General
Target

Dota2mode.exe

Filesize

3MB

Completed

20-05-2022 05:39

Task

behavioral2

Score
8/10
MD5

888d36190614310fbfc16548f3568e84

SHA1

238d4bc0cdc004c1c2be109058375e85f6342fc8

SHA256

d90639401e952a40009d20a954359d899c318c442d03b43f2a81b7b3fc00dd92

SHA512

23852fddcbdc526bfeebd7fad33715553e155c3d16a9ae67b314da0f4678ae5fe761c6fa9894be3fe43b84666db29e08f7d77cdce5b27944e33cab3f53ab39f9

Malware Config
Signatures 13

Filter: none

Discovery
  • Executes dropped EXE
    Rar.exemonvuibk.exeRar.exeplus.exeoiqwiz.exe

    Reported IOCs

    pidprocess
    2128Rar.exe
    4248monvuibk.exe
    2744Rar.exe
    824plus.exe
    4580oiqwiz.exe
  • UPX packed file

    Description

    Detects executables packed with UPX/modified UPX open source packer.

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral2/files/0x00050000000162b0-168.datupx
    behavioral2/files/0x00050000000162b0-169.datupx
  • Checks computer location settings
    WScript.exeDota2mode.exeWScript.exemonvuibk.exeplus.exeWScript.exe

    Description

    Looks up country code configured in the registry, likely geofence.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\NationWScript.exe
    Key value queried\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\NationDota2mode.exe
    Key value queried\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\NationWScript.exe
    Key value queried\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nationmonvuibk.exe
    Key value queried\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nationplus.exe
    Key value queried\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\NationWScript.exe
  • Cryptocurrency Miner

    Description

    Makes network request to known mining pool URL.

    Tags

  • Drops startup file
    plus.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xnojklgq.lnkplus.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Delays execution with timeout.exe
    timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exe

    Tags

    Reported IOCs

    pidprocess
    1200timeout.exe
    2400timeout.exe
    3180timeout.exe
    2156timeout.exe
    3448timeout.exe
    3316timeout.exe
    3060timeout.exe
    2124timeout.exe
    3172timeout.exe
    5036timeout.exe
    4224timeout.exe
    700timeout.exe
    1368timeout.exe
    1480timeout.exe
    2404timeout.exe
    1956timeout.exe
    4192timeout.exe
    3108timeout.exe
    4524timeout.exe
    4396timeout.exe
    3228timeout.exe
    764timeout.exe
    3800timeout.exe
    3544timeout.exe
    544timeout.exe
    4296timeout.exe
    4660timeout.exe
    1020timeout.exe
    220timeout.exe
    1608timeout.exe
    3780timeout.exe
    4744timeout.exe
    3552timeout.exe
    980timeout.exe
    3668timeout.exe
    3128timeout.exe
    3916timeout.exe
    364timeout.exe
    2192timeout.exe
    3016timeout.exe
    2012timeout.exe
    4080timeout.exe
    4624timeout.exe
    1564timeout.exe
    4956timeout.exe
    4996timeout.exe
    4664timeout.exe
    1312timeout.exe
    3228timeout.exe
    4292timeout.exe
    4044timeout.exe
    5036timeout.exe
    3680timeout.exe
    4264timeout.exe
    1364timeout.exe
    3604timeout.exe
    2944timeout.exe
    2576timeout.exe
    3928timeout.exe
    4940timeout.exe
    4664timeout.exe
    1040timeout.exe
    3912timeout.exe
    1260timeout.exe
  • Enumerates processes with tasklist
    tasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exe

    TTPs

    Process Discovery

    Reported IOCs

    pidprocess
    3648tasklist.exe
    1992tasklist.exe
    960tasklist.exe
    4412tasklist.exe
    4780tasklist.exe
    1448tasklist.exe
    544tasklist.exe
    4836tasklist.exe
    4072tasklist.exe
    4276tasklist.exe
    4956tasklist.exe
    4876tasklist.exe
    3180tasklist.exe
    3384tasklist.exe
    396tasklist.exe
    5032tasklist.exe
    644tasklist.exe
    2872tasklist.exe
    4864tasklist.exe
    4340tasklist.exe
    3164tasklist.exe
    2104tasklist.exe
    2068tasklist.exe
    2288tasklist.exe
    4492tasklist.exe
    244tasklist.exe
    3184tasklist.exe
    2696tasklist.exe
    5048tasklist.exe
    4872tasklist.exe
    5012tasklist.exe
    4416tasklist.exe
    1816tasklist.exe
    2576tasklist.exe
    2264tasklist.exe
    4396tasklist.exe
    4452tasklist.exe
    4080tasklist.exe
    764tasklist.exe
    4720tasklist.exe
    1868tasklist.exe
    4852tasklist.exe
    4296tasklist.exe
    1292tasklist.exe
    764tasklist.exe
    4252tasklist.exe
    1472tasklist.exe
    2968tasklist.exe
    2988tasklist.exe
    2860tasklist.exe
    4980tasklist.exe
    2220tasklist.exe
    4292tasklist.exe
    3988tasklist.exe
    1700tasklist.exe
    4676tasklist.exe
    2128tasklist.exe
    824tasklist.exe
    1296tasklist.exe
    3672tasklist.exe
    1036tasklist.exe
    2908tasklist.exe
    2420tasklist.exe
    4316tasklist.exe
  • Kills process with taskkill
    taskkill.exetaskkill.exetaskkill.exe

    Tags

    Reported IOCs

    pidprocess
    4988taskkill.exe
    4964taskkill.exe
    4872taskkill.exe
  • Modifies registry class
    Dota2mode.exeplus.exe

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local SettingsDota2mode.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settingsplus.exe
  • Suspicious behavior: EnumeratesProcesses
    monvuibk.exe

    Reported IOCs

    pidprocess
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
    4248monvuibk.exe
  • Suspicious use of AdjustPrivilegeToken
    taskkill.exetaskkill.exetaskkill.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege4988taskkill.exe
    Token: SeDebugPrivilege4964taskkill.exe
    Token: SeDebugPrivilege4872taskkill.exe
    Token: SeDebugPrivilege1472tasklist.exe
    Token: SeDebugPrivilege436tasklist.exe
    Token: SeDebugPrivilege3184tasklist.exe
    Token: SeDebugPrivilege1788tasklist.exe
    Token: SeDebugPrivilege1448tasklist.exe
    Token: SeDebugPrivilege4616tasklist.exe
    Token: SeDebugPrivilege4536tasklist.exe
    Token: SeDebugPrivilege3556tasklist.exe
    Token: SeDebugPrivilege4396tasklist.exe
    Token: SeDebugPrivilege2556tasklist.exe
    Token: SeDebugPrivilege4720tasklist.exe
    Token: SeDebugPrivilege3448tasklist.exe
    Token: SeDebugPrivilege4956tasklist.exe
    Token: SeDebugPrivilege4964tasklist.exe
    Token: SeDebugPrivilege3680tasklist.exe
    Token: SeDebugPrivilege4796tasklist.exe
    Token: SeDebugPrivilege544tasklist.exe
    Token: SeDebugPrivilege2464tasklist.exe
    Token: SeDebugPrivilege4864tasklist.exe
    Token: SeDebugPrivilege3148tasklist.exe
    Token: SeDebugPrivilege3988tasklist.exe
    Token: SeDebugPrivilege4544tasklist.exe
    Token: SeDebugPrivilege4172tasklist.exe
    Token: SeDebugPrivilege1648tasklist.exe
    Token: SeDebugPrivilege4340tasklist.exe
    Token: SeDebugPrivilege3164tasklist.exe
    Token: SeDebugPrivilege1296tasklist.exe
    Token: SeDebugPrivilege1988tasklist.exe
    Token: SeDebugPrivilege556tasklist.exe
    Token: SeDebugPrivilege3944tasklist.exe
    Token: SeDebugPrivilege4876tasklist.exe
    Token: SeDebugPrivilege3180tasklist.exe
    Token: SeDebugPrivilege2104tasklist.exe
    Token: SeDebugPrivilege2068tasklist.exe
    Token: SeDebugPrivilege4080tasklist.exe
    Token: SeDebugPrivilege3928tasklist.exe
    Token: SeDebugPrivilege1892tasklist.exe
    Token: SeDebugPrivilege2288tasklist.exe
    Token: SeDebugPrivilege4284tasklist.exe
    Token: SeDebugPrivilege2912tasklist.exe
    Token: SeDebugPrivilege3648tasklist.exe
    Token: SeDebugPrivilege4152tasklist.exe
    Token: SeDebugPrivilege4676tasklist.exe
    Token: SeDebugPrivilege1044tasklist.exe
    Token: SeDebugPrivilege1700tasklist.exe
    Token: SeDebugPrivilege1764tasklist.exe
    Token: SeDebugPrivilege788tasklist.exe
    Token: SeDebugPrivilege4612tasklist.exe
    Token: SeDebugPrivilege1752tasklist.exe
    Token: SeDebugPrivilege3672tasklist.exe
    Token: SeDebugPrivilege3464tasklist.exe
    Token: SeDebugPrivilege3104tasklist.exe
    Token: SeDebugPrivilege1792tasklist.exe
    Token: SeDebugPrivilege700tasklist.exe
    Token: SeDebugPrivilege3440tasklist.exe
    Token: SeDebugPrivilege1364tasklist.exe
    Token: SeDebugPrivilege3872tasklist.exe
    Token: SeDebugPrivilege3980tasklist.exe
    Token: SeDebugPrivilege2824tasklist.exe
    Token: SeDebugPrivilege5012tasklist.exe
    Token: SeDebugPrivilege1868tasklist.exe
  • Suspicious use of WriteProcessMemory
    Dota2mode.exeWScript.execmd.exemonvuibk.execmd.exeplus.exeWScript.exeWScript.execmd.execmd.execmd.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 4072 wrote to memory of 47444072Dota2mode.exeWScript.exe
    PID 4072 wrote to memory of 47444072Dota2mode.exeWScript.exe
    PID 4072 wrote to memory of 47444072Dota2mode.exeWScript.exe
    PID 4744 wrote to memory of 48084744WScript.execmd.exe
    PID 4744 wrote to memory of 48084744WScript.execmd.exe
    PID 4744 wrote to memory of 48084744WScript.execmd.exe
    PID 4808 wrote to memory of 49884808cmd.exetaskkill.exe
    PID 4808 wrote to memory of 49884808cmd.exetaskkill.exe
    PID 4808 wrote to memory of 49884808cmd.exetaskkill.exe
    PID 4808 wrote to memory of 49644808cmd.exetaskkill.exe
    PID 4808 wrote to memory of 49644808cmd.exetaskkill.exe
    PID 4808 wrote to memory of 49644808cmd.exetaskkill.exe
    PID 4808 wrote to memory of 13684808cmd.exetimeout.exe
    PID 4808 wrote to memory of 13684808cmd.exetimeout.exe
    PID 4808 wrote to memory of 13684808cmd.exetimeout.exe
    PID 4808 wrote to memory of 15404808cmd.exechcp.com
    PID 4808 wrote to memory of 15404808cmd.exechcp.com
    PID 4808 wrote to memory of 15404808cmd.exechcp.com
    PID 4808 wrote to memory of 21284808cmd.exeRar.exe
    PID 4808 wrote to memory of 21284808cmd.exeRar.exe
    PID 4808 wrote to memory of 21284808cmd.exeRar.exe
    PID 4808 wrote to memory of 48724808cmd.exetaskkill.exe
    PID 4808 wrote to memory of 48724808cmd.exetaskkill.exe
    PID 4808 wrote to memory of 48724808cmd.exetaskkill.exe
    PID 4808 wrote to memory of 42484808cmd.exemonvuibk.exe
    PID 4808 wrote to memory of 42484808cmd.exemonvuibk.exe
    PID 4808 wrote to memory of 42484808cmd.exemonvuibk.exe
    PID 4808 wrote to memory of 5444808cmd.exetimeout.exe
    PID 4808 wrote to memory of 5444808cmd.exetimeout.exe
    PID 4808 wrote to memory of 5444808cmd.exetimeout.exe
    PID 4248 wrote to memory of 2444248monvuibk.execmd.exe
    PID 4248 wrote to memory of 2444248monvuibk.execmd.exe
    PID 4248 wrote to memory of 2444248monvuibk.execmd.exe
    PID 244 wrote to memory of 3704244cmd.exechcp.com
    PID 244 wrote to memory of 3704244cmd.exechcp.com
    PID 244 wrote to memory of 3704244cmd.exechcp.com
    PID 244 wrote to memory of 2744244cmd.exeRar.exe
    PID 244 wrote to memory of 2744244cmd.exeRar.exe
    PID 244 wrote to memory of 2744244cmd.exeRar.exe
    PID 4248 wrote to memory of 8244248monvuibk.exeplus.exe
    PID 4248 wrote to memory of 8244248monvuibk.exeplus.exe
    PID 4248 wrote to memory of 8244248monvuibk.exeplus.exe
    PID 824 wrote to memory of 3104824plus.exeWScript.exe
    PID 824 wrote to memory of 3104824plus.exeWScript.exe
    PID 824 wrote to memory of 3104824plus.exeWScript.exe
    PID 824 wrote to memory of 432824plus.exeWScript.exe
    PID 824 wrote to memory of 432824plus.exeWScript.exe
    PID 824 wrote to memory of 432824plus.exeWScript.exe
    PID 432 wrote to memory of 2204432WScript.execmd.exe
    PID 432 wrote to memory of 2204432WScript.execmd.exe
    PID 432 wrote to memory of 2204432WScript.execmd.exe
    PID 3104 wrote to memory of 49243104WScript.execmd.exe
    PID 3104 wrote to memory of 49243104WScript.execmd.exe
    PID 3104 wrote to memory of 49243104WScript.execmd.exe
    PID 4924 wrote to memory of 12004924cmd.exetimeout.exe
    PID 4924 wrote to memory of 12004924cmd.exetimeout.exe
    PID 4924 wrote to memory of 12004924cmd.exetimeout.exe
    PID 2204 wrote to memory of 45802204cmd.exeoiqwiz.exe
    PID 2204 wrote to memory of 45802204cmd.exeoiqwiz.exe
    PID 4924 wrote to memory of 42124924cmd.execmd.exe
    PID 4924 wrote to memory of 42124924cmd.execmd.exe
    PID 4924 wrote to memory of 42124924cmd.execmd.exe
    PID 4212 wrote to memory of 14724212cmd.exetasklist.exe
    PID 4212 wrote to memory of 14724212cmd.exetasklist.exe
Processes 521
  • C:\Users\Admin\AppData\Local\Temp\Dota2mode.exe
    "C:\Users\Admin\AppData\Local\Temp\Dota2mode.exe"
    Checks computer location settings
    Modifies registry class
    Suspicious use of WriteProcessMemory
    PID:4072
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\sunshiqn\run.vbs"
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:4744
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\sunshiqn\pause.bat" "
        Suspicious use of WriteProcessMemory
        PID:4808
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im rar.exe
          Kills process with taskkill
          Suspicious use of AdjustPrivilegeToken
          PID:4988
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im rar.exe
          Kills process with taskkill
          Suspicious use of AdjustPrivilegeToken
          PID:4964
        • C:\Windows\SysWOW64\timeout.exe
          timeout 3
          Delays execution with timeout.exe
          PID:1368
        • C:\Windows\SysWOW64\chcp.com
          chcp 1251
          PID:1540
        • C:\sunshiqn\Rar.exe
          "Rar.exe" e -p555 privat.rar
          Executes dropped EXE
          PID:2128
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im rar.exe
          Kills process with taskkill
          Suspicious use of AdjustPrivilegeToken
          PID:4872
        • C:\sunshiqn\monvuibk.exe
          monvuibk.exe
          Executes dropped EXE
          Checks computer location settings
          Suspicious behavior: EnumeratesProcesses
          Suspicious use of WriteProcessMemory
          PID:4248
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\xnojklgq\omen.bat" "
            Suspicious use of WriteProcessMemory
            PID:244
            • C:\Windows\SysWOW64\chcp.com
              chcp 1251
              PID:3704
            • C:\xnojklgq\Rar.exe
              "Rar.exe" c -zinfo.txt "plus.exe"
              Executes dropped EXE
              PID:2744
          • C:\xnojklgq\plus.exe
            "C:\xnojklgq\plus.exe"
            Executes dropped EXE
            Checks computer location settings
            Drops startup file
            Modifies registry class
            Suspicious use of WriteProcessMemory
            PID:824
            • C:\Windows\SysWOW64\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\xnojklgq\Go.vbs"
              Checks computer location settings
              Suspicious use of WriteProcessMemory
              PID:3104
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\xnojklgq\Go.bat" "
                Suspicious use of WriteProcessMemory
                PID:4924
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 2 /nobreak
                  Delays execution with timeout.exe
                  PID:1200
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  Suspicious use of WriteProcessMemory
                  PID:4212
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    Suspicious use of AdjustPrivilegeToken
                    PID:1472
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:4996
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:3992
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:436
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:4980
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    Suspicious use of AdjustPrivilegeToken
                    PID:3184
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:1364
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:4432
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:1788
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:556
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    Suspicious use of AdjustPrivilegeToken
                    PID:1448
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:2208
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:3200
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:4616
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:4380
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:4536
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:2124
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:3808
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:3556
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:2960
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:4396
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:1040
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:4060
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:2556
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:1796
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    Suspicious use of AdjustPrivilegeToken
                    PID:4720
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:3912
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:2088
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:3448
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:4784
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    Suspicious use of AdjustPrivilegeToken
                    PID:4956
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:4524
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:4940
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:4964
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:4740
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:3680
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:3136
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:1044
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:4796
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:1700
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    Suspicious use of AdjustPrivilegeToken
                    PID:544
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:228
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:1564
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:2464
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:244
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    Suspicious use of AdjustPrivilegeToken
                    PID:4864
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:2400
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:3016
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:3148
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:3100
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:3988
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:3604
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:3128
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:4544
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:3668
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:4172
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:4344
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:1472
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:1648
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:2364
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    Suspicious use of AdjustPrivilegeToken
                    PID:4340
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:4296
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:1660
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Enumerates processes with tasklist
                    Suspicious use of AdjustPrivilegeToken
                    PID:3164
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:1556
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    Suspicious use of AdjustPrivilegeToken
                    PID:1296
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:448
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:1788
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:1988
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:2444
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:556
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:3172
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:820
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:3944
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:5048
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    Suspicious use of AdjustPrivilegeToken
                    PID:4876
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:5036
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:5004
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Enumerates processes with tasklist
                    Suspicious use of AdjustPrivilegeToken
                    PID:3180
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:3808
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    Suspicious use of AdjustPrivilegeToken
                    PID:2104
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:4396
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:4252
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Enumerates processes with tasklist
                    Suspicious use of AdjustPrivilegeToken
                    PID:2068
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:1828
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    Suspicious use of AdjustPrivilegeToken
                    PID:4080
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:3780
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:3212
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:3928
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:3932
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:1892
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:2628
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:4812
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Enumerates processes with tasklist
                    Suspicious use of AdjustPrivilegeToken
                    PID:2288
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:2088
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:4284
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:4744
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:4988
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:2912
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:4524
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    Suspicious use of AdjustPrivilegeToken
                    PID:3648
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:4900
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:4072
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:4152
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:4076
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    Suspicious use of AdjustPrivilegeToken
                    PID:4676
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:4800
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:4064
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:1044
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:1516
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    Suspicious use of AdjustPrivilegeToken
                    PID:1700
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:1480
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:5000
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:1764
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:4268
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:788
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:1312
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:2696
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:4612
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:2400
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:1752
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:3016
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:3008
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Enumerates processes with tasklist
                    Suspicious use of AdjustPrivilegeToken
                    PID:3672
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:1392
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:3464
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:3128
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:4596
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:3104
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:4348
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:1792
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:4664
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:4012
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:700
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:668
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:3440
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:1260
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:1304
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:1364
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:2056
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:3872
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:1988
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:1908
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:3980
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:776
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Suspicious use of AdjustPrivilegeToken
                    PID:2824
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:3944
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:1376
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Enumerates processes with tasklist
                    Suspicious use of AdjustPrivilegeToken
                    PID:5012
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:1572
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    Suspicious use of AdjustPrivilegeToken
                    PID:1868
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:3180
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:1032
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Enumerates processes with tasklist
                    PID:4416
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:3084
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    PID:4836
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:4468
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:4252
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Enumerates processes with tasklist
                    PID:2968
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:1828
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:3780
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:3916
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:3212
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:2436
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:1892
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    PID:1816
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:4084
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:3232
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:4812
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:4732
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:2088
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:1528
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:4744
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Enumerates processes with tasklist
                    PID:4852
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:4988
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:960
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:4524
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:4964
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:3044
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:4700
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    PID:4072
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:3228
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:4740
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Enumerates processes with tasklist
                    PID:2128
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:3772
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:4224
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:4660
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:2464
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:2764
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:224
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    PID:1036
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:1312
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:4292
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:4644
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:3244
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    PID:824
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:3016
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:444
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:3672
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:4544
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    PID:2908
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:3128
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:4172
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:3104
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:1648
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:1792
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:2364
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:828
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:700
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:4980
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    PID:4296
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:1296
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:2132
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:1304
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:3452
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:2056
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:2012
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:2748
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:1908
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:3200
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:776
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:1096
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:5012
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:3556
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:1868
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:5004
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:3808
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:4416
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:2220
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:5020
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:2068
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:4080
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:2568
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:2340
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:4720
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:1796
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:2740
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:1924
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Enumerates processes with tasklist
                    PID:3384
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:3932
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:4560
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:4624
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:4552
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Enumerates processes with tasklist
                    PID:1992
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:3272
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:2088
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:1920
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:1856
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:4852
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:4904
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    PID:960
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:2944
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:3680
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Enumerates processes with tasklist
                    PID:2420
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:4244
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:4152
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:3228
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:2488
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Enumerates processes with tasklist
                    PID:396
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:4944
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    PID:2988
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:364
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:4280
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:2160
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:3840
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:544
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:1564
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:3776
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Enumerates processes with tasklist
                    PID:4492
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:4268
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    PID:244
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:640
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:3572
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:4840
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:1312
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:3160
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:4292
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:1752
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:2884
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:3988
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:4136
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:3552
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:444
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:3604
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:4716
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    PID:4316
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:1812
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:3708
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:4172
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:1080
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:1648
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:2404
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:3984
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:700
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:668
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:3184
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:2156
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:1952
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Enumerates processes with tasklist
                    PID:2576
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:3540
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:448
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:764
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:464
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:2192
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:4536
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:776
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:4044
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:1096
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Enumerates processes with tasklist
                    PID:2264
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:2104
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:3336
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:4272
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:3816
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Enumerates processes with tasklist
                    PID:4396
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:2728
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    PID:2860
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:3800
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:3904
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:3328
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:2008
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:3916
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:1796
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:4896
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:4064
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:3688
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:2436
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:3448
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:1816
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:4820
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:3232
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:1992
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:1528
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:1948
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:2912
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:3648
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:3676
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:980
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:3632
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Enumerates processes with tasklist
                    PID:4412
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:4156
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:2752
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:1956
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:4032
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Enumerates processes with tasklist
                    PID:4276
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:5016
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:4712
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:2240
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:4184
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:4756
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:2128
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    PID:4872
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:4224
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:1624
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:1700
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:4696
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:1800
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:1036
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:224
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:2004
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:2052
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    PID:1292
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:4192
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:4612
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:1312
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:2276
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:824
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:1020
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:4604
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:3008
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:3492
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    PID:4780
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:4792
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:3552
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:4736
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:4844
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:1392
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:3668
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:1284
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:4544
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:4596
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:4348
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:4172
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:4628
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:1268
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:3164
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:492
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:700
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:1556
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Enumerates processes with tasklist
                    PID:4980
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:4432
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    PID:5032
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:2576
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:652
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Enumerates processes with tasklist
                    PID:644
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:2108
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    PID:764
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:4876
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:2192
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:3064
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:776
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:4984
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:5036
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:1096
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:1724
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:3808
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    PID:2220
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:3544
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:1040
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:4060
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:2516
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    PID:4252
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:3928
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:2036
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:3916
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:3388
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:64
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:3504
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:4728
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:2436
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:4312
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    PID:4452
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:4956
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:4784
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:4812
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:1452
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:4744
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:4940
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:4988
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:3676
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:3136
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:4900
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:3680
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:4700
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:656
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:3228
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:4908
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:396
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:4712
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:4948
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:2352
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:4756
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:220
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:4872
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:3772
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:1564
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:1700
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:1764
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:1800
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:3884
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:1236
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:4424
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:4264
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:3612
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:2052
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:4888
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    PID:2696
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:3108
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:3148
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Enumerates processes with tasklist
                    PID:4292
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:3512
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:3496
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:3316
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:1824
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Enumerates processes with tasklist
                    PID:3988
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:1008
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:1628
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:1608
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:4016
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:1092
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:1588
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:4952
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:4664
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:1472
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:4596
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:1792
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    Enumerates processes with tasklist
                    PID:2872
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:828
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:2404
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:3164
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:1084
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:1296
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:1448
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:1788
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:2148
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:448
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:3052
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:3060
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:3944
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Enumerates processes with tasklist
                    PID:764
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:4876
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:2208
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  Delays execution with timeout.exe
                  PID:2192
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:5012
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    Enumerates processes with tasklist
                    PID:5048
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                  PID:5036
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
                    PID:896
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 1 /nobreak
                  PID:5004
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                  PID:4036
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /NH /FI "IMAGENAME eq oiqwiz.exe"
                    PID:4272
            • C:\Windows\SysWOW64\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\xnojklgq\Auto.vbs"
              Checks computer location settings
              Suspicious use of WriteProcessMemory
              PID:432
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\xnojklgq\Auto.bat" "
                Suspicious use of WriteProcessMemory
                PID:2204
                • C:\xnojklgq\oiqwiz.exe
                  "oiqwiz.exe"
                  Executes dropped EXE
                  PID:4580
        • C:\Windows\SysWOW64\timeout.exe
          timeout 2
          Delays execution with timeout.exe
          PID:544
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • C:\sunshiqn\Rar.exe

                          MD5

                          2e86a9862257a0cf723ceef3868a1a12

                          SHA1

                          a4324281823f0800132bf13f5ad3860e6b5532c6

                          SHA256

                          2356220cfa9159b463d762e2833f647a04fa58b4c627fcb4fb1773d199656ab8

                          SHA512

                          3a8e0389637fc8a3f8bab130326fe091ead8c0575a1a3861622466d4e3c37818c928bc74af4d14b5bb3080dfae46e41fee2c362a7093b5aa3b9df39110c8e9de

                        • C:\sunshiqn\Rar.exe

                          MD5

                          2e86a9862257a0cf723ceef3868a1a12

                          SHA1

                          a4324281823f0800132bf13f5ad3860e6b5532c6

                          SHA256

                          2356220cfa9159b463d762e2833f647a04fa58b4c627fcb4fb1773d199656ab8

                          SHA512

                          3a8e0389637fc8a3f8bab130326fe091ead8c0575a1a3861622466d4e3c37818c928bc74af4d14b5bb3080dfae46e41fee2c362a7093b5aa3b9df39110c8e9de

                        • C:\sunshiqn\monvuibk.exe

                          MD5

                          5a5db532785179ed05b8a80187d7ee21

                          SHA1

                          e42a3a40e836b691c2aa9dbe9600da17c8c75763

                          SHA256

                          43d61d6b22303523a18c79162c58c15f108635a6b9bbff1a3331b74624467593

                          SHA512

                          4e45569289f3dbe5abd7c2f4303e2af0facdf239ec1effd2d15fac01f129bcd44ece0b389892ad70a42d0dd511e156adb5ce98176158c0ea42b4b0fefa51138b

                        • C:\sunshiqn\monvuibk.exe

                          MD5

                          5a5db532785179ed05b8a80187d7ee21

                          SHA1

                          e42a3a40e836b691c2aa9dbe9600da17c8c75763

                          SHA256

                          43d61d6b22303523a18c79162c58c15f108635a6b9bbff1a3331b74624467593

                          SHA512

                          4e45569289f3dbe5abd7c2f4303e2af0facdf239ec1effd2d15fac01f129bcd44ece0b389892ad70a42d0dd511e156adb5ce98176158c0ea42b4b0fefa51138b

                        • C:\sunshiqn\pause.bat

                          MD5

                          fb085f47185862061fa2adb5acc58171

                          SHA1

                          5f91cf2e8bc109e20dbe97ab91d0b047a727e93b

                          SHA256

                          fec96179e59437ede713340e5686b681c107a0363e79c5c24045887f5e7d3e1b

                          SHA512

                          a2ac14d7e67fa5d13312141b76fbc11cd373dfb1499b7d575c80e4409334a4bb28523d31044003fd907e5e52ac5e5cc45377551b1d3b704b94b2de7de892e76e

                        • C:\sunshiqn\privat.rar

                          MD5

                          bcd1d52c65ff0c640681ef7f4b4dd701

                          SHA1

                          b3a364dda02cd50ebb7990b2bfee1779a001bd95

                          SHA256

                          c54c442cfc5b905a337c740e1008ada67158e22c1b780d39e0e7c5e90ab82750

                          SHA512

                          bd9f2033a337acfed85e500588814530f81ef299a241998ae20d4518b01d9094e7ec65f7da2bfbc6328b9a89fd90cdc9233e575274efd4db04269baf035526b8

                        • C:\sunshiqn\run.vbs

                          MD5

                          6a5f5a48072a1adae96d2bd88848dcff

                          SHA1

                          b381fa864db6c521cbf1133a68acf1db4baa7005

                          SHA256

                          c7758bb2fdf207306a5b83c9916bfffcc5e85efe14c8f00d18e2b6639b9780fe

                          SHA512

                          d11101b11a95d39a2b23411955e869f92451e1613b150c15d953cccf0f741fb6c3cf082124af8b67d4eb40feb112e1167a1e25bdeab9e433af3ccc5384ccb90c

                        • C:\xnojklgq\Auto.bat

                          MD5

                          88659c9200f43efa7eedad229588356b

                          SHA1

                          36b4c368c1f5c75ca990b4d14f8a5eec903485b1

                          SHA256

                          4c77b094a906d8a0299b275581628e66c9d4e6ca96dcede7e67a3eb1c2aec2cc

                          SHA512

                          a4fe7494848608cdfe65b221edf479ff725c420772899b27db3beef540e64bf36dbc1beca31651b34664445238052d5e41360c47efe17058daa7c848103944ee

                        • C:\xnojklgq\Auto.vbs

                          MD5

                          8cab8206831c992d7c6dd5f9cfea94d9

                          SHA1

                          e36b6dd77691dbf8b1bcb4ce986e3432ff9d06af

                          SHA256

                          519603f0aa335880a3a93ba0c193a81b0bff798d931e07e4b6a4109f5a174a52

                          SHA512

                          82561a074d840666c6a2549b32d2e6f9d172d6dd7c4a5ee1009f4863fd9522cbbd8296fcdd9534a8243e22f89c6555c10c160576c5f1af516b675bc6d90de105

                        • C:\xnojklgq\Go.bat

                          MD5

                          6b5ec49cb5d3ae843891067a3484d99e

                          SHA1

                          7a903ae5924a1c2dd5406afdf8fa694243d2a26b

                          SHA256

                          7874c9ef2c75258c90f01bbc3d5a3f9ed65f1f09c8b00a39b7cfb07f7b45740f

                          SHA512

                          9279071dfb1a599827919cff376ae1ef0f518415180ecf1631563caf7c0548f827373e4fee44e24eb705b55107f1bf945aa3cdfd618fdb54ed9c7f381fef4101

                        • C:\xnojklgq\Go.vbs

                          MD5

                          a3f3d477adf9ca6fffc7eb6ecd9eb17d

                          SHA1

                          611442499a4d0ae3fbce1ae1cde20cb92360bb75

                          SHA256

                          4e7ea70519889275be433f5bf53a4c81e0ea3db8f0bd2429b68b4f9b262d307c

                          SHA512

                          0b4864684acac03fe25b4c80677c4da9e0890cf1b3164e98ee9f807a54017e0f1bceec4010de11b5be5ebedc32f9fe3dc53d5c9529a1ce26485669f00611746d

                        • C:\xnojklgq\Rar.exe

                          MD5

                          2e86a9862257a0cf723ceef3868a1a12

                          SHA1

                          a4324281823f0800132bf13f5ad3860e6b5532c6

                          SHA256

                          2356220cfa9159b463d762e2833f647a04fa58b4c627fcb4fb1773d199656ab8

                          SHA512

                          3a8e0389637fc8a3f8bab130326fe091ead8c0575a1a3861622466d4e3c37818c928bc74af4d14b5bb3080dfae46e41fee2c362a7093b5aa3b9df39110c8e9de

                        • C:\xnojklgq\Rar.exe

                          MD5

                          2e86a9862257a0cf723ceef3868a1a12

                          SHA1

                          a4324281823f0800132bf13f5ad3860e6b5532c6

                          SHA256

                          2356220cfa9159b463d762e2833f647a04fa58b4c627fcb4fb1773d199656ab8

                          SHA512

                          3a8e0389637fc8a3f8bab130326fe091ead8c0575a1a3861622466d4e3c37818c928bc74af4d14b5bb3080dfae46e41fee2c362a7093b5aa3b9df39110c8e9de

                        • C:\xnojklgq\giperdragsBFS.json

                          MD5

                          6e840dd9b1daabed84d1d32f7b8c1b8b

                          SHA1

                          ecd00359d98a48fd50856845574579cd93189f6a

                          SHA256

                          5a51a2a5f900ef34f3976ac9ccbd9686dc9affe92d9c529b0c8c9361fbc0e3fb

                          SHA512

                          11d7d9477fec95d41d721c41bb909869f2bf0bcd1de4755b0a32aeabb73b3235e874e33ee633f7d43982d452849847cee885a2dadebe538f72ab5ea4d2a94ff0

                        • C:\xnojklgq\info.txt

                          MD5

                          88cebd7e2150d2c3b0c6bff92766cebe

                          SHA1

                          a2f955ec6dca14621fa7242b3c7cec77fa349f21

                          SHA256

                          5ff39948360d11a40eb8fdcfdd0e31da86bb4018fad97745f570f9bebd159d38

                          SHA512

                          e0d2690e5ccaaad279ebb73c2ffc7ee3ca6fe0cbf3af3974df1124eb71fd00906a71819675a258a65411130cf0778ae7f5554d0b1b9be2a4dfd4c486a74597be

                        • C:\xnojklgq\oiqwiz.exe

                          MD5

                          ddc91455c12983afeda765ebc1405fc7

                          SHA1

                          818d160bfb4ae6b870083e80c12ada9bc5c6d9df

                          SHA256

                          7e87dcc6ca8263694bdd0313fe3b52d9088c5545dccace2af02e1bdf44e66554

                          SHA512

                          51cdc75b64a0ea18db0729f2b9505b1288c4defca7a5e9492922282b475b95b0307cce1daf3677f230140a2c9de594ee28e714eeab7dd69c3ed6fe466b00fe58

                        • C:\xnojklgq\oiqwiz.exe

                          MD5

                          ddc91455c12983afeda765ebc1405fc7

                          SHA1

                          818d160bfb4ae6b870083e80c12ada9bc5c6d9df

                          SHA256

                          7e87dcc6ca8263694bdd0313fe3b52d9088c5545dccace2af02e1bdf44e66554

                          SHA512

                          51cdc75b64a0ea18db0729f2b9505b1288c4defca7a5e9492922282b475b95b0307cce1daf3677f230140a2c9de594ee28e714eeab7dd69c3ed6fe466b00fe58

                        • C:\xnojklgq\omen.bat

                          MD5

                          a15b61671e902fe28fb1bf7e459a7bdd

                          SHA1

                          694d542af6834fa4cbc81cc3b3a8a99d61378f5e

                          SHA256

                          d763ef51ee4520819f8021ebb138578ba3261aa8db5fcec7c69382cca95ff75f

                          SHA512

                          653ec95af8f6f73538b0cb8d0fe903267e56b1f1a7d810bff1f4dd5adf675ae2f5a55260b0bc41295b60052fe056b1acfa00c2a07121dd387eb7719997fa15f6

                        • C:\xnojklgq\plus.exe

                          MD5

                          81107f80c971b15dd3718f6b4070c0c1

                          SHA1

                          d93e601e3d3e96422881d81a26b4bb108635f6fd

                          SHA256

                          ab5fb605318dcc99217aa0c1fb7b646ec16a242db5c8cfa50316794d3c979921

                          SHA512

                          c9185e949a7a5a24c9047c7fbfb5702c5f74e8ab5e57dcf2ac893b92d8b1be6e8b8247c83cd746a9eb932b316b691d4f971c19464d9faf6fe2c309b2c10810be

                        • C:\xnojklgq\plus.exe

                          MD5

                          81107f80c971b15dd3718f6b4070c0c1

                          SHA1

                          d93e601e3d3e96422881d81a26b4bb108635f6fd

                          SHA256

                          ab5fb605318dcc99217aa0c1fb7b646ec16a242db5c8cfa50316794d3c979921

                          SHA512

                          c9185e949a7a5a24c9047c7fbfb5702c5f74e8ab5e57dcf2ac893b92d8b1be6e8b8247c83cd746a9eb932b316b691d4f971c19464d9faf6fe2c309b2c10810be

                        • C:\xnojklgq\plus.exe

                          MD5

                          ca106b2dd914c5f5b7c0b30e503e35d9

                          SHA1

                          0c072402d244612f45f9901a3a22726226a64e29

                          SHA256

                          b300747328bd15f160c5bc063e80a961ebf56f3efe2c14da0c51dcbb38b0a55b

                          SHA512

                          ee4afcfe7763c66d8a9f2eafa0bd889b0aa86ebaad18d817f23dc6240a214425837dc593dbed971a07a51455ca6911a5f777912687a56e0d8446db0a31664c0a

                        • memory/228-213-0x0000000000000000-mapping.dmp

                        • memory/244-147-0x0000000000000000-mapping.dmp

                        • memory/432-161-0x0000000000000000-mapping.dmp

                        • memory/436-175-0x0000000000000000-mapping.dmp

                        • memory/544-145-0x0000000000000000-mapping.dmp

                        • memory/544-212-0x0000000000000000-mapping.dmp

                        • memory/556-181-0x0000000000000000-mapping.dmp

                        • memory/824-156-0x0000000000000000-mapping.dmp

                        • memory/1040-193-0x0000000000000000-mapping.dmp

                        • memory/1044-209-0x0000000000000000-mapping.dmp

                        • memory/1200-166-0x0000000000000000-mapping.dmp

                        • memory/1364-178-0x0000000000000000-mapping.dmp

                        • memory/1368-136-0x0000000000000000-mapping.dmp

                        • memory/1448-182-0x0000000000000000-mapping.dmp

                        • memory/1472-172-0x0000000000000000-mapping.dmp

                        • memory/1540-137-0x0000000000000000-mapping.dmp

                        • memory/1564-214-0x0000000000000000-mapping.dmp

                        • memory/1700-211-0x0000000000000000-mapping.dmp

                        • memory/1788-180-0x0000000000000000-mapping.dmp

                        • memory/1796-196-0x0000000000000000-mapping.dmp

                        • memory/2088-199-0x0000000000000000-mapping.dmp

                        • memory/2124-188-0x0000000000000000-mapping.dmp

                        • memory/2128-138-0x0000000000000000-mapping.dmp

                        • memory/2204-164-0x0000000000000000-mapping.dmp

                        • memory/2208-183-0x0000000000000000-mapping.dmp

                        • memory/2556-195-0x0000000000000000-mapping.dmp

                        • memory/2744-150-0x0000000000000000-mapping.dmp

                        • memory/2960-191-0x0000000000000000-mapping.dmp

                        • memory/3104-159-0x0000000000000000-mapping.dmp

                        • memory/3136-208-0x0000000000000000-mapping.dmp

                        • memory/3184-177-0x0000000000000000-mapping.dmp

                        • memory/3200-184-0x0000000000000000-mapping.dmp

                        • memory/3448-200-0x0000000000000000-mapping.dmp

                        • memory/3556-190-0x0000000000000000-mapping.dmp

                        • memory/3680-207-0x0000000000000000-mapping.dmp

                        • memory/3704-149-0x0000000000000000-mapping.dmp

                        • memory/3808-189-0x0000000000000000-mapping.dmp

                        • memory/3912-198-0x0000000000000000-mapping.dmp

                        • memory/3992-174-0x0000000000000000-mapping.dmp

                        • memory/4060-194-0x0000000000000000-mapping.dmp

                        • memory/4212-171-0x0000000000000000-mapping.dmp

                        • memory/4248-143-0x0000000000000000-mapping.dmp

                        • memory/4380-186-0x0000000000000000-mapping.dmp

                        • memory/4396-192-0x0000000000000000-mapping.dmp

                        • memory/4432-179-0x0000000000000000-mapping.dmp

                        • memory/4524-203-0x0000000000000000-mapping.dmp

                        • memory/4536-187-0x0000000000000000-mapping.dmp

                        • memory/4580-167-0x0000000000000000-mapping.dmp

                        • memory/4616-185-0x0000000000000000-mapping.dmp

                        • memory/4720-197-0x0000000000000000-mapping.dmp

                        • memory/4740-206-0x0000000000000000-mapping.dmp

                        • memory/4744-130-0x0000000000000000-mapping.dmp

                        • memory/4784-201-0x0000000000000000-mapping.dmp

                        • memory/4796-210-0x0000000000000000-mapping.dmp

                        • memory/4808-133-0x0000000000000000-mapping.dmp

                        • memory/4872-142-0x0000000000000000-mapping.dmp

                        • memory/4924-165-0x0000000000000000-mapping.dmp

                        • memory/4940-204-0x0000000000000000-mapping.dmp

                        • memory/4956-202-0x0000000000000000-mapping.dmp

                        • memory/4964-205-0x0000000000000000-mapping.dmp

                        • memory/4964-135-0x0000000000000000-mapping.dmp

                        • memory/4980-176-0x0000000000000000-mapping.dmp

                        • memory/4988-134-0x0000000000000000-mapping.dmp

                        • memory/4996-173-0x0000000000000000-mapping.dmp