Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 04:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f00b93f6c3861a8afc5643f29c04057bf586963d092dc79f2233dfe1e7469124.exe
Resource
win7-20240611-en
5 signatures
150 seconds
General
-
Target
f00b93f6c3861a8afc5643f29c04057bf586963d092dc79f2233dfe1e7469124.exe
-
Size
201KB
-
MD5
22695f650c8e52d4396324a5e36b4858
-
SHA1
7170424b27fc2fe7c364b4418b9e9b89d4a58c1d
-
SHA256
f00b93f6c3861a8afc5643f29c04057bf586963d092dc79f2233dfe1e7469124
-
SHA512
0aeb5fe284d6d437e67e11769e24cb953585c03c24363f81687efaa71aa4e2394bc3dd393aaaec2f7d7b244de09b7f3ea30e137e31ce5aeece6f30b96a57f46f
-
SSDEEP
3072:ymb3NkkiQ3mdBjFIi/0RU6QeYQsm71vPmc51+GqekBJCvr6zJBUVv1T5m:n3C9BRIG0asYFm71m8+GdkB9Cv1I
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/1744-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1744-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1080-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1644-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1096-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2224-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/832-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2184-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2248-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/868-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/756-266-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1880-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2240-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lxlrlxl.exevvjdv.exelxfxflr.exeppjjd.exerlllxfr.exebtnthh.exepppjd.exevpdvv.exe7ntttb.exehhhnbn.exexrflxfr.exehhhbnn.exevpjpd.exeppvpj.exelfxfrrf.exenttnht.exelfxfxfl.exehththt.exepjpdj.exelfllrxf.exe1hntnb.exepvvjd.exefxlxflr.exehtthth.exejdjpp.exevvddj.exebthnbn.exeppdpd.exerlxrrrx.exehbtbtt.exepjdpv.exefxfllxf.exebhnhhn.exe5vvvj.exexrfflrf.exellxflfl.exe9btbbb.exehtnbbn.exepjvpd.exe1rfxxff.exe1rlxrfr.exebnthbt.exetnbbhn.exevvjpj.exexrllrrf.exe1lflfrf.exe9nnbth.exebbhbht.exevdvpd.exellffxfr.exelffflrr.exehbtnth.exedppjj.exerlfrflf.exe5lxrfff.exe9nhnbb.exedvpjp.exe3vjvv.exellxxfll.exellxlflr.exe7bbhbh.exe7vpvd.exe5dvdj.exentbhnn.exepid process 1080 lxlrlxl.exe 2704 vvjdv.exe 2664 lxfxflr.exe 2928 ppjjd.exe 2652 rlllxfr.exe 2864 btnthh.exe 2688 pppjd.exe 2536 vpdvv.exe 3000 7ntttb.exe 1652 hhhnbn.exe 2856 xrflxfr.exe 1644 hhhbnn.exe 2848 vpjpd.exe 1096 ppvpj.exe 1476 lfxfrrf.exe 2224 nttnht.exe 832 lfxfxfl.exe 2892 hththt.exe 2184 pjpdj.exe 2504 lfllrxf.exe 2248 1hntnb.exe 868 pvvjd.exe 1448 fxlxflr.exe 1872 htthth.exe 2368 jdjpp.exe 1816 vvddj.exe 756 bthnbn.exe 1880 ppdpd.exe 1428 rlxrrrx.exe 2240 hbtbtt.exe 1700 pjdpv.exe 1744 fxfllxf.exe 1968 bhnhhn.exe 2128 5vvvj.exe 1612 xrfflrf.exe 2080 llxflfl.exe 2808 9btbbb.exe 2772 htnbbn.exe 2780 pjvpd.exe 2916 1rfxxff.exe 2544 1rlxrfr.exe 2692 bnthbt.exe 2736 tnbbhn.exe 2596 vvjpj.exe 2540 xrllrrf.exe 3000 1lflfrf.exe 2840 9nnbth.exe 2820 bbhbht.exe 1640 vdvpd.exe 1820 llffxfr.exe 1932 lffflrr.exe 1096 hbtnth.exe 2496 dppjj.exe 1372 rlfrflf.exe 2224 5lxrfff.exe 2868 9nhnbb.exe 2872 dvpjp.exe 1868 3vjvv.exe 2392 llxxfll.exe 484 llxlflr.exe 1472 7bbhbh.exe 2948 7vpvd.exe 1656 5dvdj.exe 1572 ntbhnn.exe -
Processes:
resource yara_rule behavioral1/memory/1744-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1744-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1080-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1080-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1080-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1644-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1096-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2224-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/832-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2184-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2248-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/868-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/756-266-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1880-275-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-293-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f00b93f6c3861a8afc5643f29c04057bf586963d092dc79f2233dfe1e7469124.exelxlrlxl.exevvjdv.exelxfxflr.exeppjjd.exerlllxfr.exebtnthh.exepppjd.exevpdvv.exe7ntttb.exehhhnbn.exexrflxfr.exehhhbnn.exevpjpd.exeppvpj.exelfxfrrf.exedescription pid process target process PID 1744 wrote to memory of 1080 1744 f00b93f6c3861a8afc5643f29c04057bf586963d092dc79f2233dfe1e7469124.exe lxlrlxl.exe PID 1744 wrote to memory of 1080 1744 f00b93f6c3861a8afc5643f29c04057bf586963d092dc79f2233dfe1e7469124.exe lxlrlxl.exe PID 1744 wrote to memory of 1080 1744 f00b93f6c3861a8afc5643f29c04057bf586963d092dc79f2233dfe1e7469124.exe lxlrlxl.exe PID 1744 wrote to memory of 1080 1744 f00b93f6c3861a8afc5643f29c04057bf586963d092dc79f2233dfe1e7469124.exe lxlrlxl.exe PID 1080 wrote to memory of 2704 1080 lxlrlxl.exe vvjdv.exe PID 1080 wrote to memory of 2704 1080 lxlrlxl.exe vvjdv.exe PID 1080 wrote to memory of 2704 1080 lxlrlxl.exe vvjdv.exe PID 1080 wrote to memory of 2704 1080 lxlrlxl.exe vvjdv.exe PID 2704 wrote to memory of 2664 2704 vvjdv.exe lxfxflr.exe PID 2704 wrote to memory of 2664 2704 vvjdv.exe lxfxflr.exe PID 2704 wrote to memory of 2664 2704 vvjdv.exe lxfxflr.exe PID 2704 wrote to memory of 2664 2704 vvjdv.exe lxfxflr.exe PID 2664 wrote to memory of 2928 2664 lxfxflr.exe ppjjd.exe PID 2664 wrote to memory of 2928 2664 lxfxflr.exe ppjjd.exe PID 2664 wrote to memory of 2928 2664 lxfxflr.exe ppjjd.exe PID 2664 wrote to memory of 2928 2664 lxfxflr.exe ppjjd.exe PID 2928 wrote to memory of 2652 2928 ppjjd.exe rlllxfr.exe PID 2928 wrote to memory of 2652 2928 ppjjd.exe rlllxfr.exe PID 2928 wrote to memory of 2652 2928 ppjjd.exe rlllxfr.exe PID 2928 wrote to memory of 2652 2928 ppjjd.exe rlllxfr.exe PID 2652 wrote to memory of 2864 2652 rlllxfr.exe btnthh.exe PID 2652 wrote to memory of 2864 2652 rlllxfr.exe btnthh.exe PID 2652 wrote to memory of 2864 2652 rlllxfr.exe btnthh.exe PID 2652 wrote to memory of 2864 2652 rlllxfr.exe btnthh.exe PID 2864 wrote to memory of 2688 2864 btnthh.exe pppjd.exe PID 2864 wrote to memory of 2688 2864 btnthh.exe pppjd.exe PID 2864 wrote to memory of 2688 2864 btnthh.exe pppjd.exe PID 2864 wrote to memory of 2688 2864 btnthh.exe pppjd.exe PID 2688 wrote to memory of 2536 2688 pppjd.exe vpdvv.exe PID 2688 wrote to memory of 2536 2688 pppjd.exe vpdvv.exe PID 2688 wrote to memory of 2536 2688 pppjd.exe vpdvv.exe PID 2688 wrote to memory of 2536 2688 pppjd.exe vpdvv.exe PID 2536 wrote to memory of 3000 2536 vpdvv.exe 7ntttb.exe PID 2536 wrote to memory of 3000 2536 vpdvv.exe 7ntttb.exe PID 2536 wrote to memory of 3000 2536 vpdvv.exe 7ntttb.exe PID 2536 wrote to memory of 3000 2536 vpdvv.exe 7ntttb.exe PID 3000 wrote to memory of 1652 3000 7ntttb.exe hhhnbn.exe PID 3000 wrote to memory of 1652 3000 7ntttb.exe hhhnbn.exe PID 3000 wrote to memory of 1652 3000 7ntttb.exe hhhnbn.exe PID 3000 wrote to memory of 1652 3000 7ntttb.exe hhhnbn.exe PID 1652 wrote to memory of 2856 1652 hhhnbn.exe xrflxfr.exe PID 1652 wrote to memory of 2856 1652 hhhnbn.exe xrflxfr.exe PID 1652 wrote to memory of 2856 1652 hhhnbn.exe xrflxfr.exe PID 1652 wrote to memory of 2856 1652 hhhnbn.exe xrflxfr.exe PID 2856 wrote to memory of 1644 2856 xrflxfr.exe hhhbnn.exe PID 2856 wrote to memory of 1644 2856 xrflxfr.exe hhhbnn.exe PID 2856 wrote to memory of 1644 2856 xrflxfr.exe hhhbnn.exe PID 2856 wrote to memory of 1644 2856 xrflxfr.exe hhhbnn.exe PID 1644 wrote to memory of 2848 1644 hhhbnn.exe vpjpd.exe PID 1644 wrote to memory of 2848 1644 hhhbnn.exe vpjpd.exe PID 1644 wrote to memory of 2848 1644 hhhbnn.exe vpjpd.exe PID 1644 wrote to memory of 2848 1644 hhhbnn.exe vpjpd.exe PID 2848 wrote to memory of 1096 2848 vpjpd.exe ppvpj.exe PID 2848 wrote to memory of 1096 2848 vpjpd.exe ppvpj.exe PID 2848 wrote to memory of 1096 2848 vpjpd.exe ppvpj.exe PID 2848 wrote to memory of 1096 2848 vpjpd.exe ppvpj.exe PID 1096 wrote to memory of 1476 1096 ppvpj.exe lfxfrrf.exe PID 1096 wrote to memory of 1476 1096 ppvpj.exe lfxfrrf.exe PID 1096 wrote to memory of 1476 1096 ppvpj.exe lfxfrrf.exe PID 1096 wrote to memory of 1476 1096 ppvpj.exe lfxfrrf.exe PID 1476 wrote to memory of 2224 1476 lfxfrrf.exe nttnht.exe PID 1476 wrote to memory of 2224 1476 lfxfrrf.exe nttnht.exe PID 1476 wrote to memory of 2224 1476 lfxfrrf.exe nttnht.exe PID 1476 wrote to memory of 2224 1476 lfxfrrf.exe nttnht.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f00b93f6c3861a8afc5643f29c04057bf586963d092dc79f2233dfe1e7469124.exe"C:\Users\Admin\AppData\Local\Temp\f00b93f6c3861a8afc5643f29c04057bf586963d092dc79f2233dfe1e7469124.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\lxlrlxl.exec:\lxlrlxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvjdv.exec:\vvjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxfxflr.exec:\lxfxflr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ppjjd.exec:\ppjjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlllxfr.exec:\rlllxfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btnthh.exec:\btnthh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pppjd.exec:\pppjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpdvv.exec:\vpdvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7ntttb.exec:\7ntttb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhhnbn.exec:\hhhnbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrflxfr.exec:\xrflxfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhhbnn.exec:\hhhbnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpjpd.exec:\vpjpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ppvpj.exec:\ppvpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfxfrrf.exec:\lfxfrrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nttnht.exec:\nttnht.exe17⤵
- Executes dropped EXE
-
\??\c:\lfxfxfl.exec:\lfxfxfl.exe18⤵
- Executes dropped EXE
-
\??\c:\hththt.exec:\hththt.exe19⤵
- Executes dropped EXE
-
\??\c:\pjpdj.exec:\pjpdj.exe20⤵
- Executes dropped EXE
-
\??\c:\lfllrxf.exec:\lfllrxf.exe21⤵
- Executes dropped EXE
-
\??\c:\1hntnb.exec:\1hntnb.exe22⤵
- Executes dropped EXE
-
\??\c:\pvvjd.exec:\pvvjd.exe23⤵
- Executes dropped EXE
-
\??\c:\fxlxflr.exec:\fxlxflr.exe24⤵
- Executes dropped EXE
-
\??\c:\htthth.exec:\htthth.exe25⤵
- Executes dropped EXE
-
\??\c:\jdjpp.exec:\jdjpp.exe26⤵
- Executes dropped EXE
-
\??\c:\vvddj.exec:\vvddj.exe27⤵
- Executes dropped EXE
-
\??\c:\bthnbn.exec:\bthnbn.exe28⤵
- Executes dropped EXE
-
\??\c:\ppdpd.exec:\ppdpd.exe29⤵
- Executes dropped EXE
-
\??\c:\rlxrrrx.exec:\rlxrrrx.exe30⤵
- Executes dropped EXE
-
\??\c:\hbtbtt.exec:\hbtbtt.exe31⤵
- Executes dropped EXE
-
\??\c:\pjdpv.exec:\pjdpv.exe32⤵
- Executes dropped EXE
-
\??\c:\fxfllxf.exec:\fxfllxf.exe33⤵
- Executes dropped EXE
-
\??\c:\bhnhhn.exec:\bhnhhn.exe34⤵
- Executes dropped EXE
-
\??\c:\5vvvj.exec:\5vvvj.exe35⤵
- Executes dropped EXE
-
\??\c:\xrfflrf.exec:\xrfflrf.exe36⤵
- Executes dropped EXE
-
\??\c:\llxflfl.exec:\llxflfl.exe37⤵
- Executes dropped EXE
-
\??\c:\9btbbb.exec:\9btbbb.exe38⤵
- Executes dropped EXE
-
\??\c:\htnbbn.exec:\htnbbn.exe39⤵
- Executes dropped EXE
-
\??\c:\pjvpd.exec:\pjvpd.exe40⤵
- Executes dropped EXE
-
\??\c:\1rfxxff.exec:\1rfxxff.exe41⤵
- Executes dropped EXE
-
\??\c:\1rlxrfr.exec:\1rlxrfr.exe42⤵
- Executes dropped EXE
-
\??\c:\bnthbt.exec:\bnthbt.exe43⤵
- Executes dropped EXE
-
\??\c:\tnbbhn.exec:\tnbbhn.exe44⤵
- Executes dropped EXE
-
\??\c:\vvjpj.exec:\vvjpj.exe45⤵
- Executes dropped EXE
-
\??\c:\xrllrrf.exec:\xrllrrf.exe46⤵
- Executes dropped EXE
-
\??\c:\1lflfrf.exec:\1lflfrf.exe47⤵
- Executes dropped EXE
-
\??\c:\9nnbth.exec:\9nnbth.exe48⤵
- Executes dropped EXE
-
\??\c:\bbhbht.exec:\bbhbht.exe49⤵
- Executes dropped EXE
-
\??\c:\vdvpd.exec:\vdvpd.exe50⤵
- Executes dropped EXE
-
\??\c:\llffxfr.exec:\llffxfr.exe51⤵
- Executes dropped EXE
-
\??\c:\lffflrr.exec:\lffflrr.exe52⤵
- Executes dropped EXE
-
\??\c:\hbtnth.exec:\hbtnth.exe53⤵
- Executes dropped EXE
-
\??\c:\dppjj.exec:\dppjj.exe54⤵
- Executes dropped EXE
-
\??\c:\rlfrflf.exec:\rlfrflf.exe55⤵
- Executes dropped EXE
-
\??\c:\5lxrfff.exec:\5lxrfff.exe56⤵
- Executes dropped EXE
-
\??\c:\9nhnbb.exec:\9nhnbb.exe57⤵
- Executes dropped EXE
-
\??\c:\dvpjp.exec:\dvpjp.exe58⤵
- Executes dropped EXE
-
\??\c:\3vjvv.exec:\3vjvv.exe59⤵
- Executes dropped EXE
-
\??\c:\llxxfll.exec:\llxxfll.exe60⤵
- Executes dropped EXE
-
\??\c:\llxlflr.exec:\llxlflr.exe61⤵
- Executes dropped EXE
-
\??\c:\7bbhbh.exec:\7bbhbh.exe62⤵
- Executes dropped EXE
-
\??\c:\7vpvd.exec:\7vpvd.exe63⤵
- Executes dropped EXE
-
\??\c:\5dvdj.exec:\5dvdj.exe64⤵
- Executes dropped EXE
-
\??\c:\ntbhnn.exec:\ntbhnn.exe65⤵
- Executes dropped EXE
-
\??\c:\bhnhnb.exec:\bhnhnb.exe66⤵
-
\??\c:\dpvvd.exec:\dpvvd.exe67⤵
-
\??\c:\xrxlrll.exec:\xrxlrll.exe68⤵
-
\??\c:\flfrxxf.exec:\flfrxxf.exe69⤵
-
\??\c:\hbnhnh.exec:\hbnhnh.exe70⤵
-
\??\c:\bhthbt.exec:\bhthbt.exe71⤵
-
\??\c:\vppjj.exec:\vppjj.exe72⤵
-
\??\c:\1lrflrf.exec:\1lrflrf.exe73⤵
-
\??\c:\rlfllfl.exec:\rlfllfl.exe74⤵
-
\??\c:\tttbhb.exec:\tttbhb.exe75⤵
-
\??\c:\htnnhn.exec:\htnnhn.exe76⤵
-
\??\c:\jjvjv.exec:\jjvjv.exe77⤵
-
\??\c:\dpddd.exec:\dpddd.exe78⤵
-
\??\c:\rlxlxfl.exec:\rlxlxfl.exe79⤵
-
\??\c:\ttttnt.exec:\ttttnt.exe80⤵
-
\??\c:\tttnbn.exec:\tttnbn.exe81⤵
-
\??\c:\pjpdj.exec:\pjpdj.exe82⤵
-
\??\c:\dddvd.exec:\dddvd.exe83⤵
-
\??\c:\fflxlfx.exec:\fflxlfx.exe84⤵
-
\??\c:\hnnhhb.exec:\hnnhhb.exe85⤵
-
\??\c:\nnnhtt.exec:\nnnhtt.exe86⤵
-
\??\c:\7vjjv.exec:\7vjjv.exe87⤵
-
\??\c:\rlxflrx.exec:\rlxflrx.exe88⤵
-
\??\c:\ffffxlx.exec:\ffffxlx.exe89⤵
-
\??\c:\fxxxrxl.exec:\fxxxrxl.exe90⤵
-
\??\c:\hnhhnn.exec:\hnhhnn.exe91⤵
-
\??\c:\vdvvd.exec:\vdvvd.exe92⤵
-
\??\c:\jvddj.exec:\jvddj.exe93⤵
-
\??\c:\fxxlrxf.exec:\fxxlrxf.exe94⤵
-
\??\c:\ffxllxr.exec:\ffxllxr.exe95⤵
-
\??\c:\thttth.exec:\thttth.exe96⤵
-
\??\c:\jjdvd.exec:\jjdvd.exe97⤵
-
\??\c:\ppvvp.exec:\ppvvp.exe98⤵
-
\??\c:\ffrffxx.exec:\ffrffxx.exe99⤵
-
\??\c:\nnthnt.exec:\nnthnt.exe100⤵
-
\??\c:\bnnhhh.exec:\bnnhhh.exe101⤵
-
\??\c:\pddpv.exec:\pddpv.exe102⤵
-
\??\c:\rxllrrx.exec:\rxllrrx.exe103⤵
-
\??\c:\1xlrfxf.exec:\1xlrfxf.exe104⤵
-
\??\c:\tnhbhh.exec:\tnhbhh.exe105⤵
-
\??\c:\jvjpj.exec:\jvjpj.exe106⤵
-
\??\c:\ddddj.exec:\ddddj.exe107⤵
-
\??\c:\lxxxfll.exec:\lxxxfll.exe108⤵
-
\??\c:\tnhnhn.exec:\tnhnhn.exe109⤵
-
\??\c:\bbnthh.exec:\bbnthh.exe110⤵
-
\??\c:\3vdpv.exec:\3vdpv.exe111⤵
-
\??\c:\3frxlrx.exec:\3frxlrx.exe112⤵
-
\??\c:\xrffllx.exec:\xrffllx.exe113⤵
-
\??\c:\5htbnt.exec:\5htbnt.exe114⤵
-
\??\c:\jjdjp.exec:\jjdjp.exe115⤵
-
\??\c:\vvpvj.exec:\vvpvj.exe116⤵
-
\??\c:\fxxlxlr.exec:\fxxlxlr.exe117⤵
-
\??\c:\fflxrrl.exec:\fflxrrl.exe118⤵
-
\??\c:\nnbntt.exec:\nnbntt.exe119⤵
-
\??\c:\hnthbb.exec:\hnthbb.exe120⤵
-
\??\c:\1djjp.exec:\1djjp.exe121⤵
-
\??\c:\jvjjv.exec:\jvjjv.exe122⤵
-
\??\c:\rfrrrxx.exec:\rfrrrxx.exe123⤵
-
\??\c:\lfrrfxl.exec:\lfrrfxl.exe124⤵
-
\??\c:\btntbb.exec:\btntbb.exe125⤵
-
\??\c:\9jdvj.exec:\9jdvj.exe126⤵
-
\??\c:\jdvdj.exec:\jdvdj.exe127⤵
-
\??\c:\flxlfll.exec:\flxlfll.exe128⤵
-
\??\c:\7xllrxx.exec:\7xllrxx.exe129⤵
-
\??\c:\bhnhhb.exec:\bhnhhb.exe130⤵
-
\??\c:\dvpdj.exec:\dvpdj.exe131⤵
-
\??\c:\dpvvd.exec:\dpvvd.exe132⤵
-
\??\c:\fffxxll.exec:\fffxxll.exe133⤵
-
\??\c:\1llrfll.exec:\1llrfll.exe134⤵
-
\??\c:\bthbtb.exec:\bthbtb.exe135⤵
-
\??\c:\dppdd.exec:\dppdd.exe136⤵
-
\??\c:\jddvj.exec:\jddvj.exe137⤵
-
\??\c:\ffrllll.exec:\ffrllll.exe138⤵
-
\??\c:\tbtnhb.exec:\tbtnhb.exe139⤵
-
\??\c:\htnbht.exec:\htnbht.exe140⤵
-
\??\c:\jjdpj.exec:\jjdpj.exe141⤵
-
\??\c:\lrrrrll.exec:\lrrrrll.exe142⤵
-
\??\c:\1rrxflf.exec:\1rrxflf.exe143⤵
-
\??\c:\3hthnb.exec:\3hthnb.exe144⤵
-
\??\c:\jpvdd.exec:\jpvdd.exe145⤵
-
\??\c:\ddpdp.exec:\ddpdp.exe146⤵
-
\??\c:\rfrlrlf.exec:\rfrlrlf.exe147⤵
-
\??\c:\3bttnh.exec:\3bttnh.exe148⤵
-
\??\c:\hbtnnn.exec:\hbtnnn.exe149⤵
-
\??\c:\pvjpp.exec:\pvjpp.exe150⤵
-
\??\c:\jjddp.exec:\jjddp.exe151⤵
-
\??\c:\9rxfxlf.exec:\9rxfxlf.exe152⤵
-
\??\c:\lxxlffx.exec:\lxxlffx.exe153⤵
-
\??\c:\pjvjv.exec:\pjvjv.exe154⤵
-
\??\c:\lllrxff.exec:\lllrxff.exe155⤵
-
\??\c:\xrlxfll.exec:\xrlxfll.exe156⤵
-
\??\c:\nnhtth.exec:\nnhtth.exe157⤵
-
\??\c:\ttttnb.exec:\ttttnb.exe158⤵
-
\??\c:\pjvvj.exec:\pjvvj.exe159⤵
-
\??\c:\fxrfffl.exec:\fxrfffl.exe160⤵
-
\??\c:\rlxxlrx.exec:\rlxxlrx.exe161⤵
-
\??\c:\7btbtt.exec:\7btbtt.exe162⤵
-
\??\c:\5pddp.exec:\5pddp.exe163⤵
-
\??\c:\jjppd.exec:\jjppd.exe164⤵
-
\??\c:\llrrflx.exec:\llrrflx.exe165⤵
-
\??\c:\lfxlxfr.exec:\lfxlxfr.exe166⤵
-
\??\c:\1tbhtt.exec:\1tbhtt.exe167⤵
-
\??\c:\hbntnt.exec:\hbntnt.exe168⤵
-
\??\c:\9ddpp.exec:\9ddpp.exe169⤵
-
\??\c:\vpdpd.exec:\vpdpd.exe170⤵
-
\??\c:\1xrlxfr.exec:\1xrlxfr.exe171⤵
-
\??\c:\9nhtbb.exec:\9nhtbb.exe172⤵
-
\??\c:\nntnht.exec:\nntnht.exe173⤵
-
\??\c:\vpjjv.exec:\vpjjv.exe174⤵
-
\??\c:\pppdj.exec:\pppdj.exe175⤵
-
\??\c:\flrflfl.exec:\flrflfl.exe176⤵
-
\??\c:\thhbbt.exec:\thhbbt.exe177⤵
-
\??\c:\btttbh.exec:\btttbh.exe178⤵
-
\??\c:\ddvjv.exec:\ddvjv.exe179⤵
-
\??\c:\1lrrrxl.exec:\1lrrrxl.exe180⤵
-
\??\c:\xrlrrxf.exec:\xrlrrxf.exe181⤵
-
\??\c:\5btbtb.exec:\5btbtb.exe182⤵
-
\??\c:\tntthb.exec:\tntthb.exe183⤵
-
\??\c:\dvvdj.exec:\dvvdj.exe184⤵
-
\??\c:\ffrffxx.exec:\ffrffxx.exe185⤵
-
\??\c:\1fxllxf.exec:\1fxllxf.exe186⤵
-
\??\c:\hhhbbh.exec:\hhhbbh.exe187⤵
-
\??\c:\jppdj.exec:\jppdj.exe188⤵
-
\??\c:\jpvvv.exec:\jpvvv.exe189⤵
-
\??\c:\xxlfxxx.exec:\xxlfxxx.exe190⤵
-
\??\c:\rrxflrx.exec:\rrxflrx.exe191⤵
-
\??\c:\tbbbnh.exec:\tbbbnh.exe192⤵
-
\??\c:\pdpdj.exec:\pdpdj.exe193⤵
-
\??\c:\pppdp.exec:\pppdp.exe194⤵
-
\??\c:\1ffrlrf.exec:\1ffrlrf.exe195⤵
-
\??\c:\xfrfffr.exec:\xfrfffr.exe196⤵
-
\??\c:\hnnbht.exec:\hnnbht.exe197⤵
-
\??\c:\dvdvp.exec:\dvdvp.exe198⤵
-
\??\c:\ppjpd.exec:\ppjpd.exe199⤵
-
\??\c:\9rlrflr.exec:\9rlrflr.exe200⤵
-
\??\c:\fxrxlrf.exec:\fxrxlrf.exe201⤵
-
\??\c:\5ntbnh.exec:\5ntbnh.exe202⤵
-
\??\c:\7ttbhh.exec:\7ttbhh.exe203⤵
-
\??\c:\3vvdv.exec:\3vvdv.exe204⤵
-
\??\c:\frfrfxx.exec:\frfrfxx.exe205⤵
-
\??\c:\9lflrxf.exec:\9lflrxf.exe206⤵
-
\??\c:\bthnbh.exec:\bthnbh.exe207⤵
-
\??\c:\7nhtnb.exec:\7nhtnb.exe208⤵
-
\??\c:\jvddp.exec:\jvddp.exe209⤵
-
\??\c:\5pdvv.exec:\5pdvv.exe210⤵
-
\??\c:\xfxfrlx.exec:\xfxfrlx.exe211⤵
-
\??\c:\rxfrrll.exec:\rxfrrll.exe212⤵
-
\??\c:\tnhbtn.exec:\tnhbtn.exe213⤵
-
\??\c:\pdpvp.exec:\pdpvp.exe214⤵
-
\??\c:\xxrfxrf.exec:\xxrfxrf.exe215⤵
-
\??\c:\rllxrfx.exec:\rllxrfx.exe216⤵
-
\??\c:\bthhtb.exec:\bthhtb.exe217⤵
-
\??\c:\ppjvj.exec:\ppjvj.exe218⤵
-
\??\c:\ddjpd.exec:\ddjpd.exe219⤵
-
\??\c:\xrlxlxl.exec:\xrlxlxl.exe220⤵
-
\??\c:\ffrlrxl.exec:\ffrlrxl.exe221⤵
-
\??\c:\nhntnt.exec:\nhntnt.exe222⤵
-
\??\c:\hhbhht.exec:\hhbhht.exe223⤵
-
\??\c:\ddvpv.exec:\ddvpv.exe224⤵
-
\??\c:\frxxfxf.exec:\frxxfxf.exe225⤵
-
\??\c:\xxxxlrl.exec:\xxxxlrl.exe226⤵
-
\??\c:\hbnbnb.exec:\hbnbnb.exe227⤵
-
\??\c:\bnbhtn.exec:\bnbhtn.exe228⤵
-
\??\c:\dpvvv.exec:\dpvvv.exe229⤵
-
\??\c:\lrxlrxf.exec:\lrxlrxf.exe230⤵
-
\??\c:\fxrfxxl.exec:\fxrfxxl.exe231⤵
-
\??\c:\tnbbht.exec:\tnbbht.exe232⤵
-
\??\c:\pvvvv.exec:\pvvvv.exe233⤵
-
\??\c:\jdjdj.exec:\jdjdj.exe234⤵
-
\??\c:\xllrrrx.exec:\xllrrrx.exe235⤵
-
\??\c:\xfrlxfl.exec:\xfrlxfl.exe236⤵
-
\??\c:\nbbnnb.exec:\nbbnnb.exe237⤵
-
\??\c:\pjpjj.exec:\pjpjj.exe238⤵
-
\??\c:\jpvjp.exec:\jpvjp.exe239⤵
-
\??\c:\frrfxrr.exec:\frrfxrr.exe240⤵
-
\??\c:\9fxrlrl.exec:\9fxrlrl.exe241⤵