d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

Analysis

max time kernel
222s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de.exe
Size

14KB
MD5

0f7b83a7b401200766afbb5e93125bf0
SHA1

75ddbbf60d53e38c982fc5011ed5226d9e536f3b
SHA256

d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de
SHA512

779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9
SSDEEP

192:6vAURbI/LGnYaku/oNw/GeKWgJukkoeNqtwglmNyTQS+TmN97TJa:6De/LGnfkqoNHWg4kkItwydk4d9a

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1380	nwizAsktao.exe
548	nwizAsktao.exe
1080	nwizAsktao.exe
1888	nwizAsktao.exe
1544	nwizAsktao.exe
1408	nwizAsktao.exe
816	nwizAsktao.exe
112	nwizAsktao.exe
1208	nwizAsktao.exe
1592	nwizAsktao.exe
848	nwizAsktao.exe
1112	nwizAsktao.exe
852	nwizAsktao.exe
1404	nwizAsktao.exe
1264	nwizAsktao.exe
1496	nwizAsktao.exe
1520	nwizAsktao.exe
2016	nwizAsktao.exe
1508	nwizAsktao.exe
664	nwizAsktao.exe
1868	nwizAsktao.exe
188	nwizAsktao.exe
848	nwizAsktao.exe
1096	nwizAsktao.exe
1364	nwizAsktao.exe
1312	nwizAsktao.exe
1804	nwizAsktao.exe
588	nwizAsktao.exe
1544	nwizAsktao.exe
552	nwizAsktao.exe
1636	nwizAsktao.exe
1620	nwizAsktao.exe
1568	nwizAsktao.exe
764	nwizAsktao.exe
664	nwizAsktao.exe
1908	nwizAsktao.exe
1792	nwizAsktao.exe
532	nwizAsktao.exe
548	nwizAsktao.exe
1096	nwizAsktao.exe
1748	nwizAsktao.exe
616	nwizAsktao.exe
1528	nwizAsktao.exe
1212	nwizAsktao.exe
1496	nwizAsktao.exe
1088	nwizAsktao.exe
552	nwizAsktao.exe
1608	nwizAsktao.exe
1620	nwizAsktao.exe
268	nwizAsktao.exe
1768	nwizAsktao.exe
664	nwizAsktao.exe
1908	nwizAsktao.exe
1792	nwizAsktao.exe
532	nwizAsktao.exe
548	nwizAsktao.exe
1096	nwizAsktao.exe
1364	nwizAsktao.exe
964	nwizAsktao.exe
1260	nwizAsktao.exe
1684	nwizAsktao.exe
960	nwizAsktao.exe
1732	nwizAsktao.exe
1360	nwizAsktao.exe

Deletes itself 1 IoCs

pid	Process
1472	cmd.exe

Loads dropped DLL 64 IoCs

pid	Process
756	d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de.exe
756	d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de.exe
1380	nwizAsktao.exe
1380	nwizAsktao.exe
548	nwizAsktao.exe
548	nwizAsktao.exe
1080	nwizAsktao.exe
1080	nwizAsktao.exe
1888	nwizAsktao.exe
1888	nwizAsktao.exe
1544	nwizAsktao.exe
1544	nwizAsktao.exe
1408	nwizAsktao.exe
1408	nwizAsktao.exe
816	nwizAsktao.exe
816	nwizAsktao.exe
112	nwizAsktao.exe
112	nwizAsktao.exe
1208	nwizAsktao.exe
1208	nwizAsktao.exe
1592	nwizAsktao.exe
1592	nwizAsktao.exe
848	nwizAsktao.exe
848	nwizAsktao.exe
1112	nwizAsktao.exe
1112	nwizAsktao.exe
852	nwizAsktao.exe
852	nwizAsktao.exe
1404	nwizAsktao.exe
1404	nwizAsktao.exe
1264	nwizAsktao.exe
1264	nwizAsktao.exe
1496	nwizAsktao.exe
1496	nwizAsktao.exe
1520	nwizAsktao.exe
1520	nwizAsktao.exe
2016	nwizAsktao.exe
2016	nwizAsktao.exe
1508	nwizAsktao.exe
1508	nwizAsktao.exe
664	nwizAsktao.exe
664	nwizAsktao.exe
1868	nwizAsktao.exe
1868	nwizAsktao.exe
188	nwizAsktao.exe
188	nwizAsktao.exe
848	nwizAsktao.exe
848	nwizAsktao.exe
1096	nwizAsktao.exe
1096	nwizAsktao.exe
1364	nwizAsktao.exe
1364	nwizAsktao.exe
1312	nwizAsktao.exe
1312	nwizAsktao.exe
1804	nwizAsktao.exe
1804	nwizAsktao.exe
588	nwizAsktao.exe
588	nwizAsktao.exe
1544	nwizAsktao.exe
1544	nwizAsktao.exe
552	nwizAsktao.exe
552	nwizAsktao.exe
1636	nwizAsktao.exe
1636	nwizAsktao.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe
File created	C:\Windows\SysWOW64\nwizAsktao.exe	nwizAsktao.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
756	d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de.exe
756	d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de.exe
756	d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de.exe
756	d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de.exe
1380	nwizAsktao.exe
1380	nwizAsktao.exe
1380	nwizAsktao.exe
1380	nwizAsktao.exe
548	nwizAsktao.exe
548	nwizAsktao.exe
548	nwizAsktao.exe
548	nwizAsktao.exe
1080	nwizAsktao.exe
1080	nwizAsktao.exe
1080	nwizAsktao.exe
1080	nwizAsktao.exe
1888	nwizAsktao.exe
1888	nwizAsktao.exe
1888	nwizAsktao.exe
1888	nwizAsktao.exe
1544	nwizAsktao.exe
1544	nwizAsktao.exe
1544	nwizAsktao.exe
1544	nwizAsktao.exe
1408	nwizAsktao.exe
1408	nwizAsktao.exe
1408	nwizAsktao.exe
1408	nwizAsktao.exe
816	nwizAsktao.exe
816	nwizAsktao.exe
816	nwizAsktao.exe
816	nwizAsktao.exe
112	nwizAsktao.exe
112	nwizAsktao.exe
112	nwizAsktao.exe
112	nwizAsktao.exe
1208	nwizAsktao.exe
1208	nwizAsktao.exe
1208	nwizAsktao.exe
1208	nwizAsktao.exe
1592	nwizAsktao.exe
1592	nwizAsktao.exe
1592	nwizAsktao.exe
1592	nwizAsktao.exe
848	nwizAsktao.exe
848	nwizAsktao.exe
848	nwizAsktao.exe
848	nwizAsktao.exe
1112	nwizAsktao.exe
1112	nwizAsktao.exe
1112	nwizAsktao.exe
1112	nwizAsktao.exe
852	nwizAsktao.exe
852	nwizAsktao.exe
852	nwizAsktao.exe
852	nwizAsktao.exe
1404	nwizAsktao.exe
1404	nwizAsktao.exe
1404	nwizAsktao.exe
1404	nwizAsktao.exe
1264	nwizAsktao.exe
1264	nwizAsktao.exe
1264	nwizAsktao.exe
1264	nwizAsktao.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 1380	756	d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de.exe	28
PID 756 wrote to memory of 1380	756	d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de.exe	28
PID 756 wrote to memory of 1380	756	d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de.exe	28
PID 756 wrote to memory of 1380	756	d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de.exe	28
PID 756 wrote to memory of 1472	756	d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de.exe	29
PID 756 wrote to memory of 1472	756	d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de.exe	29
PID 756 wrote to memory of 1472	756	d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de.exe	29
PID 756 wrote to memory of 1472	756	d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de.exe	29
PID 1380 wrote to memory of 548	1380	nwizAsktao.exe	31
PID 1380 wrote to memory of 548	1380	nwizAsktao.exe	31
PID 1380 wrote to memory of 548	1380	nwizAsktao.exe	31
PID 1380 wrote to memory of 548	1380	nwizAsktao.exe	31
PID 1380 wrote to memory of 536	1380	nwizAsktao.exe	32
PID 1380 wrote to memory of 536	1380	nwizAsktao.exe	32
PID 1380 wrote to memory of 536	1380	nwizAsktao.exe	32
PID 1380 wrote to memory of 536	1380	nwizAsktao.exe	32
PID 548 wrote to memory of 1080	548	nwizAsktao.exe	34
PID 548 wrote to memory of 1080	548	nwizAsktao.exe	34
PID 548 wrote to memory of 1080	548	nwizAsktao.exe	34
PID 548 wrote to memory of 1080	548	nwizAsktao.exe	34
PID 548 wrote to memory of 912	548	nwizAsktao.exe	35
PID 548 wrote to memory of 912	548	nwizAsktao.exe	35
PID 548 wrote to memory of 912	548	nwizAsktao.exe	35
PID 548 wrote to memory of 912	548	nwizAsktao.exe	35
PID 1080 wrote to memory of 1888	1080	nwizAsktao.exe	37
PID 1080 wrote to memory of 1888	1080	nwizAsktao.exe	37
PID 1080 wrote to memory of 1888	1080	nwizAsktao.exe	37
PID 1080 wrote to memory of 1888	1080	nwizAsktao.exe	37
PID 1080 wrote to memory of 1432	1080	nwizAsktao.exe	39
PID 1080 wrote to memory of 1432	1080	nwizAsktao.exe	39
PID 1080 wrote to memory of 1432	1080	nwizAsktao.exe	39
PID 1080 wrote to memory of 1432	1080	nwizAsktao.exe	39
PID 1888 wrote to memory of 1544	1888	nwizAsktao.exe	40
PID 1888 wrote to memory of 1544	1888	nwizAsktao.exe	40
PID 1888 wrote to memory of 1544	1888	nwizAsktao.exe	40
PID 1888 wrote to memory of 1544	1888	nwizAsktao.exe	40
PID 1888 wrote to memory of 812	1888	nwizAsktao.exe	41
PID 1888 wrote to memory of 812	1888	nwizAsktao.exe	41
PID 1888 wrote to memory of 812	1888	nwizAsktao.exe	41
PID 1888 wrote to memory of 812	1888	nwizAsktao.exe	41
PID 1544 wrote to memory of 1408	1544	nwizAsktao.exe	43
PID 1544 wrote to memory of 1408	1544	nwizAsktao.exe	43
PID 1544 wrote to memory of 1408	1544	nwizAsktao.exe	43
PID 1544 wrote to memory of 1408	1544	nwizAsktao.exe	43
PID 1544 wrote to memory of 1520	1544	nwizAsktao.exe	44
PID 1544 wrote to memory of 1520	1544	nwizAsktao.exe	44
PID 1544 wrote to memory of 1520	1544	nwizAsktao.exe	44
PID 1544 wrote to memory of 1520	1544	nwizAsktao.exe	44
PID 1408 wrote to memory of 816	1408	nwizAsktao.exe	46
PID 1408 wrote to memory of 816	1408	nwizAsktao.exe	46
PID 1408 wrote to memory of 816	1408	nwizAsktao.exe	46
PID 1408 wrote to memory of 816	1408	nwizAsktao.exe	46
PID 1408 wrote to memory of 2016	1408	nwizAsktao.exe	47
PID 1408 wrote to memory of 2016	1408	nwizAsktao.exe	47
PID 1408 wrote to memory of 2016	1408	nwizAsktao.exe	47
PID 1408 wrote to memory of 2016	1408	nwizAsktao.exe	47
PID 816 wrote to memory of 112	816	nwizAsktao.exe	49
PID 816 wrote to memory of 112	816	nwizAsktao.exe	49
PID 816 wrote to memory of 112	816	nwizAsktao.exe	49
PID 816 wrote to memory of 112	816	nwizAsktao.exe	49
PID 816 wrote to memory of 1440	816	nwizAsktao.exe	50
PID 816 wrote to memory of 1440	816	nwizAsktao.exe	50
PID 816 wrote to memory of 1440	816	nwizAsktao.exe	50
PID 816 wrote to memory of 1440	816	nwizAsktao.exe	50

C:\Users\Admin\AppData\Local\Temp\d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de.exe
"C:\Users\Admin\AppData\Local\Temp\d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\SysWOW64\nwizAsktao.exe
  C:\Windows\system32\nwizAsktao.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Windows\SysWOW64\nwizAsktao.exe
    C:\Windows\system32\nwizAsktao.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:548
  - - C:\Windows\SysWOW64\nwizAsktao.exe
      C:\Windows\system32\nwizAsktao.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1080
    - - C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1888
      - C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1544
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1408
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:816
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:112
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1208
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1592
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:848
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1112
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:852
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1404
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        16⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1264
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        17⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1496
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        18⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1520
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        19⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2016
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        20⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1508
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        21⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:664
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        22⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1868
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        23⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:188
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        24⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:848
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        25⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1096
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        26⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1364
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        27⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1312
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        28⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1804
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        29⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:588
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        30⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1544
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        31⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:552
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        32⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1636
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        33⤵
        Executes dropped EXE
        
        PID:1620
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1568
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:764
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:664
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        37⤵
        Executes dropped EXE
        
        PID:1908
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        38⤵
        Executes dropped EXE
        
        PID:1792
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:532
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:548
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1096
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        42⤵
        Executes dropped EXE
        
        PID:1748
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:616
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1528
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        45⤵
        Executes dropped EXE
        
        PID:1212
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1496
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        47⤵
        Executes dropped EXE
        
        PID:1088
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:552
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1608
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1620
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:268
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1768
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        53⤵
        Executes dropped EXE
        
        PID:664
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1908
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        55⤵
        Executes dropped EXE
        
        PID:1792
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:532
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:548
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1096
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1364
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        60⤵
        Executes dropped EXE
        
        PID:964
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1260
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1684
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:960
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        64⤵
        Executes dropped EXE
        
        PID:1732
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1360
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        66⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        67⤵
        Drops file in System32 directory
        
        PID:1600
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        68⤵
        Drops file in System32 directory
        
        PID:1168
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        69⤵
        Drops file in System32 directory
        
        PID:1564
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        70⤵
        Drops file in System32 directory
        
        PID:1380
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        71⤵
        Drops file in System32 directory
        
        PID:672
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        72⤵
        Drops file in System32 directory
        
        PID:928
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        73⤵
        Drops file in System32 directory
        
        PID:296
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        74⤵
        
        PID:364
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        75⤵
        
        PID:1404
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        76⤵
        Drops file in System32 directory
        
        PID:1760
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        77⤵
        Drops file in System32 directory
        
        PID:1524
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        78⤵
        Drops file in System32 directory
        
        PID:1356
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        79⤵
        Drops file in System32 directory
        
        PID:1700
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        80⤵
        Drops file in System32 directory
        
        PID:1716
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        81⤵
        Drops file in System32 directory
        
        PID:608
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        82⤵
        Drops file in System32 directory
        
        PID:1636
        
        C:\Windows\SysWOW64\nwizAsktao.exe
        
        C:\Windows\system32\nwizAsktao.exe
        83⤵
        
        PID:1608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        83⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        82⤵
        
        PID:112
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        81⤵
        
        PID:344
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        80⤵
        
        PID:1740
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        79⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        78⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        77⤵
        
        PID:1204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        76⤵
        
        PID:1996
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        75⤵
        
        PID:1144
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        74⤵
        
        PID:1296
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        73⤵
        
        PID:1824
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        72⤵
        
        PID:912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        71⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        70⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        69⤵
        
        PID:560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        68⤵
        
        PID:1872
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        67⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        66⤵
        
        PID:1552
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        65⤵
        
        PID:1944
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        64⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        63⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        62⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        61⤵
        
        PID:892
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        60⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        59⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        58⤵
        
        PID:736
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        57⤵
        
        PID:852
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        56⤵
        
        PID:1192
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        55⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        54⤵
        
        PID:568
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        53⤵
        
        PID:1104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        52⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        51⤵
        
        PID:1872
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        50⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        49⤵
        
        PID:1636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        48⤵
        
        PID:608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        47⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        46⤵
        
        PID:1232
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        45⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        44⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        43⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        42⤵
        
        PID:1052
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        41⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        40⤵
        
        PID:732
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        39⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        38⤵
        
        PID:672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        37⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        36⤵
        
        PID:992
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        35⤵
        
        PID:1168
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        34⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        33⤵
        
        PID:112
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        32⤵
        
        PID:1900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        31⤵
        
        PID:1408
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        30⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        29⤵
        
        PID:1300
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        28⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        27⤵
        
        PID:1144
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        26⤵
        
        PID:364
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        25⤵
        
        PID:732
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        24⤵
        
        PID:532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        23⤵
        
        PID:1472
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        22⤵
        
        PID:1768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        21⤵
        
        PID:764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        20⤵
        
        PID:956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        19⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        18⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        17⤵
        
        PID:1448
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        16⤵
        
        PID:964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        15⤵
        
        PID:1332
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        14⤵
        
        PID:548
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        13⤵
        
        PID:368
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        12⤵
        
        PID:1472
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        11⤵
        
        PID:268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        10⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        9⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        8⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        7⤵
        
        PID:1520
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        6⤵
        
        PID:812
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
        5⤵
        
        PID:1432
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
      4⤵
      PID:912
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizAsktao.exe"
    3⤵
    PID:536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de.exe"
  2⤵
  - Deletes itself
  PID:1472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
C:\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
C:\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
C:\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
C:\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
C:\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
C:\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
C:\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
C:\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
C:\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
C:\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
C:\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
C:\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
C:\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
C:\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
C:\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
C:\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
C:\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
C:\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
C:\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
C:\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
C:\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
\Windows\SysWOW64\nwizAsktao.exe

Filesize
14KB

MD5
0f7b83a7b401200766afbb5e93125bf0

SHA1
75ddbbf60d53e38c982fc5011ed5226d9e536f3b

SHA256
d0ad1e00bf6b19928ac123a12a3991922b7145a2c1f0ebbbc41b70a85a3281de

SHA512
779fcafd52ffae161aef9ceaa3b054a03ed77a1c65f0f34a74f940c5d4c486a0d0f16f67efd070a6da50a675383602dbac00468aab8f3d1594be60af5c728bc9

Download Submit
memory/548-71-0x00000000003A0000-0x00000000003A5000-memory.dmp

Filesize
20KB

Download
memory/548-73-0x00000000003A0000-0x00000000003A5000-memory.dmp

Filesize
20KB

Download
memory/756-61-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/756-54-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/756-56-0x0000000000270000-0x0000000000275000-memory.dmp

Filesize
20KB

Download
memory/1080-80-0x00000000001F0000-0x00000000001F5000-memory.dmp

Filesize
20KB

Download
memory/1080-79-0x00000000001F0000-0x00000000001F5000-memory.dmp

Filesize
20KB

Download
memory/1096-189-0x00000000001F0000-0x00000000001F5000-memory.dmp

Filesize
20KB

Download
memory/1096-190-0x00000000001F0000-0x00000000001F5000-memory.dmp

Filesize
20KB

Download
memory/1096-191-0x00000000001F0000-0x00000000001F5000-memory.dmp

Filesize
20KB

Download