Analysis Overview
SHA256
79f662e4967afa18a37082fbfd8ce704e079f47458569fdda125354d5beb1c33
Threat Level: Known bad
The file JaffaCakes118_b290c6025c5e02a99bb372986a2c07e4 was found to be: Known bad.
Malicious Activity Summary
Pykspa family
UAC bypass
Modifies WinLogon for persistence
Pykspa
Detect Pykspa worm
Adds policy Run key to start application
Checks computer location settings
Executes dropped EXE
Checks whether UAC is enabled
Looks up external IP address via web service
Adds Run key to start application
Drops file in System32 directory
Drops file in Windows directory
Unsigned PE
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
System policy modification
MITRE ATT&CK
Enterprise Matrix V16
Analysis: static1
Detonation Overview
Reported
2025-04-12 14:42
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2025-04-12 14:42
Reported
2025-04-12 14:45
Platform
win10v2004-20250410-en
Max time kernel
149s
Max time network
151s
Command Line
Signatures
Modifies WinLogon for persistence
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
Pykspa
Pykspa family
UAC bypass
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
Detect Pykspa worm
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Adds policy Run key to start application
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\irzhtaks = "gbvpngcwsgbdiyiduncx.exe" | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b290c6025c5e02a99bb372986a2c07e4.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Control Panel\International\Geo\Nation | C:\Windows\tngzwojcxkefjyhbrjx.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
| N/A | N/A | C:\Windows\tngzwojcxkefjyhbrjx.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
| N/A | N/A | C:\Windows\ibtlhyskeqjjmaibqh.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gntzjo = "tngzwojcxkefjyhbrjx.exe" | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tbipagp = "ibtlhyskeqjjmaibqh.exe ." | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zjsbowhqb = "tngzwojcxkefjyhbrjx.exe" | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
Checks whether UAC is enabled
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | whatismyip.everdot.org | N/A | N/A |
| N/A | www.whatismyip.ca | N/A | N/A |
| N/A | www.whatismyip.ca | N/A | N/A |
| N/A | whatismyip.everdot.org | N/A | N/A |
| N/A | www.whatismyip.ca | N/A | N/A |
| N/A | www.whatismyip.ca | N/A | N/A |
| N/A | www.whatismyip.ca | N/A | N/A |
| N/A | whatismyipaddress.com | N/A | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\SysWOW64\ibtlhyskeqjjmaibqh.exe | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\ibtlhyskeqjjmaibqh.exe | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
| File created | C:\Windows\SysWOW64\gbvpngcwsgbdiyiduncx.exe | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\gbvpngcwsgbdiyiduncx.exe | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
| File created | C:\Windows\SysWOW64\vrmhgaxspeadjalhztjfa.exe | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
| File created | C:\Windows\SysWOW64\sjzpjyqgyizxykqh.exe | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
| File created | C:\Windows\SysWOW64\zrizukdunyqpreldr.exe | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\zrizukdunyqpreldr.exe | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
| File created | C:\Windows\SysWOW64\tngzwojcxkefjyhbrjx.exe | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\tngzwojcxkefjyhbrjx.exe | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\vrmhgaxspeadjalhztjfa.exe | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
| File created | C:\Windows\SysWOW64\mjfbbwuqoebfmeqngbsplh.exe | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\mjfbbwuqoebfmeqngbsplh.exe | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\sjzpjyqgyizxykqh.exe | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\zrizukdunyqpreldr.exe | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
| File created | C:\Windows\ibtlhyskeqjjmaibqh.exe | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
| File created | C:\Windows\tngzwojcxkefjyhbrjx.exe | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
| File opened for modification | C:\Windows\tngzwojcxkefjyhbrjx.exe | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
| File created | C:\Windows\gbvpngcwsgbdiyiduncx.exe | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
| File created | C:\Windows\vrmhgaxspeadjalhztjfa.exe | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
| File created | C:\Windows\mjfbbwuqoebfmeqngbsplh.exe | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
| File created | C:\Windows\sjzpjyqgyizxykqh.exe | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
| File created | C:\Windows\zrizukdunyqpreldr.exe | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
| File opened for modification | C:\Windows\ibtlhyskeqjjmaibqh.exe | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
| File opened for modification | C:\Windows\gbvpngcwsgbdiyiduncx.exe | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
| File opened for modification | C:\Windows\vrmhgaxspeadjalhztjfa.exe | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
| File opened for modification | C:\Windows\mjfbbwuqoebfmeqngbsplh.exe | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
| File opened for modification | C:\Windows\sjzpjyqgyizxykqh.exe | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\tngzwojcxkefjyhbrjx.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\ibtlhyskeqjjmaibqh.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b290c6025c5e02a99bb372986a2c07e4.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b290c6025c5e02a99bb372986a2c07e4.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b290c6025c5e02a99bb372986a2c07e4.exe | N/A |
| N/A | N/A | C:\Windows\tngzwojcxkefjyhbrjx.exe | N/A |
| N/A | N/A | C:\Windows\tngzwojcxkefjyhbrjx.exe | N/A |
Suspicious use of WriteProcessMemory
System policy modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" | C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b290c6025c5e02a99bb372986a2c07e4.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b290c6025c5e02a99bb372986a2c07e4.exe"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\jaffacakes118_b290c6025c5e02a99bb372986a2c07e4.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe
C:\Windows\tngzwojcxkefjyhbrjx.exe
tngzwojcxkefjyhbrjx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*"
C:\Windows\ibtlhyskeqjjmaibqh.exe
ibtlhyskeqjjmaibqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .
C:\Windows\vrmhgaxspeadjalhztjfa.exe
vrmhgaxspeadjalhztjfa.exe .
C:\Windows\tngzwojcxkefjyhbrjx.exe
tngzwojcxkefjyhbrjx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*"
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .
C:\Users\Admin\AppData\Local\Temp\jxkxoapcrymhf.exe
"C:\Users\Admin\AppData\Local\Temp\jxkxoapcrymhf.exe" "-c:\users\admin\appdata\local\temp\jaffacakes118_b290c6025c5e02a99bb372986a2c07e4.exe"
C:\Users\Admin\AppData\Local\Temp\jxkxoapcrymhf.exe
"C:\Users\Admin\AppData\Local\Temp\jxkxoapcrymhf.exe" "-c:\users\admin\appdata\local\temp\jaffacakes118_b290c6025c5e02a99bb372986a2c07e4.exe"
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe
C:\Windows\ibtlhyskeqjjmaibqh.exe
ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .
C:\Windows\sjzpjyqgyizxykqh.exe
sjzpjyqgyizxykqh.exe .
C:\Windows\tngzwojcxkefjyhbrjx.exe
tngzwojcxkefjyhbrjx.exe
C:\Windows\sjzpjyqgyizxykqh.exe
sjzpjyqgyizxykqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe
C:\Windows\ibtlhyskeqjjmaibqh.exe
ibtlhyskeqjjmaibqh.exe
C:\Windows\zrizukdunyqpreldr.exe
zrizukdunyqpreldr.exe
C:\Windows\zrizukdunyqpreldr.exe
zrizukdunyqpreldr.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe .
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*."
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Windows\zrizukdunyqpreldr.exe
zrizukdunyqpreldr.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\gbvpngcwsgbdiyiduncx.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\gbvpngcwsgbdiyiduncx.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .
C:\Windows\gbvpngcwsgbdiyiduncx.exe
gbvpngcwsgbdiyiduncx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe
C:\Windows\vrmhgaxspeadjalhztjfa.exe
vrmhgaxspeadjalhztjfa.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe
C:\Windows\sjzpjyqgyizxykqh.exe
sjzpjyqgyizxykqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Windows\tngzwojcxkefjyhbrjx.exe
tngzwojcxkefjyhbrjx.exe .
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\gbvpngcwsgbdiyiduncx.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*."
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*"
C:\Windows\gbvpngcwsgbdiyiduncx.exe
gbvpngcwsgbdiyiduncx.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*."
C:\Windows\vrmhgaxspeadjalhztjfa.exe
vrmhgaxspeadjalhztjfa.exe
C:\Windows\gbvpngcwsgbdiyiduncx.exe
gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*"
C:\Windows\vrmhgaxspeadjalhztjfa.exe
vrmhgaxspeadjalhztjfa.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\gbvpngcwsgbdiyiduncx.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .
C:\Windows\vrmhgaxspeadjalhztjfa.exe
vrmhgaxspeadjalhztjfa.exe .
C:\Windows\zrizukdunyqpreldr.exe
zrizukdunyqpreldr.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*"
C:\Windows\gbvpngcwsgbdiyiduncx.exe
gbvpngcwsgbdiyiduncx.exe .
C:\Windows\sjzpjyqgyizxykqh.exe
sjzpjyqgyizxykqh.exe .
C:\Windows\zrizukdunyqpreldr.exe
zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\gbvpngcwsgbdiyiduncx.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*."
C:\Windows\sjzpjyqgyizxykqh.exe
sjzpjyqgyizxykqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\gbvpngcwsgbdiyiduncx.exe*."
C:\Windows\vrmhgaxspeadjalhztjfa.exe
vrmhgaxspeadjalhztjfa.exe .
C:\Windows\zrizukdunyqpreldr.exe
zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Windows\vrmhgaxspeadjalhztjfa.exe
vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*"
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe .
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Windows\sjzpjyqgyizxykqh.exe
sjzpjyqgyizxykqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Windows\tngzwojcxkefjyhbrjx.exe
tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Windows\tngzwojcxkefjyhbrjx.exe
tngzwojcxkefjyhbrjx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*."
C:\Windows\sjzpjyqgyizxykqh.exe
sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .
C:\Windows\zrizukdunyqpreldr.exe
zrizukdunyqpreldr.exe .
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*"
C:\Windows\zrizukdunyqpreldr.exe
zrizukdunyqpreldr.exe .
C:\Windows\vrmhgaxspeadjalhztjfa.exe
vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*."
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\gbvpngcwsgbdiyiduncx.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*."
C:\Windows\sjzpjyqgyizxykqh.exe
sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*."
C:\Windows\tngzwojcxkefjyhbrjx.exe
tngzwojcxkefjyhbrjx.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .
C:\Windows\vrmhgaxspeadjalhztjfa.exe
vrmhgaxspeadjalhztjfa.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Windows\gbvpngcwsgbdiyiduncx.exe
gbvpngcwsgbdiyiduncx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe .
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .
C:\Windows\tngzwojcxkefjyhbrjx.exe
tngzwojcxkefjyhbrjx.exe
C:\Windows\tngzwojcxkefjyhbrjx.exe
tngzwojcxkefjyhbrjx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Windows\tngzwojcxkefjyhbrjx.exe
tngzwojcxkefjyhbrjx.exe
C:\Windows\tngzwojcxkefjyhbrjx.exe
tngzwojcxkefjyhbrjx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe .
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*."
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\gbvpngcwsgbdiyiduncx.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*"
C:\Windows\vrmhgaxspeadjalhztjfa.exe
vrmhgaxspeadjalhztjfa.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\gbvpngcwsgbdiyiduncx.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*."
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*"
C:\Windows\zrizukdunyqpreldr.exe
zrizukdunyqpreldr.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe
C:\Windows\gbvpngcwsgbdiyiduncx.exe
gbvpngcwsgbdiyiduncx.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .
C:\Windows\vrmhgaxspeadjalhztjfa.exe
vrmhgaxspeadjalhztjfa.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*"
C:\Windows\vrmhgaxspeadjalhztjfa.exe
vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\gbvpngcwsgbdiyiduncx.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*"
C:\Windows\tngzwojcxkefjyhbrjx.exe
tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*."
C:\Windows\ibtlhyskeqjjmaibqh.exe
ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe .
C:\Windows\ibtlhyskeqjjmaibqh.exe
ibtlhyskeqjjmaibqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Windows\zrizukdunyqpreldr.exe
zrizukdunyqpreldr.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .
C:\Windows\gbvpngcwsgbdiyiduncx.exe
gbvpngcwsgbdiyiduncx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe
C:\Windows\sjzpjyqgyizxykqh.exe
sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe .
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .
C:\Windows\gbvpngcwsgbdiyiduncx.exe
gbvpngcwsgbdiyiduncx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Windows\sjzpjyqgyizxykqh.exe
sjzpjyqgyizxykqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Windows\zrizukdunyqpreldr.exe
zrizukdunyqpreldr.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .
C:\Windows\ibtlhyskeqjjmaibqh.exe
ibtlhyskeqjjmaibqh.exe .
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Windows\ibtlhyskeqjjmaibqh.exe
ibtlhyskeqjjmaibqh.exe
C:\Windows\vrmhgaxspeadjalhztjfa.exe
vrmhgaxspeadjalhztjfa.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\gbvpngcwsgbdiyiduncx.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Windows\tngzwojcxkefjyhbrjx.exe
tngzwojcxkefjyhbrjx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*"
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\gbvpngcwsgbdiyiduncx.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*."
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Windows\sjzpjyqgyizxykqh.exe
sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe
C:\Windows\vrmhgaxspeadjalhztjfa.exe
vrmhgaxspeadjalhztjfa.exe .
C:\Windows\vrmhgaxspeadjalhztjfa.exe
vrmhgaxspeadjalhztjfa.exe
C:\Windows\ibtlhyskeqjjmaibqh.exe
ibtlhyskeqjjmaibqh.exe .
C:\Windows\gbvpngcwsgbdiyiduncx.exe
gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Windows\sjzpjyqgyizxykqh.exe
sjzpjyqgyizxykqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe .
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Windows\gbvpngcwsgbdiyiduncx.exe
gbvpngcwsgbdiyiduncx.exe .
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Windows\sjzpjyqgyizxykqh.exe
sjzpjyqgyizxykqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*"
C:\Windows\vrmhgaxspeadjalhztjfa.exe
vrmhgaxspeadjalhztjfa.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\gbvpngcwsgbdiyiduncx.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe .
C:\Windows\ibtlhyskeqjjmaibqh.exe
ibtlhyskeqjjmaibqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .
C:\Windows\tngzwojcxkefjyhbrjx.exe
tngzwojcxkefjyhbrjx.exe .
C:\Windows\ibtlhyskeqjjmaibqh.exe
ibtlhyskeqjjmaibqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\gbvpngcwsgbdiyiduncx.exe*"
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Windows\vrmhgaxspeadjalhztjfa.exe
vrmhgaxspeadjalhztjfa.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*."
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Windows\tngzwojcxkefjyhbrjx.exe
tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*"
C:\Windows\sjzpjyqgyizxykqh.exe
sjzpjyqgyizxykqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .
C:\Windows\vrmhgaxspeadjalhztjfa.exe
vrmhgaxspeadjalhztjfa.exe .
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Windows\gbvpngcwsgbdiyiduncx.exe
gbvpngcwsgbdiyiduncx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*"
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Windows\ibtlhyskeqjjmaibqh.exe
ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Windows\ibtlhyskeqjjmaibqh.exe
ibtlhyskeqjjmaibqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*."
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*"
C:\Windows\zrizukdunyqpreldr.exe
zrizukdunyqpreldr.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*."
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe
C:\Windows\tngzwojcxkefjyhbrjx.exe
tngzwojcxkefjyhbrjx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*."
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\gbvpngcwsgbdiyiduncx.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\gbvpngcwsgbdiyiduncx.exe*."
C:\Windows\ibtlhyskeqjjmaibqh.exe
ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\gbvpngcwsgbdiyiduncx.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Windows\zrizukdunyqpreldr.exe
zrizukdunyqpreldr.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*."
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*."
C:\Windows\gbvpngcwsgbdiyiduncx.exe
gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe .
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\gbvpngcwsgbdiyiduncx.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\gbvpngcwsgbdiyiduncx.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Windows\tngzwojcxkefjyhbrjx.exe
tngzwojcxkefjyhbrjx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*"
C:\Windows\tngzwojcxkefjyhbrjx.exe
tngzwojcxkefjyhbrjx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe .
C:\Windows\tngzwojcxkefjyhbrjx.exe
tngzwojcxkefjyhbrjx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .
C:\Windows\gbvpngcwsgbdiyiduncx.exe
gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .
C:\Windows\ibtlhyskeqjjmaibqh.exe
ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .
C:\Windows\ibtlhyskeqjjmaibqh.exe
ibtlhyskeqjjmaibqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*"
C:\Windows\zrizukdunyqpreldr.exe
zrizukdunyqpreldr.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*."
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\gbvpngcwsgbdiyiduncx.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\gbvpngcwsgbdiyiduncx.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*"
C:\Windows\ibtlhyskeqjjmaibqh.exe
ibtlhyskeqjjmaibqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\gbvpngcwsgbdiyiduncx.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Windows\tngzwojcxkefjyhbrjx.exe
tngzwojcxkefjyhbrjx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe .
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Windows\zrizukdunyqpreldr.exe
zrizukdunyqpreldr.exe .
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Windows\sjzpjyqgyizxykqh.exe
sjzpjyqgyizxykqh.exe
C:\Windows\ibtlhyskeqjjmaibqh.exe
ibtlhyskeqjjmaibqh.exe
C:\Windows\sjzpjyqgyizxykqh.exe
sjzpjyqgyizxykqh.exe .
C:\Windows\ibtlhyskeqjjmaibqh.exe
ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Windows\gbvpngcwsgbdiyiduncx.exe
gbvpngcwsgbdiyiduncx.exe .
C:\Windows\tngzwojcxkefjyhbrjx.exe
tngzwojcxkefjyhbrjx.exe .
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\gbvpngcwsgbdiyiduncx.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\gbvpngcwsgbdiyiduncx.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .
C:\Windows\gbvpngcwsgbdiyiduncx.exe
gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*."
C:\Windows\ibtlhyskeqjjmaibqh.exe
ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Windows\tngzwojcxkefjyhbrjx.exe
tngzwojcxkefjyhbrjx.exe .
C:\Windows\sjzpjyqgyizxykqh.exe
sjzpjyqgyizxykqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*."
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Windows\ibtlhyskeqjjmaibqh.exe
ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Windows\tngzwojcxkefjyhbrjx.exe
tngzwojcxkefjyhbrjx.exe .
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .
C:\Windows\tngzwojcxkefjyhbrjx.exe
tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe
C:\Windows\sjzpjyqgyizxykqh.exe
sjzpjyqgyizxykqh.exe .
C:\Windows\sjzpjyqgyizxykqh.exe
sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .
C:\Windows\zrizukdunyqpreldr.exe
zrizukdunyqpreldr.exe .
C:\Windows\vrmhgaxspeadjalhztjfa.exe
vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Windows\sjzpjyqgyizxykqh.exe
sjzpjyqgyizxykqh.exe .
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Windows\tngzwojcxkefjyhbrjx.exe
tngzwojcxkefjyhbrjx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*"
C:\Windows\vrmhgaxspeadjalhztjfa.exe
vrmhgaxspeadjalhztjfa.exe .
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\gbvpngcwsgbdiyiduncx.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe .
C:\Windows\sjzpjyqgyizxykqh.exe
sjzpjyqgyizxykqh.exe .
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe
C:\Windows\sjzpjyqgyizxykqh.exe
sjzpjyqgyizxykqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .
C:\Windows\vrmhgaxspeadjalhztjfa.exe
vrmhgaxspeadjalhztjfa.exe
C:\Windows\tngzwojcxkefjyhbrjx.exe
tngzwojcxkefjyhbrjx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Windows\vrmhgaxspeadjalhztjfa.exe
vrmhgaxspeadjalhztjfa.exe
C:\Windows\tngzwojcxkefjyhbrjx.exe
tngzwojcxkefjyhbrjx.exe
C:\Windows\gbvpngcwsgbdiyiduncx.exe
gbvpngcwsgbdiyiduncx.exe .
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\gbvpngcwsgbdiyiduncx.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\gbvpngcwsgbdiyiduncx.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\gbvpngcwsgbdiyiduncx.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*"
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe .
C:\Windows\vrmhgaxspeadjalhztjfa.exe
vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe .
C:\Windows\ibtlhyskeqjjmaibqh.exe
ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\gbvpngcwsgbdiyiduncx.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\gbvpngcwsgbdiyiduncx.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*."
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe
C:\Windows\vrmhgaxspeadjalhztjfa.exe
vrmhgaxspeadjalhztjfa.exe .
C:\Windows\zrizukdunyqpreldr.exe
zrizukdunyqpreldr.exe
C:\Windows\ibtlhyskeqjjmaibqh.exe
ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Windows\zrizukdunyqpreldr.exe
zrizukdunyqpreldr.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .
C:\Windows\zrizukdunyqpreldr.exe
zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Windows\zrizukdunyqpreldr.exe
zrizukdunyqpreldr.exe .
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .
C:\Windows\ibtlhyskeqjjmaibqh.exe
ibtlhyskeqjjmaibqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe .
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Windows\gbvpngcwsgbdiyiduncx.exe
gbvpngcwsgbdiyiduncx.exe .
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\gbvpngcwsgbdiyiduncx.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Windows\ibtlhyskeqjjmaibqh.exe
ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Windows\tngzwojcxkefjyhbrjx.exe
tngzwojcxkefjyhbrjx.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*"
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Windows\vrmhgaxspeadjalhztjfa.exe
vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Windows\zrizukdunyqpreldr.exe
zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Windows\ibtlhyskeqjjmaibqh.exe
ibtlhyskeqjjmaibqh.exe .
C:\Windows\gbvpngcwsgbdiyiduncx.exe
gbvpngcwsgbdiyiduncx.exe
C:\Windows\sjzpjyqgyizxykqh.exe
sjzpjyqgyizxykqh.exe .
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .
C:\Windows\ibtlhyskeqjjmaibqh.exe
ibtlhyskeqjjmaibqh.exe
C:\Windows\sjzpjyqgyizxykqh.exe
sjzpjyqgyizxykqh.exe .
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .
C:\Windows\tngzwojcxkefjyhbrjx.exe
tngzwojcxkefjyhbrjx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Windows\ibtlhyskeqjjmaibqh.exe
ibtlhyskeqjjmaibqh.exe .
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .
C:\Windows\sjzpjyqgyizxykqh.exe
sjzpjyqgyizxykqh.exe .
C:\Windows\zrizukdunyqpreldr.exe
zrizukdunyqpreldr.exe
C:\Windows\tngzwojcxkefjyhbrjx.exe
tngzwojcxkefjyhbrjx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Windows\sjzpjyqgyizxykqh.exe
sjzpjyqgyizxykqh.exe
C:\Windows\ibtlhyskeqjjmaibqh.exe
ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .
C:\Windows\sjzpjyqgyizxykqh.exe
sjzpjyqgyizxykqh.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe .
C:\Windows\sjzpjyqgyizxykqh.exe
sjzpjyqgyizxykqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe .
C:\Windows\zrizukdunyqpreldr.exe
zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\gbvpngcwsgbdiyiduncx.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\gbvpngcwsgbdiyiduncx.exe*."
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\sjzpjyqgyizxykqh.exe*."
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\sjzpjyqgyizxykqh.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\tngzwojcxkefjyhbrjx.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*"
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .
C:\Windows\zrizukdunyqpreldr.exe
zrizukdunyqpreldr.exe
C:\Windows\vrmhgaxspeadjalhztjfa.exe
vrmhgaxspeadjalhztjfa.exe .
C:\Windows\ibtlhyskeqjjmaibqh.exe
ibtlhyskeqjjmaibqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*"
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Windows\ibtlhyskeqjjmaibqh.exe
ibtlhyskeqjjmaibqh.exe
C:\Windows\vrmhgaxspeadjalhztjfa.exe
vrmhgaxspeadjalhztjfa.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\vrmhgaxspeadjalhztjfa.exe*."
C:\Windows\vrmhgaxspeadjalhztjfa.exe
vrmhgaxspeadjalhztjfa.exe .
C:\Windows\tngzwojcxkefjyhbrjx.exe
tngzwojcxkefjyhbrjx.exe .
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Windows\sjzpjyqgyizxykqh.exe
sjzpjyqgyizxykqh.exe
C:\Windows\zrizukdunyqpreldr.exe
zrizukdunyqpreldr.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*"
C:\Windows\gbvpngcwsgbdiyiduncx.exe
gbvpngcwsgbdiyiduncx.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\vrmhgaxspeadjalhztjfa.exe*."
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Windows\ibtlhyskeqjjmaibqh.exe
ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Windows\ibtlhyskeqjjmaibqh.exe
ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\ibtlhyskeqjjmaibqh.exe*"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sjzpjyqgyizxykqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c zrizukdunyqpreldr.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c gbvpngcwsgbdiyiduncx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sjzpjyqgyizxykqh.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*"
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Users\Admin\AppData\Local\Temp\zrizukdunyqpreldr.exe
C:\Windows\ibtlhyskeqjjmaibqh.exe
ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*."
C:\Windows\sjzpjyqgyizxykqh.exe
sjzpjyqgyizxykqh.exe .
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Users\Admin\AppData\Local\Temp\tngzwojcxkefjyhbrjx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe .
C:\Windows\tngzwojcxkefjyhbrjx.exe
tngzwojcxkefjyhbrjx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c tngzwojcxkefjyhbrjx.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vrmhgaxspeadjalhztjfa.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ibtlhyskeqjjmaibqh.exe
C:\Windows\ibtlhyskeqjjmaibqh.exe
ibtlhyskeqjjmaibqh.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vrmhgaxspeadjalhztjfa.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\ibtlhyskeqjjmaibqh.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\zrizukdunyqpreldr.exe*"
C:\Windows\gbvpngcwsgbdiyiduncx.exe
gbvpngcwsgbdiyiduncx.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*"
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe
C:\Users\Admin\AppData\Local\Temp\gbvpngcwsgbdiyiduncx.exe .
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\users\admin\appdata\local\temp\tngzwojcxkefjyhbrjx.exe*"
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
"C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe" "c:\windows\zrizukdunyqpreldr.exe*"
Network
| Country | Destination | Domain | Proto |
| GB | 88.221.134.249:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | www.whatismyip.ca | udp |
| US | 8.8.8.8:53 | www.whatismyip.com | udp |
| US | 172.66.40.87:80 | www.whatismyip.com | tcp |
| US | 8.8.8.8:53 | www.whatismyip.ca | udp |
| US | 8.8.8.8:53 | whatismyipaddress.com | udp |
| US | 104.19.223.79:80 | whatismyipaddress.com | tcp |
| US | 104.19.223.79:80 | whatismyipaddress.com | tcp |
| US | 172.66.40.87:80 | www.whatismyip.com | tcp |
| US | 8.8.8.8:53 | whatismyip.everdot.org | udp |
| US | 8.8.8.8:53 | www.whatismyip.ca | udp |
| US | 172.66.40.87:80 | www.whatismyip.com | tcp |
| US | 8.8.8.8:53 | www.whatismyip.ca | udp |
| US | 8.8.8.8:53 | whatismyip.everdot.org | udp |
| US | 104.19.223.79:80 | whatismyipaddress.com | tcp |
| US | 104.19.223.79:80 | whatismyipaddress.com | tcp |
| US | 8.8.8.8:53 | www.whatismyip.ca | udp |
| US | 8.8.8.8:53 | www.google.com | udp |
| GB | 216.58.204.68:80 | www.google.com | tcp |
| AU | 218.100.81.0:3432 | tcp | |
| US | 8.8.8.8:53 | qtttbufqbex.org | udp |
| US | 8.8.8.8:53 | immuiaiugkeq.net | udp |
| US | 8.8.8.8:53 | suxkks.info | udp |
| US | 8.8.8.8:53 | molygadsholapet.org | udp |
| US | 8.8.8.8:53 | cpcmnenansnan.com | udp |
| US | 8.8.8.8:53 | yywmiiiugkeq.biz | udp |
| US | 8.8.8.8:53 | igzmwo.biz | udp |
| US | 8.8.8.8:53 | uaperanansnan.com | udp |
| US | 8.8.8.8:53 | lzkcvafox.org | udp |
| US | 8.8.8.8:53 | yksgamiq.net | udp |
| US | 8.8.8.8:53 | ywpdbcuiwcymao.info | udp |
| US | 8.8.8.8:53 | dphmlsn.org | udp |
| US | 8.8.8.8:53 | efzhnyfqbex.com | udp |
| US | 8.8.8.8:53 | eidpyqeoya.info | udp |
| US | 8.8.8.8:53 | wcotrsiugkeq.info | udp |
| US | 8.8.8.8:53 | jfnudafox.org | udp |
| US | 8.8.8.8:53 | tkrogcn.org | udp |
| US | 8.8.8.8:53 | oeesimiq.net | udp |
| US | 8.8.8.8:53 | uatqlcuiwcymao.info | udp |
| US | 8.8.8.8:53 | zfdthsn.cc | udp |
| US | 8.8.8.8:53 | xizqmkn.cc | udp |
| US | 8.8.8.8:53 | oerrlgeoya.biz | udp |
| US | 8.8.8.8:53 | eqbqcguiwcymao.info | udp |
| US | 52.11.240.239:80 | eqbqcguiwcymao.info | tcp |
| US | 8.8.8.8:53 | zuzmvwfox.com | udp |
| US | 8.8.8.8:53 | wzgrsenansnan.org | udp |
| US | 8.8.8.8:53 | wigyhsiugkeq.biz | udp |
| US | 8.8.8.8:53 | waauysiugkeq.net | udp |
| US | 8.8.8.8:53 | srjukodsholapet.org | udp |
| US | 8.8.8.8:53 | tizmbgn.org | udp |
| US | 8.8.8.8:53 | qwetpwiugkeq.biz | udp |
| US | 8.8.8.8:53 | amlehcuiwcymao.net | udp |
| US | 8.8.8.8:53 | izbqukdsholapet.com | udp |
| US | 8.8.8.8:53 | agvtrufqbex.cc | udp |
| US | 8.8.8.8:53 | sepsbs.net | udp |
| US | 8.8.8.8:53 | agoriiiugkeq.biz | udp |
| US | 8.8.8.8:53 | rmrgusfox.cc | udp |
| US | 8.8.8.8:53 | bozyrgn.com | udp |
| US | 8.8.8.8:53 | kooiewiq.net | udp |
| US | 8.8.8.8:53 | yuwuemiq.biz | udp |
| US | 8.8.8.8:53 | ybdetodsholapet.com | udp |
| US | 8.8.8.8:53 | mgesbsdsholapet.org | udp |
| US | 8.8.8.8:53 | ykbjeueoya.biz | udp |
| US | 8.8.8.8:53 | sooiysiugkeq.biz | udp |
| US | 8.8.8.8:53 | tjxxlafox.cc | udp |
| US | 8.8.8.8:53 | cjgsnenansnan.com | udp |
| US | 8.8.8.8:53 | autsca.net | udp |
| US | 8.8.8.8:53 | wmeawmiq.net | udp |
| US | 8.8.8.8:53 | nszqrsfox.cc | udp |
| US | 8.8.8.8:53 | nqwuzafox.org | udp |
| US | 8.8.8.8:53 | ugzfgguiwcymao.info | udp |
| US | 8.8.8.8:53 | qwawsaiq.biz | udp |
| US | 8.8.8.8:53 | wabchmnansnan.com | udp |
| US | 8.8.8.8:53 | xcneecn.org | udp |
| US | 8.8.8.8:53 | uwxumcuiwcymao.info | udp |
| US | 8.8.8.8:53 | qymkcaiq.net | udp |
| US | 8.8.8.8:53 | xojoxsn.com | udp |
| US | 8.8.8.8:53 | bkcsuafox.com | udp |
| US | 8.8.8.8:53 | ailswk.info | udp |
| US | 8.8.8.8:53 | qweacsiugkeq.biz | udp |
| US | 8.8.8.8:53 | tvfwkifox.cc | udp |
| US | 8.8.8.8:53 | fqcqcwfox.org | udp |
| US | 8.8.8.8:53 | gimcsiiugkeq.net | udp |
| US | 8.8.8.8:53 | catwtueoya.net | udp |
| US | 8.8.8.8:53 | ytxizanansnan.org | udp |
| US | 8.8.8.8:53 | zonspkn.cc | udp |
| US | 8.8.8.8:53 | aymkoaiugkeq.info | udp |
| US | 8.8.8.8:53 | usawkiiugkeq.biz | udp |
| US | 8.8.8.8:53 | uafudkdsholapet.cc | udp |
| US | 8.8.8.8:53 | wrsxuodsholapet.com | udp |
| US | 8.8.8.8:53 | egweniiugkeq.net | udp |
| US | 8.8.8.8:53 | igkiteiq.info | udp |
| US | 8.8.8.8:53 | ekxtrenansnan.org | udp |
| US | 8.8.8.8:53 | rmrihsn.org | udp |
| US | 8.8.8.8:53 | qgqqhwiugkeq.net | udp |
| US | 8.8.8.8:53 | skqoxsiugkeq.net | udp |
| US | 8.8.8.8:53 | unbclufqbex.org | udp |
| US | 8.8.8.8:53 | ygudvanansnan.org | udp |
| US | 8.8.8.8:53 | kenoyguiwcymao.net | udp |
| US | 8.8.8.8:53 | eaxveqeoya.net | udp |
| US | 8.8.8.8:53 | tbxouwfox.org | udp |
| US | 8.8.8.8:53 | jfgjlifox.org | udp |
| US | 8.8.8.8:53 | gahmus.net | udp |
| US | 8.8.8.8:53 | qaowwaiq.net | udp |
| US | 8.8.8.8:53 | dsfxjcn.org | udp |
| US | 8.8.8.8:53 | zcbtrcn.com | udp |
| US | 8.8.8.8:53 | sywmmmiq.info | udp |
| US | 8.8.8.8:53 | iobwycuiwcymao.net | udp |
| US | 8.8.8.8:53 | xidshsn.com | udp |
| US | 8.8.8.8:53 | mqtoqyfqbex.com | udp |
| US | 52.182.143.211:443 | tcp | |
| US | 8.8.8.8:53 | wovsmueoya.info | udp |
| US | 8.8.8.8:53 | euyypiiugkeq.net | udp |
| US | 8.8.8.8:53 | hzdupsn.org | udp |
| US | 8.8.8.8:53 | brdhrcn.org | udp |
| US | 8.8.8.8:53 | scfdcueoya.info | udp |
| US | 8.8.8.8:53 | wessyiiugkeq.info | udp |
| US | 8.8.8.8:53 | tmrvuifox.com | udp |
| US | 8.8.8.8:53 | pwhmxcn.cc | udp |
| US | 8.8.8.8:53 | kkpepo.info | udp |
| US | 8.8.8.8:53 | aaxsiueoya.info | udp |
| US | 8.8.8.8:53 | vmribifox.org | udp |
| US | 8.8.8.8:53 | drigfifox.cc | udp |
| US | 8.8.8.8:53 | kmnliguiwcymao.info | udp |
| US | 8.8.8.8:53 | uytcsgeoya.info | udp |
| US | 8.8.8.8:53 | uglergfqbex.org | udp |
| US | 8.8.8.8:53 | lxnsdcn.com | udp |
| US | 8.8.8.8:53 | coxkiueoya.info | udp |
| US | 8.8.8.8:53 | aqzadkuiwcymao.info | udp |
| US | 8.8.8.8:53 | yalpjanansnan.org | udp |
| US | 8.8.8.8:53 | ycokbodsholapet.org | udp |
| US | 8.8.8.8:53 | yqjswk.net | udp |
| US | 8.8.8.8:53 | ymxikueoya.net | udp |
| US | 8.8.8.8:53 | kdrccwnansnan.com | udp |
| US | 8.8.8.8:53 | ckocgkdsholapet.org | udp |
| US | 8.8.8.8:53 | swdihk.info | udp |
| US | 8.8.8.8:53 | qwbbyyeoya.info | udp |
| US | 8.8.8.8:53 | yndccsdsholapet.cc | udp |
| US | 8.8.8.8:53 | uvjmhufqbex.org | udp |
| US | 8.8.8.8:53 | isuufsiugkeq.info | udp |
| US | 8.8.8.8:53 | ieysqwiq.biz | udp |
| US | 8.8.8.8:53 | zqhkxgn.cc | udp |
| US | 8.8.8.8:53 | mqswuwnansnan.org | udp |
| US | 8.8.8.8:53 | iyyodwiugkeq.info | udp |
| US | 8.8.8.8:53 | wopkca.info | udp |
| US | 8.8.8.8:53 | lnhktifox.org | udp |
| US | 8.8.8.8:53 | fqhkgkn.com | udp |
| US | 8.8.8.8:53 | ewfahguiwcymao.info | udp |
| US | 8.8.8.8:53 | qusosiiugkeq.net | udp |
| US | 8.8.8.8:53 | ovtiuufqbex.cc | udp |
| US | 8.8.8.8:53 | aqestenansnan.org | udp |
| US | 8.8.8.8:53 | cymgiwiugkeq.info | udp |
| US | 8.8.8.8:53 | pvlglcn.com | udp |
| US | 8.8.8.8:53 | sshljufqbex.org | udp |
| US | 8.8.8.8:53 | suzcda.net | udp |
| US | 8.8.8.8:53 | cebszqeoya.info | udp |
| US | 8.8.8.8:53 | cdnjnanansnan.cc | udp |
| US | 8.8.8.8:53 | slwcnodsholapet.cc | udp |
| US | 8.8.8.8:53 | goboncuiwcymao.net | udp |
| US | 8.8.8.8:53 | uwmzmeiq.net | udp |
| US | 8.8.8.8:53 | vmgqbsfox.org | udp |
| US | 8.8.8.8:53 | eeigiwiq.net | udp |
| US | 8.8.8.8:53 | cyugvwiq.biz | udp |
| US | 8.8.8.8:53 | yknalenansnan.com | udp |
| US | 8.8.8.8:53 | lkadhifox.org | udp |
| US | 8.8.8.8:53 | iuwkfiiugkeq.info | udp |
| US | 8.8.8.8:53 | qidcqa.net | udp |
| US | 8.8.8.8:53 | anljvkdsholapet.cc | udp |
| US | 8.8.8.8:53 | ebaaxanansnan.org | udp |
| US | 8.8.8.8:53 | satsdueoya.info | udp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| GB | 142.250.179.227:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | cgguxsiugkeq.biz | udp |
| US | 8.8.8.8:53 | vxdaqgn.cc | udp |
| US | 8.8.8.8:53 | qxkyvwnansnan.org | udp |
| US | 8.8.8.8:53 | aijneueoya.info | udp |
| US | 8.8.8.8:53 | qixipa.info | udp |
| US | 8.8.8.8:53 | oznevadsholapet.org | udp |
| US | 8.8.8.8:53 | tnrpfkn.cc | udp |
| US | 8.8.8.8:53 | ikpogcuiwcymao.info | udp |
| US | 8.8.8.8:53 | syqyiiiugkeq.info | udp |
| US | 8.8.8.8:53 | bglbscn.org | udp |
| US | 8.8.8.8:53 | ewgxsodsholapet.cc | udp |
| US | 8.8.8.8:53 | gahdrueoya.biz | udp |
| US | 8.8.8.8:53 | kmyjzsiugkeq.net | udp |
| US | 8.8.8.8:53 | ygxqnanansnan.com | udp |
| US | 8.8.8.8:53 | fnzyrcn.com | udp |
| US | 8.8.8.8:53 | oquysiiugkeq.biz | udp |
| US | 8.8.8.8:53 | smfqaa.info | udp |
| US | 8.8.8.8:53 | ctjwaanansnan.com | udp |
| US | 8.8.8.8:53 | hbkjhafox.com | udp |
| US | 8.8.8.8:53 | yoqcpmiq.biz | udp |
| US | 8.8.8.8:53 | jjbntsfox.org | udp |
| US | 8.8.8.8:53 | wigiakdsholapet.com | udp |
| US | 8.8.8.8:53 | qaygssiugkeq.biz | udp |
| US | 8.8.8.8:53 | ayfapa.biz | udp |
| US | 8.8.8.8:53 | ojxqpmnansnan.org | udp |
| US | 8.8.8.8:53 | rpywjifox.org | udp |
| US | 8.8.8.8:53 | ggxuesuiwcymao.biz | udp |
| US | 8.8.8.8:53 | eqlgqueoya.biz | udp |
| US | 8.8.8.8:53 | abdqbenansnan.com | udp |
| US | 8.8.8.8:53 | intehufqbex.org | udp |
| US | 8.8.8.8:53 | ywywjaiq.biz | udp |
| US | 8.8.8.8:53 | osvvkgeoya.net | udp |
| US | 8.8.8.8:53 | varbwsn.com | udp |
| US | 8.8.8.8:53 | rnwslafox.com | udp |
| US | 8.8.8.8:53 | kwdktk.net | udp |
| US | 8.8.8.8:53 | katyqkuiwcymao.net | udp |
| US | 8.8.8.8:53 | mvomnkdsholapet.com | udp |
| US | 8.8.8.8:53 | mkbuyk.biz | udp |
| US | 8.8.8.8:53 | seeqxsiugkeq.info | udp |
| US | 8.8.8.8:53 | jrjyeafox.com | udp |
| US | 8.8.8.8:53 | gsuivanansnan.cc | udp |
| US | 8.8.8.8:53 | ymjogcuiwcymao.biz | udp |
| US | 8.8.8.8:53 | aopcoa.info | udp |
| US | 8.8.8.8:53 | pyxongn.org | udp |
| US | 8.8.8.8:53 | wvmqfodsholapet.cc | udp |
| US | 8.8.8.8:53 | smpsecuiwcymao.info | udp |
| US | 8.8.8.8:53 | qwffnkdsholapet.cc | udp |
| US | 8.8.8.8:53 | sbyqaodsholapet.org | udp |
| US | 8.8.8.8:53 | csvacgeoya.biz | udp |
| US | 8.8.8.8:53 | mjnmxgfqbex.org | udp |
| US | 8.8.8.8:53 | ldvhxcn.cc | udp |
| US | 8.8.8.8:53 | ywsyewiugkeq.biz | udp |
| US | 8.8.8.8:53 | kklkvguiwcymao.info | udp |
| US | 8.8.8.8:53 | ynlcxufqbex.cc | udp |
| US | 8.8.8.8:53 | fzusgafox.com | udp |
| US | 8.8.8.8:53 | ikmgamiq.net | udp |
| US | 8.8.8.8:53 | ucdeuqeoya.biz | udp |
| US | 8.8.8.8:53 | dhhnowfox.org | udp |
| US | 8.8.8.8:53 | shmdzmnansnan.cc | udp |
| US | 8.8.8.8:53 | ikahdwiq.net | udp |
| US | 8.8.8.8:53 | oqbccsuiwcymao.info | udp |
| US | 8.8.8.8:53 | vmrwksn.cc | udp |
| US | 8.8.8.8:53 | ymkaaenansnan.org | udp |
| US | 8.8.8.8:53 | uowhamiq.biz | udp |
| US | 8.8.8.8:53 | oyiemiiugkeq.net | udp |
| US | 8.8.8.8:53 | dhxelgn.cc | udp |
| US | 8.8.8.8:53 | yvjxbqfqbex.com | udp |
| US | 8.8.8.8:53 | mkfqck.net | udp |
| US | 8.8.8.8:53 | gcnunkuiwcymao.biz | udp |
| US | 8.8.8.8:53 | qarebgfqbex.org | udp |
| US | 8.8.8.8:53 | sgygrenansnan.org | udp |
| US | 8.8.8.8:53 | wqtpoa.biz | udp |
| US | 8.8.8.8:53 | uijsocuiwcymao.net | udp |
| US | 8.8.8.8:53 | inlmngfqbex.cc | udp |
| US | 8.8.8.8:53 | msgslkdsholapet.cc | udp |
| US | 8.8.8.8:53 | cmecrwiq.info | udp |
| US | 8.8.8.8:53 | yswfewiq.biz | udp |
| US | 8.8.8.8:53 | jllifcn.cc | udp |
| US | 8.8.8.8:53 | mgiwhkdsholapet.com | udp |
| US | 8.8.8.8:53 | uqgpuwiugkeq.info | udp |
| US | 8.8.8.8:53 | acwwdsiugkeq.info | udp |
| US | 8.8.8.8:53 | vqhxzsfox.com | udp |
| US | 8.8.8.8:53 | qpmmxodsholapet.org | udp |
| US | 8.8.8.8:53 | uwvams.net | udp |
| US | 8.8.8.8:53 | kehoko.biz | udp |
| US | 8.8.8.8:53 | gujndsdsholapet.org | udp |
| US | 8.8.8.8:53 | quigcenansnan.com | udp |
| US | 8.8.8.8:53 | mgjlmcuiwcymao.biz | udp |
| US | 8.8.8.8:53 | qqbfxqeoya.net | udp |
| US | 8.8.8.8:53 | lkroxcn.org | udp |
| US | 8.8.8.8:53 | xiwqrifox.cc | udp |
| US | 8.8.8.8:53 | saekyaiugkeq.biz | udp |
| US | 8.8.8.8:53 | wyufiwiugkeq.info | udp |
| US | 8.8.8.8:53 | zqdppcn.org | udp |
| US | 8.8.8.8:53 | zmcuawfox.com | udp |
| US | 8.8.8.8:53 | ccjajs.net | udp |
| US | 8.8.8.8:53 | oiwkkwiugkeq.biz | udp |
| US | 8.8.8.8:53 | cvlwyqfqbex.com | udp |
| US | 8.8.8.8:53 | mmqmdadsholapet.cc | udp |
| US | 8.8.8.8:53 | akqipmiq.net | udp |
| US | 8.8.8.8:53 | csrjza.biz | udp |
| US | 8.8.8.8:53 | irxkesdsholapet.com | udp |
| US | 8.8.8.8:53 | xedkfkn.cc | udp |
| US | 8.8.8.8:53 | eyiqmaiq.info | udp |
| US | 8.8.8.8:53 | uqjcesuiwcymao.biz | udp |
| US | 8.8.8.8:53 | qfbajkdsholapet.cc | udp |
| US | 8.8.8.8:53 | gashosdsholapet.cc | udp |
| US | 8.8.8.8:53 | cakcksiugkeq.net | udp |
| US | 8.8.8.8:53 | pzfpdsn.com | udp |
| US | 8.8.8.8:53 | kfjuhyfqbex.com | udp |
| US | 8.8.8.8:53 | skxmss.net | udp |
| US | 8.8.8.8:53 | kgjnuo.net | udp |
| US | 8.8.8.8:53 | garctenansnan.com | udp |
| US | 8.8.8.8:53 | uqirsadsholapet.cc | udp |
| US | 8.8.8.8:53 | cehbea.info | udp |
| US | 8.8.8.8:53 | qyllkyeoya.net | udp |
| US | 8.8.8.8:53 | ekzmkyfqbex.cc | udp |
| US | 8.8.8.8:53 | aywzoanansnan.cc | udp |
| US | 8.8.8.8:53 | eapmoguiwcymao.info | udp |
| US | 8.8.8.8:53 | qcjisqeoya.net | udp |
| US | 8.8.8.8:53 | brjarkn.com | udp |
| US | 8.8.8.8:53 | cvktlsdsholapet.com | udp |
| US | 8.8.8.8:53 | yslnsa.net | udp |
| US | 8.8.8.8:53 | iahmhgeoya.biz | udp |
| US | 8.8.8.8:53 | upbgkkdsholapet.cc | udp |
| US | 8.8.8.8:53 | rvoqtwfox.com | udp |
| US | 8.8.8.8:53 | gqlawgeoya.info | udp |
| US | 8.8.8.8:53 | qymmssiugkeq.net | udp |
| US | 8.8.8.8:53 | bdfqlcn.cc | udp |
| US | 8.8.8.8:53 | mohpsgfqbex.org | udp |
| US | 8.8.8.8:53 | mkxzgo.info | udp |
| US | 8.8.8.8:53 | wodkgyeoya.net | udp |
| US | 8.8.8.8:53 | hjhubwfox.cc | udp |
| US | 8.8.8.8:53 | hfmrgafox.org | udp |
| US | 8.8.8.8:53 | kapflsuiwcymao.biz | udp |
| US | 8.8.8.8:53 | aivsdgeoya.biz | udp |
| US | 8.8.8.8:53 | qprcjadsholapet.org | udp |
| US | 8.8.8.8:53 | sfwqaanansnan.com | udp |
| US | 8.8.8.8:53 | ugkjfiiugkeq.info | udp |
| US | 8.8.8.8:53 | kasatwiq.biz | udp |
| US | 8.8.8.8:53 | fwdsbsn.cc | udp |
| US | 8.8.8.8:53 | uqqigwnansnan.com | udp |
| US | 8.8.8.8:53 | iwqnwaiq.biz | udp |
| US | 8.8.8.8:53 | oevwwguiwcymao.info | udp |
| US | 8.8.8.8:53 | vtnwbsn.org | udp |
| US | 8.8.8.8:53 | drickafox.cc | udp |
| US | 8.8.8.8:53 | gyfssk.info | udp |
| US | 8.8.8.8:53 | cgbywgeoya.biz | udp |
| US | 8.8.8.8:53 | sntqrqfqbex.org | udp |
| US | 8.8.8.8:53 | keqaqwiugkeq.net | udp |
| US | 8.8.8.8:53 | ccfqsguiwcymao.biz | udp |
| US | 8.8.8.8:53 | uudadkdsholapet.cc | udp |
| US | 8.8.8.8:53 | mkaeumnansnan.org | udp |
| US | 8.8.8.8:53 | sebihguiwcymao.biz | udp |
| US | 8.8.8.8:53 | aispkeiq.net | udp |
| US | 8.8.8.8:53 | yejlkmnansnan.cc | udp |
| US | 8.8.8.8:53 | cafkbqfqbex.com | udp |
| US | 8.8.8.8:53 | akrcoueoya.net | udp |
| US | 8.8.8.8:53 | gwrxykuiwcymao.net | udp |
| US | 8.8.8.8:53 | xihaywfox.org | udp |
| US | 8.8.8.8:53 | ilwmradsholapet.org | udp |
| US | 8.8.8.8:53 | cudclguiwcymao.biz | udp |
| US | 8.8.8.8:53 | kyliisuiwcymao.net | udp |
| US | 8.8.8.8:53 | lzripifox.org | udp |
| US | 8.8.8.8:53 | ggawxkdsholapet.org | udp |
| US | 8.8.8.8:53 | sevaia.info | udp |
| US | 8.8.8.8:53 | ggxouqeoya.info | udp |
| US | 8.8.8.8:53 | qvlkzodsholapet.com | udp |
| US | 8.8.8.8:53 | rufpjsn.cc | udp |
| US | 8.8.8.8:53 | yyvilcuiwcymao.biz | udp |
| US | 8.8.8.8:53 | mariek.info | udp |
| US | 8.8.8.8:53 | ymxjpgfqbex.com | udp |
| US | 8.8.8.8:53 | ngzwjcn.com | udp |
| US | 8.8.8.8:53 | eajoyueoya.net | udp |
| US | 8.8.8.8:53 | aqbzwguiwcymao.info | udp |
| US | 8.8.8.8:53 | nkjgnkn.com | udp |
| US | 8.8.8.8:53 | gksugsdsholapet.cc | udp |
| US | 8.8.8.8:53 | ywebbeiq.biz | udp |
| US | 8.8.8.8:53 | iibjso.net | udp |
| US | 8.8.8.8:53 | opnanmnansnan.cc | udp |
| US | 8.8.8.8:53 | duwwfafox.cc | udp |
| US | 8.8.8.8:53 | sotaiqeoya.info | udp |
| US | 8.8.8.8:53 | ackuwwiugkeq.biz | udp |
| US | 8.8.8.8:53 | gmzppyfqbex.org | udp |
| US | 8.8.8.8:53 | icpliqeoya.biz | udp |
| US | 8.8.8.8:53 | gcxmzs.info | udp |
| US | 8.8.8.8:53 | aetgpyfqbex.cc | udp |
| US | 8.8.8.8:53 | fmgdnwfox.org | udp |
| US | 8.8.8.8:53 | amdgqkuiwcymao.biz | udp |
| US | 8.8.8.8:53 | gqqahaiugkeq.info | udp |
| US | 8.8.8.8:53 | stfmbenansnan.org | udp |
| US | 8.8.8.8:53 | fxnvcgn.com | udp |
| US | 8.8.8.8:53 | okecyiiugkeq.net | udp |
| US | 8.8.8.8:53 | msveigeoya.biz | udp |
| US | 8.8.8.8:53 | jehmxgn.org | udp |
| US | 8.8.8.8:53 | sdyriwnansnan.com | udp |
| US | 8.8.8.8:53 | mahfmsuiwcymao.biz | udp |
| US | 8.8.8.8:53 | eqrvoueoya.net | udp |
| US | 8.8.8.8:53 | kbzwdkdsholapet.cc | udp |
| US | 8.8.8.8:53 | zgduzgn.com | udp |
| US | 8.8.8.8:53 | mwxclueoya.biz | udp |
| US | 8.8.8.8:53 | qcklsmiq.net | udp |
| US | 8.8.8.8:53 | kxdwqgfqbex.com | udp |
| US | 8.8.8.8:53 | wrlndgfqbex.cc | udp |
| US | 8.8.8.8:53 | kolkhguiwcymao.net | udp |
| US | 8.8.8.8:53 | ccfocqeoya.info | udp |
| US | 8.8.8.8:53 | iqlrwwnansnan.org | udp |
| US | 8.8.8.8:53 | sdmumadsholapet.com | udp |
| US | 8.8.8.8:53 | kqowieiq.biz | udp |
| US | 8.8.8.8:53 | wcxwacuiwcymao.biz | udp |
| US | 8.8.8.8:53 | yphvdyfqbex.cc | udp |
| US | 8.8.8.8:53 | vbmgnafox.com | udp |
| US | 8.8.8.8:53 | qgnfmgeoya.biz | udp |
| US | 8.8.8.8:53 | gwtjza.info | udp |
| US | 8.8.8.8:53 | lohutkn.com | udp |
| US | 8.8.8.8:53 | xdngzcn.com | udp |
| US | 8.8.8.8:53 | gaycpaiq.net | udp |
| US | 8.8.8.8:53 | oorjesuiwcymao.biz | udp |
| US | 8.8.8.8:53 | rulrusfox.com | udp |
| US | 8.8.8.8:53 | gjwkhadsholapet.org | udp |
| US | 8.8.8.8:53 | watgjgeoya.info | udp |
| US | 8.8.8.8:53 | muipuaiq.info | udp |
| US | 8.8.8.8:53 | dszijcn.com | udp |
| US | 8.8.8.8:53 | pcholkn.org | udp |
| US | 8.8.8.8:53 | oqbahqeoya.net | udp |
| US | 8.8.8.8:53 | oljgxadsholapet.cc | udp |
| US | 8.8.8.8:53 | vkygxifox.org | udp |
| US | 8.8.8.8:53 | coxumyeoya.net | udp |
| US | 8.8.8.8:53 | guesgsiugkeq.biz | udp |
| US | 8.8.8.8:53 | mdfgmmnansnan.cc | udp |
| US | 8.8.8.8:53 | ejkfkodsholapet.com | udp |
| US | 8.8.8.8:53 | uwsunmiq.biz | udp |
| US | 8.8.8.8:53 | qogipaiq.biz | udp |
| US | 8.8.8.8:53 | altqradsholapet.cc | udp |
| US | 8.8.8.8:53 | uodypqfqbex.com | udp |
| US | 8.8.8.8:53 | imnargeoya.net | udp |
| US | 8.8.8.8:53 | sqcpjmiq.net | udp |
| US | 8.8.8.8:53 | cclwradsholapet.cc | udp |
| US | 8.8.8.8:53 | fzwmpwfox.org | udp |
| US | 8.8.8.8:53 | owztakuiwcymao.net | udp |
| US | 8.8.8.8:53 | ycdoeqeoya.biz | udp |
| US | 8.8.8.8:53 | mvzgvgfqbex.cc | udp |
| US | 8.8.8.8:53 | ehqvnanansnan.com | udp |
| US | 8.8.8.8:53 | kuuyeaiugkeq.net | udp |
| US | 8.8.8.8:53 | agdcas.net | udp |
| US | 8.8.8.8:53 | arhezenansnan.com | udp |
| US | 8.8.8.8:53 | mdenqadsholapet.org | udp |
| US | 8.8.8.8:53 | eqoygeiq.biz | udp |
| US | 8.8.8.8:53 | kqvomo.net | udp |
| US | 8.8.8.8:53 | gsxwoodsholapet.cc | udp |
| US | 8.8.8.8:53 | yhvtlgfqbex.com | udp |
| US | 8.8.8.8:53 | cwruns.biz | udp |
| US | 8.8.8.8:53 | ewrgra.info | udp |
| US | 8.8.8.8:53 | jbhtfgn.org | udp |
| US | 8.8.8.8:53 | vhhyksn.cc | udp |
| US | 8.8.8.8:53 | yadxsa.biz | udp |
| US | 8.8.8.8:53 | icucymiq.info | udp |
| US | 8.8.8.8:53 | capnvyfqbex.com | udp |
| US | 8.8.8.8:53 | gzycfanansnan.cc | udp |
| US | 8.8.8.8:53 | qcewewiq.info | udp |
| US | 8.8.8.8:53 | syktjaiugkeq.net | udp |
| US | 8.8.8.8:53 | jozwzafox.com | udp |
| US | 8.8.8.8:53 | gpwspmnansnan.cc | udp |
| US | 8.8.8.8:53 | mqgsxaiugkeq.net | udp |
| US | 8.8.8.8:53 | yopkua.info | udp |
| US | 8.8.8.8:53 | ndvcrgn.cc | udp |
| US | 8.8.8.8:53 | yxuqqadsholapet.org | udp |
| US | 8.8.8.8:53 | munmnkdsholapet.com | udp |
| US | 8.8.8.8:53 | ttzwcgn.cc | udp |
| US | 8.8.8.8:53 | emuqzwiq.biz | udp |
| US | 8.8.8.8:53 | giegosiugkeq.info | udp |
| US | 8.8.8.8:53 | pmxxgifox.org | udp |
| US | 8.8.8.8:53 | oceunkdsholapet.com | udp |
| US | 8.8.8.8:53 | asvxhs.biz | udp |
| US | 8.8.8.8:53 | ugjlekuiwcymao.net | udp |
| US | 8.8.8.8:53 | schwyadsholapet.org | udp |
| US | 8.8.8.8:53 | tjawhwfox.cc | udp |
| US | 8.8.8.8:53 | yobeuyeoya.info | udp |
| US | 8.8.8.8:53 | gexcoyeoya.net | udp |
| US | 8.8.8.8:53 | ltptvafox.org | udp |
| US | 8.8.8.8:53 | tfbinkn.com | udp |
| US | 8.8.8.8:53 | mqrypqeoya.info | udp |
| US | 8.8.8.8:53 | ccfbrueoya.biz | udp |
| US | 8.8.8.8:53 | wxfsuenansnan.com | udp |
| US | 8.8.8.8:53 | jfmqhafox.com | udp |
| US | 8.8.8.8:53 | mebmdk.info | udp |
| US | 8.8.8.8:53 | aifbmguiwcymao.biz | udp |
| US | 8.8.8.8:53 | rgpgnwfox.org | udp |
| US | 8.8.8.8:53 | mlocqadsholapet.com | udp |
| US | 8.8.8.8:53 | mcjqmueoya.net | udp |
Files
C:\Users\Admin\AppData\Local\Temp\qjfmnzhratp.exe
| MD5 | a3492b467622a421ab2ff18ba2762c53 |
| SHA1 | 2e6963888847f0e70d9efe6c99b6cfe3d1b0e1e0 |
| SHA256 | 062efd6997c37d42c5394912d2a59a4105cf789c90824cf56a7dd64569f973fd |
| SHA512 | deb864b71ac1c1b3b65642d5af2f3e82ec3430dedda24a3abe2ec19425c6b1c1aa963d9e8bb60fe9a29228448a50a6392a7899434ba9e500a3ea13f958866a32 |
C:\Windows\SysWOW64\ibtlhyskeqjjmaibqh.exe
| MD5 | b290c6025c5e02a99bb372986a2c07e4 |
| SHA1 | c12b76f3eac05a2e8df90c618c703e7edfff5d89 |
| SHA256 | 79f662e4967afa18a37082fbfd8ce704e079f47458569fdda125354d5beb1c33 |
| SHA512 | 30b68aebc967dec32d4203b8aebbae942e5dbbf8f1b780129e56c2ddd6c030fe8131d46504f45c757a73e4920ba32bf2135426d6af449bf9ae102d49712fea10 |
C:\Users\Admin\AppData\Local\vbgluyfkrqwjzavbdhhnsxgkrwd.ivl
| MD5 | 7c244050987f5d57db23fed69af4d9eb |
| SHA1 | 29726489d1d266c5d1da89d4ac559fc91c55ec77 |
| SHA256 | 547c247abbae6c22ea0ebb002c83ef9bbc36eab2a5c4591437a18928e2dc0145 |
| SHA512 | ea8a3e257a82934664f2ed9166861e772823e5131eab3095e48939e51b73b30f31f3e7c1ff33a69d23e8e6e278b044c3dcace90d0d6eb2745eb45ec03d44e588 |
C:\Users\Admin\AppData\Local\sjzpjyqgyizxykqhujulbrlasiakbzamsjwlwn.tnc
| MD5 | 69427f933e4491f292655d1f0a535f30 |
| SHA1 | 43f2c1e3d53410b4f417197984654eeb8ba73cbc |
| SHA256 | 9ffc3048922cd7f689a27dc4da040eebc5c23a5f2dda6d1c7962c449f974a6be |
| SHA512 | 4e35eaf1bc3027a2a52949438da8afe346968e5da1feca64b7d805dfe29e8a091f0ecb0d1349f32af70e70697e60e643fb2e7798ea60cda65cc7f3bb09d399a8 |
memory/6820-191-0x0000000000400000-0x0000000000483000-memory.dmp
memory/4164-192-0x00007FF61F380000-0x00007FF61F3E7000-memory.dmp
memory/2980-193-0x00007FF61F380000-0x00007FF61F3E7000-memory.dmp
memory/6268-194-0x0000000000400000-0x0000000000483000-memory.dmp
memory/12084-196-0x00007FF8D8BF0000-0x00007FF8D8C49000-memory.dmp
memory/11964-197-0x0000000000400000-0x0000000000483000-memory.dmp
memory/10928-195-0x0000000000400000-0x0000000000483000-memory.dmp
memory/10296-198-0x0000000000400000-0x0000000000483000-memory.dmp
memory/11304-200-0x0000000000400000-0x0000000000456000-memory.dmp
memory/6928-199-0x0000000000400000-0x0000000000483000-memory.dmp
memory/7888-201-0x0000000000400000-0x0000000000483000-memory.dmp