Overview
overview
3Static
static
347e810d266...7f.exe
windows7-x64
347e810d266...7f.exe
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3Syncplay.exe
windows7-x64
1Syncplay.exe
windows10-2004-x64
1SyncplayConsole.exe
windows7-x64
1SyncplayConsole.exe
windows10-2004-x64
1lib/PySide...re.dll
windows7-x64
1lib/PySide...re.dll
windows10-2004-x64
1lib/PySide2.QtGui.dll
windows7-x64
1lib/PySide2.QtGui.dll
windows10-2004-x64
1lib/PySide...rk.dll
windows7-x64
1lib/PySide...rk.dll
windows10-2004-x64
1lib/PySide...ns.dll
windows7-x64
1lib/PySide...ns.dll
windows10-2004-x64
1lib/PySide...s2.dll
windows7-x64
1lib/PySide...s2.dll
windows10-2004-x64
1lib/PySide...ts.dll
windows7-x64
1lib/PySide...ts.dll
windows10-2004-x64
1lib/PySide...pt.dll
windows7-x64
1lib/PySide...pt.dll
windows10-2004-x64
1lib/PySide...ls.dll
windows7-x64
1lib/PySide...ls.dll
windows10-2004-x64
1lib/PySide...rt.dll
windows7-x64
1lib/PySide...rt.dll
windows10-2004-x64
1lib/PySide...ts.dll
windows7-x64
1lib/PySide...ts.dll
windows10-2004-x64
1Analysis
-
max time kernel
134s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2024, 02:19
Static task
static1
Behavioral task
behavioral1
Sample
47e810d2661b47d7419c6ca876feeeaa900ae86880c00627a218d2c4d918927f.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
47e810d2661b47d7419c6ca876feeeaa900ae86880c00627a218d2c4d918927f.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240319-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
Syncplay.exe
Resource
win7-20240215-en
Behavioral task
behavioral10
Sample
Syncplay.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
SyncplayConsole.exe
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
SyncplayConsole.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
lib/PySide2.QtCore.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
lib/PySide2.QtCore.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral15
Sample
lib/PySide2.QtGui.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
lib/PySide2.QtGui.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral17
Sample
lib/PySide2.QtNetwork.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
lib/PySide2.QtNetwork.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral19
Sample
lib/PySide2.QtOpenGLFunctions.dll
Resource
win7-20240319-en
Behavioral task
behavioral20
Sample
lib/PySide2.QtOpenGLFunctions.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
lib/PySide2.QtQuickControls2.dll
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
lib/PySide2.QtQuickControls2.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral23
Sample
lib/PySide2.QtRemoteObjects.dll
Resource
win7-20240215-en
Behavioral task
behavioral24
Sample
lib/PySide2.QtRemoteObjects.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral25
Sample
lib/PySide2.QtScript.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
lib/PySide2.QtScript.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral27
Sample
lib/PySide2.QtScriptTools.dll
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
lib/PySide2.QtScriptTools.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral29
Sample
lib/PySide2.QtSerialPort.dll
Resource
win7-20240319-en
Behavioral task
behavioral30
Sample
lib/PySide2.QtSerialPort.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral31
Sample
lib/PySide2.QtWidgets.dll
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
lib/PySide2.QtWidgets.dll
Resource
win10v2004-20240412-en
General
-
Target
lib/PySide2.QtWidgets.dll
-
Size
5.2MB
-
MD5
64d9c073ec14c9bd65aadc6723b1638e
-
SHA1
f3142bd33c522b32fa6e7d094cfe6986fe3e9de5
-
SHA256
01e2abd8ac729915a0ad96efed7f181f4e11786ab7f1db3d860210abd1c9794a
-
SHA512
762cd9880165fa29eec2eb6eefb4713248344ad0d26931c57003501d21dfc7131a2c7d1ebfd6990deb9a2c4d15cef70477dd1e4337a9f7acf38417d9babaa764
-
SSDEEP
24576:KzKcMBQUUcLiBdcTWfbJ7g+NXXYj2KySpF0kbQJ4asI+HRLUT9p/W1u:vzeY/yOF0kbQJ4P1HRQp/WU
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags dwm.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe -
Modifies data under HKEY_USERS 18 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeCreateGlobalPrivilege 14284 dwm.exe Token: SeChangeNotifyPrivilege 14284 dwm.exe Token: 33 14284 dwm.exe Token: SeIncBasePriorityPrivilege 14284 dwm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 808 wrote to memory of 1524 808 rundll32.exe 83 PID 808 wrote to memory of 1524 808 rundll32.exe 83 PID 808 wrote to memory of 1524 808 rundll32.exe 83 PID 1524 wrote to memory of 3124 1524 rundll32.exe 84 PID 1524 wrote to memory of 3124 1524 rundll32.exe 84 PID 1524 wrote to memory of 3124 1524 rundll32.exe 84 PID 3124 wrote to memory of 3476 3124 rundll32.exe 85 PID 3124 wrote to memory of 3476 3124 rundll32.exe 85 PID 3124 wrote to memory of 3476 3124 rundll32.exe 85 PID 3476 wrote to memory of 2816 3476 rundll32.exe 86 PID 3476 wrote to memory of 2816 3476 rundll32.exe 86 PID 3476 wrote to memory of 2816 3476 rundll32.exe 86 PID 2816 wrote to memory of 5016 2816 rundll32.exe 87 PID 2816 wrote to memory of 5016 2816 rundll32.exe 87 PID 2816 wrote to memory of 5016 2816 rundll32.exe 87 PID 5016 wrote to memory of 4336 5016 rundll32.exe 88 PID 5016 wrote to memory of 4336 5016 rundll32.exe 88 PID 5016 wrote to memory of 4336 5016 rundll32.exe 88 PID 4336 wrote to memory of 1744 4336 rundll32.exe 89 PID 4336 wrote to memory of 1744 4336 rundll32.exe 89 PID 4336 wrote to memory of 1744 4336 rundll32.exe 89 PID 1744 wrote to memory of 3032 1744 rundll32.exe 90 PID 1744 wrote to memory of 3032 1744 rundll32.exe 90 PID 1744 wrote to memory of 3032 1744 rundll32.exe 90 PID 3032 wrote to memory of 4436 3032 rundll32.exe 91 PID 3032 wrote to memory of 4436 3032 rundll32.exe 91 PID 3032 wrote to memory of 4436 3032 rundll32.exe 91 PID 4436 wrote to memory of 3052 4436 rundll32.exe 92 PID 4436 wrote to memory of 3052 4436 rundll32.exe 92 PID 4436 wrote to memory of 3052 4436 rundll32.exe 92 PID 3052 wrote to memory of 4696 3052 rundll32.exe 93 PID 3052 wrote to memory of 4696 3052 rundll32.exe 93 PID 3052 wrote to memory of 4696 3052 rundll32.exe 93 PID 4696 wrote to memory of 5056 4696 rundll32.exe 94 PID 4696 wrote to memory of 5056 4696 rundll32.exe 94 PID 4696 wrote to memory of 5056 4696 rundll32.exe 94 PID 5056 wrote to memory of 2224 5056 rundll32.exe 95 PID 5056 wrote to memory of 2224 5056 rundll32.exe 95 PID 5056 wrote to memory of 2224 5056 rundll32.exe 95 PID 2224 wrote to memory of 5100 2224 rundll32.exe 96 PID 2224 wrote to memory of 5100 2224 rundll32.exe 96 PID 2224 wrote to memory of 5100 2224 rundll32.exe 96 PID 5100 wrote to memory of 1760 5100 rundll32.exe 97 PID 5100 wrote to memory of 1760 5100 rundll32.exe 97 PID 5100 wrote to memory of 1760 5100 rundll32.exe 97 PID 1760 wrote to memory of 1860 1760 rundll32.exe 98 PID 1760 wrote to memory of 1860 1760 rundll32.exe 98 PID 1760 wrote to memory of 1860 1760 rundll32.exe 98 PID 1860 wrote to memory of 4476 1860 rundll32.exe 99 PID 1860 wrote to memory of 4476 1860 rundll32.exe 99 PID 1860 wrote to memory of 4476 1860 rundll32.exe 99 PID 4476 wrote to memory of 2688 4476 rundll32.exe 100 PID 4476 wrote to memory of 2688 4476 rundll32.exe 100 PID 4476 wrote to memory of 2688 4476 rundll32.exe 100 PID 2688 wrote to memory of 5104 2688 rundll32.exe 101 PID 2688 wrote to memory of 5104 2688 rundll32.exe 101 PID 2688 wrote to memory of 5104 2688 rundll32.exe 101 PID 5104 wrote to memory of 4148 5104 rundll32.exe 102 PID 5104 wrote to memory of 4148 5104 rundll32.exe 102 PID 5104 wrote to memory of 4148 5104 rundll32.exe 102 PID 4148 wrote to memory of 4468 4148 rundll32.exe 103 PID 4148 wrote to memory of 4468 4148 rundll32.exe 103 PID 4148 wrote to memory of 4468 4148 rundll32.exe 103 PID 4468 wrote to memory of 3156 4468 rundll32.exe 104
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#123⤵PID:3156
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#124⤵PID:4028
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#125⤵PID:976
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#126⤵PID:3208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#127⤵PID:4056
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#128⤵PID:5080
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#129⤵PID:5112
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#130⤵PID:4020
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#131⤵PID:2660
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#132⤵PID:4932
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#133⤵PID:4280
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#134⤵PID:3212
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#135⤵PID:4212
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#136⤵PID:2332
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#137⤵PID:464
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#138⤵PID:3216
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#139⤵PID:2264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#140⤵PID:1060
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#141⤵PID:1564
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#142⤵PID:2796
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#143⤵PID:2924
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#144⤵PID:4160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#145⤵PID:4756
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#146⤵PID:1924
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#147⤵PID:2684
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#148⤵PID:4440
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#149⤵PID:3648
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#150⤵PID:3324
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#151⤵PID:4912
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#152⤵PID:4920
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#153⤵PID:2860
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#154⤵PID:4312
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#155⤵PID:400
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#156⤵PID:4232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#157⤵PID:4316
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#158⤵PID:8
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#159⤵PID:3488
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#160⤵PID:1848
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#161⤵PID:2328
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#162⤵PID:3536
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#163⤵PID:2164
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#164⤵PID:4400
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#165⤵PID:1708
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#166⤵PID:3900
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#167⤵PID:3532
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#168⤵PID:3284
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#169⤵PID:532
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#170⤵PID:772
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#171⤵PID:4868
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#172⤵PID:3688
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#173⤵PID:4000
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#174⤵PID:848
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#175⤵PID:936
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#176⤵PID:4872
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#177⤵PID:4428
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#178⤵PID:4964
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#179⤵PID:748
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#180⤵PID:4380
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#181⤵PID:3176
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#182⤵PID:2720
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#183⤵PID:1044
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#184⤵PID:5032
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#185⤵PID:3728
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#186⤵PID:4572
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#187⤵PID:4956
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#188⤵PID:3636
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#189⤵PID:3012
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#190⤵PID:872
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#191⤵PID:4092
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#192⤵PID:2596
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#193⤵PID:3720
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#194⤵PID:3976
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#195⤵PID:3108
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#196⤵PID:1828
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#197⤵PID:3420
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#198⤵PID:1724
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#199⤵PID:540
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#1100⤵PID:2368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#1101⤵PID:4776
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#1102⤵PID:756
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#1103⤵PID:2060
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#1104⤵PID:3652
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#1105⤵PID:5036
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#1106⤵PID:4496
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#1107⤵PID:2344
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#1108⤵PID:3000
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#1109⤵PID:3076
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#1110⤵PID:1064
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#1111⤵PID:556
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#1112⤵PID:4528
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#1113⤵PID:4560
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#1114⤵PID:1648
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#1115⤵PID:4972
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#1116⤵PID:3196
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#1117⤵PID:1208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#1118⤵PID:3848
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#1119⤵PID:4704
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#1120⤵PID:4124
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#1121⤵PID:4500
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtWidgets.dll,#1122⤵PID:1364
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-