8f0f04a2d5d0320427dd1edd1c164f223feea4c8c0a3f2acb93b00d6c6206004

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/08/2026, 22:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_bd56472c8e41cf8e25f8835a412ec0be_elex_wannacry.exe
Size 383KB
Sample260812-1wnb5ser21
SHA256 8f0f04a2d5d0320427dd1edd1c164f223feea4c8c0a3f2acb93b00d6c6206004
MD5 bd56472c8e41cf8e25f8835a412ec0be
SHA1 12938b81344faeac06425d81a864ef55c8d24d03
SHA512 85141dda4e4d2843197adc1eaca5f4be8beb1c2485047988f26c0f6c205080b1386caefa17cd75315cd663d533caab3f8ba59a40b75b46568befacb4906e3da6
SSDEEP 1536:oQNjg6Z7PRwcxjXUZwDRSZySRWIMTLmtt3ZOPGOrT9wuGY2Dz6Y6VH2pIlheMzjD:bVg8SC7FDRzTKttpnWT9wuGY2Hc2pY
TLSH
T1F5846D2275D088E6D5C77573DEA6B630D3E9C6AC5D32EA7F43E8138E1B36D00930A265
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2756	cccqj.exe

Executes dropped EXE 1 IoCs

pid	Process
2756	cccqj.exe

Loads dropped DLL 64 IoCs

pid	Process
3152	rundll32.exe
4948	rundll32.exe
3720	rundll32.exe
2092	rundll32.exe
784	rundll32.exe
3028	rundll32.exe
4864	rundll32.exe
2468	rundll32.exe
1128	rundll32.exe
2436	rundll32.exe
2188	rundll32.exe
3216	rundll32.exe
1016	rundll32.exe
1200	rundll32.exe
4912	rundll32.exe
3488	rundll32.exe
3244	rundll32.exe
4892	rundll32.exe
1572	rundll32.exe
4028	rundll32.exe
2744	rundll32.exe
4084	rundll32.exe
1732	rundll32.exe
1504	rundll32.exe
2564	rundll32.exe
924	rundll32.exe
3292	rundll32.exe
2960	rundll32.exe
4792	rundll32.exe
4804	rundll32.exe
3404	rundll32.exe
4808	rundll32.exe
564	rundll32.exe
1908	rundll32.exe
1184	rundll32.exe
1376	rundll32.exe
3100	rundll32.exe
2196	rundll32.exe
116	rundll32.exe
2120	rundll32.exe
2088	rundll32.exe
3728	rundll32.exe
1352	rundll32.exe
2576	rundll32.exe
4704	rundll32.exe
4664	rundll32.exe
1408	rundll32.exe
4500	rundll32.exe
448	rundll32.exe
4548	rundll32.exe
5008	rundll32.exe
1204	rundll32.exe
3520	rundll32.exe
1768	rundll32.exe
2064	rundll32.exe
3196	rundll32.exe
3084	rundll32.exe
4476	rundll32.exe
2804	rundll32.exe
2024	rundll32.exe
1344	rundll32.exe
2260	rundll32.exe
2508	rundll32.exe
5032	rundll32.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\ygzcv	cccqj.exe
File created	\??\c:\Program Files\ygzcv\jcxjzwho.dll	cccqj.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5020	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5020	cmd.exe
4112	PING.EXE

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4112	PING.EXE

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	1608	dwm.exe
Token: SeChangeNotifyPrivilege	1608	dwm.exe
Token: 33	1608	dwm.exe
Token: SeIncBasePriorityPrivilege	1608	dwm.exe
Token: SeShutdownPrivilege	1608	dwm.exe
Token: SeCreatePagefilePrivilege	1608	dwm.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1812	2026-08-12_bd56472c8e41cf8e25f8835a412ec0be_elex_wannacry.exe
2756	cccqj.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 5020	1812	2026-08-12_bd56472c8e41cf8e25f8835a412ec0be_elex_wannacry.exe	83
PID 5020 wrote to memory of 4112	5020	cmd.exe	85
PID 5020 wrote to memory of 2756	5020	cmd.exe	86
PID 2756 wrote to memory of 3152	2756	cccqj.exe	87
PID 3152 wrote to memory of 4948	3152	rundll32.exe	88
PID 4948 wrote to memory of 3720	4948	rundll32.exe	89
PID 3720 wrote to memory of 2092	3720	rundll32.exe	90
PID 2092 wrote to memory of 784	2092	rundll32.exe	91
PID 784 wrote to memory of 3028	784	rundll32.exe	92
PID 3028 wrote to memory of 4864	3028	rundll32.exe	93
PID 4864 wrote to memory of 2468	4864	rundll32.exe	94
PID 2468 wrote to memory of 1128	2468	rundll32.exe	95
PID 1128 wrote to memory of 2436	1128	rundll32.exe	96
PID 2436 wrote to memory of 2188	2436	rundll32.exe	97
PID 2188 wrote to memory of 3216	2188	rundll32.exe	98
PID 3216 wrote to memory of 1016	3216	rundll32.exe	99
PID 1016 wrote to memory of 1200	1016	rundll32.exe	100
PID 1200 wrote to memory of 4912	1200	rundll32.exe	101
PID 4912 wrote to memory of 3488	4912	rundll32.exe	102
PID 3488 wrote to memory of 3244	3488	rundll32.exe	103
PID 3244 wrote to memory of 4892	3244	rundll32.exe	104
PID 4892 wrote to memory of 1572	4892	rundll32.exe	105
PID 1572 wrote to memory of 4028	1572	rundll32.exe	106
PID 4028 wrote to memory of 2744	4028	rundll32.exe	107
PID 2744 wrote to memory of 4084	2744	rundll32.exe	108
PID 4084 wrote to memory of 1732	4084	rundll32.exe	109
PID 1732 wrote to memory of 1504	1732	rundll32.exe	110
PID 1504 wrote to memory of 2564	1504	rundll32.exe	111
PID 2564 wrote to memory of 924	2564	rundll32.exe	112
PID 924 wrote to memory of 3292	924	rundll32.exe	113
PID 3292 wrote to memory of 2960	3292	rundll32.exe	114
PID 2960 wrote to memory of 4792	2960	rundll32.exe	115
PID 4792 wrote to memory of 4804	4792	rundll32.exe	116
PID 4804 wrote to memory of 3404	4804	rundll32.exe	117
PID 3404 wrote to memory of 4808	3404	rundll32.exe	118
PID 4808 wrote to memory of 564	4808	rundll32.exe	119
PID 564 wrote to memory of 1908	564	rundll32.exe	120
PID 1908 wrote to memory of 1184	1908	rundll32.exe	121
PID 1184 wrote to memory of 1376	1184	rundll32.exe	122
PID 1376 wrote to memory of 3100	1376	rundll32.exe	123
PID 3100 wrote to memory of 2196	3100	rundll32.exe	124
PID 2196 wrote to memory of 116	2196	rundll32.exe	125
PID 116 wrote to memory of 2120	116	rundll32.exe	126
PID 2120 wrote to memory of 2088	2120	rundll32.exe	127
PID 2088 wrote to memory of 3728	2088	rundll32.exe	128
PID 3728 wrote to memory of 1352	3728	rundll32.exe	129
PID 1352 wrote to memory of 2576	1352	rundll32.exe	130
PID 2576 wrote to memory of 4704	2576	rundll32.exe	131
PID 4704 wrote to memory of 4664	4704	rundll32.exe	132
PID 4664 wrote to memory of 1408	4664	rundll32.exe	133
PID 1408 wrote to memory of 4500	1408	rundll32.exe	134
PID 4500 wrote to memory of 448	4500	rundll32.exe	135
PID 448 wrote to memory of 4548	448	rundll32.exe	136
PID 4548 wrote to memory of 5008	4548	rundll32.exe	137
PID 5008 wrote to memory of 1204	5008	rundll32.exe	138
PID 1204 wrote to memory of 3520	1204	rundll32.exe	139
PID 3520 wrote to memory of 1768	3520	rundll32.exe	140
PID 1768 wrote to memory of 2064	1768	rundll32.exe	141
PID 2064 wrote to memory of 3196	2064	rundll32.exe	142
PID 3196 wrote to memory of 3084	3196	rundll32.exe	143
PID 3084 wrote to memory of 4476	3084	rundll32.exe	144
PID 4476 wrote to memory of 2804	4476	rundll32.exe	145
PID 2804 wrote to memory of 2024	2804	rundll32.exe	146
PID 2024 wrote to memory of 1344	2024	rundll32.exe	147

C:\Users\Admin\AppData\Local\Temp\2026-08-12_bd56472c8e41cf8e25f8835a412ec0be_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_bd56472c8e41cf8e25f8835a412ec0be_elex_wannacry.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ping 127.0.0.1 -n 2&C:\Users\Admin\AppData\Local\Temp\\cccqj.exe "C:\Users\Admin\AppData\Local\Temp\2026-08-12_bd56472c8e41cf8e25f8835a412ec0be_elex_wannacry.exe"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4112
- - C:\Users\Admin\AppData\Local\Temp\cccqj.exe
    C:\Users\Admin\AppData\Local\Temp\\cccqj.exe "C:\Users\Admin\AppData\Local\Temp\2026-08-12_bd56472c8e41cf8e25f8835a412ec0be_elex_wannacry.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2756
  - - \??\c:\windows\SysWOW64\rundll32.exe
      c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:3152
    - - C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        5⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:4948
      - C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        6⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3720
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        7⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2092
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        8⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:784
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        9⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:3028
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        10⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:4864
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        11⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2468
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        12⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1128
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        13⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2436
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        14⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2188
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        15⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:3216
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        16⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1016
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        17⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1200
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        18⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:4912
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        19⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:3488
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        20⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:3244
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        21⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:4892
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        22⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1572
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        23⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:4028
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        24⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2744
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        25⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:4084
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        26⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1732
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        27⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1504
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        28⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2564
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        29⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:924
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        30⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:3292
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        31⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2960
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        32⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:4792
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        33⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:4804
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        34⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3404
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        35⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:4808
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        36⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:564
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        37⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1908
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        38⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1184
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        39⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1376
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        40⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:3100
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        41⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2196
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        42⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:116
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        43⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2120
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        44⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2088
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        45⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:3728
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        46⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1352
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        47⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2576
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        48⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:4704
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        49⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:4664
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        50⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1408
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        51⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:4500
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        52⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:448
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        53⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:4548
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        54⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:5008
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        55⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1204
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        56⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:3520
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        57⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1768
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        58⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2064
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        59⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:3196
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        60⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:3084
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        61⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:4476
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        62⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2804
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        63⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2024
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        64⤵
        Loads dropped DLL
        
        PID:1344
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        65⤵
        Loads dropped DLL
        
        PID:2260
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        66⤵
        Loads dropped DLL
        
        PID:2508
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        67⤵
        Loads dropped DLL
        
        PID:5032
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        68⤵
        
        PID:1552
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        69⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        70⤵
        
        PID:2264
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        71⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        72⤵
        
        PID:4488
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        73⤵
        
        PID:2376
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        74⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        75⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        76⤵
        
        PID:2168
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        77⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        78⤵
        
        PID:820
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        79⤵
        
        PID:3396
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        80⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        81⤵
        
        PID:3088
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        82⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        83⤵
        
        PID:3384
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        84⤵
        
        PID:4004
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        85⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        86⤵
        
        PID:3064
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        87⤵
        
        PID:2288
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        88⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        89⤵
        
        PID:3104
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        90⤵
        
        PID:4256
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        91⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        92⤵
        
        PID:4712
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        93⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        94⤵
        
        PID:4876
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        95⤵
        
        PID:1840
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        96⤵
        
        PID:452
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        97⤵
        
        PID:2132
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        98⤵
        
        PID:1448
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        99⤵
        
        PID:4552
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        100⤵
        
        PID:3636
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        101⤵
        System Location Discovery: System Language Discovery
        
        PID:4836
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        102⤵
        
        PID:1656
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        103⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        104⤵
        System Location Discovery: System Language Discovery
        
        PID:1588
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        105⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        106⤵
        
        PID:4388
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        107⤵
        
        PID:628
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        108⤵
        System Location Discovery: System Language Discovery
        
        PID:2248
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        109⤵
        
        PID:4416
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        110⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        111⤵
        
        PID:648
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        112⤵
        
        PID:2836
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        113⤵
        
        PID:952
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        114⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        115⤵
        
        PID:3612
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        116⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        117⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        118⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        119⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        120⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        121⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        122⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        123⤵
        System Location Discovery: System Language Discovery
        
        PID:5264
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        124⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        125⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        126⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        127⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        128⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        129⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        130⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        131⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        132⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        133⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        134⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        135⤵
        System Location Discovery: System Language Discovery
        
        PID:5492
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        136⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        137⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        138⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        139⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        140⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        141⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        142⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        143⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        144⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        145⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        146⤵
        System Location Discovery: System Language Discovery
        
        PID:5696
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        147⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        148⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        149⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        150⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        151⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        152⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        153⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        154⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        155⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        156⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        157⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        158⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        159⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        160⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        161⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        162⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        163⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        164⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        165⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        166⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        167⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        168⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        169⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        170⤵
        System Location Discovery: System Language Discovery
        
        PID:6140
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        171⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        172⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        173⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        174⤵
        
        PID:3784
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        175⤵
        
        PID:3188
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        176⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        177⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        178⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        179⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        180⤵
        System Location Discovery: System Language Discovery
        
        PID:5580
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        181⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        182⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        183⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        184⤵
        System Location Discovery: System Language Discovery
        
        PID:1188
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        185⤵
        
        PID:2148
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        186⤵
        
        PID:976
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        187⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        188⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        189⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        190⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        191⤵
        
        PID:456
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        192⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        193⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        194⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        195⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        196⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        197⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        198⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        199⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        200⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        201⤵
        System Location Discovery: System Language Discovery
        
        PID:6200
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        202⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        203⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        204⤵
        System Location Discovery: System Language Discovery
        
        PID:6252
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        205⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        206⤵
        System Location Discovery: System Language Discovery
        
        PID:6292
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        207⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        208⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        209⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        210⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        211⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        212⤵
        System Location Discovery: System Language Discovery
        
        PID:6376
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        213⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        214⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        215⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        216⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        217⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        218⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        219⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        220⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        221⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        222⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        223⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        224⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        225⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        226⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        227⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        228⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        229⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        230⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        231⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        232⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        233⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        234⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        235⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        236⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        237⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        238⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        239⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        240⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        241⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        242⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        243⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        244⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        245⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        246⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        247⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        248⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        249⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        250⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        251⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        252⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        253⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        254⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        255⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        256⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        257⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        258⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        259⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        260⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        261⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        262⤵
        
        PID:3936
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        263⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        264⤵
        
        PID:3044
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        265⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        266⤵
        
        PID:4300
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        267⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        268⤵
        
        PID:3484
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        269⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        270⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        271⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        272⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        273⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        274⤵
        
        PID:4120
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        275⤵
        System Location Discovery: System Language Discovery
        
        PID:1124
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        276⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        277⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        278⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        279⤵
        System Location Discovery: System Language Discovery
        
        PID:7212
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        280⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        281⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        282⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        283⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        284⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        285⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        286⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        287⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        288⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        289⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        290⤵
        System Location Discovery: System Language Discovery
        
        PID:7424
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        291⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        292⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        293⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        294⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        295⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        296⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        297⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        298⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        299⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        300⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        301⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        302⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        303⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        304⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        305⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        306⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        307⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        308⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        309⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        310⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        311⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        312⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        313⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        314⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        315⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        316⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        317⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        318⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        319⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        320⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        321⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        322⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        323⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        324⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        325⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        326⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        327⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        328⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        329⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        330⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        331⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        332⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        333⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        334⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        335⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        336⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        337⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        338⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        339⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        340⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        341⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        342⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        343⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        344⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        345⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        346⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        347⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        348⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        349⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        350⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        351⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        352⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        353⤵
        System Location Discovery: System Language Discovery
        
        PID:8528
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        354⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        355⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        356⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        357⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        358⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        359⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        360⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        361⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        362⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        363⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        364⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        365⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        366⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        367⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        368⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        369⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        370⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        371⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        372⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        373⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        374⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        375⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        376⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        377⤵
        System Location Discovery: System Language Discovery
        
        PID:8924
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        378⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        379⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        380⤵
        System Location Discovery: System Language Discovery
        
        PID:8972
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        381⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        382⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        383⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        384⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        385⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        386⤵
        System Location Discovery: System Language Discovery
        
        PID:9060
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        387⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        388⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        389⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        390⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        391⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        392⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        393⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        394⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        395⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        396⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        397⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        398⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        399⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        400⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        401⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        402⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        403⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        404⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        405⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        406⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        407⤵
        
        PID:9348
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        408⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        409⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        410⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        411⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        412⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        413⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        414⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        415⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        416⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        417⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        418⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        419⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        420⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        421⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        422⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        423⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        424⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        425⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        426⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        427⤵
        
        PID:9664
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        428⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        429⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        430⤵
        
        PID:9704
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        431⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        432⤵
        System Location Discovery: System Language Discovery
        
        PID:9732
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        433⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        434⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        435⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        436⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        437⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        438⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        439⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        440⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        441⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        442⤵
        System Location Discovery: System Language Discovery
        
        PID:9880
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        443⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        444⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        445⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        446⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        447⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        448⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        449⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        450⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        451⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        452⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        453⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        454⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        455⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        456⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        457⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        458⤵
        System Location Discovery: System Language Discovery
        
        PID:10128
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        459⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        460⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        461⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        462⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        463⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        464⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        465⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        466⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        467⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        468⤵
        
        PID:10260
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        469⤵
        
        PID:10276
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        470⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        471⤵
        
        PID:10304
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        472⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        473⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        474⤵
        
        PID:10348
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        475⤵
        
        PID:10364
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        476⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        477⤵
        
        PID:10396
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        478⤵
        
        PID:10412
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        479⤵
        
        PID:10428
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        480⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        481⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        482⤵
        
        PID:10476
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        483⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        484⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        485⤵
        
        PID:10528
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        486⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        487⤵
        
        PID:10556
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        488⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        489⤵
        
        PID:10592
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        490⤵
        
        PID:10604
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        491⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        492⤵
        
        PID:10636
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        493⤵
        
        PID:10652
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        494⤵
        
        PID:10668
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        495⤵
        
        PID:10684
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        496⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        497⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        498⤵
        
        PID:10732
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        499⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        500⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        501⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        502⤵
        System Location Discovery: System Language Discovery
        
        PID:10792
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        503⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        504⤵
        
        PID:10816
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        505⤵
        
        PID:10832
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        506⤵
        
        PID:10844
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        507⤵
        
        PID:10856
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        508⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        509⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        510⤵
        
        PID:10904
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        511⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        512⤵
        
        PID:10936
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        513⤵
        
        PID:10952
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        514⤵
        
        PID:10968
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        515⤵
        System Location Discovery: System Language Discovery
        
        PID:10984
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        516⤵
        
        PID:11000
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        517⤵
        
        PID:11016
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        518⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        519⤵
        
        PID:11056
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        520⤵
        
        PID:11068
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        521⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        522⤵
        System Location Discovery: System Language Discovery
        
        PID:11096
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        523⤵
        
        PID:11112
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        524⤵
        
        PID:11124
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        525⤵
        
        PID:11144
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        526⤵
        
        PID:11156
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        527⤵
        
        PID:11176
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        528⤵
        
        PID:11188
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        529⤵
        
        PID:11204
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        530⤵
        System Location Discovery: System Language Discovery
        
        PID:11220
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        531⤵
        
        PID:11236
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        532⤵
        
        PID:11252
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        533⤵
        
        PID:4248
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        534⤵
        
        PID:11280
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        535⤵
        
        PID:11300
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        536⤵
        
        PID:11312
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        537⤵
        
        PID:11332
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        538⤵
        
        PID:11348
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        539⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        540⤵
        
        PID:11376
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        541⤵
        
        PID:11392
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        542⤵
        
        PID:11412
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        543⤵
        
        PID:11424
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        544⤵
        
        PID:11452
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        545⤵
        
        PID:11480
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        546⤵
        
        PID:11492
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        547⤵
        
        PID:11516
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        548⤵
        
        PID:11532
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        549⤵
        
        PID:11548
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        550⤵
        
        PID:11564
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        551⤵
        
        PID:11580
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        552⤵
        
        PID:11596
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        553⤵
        
        PID:11612
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        554⤵
        
        PID:11628
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        555⤵
        
        PID:11644
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        556⤵
        
        PID:11660
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        557⤵
        
        PID:11676
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        558⤵
        
        PID:11692
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        559⤵
        
        PID:11708
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        560⤵
        
        PID:11724
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        561⤵
        
        PID:11736
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        562⤵
        
        PID:11752
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        563⤵
        
        PID:11768
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        564⤵
        
        PID:11784
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        565⤵
        
        PID:11800
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        566⤵
        
        PID:11816
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        567⤵
        System Location Discovery: System Language Discovery
        
        PID:11828
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        568⤵
        
        PID:11844
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        569⤵
        
        PID:11856
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        570⤵
        
        PID:11872
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        571⤵
        
        PID:11888
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        572⤵
        
        PID:11904
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        573⤵
        
        PID:11924
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        574⤵
        
        PID:11944
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        575⤵
        
        PID:11956
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        576⤵
        
        PID:11972
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        577⤵
        System Location Discovery: System Language Discovery
        
        PID:11988
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        578⤵
        
        PID:12004
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        579⤵
        
        PID:12020
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        580⤵
        
        PID:12036
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        581⤵
        
        PID:12056
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        582⤵
        
        PID:12068
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        583⤵
        
        PID:12084
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        584⤵
        
        PID:12100
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        585⤵
        
        PID:12128
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        586⤵
        System Location Discovery: System Language Discovery
        
        PID:12144
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        587⤵
        
        PID:12156
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        588⤵
        
        PID:12172
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        589⤵
        
        PID:12188
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        590⤵
        
        PID:12204
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        591⤵
        System Location Discovery: System Language Discovery
        
        PID:12220
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        592⤵
        
        PID:12236
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        593⤵
        
        PID:12256
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        594⤵
        
        PID:12268
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        595⤵
        
        PID:12280
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        596⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        597⤵
        
        PID:3888
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        598⤵
        
        PID:11464
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        599⤵
        
        PID:12304
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        600⤵
        
        PID:12320
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        601⤵
        
        PID:12336
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        602⤵
        
        PID:12352
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        603⤵
        
        PID:12372
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        604⤵
        
        PID:12384
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        605⤵
        
        PID:12400
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        606⤵
        System Location Discovery: System Language Discovery
        
        PID:12416
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        607⤵
        
        PID:12432
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        608⤵
        
        PID:12448
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        609⤵
        
        PID:12460
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        610⤵
        
        PID:12476
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        611⤵
        System Location Discovery: System Language Discovery
        
        PID:12488
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        612⤵
        
        PID:12500
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        613⤵
        System Location Discovery: System Language Discovery
        
        PID:12512
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        614⤵
        
        PID:12528
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        615⤵
        
        PID:12548
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        616⤵
        
        PID:12568
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        617⤵
        
        PID:12580
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        618⤵
        
        PID:12596
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        619⤵
        
        PID:12612
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        620⤵
        
        PID:12628
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        621⤵
        
        PID:12644
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        622⤵
        
        PID:12660
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        623⤵
        
        PID:12672
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        624⤵
        
        PID:12688
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        625⤵
        
        PID:12700
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        626⤵
        
        PID:12716
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        627⤵
        
        PID:12732
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        628⤵
        
        PID:12748
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        629⤵
        
        PID:12764
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        630⤵
        
        PID:12780
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        631⤵
        
        PID:12796
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        632⤵
        
        PID:12812
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        633⤵
        
        PID:12828
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        634⤵
        
        PID:12844
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        635⤵
        
        PID:12860
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        636⤵
        System Location Discovery: System Language Discovery
        
        PID:12880
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        637⤵
        
        PID:12896
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        638⤵
        
        PID:12912
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        639⤵
        
        PID:12928
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        640⤵
        
        PID:12944
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        641⤵
        
        PID:12960
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        642⤵
        
        PID:12972
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        643⤵
        System Location Discovery: System Language Discovery
        
        PID:12988
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        644⤵
        
        PID:13004
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        645⤵
        
        PID:13016
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        646⤵
        
        PID:13032
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        647⤵
        System Location Discovery: System Language Discovery
        
        PID:13044
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        648⤵
        System Location Discovery: System Language Discovery
        
        PID:13060
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        649⤵
        
        PID:13072
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        650⤵
        
        PID:13088
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        651⤵
        
        PID:13104
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        652⤵
        
        PID:13120
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        653⤵
        
        PID:13136
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        654⤵
        
        PID:13148
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        655⤵
        
        PID:13160
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        656⤵
        
        PID:13176
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        657⤵
        
        PID:13192
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        658⤵
        
        PID:13208
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        659⤵
        
        PID:13228
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        660⤵
        
        PID:13240
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        661⤵
        
        PID:13256
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        662⤵
        
        PID:13272
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        663⤵
        
        PID:13292
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        664⤵
        
        PID:13304
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        665⤵
        
        PID:12872
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        666⤵
        
        PID:13328
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        667⤵
        System Location Discovery: System Language Discovery
        
        PID:13344
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        668⤵
        
        PID:13360
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        669⤵
        
        PID:13376
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        670⤵
        
        PID:13392
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        671⤵
        
        PID:13404
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        672⤵
        
        PID:13420
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        673⤵
        
        PID:13432
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        674⤵
        
        PID:13448
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        675⤵
        
        PID:13464
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        676⤵
        
        PID:13480
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        677⤵
        
        PID:13496
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        678⤵
        
        PID:13512
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        679⤵
        
        PID:13532
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        680⤵
        
        PID:13548
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        681⤵
        
        PID:13564
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        682⤵
        
        PID:13580
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        683⤵
        
        PID:13600
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        684⤵
        
        PID:13612
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        685⤵
        
        PID:13628
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        686⤵
        
        PID:13644
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        687⤵
        
        PID:13660
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        688⤵
        
        PID:13676
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        689⤵
        
        PID:13688
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        690⤵
        
        PID:13704
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        691⤵
        
        PID:13716
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        692⤵
        
        PID:13728
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        693⤵
        
        PID:13744
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        694⤵
        System Location Discovery: System Language Discovery
        
        PID:13756
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        695⤵
        System Location Discovery: System Language Discovery
        
        PID:13768
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        696⤵
        
        PID:13784
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        697⤵
        System Location Discovery: System Language Discovery
        
        PID:13800
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        698⤵
        
        PID:13816
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        699⤵
        
        PID:13828
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        700⤵
        
        PID:13848
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        701⤵
        
        PID:13860
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        702⤵
        
        PID:13876
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        703⤵
        
        PID:13888
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        704⤵
        
        PID:13904
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        705⤵
        
        PID:13916
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        706⤵
        
        PID:13932
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        707⤵
        System Location Discovery: System Language Discovery
        
        PID:13948
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        708⤵
        
        PID:13964
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        709⤵
        
        PID:13980
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        710⤵
        
        PID:13996
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        711⤵
        
        PID:14008
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        712⤵
        
        PID:14024
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        713⤵
        System Location Discovery: System Language Discovery
        
        PID:14040
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        714⤵
        System Location Discovery: System Language Discovery
        
        PID:14056
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        715⤵
        
        PID:14072
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        716⤵
        
        PID:14088
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        717⤵
        
        PID:14104
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        718⤵
        
        PID:14124
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        719⤵
        
        PID:14136
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        720⤵
        
        PID:14152
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        721⤵
        
        PID:14168
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        722⤵
        
        PID:14184
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        723⤵
        
        PID:14200
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        724⤵
        
        PID:14216
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        725⤵
        
        PID:14232
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        726⤵
        
        PID:14248
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        727⤵
        System Location Discovery: System Language Discovery
        
        PID:14264
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        728⤵
        
        PID:14280
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        729⤵
        
        PID:14296
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        730⤵
        
        PID:14312
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        731⤵
        
        PID:14328
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        732⤵
        
        PID:14176
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        733⤵
        
        PID:14352
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        734⤵
        System Location Discovery: System Language Discovery
        
        PID:14368
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        735⤵
        
        PID:14384
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        736⤵
        
        PID:14396
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        737⤵
        
        PID:14408
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        738⤵
        
        PID:14420
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        739⤵
        
        PID:14436
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        740⤵
        
        PID:14452
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        741⤵
        
        PID:14464
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        742⤵
        
        PID:14476
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        743⤵
        
        PID:14492
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        744⤵
        
        PID:14504
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        745⤵
        
        PID:14520
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        746⤵
        
        PID:14548
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        747⤵
        
        PID:14568
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        748⤵
        
        PID:14592
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        749⤵
        
        PID:14608
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        750⤵
        
        PID:14624
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        751⤵
        
        PID:14664
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        752⤵
        
        PID:14716
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        753⤵
        
        PID:14768
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        754⤵
        
        PID:14796
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        755⤵
        
        PID:14816
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        756⤵
        
        PID:14836
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        757⤵
        
        PID:14856
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        758⤵
        
        PID:14876
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        759⤵
        
        PID:14896
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        760⤵
        
        PID:14936
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        761⤵
        
        PID:14956
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        762⤵
        System Location Discovery: System Language Discovery
        
        PID:14972
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        763⤵
        
        PID:14988
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        764⤵
        
        PID:15004
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        765⤵
        
        PID:15020
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        766⤵
        
        PID:15036
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        767⤵
        
        PID:15056
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        768⤵
        
        PID:15072
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        769⤵
        System Location Discovery: System Language Discovery
        
        PID:15088
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        770⤵
        
        PID:15104
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        771⤵
        
        PID:15124
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        772⤵
        
        PID:15148
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        773⤵
        
        PID:15164
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        774⤵
        
        PID:15180
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        775⤵
        
        PID:15200
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        776⤵
        
        PID:15216
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        777⤵
        System Location Discovery: System Language Discovery
        
        PID:15232
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        778⤵
        
        PID:15256
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        779⤵
        
        PID:15268
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        780⤵
        
        PID:15284
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        781⤵
        
        PID:15300
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        782⤵
        
        PID:15320
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        783⤵
        
        PID:15336
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        784⤵
        
        PID:15352
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        785⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        786⤵
        System Location Discovery: System Language Discovery
        
        PID:2536
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        787⤵
        System Location Discovery: System Language Discovery
        
        PID:14932
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        788⤵
        
        PID:14916
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        789⤵
        
        PID:14904
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        790⤵
        
        PID:14708
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        791⤵
        
        PID:15372
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        792⤵
        
        PID:15388
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        793⤵
        
        PID:15404
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        794⤵
        
        PID:15416
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        795⤵
        
        PID:15432
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        796⤵
        
        PID:15444
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        797⤵
        
        PID:15456
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        798⤵
        
        PID:15472
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        799⤵
        
        PID:15496
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        800⤵
        
        PID:15508
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        801⤵
        
        PID:15524
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        802⤵
        System Location Discovery: System Language Discovery
        
        PID:15544
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        803⤵
        
        PID:15556
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        804⤵
        
        PID:15572
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        805⤵
        
        PID:15588
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        806⤵
        
        PID:15604
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        807⤵
        
        PID:15620
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        808⤵
        
        PID:15644
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        809⤵
        
        PID:15656
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        810⤵
        System Location Discovery: System Language Discovery
        
        PID:15680
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        811⤵
        System Location Discovery: System Language Discovery
        
        PID:15700
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        812⤵
        
        PID:15712
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        813⤵
        
        PID:15728
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        814⤵
        
        PID:15744
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        815⤵
        
        PID:15764
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        816⤵
        
        PID:15776
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        817⤵
        
        PID:15792
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        818⤵
        
        PID:15808
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        819⤵
        
        PID:15824
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        820⤵
        
        PID:15840
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        821⤵
        
        PID:15856
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        822⤵
        
        PID:15872
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        823⤵
        
        PID:15888
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        824⤵
        
        PID:15904
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        825⤵
        
        PID:15920
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        826⤵
        
        PID:15936
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        827⤵
        
        PID:15952
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        828⤵
        
        PID:15968
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        829⤵
        System Location Discovery: System Language Discovery
        
        PID:15988
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        830⤵
        
        PID:16000
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        831⤵
        System Location Discovery: System Language Discovery
        
        PID:16016
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        832⤵
        
        PID:16032
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        833⤵
        
        PID:16052
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        834⤵
        
        PID:16068
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        835⤵
        
        PID:16080
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        836⤵
        
        PID:16100
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        837⤵
        System Location Discovery: System Language Discovery
        
        PID:16112
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        838⤵
        
        PID:16128
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        839⤵
        
        PID:16144
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        840⤵
        System Location Discovery: System Language Discovery
        
        PID:16160
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        841⤵
        
        PID:16180
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        842⤵
        
        PID:16196
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        843⤵
        
        PID:16212
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        844⤵
        
        PID:16228
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        845⤵
        
        PID:16244
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        846⤵
        
        PID:16260
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        847⤵
        
        PID:16276
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        848⤵
        
        PID:16292
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        849⤵
        
        PID:16304
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        850⤵
        
        PID:16324
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        851⤵
        
        PID:16336
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        852⤵
        
        PID:16352
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        853⤵
        
        PID:16368
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        854⤵
        
        PID:4752
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        855⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        856⤵
        
        PID:824
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        857⤵
        
        PID:2216
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        858⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\rundll32.exe
        
        c:\windows\system32\rundll32.exe "c:\Program Files\ygzcv\jcxjzwho.dll",method C:\Users\Admin\AppData\Local\Temp\cccqj.exe
        859⤵
        
        PID:772

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jcxjzwho.dll

Path C:\Program Files\ygzcv\jcxjzwho.dll
Size 245KB
SHA256 9f218fccd55f444df83291ba8b37f278b631ae7129fe420a3b876ffbe00f5658
MD5 0251578c4cc911286397dddc8022d0a4
SHA1 b3a6164ae1bd36237d67a7aedddf54f18cceaf2a
SHA512 25475398618ca56d638ec46dda6f65d5a85e6a412513123980ed2e9cc10c369ea2c7516b754df40b6d087eab4f5c3ede2b4c5f2d9ded13451db04c82c0333b57
SSDEEP 384:rn2rVfoSKWXD3rzp+4+lMcR3li5yh6jcQwLfMduhMFL+OrALqPyo8lJ:rnHSLzrzEXlMcR1sDwLEdJFL+OULiy1J
TLSH
T13D34C023C725938BDAAA08340F2569FDA609B374D0CF86879DC466B9C24119D2DF2ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cccqj.exe

Path C:\Users\Admin\AppData\Local\Temp\cccqj.exe
Size 383KB
SHA256 4a9c8f98a8328aff8f1bc6d534dc5583958694e4b77f24be56a753362d17e4d7
MD5 6bc9ab133d289780707af2efcacb7bb5
SHA1 42a43a01781bb6e5a488f1029f58e1ef5780ba81
SHA512 1dbde17678070c6f5767db74a308d818330310eab4dbd238555052511ac4a636c6a90dedfcad3b056ec86ef3ce88faa8eb6d2affeb6e7583ab468c524cbca241
SSDEEP 1536:oQNjg6Z7PRwcxjXUZwDRSZySRWIMTLmtt3ZOPGOrT9wuGY2Dz6Y6VH2pIlheMzjX:bVg8SC7FDRzTKttpnWT9wuGY2Hc2pe
TLSH
T1BB846D2275D088E6D5C77573DEA6B630D3E9C6AC5D32EA7F43E8138D1B36D00930A265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/116-82-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/448-101-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/784-20-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/784-141-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/820-130-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/924-59-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/1016-151-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/1016-36-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/1128-146-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/1128-28-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/1184-75-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/1200-38-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/1200-152-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/1204-105-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/1344-119-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/1352-90-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/1408-97-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/1504-163-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/1504-55-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/1552-123-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/1572-158-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/1572-47-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/1640-124-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/1732-162-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/1732-53-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/1768-108-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/1812-0-0x0000000000400000-0x0000000000461000-memory.dmp

Download

memory/1812-3-0x0000000000400000-0x0000000000461000-memory.dmp

Download

memory/1812-1-0x0000000000400000-0x0000000000461000-memory.dmp

Download

memory/1840-150-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/1908-73-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/2024-117-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/2088-86-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/2092-139-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/2092-18-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/2120-84-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/2188-32-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/2188-148-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/2196-80-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/2260-120-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/2264-125-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/2272-145-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/2288-140-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/2436-147-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/2436-30-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/2468-144-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/2468-26-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/2508-121-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/2564-57-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/2564-164-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/2744-160-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/2756-9-0x0000000000400000-0x0000000000461000-memory.dmp

Download

memory/2960-62-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/3028-142-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/3028-22-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/3084-113-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/3088-133-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/3100-78-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/3152-12-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/3152-136-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/3196-111-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/3216-149-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/3216-34-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/3244-156-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/3244-44-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/3384-135-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/3396-131-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/3404-68-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/3488-154-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/3488-42-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/3720-138-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/3720-16-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/3728-88-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4028-49-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4028-159-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4084-161-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4488-127-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4500-99-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4552-155-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4612-129-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4664-95-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4704-93-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4792-64-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4804-66-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4808-70-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4820-126-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4864-24-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4864-143-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4892-157-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4912-40-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4912-153-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4948-137-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4948-14-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/5032-122-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/5060-128-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/5092-132-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/5104-134-0x0000000010000000-0x0000000010061000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads