Malware Analysis Report

2025-08-10 16:32

Sample ID 250412-r3f2zaw1et
Target JaffaCakes118_b290c6025c5e02a99bb372986a2c07e4
SHA256 79f662e4967afa18a37082fbfd8ce704e079f47458569fdda125354d5beb1c33
Tags
pykspa defense_evasion discovery persistence trojan worm
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

79f662e4967afa18a37082fbfd8ce704e079f47458569fdda125354d5beb1c33

Threat Level: Known bad

The file JaffaCakes118_b290c6025c5e02a99bb372986a2c07e4 was found to be: Known bad.

Malicious Activity Summary

pykspa defense_evasion discovery persistence trojan worm

Pykspa family

UAC bypass

Modifies WinLogon for persistence

Pykspa

Detect Pykspa worm

Adds policy Run key to start application

Checks computer location settings

Executes dropped EXE

Checks whether UAC is enabled

Looks up external IP address via web service

Adds Run key to start application

Drops file in System32 directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

System policy modification

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-04-12 14:42

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-04-12 14:42

Reported

2025-04-12 14:45

Platform

win10v2004-20250410-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b290c6025c5e02a99bb372986a2c07e4.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A

Pykspa

worm pykspa

Pykspa family

pykspa

UAC bypass

defense_evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A

Detect Pykspa worm

worm
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\irzhtaks = "gbvpngcwsgbdiyiduncx.exe" C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b290c6025c5e02a99bb372986a2c07e4.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Control Panel\International\Geo\Nation C:\Windows\tngzwojcxkefjyhbrjx.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gntzjo = "tngzwojcxkefjyhbrjx.exe" C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tbipagp = "ibtlhyskeqjjmaibqh.exe ." C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zjsbowhqb = "tngzwojcxkefjyhbrjx.exe" C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A

Checks whether UAC is enabled

defense_evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A whatismyip.everdot.org N/A N/A
N/A www.whatismyip.ca N/A N/A
N/A www.whatismyip.ca N/A N/A
N/A whatismyip.everdot.org N/A N/A
N/A www.whatismyip.ca N/A N/A
N/A www.whatismyip.ca N/A N/A
N/A www.whatismyip.ca N/A N/A
N/A whatismyipaddress.com N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\ibtlhyskeqjjmaibqh.exe C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A
File opened for modification C:\Windows\SysWOW64\ibtlhyskeqjjmaibqh.exe C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A
File created C:\Windows\SysWOW64\gbvpngcwsgbdiyiduncx.exe C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A
File opened for modification C:\Windows\SysWOW64\gbvpngcwsgbdiyiduncx.exe C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A
File created C:\Windows\SysWOW64\vrmhgaxspeadjalhztjfa.exe C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A
File created C:\Windows\SysWOW64\sjzpjyqgyizxykqh.exe C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A
File created C:\Windows\SysWOW64\zrizukdunyqpreldr.exe C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A
File opened for modification C:\Windows\SysWOW64\zrizukdunyqpreldr.exe C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A
File created C:\Windows\SysWOW64\tngzwojcxkefjyhbrjx.exe C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A
File opened for modification C:\Windows\SysWOW64\tngzwojcxkefjyhbrjx.exe C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A
File opened for modification C:\Windows\SysWOW64\vrmhgaxspeadjalhztjfa.exe C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A
File created C:\Windows\SysWOW64\mjfbbwuqoebfmeqngbsplh.exe C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A
File opened for modification C:\Windows\SysWOW64\mjfbbwuqoebfmeqngbsplh.exe C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A
File opened for modification C:\Windows\SysWOW64\sjzpjyqgyizxykqh.exe C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\zrizukdunyqpreldr.exe C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A
File created C:\Windows\ibtlhyskeqjjmaibqh.exe C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A
File created C:\Windows\tngzwojcxkefjyhbrjx.exe C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A
File opened for modification C:\Windows\tngzwojcxkefjyhbrjx.exe C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A
File created C:\Windows\gbvpngcwsgbdiyiduncx.exe C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A
File created C:\Windows\vrmhgaxspeadjalhztjfa.exe C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A
File created C:\Windows\mjfbbwuqoebfmeqngbsplh.exe C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A
File created C:\Windows\sjzpjyqgyizxykqh.exe C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A
File created C:\Windows\zrizukdunyqpreldr.exe C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A
File opened for modification C:\Windows\ibtlhyskeqjjmaibqh.exe C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A
File opened for modification C:\Windows\gbvpngcwsgbdiyiduncx.exe C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A
File opened for modification C:\Windows\vrmhgaxspeadjalhztjfa.exe C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A
File opened for modification C:\Windows\mjfbbwuqoebfmeqngbsplh.exe C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A
File opened for modification C:\Windows\sjzpjyqgyizxykqh.exe C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\tngzwojcxkefjyhbrjx.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\ibtlhyskeqjjmaibqh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b290c6025c5e02a99bb372986a2c07e4.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5200 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b290c6025c5e02a99bb372986a2c07e4.exe C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
PID 5200 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b290c6025c5e02a99bb372986a2c07e4.exe C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
PID 5200 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b290c6025c5e02a99bb372986a2c07e4.exe C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
PID 4700 wrote to memory of 4696 N/A C:\Windows\system32\cmd.exe C:\Windows\tngzwojcxkefjyhbrjx.exe
PID 4700 wrote to memory of 4696 N/A C:\Windows\system32\cmd.exe C:\Windows\tngzwojcxkefjyhbrjx.exe
PID 4700 wrote to memory of 4696 N/A C:\Windows\system32\cmd.exe C:\Windows\tngzwojcxkefjyhbrjx.exe
PID 4696 wrote to memory of 5160 N/A C:\Windows\tngzwojcxkefjyhbrjx.exe C:\Windows\System32\Conhost.exe
PID 4696 wrote to memory of 5160 N/A C:\Windows\tngzwojcxkefjyhbrjx.exe C:\Windows\System32\Conhost.exe
PID 4696 wrote to memory of 5160 N/A C:\Windows\tngzwojcxkefjyhbrjx.exe C:\Windows\System32\Conhost.exe
PID 4792 wrote to memory of 3292 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
PID 4792 wrote to memory of 3292 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
PID 4792 wrote to memory of 3292 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

System policy modification

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b290c6025c5e02a99bb372986a2c07e4.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b290c6025c5e02a99bb372986a2c07e4.exe"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\jaffacakes118_b290c6025c5e02a99bb372986a2c07e4.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe

C:\Windows\tngzwojcxkefjyhbrjx.exe

tngzwojcxkefjyhbrjx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*"

C:\Windows\ibtlhyskeqjjmaibqh.exe

ibtlhyskeqjjmaibqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .

C:\Windows\vrmhgaxspeadjalhztjfa.exe

vrmhgaxspeadjalhztjfa.exe .

C:\Windows\tngzwojcxkefjyhbrjx.exe

tngzwojcxkefjyhbrjx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*"

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .

C:\Users\Admin\AppData\Local\Temp\jxkxoapcrymhf.exe

"C:\Users\Admin\AppData\Local\Temp\jxkxoapcrymhf.exe" "-c:\users\admin\appdata\local\temp\jaffacakes118_b290c6025c5e02a99bb372986a2c07e4.exe"

C:\Users\Admin\AppData\Local\Temp\jxkxoapcrymhf.exe

"C:\Users\Admin\AppData\Local\Temp\jxkxoapcrymhf.exe" "-c:\users\admin\appdata\local\temp\jaffacakes118_b290c6025c5e02a99bb372986a2c07e4.exe"

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe

C:\Windows\ibtlhyskeqjjmaibqh.exe

ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .

C:\Windows\sjzpjyqgyizxykqh.exe

sjzpjyqgyizxykqh.exe .

C:\Windows\tngzwojcxkefjyhbrjx.exe

tngzwojcxkefjyhbrjx.exe

C:\Windows\sjzpjyqgyizxykqh.exe

sjzpjyqgyizxykqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe

C:\Windows\ibtlhyskeqjjmaibqh.exe

ibtlhyskeqjjmaibqh.exe

C:\Windows\zrizukdunyqpreldr.exe

zrizukdunyqpreldr.exe

C:\Windows\zrizukdunyqpreldr.exe

zrizukdunyqpreldr.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe .

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*."

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Windows\zrizukdunyqpreldr.exe

zrizukdunyqpreldr.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\gbvpngcwsgbdiyiduncx.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\gbvpngcwsgbdiyiduncx.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .

C:\Windows\gbvpngcwsgbdiyiduncx.exe

gbvpngcwsgbdiyiduncx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe

C:\Windows\vrmhgaxspeadjalhztjfa.exe

vrmhgaxspeadjalhztjfa.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe

C:\Windows\sjzpjyqgyizxykqh.exe

sjzpjyqgyizxykqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Windows\tngzwojcxkefjyhbrjx.exe

tngzwojcxkefjyhbrjx.exe .

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\gbvpngcwsgbdiyiduncx.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*."

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*"

C:\Windows\gbvpngcwsgbdiyiduncx.exe

gbvpngcwsgbdiyiduncx.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*."

C:\Windows\vrmhgaxspeadjalhztjfa.exe

vrmhgaxspeadjalhztjfa.exe

C:\Windows\gbvpngcwsgbdiyiduncx.exe

gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*"

C:\Windows\vrmhgaxspeadjalhztjfa.exe

vrmhgaxspeadjalhztjfa.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\gbvpngcwsgbdiyiduncx.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .

C:\Windows\vrmhgaxspeadjalhztjfa.exe

vrmhgaxspeadjalhztjfa.exe .

C:\Windows\zrizukdunyqpreldr.exe

zrizukdunyqpreldr.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*"

C:\Windows\gbvpngcwsgbdiyiduncx.exe

gbvpngcwsgbdiyiduncx.exe .

C:\Windows\sjzpjyqgyizxykqh.exe

sjzpjyqgyizxykqh.exe .

C:\Windows\zrizukdunyqpreldr.exe

zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\gbvpngcwsgbdiyiduncx.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*."

C:\Windows\sjzpjyqgyizxykqh.exe

sjzpjyqgyizxykqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\gbvpngcwsgbdiyiduncx.exe*."

C:\Windows\vrmhgaxspeadjalhztjfa.exe

vrmhgaxspeadjalhztjfa.exe .

C:\Windows\zrizukdunyqpreldr.exe

zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Windows\vrmhgaxspeadjalhztjfa.exe

vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*"

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe .

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Windows\sjzpjyqgyizxykqh.exe

sjzpjyqgyizxykqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Windows\tngzwojcxkefjyhbrjx.exe

tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Windows\tngzwojcxkefjyhbrjx.exe

tngzwojcxkefjyhbrjx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*."

C:\Windows\sjzpjyqgyizxykqh.exe

sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .

C:\Windows\zrizukdunyqpreldr.exe

zrizukdunyqpreldr.exe .

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*"

C:\Windows\zrizukdunyqpreldr.exe

zrizukdunyqpreldr.exe .

C:\Windows\vrmhgaxspeadjalhztjfa.exe

vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*."

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\gbvpngcwsgbdiyiduncx.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*."

C:\Windows\sjzpjyqgyizxykqh.exe

sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*."

C:\Windows\tngzwojcxkefjyhbrjx.exe

tngzwojcxkefjyhbrjx.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .

C:\Windows\vrmhgaxspeadjalhztjfa.exe

vrmhgaxspeadjalhztjfa.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Windows\gbvpngcwsgbdiyiduncx.exe

gbvpngcwsgbdiyiduncx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe .

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .

C:\Windows\tngzwojcxkefjyhbrjx.exe

tngzwojcxkefjyhbrjx.exe

C:\Windows\tngzwojcxkefjyhbrjx.exe

tngzwojcxkefjyhbrjx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Windows\tngzwojcxkefjyhbrjx.exe

tngzwojcxkefjyhbrjx.exe

C:\Windows\tngzwojcxkefjyhbrjx.exe

tngzwojcxkefjyhbrjx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe .

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*."

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\gbvpngcwsgbdiyiduncx.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*"

C:\Windows\vrmhgaxspeadjalhztjfa.exe

vrmhgaxspeadjalhztjfa.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\gbvpngcwsgbdiyiduncx.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*."

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*"

C:\Windows\zrizukdunyqpreldr.exe

zrizukdunyqpreldr.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe

C:\Windows\gbvpngcwsgbdiyiduncx.exe

gbvpngcwsgbdiyiduncx.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .

C:\Windows\vrmhgaxspeadjalhztjfa.exe

vrmhgaxspeadjalhztjfa.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*"

C:\Windows\vrmhgaxspeadjalhztjfa.exe

vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\gbvpngcwsgbdiyiduncx.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*"

C:\Windows\tngzwojcxkefjyhbrjx.exe

tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*."

C:\Windows\ibtlhyskeqjjmaibqh.exe

ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe .

C:\Windows\ibtlhyskeqjjmaibqh.exe

ibtlhyskeqjjmaibqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Windows\zrizukdunyqpreldr.exe

zrizukdunyqpreldr.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .

C:\Windows\gbvpngcwsgbdiyiduncx.exe

gbvpngcwsgbdiyiduncx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe

C:\Windows\sjzpjyqgyizxykqh.exe

sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe .

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .

C:\Windows\gbvpngcwsgbdiyiduncx.exe

gbvpngcwsgbdiyiduncx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Windows\sjzpjyqgyizxykqh.exe

sjzpjyqgyizxykqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Windows\zrizukdunyqpreldr.exe

zrizukdunyqpreldr.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .

C:\Windows\ibtlhyskeqjjmaibqh.exe

ibtlhyskeqjjmaibqh.exe .

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Windows\ibtlhyskeqjjmaibqh.exe

ibtlhyskeqjjmaibqh.exe

C:\Windows\vrmhgaxspeadjalhztjfa.exe

vrmhgaxspeadjalhztjfa.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\gbvpngcwsgbdiyiduncx.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Windows\tngzwojcxkefjyhbrjx.exe

tngzwojcxkefjyhbrjx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*"

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\gbvpngcwsgbdiyiduncx.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*."

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Windows\sjzpjyqgyizxykqh.exe

sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe

C:\Windows\vrmhgaxspeadjalhztjfa.exe

vrmhgaxspeadjalhztjfa.exe .

C:\Windows\vrmhgaxspeadjalhztjfa.exe

vrmhgaxspeadjalhztjfa.exe

C:\Windows\ibtlhyskeqjjmaibqh.exe

ibtlhyskeqjjmaibqh.exe .

C:\Windows\gbvpngcwsgbdiyiduncx.exe

gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Windows\sjzpjyqgyizxykqh.exe

sjzpjyqgyizxykqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe .

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Windows\gbvpngcwsgbdiyiduncx.exe

gbvpngcwsgbdiyiduncx.exe .

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Windows\sjzpjyqgyizxykqh.exe

sjzpjyqgyizxykqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*"

C:\Windows\vrmhgaxspeadjalhztjfa.exe

vrmhgaxspeadjalhztjfa.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\gbvpngcwsgbdiyiduncx.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe .

C:\Windows\ibtlhyskeqjjmaibqh.exe

ibtlhyskeqjjmaibqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .

C:\Windows\tngzwojcxkefjyhbrjx.exe

tngzwojcxkefjyhbrjx.exe .

C:\Windows\ibtlhyskeqjjmaibqh.exe

ibtlhyskeqjjmaibqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\gbvpngcwsgbdiyiduncx.exe*"

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Windows\vrmhgaxspeadjalhztjfa.exe

vrmhgaxspeadjalhztjfa.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*."

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Windows\tngzwojcxkefjyhbrjx.exe

tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*"

C:\Windows\sjzpjyqgyizxykqh.exe

sjzpjyqgyizxykqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .

C:\Windows\vrmhgaxspeadjalhztjfa.exe

vrmhgaxspeadjalhztjfa.exe .

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Windows\gbvpngcwsgbdiyiduncx.exe

gbvpngcwsgbdiyiduncx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*"

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Windows\ibtlhyskeqjjmaibqh.exe

ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Windows\ibtlhyskeqjjmaibqh.exe

ibtlhyskeqjjmaibqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*."

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*"

C:\Windows\zrizukdunyqpreldr.exe

zrizukdunyqpreldr.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*."

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe

C:\Windows\tngzwojcxkefjyhbrjx.exe

tngzwojcxkefjyhbrjx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*."

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\gbvpngcwsgbdiyiduncx.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\gbvpngcwsgbdiyiduncx.exe*."

C:\Windows\ibtlhyskeqjjmaibqh.exe

ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\gbvpngcwsgbdiyiduncx.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Windows\zrizukdunyqpreldr.exe

zrizukdunyqpreldr.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*."

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*."

C:\Windows\gbvpngcwsgbdiyiduncx.exe

gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe .

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\gbvpngcwsgbdiyiduncx.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\gbvpngcwsgbdiyiduncx.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Windows\tngzwojcxkefjyhbrjx.exe

tngzwojcxkefjyhbrjx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*"

C:\Windows\tngzwojcxkefjyhbrjx.exe

tngzwojcxkefjyhbrjx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe .

C:\Windows\tngzwojcxkefjyhbrjx.exe

tngzwojcxkefjyhbrjx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .

C:\Windows\gbvpngcwsgbdiyiduncx.exe

gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .

C:\Windows\ibtlhyskeqjjmaibqh.exe

ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .

C:\Windows\ibtlhyskeqjjmaibqh.exe

ibtlhyskeqjjmaibqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*"

C:\Windows\zrizukdunyqpreldr.exe

zrizukdunyqpreldr.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*."

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\gbvpngcwsgbdiyiduncx.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\gbvpngcwsgbdiyiduncx.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*"

C:\Windows\ibtlhyskeqjjmaibqh.exe

ibtlhyskeqjjmaibqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\gbvpngcwsgbdiyiduncx.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Windows\tngzwojcxkefjyhbrjx.exe

tngzwojcxkefjyhbrjx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe .

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Windows\zrizukdunyqpreldr.exe

zrizukdunyqpreldr.exe .

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Windows\sjzpjyqgyizxykqh.exe

sjzpjyqgyizxykqh.exe

C:\Windows\ibtlhyskeqjjmaibqh.exe

ibtlhyskeqjjmaibqh.exe

C:\Windows\sjzpjyqgyizxykqh.exe

sjzpjyqgyizxykqh.exe .

C:\Windows\ibtlhyskeqjjmaibqh.exe

ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Windows\gbvpngcwsgbdiyiduncx.exe

gbvpngcwsgbdiyiduncx.exe .

C:\Windows\tngzwojcxkefjyhbrjx.exe

tngzwojcxkefjyhbrjx.exe .

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\gbvpngcwsgbdiyiduncx.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\gbvpngcwsgbdiyiduncx.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .

C:\Windows\gbvpngcwsgbdiyiduncx.exe

gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*."

C:\Windows\ibtlhyskeqjjmaibqh.exe

ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Windows\tngzwojcxkefjyhbrjx.exe

tngzwojcxkefjyhbrjx.exe .

C:\Windows\sjzpjyqgyizxykqh.exe

sjzpjyqgyizxykqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*."

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Windows\ibtlhyskeqjjmaibqh.exe

ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Windows\tngzwojcxkefjyhbrjx.exe

tngzwojcxkefjyhbrjx.exe .

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .

C:\Windows\tngzwojcxkefjyhbrjx.exe

tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe

C:\Windows\sjzpjyqgyizxykqh.exe

sjzpjyqgyizxykqh.exe .

C:\Windows\sjzpjyqgyizxykqh.exe

sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .

C:\Windows\zrizukdunyqpreldr.exe

zrizukdunyqpreldr.exe .

C:\Windows\vrmhgaxspeadjalhztjfa.exe

vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Windows\sjzpjyqgyizxykqh.exe

sjzpjyqgyizxykqh.exe .

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Windows\tngzwojcxkefjyhbrjx.exe

tngzwojcxkefjyhbrjx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*"

C:\Windows\vrmhgaxspeadjalhztjfa.exe

vrmhgaxspeadjalhztjfa.exe .

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\gbvpngcwsgbdiyiduncx.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe .

C:\Windows\sjzpjyqgyizxykqh.exe

sjzpjyqgyizxykqh.exe .

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe

C:\Windows\sjzpjyqgyizxykqh.exe

sjzpjyqgyizxykqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .

C:\Windows\vrmhgaxspeadjalhztjfa.exe

vrmhgaxspeadjalhztjfa.exe

C:\Windows\tngzwojcxkefjyhbrjx.exe

tngzwojcxkefjyhbrjx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Windows\vrmhgaxspeadjalhztjfa.exe

vrmhgaxspeadjalhztjfa.exe

C:\Windows\tngzwojcxkefjyhbrjx.exe

tngzwojcxkefjyhbrjx.exe

C:\Windows\gbvpngcwsgbdiyiduncx.exe

gbvpngcwsgbdiyiduncx.exe .

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\gbvpngcwsgbdiyiduncx.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\gbvpngcwsgbdiyiduncx.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\gbvpngcwsgbdiyiduncx.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*"

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe .

C:\Windows\vrmhgaxspeadjalhztjfa.exe

vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe .

C:\Windows\ibtlhyskeqjjmaibqh.exe

ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\gbvpngcwsgbdiyiduncx.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\gbvpngcwsgbdiyiduncx.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*."

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe

C:\Windows\vrmhgaxspeadjalhztjfa.exe

vrmhgaxspeadjalhztjfa.exe .

C:\Windows\zrizukdunyqpreldr.exe

zrizukdunyqpreldr.exe

C:\Windows\ibtlhyskeqjjmaibqh.exe

ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Windows\zrizukdunyqpreldr.exe

zrizukdunyqpreldr.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .

C:\Windows\zrizukdunyqpreldr.exe

zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Windows\zrizukdunyqpreldr.exe

zrizukdunyqpreldr.exe .

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .

C:\Windows\ibtlhyskeqjjmaibqh.exe

ibtlhyskeqjjmaibqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe .

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Windows\gbvpngcwsgbdiyiduncx.exe

gbvpngcwsgbdiyiduncx.exe .

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\gbvpngcwsgbdiyiduncx.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Windows\ibtlhyskeqjjmaibqh.exe

ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Windows\tngzwojcxkefjyhbrjx.exe

tngzwojcxkefjyhbrjx.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*"

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Windows\vrmhgaxspeadjalhztjfa.exe

vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Windows\zrizukdunyqpreldr.exe

zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Windows\ibtlhyskeqjjmaibqh.exe

ibtlhyskeqjjmaibqh.exe .

C:\Windows\gbvpngcwsgbdiyiduncx.exe

gbvpngcwsgbdiyiduncx.exe

C:\Windows\sjzpjyqgyizxykqh.exe

sjzpjyqgyizxykqh.exe .

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .

C:\Windows\ibtlhyskeqjjmaibqh.exe

ibtlhyskeqjjmaibqh.exe

C:\Windows\sjzpjyqgyizxykqh.exe

sjzpjyqgyizxykqh.exe .

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .

C:\Windows\tngzwojcxkefjyhbrjx.exe

tngzwojcxkefjyhbrjx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Windows\ibtlhyskeqjjmaibqh.exe

ibtlhyskeqjjmaibqh.exe .

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .

C:\Windows\sjzpjyqgyizxykqh.exe

sjzpjyqgyizxykqh.exe .

C:\Windows\zrizukdunyqpreldr.exe

zrizukdunyqpreldr.exe

C:\Windows\tngzwojcxkefjyhbrjx.exe

tngzwojcxkefjyhbrjx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Windows\sjzpjyqgyizxykqh.exe

sjzpjyqgyizxykqh.exe

C:\Windows\ibtlhyskeqjjmaibqh.exe

ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .

C:\Windows\sjzpjyqgyizxykqh.exe

sjzpjyqgyizxykqh.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe .

C:\Windows\sjzpjyqgyizxykqh.exe

sjzpjyqgyizxykqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe .

C:\Windows\zrizukdunyqpreldr.exe

zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\gbvpngcwsgbdiyiduncx.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\gbvpngcwsgbdiyiduncx.exe*."

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*."

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*"

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .

C:\Windows\zrizukdunyqpreldr.exe

zrizukdunyqpreldr.exe

C:\Windows\vrmhgaxspeadjalhztjfa.exe

vrmhgaxspeadjalhztjfa.exe .

C:\Windows\ibtlhyskeqjjmaibqh.exe

ibtlhyskeqjjmaibqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*"

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Windows\ibtlhyskeqjjmaibqh.exe

ibtlhyskeqjjmaibqh.exe

C:\Windows\vrmhgaxspeadjalhztjfa.exe

vrmhgaxspeadjalhztjfa.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*."

C:\Windows\vrmhgaxspeadjalhztjfa.exe

vrmhgaxspeadjalhztjfa.exe .

C:\Windows\tngzwojcxkefjyhbrjx.exe

tngzwojcxkefjyhbrjx.exe .

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Windows\sjzpjyqgyizxykqh.exe

sjzpjyqgyizxykqh.exe

C:\Windows\zrizukdunyqpreldr.exe

zrizukdunyqpreldr.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*"

C:\Windows\gbvpngcwsgbdiyiduncx.exe

gbvpngcwsgbdiyiduncx.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*."

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Windows\ibtlhyskeqjjmaibqh.exe

ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Windows\ibtlhyskeqjjmaibqh.exe

ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*"

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe

C:\Windows\ibtlhyskeqjjmaibqh.exe

ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*."

C:\Windows\sjzpjyqgyizxykqh.exe

sjzpjyqgyizxykqh.exe .

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .

C:\Windows\tngzwojcxkefjyhbrjx.exe

tngzwojcxkefjyhbrjx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe

C:\Windows\ibtlhyskeqjjmaibqh.exe

ibtlhyskeqjjmaibqh.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*"

C:\Windows\gbvpngcwsgbdiyiduncx.exe

gbvpngcwsgbdiyiduncx.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*"

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe

C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*"

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*"

Network

Country Destination Domain Proto
GB 88.221.134.249:443 www.bing.com tcp
US 8.8.8.8:53 www.whatismyip.ca udp
US 8.8.8.8:53 www.whatismyip.com udp
US 172.66.40.87:80 www.whatismyip.com tcp
US 8.8.8.8:53 www.whatismyip.ca udp
US 8.8.8.8:53 whatismyipaddress.com udp
US 104.19.223.79:80 whatismyipaddress.com tcp
US 104.19.223.79:80 whatismyipaddress.com tcp
US 172.66.40.87:80 www.whatismyip.com tcp
US 8.8.8.8:53 whatismyip.everdot.org udp
US 8.8.8.8:53 www.whatismyip.ca udp
US 172.66.40.87:80 www.whatismyip.com tcp
US 8.8.8.8:53 www.whatismyip.ca udp
US 8.8.8.8:53 whatismyip.everdot.org udp
US 104.19.223.79:80 whatismyipaddress.com tcp
US 104.19.223.79:80 whatismyipaddress.com tcp
US 8.8.8.8:53 www.whatismyip.ca udp
US 8.8.8.8:53 www.google.com udp
GB 216.58.204.68:80 www.google.com tcp
AU 218.100.81.0:3432 tcp
US 8.8.8.8:53 qtttbufqbex.org udp
US 8.8.8.8:53 immuiaiugkeq.net udp
US 8.8.8.8:53 suxkks.info udp
US 8.8.8.8:53 molygadsholapet.org udp
US 8.8.8.8:53 cpcmnenansnan.com udp
US 8.8.8.8:53 yywmiiiugkeq.biz udp
US 8.8.8.8:53 igzmwo.biz udp
US 8.8.8.8:53 uaperanansnan.com udp
US 8.8.8.8:53 lzkcvafox.org udp
US 8.8.8.8:53 yksgamiq.net udp
US 8.8.8.8:53 ywpdbcuiwcymao.info udp
US 8.8.8.8:53 dphmlsn.org udp
US 8.8.8.8:53 efzhnyfqbex.com udp
US 8.8.8.8:53 eidpyqeoya.info udp
US 8.8.8.8:53 wcotrsiugkeq.info udp
US 8.8.8.8:53 jfnudafox.org udp
US 8.8.8.8:53 tkrogcn.org udp
US 8.8.8.8:53 oeesimiq.net udp
US 8.8.8.8:53 uatqlcuiwcymao.info udp
US 8.8.8.8:53 zfdthsn.cc udp
US 8.8.8.8:53 xizqmkn.cc udp
US 8.8.8.8:53 oerrlgeoya.biz udp
US 8.8.8.8:53 eqbqcguiwcymao.info udp
US 52.11.240.239:80 eqbqcguiwcymao.info tcp
US 8.8.8.8:53 zuzmvwfox.com udp
US 8.8.8.8:53 wzgrsenansnan.org udp
US 8.8.8.8:53 wigyhsiugkeq.biz udp
US 8.8.8.8:53 waauysiugkeq.net udp
US 8.8.8.8:53 srjukodsholapet.org udp
US 8.8.8.8:53 tizmbgn.org udp
US 8.8.8.8:53 qwetpwiugkeq.biz udp
US 8.8.8.8:53 amlehcuiwcymao.net udp
US 8.8.8.8:53 izbqukdsholapet.com udp
US 8.8.8.8:53 agvtrufqbex.cc udp
US 8.8.8.8:53 sepsbs.net udp
US 8.8.8.8:53 agoriiiugkeq.biz udp
US 8.8.8.8:53 rmrgusfox.cc udp
US 8.8.8.8:53 bozyrgn.com udp
US 8.8.8.8:53 kooiewiq.net udp
US 8.8.8.8:53 yuwuemiq.biz udp
US 8.8.8.8:53 ybdetodsholapet.com udp
US 8.8.8.8:53 mgesbsdsholapet.org udp
US 8.8.8.8:53 ykbjeueoya.biz udp
US 8.8.8.8:53 sooiysiugkeq.biz udp
US 8.8.8.8:53 tjxxlafox.cc udp
US 8.8.8.8:53 cjgsnenansnan.com udp
US 8.8.8.8:53 autsca.net udp
US 8.8.8.8:53 wmeawmiq.net udp
US 8.8.8.8:53 nszqrsfox.cc udp
US 8.8.8.8:53 nqwuzafox.org udp
US 8.8.8.8:53 ugzfgguiwcymao.info udp
US 8.8.8.8:53 qwawsaiq.biz udp
US 8.8.8.8:53 wabchmnansnan.com udp
US 8.8.8.8:53 xcneecn.org udp
US 8.8.8.8:53 uwxumcuiwcymao.info udp
US 8.8.8.8:53 qymkcaiq.net udp
US 8.8.8.8:53 xojoxsn.com udp
US 8.8.8.8:53 bkcsuafox.com udp
US 8.8.8.8:53 ailswk.info udp
US 8.8.8.8:53 qweacsiugkeq.biz udp
US 8.8.8.8:53 tvfwkifox.cc udp
US 8.8.8.8:53 fqcqcwfox.org udp
US 8.8.8.8:53 gimcsiiugkeq.net udp
US 8.8.8.8:53 catwtueoya.net udp
US 8.8.8.8:53 ytxizanansnan.org udp
US 8.8.8.8:53 zonspkn.cc udp
US 8.8.8.8:53 aymkoaiugkeq.info udp
US 8.8.8.8:53 usawkiiugkeq.biz udp
US 8.8.8.8:53 uafudkdsholapet.cc udp
US 8.8.8.8:53 wrsxuodsholapet.com udp
US 8.8.8.8:53 egweniiugkeq.net udp
US 8.8.8.8:53 igkiteiq.info udp
US 8.8.8.8:53 ekxtrenansnan.org udp
US 8.8.8.8:53 rmrihsn.org udp
US 8.8.8.8:53 qgqqhwiugkeq.net udp
US 8.8.8.8:53 skqoxsiugkeq.net udp
US 8.8.8.8:53 unbclufqbex.org udp
US 8.8.8.8:53 ygudvanansnan.org udp
US 8.8.8.8:53 kenoyguiwcymao.net udp
US 8.8.8.8:53 eaxveqeoya.net udp
US 8.8.8.8:53 tbxouwfox.org udp
US 8.8.8.8:53 jfgjlifox.org udp
US 8.8.8.8:53 gahmus.net udp
US 8.8.8.8:53 qaowwaiq.net udp
US 8.8.8.8:53 dsfxjcn.org udp
US 8.8.8.8:53 zcbtrcn.com udp
US 8.8.8.8:53 sywmmmiq.info udp
US 8.8.8.8:53 iobwycuiwcymao.net udp
US 8.8.8.8:53 xidshsn.com udp
US 8.8.8.8:53 mqtoqyfqbex.com udp
US 52.182.143.211:443 tcp
US 8.8.8.8:53 wovsmueoya.info udp
US 8.8.8.8:53 euyypiiugkeq.net udp
US 8.8.8.8:53 hzdupsn.org udp
US 8.8.8.8:53 brdhrcn.org udp
US 8.8.8.8:53 scfdcueoya.info udp
US 8.8.8.8:53 wessyiiugkeq.info udp
US 8.8.8.8:53 tmrvuifox.com udp
US 8.8.8.8:53 pwhmxcn.cc udp
US 8.8.8.8:53 kkpepo.info udp
US 8.8.8.8:53 aaxsiueoya.info udp
US 8.8.8.8:53 vmribifox.org udp
US 8.8.8.8:53 drigfifox.cc udp
US 8.8.8.8:53 kmnliguiwcymao.info udp
US 8.8.8.8:53 uytcsgeoya.info udp
US 8.8.8.8:53 uglergfqbex.org udp
US 8.8.8.8:53 lxnsdcn.com udp
US 8.8.8.8:53 coxkiueoya.info udp
US 8.8.8.8:53 aqzadkuiwcymao.info udp
US 8.8.8.8:53 yalpjanansnan.org udp
US 8.8.8.8:53 ycokbodsholapet.org udp
US 8.8.8.8:53 yqjswk.net udp
US 8.8.8.8:53 ymxikueoya.net udp
US 8.8.8.8:53 kdrccwnansnan.com udp
US 8.8.8.8:53 ckocgkdsholapet.org udp
US 8.8.8.8:53 swdihk.info udp
US 8.8.8.8:53 qwbbyyeoya.info udp
US 8.8.8.8:53 yndccsdsholapet.cc udp
US 8.8.8.8:53 uvjmhufqbex.org udp
US 8.8.8.8:53 isuufsiugkeq.info udp
US 8.8.8.8:53 ieysqwiq.biz udp
US 8.8.8.8:53 zqhkxgn.cc udp
US 8.8.8.8:53 mqswuwnansnan.org udp
US 8.8.8.8:53 iyyodwiugkeq.info udp
US 8.8.8.8:53 wopkca.info udp
US 8.8.8.8:53 lnhktifox.org udp
US 8.8.8.8:53 fqhkgkn.com udp
US 8.8.8.8:53 ewfahguiwcymao.info udp
US 8.8.8.8:53 qusosiiugkeq.net udp
US 8.8.8.8:53 ovtiuufqbex.cc udp
US 8.8.8.8:53 aqestenansnan.org udp
US 8.8.8.8:53 cymgiwiugkeq.info udp
US 8.8.8.8:53 pvlglcn.com udp
US 8.8.8.8:53 sshljufqbex.org udp
US 8.8.8.8:53 suzcda.net udp
US 8.8.8.8:53 cebszqeoya.info udp
US 8.8.8.8:53 cdnjnanansnan.cc udp
US 8.8.8.8:53 slwcnodsholapet.cc udp
US 8.8.8.8:53 goboncuiwcymao.net udp
US 8.8.8.8:53 uwmzmeiq.net udp
US 8.8.8.8:53 vmgqbsfox.org udp
US 8.8.8.8:53 eeigiwiq.net udp
US 8.8.8.8:53 cyugvwiq.biz udp
US 8.8.8.8:53 yknalenansnan.com udp
US 8.8.8.8:53 lkadhifox.org udp
US 8.8.8.8:53 iuwkfiiugkeq.info udp
US 8.8.8.8:53 qidcqa.net udp
US 8.8.8.8:53 anljvkdsholapet.cc udp
US 8.8.8.8:53 ebaaxanansnan.org udp
US 8.8.8.8:53 satsdueoya.info udp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.179.227:80 c.pki.goog tcp
US 8.8.8.8:53 cgguxsiugkeq.biz udp
US 8.8.8.8:53 vxdaqgn.cc udp
US 8.8.8.8:53 qxkyvwnansnan.org udp
US 8.8.8.8:53 aijneueoya.info udp
US 8.8.8.8:53 qixipa.info udp
US 8.8.8.8:53 oznevadsholapet.org udp
US 8.8.8.8:53 tnrpfkn.cc udp
US 8.8.8.8:53 ikpogcuiwcymao.info udp
US 8.8.8.8:53 syqyiiiugkeq.info udp
US 8.8.8.8:53 bglbscn.org udp
US 8.8.8.8:53 ewgxsodsholapet.cc udp
US 8.8.8.8:53 gahdrueoya.biz udp
US 8.8.8.8:53 kmyjzsiugkeq.net udp
US 8.8.8.8:53 ygxqnanansnan.com udp
US 8.8.8.8:53 fnzyrcn.com udp
US 8.8.8.8:53 oquysiiugkeq.biz udp
US 8.8.8.8:53 smfqaa.info udp
US 8.8.8.8:53 ctjwaanansnan.com udp
US 8.8.8.8:53 hbkjhafox.com udp
US 8.8.8.8:53 yoqcpmiq.biz udp
US 8.8.8.8:53 jjbntsfox.org udp
US 8.8.8.8:53 wigiakdsholapet.com udp
US 8.8.8.8:53 qaygssiugkeq.biz udp
US 8.8.8.8:53 ayfapa.biz udp
US 8.8.8.8:53 ojxqpmnansnan.org udp
US 8.8.8.8:53 rpywjifox.org udp
US 8.8.8.8:53 ggxuesuiwcymao.biz udp
US 8.8.8.8:53 eqlgqueoya.biz udp
US 8.8.8.8:53 abdqbenansnan.com udp
US 8.8.8.8:53 intehufqbex.org udp
US 8.8.8.8:53 ywywjaiq.biz udp
US 8.8.8.8:53 osvvkgeoya.net udp
US 8.8.8.8:53 varbwsn.com udp
US 8.8.8.8:53 rnwslafox.com udp
US 8.8.8.8:53 kwdktk.net udp
US 8.8.8.8:53 katyqkuiwcymao.net udp
US 8.8.8.8:53 mvomnkdsholapet.com udp
US 8.8.8.8:53 mkbuyk.biz udp
US 8.8.8.8:53 seeqxsiugkeq.info udp
US 8.8.8.8:53 jrjyeafox.com udp
US 8.8.8.8:53 gsuivanansnan.cc udp
US 8.8.8.8:53 ymjogcuiwcymao.biz udp
US 8.8.8.8:53 aopcoa.info udp
US 8.8.8.8:53 pyxongn.org udp
US 8.8.8.8:53 wvmqfodsholapet.cc udp
US 8.8.8.8:53 smpsecuiwcymao.info udp
US 8.8.8.8:53 qwffnkdsholapet.cc udp
US 8.8.8.8:53 sbyqaodsholapet.org udp
US 8.8.8.8:53 csvacgeoya.biz udp
US 8.8.8.8:53 mjnmxgfqbex.org udp
US 8.8.8.8:53 ldvhxcn.cc udp
US 8.8.8.8:53 ywsyewiugkeq.biz udp
US 8.8.8.8:53 kklkvguiwcymao.info udp
US 8.8.8.8:53 ynlcxufqbex.cc udp
US 8.8.8.8:53 fzusgafox.com udp
US 8.8.8.8:53 ikmgamiq.net udp
US 8.8.8.8:53 ucdeuqeoya.biz udp
US 8.8.8.8:53 dhhnowfox.org udp
US 8.8.8.8:53 shmdzmnansnan.cc udp
US 8.8.8.8:53 ikahdwiq.net udp
US 8.8.8.8:53 oqbccsuiwcymao.info udp
US 8.8.8.8:53 vmrwksn.cc udp
US 8.8.8.8:53 ymkaaenansnan.org udp
US 8.8.8.8:53 uowhamiq.biz udp
US 8.8.8.8:53 oyiemiiugkeq.net udp
US 8.8.8.8:53 dhxelgn.cc udp
US 8.8.8.8:53 yvjxbqfqbex.com udp
US 8.8.8.8:53 mkfqck.net udp
US 8.8.8.8:53 gcnunkuiwcymao.biz udp
US 8.8.8.8:53 qarebgfqbex.org udp
US 8.8.8.8:53 sgygrenansnan.org udp
US 8.8.8.8:53 wqtpoa.biz udp
US 8.8.8.8:53 uijsocuiwcymao.net udp
US 8.8.8.8:53 inlmngfqbex.cc udp
US 8.8.8.8:53 msgslkdsholapet.cc udp
US 8.8.8.8:53 cmecrwiq.info udp
US 8.8.8.8:53 yswfewiq.biz udp
US 8.8.8.8:53 jllifcn.cc udp
US 8.8.8.8:53 mgiwhkdsholapet.com udp
US 8.8.8.8:53 uqgpuwiugkeq.info udp
US 8.8.8.8:53 acwwdsiugkeq.info udp
US 8.8.8.8:53 vqhxzsfox.com udp
US 8.8.8.8:53 qpmmxodsholapet.org udp
US 8.8.8.8:53 uwvams.net udp
US 8.8.8.8:53 kehoko.biz udp
US 8.8.8.8:53 gujndsdsholapet.org udp
US 8.8.8.8:53 quigcenansnan.com udp
US 8.8.8.8:53 mgjlmcuiwcymao.biz udp
US 8.8.8.8:53 qqbfxqeoya.net udp
US 8.8.8.8:53 lkroxcn.org udp
US 8.8.8.8:53 xiwqrifox.cc udp
US 8.8.8.8:53 saekyaiugkeq.biz udp
US 8.8.8.8:53 wyufiwiugkeq.info udp
US 8.8.8.8:53 zqdppcn.org udp
US 8.8.8.8:53 zmcuawfox.com udp
US 8.8.8.8:53 ccjajs.net udp
US 8.8.8.8:53 oiwkkwiugkeq.biz udp
US 8.8.8.8:53 cvlwyqfqbex.com udp
US 8.8.8.8:53 mmqmdadsholapet.cc udp
US 8.8.8.8:53 akqipmiq.net udp
US 8.8.8.8:53 csrjza.biz udp
US 8.8.8.8:53 irxkesdsholapet.com udp
US 8.8.8.8:53 xedkfkn.cc udp
US 8.8.8.8:53 eyiqmaiq.info udp
US 8.8.8.8:53 uqjcesuiwcymao.biz udp
US 8.8.8.8:53 qfbajkdsholapet.cc udp
US 8.8.8.8:53 gashosdsholapet.cc udp
US 8.8.8.8:53 cakcksiugkeq.net udp
US 8.8.8.8:53 pzfpdsn.com udp
US 8.8.8.8:53 kfjuhyfqbex.com udp
US 8.8.8.8:53 skxmss.net udp
US 8.8.8.8:53 kgjnuo.net udp
US 8.8.8.8:53 garctenansnan.com udp
US 8.8.8.8:53 uqirsadsholapet.cc udp
US 8.8.8.8:53 cehbea.info udp
US 8.8.8.8:53 qyllkyeoya.net udp
US 8.8.8.8:53 ekzmkyfqbex.cc udp
US 8.8.8.8:53 aywzoanansnan.cc udp
US 8.8.8.8:53 eapmoguiwcymao.info udp
US 8.8.8.8:53 qcjisqeoya.net udp
US 8.8.8.8:53 brjarkn.com udp
US 8.8.8.8:53 cvktlsdsholapet.com udp
US 8.8.8.8:53 yslnsa.net udp
US 8.8.8.8:53 iahmhgeoya.biz udp
US 8.8.8.8:53 upbgkkdsholapet.cc udp
US 8.8.8.8:53 rvoqtwfox.com udp
US 8.8.8.8:53 gqlawgeoya.info udp
US 8.8.8.8:53 qymmssiugkeq.net udp
US 8.8.8.8:53 bdfqlcn.cc udp
US 8.8.8.8:53 mohpsgfqbex.org udp
US 8.8.8.8:53 mkxzgo.info udp
US 8.8.8.8:53 wodkgyeoya.net udp
US 8.8.8.8:53 hjhubwfox.cc udp
US 8.8.8.8:53 hfmrgafox.org udp
US 8.8.8.8:53 kapflsuiwcymao.biz udp
US 8.8.8.8:53 aivsdgeoya.biz udp
US 8.8.8.8:53 qprcjadsholapet.org udp
US 8.8.8.8:53 sfwqaanansnan.com udp
US 8.8.8.8:53 ugkjfiiugkeq.info udp
US 8.8.8.8:53 kasatwiq.biz udp
US 8.8.8.8:53 fwdsbsn.cc udp
US 8.8.8.8:53 uqqigwnansnan.com udp
US 8.8.8.8:53 iwqnwaiq.biz udp
US 8.8.8.8:53 oevwwguiwcymao.info udp
US 8.8.8.8:53 vtnwbsn.org udp
US 8.8.8.8:53 drickafox.cc udp
US 8.8.8.8:53 gyfssk.info udp
US 8.8.8.8:53 cgbywgeoya.biz udp
US 8.8.8.8:53 sntqrqfqbex.org udp
US 8.8.8.8:53 keqaqwiugkeq.net udp
US 8.8.8.8:53 ccfqsguiwcymao.biz udp
US 8.8.8.8:53 uudadkdsholapet.cc udp
US 8.8.8.8:53 mkaeumnansnan.org udp
US 8.8.8.8:53 sebihguiwcymao.biz udp
US 8.8.8.8:53 aispkeiq.net udp
US 8.8.8.8:53 yejlkmnansnan.cc udp
US 8.8.8.8:53 cafkbqfqbex.com udp
US 8.8.8.8:53 akrcoueoya.net udp
US 8.8.8.8:53 gwrxykuiwcymao.net udp
US 8.8.8.8:53 xihaywfox.org udp
US 8.8.8.8:53 ilwmradsholapet.org udp
US 8.8.8.8:53 cudclguiwcymao.biz udp
US 8.8.8.8:53 kyliisuiwcymao.net udp
US 8.8.8.8:53 lzripifox.org udp
US 8.8.8.8:53 ggawxkdsholapet.org udp
US 8.8.8.8:53 sevaia.info udp
US 8.8.8.8:53 ggxouqeoya.info udp
US 8.8.8.8:53 qvlkzodsholapet.com udp
US 8.8.8.8:53 rufpjsn.cc udp
US 8.8.8.8:53 yyvilcuiwcymao.biz udp
US 8.8.8.8:53 mariek.info udp
US 8.8.8.8:53 ymxjpgfqbex.com udp
US 8.8.8.8:53 ngzwjcn.com udp
US 8.8.8.8:53 eajoyueoya.net udp
US 8.8.8.8:53 aqbzwguiwcymao.info udp
US 8.8.8.8:53 nkjgnkn.com udp
US 8.8.8.8:53 gksugsdsholapet.cc udp
US 8.8.8.8:53 ywebbeiq.biz udp
US 8.8.8.8:53 iibjso.net udp
US 8.8.8.8:53 opnanmnansnan.cc udp
US 8.8.8.8:53 duwwfafox.cc udp
US 8.8.8.8:53 sotaiqeoya.info udp
US 8.8.8.8:53 ackuwwiugkeq.biz udp
US 8.8.8.8:53 gmzppyfqbex.org udp
US 8.8.8.8:53 icpliqeoya.biz udp
US 8.8.8.8:53 gcxmzs.info udp
US 8.8.8.8:53 aetgpyfqbex.cc udp
US 8.8.8.8:53 fmgdnwfox.org udp
US 8.8.8.8:53 amdgqkuiwcymao.biz udp
US 8.8.8.8:53 gqqahaiugkeq.info udp
US 8.8.8.8:53 stfmbenansnan.org udp
US 8.8.8.8:53 fxnvcgn.com udp
US 8.8.8.8:53 okecyiiugkeq.net udp
US 8.8.8.8:53 msveigeoya.biz udp
US 8.8.8.8:53 jehmxgn.org udp
US 8.8.8.8:53 sdyriwnansnan.com udp
US 8.8.8.8:53 mahfmsuiwcymao.biz udp
US 8.8.8.8:53 eqrvoueoya.net udp
US 8.8.8.8:53 kbzwdkdsholapet.cc udp
US 8.8.8.8:53 zgduzgn.com udp
US 8.8.8.8:53 mwxclueoya.biz udp
US 8.8.8.8:53 qcklsmiq.net udp
US 8.8.8.8:53 kxdwqgfqbex.com udp
US 8.8.8.8:53 wrlndgfqbex.cc udp
US 8.8.8.8:53 kolkhguiwcymao.net udp
US 8.8.8.8:53 ccfocqeoya.info udp
US 8.8.8.8:53 iqlrwwnansnan.org udp
US 8.8.8.8:53 sdmumadsholapet.com udp
US 8.8.8.8:53 kqowieiq.biz udp
US 8.8.8.8:53 wcxwacuiwcymao.biz udp
US 8.8.8.8:53 yphvdyfqbex.cc udp
US 8.8.8.8:53 vbmgnafox.com udp
US 8.8.8.8:53 qgnfmgeoya.biz udp
US 8.8.8.8:53 gwtjza.info udp
US 8.8.8.8:53 lohutkn.com udp
US 8.8.8.8:53 xdngzcn.com udp
US 8.8.8.8:53 gaycpaiq.net udp
US 8.8.8.8:53 oorjesuiwcymao.biz udp
US 8.8.8.8:53 rulrusfox.com udp
US 8.8.8.8:53 gjwkhadsholapet.org udp
US 8.8.8.8:53 watgjgeoya.info udp
US 8.8.8.8:53 muipuaiq.info udp
US 8.8.8.8:53 dszijcn.com udp
US 8.8.8.8:53 pcholkn.org udp
US 8.8.8.8:53 oqbahqeoya.net udp
US 8.8.8.8:53 oljgxadsholapet.cc udp
US 8.8.8.8:53 vkygxifox.org udp
US 8.8.8.8:53 coxumyeoya.net udp
US 8.8.8.8:53 guesgsiugkeq.biz udp
US 8.8.8.8:53 mdfgmmnansnan.cc udp
US 8.8.8.8:53 ejkfkodsholapet.com udp
US 8.8.8.8:53 uwsunmiq.biz udp
US 8.8.8.8:53 qogipaiq.biz udp
US 8.8.8.8:53 altqradsholapet.cc udp
US 8.8.8.8:53 uodypqfqbex.com udp
US 8.8.8.8:53 imnargeoya.net udp
US 8.8.8.8:53 sqcpjmiq.net udp
US 8.8.8.8:53 cclwradsholapet.cc udp
US 8.8.8.8:53 fzwmpwfox.org udp
US 8.8.8.8:53 owztakuiwcymao.net udp
US 8.8.8.8:53 ycdoeqeoya.biz udp
US 8.8.8.8:53 mvzgvgfqbex.cc udp
US 8.8.8.8:53 ehqvnanansnan.com udp
US 8.8.8.8:53 kuuyeaiugkeq.net udp
US 8.8.8.8:53 agdcas.net udp
US 8.8.8.8:53 arhezenansnan.com udp
US 8.8.8.8:53 mdenqadsholapet.org udp
US 8.8.8.8:53 eqoygeiq.biz udp
US 8.8.8.8:53 kqvomo.net udp
US 8.8.8.8:53 gsxwoodsholapet.cc udp
US 8.8.8.8:53 yhvtlgfqbex.com udp
US 8.8.8.8:53 cwruns.biz udp
US 8.8.8.8:53 ewrgra.info udp
US 8.8.8.8:53 jbhtfgn.org udp
US 8.8.8.8:53 vhhyksn.cc udp
US 8.8.8.8:53 yadxsa.biz udp
US 8.8.8.8:53 icucymiq.info udp
US 8.8.8.8:53 capnvyfqbex.com udp
US 8.8.8.8:53 gzycfanansnan.cc udp
US 8.8.8.8:53 qcewewiq.info udp
US 8.8.8.8:53 syktjaiugkeq.net udp
US 8.8.8.8:53 jozwzafox.com udp
US 8.8.8.8:53 gpwspmnansnan.cc udp
US 8.8.8.8:53 mqgsxaiugkeq.net udp
US 8.8.8.8:53 yopkua.info udp
US 8.8.8.8:53 ndvcrgn.cc udp
US 8.8.8.8:53 yxuqqadsholapet.org udp
US 8.8.8.8:53 munmnkdsholapet.com udp
US 8.8.8.8:53 ttzwcgn.cc udp
US 8.8.8.8:53 emuqzwiq.biz udp
US 8.8.8.8:53 giegosiugkeq.info udp
US 8.8.8.8:53 pmxxgifox.org udp
US 8.8.8.8:53 oceunkdsholapet.com udp
US 8.8.8.8:53 asvxhs.biz udp
US 8.8.8.8:53 ugjlekuiwcymao.net udp
US 8.8.8.8:53 schwyadsholapet.org udp
US 8.8.8.8:53 tjawhwfox.cc udp
US 8.8.8.8:53 yobeuyeoya.info udp
US 8.8.8.8:53 gexcoyeoya.net udp
US 8.8.8.8:53 ltptvafox.org udp
US 8.8.8.8:53 tfbinkn.com udp
US 8.8.8.8:53 mqrypqeoya.info udp
US 8.8.8.8:53 ccfbrueoya.biz udp
US 8.8.8.8:53 wxfsuenansnan.com udp
US 8.8.8.8:53 jfmqhafox.com udp
US 8.8.8.8:53 mebmdk.info udp
US 8.8.8.8:53 aifbmguiwcymao.biz udp
US 8.8.8.8:53 rgpgnwfox.org udp
US 8.8.8.8:53 mlocqadsholapet.com udp
US 8.8.8.8:53 mcjqmueoya.net udp

Files

C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe

MD5 a3492b467622a421ab2ff18ba2762c53
SHA1 2e6963888847f0e70d9efe6c99b6cfe3d1b0e1e0
SHA256 062efd6997c37d42c5394912d2a59a4105cf789c90824cf56a7dd64569f973fd
SHA512 deb864b71ac1c1b3b65642d5af2f3e82ec3430dedda24a3abe2ec19425c6b1c1aa963d9e8bb60fe9a29228448a50a6392a7899434ba9e500a3ea13f958866a32

C:\Windows\SysWOW64\ibtlhyskeqjjmaibqh.exe

MD5 b290c6025c5e02a99bb372986a2c07e4
SHA1 c12b76f3eac05a2e8df90c618c703e7edfff5d89
SHA256 79f662e4967afa18a37082fbfd8ce704e079f47458569fdda125354d5beb1c33
SHA512 30b68aebc967dec32d4203b8aebbae942e5dbbf8f1b780129e56c2ddd6c030fe8131d46504f45c757a73e4920ba32bf2135426d6af449bf9ae102d49712fea10

C:\Users\Admin\AppData\Local\vbgluyfkrqwjzavbdhhnsxgkrwd.ivl

MD5 7c244050987f5d57db23fed69af4d9eb
SHA1 29726489d1d266c5d1da89d4ac559fc91c55ec77
SHA256 547c247abbae6c22ea0ebb002c83ef9bbc36eab2a5c4591437a18928e2dc0145
SHA512 ea8a3e257a82934664f2ed9166861e772823e5131eab3095e48939e51b73b30f31f3e7c1ff33a69d23e8e6e278b044c3dcace90d0d6eb2745eb45ec03d44e588

C:\Users\Admin\AppData\Local\sjzpjyqgyizxykqhujulbrlasiakbzamsjwlwn.tnc

MD5 69427f933e4491f292655d1f0a535f30
SHA1 43f2c1e3d53410b4f417197984654eeb8ba73cbc
SHA256 9ffc3048922cd7f689a27dc4da040eebc5c23a5f2dda6d1c7962c449f974a6be
SHA512 4e35eaf1bc3027a2a52949438da8afe346968e5da1feca64b7d805dfe29e8a091f0ecb0d1349f32af70e70697e60e643fb2e7798ea60cda65cc7f3bb09d399a8

memory/6820-191-0x0000000000400000-0x0000000000483000-memory.dmp

memory/4164-192-0x00007FF61F380000-0x00007FF61F3E7000-memory.dmp

memory/2980-193-0x00007FF61F380000-0x00007FF61F3E7000-memory.dmp

memory/6268-194-0x0000000000400000-0x0000000000483000-memory.dmp

memory/12084-196-0x00007FF8D8BF0000-0x00007FF8D8C49000-memory.dmp

memory/11964-197-0x0000000000400000-0x0000000000483000-memory.dmp

memory/10928-195-0x0000000000400000-0x0000000000483000-memory.dmp

memory/10296-198-0x0000000000400000-0x0000000000483000-memory.dmp

memory/11304-200-0x0000000000400000-0x0000000000456000-memory.dmp

memory/6928-199-0x0000000000400000-0x0000000000483000-memory.dmp

memory/7888-201-0x0000000000400000-0x0000000000483000-memory.dmp