0d2d204031aa9e118b257fe70f8b21d7980a0719c61320d09842fb7d93d3971a

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 19:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d17854d76b345441b9d70bd5cec9d04f_JC.exe
Size

485KB
MD5

d17854d76b345441b9d70bd5cec9d04f
SHA1

10b32d61f1bc4e6bbc7db42da2bc8cae101bfcbc
SHA256

0d2d204031aa9e118b257fe70f8b21d7980a0719c61320d09842fb7d93d3971a
SHA512

6e487ea802e2208d1ceef28e6762864b3ec08c9557052c249ba7457f2cb51824476431fc994b482706fb2aea3df31181330747fc9d31dddcb2ebdd34333ab096
SSDEEP

12288:El6SZhXFepTlvnpWROIW+PLE1t4Tg5hvXmYe0/oX9ady5KBqw:ElhhiTlvnpWROIW+PLE1t4Tg5hvXmYeo

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 41 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wjytkrr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wwguj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wtnvqnyk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wpvv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wwfql.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wwwj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wbfh.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wmeospf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wkuinyl.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wqoe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wxetfxn.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wldgxd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wxhsk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	weuu.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wefqx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wmhvkybk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wkwe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wthtirk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wayna.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wgxwrhg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wcjxoh.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	d17854d76b345441b9d70bd5cec9d04f_JC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wjtcudeg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wsemls.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wjmy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wrtxcpet.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	warisqv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wjqnbyv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wiir.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wibc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	whqdgkt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wotepelq.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wlnouvttt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wofxrqi.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wvwst.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wusfofd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wyytjo.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wopftta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wybvyhk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wcvdg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	wdonnuwn.exe

Executes dropped EXE 41 IoCs

pid	Process
3064	wrtxcpet.exe
2288	whqdgkt.exe
2920	warisqv.exe
2268	wybvyhk.exe
2748	wjqnbyv.exe
3700	wotepelq.exe
772	wxetfxn.exe
936	wvwst.exe
5004	wldgxd.exe
4760	wtnvqnyk.exe
4172	wcvdg.exe
4976	wusfofd.exe
4476	wdonnuwn.exe
3632	wxhsk.exe
2340	wjtcudeg.exe
1088	weuu.exe
1000	wwwj.exe
3148	wefqx.exe
5040	wopftta.exe
1388	wyytjo.exe
3064	wbfh.exe
3756	wpvv.exe
2448	wmhvkybk.exe
4152	wmeospf.exe
244	wwfql.exe
1088	wlnouvttt.exe
3596	wofxrqi.exe
2844	wkuinyl.exe
5116	wsemls.exe
1664	wkwe.exe
1244	wthtirk.exe
3220	wiir.exe
4688	wibc.exe
3912	wjmy.exe
4432	wayna.exe
4628	wgxwrhg.exe
1532	wjytkrr.exe
3352	wwguj.exe
316	wcjxoh.exe
4756	wqoe.exe
3940	wylac.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wvwst.exe	wxetfxn.exe
File created	C:\Windows\SysWOW64\wldgxd.exe	wvwst.exe
File opened for modification	C:\Windows\SysWOW64\wtnvqnyk.exe	wldgxd.exe
File created	C:\Windows\SysWOW64\wkwe.exe	wsemls.exe
File opened for modification	C:\Windows\SysWOW64\wkwe.exe	wsemls.exe
File opened for modification	C:\Windows\SysWOW64\wjytkrr.exe	wgxwrhg.exe
File opened for modification	C:\Windows\SysWOW64\wylac.exe	wqoe.exe
File created	C:\Windows\SysWOW64\warisqv.exe	whqdgkt.exe
File opened for modification	C:\Windows\SysWOW64\wldgxd.exe	wvwst.exe
File opened for modification	C:\Windows\SysWOW64\wjtcudeg.exe	wxhsk.exe
File created	C:\Windows\SysWOW64\wofxrqi.exe	wlnouvttt.exe
File created	C:\Windows\SysWOW64\wqoe.exe	wcjxoh.exe
File created	C:\Windows\SysWOW64\wrtxcpet.exe	d17854d76b345441b9d70bd5cec9d04f_JC.exe
File opened for modification	C:\Windows\SysWOW64\wrtxcpet.exe	d17854d76b345441b9d70bd5cec9d04f_JC.exe
File created	C:\Windows\SysWOW64\wwwj.exe	weuu.exe
File created	C:\Windows\SysWOW64\wyytjo.exe	wopftta.exe
File opened for modification	C:\Windows\SysWOW64\wmhvkybk.exe	wpvv.exe
File created	C:\Windows\SysWOW64\wibc.exe	wiir.exe
File created	C:\Windows\SysWOW64\wylac.exe	wqoe.exe
File created	C:\Windows\SysWOW64\wopftta.exe	wllogn.exe
File created	C:\Windows\SysWOW64\wwfql.exe	wmeospf.exe
File created	C:\Windows\SysWOW64\wayna.exe	wjmy.exe
File opened for modification	C:\Windows\SysWOW64\wotepelq.exe	wjqnbyv.exe
File created	C:\Windows\SysWOW64\wusfofd.exe	wcvdg.exe
File opened for modification	C:\Windows\SysWOW64\wdonnuwn.exe	wusfofd.exe
File opened for modification	C:\Windows\SysWOW64\weuu.exe	wjtcudeg.exe
File opened for modification	C:\Windows\SysWOW64\whqdgkt.exe	wrtxcpet.exe
File opened for modification	C:\Windows\SysWOW64\warisqv.exe	whqdgkt.exe
File created	C:\Windows\SysWOW64\wjqnbyv.exe	wybvyhk.exe
File opened for modification	C:\Windows\SysWOW64\wopftta.exe	wllogn.exe
File created	C:\Windows\SysWOW64\wmhvkybk.exe	wpvv.exe
File created	C:\Windows\SysWOW64\wkuinyl.exe	wofxrqi.exe
File opened for modification	C:\Windows\SysWOW64\wxhsk.exe	wdonnuwn.exe
File created	C:\Windows\SysWOW64\weuu.exe	wjtcudeg.exe
File opened for modification	C:\Windows\SysWOW64\wwguj.exe	wjytkrr.exe
File opened for modification	C:\Windows\SysWOW64\wcjxoh.exe	wwguj.exe
File created	C:\Windows\SysWOW64\wdonnuwn.exe	wusfofd.exe
File created	C:\Windows\SysWOW64\wlnouvttt.exe	wwfql.exe
File opened for modification	C:\Windows\SysWOW64\wkuinyl.exe	wofxrqi.exe
File created	C:\Windows\SysWOW64\wgxwrhg.exe	wayna.exe
File opened for modification	C:\Windows\SysWOW64\wqoe.exe	wcjxoh.exe
File created	C:\Windows\SysWOW64\wdpfq.exe	wylac.exe
File created	C:\Windows\SysWOW64\wvwst.exe	wxetfxn.exe
File created	C:\Windows\SysWOW64\wjtcudeg.exe	wxhsk.exe
File created	C:\Windows\SysWOW64\wefqx.exe	wwwj.exe
File opened for modification	C:\Windows\SysWOW64\wbfh.exe	wyytjo.exe
File opened for modification	C:\Windows\SysWOW64\wmeospf.exe	wmhvkybk.exe
File opened for modification	C:\Windows\SysWOW64\wibc.exe	wiir.exe
File opened for modification	C:\Windows\SysWOW64\wayna.exe	wjmy.exe
File created	C:\Windows\SysWOW64\wybvyhk.exe	warisqv.exe
File opened for modification	C:\Windows\SysWOW64\wcvdg.exe	wtnvqnyk.exe
File created	C:\Windows\SysWOW64\wxhsk.exe	wdonnuwn.exe
File opened for modification	C:\Windows\SysWOW64\wwwj.exe	weuu.exe
File opened for modification	C:\Windows\SysWOW64\wpvv.exe	wbfh.exe
File created	C:\Windows\SysWOW64\whqdgkt.exe	wrtxcpet.exe
File opened for modification	C:\Windows\SysWOW64\wjqnbyv.exe	wybvyhk.exe
File opened for modification	C:\Windows\SysWOW64\wefqx.exe	wwwj.exe
File opened for modification	C:\Windows\SysWOW64\wyytjo.exe	wopftta.exe
File created	C:\Windows\SysWOW64\wpvv.exe	wbfh.exe
File opened for modification	C:\Windows\SysWOW64\wofxrqi.exe	wlnouvttt.exe
File created	C:\Windows\SysWOW64\wjmy.exe	wibc.exe
File created	C:\Windows\SysWOW64\wotepelq.exe	wjqnbyv.exe
File opened for modification	C:\Windows\SysWOW64\wusfofd.exe	wcvdg.exe
File created	C:\Windows\SysWOW64\wmeospf.exe	wmhvkybk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 21 IoCs

pid	pid_target	Process	procid_target
1728	2920	WerFault.exe	99
436	2268	WerFault.exe	103
1252	2920	WerFault.exe	99
220	4976	WerFault.exe	137
3600	4476	WerFault.exe	140
2756	4476	WerFault.exe	140
2552	1088	WerFault.exe	156
3608	3064	WerFault.exe	176
2404	3756	WerFault.exe	179
1600	2448	WerFault.exe	184
3648	2448	WerFault.exe	184
716	2448	WerFault.exe	184
3224	2844	WerFault.exe	207
5004	2844	WerFault.exe	207
4876	1244	WerFault.exe	220
4624	3220	WerFault.exe	223
1776	4688	WerFault.exe	229
4784	4628	WerFault.exe	242
2460	1532	WerFault.exe	245
2552	316	WerFault.exe	255
4728	4756	WerFault.exe	258

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 3064	2412	d17854d76b345441b9d70bd5cec9d04f_JC.exe	86
PID 2412 wrote to memory of 3064	2412	d17854d76b345441b9d70bd5cec9d04f_JC.exe	86
PID 2412 wrote to memory of 3064	2412	d17854d76b345441b9d70bd5cec9d04f_JC.exe	86
PID 2412 wrote to memory of 2700	2412	d17854d76b345441b9d70bd5cec9d04f_JC.exe	90
PID 2412 wrote to memory of 2700	2412	d17854d76b345441b9d70bd5cec9d04f_JC.exe	90
PID 2412 wrote to memory of 2700	2412	d17854d76b345441b9d70bd5cec9d04f_JC.exe	90
PID 3064 wrote to memory of 2288	3064	wrtxcpet.exe	95
PID 3064 wrote to memory of 2288	3064	wrtxcpet.exe	95
PID 3064 wrote to memory of 2288	3064	wrtxcpet.exe	95
PID 3064 wrote to memory of 3328	3064	wrtxcpet.exe	96
PID 3064 wrote to memory of 3328	3064	wrtxcpet.exe	96
PID 3064 wrote to memory of 3328	3064	wrtxcpet.exe	96
PID 2288 wrote to memory of 2920	2288	whqdgkt.exe	99
PID 2288 wrote to memory of 2920	2288	whqdgkt.exe	99
PID 2288 wrote to memory of 2920	2288	whqdgkt.exe	99
PID 2288 wrote to memory of 1540	2288	whqdgkt.exe	100
PID 2288 wrote to memory of 1540	2288	whqdgkt.exe	100
PID 2288 wrote to memory of 1540	2288	whqdgkt.exe	100
PID 2920 wrote to memory of 2268	2920	warisqv.exe	103
PID 2920 wrote to memory of 2268	2920	warisqv.exe	103
PID 2920 wrote to memory of 2268	2920	warisqv.exe	103
PID 2920 wrote to memory of 2000	2920	warisqv.exe	105
PID 2920 wrote to memory of 2000	2920	warisqv.exe	105
PID 2920 wrote to memory of 2000	2920	warisqv.exe	105
PID 2268 wrote to memory of 2748	2268	wybvyhk.exe	110
PID 2268 wrote to memory of 2748	2268	wybvyhk.exe	110
PID 2268 wrote to memory of 2748	2268	wybvyhk.exe	110
PID 2268 wrote to memory of 2404	2268	wybvyhk.exe	111
PID 2268 wrote to memory of 2404	2268	wybvyhk.exe	111
PID 2268 wrote to memory of 2404	2268	wybvyhk.exe	111
PID 2748 wrote to memory of 3700	2748	wjqnbyv.exe	117
PID 2748 wrote to memory of 3700	2748	wjqnbyv.exe	117
PID 2748 wrote to memory of 3700	2748	wjqnbyv.exe	117
PID 2748 wrote to memory of 5088	2748	wjqnbyv.exe	118
PID 2748 wrote to memory of 5088	2748	wjqnbyv.exe	118
PID 2748 wrote to memory of 5088	2748	wjqnbyv.exe	118
PID 3700 wrote to memory of 772	3700	wotepelq.exe	121
PID 3700 wrote to memory of 772	3700	wotepelq.exe	121
PID 3700 wrote to memory of 772	3700	wotepelq.exe	121
PID 3700 wrote to memory of 2680	3700	wotepelq.exe	122
PID 3700 wrote to memory of 2680	3700	wotepelq.exe	122
PID 3700 wrote to memory of 2680	3700	wotepelq.exe	122
PID 772 wrote to memory of 936	772	wxetfxn.exe	125
PID 772 wrote to memory of 936	772	wxetfxn.exe	125
PID 772 wrote to memory of 936	772	wxetfxn.exe	125
PID 772 wrote to memory of 4696	772	wxetfxn.exe	126
PID 772 wrote to memory of 4696	772	wxetfxn.exe	126
PID 772 wrote to memory of 4696	772	wxetfxn.exe	126
PID 936 wrote to memory of 5004	936	wvwst.exe	128
PID 936 wrote to memory of 5004	936	wvwst.exe	128
PID 936 wrote to memory of 5004	936	wvwst.exe	128
PID 936 wrote to memory of 3352	936	wvwst.exe	129
PID 936 wrote to memory of 3352	936	wvwst.exe	129
PID 936 wrote to memory of 3352	936	wvwst.exe	129
PID 5004 wrote to memory of 4760	5004	wldgxd.exe	131
PID 5004 wrote to memory of 4760	5004	wldgxd.exe	131
PID 5004 wrote to memory of 4760	5004	wldgxd.exe	131
PID 5004 wrote to memory of 8	5004	wldgxd.exe	132
PID 5004 wrote to memory of 8	5004	wldgxd.exe	132
PID 5004 wrote to memory of 8	5004	wldgxd.exe	132
PID 4760 wrote to memory of 4172	4760	wtnvqnyk.exe	134
PID 4760 wrote to memory of 4172	4760	wtnvqnyk.exe	134
PID 4760 wrote to memory of 4172	4760	wtnvqnyk.exe	134
PID 4760 wrote to memory of 3036	4760	wtnvqnyk.exe	135

C:\Users\Admin\AppData\Local\Temp\d17854d76b345441b9d70bd5cec9d04f_JC.exe
"C:\Users\Admin\AppData\Local\Temp\d17854d76b345441b9d70bd5cec9d04f_JC.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\SysWOW64\wrtxcpet.exe
  "C:\Windows\system32\wrtxcpet.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Windows\SysWOW64\whqdgkt.exe
    "C:\Windows\system32\whqdgkt.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:2288
  - - C:\Windows\SysWOW64\warisqv.exe
      "C:\Windows\system32\warisqv.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2920
    - - C:\Windows\SysWOW64\wybvyhk.exe
        
        "C:\Windows\system32\wybvyhk.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2268
      - C:\Windows\SysWOW64\wjqnbyv.exe
        
        "C:\Windows\system32\wjqnbyv.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2748
        
        C:\Windows\SysWOW64\wotepelq.exe
        
        "C:\Windows\system32\wotepelq.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3700
        
        C:\Windows\SysWOW64\wxetfxn.exe
        
        "C:\Windows\system32\wxetfxn.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:772
        
        C:\Windows\SysWOW64\wvwst.exe
        
        "C:\Windows\system32\wvwst.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:936
        
        C:\Windows\SysWOW64\wldgxd.exe
        
        "C:\Windows\system32\wldgxd.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5004
        
        C:\Windows\SysWOW64\wtnvqnyk.exe
        
        "C:\Windows\system32\wtnvqnyk.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4760
        
        C:\Windows\SysWOW64\wcvdg.exe
        
        "C:\Windows\system32\wcvdg.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4172
        
        C:\Windows\SysWOW64\wusfofd.exe
        
        "C:\Windows\system32\wusfofd.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4976
        
        C:\Windows\SysWOW64\wdonnuwn.exe
        
        "C:\Windows\system32\wdonnuwn.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4476
        
        C:\Windows\SysWOW64\wxhsk.exe
        
        "C:\Windows\system32\wxhsk.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3632
        
        C:\Windows\SysWOW64\wjtcudeg.exe
        
        "C:\Windows\system32\wjtcudeg.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2340
        
        C:\Windows\SysWOW64\weuu.exe
        
        "C:\Windows\system32\weuu.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1088
        
        C:\Windows\SysWOW64\wwwj.exe
        
        "C:\Windows\system32\wwwj.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1000
        
        C:\Windows\SysWOW64\wefqx.exe
        
        "C:\Windows\system32\wefqx.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3148
        
        C:\Windows\SysWOW64\wllogn.exe
        
        "C:\Windows\system32\wllogn.exe"
        20⤵
        Drops file in System32 directory
        
        PID:1816
        
        C:\Windows\SysWOW64\wopftta.exe
        
        "C:\Windows\system32\wopftta.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5040
        
        C:\Windows\SysWOW64\wyytjo.exe
        
        "C:\Windows\system32\wyytjo.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1388
        
        C:\Windows\SysWOW64\wbfh.exe
        
        "C:\Windows\system32\wbfh.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3064
        
        C:\Windows\SysWOW64\wpvv.exe
        
        "C:\Windows\system32\wpvv.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3756
        
        C:\Windows\SysWOW64\wmhvkybk.exe
        
        "C:\Windows\system32\wmhvkybk.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2448
        
        C:\Windows\SysWOW64\wmeospf.exe
        
        "C:\Windows\system32\wmeospf.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4152
        
        C:\Windows\SysWOW64\wwfql.exe
        
        "C:\Windows\system32\wwfql.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:244
        
        C:\Windows\SysWOW64\wlnouvttt.exe
        
        "C:\Windows\system32\wlnouvttt.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1088
        
        C:\Windows\SysWOW64\wofxrqi.exe
        
        "C:\Windows\system32\wofxrqi.exe"
        29⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3596
        
        C:\Windows\SysWOW64\wkuinyl.exe
        
        "C:\Windows\system32\wkuinyl.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2844
        
        C:\Windows\SysWOW64\wsemls.exe
        
        "C:\Windows\system32\wsemls.exe"
        31⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5116
        
        C:\Windows\SysWOW64\wkwe.exe
        
        "C:\Windows\system32\wkwe.exe"
        32⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1664
        
        C:\Windows\SysWOW64\wthtirk.exe
        
        "C:\Windows\system32\wthtirk.exe"
        33⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1244
        
        C:\Windows\SysWOW64\wiir.exe
        
        "C:\Windows\system32\wiir.exe"
        34⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3220
        
        C:\Windows\SysWOW64\wibc.exe
        
        "C:\Windows\system32\wibc.exe"
        35⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4688
        
        C:\Windows\SysWOW64\wjmy.exe
        
        "C:\Windows\system32\wjmy.exe"
        36⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3912
        
        C:\Windows\SysWOW64\wayna.exe
        
        "C:\Windows\system32\wayna.exe"
        37⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4432
        
        C:\Windows\SysWOW64\wgxwrhg.exe
        
        "C:\Windows\system32\wgxwrhg.exe"
        38⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4628
        
        C:\Windows\SysWOW64\wjytkrr.exe
        
        "C:\Windows\system32\wjytkrr.exe"
        39⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1532
        
        C:\Windows\SysWOW64\wwguj.exe
        
        "C:\Windows\system32\wwguj.exe"
        40⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3352
        
        C:\Windows\SysWOW64\wcjxoh.exe
        
        "C:\Windows\system32\wcjxoh.exe"
        41⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:316
        
        C:\Windows\SysWOW64\wqoe.exe
        
        "C:\Windows\system32\wqoe.exe"
        42⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4756
        
        C:\Windows\SysWOW64\wylac.exe
        
        "C:\Windows\system32\wylac.exe"
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3940
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wqoe.exe"
        43⤵
        
        PID:1384
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 1584
        43⤵
        Program crash
        
        PID:4728
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wcjxoh.exe"
        42⤵
        
        PID:1252
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 316 -s 1676
        42⤵
        Program crash
        
        PID:2552
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wwguj.exe"
        41⤵
        
        PID:4760
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wjytkrr.exe"
        40⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 116
        40⤵
        Program crash
        
        PID:2460
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wgxwrhg.exe"
        39⤵
        
        PID:2888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 116
        39⤵
        Program crash
        
        PID:4784
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wayna.exe"
        38⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wjmy.exe"
        37⤵
        
        PID:2848
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wibc.exe"
        36⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1692
        36⤵
        Program crash
        
        PID:1776
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wiir.exe"
        35⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 1344
        35⤵
        Program crash
        
        PID:4624
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wthtirk.exe"
        34⤵
        
        PID:2664
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 1344
        34⤵
        Program crash
        
        PID:4876
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkwe.exe"
        33⤵
        
        PID:632
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wsemls.exe"
        32⤵
        
        PID:2660
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkuinyl.exe"
        31⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 116
        31⤵
        Program crash
        
        PID:3224
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 1344
        31⤵
        Program crash
        
        PID:5004
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wofxrqi.exe"
        30⤵
        
        PID:552
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wlnouvttt.exe"
        29⤵
        
        PID:4276
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wwfql.exe"
        28⤵
        
        PID:2516
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wmeospf.exe"
        27⤵
        
        PID:2864
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wmhvkybk.exe"
        26⤵
        
        PID:3132
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 116
        26⤵
        Program crash
        
        PID:1600
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 1520
        26⤵
        Program crash
        
        PID:3648
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 256
        26⤵
        Program crash
        
        PID:716
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wpvv.exe"
        25⤵
        
        PID:4020
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 1288
        25⤵
        Program crash
        
        PID:2404
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wbfh.exe"
        24⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 1540
        24⤵
        Program crash
        
        PID:3608
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wyytjo.exe"
        23⤵
        
        PID:3084
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wopftta.exe"
        22⤵
        
        PID:936
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wllogn.exe"
        21⤵
        
        PID:3648
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wefqx.exe"
        20⤵
        
        PID:644
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wwwj.exe"
        19⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\weuu.exe"
        18⤵
        
        PID:3396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 1368
        18⤵
        Program crash
        
        PID:2552
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wjtcudeg.exe"
        17⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wxhsk.exe"
        16⤵
        
        PID:1248
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wdonnuwn.exe"
        15⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 116
        15⤵
        Program crash
        
        PID:3600
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 1448
        15⤵
        Program crash
        
        PID:2756
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wusfofd.exe"
        14⤵
        
        PID:2320
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4976 -s 1708
        14⤵
        Program crash
        
        PID:220
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wcvdg.exe"
        13⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtnvqnyk.exe"
        12⤵
        
        PID:3036
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wldgxd.exe"
        11⤵
        
        PID:8
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wvwst.exe"
        10⤵
        
        PID:3352
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wxetfxn.exe"
        9⤵
        
        PID:4696
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wotepelq.exe"
        8⤵
        
        PID:2680
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wjqnbyv.exe"
        7⤵
        
        PID:5088
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wybvyhk.exe"
        6⤵
        
        PID:2404
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 1448
        6⤵
        Program crash
        
        PID:436
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\warisqv.exe"
        5⤵
        
        PID:2000
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 116
        5⤵
        Program crash
        
        PID:1728
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1668
        5⤵
        Program crash
        
        PID:1252
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\whqdgkt.exe"
      4⤵
      PID:1540
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wrtxcpet.exe"
    3⤵
    PID:3328
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\d17854d76b345441b9d70bd5cec9d04f_JC.exe"
  2⤵
  PID:2700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2920 -ip 2920
1⤵
PID:2352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2268 -ip 2268
1⤵
PID:4760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2920 -ip 2920
1⤵
PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4976 -ip 4976
1⤵
PID:212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4476 -ip 4476
1⤵
PID:3924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4476 -ip 4476
1⤵
PID:4004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4476 -ip 4476
1⤵
PID:3664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1088 -ip 1088
1⤵
PID:544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3064 -ip 3064
1⤵
PID:4996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3756 -ip 3756
1⤵
PID:216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2448 -ip 2448
1⤵
PID:436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2448 -ip 2448
1⤵
PID:3544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2448 -ip 2448
1⤵
PID:3924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2844 -ip 2844
1⤵
PID:3076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2844 -ip 2844
1⤵
PID:4312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1244 -ip 1244
1⤵
PID:400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1244 -ip 1244
1⤵
PID:2100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3220 -ip 3220
1⤵
PID:1000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4688 -ip 4688
1⤵
PID:4488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4628 -ip 4628
1⤵
PID:1388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1532 -ip 1532
1⤵
PID:4160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 316 -ip 316
1⤵
PID:3408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4756 -ip 4756
1⤵
PID:4140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\warisqv.exe

Filesize
485KB

MD5
2520bd0c6b8223879d242ff75311db88

SHA1
4a3377a074301f3e86e6de131a76f5a3cd5c4de9

SHA256
f773d4a5fd6deeeb63eebdf310ae2c3e4a65e42cb905cb98c3a0b9bdd7df21b4

SHA512
7980251c642e57ea3497592347264281f94143bac6598f732c059140b2a5b43472ed9156884d5789f80c4712057d7baa361d0ed68db63699eebbfd31192191b9

Download Submit
C:\Windows\SysWOW64\warisqv.exe

Filesize
485KB

MD5
2520bd0c6b8223879d242ff75311db88

SHA1
4a3377a074301f3e86e6de131a76f5a3cd5c4de9

SHA256
f773d4a5fd6deeeb63eebdf310ae2c3e4a65e42cb905cb98c3a0b9bdd7df21b4

SHA512
7980251c642e57ea3497592347264281f94143bac6598f732c059140b2a5b43472ed9156884d5789f80c4712057d7baa361d0ed68db63699eebbfd31192191b9

Download Submit
C:\Windows\SysWOW64\wbfh.exe

Filesize
485KB

MD5
c92f0c70f3d82eb7130fe303ac927495

SHA1
56a5f222cb0a61ed7721d91de801ab7f12a98c57

SHA256
56fc3f3a1bb6b333c4833b01d37b86bb7dcfed9ecebbd71c509f39ab04c4312f

SHA512
4a5c56e4eabc8a37579fa5896abe19a31af3757917ac543c348cbe70504dd3e763b4e4ab8eb43b9f00b7fef0b2aeec2918544c7ff9200b0764874a4f9d8c756d

Download Submit
C:\Windows\SysWOW64\wbfh.exe

Filesize
485KB

MD5
c92f0c70f3d82eb7130fe303ac927495

SHA1
56a5f222cb0a61ed7721d91de801ab7f12a98c57

SHA256
56fc3f3a1bb6b333c4833b01d37b86bb7dcfed9ecebbd71c509f39ab04c4312f

SHA512
4a5c56e4eabc8a37579fa5896abe19a31af3757917ac543c348cbe70504dd3e763b4e4ab8eb43b9f00b7fef0b2aeec2918544c7ff9200b0764874a4f9d8c756d

Download Submit
C:\Windows\SysWOW64\wcvdg.exe

Filesize
485KB

MD5
b64593630bd8f01701068ea0eaa49e43

SHA1
1223fbea85edc724e19744cd2b0f9cc1a8ef1dca

SHA256
a1bc50b5f08ff4d691ff9c7514085b8868c84cfbab4068701bec9b6bc21fac73

SHA512
ee6f53cdc94f785d806f456cb11f8ecfb72c97c72a8d4166d3c373234106634237406456bdb4ab386087b427b19647a7bd5181550955fa8ab8c9a369a7633901

Download Submit
C:\Windows\SysWOW64\wcvdg.exe

Filesize
485KB

MD5
b64593630bd8f01701068ea0eaa49e43

SHA1
1223fbea85edc724e19744cd2b0f9cc1a8ef1dca

SHA256
a1bc50b5f08ff4d691ff9c7514085b8868c84cfbab4068701bec9b6bc21fac73

SHA512
ee6f53cdc94f785d806f456cb11f8ecfb72c97c72a8d4166d3c373234106634237406456bdb4ab386087b427b19647a7bd5181550955fa8ab8c9a369a7633901

Download Submit
C:\Windows\SysWOW64\wdonnuwn.exe

Filesize
485KB

MD5
0f9b14ef66c20a3ac3a6e61685816a51

SHA1
f0a81fc616103d36355d2b49be9617ce5babd406

SHA256
14eec403713f43afc363e885b7ca2e125d8033224e4987cb77ba0c5e357f82e4

SHA512
759a26c769aa14aee37d3bb2e65da2852700457a6c050dc277fa3a77c7942634e51fb4853bda175d3d3beed3cbcfd5180af390ab1a74d2ea2fdcc4a033038765

Download Submit
C:\Windows\SysWOW64\wdonnuwn.exe

Filesize
485KB

MD5
0f9b14ef66c20a3ac3a6e61685816a51

SHA1
f0a81fc616103d36355d2b49be9617ce5babd406

SHA256
14eec403713f43afc363e885b7ca2e125d8033224e4987cb77ba0c5e357f82e4

SHA512
759a26c769aa14aee37d3bb2e65da2852700457a6c050dc277fa3a77c7942634e51fb4853bda175d3d3beed3cbcfd5180af390ab1a74d2ea2fdcc4a033038765

Download Submit
C:\Windows\SysWOW64\wefqx.exe

Filesize
485KB

MD5
bbb6056278ff7cde5ae2c718e7b6ad66

SHA1
73b508924e77dbc747b8613b23646b409e2a7fb4

SHA256
37d864897552a8dc93f1b15a8132114c4bf535f9b49f6c27cafb058c8b73b46f

SHA512
3cb571267aa70b2f4ee37555a4c14a1b2328b3e5ce6f35bdc35c5aa44d52488fc4357f31e520601c5aba10fb18acf5705ea05f08e8b44290aa4fea7d2fe6c69c

Download Submit
C:\Windows\SysWOW64\wefqx.exe

Filesize
485KB

MD5
bbb6056278ff7cde5ae2c718e7b6ad66

SHA1
73b508924e77dbc747b8613b23646b409e2a7fb4

SHA256
37d864897552a8dc93f1b15a8132114c4bf535f9b49f6c27cafb058c8b73b46f

SHA512
3cb571267aa70b2f4ee37555a4c14a1b2328b3e5ce6f35bdc35c5aa44d52488fc4357f31e520601c5aba10fb18acf5705ea05f08e8b44290aa4fea7d2fe6c69c

Download Submit
C:\Windows\SysWOW64\weuu.exe

Filesize
485KB

MD5
aa33b5905582d810fea1f51ea4b9e103

SHA1
8de54998029fce0ed1d58156f468d308ac6ff514

SHA256
fef09528f6dcc55e935201f36101f772135a130783d58eabde05973ff0de79f4

SHA512
72e744ce36a222f2347ef7b10a76a2f899e45d2504a440227d780b547336a067cea4f9d856d4ad427622339ec0973abd1375b73213f9441835524f85b12b07db

Download Submit
C:\Windows\SysWOW64\weuu.exe

Filesize
485KB

MD5
aa33b5905582d810fea1f51ea4b9e103

SHA1
8de54998029fce0ed1d58156f468d308ac6ff514

SHA256
fef09528f6dcc55e935201f36101f772135a130783d58eabde05973ff0de79f4

SHA512
72e744ce36a222f2347ef7b10a76a2f899e45d2504a440227d780b547336a067cea4f9d856d4ad427622339ec0973abd1375b73213f9441835524f85b12b07db

Download Submit
C:\Windows\SysWOW64\whqdgkt.exe

Filesize
485KB

MD5
a82485b2701c563cb1097f8270b13daf

SHA1
3e30339a0d0333fafd464ef40a1ac91e849c69e6

SHA256
66f2ae531839827714b31a2dd0dcd0f9c4494c83e24c0696e32640b1a78b8706

SHA512
60158a594d1fd21766d6794748dbab12bd448d27448248318c48326d049c0e5b88d4e0feb786133a8f4f17354e74b5263c86d530779ba4706a60ed8764ca0701

Download Submit
C:\Windows\SysWOW64\whqdgkt.exe

Filesize
485KB

MD5
a82485b2701c563cb1097f8270b13daf

SHA1
3e30339a0d0333fafd464ef40a1ac91e849c69e6

SHA256
66f2ae531839827714b31a2dd0dcd0f9c4494c83e24c0696e32640b1a78b8706

SHA512
60158a594d1fd21766d6794748dbab12bd448d27448248318c48326d049c0e5b88d4e0feb786133a8f4f17354e74b5263c86d530779ba4706a60ed8764ca0701

Download Submit
C:\Windows\SysWOW64\wiir.exe

Filesize
486KB

MD5
6806f8b323983bcf20b97724a66e56f2

SHA1
ec5291625310ea925b1e2af280f1466713f77f41

SHA256
69528f0457bb5c2c5562e7053bdeb39d645c4b3d59591f59d6a384ce365cc957

SHA512
a62823d601167fab4ff43a3e160c094515983ebba1fafb8637422648863362a048f3a982e7b63a769f09d8ea0896662501f3aa1fe11df5faa5b8f0e86e6f2f78

Download Submit
C:\Windows\SysWOW64\wiir.exe

Filesize
486KB

MD5
6806f8b323983bcf20b97724a66e56f2

SHA1
ec5291625310ea925b1e2af280f1466713f77f41

SHA256
69528f0457bb5c2c5562e7053bdeb39d645c4b3d59591f59d6a384ce365cc957

SHA512
a62823d601167fab4ff43a3e160c094515983ebba1fafb8637422648863362a048f3a982e7b63a769f09d8ea0896662501f3aa1fe11df5faa5b8f0e86e6f2f78

Download Submit
C:\Windows\SysWOW64\wjqnbyv.exe

Filesize
485KB

MD5
152f2b00d40b42c268a69f90dd455455

SHA1
48ac2243505faacff5821192ad5b510d2b2484f9

SHA256
dae8d28cce9ee21dc8dd71bb28f8c83ba3af222e04e46f8319da73f5ab0259db

SHA512
be552d2da4533a34f6a8fc943e0775e83a8ed0b0eeb2434d3a8cfcf28bca0548111b670fcc30603fb8c1c72eb158d13571259d1a3eb548fd1965ae2ede9b6756

Download Submit
C:\Windows\SysWOW64\wjqnbyv.exe

Filesize
485KB

MD5
152f2b00d40b42c268a69f90dd455455

SHA1
48ac2243505faacff5821192ad5b510d2b2484f9

SHA256
dae8d28cce9ee21dc8dd71bb28f8c83ba3af222e04e46f8319da73f5ab0259db

SHA512
be552d2da4533a34f6a8fc943e0775e83a8ed0b0eeb2434d3a8cfcf28bca0548111b670fcc30603fb8c1c72eb158d13571259d1a3eb548fd1965ae2ede9b6756

Download Submit
C:\Windows\SysWOW64\wjtcudeg.exe

Filesize
485KB

MD5
3c39663d89647b3b55b21508e7cd4488

SHA1
2fbabb955f58d3a1e97e3aecbf35219052f4e995

SHA256
f57fdf2b47034898701e0b35418ea00c3e93629943a59d41e8e6964056deb654

SHA512
5561fe43a12ba2a16a17b3ae5ad04bcf05e1497e20c472137622d5a0194d01446266d4fb4c020184d918a501ed3fa0b99354f5548dc5e06b1012d71e43b5908d

Download Submit
C:\Windows\SysWOW64\wjtcudeg.exe

Filesize
485KB

MD5
3c39663d89647b3b55b21508e7cd4488

SHA1
2fbabb955f58d3a1e97e3aecbf35219052f4e995

SHA256
f57fdf2b47034898701e0b35418ea00c3e93629943a59d41e8e6964056deb654

SHA512
5561fe43a12ba2a16a17b3ae5ad04bcf05e1497e20c472137622d5a0194d01446266d4fb4c020184d918a501ed3fa0b99354f5548dc5e06b1012d71e43b5908d

Download Submit
C:\Windows\SysWOW64\wkuinyl.exe

Filesize
485KB

MD5
9556408b2cfd88cf2aa38a4a06501e75

SHA1
656ca66335ce064651f83503e6aa1d6acf601ceb

SHA256
0277045f41b567badca3274e4fb12f44fd540849c84e987e17523f3c2a969eb3

SHA512
c8dcd9299562d1587800222a695ede1fb78a34ad6cc8429aeb8ab8bf7672618dfafcedf4466937bf6d9524a763b857e80881f1b31adc1e4beb0ec347822fd362

Download Submit
C:\Windows\SysWOW64\wkuinyl.exe

Filesize
485KB

MD5
9556408b2cfd88cf2aa38a4a06501e75

SHA1
656ca66335ce064651f83503e6aa1d6acf601ceb

SHA256
0277045f41b567badca3274e4fb12f44fd540849c84e987e17523f3c2a969eb3

SHA512
c8dcd9299562d1587800222a695ede1fb78a34ad6cc8429aeb8ab8bf7672618dfafcedf4466937bf6d9524a763b857e80881f1b31adc1e4beb0ec347822fd362

Download Submit
C:\Windows\SysWOW64\wkwe.exe

Filesize
486KB

MD5
52da6353690766fd0b1314939964eef1

SHA1
bcefd85840bc9e3abfa90c02fd43d65b8e7fc07d

SHA256
a3439d43bd9d25a29cc48a3f51b1dada1aa26a520b6cbb86bdca14a353e391fe

SHA512
90aa6d82c7e3e9d67c2349482348b8fc3e60eb6adf99a0704bb64743a4ed9e5bfd73437bd2357ad9d78d3469e1687f7286ebcfa49ef817eb58b79ef61cd49367

Download Submit
C:\Windows\SysWOW64\wkwe.exe

Filesize
486KB

MD5
52da6353690766fd0b1314939964eef1

SHA1
bcefd85840bc9e3abfa90c02fd43d65b8e7fc07d

SHA256
a3439d43bd9d25a29cc48a3f51b1dada1aa26a520b6cbb86bdca14a353e391fe

SHA512
90aa6d82c7e3e9d67c2349482348b8fc3e60eb6adf99a0704bb64743a4ed9e5bfd73437bd2357ad9d78d3469e1687f7286ebcfa49ef817eb58b79ef61cd49367

Download Submit
C:\Windows\SysWOW64\wldgxd.exe

Filesize
485KB

MD5
5c7d74e4461e24624ce2eed9dfb67c94

SHA1
3179fa9bf931ac43f23e15a854b48945cf32af86

SHA256
791a48fbd06e6874840045773525546f774f284928e368aec3953b008b0121ed

SHA512
2bc84ffba63f7693b198d34b2932536544458c0dea138c28ec5a65c0a4dc42d52af908e86771535ce177ee00eecd75d4cb73922806ace2555db072fb92a1dbb3

Download Submit
C:\Windows\SysWOW64\wldgxd.exe

Filesize
485KB

MD5
5c7d74e4461e24624ce2eed9dfb67c94

SHA1
3179fa9bf931ac43f23e15a854b48945cf32af86

SHA256
791a48fbd06e6874840045773525546f774f284928e368aec3953b008b0121ed

SHA512
2bc84ffba63f7693b198d34b2932536544458c0dea138c28ec5a65c0a4dc42d52af908e86771535ce177ee00eecd75d4cb73922806ace2555db072fb92a1dbb3

Download Submit
C:\Windows\SysWOW64\wlnouvttt.exe

Filesize
485KB

MD5
afaa55658b5257a7b0b4a2c740727d8f

SHA1
fdc5c2ecd0b24dc0d647bacca47c9387ee2aff98

SHA256
d39f9effd8230f616626935bc4975a55e8a93d9e1436262a6d7f2a1e224de37f

SHA512
a42acce2a301157d63210c86defe43279b3bd5997936253cd7ce1a5f15fc1bfc0c4c4611e193298177d7eecba3fcd07c426cef4ce48170c7a583fe56b8815187

Download Submit
C:\Windows\SysWOW64\wlnouvttt.exe

Filesize
485KB

MD5
afaa55658b5257a7b0b4a2c740727d8f

SHA1
fdc5c2ecd0b24dc0d647bacca47c9387ee2aff98

SHA256
d39f9effd8230f616626935bc4975a55e8a93d9e1436262a6d7f2a1e224de37f

SHA512
a42acce2a301157d63210c86defe43279b3bd5997936253cd7ce1a5f15fc1bfc0c4c4611e193298177d7eecba3fcd07c426cef4ce48170c7a583fe56b8815187

Download Submit
C:\Windows\SysWOW64\wmeospf.exe

Filesize
485KB

MD5
ba9e2e465a6a4a8070edd8eab4f12b4b

SHA1
da3f528564909dbeae99d73dc732be996d396086

SHA256
3789905016b9474e952ac155757af389a8f049e2de81a83a72a8a6eea824a8b8

SHA512
5cee32c1628be5906f40b609442cf5a700dfdc0082bbe1f2cb597373eb7bd4dc3dbb88ad5265082314574b26e803839a4d394a5e30bdbdd0a39f5d0c343bdf74

Download Submit
C:\Windows\SysWOW64\wmeospf.exe

Filesize
485KB

MD5
ba9e2e465a6a4a8070edd8eab4f12b4b

SHA1
da3f528564909dbeae99d73dc732be996d396086

SHA256
3789905016b9474e952ac155757af389a8f049e2de81a83a72a8a6eea824a8b8

SHA512
5cee32c1628be5906f40b609442cf5a700dfdc0082bbe1f2cb597373eb7bd4dc3dbb88ad5265082314574b26e803839a4d394a5e30bdbdd0a39f5d0c343bdf74

Download Submit
C:\Windows\SysWOW64\wmhvkybk.exe

Filesize
485KB

MD5
3caf67a4add49ba98353c625641bc06b

SHA1
2b1ec21d3f501956535e19438a8ca1967208685d

SHA256
4a6a77c85b594f2237f05520c1bd1b79790cb8793c71ea67d64a71a122d89d36

SHA512
d028ddc45212740c6172a137113dcf27e1ea66edb0f0036eb83a21aeca0ef33a160915e0b5b6c558571da24f459c98aa1122dedb72e79c69d2272ba9adcba7c3

Download Submit
C:\Windows\SysWOW64\wmhvkybk.exe

Filesize
485KB

MD5
3caf67a4add49ba98353c625641bc06b

SHA1
2b1ec21d3f501956535e19438a8ca1967208685d

SHA256
4a6a77c85b594f2237f05520c1bd1b79790cb8793c71ea67d64a71a122d89d36

SHA512
d028ddc45212740c6172a137113dcf27e1ea66edb0f0036eb83a21aeca0ef33a160915e0b5b6c558571da24f459c98aa1122dedb72e79c69d2272ba9adcba7c3

Download Submit
C:\Windows\SysWOW64\wofxrqi.exe

Filesize
485KB

MD5
62b54a38ca752dc91c1427120e81efb3

SHA1
678d195cac4bfa56c40feb272d175579ff57388d

SHA256
dcb82fac649ef4773cdda0e273f04a7307ed7fa50417f8df34b7bd7ea0771bcf

SHA512
f501176e30f2acb4f2c5c419b3daef4dc579b03607a6d540f7ec1bd22280b4d1246633d8bfc110d2f0284a9f1b87d1b06c87693b9a399c6dc05c88dd7e872bad

Download Submit
C:\Windows\SysWOW64\wofxrqi.exe

Filesize
485KB

MD5
62b54a38ca752dc91c1427120e81efb3

SHA1
678d195cac4bfa56c40feb272d175579ff57388d

SHA256
dcb82fac649ef4773cdda0e273f04a7307ed7fa50417f8df34b7bd7ea0771bcf

SHA512
f501176e30f2acb4f2c5c419b3daef4dc579b03607a6d540f7ec1bd22280b4d1246633d8bfc110d2f0284a9f1b87d1b06c87693b9a399c6dc05c88dd7e872bad

Download Submit
C:\Windows\SysWOW64\wopftta.exe

Filesize
485KB

MD5
109ad6cc47161cd4ce63ac0adb4ad8e7

SHA1
21b8158d3244b7c25401e616800fe4eb7d7cbfc3

SHA256
ebf32f7c5e9011e254c5e320425a7de386970a6a93c6e8816cf3b4911765d646

SHA512
98a69a60f3b7a8c86f695dbd6f0f564f51ee1ede2ab9c24543a0c75538f2a7b9a2effa39ca3644acceab7a562be5d79baf536623b7b7d4ac3b372a39480ff497

Download Submit
C:\Windows\SysWOW64\wopftta.exe

Filesize
485KB

MD5
109ad6cc47161cd4ce63ac0adb4ad8e7

SHA1
21b8158d3244b7c25401e616800fe4eb7d7cbfc3

SHA256
ebf32f7c5e9011e254c5e320425a7de386970a6a93c6e8816cf3b4911765d646

SHA512
98a69a60f3b7a8c86f695dbd6f0f564f51ee1ede2ab9c24543a0c75538f2a7b9a2effa39ca3644acceab7a562be5d79baf536623b7b7d4ac3b372a39480ff497

Download Submit
C:\Windows\SysWOW64\wotepelq.exe

Filesize
485KB

MD5
5d59e3df5ea52ec0938c1d5a1f10d5d4

SHA1
3d47053760f7b7d9bff75c252d7131727bf431a9

SHA256
34f31189c8ed380c0651f4e47227d58a88fc27f4d6c22eee57ad508b800fc236

SHA512
0f5e323c21a50a7ba648ba160e3204130db470a6f1f1a1957f50243d90a00fabe18bbfffcce4f19823e5110526a32bbce25488ed0bfd7de27da6264be7aff5e4

Download Submit
C:\Windows\SysWOW64\wotepelq.exe

Filesize
485KB

MD5
5d59e3df5ea52ec0938c1d5a1f10d5d4

SHA1
3d47053760f7b7d9bff75c252d7131727bf431a9

SHA256
34f31189c8ed380c0651f4e47227d58a88fc27f4d6c22eee57ad508b800fc236

SHA512
0f5e323c21a50a7ba648ba160e3204130db470a6f1f1a1957f50243d90a00fabe18bbfffcce4f19823e5110526a32bbce25488ed0bfd7de27da6264be7aff5e4

Download Submit
C:\Windows\SysWOW64\wpvv.exe

Filesize
485KB

MD5
0663b81d8a3233bdee5502a3c531bab5

SHA1
e4c6f75dabfadba9374c27c07c5cdca18763ce07

SHA256
abf92611ab59bc67dac194ab362ad95f6a55973561c85b09939dfdee319f44bb

SHA512
38847cab6c7ee80b6b5a1ca383b74fece3ada391b0a2249d2e13d0152da44062132c4331912c72ba247f4965ce4e9928eaffbb8b9ae9df21c3e268444bc0be3c

Download Submit
C:\Windows\SysWOW64\wpvv.exe

Filesize
485KB

MD5
0663b81d8a3233bdee5502a3c531bab5

SHA1
e4c6f75dabfadba9374c27c07c5cdca18763ce07

SHA256
abf92611ab59bc67dac194ab362ad95f6a55973561c85b09939dfdee319f44bb

SHA512
38847cab6c7ee80b6b5a1ca383b74fece3ada391b0a2249d2e13d0152da44062132c4331912c72ba247f4965ce4e9928eaffbb8b9ae9df21c3e268444bc0be3c

Download Submit
C:\Windows\SysWOW64\wrtxcpet.exe

Filesize
485KB

MD5
e977ef487deb102b4f777b017856b204

SHA1
c01c65ada1b4ec2dd49b28b98d29ba45e3f1c4ab

SHA256
4afa38eb35ab66b9a03a0ef33fb58e3493c7945414c123a16c7e92c9796e68e5

SHA512
b6b79af27bd6661f9c0c1432efefe93be653090b248296ca9d7c7b4d4ab5a2324499980287c61ee01ce5d8a8ca004d228e815e52d780ea5cc1683661afa8c451

Download Submit
C:\Windows\SysWOW64\wrtxcpet.exe

Filesize
485KB

MD5
e977ef487deb102b4f777b017856b204

SHA1
c01c65ada1b4ec2dd49b28b98d29ba45e3f1c4ab

SHA256
4afa38eb35ab66b9a03a0ef33fb58e3493c7945414c123a16c7e92c9796e68e5

SHA512
b6b79af27bd6661f9c0c1432efefe93be653090b248296ca9d7c7b4d4ab5a2324499980287c61ee01ce5d8a8ca004d228e815e52d780ea5cc1683661afa8c451

Download Submit
C:\Windows\SysWOW64\wrtxcpet.exe

Filesize
485KB

MD5
e977ef487deb102b4f777b017856b204

SHA1
c01c65ada1b4ec2dd49b28b98d29ba45e3f1c4ab

SHA256
4afa38eb35ab66b9a03a0ef33fb58e3493c7945414c123a16c7e92c9796e68e5

SHA512
b6b79af27bd6661f9c0c1432efefe93be653090b248296ca9d7c7b4d4ab5a2324499980287c61ee01ce5d8a8ca004d228e815e52d780ea5cc1683661afa8c451

Download Submit
C:\Windows\SysWOW64\wsemls.exe

Filesize
485KB

MD5
f65fb5efd5b70e85a9f82299df5182e0

SHA1
d7f11d9337eb858d4d1ada4546107ea74dda55fb

SHA256
62d221110634e81b2cd4015ded60861be15e9ef1114d337808b2c4710297ac06

SHA512
636982e9dce1e1cab7e5fe90fa6d5cb31900cb5005595333355cd0f06c114310d67efbfa7eb0f1697b39dfac7e0fdb80a58831744ba61dc5328613186690a43d

Download Submit
C:\Windows\SysWOW64\wsemls.exe

Filesize
485KB

MD5
f65fb5efd5b70e85a9f82299df5182e0

SHA1
d7f11d9337eb858d4d1ada4546107ea74dda55fb

SHA256
62d221110634e81b2cd4015ded60861be15e9ef1114d337808b2c4710297ac06

SHA512
636982e9dce1e1cab7e5fe90fa6d5cb31900cb5005595333355cd0f06c114310d67efbfa7eb0f1697b39dfac7e0fdb80a58831744ba61dc5328613186690a43d

Download Submit
C:\Windows\SysWOW64\wthtirk.exe

Filesize
486KB

MD5
11844900c8e9fa7b16abb0c2a68d59a7

SHA1
35f7fc27254dd708f1a56b58351c5d2a641f67e9

SHA256
a5b735e291d9d17b2e1c6c11c1b9a258f09151e71841d86a130a8ea50e4c1a61

SHA512
281399a92d9e925fec71bbf384982292c21bf4cddb734d72c7751687109d9657dcb921a9106e635a9231dbd05197d19329e7e3733e5285ccf7244049b55f81a7

Download Submit
C:\Windows\SysWOW64\wthtirk.exe

Filesize
486KB

MD5
11844900c8e9fa7b16abb0c2a68d59a7

SHA1
35f7fc27254dd708f1a56b58351c5d2a641f67e9

SHA256
a5b735e291d9d17b2e1c6c11c1b9a258f09151e71841d86a130a8ea50e4c1a61

SHA512
281399a92d9e925fec71bbf384982292c21bf4cddb734d72c7751687109d9657dcb921a9106e635a9231dbd05197d19329e7e3733e5285ccf7244049b55f81a7

Download Submit
C:\Windows\SysWOW64\wtnvqnyk.exe

Filesize
485KB

MD5
349ed357213ca94657d8320de40682e1

SHA1
1294d99ae0f411a3441963fcbd92a03539dc392e

SHA256
5302d9fb78ba585c234f6bb581007cf1c7a2d6333f66e81ffd6647e9a8f8b7a8

SHA512
424c00f59cec70d2e6aa0aaeaa4450224f658b042861b31dabf37e54a6a216ab5eec49ecf6cab04ae1188735ce7ce3b714d4e7009fac1c7281d130687eb74fe4

Download Submit
C:\Windows\SysWOW64\wtnvqnyk.exe

Filesize
485KB

MD5
349ed357213ca94657d8320de40682e1

SHA1
1294d99ae0f411a3441963fcbd92a03539dc392e

SHA256
5302d9fb78ba585c234f6bb581007cf1c7a2d6333f66e81ffd6647e9a8f8b7a8

SHA512
424c00f59cec70d2e6aa0aaeaa4450224f658b042861b31dabf37e54a6a216ab5eec49ecf6cab04ae1188735ce7ce3b714d4e7009fac1c7281d130687eb74fe4

Download Submit
C:\Windows\SysWOW64\wusfofd.exe

Filesize
485KB

MD5
b2b55a40e3ed7bb80f915d3288e34927

SHA1
aaa47da84475545e388caec70021834dece69e71

SHA256
a73d2854dd69c9ea0ded841de7eebe78e7da7928af17caa4c6c8b9aa367b4c50

SHA512
e089ec04b78b7677afd3b77dff39cd273a2c58bda8a42581b9b6a7b125b692d612492e5c58ff25f22697c4e28a190ea22b87298bf2e18616eebdf918b5b2dfc3

Download Submit
C:\Windows\SysWOW64\wusfofd.exe

Filesize
485KB

MD5
b2b55a40e3ed7bb80f915d3288e34927

SHA1
aaa47da84475545e388caec70021834dece69e71

SHA256
a73d2854dd69c9ea0ded841de7eebe78e7da7928af17caa4c6c8b9aa367b4c50

SHA512
e089ec04b78b7677afd3b77dff39cd273a2c58bda8a42581b9b6a7b125b692d612492e5c58ff25f22697c4e28a190ea22b87298bf2e18616eebdf918b5b2dfc3

Download Submit
C:\Windows\SysWOW64\wvwst.exe

Filesize
485KB

MD5
9f373bc536f0c2c357ffd23907480fc3

SHA1
14ed38e99fb1be4fb70c2bada8d31d9e5f42b01b

SHA256
d6192034d59badacd3d42914f2a507f075ddbe9f56aca11c14f0535f7f6b9999

SHA512
25d7721cd7ea171f16d64d75e5d32f2cc0320d8a58acf2fe706f835836cad0a26266f0f521677f572e3d6bda67644c5f662801d9333b5c1490c92d4b2791d1bf

Download Submit
C:\Windows\SysWOW64\wvwst.exe

Filesize
485KB

MD5
9f373bc536f0c2c357ffd23907480fc3

SHA1
14ed38e99fb1be4fb70c2bada8d31d9e5f42b01b

SHA256
d6192034d59badacd3d42914f2a507f075ddbe9f56aca11c14f0535f7f6b9999

SHA512
25d7721cd7ea171f16d64d75e5d32f2cc0320d8a58acf2fe706f835836cad0a26266f0f521677f572e3d6bda67644c5f662801d9333b5c1490c92d4b2791d1bf

Download Submit
C:\Windows\SysWOW64\wwfql.exe

Filesize
485KB

MD5
65a28640e849be6cc75c9bd035c7376d

SHA1
08ad8296a436bd6341702917a677ec7820be0f44

SHA256
05606aec224b773220505c43c6edc11b8fe61a8adca299287f9360f68e7adaed

SHA512
cba0349f5821e487cfeff41ffccc54de275e4c951163e23dae2ca90826b832894300f61ef97f0e26b6c2f670484d21090f94ea46724955313d7457d87f29d54d

Download Submit
C:\Windows\SysWOW64\wwfql.exe

Filesize
485KB

MD5
65a28640e849be6cc75c9bd035c7376d

SHA1
08ad8296a436bd6341702917a677ec7820be0f44

SHA256
05606aec224b773220505c43c6edc11b8fe61a8adca299287f9360f68e7adaed

SHA512
cba0349f5821e487cfeff41ffccc54de275e4c951163e23dae2ca90826b832894300f61ef97f0e26b6c2f670484d21090f94ea46724955313d7457d87f29d54d

Download Submit
C:\Windows\SysWOW64\wwwj.exe

Filesize
485KB

MD5
afa05b3c8c74801ed75668e19f21ed14

SHA1
103d59d291b88fada59e6e6cbc113a38d37893e4

SHA256
3575ebb39744ec9aadc58b57c23b312f305c18b5eca36bcce2dec7e2dd2641f9

SHA512
28a5811c02bfe84dfca26ea86d449f4ae7423b23fc83f6f163336df14bd3c4a5660c86c41bb32c9559a28c822b8d9baae5beef8bf58e61468779c798d889ae94

Download Submit
C:\Windows\SysWOW64\wwwj.exe

Filesize
485KB

MD5
afa05b3c8c74801ed75668e19f21ed14

SHA1
103d59d291b88fada59e6e6cbc113a38d37893e4

SHA256
3575ebb39744ec9aadc58b57c23b312f305c18b5eca36bcce2dec7e2dd2641f9

SHA512
28a5811c02bfe84dfca26ea86d449f4ae7423b23fc83f6f163336df14bd3c4a5660c86c41bb32c9559a28c822b8d9baae5beef8bf58e61468779c798d889ae94

Download Submit
C:\Windows\SysWOW64\wxetfxn.exe

Filesize
485KB

MD5
dbc0819111e7bdf819ccfa61ec33864a

SHA1
b738fa4dbd88f015d293cd414514e659725732a9

SHA256
a687a003371a2cda33f5c1bd15121d5b44f25ec0a582dc8e9fae30593131ab77

SHA512
3bb45aa78f94068c60a0cb97735733d60f866a8bc0571819d2e15859f739776a56f6fbd5076100a1415c02afcbc731593d1c04bed3314b0f2786b86af9f80df9

Download Submit
C:\Windows\SysWOW64\wxetfxn.exe

Filesize
485KB

MD5
dbc0819111e7bdf819ccfa61ec33864a

SHA1
b738fa4dbd88f015d293cd414514e659725732a9

SHA256
a687a003371a2cda33f5c1bd15121d5b44f25ec0a582dc8e9fae30593131ab77

SHA512
3bb45aa78f94068c60a0cb97735733d60f866a8bc0571819d2e15859f739776a56f6fbd5076100a1415c02afcbc731593d1c04bed3314b0f2786b86af9f80df9

Download Submit
C:\Windows\SysWOW64\wxhsk.exe

Filesize
485KB

MD5
4c58413bff4fbd3110d51a108ce89a35

SHA1
d9be6584c601c9ce20c2fe773800fd392e1e0c2b

SHA256
6e3b9eeeba3c4c804d8bda61ba85b4a8fe67e52208bff4086e46b8f375c8d37a

SHA512
0643a347bc87a7fae8248ea17085ae9e6b5af85ec9455465f87daaf2aaf178cacc7b5e4f2de92fecf1c61f3c1105aa9b04896705651c94b6ac21605c3ebed5fa

Download Submit
C:\Windows\SysWOW64\wxhsk.exe

Filesize
485KB

MD5
4c58413bff4fbd3110d51a108ce89a35

SHA1
d9be6584c601c9ce20c2fe773800fd392e1e0c2b

SHA256
6e3b9eeeba3c4c804d8bda61ba85b4a8fe67e52208bff4086e46b8f375c8d37a

SHA512
0643a347bc87a7fae8248ea17085ae9e6b5af85ec9455465f87daaf2aaf178cacc7b5e4f2de92fecf1c61f3c1105aa9b04896705651c94b6ac21605c3ebed5fa

Download Submit
C:\Windows\SysWOW64\wybvyhk.exe

Filesize
485KB

MD5
db864ca3854adb5f724fb46dd20b8499

SHA1
ed43e65213363ccfe48853727a4fad214160a6ca

SHA256
2927603d9e7810fd97144ea66e5becfd87e22318c40fa695973eb31a2ed29054

SHA512
1e766b6745bb6c9c13ea422776cd8d2487c7493ea1ebab70c8e28b646a23f39b9ac418152eaa75f53b1a0c63572fa18640c9f70d7ca9268ac0a5cf14eda46aa7

Download Submit
C:\Windows\SysWOW64\wybvyhk.exe

Filesize
485KB

MD5
db864ca3854adb5f724fb46dd20b8499

SHA1
ed43e65213363ccfe48853727a4fad214160a6ca

SHA256
2927603d9e7810fd97144ea66e5becfd87e22318c40fa695973eb31a2ed29054

SHA512
1e766b6745bb6c9c13ea422776cd8d2487c7493ea1ebab70c8e28b646a23f39b9ac418152eaa75f53b1a0c63572fa18640c9f70d7ca9268ac0a5cf14eda46aa7

Download Submit
C:\Windows\SysWOW64\wyytjo.exe

Filesize
485KB

MD5
86cd38e75b1993ec42c1e84782af41cc

SHA1
0a3d4398f3c0799dff0b62748a7dd3b532bde2c5

SHA256
16c281277e64715af8c77192473d8642df03ef9140fe5ed712324d91feee53b0

SHA512
92747c12fdf56499ea34dfb3c057ff4462353b6ae7efe754fe3ef03bf38691f1be0f44be8288c07cfc880e47ebee0e0a37f62bff0dc36ac169bbea6ee71c56c4

Download Submit
C:\Windows\SysWOW64\wyytjo.exe

Filesize
485KB

MD5
86cd38e75b1993ec42c1e84782af41cc

SHA1
0a3d4398f3c0799dff0b62748a7dd3b532bde2c5

SHA256
16c281277e64715af8c77192473d8642df03ef9140fe5ed712324d91feee53b0

SHA512
92747c12fdf56499ea34dfb3c057ff4462353b6ae7efe754fe3ef03bf38691f1be0f44be8288c07cfc880e47ebee0e0a37f62bff0dc36ac169bbea6ee71c56c4

Download Submit
memory/244-310-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/244-293-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/316-475-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/772-95-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/936-105-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1000-213-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1000-199-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1088-209-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1088-327-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1244-386-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1388-248-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1532-459-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1664-362-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1664-373-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1816-228-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2268-65-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2288-31-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2340-185-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2412-11-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2412-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2412-1-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2448-295-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2448-326-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2748-75-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2748-50-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2844-352-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2920-56-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3064-21-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3064-261-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3148-217-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3220-397-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3352-453-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3596-337-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3596-325-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3632-164-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3700-85-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3756-274-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3912-416-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3940-483-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4152-294-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4172-135-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4432-424-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4476-175-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4628-439-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4688-408-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4760-125-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4976-158-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/5004-115-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/5040-238-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/5116-363-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download