Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 04:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
045eea365a3fd5461d643f657712103a_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
045eea365a3fd5461d643f657712103a_JaffaCakes118.exe
-
Size
83KB
-
MD5
045eea365a3fd5461d643f657712103a
-
SHA1
dbd313d2b568df26d1795223d658a35e7c3b850d
-
SHA256
b11abd1c0576861b8de04a23c06e770aff496dc3054579e3759f4c0f312bfee4
-
SHA512
d9628176e95a87e53e2c6660159a690a8aa6af5fe6749c06d67caad998c7070e268c2a7d8042ad76431ba5aee025dfdd154eef9aae80c4136704e89aca1ea279
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIQIDyviFxx2hCtgIMLP9rBZa8:ymb3NkkiQ3mdBjFIVLd2hWZGre8
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/2184-1-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2256-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1224-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1976-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2140-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1592-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1044-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/328-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2312-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1060-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1560-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1020-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/904-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lfxfxfl.exenbhhtt.exevvddp.exe7lxxlrx.exetnbbhh.exetntnbt.exejdppv.exe9dpjp.exefrllrrf.exerlxxffl.exehttnnn.exe9htnnh.exevpjpp.exevjvjp.exerffxffl.exelflrrrr.exe1lxflrx.exe1btbhb.exevpddp.exelllfxxr.exenbhnhb.exe1jvdj.exexrfflfl.exe3lfrrrf.exe9nbbbb.exe5nnhbt.exe9vvvp.exedvjvd.exelffrxfx.exefrxxxfx.exehbbbbt.exevjvdj.exe7vjjp.exelxfxxrx.exexlrllrx.exebnhhbb.exe9nnhbn.exe9ddvp.exe3vppp.exe5xlfrlr.exefrxxxxx.exenhnnbh.exehtthhb.exejvvdd.exejpdvv.exelfrrffl.exexlrllff.exetnnnth.exethtnnt.exejvvpd.exedppjp.exexlxxlfl.exerxxxxlr.exe1fflrll.exehthbbb.exepvvvd.exerlfxfxx.exe1rxxrrr.exehtthhb.exeththbt.exedpdpp.exe3pdvd.exelxxlfxx.exe5lrrxll.exepid process 2464 lfxfxfl.exe 2256 nbhhtt.exe 2596 vvddp.exe 1224 7lxxlrx.exe 2576 tnbbhh.exe 2548 tntnbt.exe 2428 jdppv.exe 1976 9dpjp.exe 2140 frllrrf.exe 2628 rlxxffl.exe 2704 httnnn.exe 2148 9htnnh.exe 1592 vpjpp.exe 1044 vjvjp.exe 328 rffxffl.exe 2312 lflrrrr.exe 1060 1lxflrx.exe 2880 1btbhb.exe 2480 vpddp.exe 2660 lllfxxr.exe 2072 nbhnhb.exe 560 1jvdj.exe 1436 xrfflfl.exe 1476 3lfrrrf.exe 272 9nbbbb.exe 1560 5nnhbt.exe 1020 9vvvp.exe 568 dvjvd.exe 2060 lffrxfx.exe 2088 frxxxfx.exe 904 hbbbbt.exe 1984 vjvdj.exe 2476 7vjjp.exe 3060 lxfxxrx.exe 2488 xlrllrx.exe 2648 bnhhbb.exe 2592 9nnhbn.exe 2528 9ddvp.exe 2960 3vppp.exe 2576 5xlfrlr.exe 2552 frxxxxx.exe 2504 nhnnbh.exe 2428 htthhb.exe 880 jvvdd.exe 2972 jpdvv.exe 2140 lfrrffl.exe 2372 xlrllff.exe 2712 tnnnth.exe 2316 thtnnt.exe 1472 jvvpd.exe 1456 dppjp.exe 2564 xlxxlfl.exe 2136 rxxxxlr.exe 2024 1fflrll.exe 2868 hthbbb.exe 2856 pvvvd.exe 1960 rlfxfxx.exe 1936 1rxxrrr.exe 1940 htthhb.exe 268 ththbt.exe 580 dpdpp.exe 1432 3pdvd.exe 2728 lxxlfxx.exe 2052 5lrrxll.exe -
Processes:
resource yara_rule behavioral1/memory/2184-1-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1224-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1592-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1044-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/328-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1060-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1560-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1020-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/904-300-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
045eea365a3fd5461d643f657712103a_JaffaCakes118.exelfxfxfl.exenbhhtt.exevvddp.exe7lxxlrx.exetnbbhh.exetntnbt.exejdppv.exe9dpjp.exefrllrrf.exerlxxffl.exehttnnn.exe9htnnh.exevpjpp.exevjvjp.exerffxffl.exedescription pid process target process PID 2184 wrote to memory of 2464 2184 045eea365a3fd5461d643f657712103a_JaffaCakes118.exe lfxfxfl.exe PID 2184 wrote to memory of 2464 2184 045eea365a3fd5461d643f657712103a_JaffaCakes118.exe lfxfxfl.exe PID 2184 wrote to memory of 2464 2184 045eea365a3fd5461d643f657712103a_JaffaCakes118.exe lfxfxfl.exe PID 2184 wrote to memory of 2464 2184 045eea365a3fd5461d643f657712103a_JaffaCakes118.exe lfxfxfl.exe PID 2464 wrote to memory of 2256 2464 lfxfxfl.exe nbhhtt.exe PID 2464 wrote to memory of 2256 2464 lfxfxfl.exe nbhhtt.exe PID 2464 wrote to memory of 2256 2464 lfxfxfl.exe nbhhtt.exe PID 2464 wrote to memory of 2256 2464 lfxfxfl.exe nbhhtt.exe PID 2256 wrote to memory of 2596 2256 nbhhtt.exe vvddp.exe PID 2256 wrote to memory of 2596 2256 nbhhtt.exe vvddp.exe PID 2256 wrote to memory of 2596 2256 nbhhtt.exe vvddp.exe PID 2256 wrote to memory of 2596 2256 nbhhtt.exe vvddp.exe PID 2596 wrote to memory of 1224 2596 vvddp.exe 7lxxlrx.exe PID 2596 wrote to memory of 1224 2596 vvddp.exe 7lxxlrx.exe PID 2596 wrote to memory of 1224 2596 vvddp.exe 7lxxlrx.exe PID 2596 wrote to memory of 1224 2596 vvddp.exe 7lxxlrx.exe PID 1224 wrote to memory of 2576 1224 7lxxlrx.exe tnbbhh.exe PID 1224 wrote to memory of 2576 1224 7lxxlrx.exe tnbbhh.exe PID 1224 wrote to memory of 2576 1224 7lxxlrx.exe tnbbhh.exe PID 1224 wrote to memory of 2576 1224 7lxxlrx.exe tnbbhh.exe PID 2576 wrote to memory of 2548 2576 tnbbhh.exe tntnbt.exe PID 2576 wrote to memory of 2548 2576 tnbbhh.exe tntnbt.exe PID 2576 wrote to memory of 2548 2576 tnbbhh.exe tntnbt.exe PID 2576 wrote to memory of 2548 2576 tnbbhh.exe tntnbt.exe PID 2548 wrote to memory of 2428 2548 tntnbt.exe jdppv.exe PID 2548 wrote to memory of 2428 2548 tntnbt.exe jdppv.exe PID 2548 wrote to memory of 2428 2548 tntnbt.exe jdppv.exe PID 2548 wrote to memory of 2428 2548 tntnbt.exe jdppv.exe PID 2428 wrote to memory of 1976 2428 jdppv.exe 9dpjp.exe PID 2428 wrote to memory of 1976 2428 jdppv.exe 9dpjp.exe PID 2428 wrote to memory of 1976 2428 jdppv.exe 9dpjp.exe PID 2428 wrote to memory of 1976 2428 jdppv.exe 9dpjp.exe PID 1976 wrote to memory of 2140 1976 9dpjp.exe frllrrf.exe PID 1976 wrote to memory of 2140 1976 9dpjp.exe frllrrf.exe PID 1976 wrote to memory of 2140 1976 9dpjp.exe frllrrf.exe PID 1976 wrote to memory of 2140 1976 9dpjp.exe frllrrf.exe PID 2140 wrote to memory of 2628 2140 frllrrf.exe rlxxffl.exe PID 2140 wrote to memory of 2628 2140 frllrrf.exe rlxxffl.exe PID 2140 wrote to memory of 2628 2140 frllrrf.exe rlxxffl.exe PID 2140 wrote to memory of 2628 2140 frllrrf.exe rlxxffl.exe PID 2628 wrote to memory of 2704 2628 rlxxffl.exe httnnn.exe PID 2628 wrote to memory of 2704 2628 rlxxffl.exe httnnn.exe PID 2628 wrote to memory of 2704 2628 rlxxffl.exe httnnn.exe PID 2628 wrote to memory of 2704 2628 rlxxffl.exe httnnn.exe PID 2704 wrote to memory of 2148 2704 httnnn.exe 9htnnh.exe PID 2704 wrote to memory of 2148 2704 httnnn.exe 9htnnh.exe PID 2704 wrote to memory of 2148 2704 httnnn.exe 9htnnh.exe PID 2704 wrote to memory of 2148 2704 httnnn.exe 9htnnh.exe PID 2148 wrote to memory of 1592 2148 9htnnh.exe vpjpp.exe PID 2148 wrote to memory of 1592 2148 9htnnh.exe vpjpp.exe PID 2148 wrote to memory of 1592 2148 9htnnh.exe vpjpp.exe PID 2148 wrote to memory of 1592 2148 9htnnh.exe vpjpp.exe PID 1592 wrote to memory of 1044 1592 vpjpp.exe vjvjp.exe PID 1592 wrote to memory of 1044 1592 vpjpp.exe vjvjp.exe PID 1592 wrote to memory of 1044 1592 vpjpp.exe vjvjp.exe PID 1592 wrote to memory of 1044 1592 vpjpp.exe vjvjp.exe PID 1044 wrote to memory of 328 1044 vjvjp.exe rffxffl.exe PID 1044 wrote to memory of 328 1044 vjvjp.exe rffxffl.exe PID 1044 wrote to memory of 328 1044 vjvjp.exe rffxffl.exe PID 1044 wrote to memory of 328 1044 vjvjp.exe rffxffl.exe PID 328 wrote to memory of 2312 328 rffxffl.exe lflrrrr.exe PID 328 wrote to memory of 2312 328 rffxffl.exe lflrrrr.exe PID 328 wrote to memory of 2312 328 rffxffl.exe lflrrrr.exe PID 328 wrote to memory of 2312 328 rffxffl.exe lflrrrr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\045eea365a3fd5461d643f657712103a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\045eea365a3fd5461d643f657712103a_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\lfxfxfl.exec:\lfxfxfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbhhtt.exec:\nbhhtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvddp.exec:\vvddp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7lxxlrx.exec:\7lxxlrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnbbhh.exec:\tnbbhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tntnbt.exec:\tntnbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdppv.exec:\jdppv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9dpjp.exec:\9dpjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frllrrf.exec:\frllrrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlxxffl.exec:\rlxxffl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\httnnn.exec:\httnnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9htnnh.exec:\9htnnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpjpp.exec:\vpjpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjvjp.exec:\vjvjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rffxffl.exec:\rffxffl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lflrrrr.exec:\lflrrrr.exe17⤵
- Executes dropped EXE
-
\??\c:\1lxflrx.exec:\1lxflrx.exe18⤵
- Executes dropped EXE
-
\??\c:\1btbhb.exec:\1btbhb.exe19⤵
- Executes dropped EXE
-
\??\c:\vpddp.exec:\vpddp.exe20⤵
- Executes dropped EXE
-
\??\c:\lllfxxr.exec:\lllfxxr.exe21⤵
- Executes dropped EXE
-
\??\c:\nbhnhb.exec:\nbhnhb.exe22⤵
- Executes dropped EXE
-
\??\c:\1jvdj.exec:\1jvdj.exe23⤵
- Executes dropped EXE
-
\??\c:\xrfflfl.exec:\xrfflfl.exe24⤵
- Executes dropped EXE
-
\??\c:\3lfrrrf.exec:\3lfrrrf.exe25⤵
- Executes dropped EXE
-
\??\c:\9nbbbb.exec:\9nbbbb.exe26⤵
- Executes dropped EXE
-
\??\c:\5nnhbt.exec:\5nnhbt.exe27⤵
- Executes dropped EXE
-
\??\c:\9vvvp.exec:\9vvvp.exe28⤵
- Executes dropped EXE
-
\??\c:\dvjvd.exec:\dvjvd.exe29⤵
- Executes dropped EXE
-
\??\c:\lffrxfx.exec:\lffrxfx.exe30⤵
- Executes dropped EXE
-
\??\c:\frxxxfx.exec:\frxxxfx.exe31⤵
- Executes dropped EXE
-
\??\c:\hbbbbt.exec:\hbbbbt.exe32⤵
- Executes dropped EXE
-
\??\c:\vjvdj.exec:\vjvdj.exe33⤵
- Executes dropped EXE
-
\??\c:\7vjjp.exec:\7vjjp.exe34⤵
- Executes dropped EXE
-
\??\c:\lxfxxrx.exec:\lxfxxrx.exe35⤵
- Executes dropped EXE
-
\??\c:\xlrllrx.exec:\xlrllrx.exe36⤵
- Executes dropped EXE
-
\??\c:\bnhhbb.exec:\bnhhbb.exe37⤵
- Executes dropped EXE
-
\??\c:\9nnhbn.exec:\9nnhbn.exe38⤵
- Executes dropped EXE
-
\??\c:\9ddvp.exec:\9ddvp.exe39⤵
- Executes dropped EXE
-
\??\c:\3vppp.exec:\3vppp.exe40⤵
- Executes dropped EXE
-
\??\c:\5xlfrlr.exec:\5xlfrlr.exe41⤵
- Executes dropped EXE
-
\??\c:\frxxxxx.exec:\frxxxxx.exe42⤵
- Executes dropped EXE
-
\??\c:\nhnnbh.exec:\nhnnbh.exe43⤵
- Executes dropped EXE
-
\??\c:\htthhb.exec:\htthhb.exe44⤵
- Executes dropped EXE
-
\??\c:\jvvdd.exec:\jvvdd.exe45⤵
- Executes dropped EXE
-
\??\c:\jpdvv.exec:\jpdvv.exe46⤵
- Executes dropped EXE
-
\??\c:\lfrrffl.exec:\lfrrffl.exe47⤵
- Executes dropped EXE
-
\??\c:\xlrllff.exec:\xlrllff.exe48⤵
- Executes dropped EXE
-
\??\c:\tnnnth.exec:\tnnnth.exe49⤵
- Executes dropped EXE
-
\??\c:\thtnnt.exec:\thtnnt.exe50⤵
- Executes dropped EXE
-
\??\c:\jvvpd.exec:\jvvpd.exe51⤵
- Executes dropped EXE
-
\??\c:\dppjp.exec:\dppjp.exe52⤵
- Executes dropped EXE
-
\??\c:\xlxxlfl.exec:\xlxxlfl.exe53⤵
- Executes dropped EXE
-
\??\c:\rxxxxlr.exec:\rxxxxlr.exe54⤵
- Executes dropped EXE
-
\??\c:\1fflrll.exec:\1fflrll.exe55⤵
- Executes dropped EXE
-
\??\c:\hthbbb.exec:\hthbbb.exe56⤵
- Executes dropped EXE
-
\??\c:\pvvvd.exec:\pvvvd.exe57⤵
- Executes dropped EXE
-
\??\c:\rlfxfxx.exec:\rlfxfxx.exe58⤵
- Executes dropped EXE
-
\??\c:\1rxxrrr.exec:\1rxxrrr.exe59⤵
- Executes dropped EXE
-
\??\c:\htthhb.exec:\htthhb.exe60⤵
- Executes dropped EXE
-
\??\c:\ththbt.exec:\ththbt.exe61⤵
- Executes dropped EXE
-
\??\c:\dpdpp.exec:\dpdpp.exe62⤵
- Executes dropped EXE
-
\??\c:\3pdvd.exec:\3pdvd.exe63⤵
- Executes dropped EXE
-
\??\c:\lxxlfxx.exec:\lxxlfxx.exe64⤵
- Executes dropped EXE
-
\??\c:\5lrrxll.exec:\5lrrxll.exe65⤵
- Executes dropped EXE
-
\??\c:\hbbbnb.exec:\hbbbnb.exe66⤵
-
\??\c:\5htnhh.exec:\5htnhh.exe67⤵
-
\??\c:\dvdvd.exec:\dvdvd.exe68⤵
-
\??\c:\pdppj.exec:\pdppj.exe69⤵
-
\??\c:\frrlfrr.exec:\frrlfrr.exe70⤵
-
\??\c:\xllfxrr.exec:\xllfxrr.exe71⤵
-
\??\c:\7bhbth.exec:\7bhbth.exe72⤵
-
\??\c:\hnthtt.exec:\hnthtt.exe73⤵
-
\??\c:\djdpp.exec:\djdpp.exe74⤵
-
\??\c:\pvdpv.exec:\pvdpv.exe75⤵
-
\??\c:\xlxxrll.exec:\xlxxrll.exe76⤵
-
\??\c:\5rfrrfx.exec:\5rfrrfx.exe77⤵
-
\??\c:\xffffff.exec:\xffffff.exe78⤵
-
\??\c:\1htnnn.exec:\1htnnn.exe79⤵
-
\??\c:\1vvvp.exec:\1vvvp.exe80⤵
-
\??\c:\pdpjj.exec:\pdpjj.exe81⤵
-
\??\c:\flllfff.exec:\flllfff.exe82⤵
-
\??\c:\fxxrlff.exec:\fxxrlff.exe83⤵
-
\??\c:\frlffxx.exec:\frlffxx.exe84⤵
-
\??\c:\7ntbtn.exec:\7ntbtn.exe85⤵
-
\??\c:\pjjdd.exec:\pjjdd.exe86⤵
-
\??\c:\jvvpp.exec:\jvvpp.exe87⤵
-
\??\c:\vvdpv.exec:\vvdpv.exe88⤵
-
\??\c:\xxlffff.exec:\xxlffff.exe89⤵
-
\??\c:\xffffxx.exec:\xffffxx.exe90⤵
-
\??\c:\nbhnnh.exec:\nbhnnh.exe91⤵
-
\??\c:\5bhnht.exec:\5bhnht.exe92⤵
-
\??\c:\jpvpp.exec:\jpvpp.exe93⤵
-
\??\c:\jvdvv.exec:\jvdvv.exe94⤵
-
\??\c:\lffrlff.exec:\lffrlff.exe95⤵
-
\??\c:\rffxxrr.exec:\rffxxrr.exe96⤵
-
\??\c:\bnbbht.exec:\bnbbht.exe97⤵
-
\??\c:\pdjjp.exec:\pdjjp.exe98⤵
-
\??\c:\dpvvp.exec:\dpvvp.exe99⤵
-
\??\c:\9dvjd.exec:\9dvjd.exe100⤵
-
\??\c:\hnbhbt.exec:\hnbhbt.exe101⤵
-
\??\c:\nbhtnb.exec:\nbhtnb.exe102⤵
-
\??\c:\pdpjd.exec:\pdpjd.exe103⤵
-
\??\c:\pdjdd.exec:\pdjdd.exe104⤵
-
\??\c:\rxxrrll.exec:\rxxrrll.exe105⤵
-
\??\c:\lrrrlfx.exec:\lrrrlfx.exe106⤵
-
\??\c:\1ttnnn.exec:\1ttnnn.exe107⤵
-
\??\c:\tntttt.exec:\tntttt.exe108⤵
-
\??\c:\dppjj.exec:\dppjj.exe109⤵
-
\??\c:\1djjd.exec:\1djjd.exe110⤵
-
\??\c:\jvvjd.exec:\jvvjd.exe111⤵
-
\??\c:\rxrxlll.exec:\rxrxlll.exe112⤵
-
\??\c:\xllflfl.exec:\xllflfl.exe113⤵
-
\??\c:\hnnhbn.exec:\hnnhbn.exe114⤵
-
\??\c:\9bnhhb.exec:\9bnhhb.exe115⤵
-
\??\c:\9jvvp.exec:\9jvvp.exe116⤵
-
\??\c:\djjvp.exec:\djjvp.exe117⤵
-
\??\c:\5rrffrr.exec:\5rrffrr.exe118⤵
-
\??\c:\xllxfxx.exec:\xllxfxx.exe119⤵
-
\??\c:\rxxffll.exec:\rxxffll.exe120⤵
-
\??\c:\hntttn.exec:\hntttn.exe121⤵
-
\??\c:\3httbt.exec:\3httbt.exe122⤵
-
\??\c:\bnntnh.exec:\bnntnh.exe123⤵
-
\??\c:\5pdpj.exec:\5pdpj.exe124⤵
-
\??\c:\5vjdv.exec:\5vjdv.exe125⤵
-
\??\c:\1lrllll.exec:\1lrllll.exe126⤵
-
\??\c:\1lxrrff.exec:\1lxrrff.exe127⤵
-
\??\c:\1hhnhh.exec:\1hhnhh.exe128⤵
-
\??\c:\hthhbn.exec:\hthhbn.exe129⤵
-
\??\c:\9ddvv.exec:\9ddvv.exe130⤵
-
\??\c:\jpdvj.exec:\jpdvj.exe131⤵
-
\??\c:\flxlrfx.exec:\flxlrfx.exe132⤵
-
\??\c:\rffxfxx.exec:\rffxfxx.exe133⤵
-
\??\c:\tbbbtt.exec:\tbbbtt.exe134⤵
-
\??\c:\9tnhbt.exec:\9tnhbt.exe135⤵
-
\??\c:\pjvpj.exec:\pjvpj.exe136⤵
-
\??\c:\3jvpp.exec:\3jvpp.exe137⤵
-
\??\c:\1xrllll.exec:\1xrllll.exe138⤵
-
\??\c:\rxxrlxx.exec:\rxxrlxx.exe139⤵
-
\??\c:\hnnnnn.exec:\hnnnnn.exe140⤵
-
\??\c:\nbhnnb.exec:\nbhnnb.exe141⤵
-
\??\c:\jvppv.exec:\jvppv.exe142⤵
-
\??\c:\jdddj.exec:\jdddj.exe143⤵
-
\??\c:\frxfxxx.exec:\frxfxxx.exe144⤵
-
\??\c:\rxxlfxx.exec:\rxxlfxx.exe145⤵
-
\??\c:\1hntth.exec:\1hntth.exe146⤵
-
\??\c:\hntnnh.exec:\hntnnh.exe147⤵
-
\??\c:\tbbtnn.exec:\tbbtnn.exe148⤵
-
\??\c:\dpjjd.exec:\dpjjd.exe149⤵
-
\??\c:\dpddj.exec:\dpddj.exe150⤵
-
\??\c:\5lxrrff.exec:\5lxrrff.exe151⤵
-
\??\c:\3lrllff.exec:\3lrllff.exe152⤵
-
\??\c:\hthbht.exec:\hthbht.exe153⤵
-
\??\c:\bhnhbb.exec:\bhnhbb.exe154⤵
-
\??\c:\pddvv.exec:\pddvv.exe155⤵
-
\??\c:\jpjdv.exec:\jpjdv.exe156⤵
-
\??\c:\rfllfxf.exec:\rfllfxf.exe157⤵
-
\??\c:\3rlfxxx.exec:\3rlfxxx.exe158⤵
-
\??\c:\fxfxxff.exec:\fxfxxff.exe159⤵
-
\??\c:\thtnnt.exec:\thtnnt.exe160⤵
-
\??\c:\9nbbbt.exec:\9nbbbt.exe161⤵
-
\??\c:\3pvvp.exec:\3pvvp.exe162⤵
-
\??\c:\dpvpp.exec:\dpvpp.exe163⤵
-
\??\c:\frxxxxx.exec:\frxxxxx.exe164⤵
-
\??\c:\xllflxx.exec:\xllflxx.exe165⤵
-
\??\c:\7btbbh.exec:\7btbbh.exe166⤵
-
\??\c:\5bnbhb.exec:\5bnbhb.exe167⤵
-
\??\c:\9thbbt.exec:\9thbbt.exe168⤵
-
\??\c:\dpvpv.exec:\dpvpv.exe169⤵
-
\??\c:\jdvpp.exec:\jdvpp.exe170⤵
-
\??\c:\7rffxrx.exec:\7rffxrx.exe171⤵
-
\??\c:\frxxxxf.exec:\frxxxxf.exe172⤵
-
\??\c:\pdjdv.exec:\pdjdv.exe173⤵
-
\??\c:\vjvpp.exec:\vjvpp.exe174⤵
-
\??\c:\vjvdv.exec:\vjvdv.exe175⤵
-
\??\c:\xlrlfxx.exec:\xlrlfxx.exe176⤵
-
\??\c:\lxlxxfr.exec:\lxlxxfr.exe177⤵
-
\??\c:\3tbtht.exec:\3tbtht.exe178⤵
-
\??\c:\htbttt.exec:\htbttt.exe179⤵
-
\??\c:\jvpjj.exec:\jvpjj.exe180⤵
-
\??\c:\pddvd.exec:\pddvd.exe181⤵
-
\??\c:\9dvvv.exec:\9dvvv.exe182⤵
-
\??\c:\lxfxxxr.exec:\lxfxxxr.exe183⤵
-
\??\c:\rxlxfxx.exec:\rxlxfxx.exe184⤵
-
\??\c:\3nhbtb.exec:\3nhbtb.exe185⤵
-
\??\c:\tnbhtb.exec:\tnbhtb.exe186⤵
-
\??\c:\3vddv.exec:\3vddv.exe187⤵
-
\??\c:\pvppp.exec:\pvppp.exe188⤵
-
\??\c:\jpdvp.exec:\jpdvp.exe189⤵
-
\??\c:\7xffffl.exec:\7xffffl.exe190⤵
-
\??\c:\5lxxxxx.exec:\5lxxxxx.exe191⤵
-
\??\c:\thtttn.exec:\thtttn.exe192⤵
-
\??\c:\tbhbbt.exec:\tbhbbt.exe193⤵
-
\??\c:\7jddj.exec:\7jddj.exe194⤵
-
\??\c:\pdjvv.exec:\pdjvv.exe195⤵
-
\??\c:\frfxfff.exec:\frfxfff.exe196⤵
-
\??\c:\lxfxxrr.exec:\lxfxxrr.exe197⤵
-
\??\c:\thhhbt.exec:\thhhbt.exe198⤵
-
\??\c:\btnhth.exec:\btnhth.exe199⤵
-
\??\c:\thttbt.exec:\thttbt.exe200⤵
-
\??\c:\dpvjj.exec:\dpvjj.exe201⤵
-
\??\c:\dppjj.exec:\dppjj.exe202⤵
-
\??\c:\rxxrxrr.exec:\rxxrxrr.exe203⤵
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe204⤵
-
\??\c:\tntttn.exec:\tntttn.exe205⤵
-
\??\c:\5hhtnh.exec:\5hhtnh.exe206⤵
-
\??\c:\1vvdp.exec:\1vvdp.exe207⤵
-
\??\c:\7jvpp.exec:\7jvpp.exe208⤵
-
\??\c:\xlrrxfr.exec:\xlrrxfr.exe209⤵
-
\??\c:\lrrffrr.exec:\lrrffrr.exe210⤵
-
\??\c:\fllflff.exec:\fllflff.exe211⤵
-
\??\c:\3bbbtn.exec:\3bbbtn.exe212⤵
-
\??\c:\bhnhbb.exec:\bhnhbb.exe213⤵
-
\??\c:\pjppv.exec:\pjppv.exe214⤵
-
\??\c:\djdvv.exec:\djdvv.exe215⤵
-
\??\c:\9xffrrr.exec:\9xffrrr.exe216⤵
-
\??\c:\7xfflfl.exec:\7xfflfl.exe217⤵
-
\??\c:\ntbttn.exec:\ntbttn.exe218⤵
-
\??\c:\hbhtbb.exec:\hbhtbb.exe219⤵
-
\??\c:\frxrlfl.exec:\frxrlfl.exe220⤵
-
\??\c:\frrrrrx.exec:\frrrrrx.exe221⤵
-
\??\c:\lrrxrff.exec:\lrrxrff.exe222⤵
-
\??\c:\nbnthb.exec:\nbnthb.exe223⤵
-
\??\c:\ntbhhh.exec:\ntbhhh.exe224⤵
-
\??\c:\pdppv.exec:\pdppv.exe225⤵
-
\??\c:\jvvjp.exec:\jvvjp.exe226⤵
-
\??\c:\rxflxff.exec:\rxflxff.exe227⤵
-
\??\c:\rrrfxxf.exec:\rrrfxxf.exe228⤵
-
\??\c:\7xllrlf.exec:\7xllrlf.exe229⤵
-
\??\c:\tbhhbt.exec:\tbhhbt.exe230⤵
-
\??\c:\thnntt.exec:\thnntt.exe231⤵
-
\??\c:\dpppv.exec:\dpppv.exe232⤵
-
\??\c:\dppdp.exec:\dppdp.exe233⤵
-
\??\c:\9frlxrr.exec:\9frlxrr.exe234⤵
-
\??\c:\flrlfxx.exec:\flrlfxx.exe235⤵
-
\??\c:\5thbth.exec:\5thbth.exe236⤵
-
\??\c:\thnthh.exec:\thnthh.exe237⤵
-
\??\c:\dvdjp.exec:\dvdjp.exe238⤵
-
\??\c:\3jddj.exec:\3jddj.exe239⤵
-
\??\c:\pvjjd.exec:\pvjjd.exe240⤵
-
\??\c:\lxxrxrx.exec:\lxxrxrx.exe241⤵