Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-04-2024 07:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
02b4caef6bd4e69332b583ac06c1f558_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
02b4caef6bd4e69332b583ac06c1f558_JaffaCakes118.exe
-
Size
96KB
-
MD5
02b4caef6bd4e69332b583ac06c1f558
-
SHA1
9652a167d99fb9b93ab47cfe36bf1c07a9c7d072
-
SHA256
4fcef8fc484b7057c32467b697edebf43c754d7131780f2e53fa75248e98d2fe
-
SHA512
e1c0fc15bd36d2a41b10af202fbcf89bd2e0f57c1de2a0d945b3863060dc826d20f637ec2720c38d735985ce5bae10fd76b9ec9fbef9c438c762e602ec567d99
-
SSDEEP
3072:ymb3NkkiQ3mdBjFIVLd2hWZGreRCUlbOgWjM:n3C9BRIVLdPWjM
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
Processes:
resource yara_rule behavioral1/memory/1132-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/856-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3040-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1280-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2984-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2984-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/312-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1608-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1960-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1520-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1772-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/584-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/840-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1668-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1012-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/964-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2208-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1944-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
1hbntn.exejvdvd.exexlllrll.exenbnntb.exejvvdd.exe3dppv.exe5lfxxxx.exetnttbb.exe1hnttn.exejjddj.exepdddd.exexrrlrrr.exe3bbbtn.exetnthhb.exe5dpvv.exexrffffl.exefxlllff.exe5thnnh.exe1hnbtn.exe5dpdv.exe5flffff.exerflflxf.exe7ntnnh.exehtbbtn.exepvvpj.exepvdpj.exexffxlff.exelxlrxxf.exethtbtt.exe3dddd.exejdjjj.exexrfxfxf.exe3frlrlr.exebtbbnn.exepdpjj.exe7vjdv.exepdjdd.exe1rxrrff.exellffrfx.exettbttn.exethbbbb.exe1dpvp.exevjddd.exe7pppp.exerxlffrl.exebbtthn.exe9thbth.exebhhhbt.exevppdv.exe1djdv.exefrrlfxf.exerlxxlxl.exebnbhhh.exenbnnhh.exejvjjj.exepddjj.exe1lxrrxx.exebnnttb.exepjjpv.exe7jvvp.exefxrlxrx.exelxlfffx.exetnhtnn.exetbbtht.exepid process 856 1hbntn.exe 3040 jvdvd.exe 1280 xlllrll.exe 2824 nbnntb.exe 2560 jvvdd.exe 2984 3dppv.exe 2436 5lfxxxx.exe 2176 tnttbb.exe 312 1hnttn.exe 2752 jjddj.exe 2528 pdddd.exe 2920 xrrlrrr.exe 1608 3bbbtn.exe 1960 tnthhb.exe 1620 5dpvv.exe 2428 xrffffl.exe 1520 fxlllff.exe 1772 5thnnh.exe 2948 1hnbtn.exe 2284 5dpdv.exe 2832 5flffff.exe 2288 rflflxf.exe 584 7ntnnh.exe 840 htbbtn.exe 1668 pvvpj.exe 1328 pvdpj.exe 1012 xffxlff.exe 964 lxlrxxf.exe 2208 thtbtt.exe 1944 3dddd.exe 2848 jdjjj.exe 1504 xrfxfxf.exe 1796 3frlrlr.exe 1604 btbbnn.exe 2184 pdpjj.exe 3028 7vjdv.exe 2656 pdjdd.exe 2552 1rxrrff.exe 2700 llffrfx.exe 2688 ttbttn.exe 2776 thbbbb.exe 2704 1dpvp.exe 2484 vjddd.exe 2992 7pppp.exe 2176 rxlffrl.exe 1200 bbtthn.exe 312 9thbth.exe 2900 bhhhbt.exe 2528 vppdv.exe 1692 1djdv.exe 2388 frrlfxf.exe 352 rlxxlxl.exe 1588 bnbhhh.exe 2180 nbnnhh.exe 1788 jvjjj.exe 2480 pddjj.exe 2164 1lxrrxx.exe 3044 bnnttb.exe 2948 pjjpv.exe 2284 7jvvp.exe 784 fxrlxrx.exe 600 lxlfffx.exe 1472 tnhtnn.exe 3008 tbbtht.exe -
Processes:
resource yara_rule behavioral1/memory/1132-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/856-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1280-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/312-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1608-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1960-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1520-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1772-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/584-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1668-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1012-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/964-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2208-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1944-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-300-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
02b4caef6bd4e69332b583ac06c1f558_JaffaCakes118.exe1hbntn.exejvdvd.exexlllrll.exenbnntb.exejvvdd.exe3dppv.exe5lfxxxx.exetnttbb.exe1hnttn.exejjddj.exepdddd.exexrrlrrr.exe3bbbtn.exetnthhb.exe5dpvv.exedescription pid process target process PID 1132 wrote to memory of 856 1132 02b4caef6bd4e69332b583ac06c1f558_JaffaCakes118.exe 1hbntn.exe PID 1132 wrote to memory of 856 1132 02b4caef6bd4e69332b583ac06c1f558_JaffaCakes118.exe 1hbntn.exe PID 1132 wrote to memory of 856 1132 02b4caef6bd4e69332b583ac06c1f558_JaffaCakes118.exe 1hbntn.exe PID 1132 wrote to memory of 856 1132 02b4caef6bd4e69332b583ac06c1f558_JaffaCakes118.exe 1hbntn.exe PID 856 wrote to memory of 3040 856 1hbntn.exe jvdvd.exe PID 856 wrote to memory of 3040 856 1hbntn.exe jvdvd.exe PID 856 wrote to memory of 3040 856 1hbntn.exe jvdvd.exe PID 856 wrote to memory of 3040 856 1hbntn.exe jvdvd.exe PID 3040 wrote to memory of 1280 3040 jvdvd.exe xlllrll.exe PID 3040 wrote to memory of 1280 3040 jvdvd.exe xlllrll.exe PID 3040 wrote to memory of 1280 3040 jvdvd.exe xlllrll.exe PID 3040 wrote to memory of 1280 3040 jvdvd.exe xlllrll.exe PID 1280 wrote to memory of 2824 1280 xlllrll.exe nbnntb.exe PID 1280 wrote to memory of 2824 1280 xlllrll.exe nbnntb.exe PID 1280 wrote to memory of 2824 1280 xlllrll.exe nbnntb.exe PID 1280 wrote to memory of 2824 1280 xlllrll.exe nbnntb.exe PID 2824 wrote to memory of 2560 2824 nbnntb.exe jvvdd.exe PID 2824 wrote to memory of 2560 2824 nbnntb.exe jvvdd.exe PID 2824 wrote to memory of 2560 2824 nbnntb.exe jvvdd.exe PID 2824 wrote to memory of 2560 2824 nbnntb.exe jvvdd.exe PID 2560 wrote to memory of 2984 2560 jvvdd.exe 3dppv.exe PID 2560 wrote to memory of 2984 2560 jvvdd.exe 3dppv.exe PID 2560 wrote to memory of 2984 2560 jvvdd.exe 3dppv.exe PID 2560 wrote to memory of 2984 2560 jvvdd.exe 3dppv.exe PID 2984 wrote to memory of 2436 2984 3dppv.exe 5lfxxxx.exe PID 2984 wrote to memory of 2436 2984 3dppv.exe 5lfxxxx.exe PID 2984 wrote to memory of 2436 2984 3dppv.exe 5lfxxxx.exe PID 2984 wrote to memory of 2436 2984 3dppv.exe 5lfxxxx.exe PID 2436 wrote to memory of 2176 2436 5lfxxxx.exe tnttbb.exe PID 2436 wrote to memory of 2176 2436 5lfxxxx.exe tnttbb.exe PID 2436 wrote to memory of 2176 2436 5lfxxxx.exe tnttbb.exe PID 2436 wrote to memory of 2176 2436 5lfxxxx.exe tnttbb.exe PID 2176 wrote to memory of 312 2176 tnttbb.exe 1hnttn.exe PID 2176 wrote to memory of 312 2176 tnttbb.exe 1hnttn.exe PID 2176 wrote to memory of 312 2176 tnttbb.exe 1hnttn.exe PID 2176 wrote to memory of 312 2176 tnttbb.exe 1hnttn.exe PID 312 wrote to memory of 2752 312 1hnttn.exe jjddj.exe PID 312 wrote to memory of 2752 312 1hnttn.exe jjddj.exe PID 312 wrote to memory of 2752 312 1hnttn.exe jjddj.exe PID 312 wrote to memory of 2752 312 1hnttn.exe jjddj.exe PID 2752 wrote to memory of 2528 2752 jjddj.exe pdddd.exe PID 2752 wrote to memory of 2528 2752 jjddj.exe pdddd.exe PID 2752 wrote to memory of 2528 2752 jjddj.exe pdddd.exe PID 2752 wrote to memory of 2528 2752 jjddj.exe pdddd.exe PID 2528 wrote to memory of 2920 2528 pdddd.exe xrrlrrr.exe PID 2528 wrote to memory of 2920 2528 pdddd.exe xrrlrrr.exe PID 2528 wrote to memory of 2920 2528 pdddd.exe xrrlrrr.exe PID 2528 wrote to memory of 2920 2528 pdddd.exe xrrlrrr.exe PID 2920 wrote to memory of 1608 2920 xrrlrrr.exe 3bbbtn.exe PID 2920 wrote to memory of 1608 2920 xrrlrrr.exe 3bbbtn.exe PID 2920 wrote to memory of 1608 2920 xrrlrrr.exe 3bbbtn.exe PID 2920 wrote to memory of 1608 2920 xrrlrrr.exe 3bbbtn.exe PID 1608 wrote to memory of 1960 1608 3bbbtn.exe tnthhb.exe PID 1608 wrote to memory of 1960 1608 3bbbtn.exe tnthhb.exe PID 1608 wrote to memory of 1960 1608 3bbbtn.exe tnthhb.exe PID 1608 wrote to memory of 1960 1608 3bbbtn.exe tnthhb.exe PID 1960 wrote to memory of 1620 1960 tnthhb.exe 5dpvv.exe PID 1960 wrote to memory of 1620 1960 tnthhb.exe 5dpvv.exe PID 1960 wrote to memory of 1620 1960 tnthhb.exe 5dpvv.exe PID 1960 wrote to memory of 1620 1960 tnthhb.exe 5dpvv.exe PID 1620 wrote to memory of 2428 1620 5dpvv.exe xrffffl.exe PID 1620 wrote to memory of 2428 1620 5dpvv.exe xrffffl.exe PID 1620 wrote to memory of 2428 1620 5dpvv.exe xrffffl.exe PID 1620 wrote to memory of 2428 1620 5dpvv.exe xrffffl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\02b4caef6bd4e69332b583ac06c1f558_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\02b4caef6bd4e69332b583ac06c1f558_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\1hbntn.exec:\1hbntn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvdvd.exec:\jvdvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xlllrll.exec:\xlllrll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbnntb.exec:\nbnntb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvvdd.exec:\jvvdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3dppv.exec:\3dppv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5lfxxxx.exec:\5lfxxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnttbb.exec:\tnttbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1hnttn.exec:\1hnttn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjddj.exec:\jjddj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdddd.exec:\pdddd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrrlrrr.exec:\xrrlrrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3bbbtn.exec:\3bbbtn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnthhb.exec:\tnthhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5dpvv.exec:\5dpvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrffffl.exec:\xrffffl.exe17⤵
- Executes dropped EXE
-
\??\c:\fxlllff.exec:\fxlllff.exe18⤵
- Executes dropped EXE
-
\??\c:\5thnnh.exec:\5thnnh.exe19⤵
- Executes dropped EXE
-
\??\c:\1hnbtn.exec:\1hnbtn.exe20⤵
- Executes dropped EXE
-
\??\c:\5dpdv.exec:\5dpdv.exe21⤵
- Executes dropped EXE
-
\??\c:\5flffff.exec:\5flffff.exe22⤵
- Executes dropped EXE
-
\??\c:\rflflxf.exec:\rflflxf.exe23⤵
- Executes dropped EXE
-
\??\c:\7ntnnh.exec:\7ntnnh.exe24⤵
- Executes dropped EXE
-
\??\c:\htbbtn.exec:\htbbtn.exe25⤵
- Executes dropped EXE
-
\??\c:\pvvpj.exec:\pvvpj.exe26⤵
- Executes dropped EXE
-
\??\c:\pvdpj.exec:\pvdpj.exe27⤵
- Executes dropped EXE
-
\??\c:\xffxlff.exec:\xffxlff.exe28⤵
- Executes dropped EXE
-
\??\c:\lxlrxxf.exec:\lxlrxxf.exe29⤵
- Executes dropped EXE
-
\??\c:\thtbtt.exec:\thtbtt.exe30⤵
- Executes dropped EXE
-
\??\c:\3dddd.exec:\3dddd.exe31⤵
- Executes dropped EXE
-
\??\c:\jdjjj.exec:\jdjjj.exe32⤵
- Executes dropped EXE
-
\??\c:\xrfxfxf.exec:\xrfxfxf.exe33⤵
- Executes dropped EXE
-
\??\c:\3frlrlr.exec:\3frlrlr.exe34⤵
- Executes dropped EXE
-
\??\c:\btbbnn.exec:\btbbnn.exe35⤵
- Executes dropped EXE
-
\??\c:\pdpjj.exec:\pdpjj.exe36⤵
- Executes dropped EXE
-
\??\c:\7vjdv.exec:\7vjdv.exe37⤵
- Executes dropped EXE
-
\??\c:\pdjdd.exec:\pdjdd.exe38⤵
- Executes dropped EXE
-
\??\c:\1rxrrff.exec:\1rxrrff.exe39⤵
- Executes dropped EXE
-
\??\c:\llffrfx.exec:\llffrfx.exe40⤵
- Executes dropped EXE
-
\??\c:\ttbttn.exec:\ttbttn.exe41⤵
- Executes dropped EXE
-
\??\c:\thbbbb.exec:\thbbbb.exe42⤵
- Executes dropped EXE
-
\??\c:\1dpvp.exec:\1dpvp.exe43⤵
- Executes dropped EXE
-
\??\c:\vjddd.exec:\vjddd.exe44⤵
- Executes dropped EXE
-
\??\c:\7pppp.exec:\7pppp.exe45⤵
- Executes dropped EXE
-
\??\c:\rxlffrl.exec:\rxlffrl.exe46⤵
- Executes dropped EXE
-
\??\c:\bbtthn.exec:\bbtthn.exe47⤵
- Executes dropped EXE
-
\??\c:\9thbth.exec:\9thbth.exe48⤵
- Executes dropped EXE
-
\??\c:\bhhhbt.exec:\bhhhbt.exe49⤵
- Executes dropped EXE
-
\??\c:\vppdv.exec:\vppdv.exe50⤵
- Executes dropped EXE
-
\??\c:\1djdv.exec:\1djdv.exe51⤵
- Executes dropped EXE
-
\??\c:\frrlfxf.exec:\frrlfxf.exe52⤵
- Executes dropped EXE
-
\??\c:\rlxxlxl.exec:\rlxxlxl.exe53⤵
- Executes dropped EXE
-
\??\c:\bnbhhh.exec:\bnbhhh.exe54⤵
- Executes dropped EXE
-
\??\c:\nbnnhh.exec:\nbnnhh.exe55⤵
- Executes dropped EXE
-
\??\c:\jvjjj.exec:\jvjjj.exe56⤵
- Executes dropped EXE
-
\??\c:\pddjj.exec:\pddjj.exe57⤵
- Executes dropped EXE
-
\??\c:\1lxrrxx.exec:\1lxrrxx.exe58⤵
- Executes dropped EXE
-
\??\c:\bnnttb.exec:\bnnttb.exe59⤵
- Executes dropped EXE
-
\??\c:\pjjpv.exec:\pjjpv.exe60⤵
- Executes dropped EXE
-
\??\c:\7jvvp.exec:\7jvvp.exe61⤵
- Executes dropped EXE
-
\??\c:\fxrlxrx.exec:\fxrlxrx.exe62⤵
- Executes dropped EXE
-
\??\c:\lxlfffx.exec:\lxlfffx.exe63⤵
- Executes dropped EXE
-
\??\c:\tnhtnn.exec:\tnhtnn.exe64⤵
- Executes dropped EXE
-
\??\c:\tbbtht.exec:\tbbtht.exe65⤵
- Executes dropped EXE
-
\??\c:\jdvvj.exec:\jdvvj.exe66⤵
-
\??\c:\vjvpv.exec:\vjvpv.exe67⤵
-
\??\c:\llrxxxf.exec:\llrxxxf.exe68⤵
-
\??\c:\rfrxffl.exec:\rfrxffl.exe69⤵
-
\??\c:\tbthnb.exec:\tbthnb.exe70⤵
-
\??\c:\nhbthh.exec:\nhbthh.exe71⤵
-
\??\c:\vpddj.exec:\vpddj.exe72⤵
-
\??\c:\dppdv.exec:\dppdv.exe73⤵
-
\??\c:\9rllrlx.exec:\9rllrlx.exe74⤵
-
\??\c:\lflrxfx.exec:\lflrxfx.exe75⤵
-
\??\c:\rlflxff.exec:\rlflxff.exe76⤵
-
\??\c:\9nbhnn.exec:\9nbhnn.exe77⤵
-
\??\c:\hbtttb.exec:\hbtttb.exe78⤵
-
\??\c:\vjjvv.exec:\vjjvv.exe79⤵
-
\??\c:\pvjdj.exec:\pvjdj.exe80⤵
-
\??\c:\lrfxrff.exec:\lrfxrff.exe81⤵
-
\??\c:\lxffrrx.exec:\lxffrrx.exe82⤵
-
\??\c:\nnbntt.exec:\nnbntt.exe83⤵
-
\??\c:\tnnhhn.exec:\tnnhhn.exe84⤵
-
\??\c:\jdvvj.exec:\jdvvj.exe85⤵
-
\??\c:\jdppv.exec:\jdppv.exe86⤵
-
\??\c:\llxfxfr.exec:\llxfxfr.exe87⤵
-
\??\c:\lfxfllr.exec:\lfxfllr.exe88⤵
-
\??\c:\xlxxflr.exec:\xlxxflr.exe89⤵
-
\??\c:\thnthh.exec:\thnthh.exe90⤵
-
\??\c:\nbttbb.exec:\nbttbb.exe91⤵
-
\??\c:\pjjpv.exec:\pjjpv.exe92⤵
-
\??\c:\dvvvd.exec:\dvvvd.exe93⤵
-
\??\c:\xlxlxfr.exec:\xlxlxfr.exe94⤵
-
\??\c:\lfxfrxf.exec:\lfxfrxf.exe95⤵
-
\??\c:\hbbbnn.exec:\hbbbnn.exe96⤵
-
\??\c:\hbhhnb.exec:\hbhhnb.exe97⤵
-
\??\c:\hbttnn.exec:\hbttnn.exe98⤵
-
\??\c:\1dvdj.exec:\1dvdj.exe99⤵
-
\??\c:\vpddj.exec:\vpddj.exe100⤵
-
\??\c:\frrrlff.exec:\frrrlff.exe101⤵
-
\??\c:\thtbbb.exec:\thtbbb.exe102⤵
-
\??\c:\nhhhbb.exec:\nhhhbb.exe103⤵
-
\??\c:\pjpjp.exec:\pjpjp.exe104⤵
-
\??\c:\9jvvv.exec:\9jvvv.exe105⤵
-
\??\c:\rflrxxf.exec:\rflrxxf.exe106⤵
-
\??\c:\flxxlfr.exec:\flxxlfr.exe107⤵
-
\??\c:\nhtbbh.exec:\nhtbbh.exe108⤵
-
\??\c:\1htntt.exec:\1htntt.exe109⤵
-
\??\c:\5jvvd.exec:\5jvvd.exe110⤵
-
\??\c:\vjpvv.exec:\vjpvv.exe111⤵
-
\??\c:\vvpvj.exec:\vvpvj.exe112⤵
-
\??\c:\lfrlfff.exec:\lfrlfff.exe113⤵
-
\??\c:\xlfxlrx.exec:\xlfxlrx.exe114⤵
-
\??\c:\nbnnnh.exec:\nbnnnh.exe115⤵
-
\??\c:\btnthh.exec:\btnthh.exe116⤵
-
\??\c:\3vjjj.exec:\3vjjj.exe117⤵
-
\??\c:\3vppj.exec:\3vppj.exe118⤵
-
\??\c:\xlxrrll.exec:\xlxrrll.exe119⤵
-
\??\c:\rrlrxxf.exec:\rrlrxxf.exe120⤵
-
\??\c:\hhbnbb.exec:\hhbnbb.exe121⤵
-
\??\c:\bntbnh.exec:\bntbnh.exe122⤵
-
\??\c:\btbhhb.exec:\btbhhb.exe123⤵
-
\??\c:\5ppdj.exec:\5ppdj.exe124⤵
-
\??\c:\vpvpd.exec:\vpvpd.exe125⤵
-
\??\c:\5lxxlrr.exec:\5lxxlrr.exe126⤵
-
\??\c:\ffrxxfl.exec:\ffrxxfl.exe127⤵
-
\??\c:\hthhhh.exec:\hthhhh.exe128⤵
-
\??\c:\3nbttb.exec:\3nbttb.exe129⤵
-
\??\c:\ddpjd.exec:\ddpjd.exe130⤵
-
\??\c:\pdjjp.exec:\pdjjp.exe131⤵
-
\??\c:\7xlrfxl.exec:\7xlrfxl.exe132⤵
-
\??\c:\xffllrr.exec:\xffllrr.exe133⤵
-
\??\c:\bbnbnb.exec:\bbnbnb.exe134⤵
-
\??\c:\nhbttb.exec:\nhbttb.exe135⤵
-
\??\c:\dvddj.exec:\dvddj.exe136⤵
-
\??\c:\pdpjj.exec:\pdpjj.exe137⤵
-
\??\c:\jdjjp.exec:\jdjjp.exe138⤵
-
\??\c:\3xxllrr.exec:\3xxllrr.exe139⤵
-
\??\c:\1lxflll.exec:\1lxflll.exe140⤵
-
\??\c:\7htbnn.exec:\7htbnn.exe141⤵
-
\??\c:\9nhnnn.exec:\9nhnnn.exe142⤵
-
\??\c:\1jjdj.exec:\1jjdj.exe143⤵
-
\??\c:\vpddp.exec:\vpddp.exe144⤵
-
\??\c:\xllrrrx.exec:\xllrrrx.exe145⤵
-
\??\c:\rrllfrf.exec:\rrllfrf.exe146⤵
-
\??\c:\9rfffxl.exec:\9rfffxl.exe147⤵
-
\??\c:\1hnnbb.exec:\1hnnbb.exe148⤵
-
\??\c:\nhthtt.exec:\nhthtt.exe149⤵
-
\??\c:\5vvdd.exec:\5vvdd.exe150⤵
-
\??\c:\jvdjj.exec:\jvdjj.exe151⤵
-
\??\c:\rrrfxfx.exec:\rrrfxfx.exe152⤵
-
\??\c:\3frrrll.exec:\3frrrll.exe153⤵
-
\??\c:\5bntbt.exec:\5bntbt.exe154⤵
-
\??\c:\tntttn.exec:\tntttn.exe155⤵
-
\??\c:\vpdjv.exec:\vpdjv.exe156⤵
-
\??\c:\9dvdj.exec:\9dvdj.exe157⤵
-
\??\c:\3rfxflr.exec:\3rfxflr.exe158⤵
-
\??\c:\3lflrrx.exec:\3lflrrx.exe159⤵
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe160⤵
-
\??\c:\3hbtth.exec:\3hbtth.exe161⤵
-
\??\c:\nbhbhh.exec:\nbhbhh.exe162⤵
-
\??\c:\dvvjv.exec:\dvvjv.exe163⤵
-
\??\c:\jdddj.exec:\jdddj.exe164⤵
-
\??\c:\1rrrrxf.exec:\1rrrrxf.exe165⤵
-
\??\c:\5lxxlrf.exec:\5lxxlrf.exe166⤵
-
\??\c:\tnbbnn.exec:\tnbbnn.exe167⤵
-
\??\c:\hthbhh.exec:\hthbhh.exe168⤵
-
\??\c:\hbhhbh.exec:\hbhhbh.exe169⤵
-
\??\c:\5vddp.exec:\5vddp.exe170⤵
-
\??\c:\1vjpp.exec:\1vjpp.exe171⤵
-
\??\c:\xrfrrrx.exec:\xrfrrrx.exe172⤵
-
\??\c:\xlxffff.exec:\xlxffff.exe173⤵
-
\??\c:\thbbhh.exec:\thbbhh.exe174⤵
-
\??\c:\1btbhh.exec:\1btbhh.exe175⤵
-
\??\c:\vpdpp.exec:\vpdpp.exe176⤵
-
\??\c:\pvjjp.exec:\pvjjp.exe177⤵
-
\??\c:\3rlrrff.exec:\3rlrrff.exe178⤵
-
\??\c:\xllrrxf.exec:\xllrrxf.exe179⤵
-
\??\c:\thnhnh.exec:\thnhnh.exe180⤵
-
\??\c:\7nnttt.exec:\7nnttt.exe181⤵
-
\??\c:\pjddp.exec:\pjddp.exe182⤵
-
\??\c:\dvjpp.exec:\dvjpp.exe183⤵
-
\??\c:\vjppj.exec:\vjppj.exe184⤵
-
\??\c:\xlxrlrf.exec:\xlxrlrf.exe185⤵
-
\??\c:\xlxxlfl.exec:\xlxxlfl.exe186⤵
-
\??\c:\htbbbb.exec:\htbbbb.exe187⤵
-
\??\c:\nhtbnn.exec:\nhtbnn.exe188⤵
-
\??\c:\dpdvd.exec:\dpdvd.exe189⤵
-
\??\c:\vjvdj.exec:\vjvdj.exe190⤵
-
\??\c:\rllrxxf.exec:\rllrxxf.exe191⤵
-
\??\c:\frrrfll.exec:\frrrfll.exe192⤵
-
\??\c:\7nnhnn.exec:\7nnhnn.exe193⤵
-
\??\c:\thtbbt.exec:\thtbbt.exe194⤵
-
\??\c:\1nhnhb.exec:\1nhnhb.exe195⤵
-
\??\c:\dvpvv.exec:\dvpvv.exe196⤵
-
\??\c:\pdppp.exec:\pdppp.exe197⤵
-
\??\c:\7lxfffl.exec:\7lxfffl.exe198⤵
-
\??\c:\xrffrll.exec:\xrffrll.exe199⤵
-
\??\c:\btnthh.exec:\btnthh.exe200⤵
-
\??\c:\thnhbt.exec:\thnhbt.exe201⤵
-
\??\c:\7jddd.exec:\7jddd.exe202⤵
-
\??\c:\1pdpp.exec:\1pdpp.exe203⤵
-
\??\c:\5dppv.exec:\5dppv.exe204⤵
-
\??\c:\rrxlxfl.exec:\rrxlxfl.exe205⤵
-
\??\c:\thnttt.exec:\thnttt.exe206⤵
-
\??\c:\hbntnh.exec:\hbntnh.exe207⤵
-
\??\c:\7thbhb.exec:\7thbhb.exe208⤵
-
\??\c:\pjpjj.exec:\pjpjj.exe209⤵
-
\??\c:\vjjjv.exec:\vjjjv.exe210⤵
-
\??\c:\3flffrr.exec:\3flffrr.exe211⤵
-
\??\c:\lxllrrx.exec:\lxllrrx.exe212⤵
-
\??\c:\9lfxfxx.exec:\9lfxfxx.exe213⤵
-
\??\c:\thtttn.exec:\thtttn.exe214⤵
-
\??\c:\bnbbhb.exec:\bnbbhb.exe215⤵
-
\??\c:\dpvdv.exec:\dpvdv.exe216⤵
-
\??\c:\jpvjv.exec:\jpvjv.exe217⤵
-
\??\c:\xrxxflr.exec:\xrxxflr.exe218⤵
-
\??\c:\3frrrrx.exec:\3frrrrx.exe219⤵
-
\??\c:\thnntt.exec:\thnntt.exe220⤵
-
\??\c:\hthhht.exec:\hthhht.exe221⤵
-
\??\c:\pjvvv.exec:\pjvvv.exe222⤵
-
\??\c:\pjvdd.exec:\pjvdd.exe223⤵
-
\??\c:\lfrlllr.exec:\lfrlllr.exe224⤵
-
\??\c:\bnhhnn.exec:\bnhhnn.exe225⤵
-
\??\c:\vpvvv.exec:\vpvvv.exe226⤵
-
\??\c:\1pjjv.exec:\1pjjv.exe227⤵
-
\??\c:\fxflrrf.exec:\fxflrrf.exe228⤵
-
\??\c:\5nhhnn.exec:\5nhhnn.exe229⤵
-
\??\c:\jpvpj.exec:\jpvpj.exe230⤵
-
\??\c:\vjvvp.exec:\vjvvp.exe231⤵
-
\??\c:\lxrlxrr.exec:\lxrlxrr.exe232⤵
-
\??\c:\xllffxx.exec:\xllffxx.exe233⤵
-
\??\c:\hnttth.exec:\hnttth.exe234⤵
-
\??\c:\bthtbb.exec:\bthtbb.exe235⤵
-
\??\c:\btbhbb.exec:\btbhbb.exe236⤵
-
\??\c:\jdjjd.exec:\jdjjd.exe237⤵
-
\??\c:\jdppj.exec:\jdppj.exe238⤵
-
\??\c:\dpvdd.exec:\dpvdd.exe239⤵
-
\??\c:\3lfrxrx.exec:\3lfrxrx.exe240⤵
-
\??\c:\bthhhh.exec:\bthhhh.exe241⤵