0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

Analysis

max time kernel
170s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 04:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0.exe
Size

80KB
MD5

34bc708b6f1f61e31053426a48f38e50
SHA1

43aac41070ff652e0d364f16736a605953e1f75f
SHA256

0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0
SHA512

a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302
SSDEEP

384:XegMP/sbcegMP/sbzQeVB9Zt3QetOExzqViB:XMXsb8MXsbRNgeth1uiB

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1352	nwizqjsj.exe
1128	nwizqjsj.exe
288	nwizqjsj.exe
556	nwizqjsj.exe
1172	nwizqjsj.exe
1468	nwizqjsj.exe
1940	nwizqjsj.exe
1772	nwizqjsj.exe
1732	nwizqjsj.exe
2044	nwizqjsj.exe
1304	nwizqjsj.exe
1320	nwizqjsj.exe
1284	nwizqjsj.exe
1800	nwizqjsj.exe
664	nwizqjsj.exe
1192	nwizqjsj.exe
820	nwizqjsj.exe
1804	nwizqjsj.exe
832	nwizqjsj.exe
1524	nwizqjsj.exe
1056	nwizqjsj.exe
1628	nwizqjsj.exe
1688	nwizqjsj.exe
1304	nwizqjsj.exe
1220	nwizqjsj.exe
2036	nwizqjsj.exe
280	nwizqjsj.exe
616	nwizqjsj.exe
1112	nwizqjsj.exe
1572	nwizqjsj.exe
1996	nwizqjsj.exe
1468	nwizqjsj.exe
1436	nwizqjsj.exe
1472	nwizqjsj.exe
1772	nwizqjsj.exe
1524	nwizqjsj.exe
1040	nwizqjsj.exe
1032	nwizqjsj.exe
1588	nwizqjsj.exe
952	nwizqjsj.exe
1304	nwizqjsj.exe
1476	nwizqjsj.exe
272	nwizqjsj.exe
576	nwizqjsj.exe
1800	nwizqjsj.exe
1964	nwizqjsj.exe
1504	nwizqjsj.exe
980	nwizqjsj.exe
1624	nwizqjsj.exe
1956	nwizqjsj.exe
108	nwizqjsj.exe
2008	nwizqjsj.exe
1752	nwizqjsj.exe
928	nwizqjsj.exe
1496	nwizqjsj.exe
1016	nwizqjsj.exe
1592	nwizqjsj.exe
1052	nwizqjsj.exe
1820	nwizqjsj.exe
1428	nwizqjsj.exe
1220	nwizqjsj.exe
752	nwizqjsj.exe
1044	nwizqjsj.exe
1408	nwizqjsj.exe

Deletes itself 1 IoCs

pid	Process
2028	cmd.exe

Loads dropped DLL 64 IoCs

pid	Process
1028	0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0.exe
1028	0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0.exe
1352	nwizqjsj.exe
1352	nwizqjsj.exe
1128	nwizqjsj.exe
1128	nwizqjsj.exe
288	nwizqjsj.exe
288	nwizqjsj.exe
556	nwizqjsj.exe
556	nwizqjsj.exe
1172	nwizqjsj.exe
1172	nwizqjsj.exe
1468	nwizqjsj.exe
1468	nwizqjsj.exe
1940	nwizqjsj.exe
1940	nwizqjsj.exe
1772	nwizqjsj.exe
1772	nwizqjsj.exe
1732	nwizqjsj.exe
1732	nwizqjsj.exe
2044	nwizqjsj.exe
2044	nwizqjsj.exe
1304	nwizqjsj.exe
1304	nwizqjsj.exe
1320	nwizqjsj.exe
1320	nwizqjsj.exe
1284	nwizqjsj.exe
1284	nwizqjsj.exe
1800	nwizqjsj.exe
1800	nwizqjsj.exe
664	nwizqjsj.exe
664	nwizqjsj.exe
1192	nwizqjsj.exe
1192	nwizqjsj.exe
820	nwizqjsj.exe
820	nwizqjsj.exe
1804	nwizqjsj.exe
1804	nwizqjsj.exe
832	nwizqjsj.exe
832	nwizqjsj.exe
1524	nwizqjsj.exe
1524	nwizqjsj.exe
1056	nwizqjsj.exe
1056	nwizqjsj.exe
1628	nwizqjsj.exe
1628	nwizqjsj.exe
1688	nwizqjsj.exe
1688	nwizqjsj.exe
1304	nwizqjsj.exe
1304	nwizqjsj.exe
1220	nwizqjsj.exe
1220	nwizqjsj.exe
2036	nwizqjsj.exe
2036	nwizqjsj.exe
280	nwizqjsj.exe
280	nwizqjsj.exe
616	nwizqjsj.exe
616	nwizqjsj.exe
1112	nwizqjsj.exe
1112	nwizqjsj.exe
1572	nwizqjsj.exe
1572	nwizqjsj.exe
1996	nwizqjsj.exe
1996	nwizqjsj.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe
File created	C:\Windows\SysWOW64\nwizqjsj.exe	nwizqjsj.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1028	0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0.exe
1028	0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0.exe
1028	0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0.exe
1028	0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0.exe
1352	nwizqjsj.exe
1352	nwizqjsj.exe
1352	nwizqjsj.exe
1352	nwizqjsj.exe
1128	nwizqjsj.exe
1128	nwizqjsj.exe
1128	nwizqjsj.exe
1128	nwizqjsj.exe
288	nwizqjsj.exe
288	nwizqjsj.exe
288	nwizqjsj.exe
288	nwizqjsj.exe
556	nwizqjsj.exe
556	nwizqjsj.exe
556	nwizqjsj.exe
556	nwizqjsj.exe
1172	nwizqjsj.exe
1172	nwizqjsj.exe
1172	nwizqjsj.exe
1172	nwizqjsj.exe
1468	nwizqjsj.exe
1468	nwizqjsj.exe
1468	nwizqjsj.exe
1468	nwizqjsj.exe
1940	nwizqjsj.exe
1940	nwizqjsj.exe
1940	nwizqjsj.exe
1940	nwizqjsj.exe
1772	nwizqjsj.exe
1772	nwizqjsj.exe
1772	nwizqjsj.exe
1772	nwizqjsj.exe
1732	nwizqjsj.exe
1732	nwizqjsj.exe
1732	nwizqjsj.exe
1732	nwizqjsj.exe
2044	nwizqjsj.exe
2044	nwizqjsj.exe
2044	nwizqjsj.exe
2044	nwizqjsj.exe
1304	nwizqjsj.exe
1304	nwizqjsj.exe
1304	nwizqjsj.exe
1304	nwizqjsj.exe
1320	nwizqjsj.exe
1320	nwizqjsj.exe
1320	nwizqjsj.exe
1320	nwizqjsj.exe
1284	nwizqjsj.exe
1284	nwizqjsj.exe
1284	nwizqjsj.exe
1284	nwizqjsj.exe
1800	nwizqjsj.exe
1800	nwizqjsj.exe
1800	nwizqjsj.exe
1800	nwizqjsj.exe
664	nwizqjsj.exe
664	nwizqjsj.exe
664	nwizqjsj.exe
664	nwizqjsj.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 1352	1028	0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0.exe	27
PID 1028 wrote to memory of 1352	1028	0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0.exe	27
PID 1028 wrote to memory of 1352	1028	0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0.exe	27
PID 1028 wrote to memory of 1352	1028	0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0.exe	27
PID 1028 wrote to memory of 2028	1028	0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0.exe	28
PID 1028 wrote to memory of 2028	1028	0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0.exe	28
PID 1028 wrote to memory of 2028	1028	0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0.exe	28
PID 1028 wrote to memory of 2028	1028	0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0.exe	28
PID 1352 wrote to memory of 1128	1352	nwizqjsj.exe	30
PID 1352 wrote to memory of 1128	1352	nwizqjsj.exe	30
PID 1352 wrote to memory of 1128	1352	nwizqjsj.exe	30
PID 1352 wrote to memory of 1128	1352	nwizqjsj.exe	30
PID 1352 wrote to memory of 1240	1352	nwizqjsj.exe	31
PID 1352 wrote to memory of 1240	1352	nwizqjsj.exe	31
PID 1352 wrote to memory of 1240	1352	nwizqjsj.exe	31
PID 1352 wrote to memory of 1240	1352	nwizqjsj.exe	31
PID 1128 wrote to memory of 288	1128	nwizqjsj.exe	33
PID 1128 wrote to memory of 288	1128	nwizqjsj.exe	33
PID 1128 wrote to memory of 288	1128	nwizqjsj.exe	33
PID 1128 wrote to memory of 288	1128	nwizqjsj.exe	33
PID 1128 wrote to memory of 1984	1128	nwizqjsj.exe	34
PID 1128 wrote to memory of 1984	1128	nwizqjsj.exe	34
PID 1128 wrote to memory of 1984	1128	nwizqjsj.exe	34
PID 1128 wrote to memory of 1984	1128	nwizqjsj.exe	34
PID 288 wrote to memory of 556	288	nwizqjsj.exe	36
PID 288 wrote to memory of 556	288	nwizqjsj.exe	36
PID 288 wrote to memory of 556	288	nwizqjsj.exe	36
PID 288 wrote to memory of 556	288	nwizqjsj.exe	36
PID 288 wrote to memory of 1408	288	nwizqjsj.exe	37
PID 288 wrote to memory of 1408	288	nwizqjsj.exe	37
PID 288 wrote to memory of 1408	288	nwizqjsj.exe	37
PID 288 wrote to memory of 1408	288	nwizqjsj.exe	37
PID 556 wrote to memory of 1172	556	nwizqjsj.exe	39
PID 556 wrote to memory of 1172	556	nwizqjsj.exe	39
PID 556 wrote to memory of 1172	556	nwizqjsj.exe	39
PID 556 wrote to memory of 1172	556	nwizqjsj.exe	39
PID 556 wrote to memory of 1604	556	nwizqjsj.exe	40
PID 556 wrote to memory of 1604	556	nwizqjsj.exe	40
PID 556 wrote to memory of 1604	556	nwizqjsj.exe	40
PID 556 wrote to memory of 1604	556	nwizqjsj.exe	40
PID 1172 wrote to memory of 1468	1172	nwizqjsj.exe	42
PID 1172 wrote to memory of 1468	1172	nwizqjsj.exe	42
PID 1172 wrote to memory of 1468	1172	nwizqjsj.exe	42
PID 1172 wrote to memory of 1468	1172	nwizqjsj.exe	42
PID 1172 wrote to memory of 1612	1172	nwizqjsj.exe	43
PID 1172 wrote to memory of 1612	1172	nwizqjsj.exe	43
PID 1172 wrote to memory of 1612	1172	nwizqjsj.exe	43
PID 1172 wrote to memory of 1612	1172	nwizqjsj.exe	43
PID 1468 wrote to memory of 1940	1468	nwizqjsj.exe	45
PID 1468 wrote to memory of 1940	1468	nwizqjsj.exe	45
PID 1468 wrote to memory of 1940	1468	nwizqjsj.exe	45
PID 1468 wrote to memory of 1940	1468	nwizqjsj.exe	45
PID 1468 wrote to memory of 1968	1468	nwizqjsj.exe	46
PID 1468 wrote to memory of 1968	1468	nwizqjsj.exe	46
PID 1468 wrote to memory of 1968	1468	nwizqjsj.exe	46
PID 1468 wrote to memory of 1968	1468	nwizqjsj.exe	46
PID 1940 wrote to memory of 1772	1940	nwizqjsj.exe	48
PID 1940 wrote to memory of 1772	1940	nwizqjsj.exe	48
PID 1940 wrote to memory of 1772	1940	nwizqjsj.exe	48
PID 1940 wrote to memory of 1772	1940	nwizqjsj.exe	48
PID 1940 wrote to memory of 1724	1940	nwizqjsj.exe	49
PID 1940 wrote to memory of 1724	1940	nwizqjsj.exe	49
PID 1940 wrote to memory of 1724	1940	nwizqjsj.exe	49
PID 1940 wrote to memory of 1724	1940	nwizqjsj.exe	49

C:\Users\Admin\AppData\Local\Temp\0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0.exe
"C:\Users\Admin\AppData\Local\Temp\0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\SysWOW64\nwizqjsj.exe
  C:\Windows\system32\nwizqjsj.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\Windows\SysWOW64\nwizqjsj.exe
    C:\Windows\system32\nwizqjsj.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1128
  - - C:\Windows\SysWOW64\nwizqjsj.exe
      C:\Windows\system32\nwizqjsj.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:288
    - - C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:556
      - C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1172
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1468
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1940
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1772
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1732
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2044
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1304
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1320
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:1284
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1800
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        16⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:664
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        17⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1192
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        18⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:820
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        19⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1804
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        20⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:832
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        21⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1524
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        22⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1056
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        23⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1628
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        24⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1688
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        25⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1304
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        26⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1220
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        27⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2036
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        28⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:280
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        29⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:616
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        30⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1112
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        31⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1572
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        32⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1996
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        33⤵
        Executes dropped EXE
        
        PID:1468
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1436
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1472
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1772
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1524
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1040
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1032
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1588
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:952
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1304
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1476
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:272
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        45⤵
        Executes dropped EXE
        
        PID:576
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1800
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1964
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1504
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:980
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1624
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1956
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:108
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        53⤵
        Executes dropped EXE
        
        PID:2008
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1752
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:928
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1496
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1016
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        58⤵
        Executes dropped EXE
        
        PID:1592
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1052
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1820
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1428
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1220
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        63⤵
        Executes dropped EXE
        
        PID:752
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1044
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        65⤵
        Executes dropped EXE
        
        PID:1408
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        66⤵
        Drops file in System32 directory
        
        PID:1708
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        67⤵
        Drops file in System32 directory
        
        PID:1260
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        68⤵
        Drops file in System32 directory
        
        PID:844
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        69⤵
        
        PID:820
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        70⤵
        Drops file in System32 directory
        
        PID:1660
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        71⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        72⤵
        Drops file in System32 directory
        
        PID:1520
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        73⤵
        Drops file in System32 directory
        
        PID:1736
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        74⤵
        Drops file in System32 directory
        
        PID:1976
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        75⤵
        Drops file in System32 directory
        
        PID:1832
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        76⤵
        Drops file in System32 directory
        
        PID:1420
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        77⤵
        
        PID:1028
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        78⤵
        
        PID:1372
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        79⤵
        Drops file in System32 directory
        
        PID:952
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        80⤵
        Drops file in System32 directory
        
        PID:1860
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        81⤵
        Drops file in System32 directory
        
        PID:1796
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        82⤵
        Drops file in System32 directory
        
        PID:692
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        83⤵
        
        PID:520
        
        C:\Windows\SysWOW64\nwizqjsj.exe
        
        C:\Windows\system32\nwizqjsj.exe
        84⤵
        
        PID:1128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        84⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        83⤵
        
        PID:576
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        82⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        81⤵
        
        PID:876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        80⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        79⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        78⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        77⤵
        
        PID:1032
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        76⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        75⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        74⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        73⤵
        
        PID:1472
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        72⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        71⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        70⤵
        
        PID:1744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        69⤵
        
        PID:828
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        68⤵
        
        PID:2000
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        67⤵
        
        PID:1212
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        66⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        65⤵
        
        PID:1128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        64⤵
        
        PID:520
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        63⤵
        
        PID:692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        62⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        61⤵
        
        PID:1860
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        60⤵
        
        PID:952
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        59⤵
        
        PID:1372
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        58⤵
        
        PID:1028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        57⤵
        
        PID:1420
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        56⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        55⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        54⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        53⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        52⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        51⤵
        
        PID:1104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        50⤵
        
        PID:820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        49⤵
        
        PID:844
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        48⤵
        
        PID:1260
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        47⤵
        
        PID:664
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        46⤵
        
        PID:280
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        45⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        44⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        43⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        42⤵
        
        PID:1320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        41⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        40⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        39⤵
        
        PID:1364
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        38⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        37⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        36⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        35⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        34⤵
        
        PID:1884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        33⤵
        
        PID:1744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        32⤵
        
        PID:1156
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        31⤵
        
        PID:844
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        30⤵
        
        PID:1256
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        29⤵
        
        PID:1408
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        28⤵
        
        PID:1784
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        27⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        26⤵
        
        PID:2024
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        25⤵
        
        PID:1840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        24⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        23⤵
        
        PID:1016
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        22⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        21⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        20⤵
        
        PID:1844
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        19⤵
        
        PID:1104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        18⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        17⤵
        
        PID:580
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        16⤵
        
        PID:288
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        15⤵
        
        PID:1128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        14⤵
        
        PID:1352
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        13⤵
        
        PID:952
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        12⤵
        
        PID:1584
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        11⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        10⤵
        
        PID:1608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        9⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        8⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        7⤵
        
        PID:1612
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        6⤵
        
        PID:1604
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
        5⤵
        
        PID:1408
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
      4⤵
      PID:1984
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\nwizqjsj.exe"
    3⤵
    PID:1240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0.exe"
  2⤵
  - Deletes itself
  PID:2028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
C:\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
C:\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
C:\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
C:\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
C:\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
C:\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
C:\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
C:\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
C:\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
C:\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
C:\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
C:\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
C:\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
C:\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
C:\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
C:\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
C:\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
C:\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
C:\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
C:\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
C:\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit
\Windows\SysWOW64\nwizqjsj.exe

Filesize
80KB

MD5
34bc708b6f1f61e31053426a48f38e50

SHA1
43aac41070ff652e0d364f16736a605953e1f75f

SHA256
0f85be063c8943450e0a64a7f75914d88755347eebc3e3261070a706d92e8db0

SHA512
a272c616a333caa298a471e3e988d9a970603850f68ff299e047501f433b341da1dc73e460636b25f95bfdb09e83fc565b4947cfcee2253aae4f8fd4d2667302

Download Submit