Overview
overview
10Static
static
102026-05-27...ys.exe
windows10-2004-x64
32026-05-27...ys.exe
windows11-21h2-x64
3$PLUGINSDI...st.dll
windows10-2004-x64
3$PLUGINSDI...st.dll
windows11-21h2-x64
3$PLUGINSDI...in.dll
windows10-2004-x64
3$PLUGINSDI...in.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...86.dll
windows10-2004-x64
3$PLUGINSDI...86.dll
windows11-21h2-x64
3$_54_/13.7...re.exe
windows10-2004-x64
6$_54_/13.7...re.exe
windows11-21h2-x64
6$_54_/13.7...pp.dll
windows10-2004-x64
8$_54_/13.7...pp.dll
windows11-21h2-x64
8$_54_/13.7...LL.dll
windows10-2004-x64
9$_54_/13.7...LL.dll
windows11-21h2-x64
9$_54_/13.7...64.dll
windows10-2004-x64
9$_54_/13.7...64.dll
windows11-21h2-x64
9$_54_/13.7...st.exe
windows10-2004-x64
3$_54_/13.7...st.exe
windows11-21h2-x64
3$_54_/13.7...dm.dll
windows10-2004-x64
3$_54_/13.7...dm.dll
windows11-21h2-x64
3$_54_/Prot...er.exe
windows10-2004-x64
3$_54_/Prot...er.exe
windows11-21h2-x64
4$_54_/Prot...in.dll
windows10-2004-x64
3$_54_/Prot...in.dll
windows11-21h2-x64
3$_54_/Prot...ce.dll
windows10-2004-x64
3$_54_/Prot...ce.dll
windows11-21h2-x64
3$_54_/Prot...ce.exe
windows10-2004-x64
3$_54_/Prot...ce.exe
windows11-21h2-x64
3$_54_/Prot...er.exe
windows10-2004-x64
3$_54_/Prot...er.exe
windows11-21h2-x64
3Analysis
- max time kernel
122s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
27/05/2026, 23:48
Behavioral task
behavioral1
Sample
2026-05-27_0cdba1b04e2f226718ef678638d0ee6f_elex_maze_rhadamanthys.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-05-27_0cdba1b04e2f226718ef678638d0ee6f_elex_maze_rhadamanthys.exe
Resource
win11-20260513-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Assist.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Assist.dll
Resource
win11-20260513-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/RCWidgetPlugin.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/RCWidgetPlugin.dll
Resource
win11-20260513-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/libcurl_x86.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/libcurl_x86.dll
Resource
win11-20260513-en
Behavioral task
behavioral11
Sample
$_54_/13.7.0.41868/Assistant/2345Capture.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
$_54_/13.7.0.41868/Assistant/2345Capture.exe
Resource
win11-20260513-en
Behavioral task
behavioral13
Sample
$_54_/13.7.0.41868/Assistant/2345CaptureApp.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
$_54_/13.7.0.41868/Assistant/2345CaptureApp.dll
Resource
win11-20260513-en
Behavioral task
behavioral15
Sample
$_54_/13.7.0.41868/Assistant/2345MgrDLL.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
$_54_/13.7.0.41868/Assistant/2345MgrDLL.dll
Resource
win11-20260513-en
Behavioral task
behavioral17
Sample
$_54_/13.7.0.41868/Assistant/2345MgrDLL64.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
$_54_/13.7.0.41868/Assistant/2345MgrDLL64.dll
Resource
win11-20260513-en
Behavioral task
behavioral19
Sample
$_54_/13.7.0.41868/Assistant/2345Uninst.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
$_54_/13.7.0.41868/Assistant/2345Uninst.exe
Resource
win11-20260513-en
Behavioral task
behavioral21
Sample
$_54_/13.7.0.41868/WidevineCdm/_platform_specific/win_x86/widevinecdm.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
$_54_/13.7.0.41868/WidevineCdm/_platform_specific/win_x86/widevinecdm.dll
Resource
win11-20260513-en
Behavioral task
behavioral23
Sample
$_54_/Protect/AssistExplorer.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral24
Sample
$_54_/Protect/AssistExplorer.exe
Resource
win11-20260513-en
Behavioral task
behavioral25
Sample
$_54_/Protect/AssistMain.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral26
Sample
$_54_/Protect/AssistMain.dll
Resource
win11-20260513-en
Behavioral task
behavioral27
Sample
$_54_/Protect/BrowserService.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral28
Sample
$_54_/Protect/BrowserService.dll
Resource
win11-20260513-en
Behavioral task
behavioral29
Sample
$_54_/Protect/BrowserService.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral30
Sample
$_54_/Protect/BrowserService.exe
Resource
win11-20260513-en
Behavioral task
behavioral31
Sample
$_54_/Protect/BrowserServiceManager.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral32
Sample
$_54_/Protect/BrowserServiceManager.exe
Resource
win11-20260513-en
General
- Target $_54_/13.7.0.41868/WidevineCdm/_platform_specific/win_x86/widevinecdm.dll
- Size 9.9MB
- Sample260527-3tkvcads61
- SHA256 35cf7389ab7b5badc6d0c8ffeb3398e89782e05d0332bf28d3b0dd215da35a9e
- MD5 5ac1484abd2fc318afc247c76ed9c85c
- SHA1 5e007d1dea92cc680d5b491247a655fd6d1e4ab5
- SHA512 1b45d679e46dd460e26ad1be9dafc5a67baf6efcb68e85049c2bdbee25b4aa528f8a81518304b220602a3b158b9550fa74d00285c3e547c0ae3666433be9738a
- SSDEEP 196608:t52ERBm6yxkGOpqcHWV7FqIa0dHeI5us7s6Nfb9vU:t5NBOxk2XdFTHleIgsoAq
- TLSH T1B9B6C080E3232174D84A58F0087DEDEB9478056E5325C7EBEBE85C71FAF22C1672975A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2972 wrote to memory of 4380 2972 rundll32.exe 82 PID 4380 wrote to memory of 3376 4380 rundll32.exe 83 PID 3376 wrote to memory of 4472 3376 rundll32.exe 84 PID 4472 wrote to memory of 3388 4472 rundll32.exe 85 PID 3388 wrote to memory of 4292 3388 rundll32.exe 86 PID 4292 wrote to memory of 4304 4292 rundll32.exe 87 PID 4304 wrote to memory of 4416 4304 rundll32.exe 88 PID 4416 wrote to memory of 3088 4416 rundll32.exe 89 PID 3088 wrote to memory of 4420 3088 rundll32.exe 90 PID 4420 wrote to memory of 1168 4420 rundll32.exe 91 PID 1168 wrote to memory of 4996 1168 rundll32.exe 92 PID 4996 wrote to memory of 4644 4996 rundll32.exe 93 PID 4644 wrote to memory of 748 4644 rundll32.exe 94 PID 748 wrote to memory of 4600 748 rundll32.exe 95 PID 4600 wrote to memory of 3976 4600 rundll32.exe 96 PID 3976 wrote to memory of 852 3976 rundll32.exe 97 PID 852 wrote to memory of 4992 852 rundll32.exe 98 PID 4992 wrote to memory of 2544 4992 rundll32.exe 99 PID 2544 wrote to memory of 4976 2544 rundll32.exe 100 PID 4976 wrote to memory of 3780 4976 rundll32.exe 101 PID 3780 wrote to memory of 4556 3780 rundll32.exe 102 PID 4556 wrote to memory of 4876 4556 rundll32.exe 103 PID 4876 wrote to memory of 3180 4876 rundll32.exe 104 PID 3180 wrote to memory of 4112 3180 rundll32.exe 105 PID 4112 wrote to memory of 2400 4112 rundll32.exe 106 PID 2400 wrote to memory of 916 2400 rundll32.exe 107 PID 916 wrote to memory of 2164 916 rundll32.exe 108 PID 2164 wrote to memory of 2548 2164 rundll32.exe 109 PID 2548 wrote to memory of 4792 2548 rundll32.exe 110 PID 4792 wrote to memory of 1808 4792 rundll32.exe 111 PID 1808 wrote to memory of 3880 1808 rundll32.exe 112 PID 3880 wrote to memory of 2664 3880 rundll32.exe 113 PID 2664 wrote to memory of 1768 2664 rundll32.exe 114 PID 1768 wrote to memory of 3604 1768 rundll32.exe 115 PID 3604 wrote to memory of 1956 3604 rundll32.exe 116 PID 1956 wrote to memory of 2056 1956 rundll32.exe 117 PID 2056 wrote to memory of 2528 2056 rundll32.exe 118 PID 2528 wrote to memory of 3284 2528 rundll32.exe 119 PID 3284 wrote to memory of 3164 3284 rundll32.exe 120 PID 3164 wrote to memory of 1216 3164 rundll32.exe 121 PID 1216 wrote to memory of 5100 1216 rundll32.exe 122 PID 5100 wrote to memory of 3960 5100 rundll32.exe 123 PID 3960 wrote to memory of 4668 3960 rundll32.exe 124 PID 4668 wrote to memory of 3828 4668 rundll32.exe 125 PID 3828 wrote to memory of 2436 3828 rundll32.exe 126 PID 2436 wrote to memory of 692 2436 rundll32.exe 127 PID 692 wrote to memory of 4628 692 rundll32.exe 128 PID 4628 wrote to memory of 1248 4628 rundll32.exe 129 PID 1248 wrote to memory of 1512 1248 rundll32.exe 130 PID 1512 wrote to memory of 1036 1512 rundll32.exe 131 PID 1036 wrote to memory of 3208 1036 rundll32.exe 132 PID 3208 wrote to memory of 3520 3208 rundll32.exe 133 PID 3520 wrote to memory of 1164 3520 rundll32.exe 134 PID 1164 wrote to memory of 344 1164 rundll32.exe 135 PID 344 wrote to memory of 236 344 rundll32.exe 136 PID 236 wrote to memory of 2228 236 rundll32.exe 137 PID 2228 wrote to memory of 2852 2228 rundll32.exe 138 PID 2852 wrote to memory of 1300 2852 rundll32.exe 139 PID 1300 wrote to memory of 1472 1300 rundll32.exe 140 PID 1472 wrote to memory of 3508 1472 rundll32.exe 141 PID 3508 wrote to memory of 2744 3508 rundll32.exe 142 PID 2744 wrote to memory of 1460 2744 rundll32.exe 143 PID 1460 wrote to memory of 4608 1460 rundll32.exe 144 PID 4608 wrote to memory of 4712 4608 rundll32.exe 145
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#123⤵
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#124⤵
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#125⤵
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#126⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#127⤵
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#128⤵
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#129⤵
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#130⤵
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#131⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#132⤵
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#133⤵
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#134⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#135⤵
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#136⤵
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#137⤵
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#138⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#139⤵
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#140⤵
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#141⤵
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#142⤵
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#143⤵
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#144⤵
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#145⤵
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#146⤵
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#147⤵
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#148⤵
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#149⤵
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#150⤵
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#151⤵
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#152⤵
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#153⤵
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#154⤵
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#155⤵
- Suspicious use of WriteProcessMemory
PID:344 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#156⤵
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#157⤵
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#158⤵
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#159⤵
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#160⤵
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#161⤵
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#162⤵
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#163⤵
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#164⤵
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#165⤵PID:4712
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#166⤵PID:3792
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#167⤵PID:4736
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#168⤵PID:2444
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#169⤵PID:3308
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#170⤵PID:440
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#171⤵PID:2036
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#172⤵PID:2676
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#173⤵PID:5080
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#174⤵PID:1568
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#175⤵PID:1104
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#176⤵PID:2008
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#177⤵PID:1612
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#178⤵PID:808
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#179⤵PID:3700
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#180⤵PID:2204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#181⤵PID:3448
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#182⤵PID:1236
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#183⤵PID:1068
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#184⤵PID:412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#185⤵PID:704
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#186⤵
- System Location Discovery: System Language Discovery
PID:3756 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#187⤵PID:4960
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#188⤵PID:3472
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#189⤵PID:3928
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#190⤵PID:4224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#191⤵PID:1748
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#192⤵PID:3936
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#193⤵PID:3248
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#194⤵PID:880
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#195⤵PID:4036
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#196⤵PID:3980
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#197⤵PID:2308
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#198⤵PID:3064
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#199⤵PID:5104
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#1100⤵PID:2964
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#1101⤵PID:2092
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#1102⤵PID:1892
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#1103⤵PID:4376
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#1104⤵PID:3744
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#1105⤵PID:4740
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#1106⤵PID:1052
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#1107⤵PID:2596
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#1108⤵PID:4012
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#1109⤵PID:1184
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#1110⤵PID:4088
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#1111⤵PID:2364
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#1112⤵PID:4752
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#1113⤵PID:4660
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#1114⤵PID:2016
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#1115⤵PID:4884
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#1116⤵PID:4360
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#1117⤵PID:5136
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#1118⤵PID:5148
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#1119⤵PID:5164
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#1120⤵PID:5180
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#1121⤵PID:5200
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\WidevineCdm\_platform_specific\win_x86\widevinecdm.dll,#1122⤵PID:5212
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-