Analysis
-
max time kernel
152s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
05-07-2024 02:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cc5af6ad30d92abb514a6b33ef9c82e8ec8c32d5cf312331f9ae354c656df814.exe
Resource
win7-20240704-en
5 signatures
150 seconds
General
-
Target
cc5af6ad30d92abb514a6b33ef9c82e8ec8c32d5cf312331f9ae354c656df814.exe
-
Size
64KB
-
MD5
3baf356734cef6e7dc76a3a04a8383fa
-
SHA1
5cb41daa7459e85a15082005826c71c6c4daf99f
-
SHA256
cc5af6ad30d92abb514a6b33ef9c82e8ec8c32d5cf312331f9ae354c656df814
-
SHA512
1a9013bf3b2b61b3f1719b0ea4b2d858a9d6ddcea82db18b97d7a6add42f1c35d992e77cc0efaa5e3cef0c7312c9cfe965e7625d7293c805014a5090fb3daf42
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvAEaFJL/S:ymb3NkkiQ3mdBjFIvAvq
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/3028-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2184-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1516-305-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1944-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1468-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1360-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1808-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2068-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2912-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1896-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/808-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1708-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1804-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1804-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2376-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rjhlxrn.exepvdbfnt.exetfbppd.exebhttbj.exevtnflj.exerbdtfd.exevjnhlr.exebrxpdx.exejxdfdlh.exexvlhxp.exedxlln.exedtnhdt.exerxtfxxr.exeldhfh.exerrvhbjp.exexxfdvf.exetvfrx.exexrtpv.exenxhrvpt.exetpnvlld.exevrjdpj.exefdpjln.exedvnjn.exeljxprjp.exenllfj.exeltbxhb.exentnvxpv.exebnlhv.exenvrxvp.exeffdjpl.exetjhtxf.exexlfxvd.exeflptrfn.exerbltndl.exedlrdr.exetlxdh.exefvvvr.exelbxdfht.exebnrhtvp.exevdbjnhb.exebhlvddr.exeplhrrt.exerlppxd.exexfflrhv.exehdbhl.exexffxxxh.exerdllll.exetpnjh.exexjjrx.exexlptfj.exetjltbb.exexxjbdxd.exepjbvfd.exetbdpfn.exevjtjtvb.exethddhdl.exeflppr.exexxhrbn.exevfjdh.exelbvxb.exejnvtxl.exejlrlb.exepfbpxpr.exexlhrj.exepid process 3028 rjhlxrn.exe 1804 pvdbfnt.exe 3052 tfbppd.exe 2760 bhttbj.exe 2500 vtnflj.exe 2664 rbdtfd.exe 2440 vjnhlr.exe 2524 brxpdx.exe 2192 jxdfdlh.exe 2676 xvlhxp.exe 1708 dxlln.exe 1904 dtnhdt.exe 2812 rxtfxxr.exe 808 ldhfh.exe 1896 rrvhbjp.exe 2912 xxfdvf.exe 2184 tvfrx.exe 2096 xrtpv.exe 2068 nxhrvpt.exe 1808 tpnvlld.exe 952 vrjdpj.exe 768 fdpjln.exe 936 dvnjn.exe 1360 ljxprjp.exe 2204 nllfj.exe 1468 ltbxhb.exe 1780 ntnvxpv.exe 2240 bnlhv.exe 1944 nvrxvp.exe 1784 ffdjpl.exe 1516 tjhtxf.exe 1800 xlfxvd.exe 3028 flptrfn.exe 1592 rbltndl.exe 2600 dlrdr.exe 2756 tlxdh.exe 2904 fvvvr.exe 2716 lbxdfht.exe 2700 bnrhtvp.exe 2660 vdbjnhb.exe 2512 bhlvddr.exe 2564 plhrrt.exe 2752 rlppxd.exe 1728 xfflrhv.exe 648 hdbhl.exe 1928 xffxxxh.exe 2800 rdllll.exe 1704 tpnjh.exe 1520 xjjrx.exe 748 xlptfj.exe 1916 tjltbb.exe 2084 xxjbdxd.exe 2684 pjbvfd.exe 2184 tbdpfn.exe 2104 vjtjtvb.exe 2920 thddhdl.exe 1344 flppr.exe 592 xxhrbn.exe 1088 vfjdh.exe 2492 lbvxb.exe 2868 jnvtxl.exe 1932 jlrlb.exe 672 pfbpxpr.exe 2128 xlhrj.exe -
Processes:
resource yara_rule behavioral1/memory/3028-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2184-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1516-305-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1944-286-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1468-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1360-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1808-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1896-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/808-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1804-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1804-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-4-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cc5af6ad30d92abb514a6b33ef9c82e8ec8c32d5cf312331f9ae354c656df814.exerjhlxrn.exepvdbfnt.exetfbppd.exebhttbj.exevtnflj.exerbdtfd.exevjnhlr.exebrxpdx.exejxdfdlh.exexvlhxp.exedxlln.exedtnhdt.exerxtfxxr.exeldhfh.exerrvhbjp.exedescription pid process target process PID 2376 wrote to memory of 3028 2376 cc5af6ad30d92abb514a6b33ef9c82e8ec8c32d5cf312331f9ae354c656df814.exe lrhdp.exe PID 2376 wrote to memory of 3028 2376 cc5af6ad30d92abb514a6b33ef9c82e8ec8c32d5cf312331f9ae354c656df814.exe lrhdp.exe PID 2376 wrote to memory of 3028 2376 cc5af6ad30d92abb514a6b33ef9c82e8ec8c32d5cf312331f9ae354c656df814.exe lrhdp.exe PID 2376 wrote to memory of 3028 2376 cc5af6ad30d92abb514a6b33ef9c82e8ec8c32d5cf312331f9ae354c656df814.exe lrhdp.exe PID 3028 wrote to memory of 1804 3028 rjhlxrn.exe pvdbfnt.exe PID 3028 wrote to memory of 1804 3028 rjhlxrn.exe pvdbfnt.exe PID 3028 wrote to memory of 1804 3028 rjhlxrn.exe pvdbfnt.exe PID 3028 wrote to memory of 1804 3028 rjhlxrn.exe pvdbfnt.exe PID 1804 wrote to memory of 3052 1804 pvdbfnt.exe tfbppd.exe PID 1804 wrote to memory of 3052 1804 pvdbfnt.exe tfbppd.exe PID 1804 wrote to memory of 3052 1804 pvdbfnt.exe tfbppd.exe PID 1804 wrote to memory of 3052 1804 pvdbfnt.exe tfbppd.exe PID 3052 wrote to memory of 2760 3052 tfbppd.exe dbnrvlr.exe PID 3052 wrote to memory of 2760 3052 tfbppd.exe dbnrvlr.exe PID 3052 wrote to memory of 2760 3052 tfbppd.exe dbnrvlr.exe PID 3052 wrote to memory of 2760 3052 tfbppd.exe dbnrvlr.exe PID 2760 wrote to memory of 2500 2760 bhttbj.exe vtnflj.exe PID 2760 wrote to memory of 2500 2760 bhttbj.exe vtnflj.exe PID 2760 wrote to memory of 2500 2760 bhttbj.exe vtnflj.exe PID 2760 wrote to memory of 2500 2760 bhttbj.exe vtnflj.exe PID 2500 wrote to memory of 2664 2500 vtnflj.exe rbdtfd.exe PID 2500 wrote to memory of 2664 2500 vtnflj.exe rbdtfd.exe PID 2500 wrote to memory of 2664 2500 vtnflj.exe rbdtfd.exe PID 2500 wrote to memory of 2664 2500 vtnflj.exe rbdtfd.exe PID 2664 wrote to memory of 2440 2664 rbdtfd.exe vjnhlr.exe PID 2664 wrote to memory of 2440 2664 rbdtfd.exe vjnhlr.exe PID 2664 wrote to memory of 2440 2664 rbdtfd.exe vjnhlr.exe PID 2664 wrote to memory of 2440 2664 rbdtfd.exe vjnhlr.exe PID 2440 wrote to memory of 2524 2440 vjnhlr.exe brxpdx.exe PID 2440 wrote to memory of 2524 2440 vjnhlr.exe brxpdx.exe PID 2440 wrote to memory of 2524 2440 vjnhlr.exe brxpdx.exe PID 2440 wrote to memory of 2524 2440 vjnhlr.exe brxpdx.exe PID 2524 wrote to memory of 2192 2524 brxpdx.exe jxdfdlh.exe PID 2524 wrote to memory of 2192 2524 brxpdx.exe jxdfdlh.exe PID 2524 wrote to memory of 2192 2524 brxpdx.exe jxdfdlh.exe PID 2524 wrote to memory of 2192 2524 brxpdx.exe jxdfdlh.exe PID 2192 wrote to memory of 2676 2192 jxdfdlh.exe jrtjljt.exe PID 2192 wrote to memory of 2676 2192 jxdfdlh.exe jrtjljt.exe PID 2192 wrote to memory of 2676 2192 jxdfdlh.exe jrtjljt.exe PID 2192 wrote to memory of 2676 2192 jxdfdlh.exe jrtjljt.exe PID 2676 wrote to memory of 1708 2676 xvlhxp.exe dxlln.exe PID 2676 wrote to memory of 1708 2676 xvlhxp.exe dxlln.exe PID 2676 wrote to memory of 1708 2676 xvlhxp.exe dxlln.exe PID 2676 wrote to memory of 1708 2676 xvlhxp.exe dxlln.exe PID 1708 wrote to memory of 1904 1708 dxlln.exe dtnhdt.exe PID 1708 wrote to memory of 1904 1708 dxlln.exe dtnhdt.exe PID 1708 wrote to memory of 1904 1708 dxlln.exe dtnhdt.exe PID 1708 wrote to memory of 1904 1708 dxlln.exe dtnhdt.exe PID 1904 wrote to memory of 2812 1904 dtnhdt.exe rxtfxxr.exe PID 1904 wrote to memory of 2812 1904 dtnhdt.exe rxtfxxr.exe PID 1904 wrote to memory of 2812 1904 dtnhdt.exe rxtfxxr.exe PID 1904 wrote to memory of 2812 1904 dtnhdt.exe rxtfxxr.exe PID 2812 wrote to memory of 808 2812 rxtfxxr.exe ldhfh.exe PID 2812 wrote to memory of 808 2812 rxtfxxr.exe ldhfh.exe PID 2812 wrote to memory of 808 2812 rxtfxxr.exe ldhfh.exe PID 2812 wrote to memory of 808 2812 rxtfxxr.exe ldhfh.exe PID 808 wrote to memory of 1896 808 ldhfh.exe rrvhbjp.exe PID 808 wrote to memory of 1896 808 ldhfh.exe rrvhbjp.exe PID 808 wrote to memory of 1896 808 ldhfh.exe rrvhbjp.exe PID 808 wrote to memory of 1896 808 ldhfh.exe rrvhbjp.exe PID 1896 wrote to memory of 2912 1896 rrvhbjp.exe dhrxd.exe PID 1896 wrote to memory of 2912 1896 rrvhbjp.exe dhrxd.exe PID 1896 wrote to memory of 2912 1896 rrvhbjp.exe dhrxd.exe PID 1896 wrote to memory of 2912 1896 rrvhbjp.exe dhrxd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc5af6ad30d92abb514a6b33ef9c82e8ec8c32d5cf312331f9ae354c656df814.exe"C:\Users\Admin\AppData\Local\Temp\cc5af6ad30d92abb514a6b33ef9c82e8ec8c32d5cf312331f9ae354c656df814.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\rjhlxrn.exec:\rjhlxrn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvdbfnt.exec:\pvdbfnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tfbppd.exec:\tfbppd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhttbj.exec:\bhttbj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vtnflj.exec:\vtnflj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rbdtfd.exec:\rbdtfd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjnhlr.exec:\vjnhlr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\brxpdx.exec:\brxpdx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jxdfdlh.exec:\jxdfdlh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xvlhxp.exec:\xvlhxp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dxlln.exec:\dxlln.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dtnhdt.exec:\dtnhdt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rxtfxxr.exec:\rxtfxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ldhfh.exec:\ldhfh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrvhbjp.exec:\rrvhbjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxfdvf.exec:\xxfdvf.exe17⤵
- Executes dropped EXE
-
\??\c:\tvfrx.exec:\tvfrx.exe18⤵
- Executes dropped EXE
-
\??\c:\xrtpv.exec:\xrtpv.exe19⤵
- Executes dropped EXE
-
\??\c:\nxhrvpt.exec:\nxhrvpt.exe20⤵
- Executes dropped EXE
-
\??\c:\tpnvlld.exec:\tpnvlld.exe21⤵
- Executes dropped EXE
-
\??\c:\vrjdpj.exec:\vrjdpj.exe22⤵
- Executes dropped EXE
-
\??\c:\fdpjln.exec:\fdpjln.exe23⤵
- Executes dropped EXE
-
\??\c:\dvnjn.exec:\dvnjn.exe24⤵
- Executes dropped EXE
-
\??\c:\ljxprjp.exec:\ljxprjp.exe25⤵
- Executes dropped EXE
-
\??\c:\nllfj.exec:\nllfj.exe26⤵
- Executes dropped EXE
-
\??\c:\ltbxhb.exec:\ltbxhb.exe27⤵
- Executes dropped EXE
-
\??\c:\ntnvxpv.exec:\ntnvxpv.exe28⤵
- Executes dropped EXE
-
\??\c:\bnlhv.exec:\bnlhv.exe29⤵
- Executes dropped EXE
-
\??\c:\nvrxvp.exec:\nvrxvp.exe30⤵
- Executes dropped EXE
-
\??\c:\ffdjpl.exec:\ffdjpl.exe31⤵
- Executes dropped EXE
-
\??\c:\tjhtxf.exec:\tjhtxf.exe32⤵
- Executes dropped EXE
-
\??\c:\xlfxvd.exec:\xlfxvd.exe33⤵
- Executes dropped EXE
-
\??\c:\flptrfn.exec:\flptrfn.exe34⤵
- Executes dropped EXE
-
\??\c:\rbltndl.exec:\rbltndl.exe35⤵
- Executes dropped EXE
-
\??\c:\dlrdr.exec:\dlrdr.exe36⤵
- Executes dropped EXE
-
\??\c:\tlxdh.exec:\tlxdh.exe37⤵
- Executes dropped EXE
-
\??\c:\fvvvr.exec:\fvvvr.exe38⤵
- Executes dropped EXE
-
\??\c:\lbxdfht.exec:\lbxdfht.exe39⤵
- Executes dropped EXE
-
\??\c:\bnrhtvp.exec:\bnrhtvp.exe40⤵
- Executes dropped EXE
-
\??\c:\vdbjnhb.exec:\vdbjnhb.exe41⤵
- Executes dropped EXE
-
\??\c:\bhlvddr.exec:\bhlvddr.exe42⤵
- Executes dropped EXE
-
\??\c:\plhrrt.exec:\plhrrt.exe43⤵
- Executes dropped EXE
-
\??\c:\rlppxd.exec:\rlppxd.exe44⤵
- Executes dropped EXE
-
\??\c:\xfflrhv.exec:\xfflrhv.exe45⤵
- Executes dropped EXE
-
\??\c:\hdbhl.exec:\hdbhl.exe46⤵
- Executes dropped EXE
-
\??\c:\xffxxxh.exec:\xffxxxh.exe47⤵
- Executes dropped EXE
-
\??\c:\rdllll.exec:\rdllll.exe48⤵
- Executes dropped EXE
-
\??\c:\tpnjh.exec:\tpnjh.exe49⤵
- Executes dropped EXE
-
\??\c:\xjjrx.exec:\xjjrx.exe50⤵
- Executes dropped EXE
-
\??\c:\xlptfj.exec:\xlptfj.exe51⤵
- Executes dropped EXE
-
\??\c:\tjltbb.exec:\tjltbb.exe52⤵
- Executes dropped EXE
-
\??\c:\xxjbdxd.exec:\xxjbdxd.exe53⤵
- Executes dropped EXE
-
\??\c:\pjbvfd.exec:\pjbvfd.exe54⤵
- Executes dropped EXE
-
\??\c:\tbdpfn.exec:\tbdpfn.exe55⤵
- Executes dropped EXE
-
\??\c:\vjtjtvb.exec:\vjtjtvb.exe56⤵
- Executes dropped EXE
-
\??\c:\thddhdl.exec:\thddhdl.exe57⤵
- Executes dropped EXE
-
\??\c:\flppr.exec:\flppr.exe58⤵
- Executes dropped EXE
-
\??\c:\xxhrbn.exec:\xxhrbn.exe59⤵
- Executes dropped EXE
-
\??\c:\vfjdh.exec:\vfjdh.exe60⤵
- Executes dropped EXE
-
\??\c:\lbvxb.exec:\lbvxb.exe61⤵
- Executes dropped EXE
-
\??\c:\jnvtxl.exec:\jnvtxl.exe62⤵
- Executes dropped EXE
-
\??\c:\jlrlb.exec:\jlrlb.exe63⤵
- Executes dropped EXE
-
\??\c:\pfbpxpr.exec:\pfbpxpr.exe64⤵
- Executes dropped EXE
-
\??\c:\xlhrj.exec:\xlhrj.exe65⤵
- Executes dropped EXE
-
\??\c:\lblbhx.exec:\lblbhx.exe66⤵
-
\??\c:\vjltrbh.exec:\vjltrbh.exe67⤵
-
\??\c:\fttdhdp.exec:\fttdhdp.exe68⤵
-
\??\c:\vpppthb.exec:\vpppthb.exe69⤵
-
\??\c:\pltxnpd.exec:\pltxnpd.exe70⤵
-
\??\c:\xlpddrx.exec:\xlpddrx.exe71⤵
-
\??\c:\drrlt.exec:\drrlt.exe72⤵
-
\??\c:\txddx.exec:\txddx.exe73⤵
-
\??\c:\rldxf.exec:\rldxf.exe74⤵
-
\??\c:\tlphdvj.exec:\tlphdvj.exe75⤵
-
\??\c:\lrbjr.exec:\lrbjr.exe76⤵
-
\??\c:\jlffnn.exec:\jlffnn.exe77⤵
-
\??\c:\nvtlhrb.exec:\nvtlhrb.exe78⤵
-
\??\c:\dbnrvlr.exec:\dbnrvlr.exe79⤵
-
\??\c:\bfvpfv.exec:\bfvpfv.exe80⤵
-
\??\c:\rxhhhhp.exec:\rxhhhhp.exe81⤵
-
\??\c:\ltblbv.exec:\ltblbv.exe82⤵
-
\??\c:\llphb.exec:\llphb.exe83⤵
-
\??\c:\tldrpn.exec:\tldrpn.exe84⤵
-
\??\c:\njnbfp.exec:\njnbfp.exe85⤵
-
\??\c:\jntpb.exec:\jntpb.exe86⤵
-
\??\c:\pnrhv.exec:\pnrhv.exe87⤵
-
\??\c:\ptljfjf.exec:\ptljfjf.exe88⤵
-
\??\c:\hjtvdj.exec:\hjtvdj.exe89⤵
-
\??\c:\jptbfld.exec:\jptbfld.exe90⤵
-
\??\c:\phnldht.exec:\phnldht.exe91⤵
-
\??\c:\bvjhp.exec:\bvjhp.exe92⤵
-
\??\c:\tdphr.exec:\tdphr.exe93⤵
-
\??\c:\xvvxv.exec:\xvvxv.exe94⤵
-
\??\c:\lppxlr.exec:\lppxlr.exe95⤵
-
\??\c:\hnrddj.exec:\hnrddj.exe96⤵
-
\??\c:\hllbdvt.exec:\hllbdvt.exe97⤵
-
\??\c:\rftlfdl.exec:\rftlfdl.exe98⤵
-
\??\c:\pddvbp.exec:\pddvbp.exe99⤵
-
\??\c:\ntdlbd.exec:\ntdlbd.exe100⤵
-
\??\c:\fvbtf.exec:\fvbtf.exe101⤵
-
\??\c:\vpdvp.exec:\vpdvp.exe102⤵
-
\??\c:\hhhntxt.exec:\hhhntxt.exe103⤵
-
\??\c:\nhllpvn.exec:\nhllpvn.exe104⤵
-
\??\c:\rlrbhtj.exec:\rlrbhtj.exe105⤵
-
\??\c:\frtvfn.exec:\frtvfn.exe106⤵
-
\??\c:\vlrpr.exec:\vlrpr.exe107⤵
-
\??\c:\nbrvftv.exec:\nbrvftv.exe108⤵
-
\??\c:\vjtfh.exec:\vjtfh.exe109⤵
-
\??\c:\tljdxpj.exec:\tljdxpj.exe110⤵
-
\??\c:\rdnjlfp.exec:\rdnjlfp.exe111⤵
-
\??\c:\jxtlrxn.exec:\jxtlrxn.exe112⤵
-
\??\c:\ljrpfh.exec:\ljrpfh.exe113⤵
-
\??\c:\hxtxfh.exec:\hxtxfh.exe114⤵
-
\??\c:\tbnlpln.exec:\tbnlpln.exe115⤵
-
\??\c:\xhthjr.exec:\xhthjr.exe116⤵
-
\??\c:\pttlrp.exec:\pttlrp.exe117⤵
-
\??\c:\dhvnbh.exec:\dhvnbh.exe118⤵
-
\??\c:\jtblf.exec:\jtblf.exe119⤵
-
\??\c:\hdbhpfj.exec:\hdbhpfj.exe120⤵
-
\??\c:\dlvnlj.exec:\dlvnlj.exe121⤵
-
\??\c:\vprdtb.exec:\vprdtb.exe122⤵
-
\??\c:\ltdxb.exec:\ltdxb.exe123⤵
-
\??\c:\fdtfbd.exec:\fdtfbd.exe124⤵
-
\??\c:\xfrjhh.exec:\xfrjhh.exe125⤵
-
\??\c:\nxhdnh.exec:\nxhdnh.exe126⤵
-
\??\c:\dhtrfrt.exec:\dhtrfrt.exe127⤵
-
\??\c:\jjdrv.exec:\jjdrv.exe128⤵
-
\??\c:\thbbll.exec:\thbbll.exe129⤵
-
\??\c:\jltvltt.exec:\jltvltt.exe130⤵
-
\??\c:\ftddrx.exec:\ftddrx.exe131⤵
-
\??\c:\pxhlrtv.exec:\pxhlrtv.exe132⤵
-
\??\c:\ffpjrn.exec:\ffpjrn.exe133⤵
-
\??\c:\lhvlh.exec:\lhvlh.exe134⤵
-
\??\c:\xxhvt.exec:\xxhvt.exe135⤵
-
\??\c:\ndxfb.exec:\ndxfb.exe136⤵
-
\??\c:\fvlfbb.exec:\fvlfbb.exe137⤵
-
\??\c:\xxvblr.exec:\xxvblr.exe138⤵
-
\??\c:\bjtrdj.exec:\bjtrdj.exe139⤵
-
\??\c:\pjpxll.exec:\pjpxll.exe140⤵
-
\??\c:\pltflf.exec:\pltflf.exe141⤵
-
\??\c:\xtrvn.exec:\xtrvn.exe142⤵
-
\??\c:\vhfdnl.exec:\vhfdnl.exe143⤵
-
\??\c:\lrhlp.exec:\lrhlp.exe144⤵
-
\??\c:\llhtfd.exec:\llhtfd.exe145⤵
-
\??\c:\xrvbvbj.exec:\xrvbvbj.exe146⤵
-
\??\c:\vxhnxx.exec:\vxhnxx.exe147⤵
-
\??\c:\nndrt.exec:\nndrt.exe148⤵
-
\??\c:\tnhbllh.exec:\tnhbllh.exe149⤵
-
\??\c:\hpbxbt.exec:\hpbxbt.exe150⤵
-
\??\c:\dfbpfh.exec:\dfbpfh.exe151⤵
-
\??\c:\jtxbh.exec:\jtxbh.exe152⤵
-
\??\c:\xjbrtxn.exec:\xjbrtxn.exe153⤵
-
\??\c:\vhrjxbv.exec:\vhrjxbv.exe154⤵
-
\??\c:\hrbpt.exec:\hrbpt.exe155⤵
-
\??\c:\fnntdlt.exec:\fnntdlt.exe156⤵
-
\??\c:\jplnnhl.exec:\jplnnhl.exe157⤵
-
\??\c:\xbtht.exec:\xbtht.exe158⤵
-
\??\c:\ldjpjx.exec:\ldjpjx.exe159⤵
-
\??\c:\rhlhd.exec:\rhlhd.exe160⤵
-
\??\c:\rphdbx.exec:\rphdbx.exe161⤵
-
\??\c:\vtvhnnt.exec:\vtvhnnt.exe162⤵
-
\??\c:\tbrlxrn.exec:\tbrlxrn.exe163⤵
-
\??\c:\xrblpfn.exec:\xrblpfn.exe164⤵
-
\??\c:\jhlxjrr.exec:\jhlxjrr.exe165⤵
-
\??\c:\btllr.exec:\btllr.exe166⤵
-
\??\c:\lblrjtd.exec:\lblrjtd.exe167⤵
-
\??\c:\lvdxjpd.exec:\lvdxjpd.exe168⤵
-
\??\c:\rftrnd.exec:\rftrnd.exe169⤵
-
\??\c:\jlrrfth.exec:\jlrrfth.exe170⤵
-
\??\c:\pdfxxxr.exec:\pdfxxxr.exe171⤵
-
\??\c:\hpdjlb.exec:\hpdjlb.exe172⤵
-
\??\c:\rntnbtj.exec:\rntnbtj.exe173⤵
-
\??\c:\rlhvf.exec:\rlhvf.exe174⤵
-
\??\c:\pnplh.exec:\pnplh.exe175⤵
-
\??\c:\tltppt.exec:\tltppt.exe176⤵
-
\??\c:\vhtfpp.exec:\vhtfpp.exe177⤵
-
\??\c:\fdfll.exec:\fdfll.exe178⤵
-
\??\c:\bvnxf.exec:\bvnxf.exe179⤵
-
\??\c:\vdltlp.exec:\vdltlp.exe180⤵
-
\??\c:\thrjrx.exec:\thrjrx.exe181⤵
-
\??\c:\jdhhd.exec:\jdhhd.exe182⤵
-
\??\c:\xfrxp.exec:\xfrxp.exe183⤵
-
\??\c:\rjfld.exec:\rjfld.exe184⤵
-
\??\c:\bfrjtp.exec:\bfrjtp.exe185⤵
-
\??\c:\hnjlpln.exec:\hnjlpln.exe186⤵
-
\??\c:\tpjfj.exec:\tpjfj.exe187⤵
-
\??\c:\dxtnrhd.exec:\dxtnrhd.exe188⤵
-
\??\c:\bjvhxt.exec:\bjvhxt.exe189⤵
-
\??\c:\thblfl.exec:\thblfl.exe190⤵
-
\??\c:\lppftdh.exec:\lppftdh.exe191⤵
-
\??\c:\phxjfpp.exec:\phxjfpp.exe192⤵
-
\??\c:\blpxrlj.exec:\blpxrlj.exe193⤵
-
\??\c:\rpfpdbh.exec:\rpfpdbh.exe194⤵
-
\??\c:\lndxf.exec:\lndxf.exe195⤵
-
\??\c:\bpbdn.exec:\bpbdn.exe196⤵
-
\??\c:\jlfbdj.exec:\jlfbdj.exe197⤵
-
\??\c:\vttffr.exec:\vttffr.exe198⤵
-
\??\c:\xvhrtft.exec:\xvhrtft.exe199⤵
-
\??\c:\vjlnxdj.exec:\vjlnxdj.exe200⤵
-
\??\c:\frnjrr.exec:\frnjrr.exe201⤵
-
\??\c:\jhrnn.exec:\jhrnn.exe202⤵
-
\??\c:\xlpvvrf.exec:\xlpvvrf.exe203⤵
-
\??\c:\nnphvr.exec:\nnphvr.exe204⤵
-
\??\c:\rfbprxx.exec:\rfbprxx.exe205⤵
-
\??\c:\pxpbt.exec:\pxpbt.exe206⤵
-
\??\c:\pffbpx.exec:\pffbpx.exe207⤵
-
\??\c:\nbpnlvb.exec:\nbpnlvb.exe208⤵
-
\??\c:\tfpnbvd.exec:\tfpnbvd.exe209⤵
-
\??\c:\hfbht.exec:\hfbht.exe210⤵
-
\??\c:\txfpf.exec:\txfpf.exe211⤵
-
\??\c:\prdrrj.exec:\prdrrj.exe212⤵
-
\??\c:\xhntrj.exec:\xhntrj.exe213⤵
-
\??\c:\brttlf.exec:\brttlf.exe214⤵
-
\??\c:\nbvrt.exec:\nbvrt.exe215⤵
-
\??\c:\rpbvdhx.exec:\rpbvdhx.exe216⤵
-
\??\c:\pvbfnj.exec:\pvbfnj.exe217⤵
-
\??\c:\nrdbjlt.exec:\nrdbjlt.exe218⤵
-
\??\c:\htlvll.exec:\htlvll.exe219⤵
-
\??\c:\btfnffd.exec:\btfnffd.exe220⤵
-
\??\c:\hxbpx.exec:\hxbpx.exe221⤵
-
\??\c:\brxxh.exec:\brxxh.exe222⤵
-
\??\c:\dlltf.exec:\dlltf.exe223⤵
-
\??\c:\ppbltrj.exec:\ppbltrj.exe224⤵
-
\??\c:\ftlxvj.exec:\ftlxvj.exe225⤵
-
\??\c:\jjdfvxd.exec:\jjdfvxd.exe226⤵
-
\??\c:\tjnxj.exec:\tjnxj.exe227⤵
-
\??\c:\brprt.exec:\brprt.exe228⤵
-
\??\c:\xfxbhfv.exec:\xfxbhfv.exe229⤵
-
\??\c:\hjflrn.exec:\hjflrn.exe230⤵
-
\??\c:\fdbjf.exec:\fdbjf.exe231⤵
-
\??\c:\bhtllr.exec:\bhtllr.exe232⤵
-
\??\c:\bvndb.exec:\bvndb.exe233⤵
-
\??\c:\ppttdhp.exec:\ppttdhp.exe234⤵
-
\??\c:\xhxtnnl.exec:\xhxtnnl.exe235⤵
-
\??\c:\ldpbjv.exec:\ldpbjv.exe236⤵
-
\??\c:\fhdhv.exec:\fhdhv.exe237⤵
-
\??\c:\hlrjplr.exec:\hlrjplr.exe238⤵
-
\??\c:\hppprl.exec:\hppprl.exe239⤵
-
\??\c:\ldjxlxd.exec:\ldjxlxd.exe240⤵
-
\??\c:\xtnblhf.exec:\xtnblhf.exe241⤵