to memory of 5072 2904 rundll32.exe 96 PID 2904 wrote to memory of 5072 2904 rundll32.exe 96 PID 2904 wrote to memory of 5072 2904 rundll32.exe 96 PID 5072 wrote to memory of 3000 5072 rundll32.exe 97 PID 5072 wrote to memory of 3000 5072 rundll32.exe 97 PID 5072 wrote to memory of 3000 5072 rundll32.exe 97 PID 3000 wrote to memory of 3096 3000 rundll32.exe 98 PID 3000 wrote to memory of 3096 3000 rundll32.exe 98 PID 3000 wrote to memory of 3096 3000 rundll32.exe 98 PID 3096 wrote to memory of 3976 3096 rundll32.exe 99 PID 3096 wrote to memory of 3976 3096 rundll32.exe 99 PID 3096 wrote to memory of 3976 3096 rundll32.exe 99 PID 3976 wrote to memory of 2356 3976 rundll32.exe 100 PID 3976 wrote to memory of 2356 3976 rundll32.exe 100 PID 3976 wrote to memory of 2356 3976 rundll32.exe 100 PID 2356 wrote to memory of 3872 2356 rundll32.exe 101 PID 2356 wrote to memory of 3872 2356 rundll32.exe 101 PID 2356 wrote to memory of 3872 2356 rundll32.exe 101 PID 3872 wrote to memory of 3700 3872 rundll32.exe 102 PID 3872 wrote to memory of 3700 3872 rundll32.exe 102 PID 3872 wrote to memory of 3700 3872 rundll32.exe 102 PID 3700 wrote to memory of 2788 3700 rundll32.exe 103 PID 3700 wrote to memory of 2788 3700 rundll32.exe 103 PID 3700 wrote to memory of 2788 3700 rundll32.exe 103 PID 2788 wrote to memory of 4900 2788 rundll32.exe 104
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#123⤵PID:4900
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#124⤵PID:3948
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#125⤵PID:528
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#126⤵PID:3196
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#127⤵PID:5084
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#128⤵PID:4152
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#129⤵PID:3316
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#130⤵PID:4656
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#131⤵PID:1556
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#132⤵PID:4088
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#133⤵PID:4380
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#134⤵PID:2540
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#135⤵PID:2392
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#136⤵PID:512
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#137⤵PID:452
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#138⤵PID:2708
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#139⤵PID:4544
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#140⤵PID:1828
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#141⤵PID:4844
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#142⤵PID:5080
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#143⤵PID:2756
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#144⤵PID:3312
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#145⤵PID:936
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#146⤵PID:3020
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#147⤵PID:364
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#148⤵PID:996
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#149⤵PID:3272
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#150⤵PID:4816
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#151⤵PID:4804
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#152⤵PID:1628
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#153⤵PID:2864
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#154⤵PID:4904
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#155⤵PID:2088
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#156⤵PID:2692
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#157⤵PID:2176
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#158⤵PID:3168
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#159⤵PID:3744
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#160⤵PID:1580
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#161⤵PID:1648
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#162⤵PID:3980
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#163⤵PID:3740
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#164⤵PID:4808
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#165⤵PID:4740
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#166⤵PID:1536
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#167⤵PID:3844
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#168⤵PID:4572
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#169⤵PID:5032
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#170⤵PID:3308
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#171⤵PID:3016
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#172⤵PID:4060
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#173⤵PID:5076
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#174⤵PID:3460
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#175⤵PID:3420
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#176⤵PID:1668
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#177⤵PID:1548
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#178⤵PID:4064
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#179⤵PID:3488
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#180⤵PID:3924
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#181⤵PID:2580
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#182⤵PID:2160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#183⤵PID:4408
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#184⤵PID:4764
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#185⤵PID:3228
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#186⤵PID:412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#187⤵PID:4388
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#188⤵PID:4924
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#189⤵PID:1412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#190⤵PID:2496
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#191⤵PID:1216
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#192⤵PID:1012
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#193⤵PID:2380
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#194⤵PID:4940
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#195⤵PID:4532
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#196⤵PID:3548
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#197⤵PID:4340
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#198⤵PID:1992
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#199⤵PID:4352
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#1100⤵PID:4348
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#1101⤵PID:4640
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#1102⤵PID:2140
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#1103⤵PID:2880
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#1104⤵PID:4864
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#1105⤵PID:3428
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#1106⤵PID:4108
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#1107⤵PID:2740
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#1108⤵PID:916
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#1109⤵PID:5136
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#1110⤵PID:5152
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#1111⤵PID:5172
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#1112⤵PID:5192
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#1113⤵PID:5208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#1114⤵PID:5224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#1115⤵PID:5240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#1116⤵PID:5256
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#1117⤵PID:5272
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#1118⤵PID:5288
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#1119⤵PID:5304
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#1120⤵PID:5320
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#1121⤵PID:5336
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtScriptTools.dll,#1122⤵PID:5352
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-