def473ae3bf69fa4636312f7eab8f0ccfd5b765b435977f1308e4d55a764dda1

Analysis

user interaction
yes
max time kernel
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 15:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IlusionTap.bat
Size 775B
Sample260722-sqqlbabr21
SHA256 def473ae3bf69fa4636312f7eab8f0ccfd5b765b435977f1308e4d55a764dda1
MD5 210ed04d7c4bada756e93b46016d6ab9
SHA1 c967ac0a59f4960eed1492e68e6166d2ee710024
SHA512 9859b44594c33e53c36e9ea883b22b0018f1914c086f1edc0b27ad9aa76b1d3b17fb880997bcf3387f985252444637d14220f94938c567e46e73425a15ee6452
TLSH
T1A201891004424E23267795B4C712355AEA3DF20B292894A4F83251D0AEBE2898FFEDE9
MD5 SHA1 SHA512 TLSH

Score

5^/10

execution

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\LogFiles\WMI\FaceUnlockManually.etl	LogonUI.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\1190018277\87679231.pri	LogonUI.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1092	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	LogonUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	LogonUI.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\Languages = 65006e002d005500530000000000	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft\IME\15.0\IMEJP\MSIME	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IME\15.0\IMETC	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Input\TIPC	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\StigRegKey\Typing\DesktopNearCaretKeyboardEnabled	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\InputMethod\CandidateWindow\CHS\1	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US\0409:00000409 = "1"	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US\CachedLanguageName = "@Winlangdb.dll,-1121"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\ASSEMBLYITEM\0X00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Input\Settings	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\InputMethod\Settings\CHT	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\ASSEMBLYITEM\0X00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\KeyboardLayout = "67699721"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\ShowCasing = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lighting	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Windows\Pen\PLOC\Settings	Process not Found
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\Language\00000000 = "00000409"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\ShowShiftLock = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\LANGUAGE	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\CLSID = "{00000000-0000-0000-0000-000000000000}"	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload\1 = "00000409"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\InputMethod\CandidateWindow\CHS\2	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Substitutes	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\TIP	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\HiddenDummyLayouts	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\Language	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\InputMethod\Settings\CHS	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\TabletTip\1.7	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\Profile = "{00000000-0000-0000-0000-000000000000}"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5936	LogonUI.exe
Token: SeCreatePagefilePrivilege	5936	LogonUI.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5936	LogonUI.exe
5936	LogonUI.exe
5936	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 1920	1092	cmd.exe	90
PID 1092 wrote to memory of 616	1092	cmd.exe	91
PID 616 wrote to memory of 3884	616	net.exe	92
PID 1092 wrote to memory of 4776	1092	cmd.exe	93
PID 1092 wrote to memory of 296	1092	cmd.exe	215
PID 1092 wrote to memory of 5088	1092	cmd.exe	216
PID 1092 wrote to memory of 2640	1092	cmd.exe	217
PID 1092 wrote to memory of 2692	1092	cmd.exe	218
PID 1092 wrote to memory of 4880	1092	cmd.exe	219
PID 1092 wrote to memory of 5372	1092	cmd.exe	220
PID 1092 wrote to memory of 3768	1092	cmd.exe	221
PID 1092 wrote to memory of 4352	1092	cmd.exe	222
PID 1092 wrote to memory of 3904	1092	cmd.exe	223
PID 1092 wrote to memory of 3120	1092	cmd.exe	224
PID 1092 wrote to memory of 1628	1092	cmd.exe	225
PID 1092 wrote to memory of 5400	1092	cmd.exe	226
PID 1092 wrote to memory of 4940	1092	cmd.exe	227
PID 1092 wrote to memory of 1232	1092	cmd.exe	228
PID 1092 wrote to memory of 1780	1092	cmd.exe	229
PID 1092 wrote to memory of 2000	1092	cmd.exe	230
PID 1092 wrote to memory of 2816	1092	cmd.exe	231
PID 1092 wrote to memory of 3800	1092	cmd.exe	232
PID 1092 wrote to memory of 4724	1092	cmd.exe	233
PID 1092 wrote to memory of 5356	1092	cmd.exe	234
PID 1092 wrote to memory of 4948	1092	cmd.exe	235
PID 1092 wrote to memory of 2016	1092	cmd.exe	236
PID 1092 wrote to memory of 2708	1092	cmd.exe	237
PID 1092 wrote to memory of 5872	1092	cmd.exe	238
PID 1092 wrote to memory of 3156	1092	cmd.exe	239
PID 1092 wrote to memory of 3568	1092	cmd.exe	240
PID 1092 wrote to memory of 3004	1092	cmd.exe	241
PID 1092 wrote to memory of 2320	1092	cmd.exe	242
PID 1092 wrote to memory of 2132	1092	cmd.exe	243
PID 1092 wrote to memory of 3656	1092	cmd.exe	244
PID 1092 wrote to memory of 5000	1092	cmd.exe	245
PID 1092 wrote to memory of 2800	1092	cmd.exe	246
PID 1092 wrote to memory of 1968	1092	cmd.exe	247
PID 1092 wrote to memory of 4308	1092	cmd.exe	248
PID 1092 wrote to memory of 2848	1092	cmd.exe	249
PID 1092 wrote to memory of 4688	1092	cmd.exe	250
PID 1092 wrote to memory of 2664	1092	cmd.exe	251
PID 1092 wrote to memory of 964	1092	cmd.exe	252
PID 1092 wrote to memory of 3900	1092	cmd.exe	253
PID 1092 wrote to memory of 2824	1092	cmd.exe	254
PID 1092 wrote to memory of 5756	1092	cmd.exe	255
PID 1092 wrote to memory of 2404	1092	cmd.exe	256
PID 1092 wrote to memory of 1456	1092	cmd.exe	257
PID 1092 wrote to memory of 5788	1092	cmd.exe	258
PID 1092 wrote to memory of 4924	1092	cmd.exe	259
PID 1092 wrote to memory of 5784	1092	cmd.exe	260
PID 1092 wrote to memory of 3404	1092	cmd.exe	261
PID 1092 wrote to memory of 3452	1092	cmd.exe	262
PID 1092 wrote to memory of 3536	1092	cmd.exe	263
PID 1092 wrote to memory of 1268	1092	cmd.exe	264
PID 1092 wrote to memory of 5040	1092	cmd.exe	265
PID 1092 wrote to memory of 932	1092	cmd.exe	266
PID 1092 wrote to memory of 2200	1092	cmd.exe	267
PID 1092 wrote to memory of 5048	1092	cmd.exe	149
PID 1092 wrote to memory of 3016	1092	cmd.exe	150
PID 1092 wrote to memory of 5772	1092	cmd.exe	151
PID 1092 wrote to memory of 1028	1092	cmd.exe	152
PID 1092 wrote to memory of 3432	1092	cmd.exe	153
PID 1092 wrote to memory of 6020	1092	cmd.exe	154
PID 1092 wrote to memory of 1020	1092	cmd.exe	155

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\IlusionTap.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:1920
- C:\Windows\system32\net.exe
  net user "Admin" "FS0ciety!#$@*"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:616
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user "Admin" "FS0ciety!#$@*"
    3⤵
    PID:3884
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4776
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:296
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5088
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2640
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2692
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4880
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5372
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3768
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4352
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3904
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3120
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1628
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5400
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4940
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1232
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1780
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2000
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2816
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3800
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4724
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5356
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4948
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2016
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2708
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5872
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3156
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3568
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3004
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2320
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2132
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3656
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5000
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2800
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1968
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4308
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2848
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4688
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2664
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:964
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3900
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2824
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5756
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2404
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1456
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5788
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4924
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5784
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3404
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3452
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3536
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1268
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5040
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:932
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2200
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5048
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3016
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5772
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1028
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3432
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:6020
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1020
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5888
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3008
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4576
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2128
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1208
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5924
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5852
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4896
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2728
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4600
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5448
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5236
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5136
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2916
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4380
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3792
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3444
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4500
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4540
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5612
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5884
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4344
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5620
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4732
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3744
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2388
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4256
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3888
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4188
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5600
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5628
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4180
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5392
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4636
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5052
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4728
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5764
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1132
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3228
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2328
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4144
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3188
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4692
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4648
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4664
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3012
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5312
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5576
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2628
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:6140
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4128
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:600
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3884
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5960
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5092
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2164
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4332
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5724
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5992
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:296
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5088
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2640
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2692
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4880
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5372
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3768
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4352
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3904
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3120
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1628
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5400
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4940
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1232
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1780
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2000
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2816
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3800
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4724
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5356
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4948
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2016
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2708
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5872
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3156
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3568
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3004
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2320
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2132
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3656
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5000
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2800
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1968
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4308
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2848
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4688
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2664
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:964
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3900
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2824
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5756
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2404
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1456
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5788
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4924
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5784
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3404
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3452
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3536
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1268
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5040
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:932
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2200
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3416
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1088
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3480
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:6072
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3300
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5428
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2488
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2712
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4572
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1480
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4844
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4316
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5988
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2520
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3336
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2180
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:6004
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2576
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:6068
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2732
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3512
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4804
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4852
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1044
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1244
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4304
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3340
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3104
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3244
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2108
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1832
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5696
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3620
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4872
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1004
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5536
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5624
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1848
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5608
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1672
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2656
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5212
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1428
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:824
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5640
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5644
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1324
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2644
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3516
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4356
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2316
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4840
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3012
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5312
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5576
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2628
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:6140
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4128
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:600
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3884
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5960
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5092
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2164
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4332
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5724
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5992
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:296
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5088
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2640
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2692
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4880
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5372
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3768
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4352
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3904
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3120
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1628
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5400
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4940
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1232
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1780
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2000
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2816
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3800
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4724
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5356
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4948
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5072
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2016
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3160
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1152
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2112
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4272
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3424
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2376
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1252
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4820
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2928
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5000
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1892
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4716
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4616
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4484
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4892
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2664
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:964
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3900
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2824
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5756
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2404
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1456
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5788
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4924
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5784
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3404
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3452
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3536
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1268
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5040
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:932
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2200
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3416
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1088
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3480
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:6072
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3300
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5428
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2488
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2712
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4572
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1480
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4844
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4316
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5988
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2520
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3336
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2180
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:6004
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2576
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:6068
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2732
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3512
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4804
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4852
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1044
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1244
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4304
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3340
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3104
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3244
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2108
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1832
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5696
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3620
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4872
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1004
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5536
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5624
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1848
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5608
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1672
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2656
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5212
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1428
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:824
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5640
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5644
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1324
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2644
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3516
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4356
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2316
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4840
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1116
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2672
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4336
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4932
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3348
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1400
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4328
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5104
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4264
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3196
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:252
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3320
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4196
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4112
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4428
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2736
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2856
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4228
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5956
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4132
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3768
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4352
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3904
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3120
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1628
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4712
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3484
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3476
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2220
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1964
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2636
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2920
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5204
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1332
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4788
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4176
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4668
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5872
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3156
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3568
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3004
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1520
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2132
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5944
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4800
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2012
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1968
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4308
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2848
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4612
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5444
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1648
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5680
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:920
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1060
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3776
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2792
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1776
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1888
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1408
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1560
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4796
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:888
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4768
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:820
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2224
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2840
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1172
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4700
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1660
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1700
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3432
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:6020
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1020
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2024
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5876
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2996
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1788
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2364
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3364
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4516
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4896
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4632
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3556
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5856
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2148
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1896
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2916
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3504
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:6064
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2496
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1380
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3936
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4248
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:6016
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1288
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1676
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5932
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2472
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5560
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4772
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5600
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5628
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1264
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1724
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:6008
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1300
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4560
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5068
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1132
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5352
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3276
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4300
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3188
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4140
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1940
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4664
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2008
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5952
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1920
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2868
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4756
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1536
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4320
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4776
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4404
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4440
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:700
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4168
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:360
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1576
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4476
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2584
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5232
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4592
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5340
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3184
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1516
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3544
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2232
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3580
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1156
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5196
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5812
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3484
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3476
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2220
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1964
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2636
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2920
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3200
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1192
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4176
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4668
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5872
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3156
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3568
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3004
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1520
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2132
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4820
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2800
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4452
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1892
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2632
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4688
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4484
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4828
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1648
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5680
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2980
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3420
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3108
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4396
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3312
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2380
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4288
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3404
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5588
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3536
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:900
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2340
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5048
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4136
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3416
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1088
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3480
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5004
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3048
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5888
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2488
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2712
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2128
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4472
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:6120
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4316
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5988
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2728
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4600
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5448
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5236
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5136
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:6068
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2732
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3792
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4804
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4852
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3876
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5612
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5884
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3340
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5620
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1388
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3744
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1832
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4256
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3888
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3572
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4744
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2004
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4232
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1744
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4532
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5212
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5384
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3228
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2328
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2764
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1324
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2644
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4648
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4356
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2316
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5312
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5712
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2672
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3604
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2284
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:600
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3884
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5960
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4368
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2164
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4332
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:256
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5036
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4860
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5088
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2640
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3268
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3636
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4228
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3532
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4132
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3768
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5652
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3580
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1156
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5196
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3696
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5192
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2220
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1964
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2636
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2920
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4788
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2708
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1152
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2112
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4272
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5280
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3528
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1252
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3656
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5376
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2756
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:6084
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:784
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1484
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4892
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2664
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:6132
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3000
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4528
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5680
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2980
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3420
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3108
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4396
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3312
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2380
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4288
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3404
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5588
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3536
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:900
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2340
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2840
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5772
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1028
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:460
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1700
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3432
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:6020
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3008
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2024
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4572
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1480
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1788
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2364
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4268
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1528
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3336
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2180
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5320
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3304
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5572
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4468
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3860
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5532
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3824
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1044
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1244
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5612
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5884
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3340
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5620
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1388
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3744
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1832
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4256
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3888
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3572
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4744
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2004
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4232
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1744
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4532
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5212
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5384
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3228
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2328
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2764
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1324
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2644
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4648
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4356
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2316
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5952
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1920
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2868
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4932
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1536
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4320
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5104
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4404
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4440
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5724
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4168
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:296
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1312
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4860
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5088
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2640
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3268
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3636
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4228
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3532
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4132
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3768
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4340
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3120
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1628
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1220
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2000
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5968
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:472
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5024
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1844
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3548
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3812
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1192
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1096
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2608
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4668
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5872
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:796
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3568
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2376
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1252
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3656
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5376
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2012
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1968
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5020
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:784
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1484
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4892
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2760
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2664
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:6036
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1640
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1416
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2964
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4528
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5680
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3776
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5828
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1776
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5844
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2812
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1560
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4288
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3404
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5588
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3536
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1412
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5048
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3080
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2948
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3416
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5948
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3480
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5004
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3048
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2044
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5876
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2996
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5924
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4472
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3364
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4316
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2520
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2728
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4600
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:6004
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2576
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5780
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1896
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3512
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3792
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4500
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4852
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1380
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5152
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3104
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4732
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4184
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4604
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4224
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3620
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5536
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:672
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4180
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1264
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5608
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5052
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2656
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5764
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1428
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:824
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5352
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5644
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4300
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4692
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4140
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1940
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5304
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4840
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5952
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1920
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2868
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4932
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1536
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4320
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5104
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4404
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4440
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5724
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4168
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:296
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1312
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4860
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5088
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2640
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3268
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3636
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4228
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3532
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4132
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3768
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4340
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3120
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1628
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1220
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2000
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5968
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:472
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5024
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1844
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3548
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3812
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1192
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1096
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2608
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4668
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5872
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:796
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3568
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2376
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1252
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3656
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5376
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2012
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1968
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4688
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4484
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1556
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4200
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4520
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3608
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2208
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2580
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:6088
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1060
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5756
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5912
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3420
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3108
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4396
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3312
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2380
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:888
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4768
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:6136
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2952
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2200
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2840
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4700
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1660
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:6072
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:460
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1592
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1020
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:6020
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1224
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2024
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4844
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1800
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2280
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2364
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5988
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4260
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3556
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2180
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5320
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3304
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5572
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4468
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3860
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4804
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2684
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1044
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1244
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:6016
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3244
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2108
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5736
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4184
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4604
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4224
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3620
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5536
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:672
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4180
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1264
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5608
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5052
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2656
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5764
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1428
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:824
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5352
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5644
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4300
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4692
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4140
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1940
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5304
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4840
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3604
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2284
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1492
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1400
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4776
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5092
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2164
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4332
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:252
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:360
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4196
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4476
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4428
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2692
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1116
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2640
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3268
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3636
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4228
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3532
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4132
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3768
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4340
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3120
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1628
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1220
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2000
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5968
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:472
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5024
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1844
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3548
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3812
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1192
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1096
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2608
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4668
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5872
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:796
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3568
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2376
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1252
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3656
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5376
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2012
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4616
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4956
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1992
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5820
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4236
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1648
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2984
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4780
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3000
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3900
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1200
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3344
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2980
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1456
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4924
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5784
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2812
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3452
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:868
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2256
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5040
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2224
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3016
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1172
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5772
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2516
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:1088
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4656
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5428
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:3432
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:4576
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2488
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2712
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2128
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:5852
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:6120
- C:\Windows\system32\rundll32.exe
  rundll32.exe user32.dll,LockWorkStation
  2⤵
  PID:2396

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3a25855 /state1:0x41c64e6d
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5936

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:3608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

87679231.pri

Path C:\Windows\rescache\_merged\1190018277\87679231.pri
Size 1KB
SHA256 3225c4607f1542dfc37cca73b1a081de384302ea94c6aa4b188797e32b522b3e
MD5 4f71a43cf664ffbbce629389257407cd
SHA1 6fb59086378bfbe75b5327e8d1f3e5905a1d0c6b
SHA512 046c0dca659f90238b637658e9a4180ff30131c7668a8ebac90acf0a7a92c782c7e1dd02def21b0037d09b0b3da0eb15b5aa8faccc3c750b0713607866cea7be
TLSH
T1F731CD07F6FC6E02E0BD073A94F767E0BB34F903E7239B9E418415455C823D09D62A64
MD5 SHA1 SHA512 TLSH

Submit Download