Threat Database Trojans Trojan.Rugmi.DD

Trojan.Rugmi.DD

By CagedTech in Trojans

Threat Scorecard

Popularity Rank: 4,709
Threat Level: 80 % (High)
Infected Computers: 76
First Seen: November 1, 2025
Last Seen: September 12, 2026
OS(es) Affected: Windows

Analysis Report

General information

Family Name: Trojan.Rugmi.DD
Signature status: Hash Mismatch

Known Samples

MD5: 71d2f3c36626ec54f4db7bf896e4aa55
SHA1: 5bfb36a66a70da6a238032cc784d77fbe6e66508
SHA256: F5BCC76672C7FC7399DD645FDAB829169B3DBCD60ED8DB351BD2F68F7DFFFE9D
File Size: 96.41 KB, 96408 bytes
MD5: a92ec5d7be2dd296f9dd761a581e4e04
SHA1: 1dc0596a09a1e9c8ea957c46d183d2f0cdc8730a
SHA256: F883B0ADC4F422566AC2D117CD49DAC6D40296F168ED60962AC14F575D98B60C
File Size: 94.20 KB, 94200 bytes
MD5: 4da9495c058244f1cbb96341c647f4b8
SHA1: 531c6b43a324c8f139bbbb13c22f092ece8b621a
SHA256: 756CE2BDDFF9FD4FC5D356141A9F8F45BC4B8CEF43726CFC8DB8229DD59A9A0F
File Size: 2.14 MB, 2140648 bytes
MD5: be9adce65be4f04f366ea12df117803b
SHA1: 4282eeef6ea228e2c5eb1a042ae726f322860472
SHA256: 7E1E08B386269B59F7B97FD1A0184B4DDE1785A7F85C75C41950A05AF24A3242
File Size: 70.68 KB, 70680 bytes
MD5: 231accbccf91ce0c3c3d409e09ee577c
SHA1: d0c49ea1acfa1a0f51ab581c08105949b477d5d1
SHA256: 0995749CF202695609176A7EB085602B934369CF7440309C7A3BA507A82B6C1B
File Size: 70.68 KB, 70680 bytes
Show More
MD5: c437f13630424b4ffe37d9acfca19ee7
SHA1: c95ae747e358dc3fcd5f94212d37893284699b2c
SHA256: 05B52151534B2B230CBEB1BA63AF027C284329C76480142529AF22B17B39B902
File Size: 189.86 KB, 189856 bytes
MD5: 7a44903ce96823bf4e79ae5a5f8d27cf
SHA1: 9e28c8df0ed056a93e98f7bcb3fe12b98975036b
SHA256: 276E8D19BEB2F46B4FAC791447458809A0193F6F43FB941A1DD1192EB0001EE1
File Size: 523.05 KB, 523048 bytes
MD5: 35b77b38f58197270fb603bc277648f8
SHA1: ab89bb1873d6339710bc778bff5ff6c7af5d605d
SHA256: C2A6E75E71B0D590C45335EF9EA1A28B50EE2E1F599CAA0233E558D38E80591E
File Size: 90.91 KB, 90912 bytes
MD5: 3ed58a8de2c12c7632529cc51715211d
SHA1: a2bbb95e9f6fca839a5595dbf5693057bdb2d3c7
SHA256: 38EF1A7EEA88BD70EE27DC604E290EE9D81D50081CCD3AAA6A0E53D9D0656227
File Size: 4.46 MB, 4456520 bytes
MD5: 54f185e536c9eed3ecce4065350af290
SHA1: bd31fc0d6e50abdf9c523e9344136078c3405282
SHA256: 2E71B697C8F30A7BFA625B7A794620E2270751A1D19771638AD855C2F7B5E875
File Size: 2.94 MB, 2939704 bytes
MD5: cb3488c3658302df47de3bc133eead48
SHA1: e7839719d93bb5fcd81431ed9a291641494a92c6
SHA256: FE6DC05435A94186B461D4359E610A2A7CB14084787A00E156B0EEA57D66AE79
File Size: 79.97 KB, 79968 bytes
MD5: 14a9452d9800c0d76ab000b00e05d634
SHA1: 7784f4df1a58dd088eb9be945afa08fa77c71801
SHA256: D2CB05E9B19C4674501EC7ECF9A420E69F6093756FF815DEEF3F2B8FCE70DF91
File Size: 585.73 KB, 585728 bytes
MD5: b658a5d289f2d51a2d1b28c158958b3e
SHA1: c0c3ccc1f15bbb6c39f6a4a860cc50a4200c4d33
SHA256: 9FB28D99515F19A0E8C94589C9EE609ADF2426B75C0C5D74A67CDA32FB29D6FE
File Size: 1.17 MB, 1170800 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have security information
  • File has exports table
  • File has TLS information
  • File is 32-bit executable
  • File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
  • File is not packed
Show More
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

Windows PE Version Information

Name Value
Company Name
  • Intel Corporation
  • Microsoft Corporation
  • Nero AG
  • Nuance Communications, Inc.
  • The GLib developer community
  • The OpenSSL Project, https://www.openssl.org/
  • Zhuhai Kingsoft Office Software Co.,Ltd
  • ©, Inc.
File Description
  • Common
  • Extended MAPI 1.0 for Windows NT
  • GLib
  • kprt
  • MFCDLL Shared Library - Retail Version
  • Microsoft Office 2010 component
  • Nero Vision
  • OpenSSL library
  • PaperPort File and Rendering
  • PaperPort Utilities Library
Show More
  • TAMInstance模块
File Version
  • 2018,02,27,1
  • 14.7.22568.2000
  • 14.5.15069.1503
  • 14.0.7007.1000
  • 12.0.4518.1014
  • 12,9,0,21549
  • 11.6.0.1035
  • 11.0.60610.1 built by: Q11REL
  • 4,9,7,6
  • 2.48.2.0
Show More
  • 1.1.1q
Internal Name
  • Common
  • HEV
  • krpt
  • libcrypto
  • libglib-2.0-0
  • MAPI32.DLL
  • MAXKERNL
  • MAXUTIL
  • MFC110U.DLL
  • Nero Vision
Show More
  • TAMInstance
Legal Copyright
  • (c) 1995-2015, Nuance Communications, Inc.
  • Copyright 1998-2022 The OpenSSL Authors. All rights reserved.
  • Copyright 2007 Nero AG and its licensors
  • Copyright © 1995-2011 Peter Mattis, Spencer Kimball, Josh MacDonald and others.
  • Copyright © 2010-2016, Intel Corporation. All rights reserved.
  • Copyright©2025 Kingsoft Corporation. All rights reserved.
  • © 2006 Microsoft Corporation. All rights reserved.
  • © 2010 Microsoft Corporation. All rights reserved.
  • © 2022, Kofax Inc.
  • © Microsoft Corporation. All rights reserved.
Legal Trademarks
  • Kofax, ScanSoft, Recognita, Power PDF, PaperPort, OmniPage, and OmniPage Capture SDK are registered trademarks of Kofax Inc. in the United States and/or other countries.
  • Nuance, ScanSoft, Recognita, OmniPage, PaperPort, Power PDF, and OmniPage Capture SDK are registered trademarks of Nuance Communications, Inc. in the United States and/or other countries.
Legal Trademarks1 Microsoft® is a registered trademark of Microsoft Corporation.
Legal Trademarks2 Windows® is a registered trademark of Microsoft Corporation.
Legal Trademarks3 Microsoft Office Outlook® is a registered trademark of Microsoft Corporation.
Original Filename
  • Common.dll
  • krpt.dll
  • libcrypto
  • libglib-2.0-0.dll
  • MAPI32.DLL
  • MAXKERNL.DLL
  • MAXUTIL.DLL
  • MFC110U.DLL
  • MsoHev.dll
  • TAMInstance.dll
Product Name
  • GLib
  • Intel(R) Management and Security Application Local Management Service
  • MAPI32
  • Microsoft Office 2010
  • Microsoft® Visual Studio® 2012
  • Nero Vision
  • PaperPort
  • The OpenSSL Toolkit
  • WPS Office
Product Version
  • 14.71
  • 14.5
  • 14.0.7007.1000
  • 12.0.4518.1014
  • 12,9,0,21549
  • 11.6.0.1035
  • 11.0.60610.1
  • 9, 0, 5, 0
  • 4,9,7,6
  • 2.48.2
Show More
  • 1.1.1q

Digital Signatures

Signer Root Status
Intel Corporation - Embedded Subsystems and IP Blocks Group AddTrust External CA Root Hash Mismatch
Broadcom Inc DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 Hash Mismatch
JUST OKAY LIMITED DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 Hash Mismatch
Kofax, Inc. DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 Hash Mismatch
Zhuhai Kingsoft Office Software Co., Ltd. DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 Hash Mismatch
Show More
JUST OKAY LIMITED DigiCert Trusted Root G4 Hash Mismatch
Zhuhai Kingsoft Office Software Co., Ltd. DigiCert Trusted Root G4 Hash Mismatch
Nuance Communications, Inc. Go Daddy Secure Certification Authority Hash Mismatch
Microsoft Corporation Microsoft Code Signing PCA Hash Mismatch
Microsoft Corporation Microsoft Code Signing PCA 2011 Hash Mismatch
Microsoft Corporation Microsoft Root Authority Hash Mismatch
Nero AG VeriSign Class 3 Code Signing 2004 CA Hash Mismatch
Hangzhou Shunwang Technology Co.,Ltd VeriSign Class 3 Public Primary Certification Authority - G5 Hash Mismatch
Hangzhou Shunwang Technology Co.,Ltd VeriSign Class 3 Public Primary Certification Authority - G5 Hash Mismatch

File Traits

  • CryptUnprotectData
  • dll
  • HighEntropy
  • ntdll
  • x86

Block Information

Total Blocks: 3,641
Potentially Malicious Blocks: 13
Whitelisted Blocks: 2,385
Unknown Blocks: 1,243

Visual Map

0 0 0 0 0 0 ? 0 0 ? ? 0 0 ? 0 0 ? ? ? ? 0 0 ? 0 0 0 0 ? ? 0 ? ? ? 0 0 0 0 0 ? ? ? ? ? 0 0 0 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x ? ? 0 ? 0 0 0 0 0 ? ? ? 0 0 0 0 0 0 0 0 ? 0 0 ? 0 0 ? 0 0 0 0 0 0 ? ? 0 ? ? 0 0 0 0 0 ? 0 0 0 0 0 0 0 ? 0 ? 0 0 0 0 0 0 0 ? ? 0 0 ? 0 ? 0 0 0 0 0 ? 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? ? 0 ? 0 0 ? 0 ? 0 ? 0 ? 0 ? 0 0 0 ? ? 0 ? ? ? ? 0 ? x 0 ? 0 0 ? ? 0 0 0 0 0 0 0 0 ? ? ? ? 0 0 ? 0 0 0 0 ? ? 0 ? 0 ? ? 0 ? 0 ? 0 0 0 ? ? ? 0 0 0 ? 0 ? 0 0 0 0 0 0 0 0 ? 0 ? ? 0 ? 0 ? 0 ? 0 ? ? 0 ? 0 ? 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 ? ? ? 0 0 0 0 ? ? ? 0 0 ? ? ? ? 0 ? 0 0 0 0 0 0 ? 0 0 ? ? ? 0 0 0 ? ? 0 ? ? 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 ? 0 ? ? ? ? ? 0 ? 0 ? 0 ? ? 0 0 ? ? ? 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 ? 0 ? 0 0 ? ? ? ? 0 0 ? ? ? 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 ? 0 0 0 ? 0 0 0 ? 0 0 ? 0 ? 0 0 0 0 ? 0 ? ? 0 0 ? 0 0 ? 0 ? ? 0 0 ? ? ? 0 ? ? 0 ? ? 0 ? ? ? ? ? 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 ? 0 ? ? ? ? ? ? ? 0 0 ? 0 0 ? ? 0 ? ? 0 ? 0 ? 0 0 ? ? ? 0 0 ? ? ? ? ? ? ? ? 0 0 0 0 0 0 ? ? 0 0 ? ? 0 ? ? 0 ? ? ? ? 0 0 0 0 0 0 0 ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? 0 ? ? 0 ? ? 0 ? ? ? ? ? ? ? ? 0 ? 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 ? 0 0 ? 0 0 0 ? 0 0 0 ? ? 0 0 0 0 ? ? 0 0 0 0 0 0 ? 0 0 0 ? 0 0 ? 0 ? 0 0 0 0 0 0 0 0 ? 0 0 ? ? 0 0 0 ? ? 0 0 0 ? 0 ? 0 0 ? 0 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? 1 0 ? ? ? ? 0 0 ? ? 0 0 0 0 ? 0 0 0 0 0 0 0 0 ? 0 ? 0 ? 0 0 0 0 0 ? 0 0 0 0 0 0 0 ? 0 ? 0 ? ? 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 ? 0 ? ? 0 ? 0 0 ? ? 0 0 0 0 0 0 0 0 ? 0 ? 0 ? 0 0 ? 0 ? ? 0 ? ? ? ? 0 ? ? 0 ? 0 ? ? 0 0 ? 0 ? 0 ? 0 0 ? ? ? ? 0 0 0 ? 0 ? ? 0 ? ? 0 0 0 ? 0 0 ? ? 0 0 0 ? 0 0 0 0 ? 0 0 ? ? ? ? 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 ? ? ? 0 0 ? ? 0 ? 0 ? 0 0 ? 0 0 0 0 0 0 0 0 0 ? ? ? 0 0 0 0 ? ? 0 0 0 ? ? ? 0 ? ? 0 0 ? 0 0 0 ? ? ? 0 0 0 0 0 ? ? 0 0 ? 0 0 0 0 0 0 ? ? 0 ? 0 0 ? ? 0 0 0 0 0 0 0 0 ? 0 0 0 ? ? 0 ? 0 0 ? ? ? 0 0 0 0 0 0 ? ? ? ? ? 0 0 0 ? ? 0 ? ? ? 0 ? 0 0 ? 0 ? ? 0 0 0 ? 0 0 0 0 ? ? 0 0 ? 0 0 ? 0 0 0 ? 0 0 0 ? 0 ? 0 ? 0 0 0 0 ? ? 0 ? 0 ? 0 0 ? 0 ? ? 0 ? 0 0 0 ? 0 0 ? 0 ? ? 0 ? 0 0 ? 0 0 ? ? 0 ? ? 0 ? 0 ? 0 ? ? 0 0 ? ? ? ? 0 0 0 ? 0 ? ? ? ? ? 0 0 ? 0 ? 0 0 ? ? ? ? ? ? ? ? 0 0 0 0 ? ? 0 0 0 0 ? 0 ? 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 ? 0 0 0 0 ? 0 0 0 0 0 ? 0 0 0 0 ? 0 0 0 0 ? 0 0 0 0 ? ? ? 0 0 0 0 0 ? 0 ? 0 0 0 0 ? 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 ? 0 ? 0 ? ? ? ? ? ? ? 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 ? 0 0 ? 0 0 ? 0 0 0 0 0 0 0 ? ? ? ? 0 0 0 0 ? ? 0 0 ? ? ? 0 0 ? 0 0 ? 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 ? ? 0 0 0 ? ? ? ? ? ? ? ? ? 0 0 ? 0 ? 0 ? 0 0 0 1 0 0 ? ? ? ? ? ? ? ? ? ? ? 0 ? 0 ? 0 ? 0 ? 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 ? ? 0 0 ? 0 ? 0 0 0 0 0 ? 0 0 ? 0 ? ? 0 ? ? ? 0 0 0 0 ? ? 0 0 0 ? ? 0 0 ? 0 ? 0 ? ? 0 ? ? 0 ? 0 ? 0 ? 0 0 0 0 0 0 0 0 ? ? ? ? ? 0 0 ? ? 0 0 0 0 ? ? ? ? ? ? 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 ? 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 ? ? ? ? ? ? 0 0 0 0 ? ? 0 ? ? 0 ? 0 ? ? ? 0 ? ? 0 0 0 ? 0 ? ? 0 0 ? 0 ? 0 0 ? 0 0 ? 0 0 0 ? 0 ? ? ? 0 ? 0 0 0 0 0 0 ? ? 0 ? ? 0 ? ? ? ? ? ? ? ? ? ? ? 0 ? 0 0 0 ? ? ? 0 0 0 ? ? ? ? 0 0 ? 0 ? 0 0 0 ? 0 ? ? 0 ? ? ? 0 ? 0 0 0 ? 0 0 0 0 0 0 0 0 ? ? ? ? 0 0 0 0 0 0 ? 0 ? ? 0 0 0 ? 0 0 0 0 ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 ? 0 ? ? 0 0 0 ? 0 0 0 0 0 ? 0 ? 0 0 0 ? 0 0 ? 0 ? ? ? ? ? 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? ? ? 0 0 0 0 0 ? ? 0 0 ? 0 0 0 0 ? 0 0 0 0 0 0 0 0 ? ? 0 ? ? 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 ? 0 ? 0 0 ? ? ? ? ? 0 ? 0 0 0 0 0 ? 0 0 0 ? 0 ? ? 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 ? ? 0 ? 0 0 0 0 0 0 0 0 0 ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 ? 0 0 ? 0 ? 0 0 0 0 ? 0 ? 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 ? 0 ? 0 0 0 ? 0 0 ? ? ? ? ? 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 ? ? 0 ? 0 0 0 ? 0 0 0 ? 0 ? ? ? ? 0 ? 0 0 0 0 0 0 ? ? ? ? ? 0 0 ? ? ? 0 ? 0 ? ? 0 0 ? ? ? ? 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 ? 0 0 0 0 0 ? 0 0 ? 0 0 ? 0 ? 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 ? ? ? 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
... Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

Files Modified

File Attributes
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.0.regtrans-ms Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.1.regtrans-ms Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.2.regtrans-ms Generic Read,Write Data,Write Attributes,Write extended,Append data

Windows API Usage

Category API
Syscall Use
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtClose
  • ntdll.dll!NtCreateFile
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtQueryAttributesFile
Show More
  • ntdll.dll!NtQueryDebugFilterState
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtReadFile
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationFile
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWriteFile
Process Manipulation Evasion
  • NtUnmapViewOfSection
Process Shell Execute
  • CreateProcess
Anti Debug
  • NtQuerySystemInformation

Shell Command Execution

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\5bfb36a66a70da6a238032cc784d77fbe6e66508_0000096408.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\1dc0596a09a1e9c8ea957c46d183d2f0cdc8730a_0000094200.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\531c6b43a324c8f139bbbb13c22f092ece8b621a_0002140648.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\4282eeef6ea228e2c5eb1a042ae726f322860472_0000070680.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\d0c49ea1acfa1a0f51ab581c08105949b477d5d1_0000070680.,LiQMAxHB
Show More
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\c95ae747e358dc3fcd5f94212d37893284699b2c_0000189856.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\9e28c8df0ed056a93e98f7bcb3fe12b98975036b_0000523048.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\ab89bb1873d6339710bc778bff5ff6c7af5d605d_0000090912.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\a2bbb95e9f6fca839a5595dbf5693057bdb2d3c7_0004456520.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\bd31fc0d6e50abdf9c523e9344136078c3405282_0002939704.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\e7839719d93bb5fcd81431ed9a291641494a92c6_0000079968.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\7784f4df1a58dd088eb9be945afa08fa77c71801_0000585728.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\c0c3ccc1f15bbb6c39f6a4a860cc50a4200c4d33_0001170800.,LiQMAxHB