Analysis
-
max time kernel
28s -
max time network
29s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 07:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
04b5ed7ab328e9ad737a184266c39db8_JaffaCakes118.exe
Resource
win7-20240221-en
0 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
04b5ed7ab328e9ad737a184266c39db8_JaffaCakes118.exe
-
Size
57KB
-
MD5
04b5ed7ab328e9ad737a184266c39db8
-
SHA1
9f6a206fedd11c654aa99b1f0ebcd275f75a9859
-
SHA256
ea4d9a7c4fed0968d1385242c1182360a9a61c1aaf0355b83c1f3178cbde1cc7
-
SHA512
5ff4d9616025a63fd2530ba3992e04d16e2e476ce10f1d82017dde248db85cb7f3c08c2828f5376a9da31e5ebefe9051526fcc6dfe1ed47f1089199c450e9050
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIJLeT:ymb3NkkiQ3mdBjFIoT
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
Processes:
resource yara_rule behavioral2/memory/2920-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3340-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3600-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-70-0x0000000000650000-0x0000000000690000-memory.dmp family_blackmoon behavioral2/memory/2276-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1740-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2716-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1876-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2312-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2628-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/368-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2252-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3128-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2288-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2464-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2008-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4140-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4820-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4108-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3604-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4080-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
fllxlfx.exenhtnbt.exebttnnh.exevjjvp.exedjjdp.exelxxxlfr.exefffxxrl.exe3nnhtn.exenbtnhb.exepjddp.exerllxrlx.exexffxrlf.exehtbbtn.exejddvp.exeflfrlxr.exefrlfxrf.exehbtnht.exevjdpd.exevjdvj.exelxfflxl.exebtbnhh.exevjpdd.exejdjvj.exe7xfrfxr.exeflrlxxl.exehnnhbt.exevjpjp.exevjvjv.exe7lfrfxr.exehnhthb.exejjdvp.exepjjvj.exelrrfrrr.exexlxfxxf.exebtnhbb.exehbhbtt.exejjjjv.exepjdjp.exelflxlfx.exefxrlxxl.exebbbbhh.exejvjdv.exelxrrlll.exexxrlffx.exetbhhbb.exedvvpp.exevdjvp.exexrrfrlx.exefrxxfxx.exennnthb.exebnbntn.exepdjpv.exevdpjv.exelxffrxl.exe9xxrlfx.exe5tnnbt.exebnnhbt.exeddjdv.exedpjdj.exelfxfxrl.exerlllllx.exetnbbhh.exebtbttt.exejpvpd.exepid process 3340 fllxlfx.exe 4232 nhtnbt.exe 1876 bttnnh.exe 4896 vjjvp.exe 1740 djjdp.exe 4904 lxxxlfr.exe 5008 fffxxrl.exe 3600 3nnhtn.exe 396 nbtnhb.exe 3076 pjddp.exe 2276 rllxrlx.exe 2716 xffxrlf.exe 2312 htbbtn.exe 2628 jddvp.exe 368 flfrlxr.exe 2252 frlfxrf.exe 3128 hbtnht.exe 1664 vjdpd.exe 2288 vjdvj.exe 1444 lxfflxl.exe 2464 btbnhh.exe 4240 vjpdd.exe 4692 jdjvj.exe 2008 7xfrfxr.exe 4140 flrlxxl.exe 2264 hnnhbt.exe 4820 vjpjp.exe 4836 vjvjv.exe 4108 7lfrfxr.exe 3604 hnhthb.exe 4080 jjdvp.exe 3864 pjjvj.exe 4416 lrrfrrr.exe 716 xlxfxxf.exe 3900 btnhbb.exe 3868 hbhbtt.exe 4324 jjjjv.exe 1912 pjdjp.exe 4348 lflxlfx.exe 2640 fxrlxxl.exe 1616 bbbbhh.exe 1520 jvjdv.exe 3140 lxrrlll.exe 1876 xxrlffx.exe 2108 tbhhbb.exe 3208 dvvpp.exe 4112 vdjvp.exe 3596 xrrfrlx.exe 2240 frxxfxx.exe 2940 nnnthb.exe 2852 bnbntn.exe 2004 pdjpv.exe 972 vdpjv.exe 2224 lxffrxl.exe 5072 9xxrlfx.exe 1544 5tnnbt.exe 3296 bnnhbt.exe 4604 ddjdv.exe 3148 dpjdj.exe 3788 lfxfxrl.exe 2840 rlllllx.exe 3128 tnbbhh.exe 2388 btbttt.exe 4708 jpvpd.exe -
Processes:
resource yara_rule behavioral2/memory/2920-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3340-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3600-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2276-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1740-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2716-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1876-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2628-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/368-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2252-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3128-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2288-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2464-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2008-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4140-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4820-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4108-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3604-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4080-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
04b5ed7ab328e9ad737a184266c39db8_JaffaCakes118.exefllxlfx.exenhtnbt.exebttnnh.exevjjvp.exedjjdp.exelxxxlfr.exefffxxrl.exe3nnhtn.exenbtnhb.exepjddp.exerllxrlx.exexffxrlf.exehtbbtn.exejddvp.exeflfrlxr.exefrlfxrf.exehbtnht.exevjdpd.exevjdvj.exelxfflxl.exebtbnhh.exedescription pid process target process PID 2920 wrote to memory of 3340 2920 04b5ed7ab328e9ad737a184266c39db8_JaffaCakes118.exe fllxlfx.exe PID 2920 wrote to memory of 3340 2920 04b5ed7ab328e9ad737a184266c39db8_JaffaCakes118.exe fllxlfx.exe PID 2920 wrote to memory of 3340 2920 04b5ed7ab328e9ad737a184266c39db8_JaffaCakes118.exe fllxlfx.exe PID 3340 wrote to memory of 4232 3340 fllxlfx.exe nhtnbt.exe PID 3340 wrote to memory of 4232 3340 fllxlfx.exe nhtnbt.exe PID 3340 wrote to memory of 4232 3340 fllxlfx.exe nhtnbt.exe PID 4232 wrote to memory of 1876 4232 nhtnbt.exe bttnnh.exe PID 4232 wrote to memory of 1876 4232 nhtnbt.exe bttnnh.exe PID 4232 wrote to memory of 1876 4232 nhtnbt.exe bttnnh.exe PID 1876 wrote to memory of 4896 1876 bttnnh.exe vjjvp.exe PID 1876 wrote to memory of 4896 1876 bttnnh.exe vjjvp.exe PID 1876 wrote to memory of 4896 1876 bttnnh.exe vjjvp.exe PID 4896 wrote to memory of 1740 4896 vjjvp.exe djjdp.exe PID 4896 wrote to memory of 1740 4896 vjjvp.exe djjdp.exe PID 4896 wrote to memory of 1740 4896 vjjvp.exe djjdp.exe PID 1740 wrote to memory of 4904 1740 djjdp.exe lxxxlfr.exe PID 1740 wrote to memory of 4904 1740 djjdp.exe lxxxlfr.exe PID 1740 wrote to memory of 4904 1740 djjdp.exe lxxxlfr.exe PID 4904 wrote to memory of 5008 4904 lxxxlfr.exe fffxxrl.exe PID 4904 wrote to memory of 5008 4904 lxxxlfr.exe fffxxrl.exe PID 4904 wrote to memory of 5008 4904 lxxxlfr.exe fffxxrl.exe PID 5008 wrote to memory of 3600 5008 fffxxrl.exe 3nnhtn.exe PID 5008 wrote to memory of 3600 5008 fffxxrl.exe 3nnhtn.exe PID 5008 wrote to memory of 3600 5008 fffxxrl.exe 3nnhtn.exe PID 3600 wrote to memory of 396 3600 3nnhtn.exe nbtnhb.exe PID 3600 wrote to memory of 396 3600 3nnhtn.exe nbtnhb.exe PID 3600 wrote to memory of 396 3600 3nnhtn.exe nbtnhb.exe PID 396 wrote to memory of 3076 396 nbtnhb.exe pjddp.exe PID 396 wrote to memory of 3076 396 nbtnhb.exe pjddp.exe PID 396 wrote to memory of 3076 396 nbtnhb.exe pjddp.exe PID 3076 wrote to memory of 2276 3076 pjddp.exe rllxrlx.exe PID 3076 wrote to memory of 2276 3076 pjddp.exe rllxrlx.exe PID 3076 wrote to memory of 2276 3076 pjddp.exe rllxrlx.exe PID 2276 wrote to memory of 2716 2276 rllxrlx.exe xffxrlf.exe PID 2276 wrote to memory of 2716 2276 rllxrlx.exe xffxrlf.exe PID 2276 wrote to memory of 2716 2276 rllxrlx.exe xffxrlf.exe PID 2716 wrote to memory of 2312 2716 xffxrlf.exe htbbtn.exe PID 2716 wrote to memory of 2312 2716 xffxrlf.exe htbbtn.exe PID 2716 wrote to memory of 2312 2716 xffxrlf.exe htbbtn.exe PID 2312 wrote to memory of 2628 2312 htbbtn.exe jddvp.exe PID 2312 wrote to memory of 2628 2312 htbbtn.exe jddvp.exe PID 2312 wrote to memory of 2628 2312 htbbtn.exe jddvp.exe PID 2628 wrote to memory of 368 2628 jddvp.exe flfrlxr.exe PID 2628 wrote to memory of 368 2628 jddvp.exe flfrlxr.exe PID 2628 wrote to memory of 368 2628 jddvp.exe flfrlxr.exe PID 368 wrote to memory of 2252 368 flfrlxr.exe frlfxrf.exe PID 368 wrote to memory of 2252 368 flfrlxr.exe frlfxrf.exe PID 368 wrote to memory of 2252 368 flfrlxr.exe frlfxrf.exe PID 2252 wrote to memory of 3128 2252 frlfxrf.exe hbtnht.exe PID 2252 wrote to memory of 3128 2252 frlfxrf.exe hbtnht.exe PID 2252 wrote to memory of 3128 2252 frlfxrf.exe hbtnht.exe PID 3128 wrote to memory of 1664 3128 hbtnht.exe vjdpd.exe PID 3128 wrote to memory of 1664 3128 hbtnht.exe vjdpd.exe PID 3128 wrote to memory of 1664 3128 hbtnht.exe vjdpd.exe PID 1664 wrote to memory of 2288 1664 vjdpd.exe vjdvj.exe PID 1664 wrote to memory of 2288 1664 vjdpd.exe vjdvj.exe PID 1664 wrote to memory of 2288 1664 vjdpd.exe vjdvj.exe PID 2288 wrote to memory of 1444 2288 vjdvj.exe lxfflxl.exe PID 2288 wrote to memory of 1444 2288 vjdvj.exe lxfflxl.exe PID 2288 wrote to memory of 1444 2288 vjdvj.exe lxfflxl.exe PID 1444 wrote to memory of 2464 1444 lxfflxl.exe btbnhh.exe PID 1444 wrote to memory of 2464 1444 lxfflxl.exe btbnhh.exe PID 1444 wrote to memory of 2464 1444 lxfflxl.exe btbnhh.exe PID 2464 wrote to memory of 4240 2464 btbnhh.exe vjpdd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\04b5ed7ab328e9ad737a184266c39db8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\04b5ed7ab328e9ad737a184266c39db8_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\fllxlfx.exec:\fllxlfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhtnbt.exec:\nhtnbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bttnnh.exec:\bttnnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjjvp.exec:\vjjvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\djjdp.exec:\djjdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxxxlfr.exec:\lxxxlfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fffxxrl.exec:\fffxxrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3nnhtn.exec:\3nnhtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbtnhb.exec:\nbtnhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjddp.exec:\pjddp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rllxrlx.exec:\rllxrlx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xffxrlf.exec:\xffxrlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\htbbtn.exec:\htbbtn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jddvp.exec:\jddvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\flfrlxr.exec:\flfrlxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frlfxrf.exec:\frlfxrf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbtnht.exec:\hbtnht.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjdpd.exec:\vjdpd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjdvj.exec:\vjdvj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxfflxl.exec:\lxfflxl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btbnhh.exec:\btbnhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjpdd.exec:\vjpdd.exe23⤵
- Executes dropped EXE
-
\??\c:\jdjvj.exec:\jdjvj.exe24⤵
- Executes dropped EXE
-
\??\c:\7xfrfxr.exec:\7xfrfxr.exe25⤵
- Executes dropped EXE
-
\??\c:\flrlxxl.exec:\flrlxxl.exe26⤵
- Executes dropped EXE
-
\??\c:\hnnhbt.exec:\hnnhbt.exe27⤵
- Executes dropped EXE
-
\??\c:\vjpjp.exec:\vjpjp.exe28⤵
- Executes dropped EXE
-
\??\c:\vjvjv.exec:\vjvjv.exe29⤵
- Executes dropped EXE
-
\??\c:\7lfrfxr.exec:\7lfrfxr.exe30⤵
- Executes dropped EXE
-
\??\c:\hnhthb.exec:\hnhthb.exe31⤵
- Executes dropped EXE
-
\??\c:\jjdvp.exec:\jjdvp.exe32⤵
- Executes dropped EXE
-
\??\c:\pjjvj.exec:\pjjvj.exe33⤵
- Executes dropped EXE
-
\??\c:\lrrfrrr.exec:\lrrfrrr.exe34⤵
- Executes dropped EXE
-
\??\c:\xlxfxxf.exec:\xlxfxxf.exe35⤵
- Executes dropped EXE
-
\??\c:\btnhbb.exec:\btnhbb.exe36⤵
- Executes dropped EXE
-
\??\c:\hbhbtt.exec:\hbhbtt.exe37⤵
- Executes dropped EXE
-
\??\c:\jjjjv.exec:\jjjjv.exe38⤵
- Executes dropped EXE
-
\??\c:\pjdjp.exec:\pjdjp.exe39⤵
- Executes dropped EXE
-
\??\c:\lflxlfx.exec:\lflxlfx.exe40⤵
- Executes dropped EXE
-
\??\c:\fxrlxxl.exec:\fxrlxxl.exe41⤵
- Executes dropped EXE
-
\??\c:\bbbbhh.exec:\bbbbhh.exe42⤵
- Executes dropped EXE
-
\??\c:\jvjdv.exec:\jvjdv.exe43⤵
- Executes dropped EXE
-
\??\c:\lxrrlll.exec:\lxrrlll.exe44⤵
- Executes dropped EXE
-
\??\c:\xxrlffx.exec:\xxrlffx.exe45⤵
- Executes dropped EXE
-
\??\c:\tbhhbb.exec:\tbhhbb.exe46⤵
- Executes dropped EXE
-
\??\c:\dvvpp.exec:\dvvpp.exe47⤵
- Executes dropped EXE
-
\??\c:\vdjvp.exec:\vdjvp.exe48⤵
- Executes dropped EXE
-
\??\c:\xrrfrlx.exec:\xrrfrlx.exe49⤵
- Executes dropped EXE
-
\??\c:\frxxfxx.exec:\frxxfxx.exe50⤵
- Executes dropped EXE
-
\??\c:\nnnthb.exec:\nnnthb.exe51⤵
- Executes dropped EXE
-
\??\c:\bnbntn.exec:\bnbntn.exe52⤵
- Executes dropped EXE
-
\??\c:\pdjpv.exec:\pdjpv.exe53⤵
- Executes dropped EXE
-
\??\c:\vdpjv.exec:\vdpjv.exe54⤵
- Executes dropped EXE
-
\??\c:\lxffrxl.exec:\lxffrxl.exe55⤵
- Executes dropped EXE
-
\??\c:\9xxrlfx.exec:\9xxrlfx.exe56⤵
- Executes dropped EXE
-
\??\c:\5tnnbt.exec:\5tnnbt.exe57⤵
- Executes dropped EXE
-
\??\c:\bnnhbt.exec:\bnnhbt.exe58⤵
- Executes dropped EXE
-
\??\c:\ddjdv.exec:\ddjdv.exe59⤵
- Executes dropped EXE
-
\??\c:\dpjdj.exec:\dpjdj.exe60⤵
- Executes dropped EXE
-
\??\c:\lfxfxrl.exec:\lfxfxrl.exe61⤵
- Executes dropped EXE
-
\??\c:\rlllllx.exec:\rlllllx.exe62⤵
- Executes dropped EXE
-
\??\c:\tnbbhh.exec:\tnbbhh.exe63⤵
- Executes dropped EXE
-
\??\c:\btbttt.exec:\btbttt.exe64⤵
- Executes dropped EXE
-
\??\c:\jpvpd.exec:\jpvpd.exe65⤵
- Executes dropped EXE
-
\??\c:\lflfxrr.exec:\lflfxrr.exe66⤵
-
\??\c:\tnttbt.exec:\tnttbt.exe67⤵
-
\??\c:\bhhhtn.exec:\bhhhtn.exe68⤵
-
\??\c:\vjjdp.exec:\vjjdp.exe69⤵
-
\??\c:\rfxrfxr.exec:\rfxrfxr.exe70⤵
-
\??\c:\nbtthb.exec:\nbtthb.exe71⤵
-
\??\c:\dvdvv.exec:\dvdvv.exe72⤵
-
\??\c:\rrrlxrl.exec:\rrrlxrl.exe73⤵
-
\??\c:\nthbht.exec:\nthbht.exe74⤵
-
\??\c:\jvdvv.exec:\jvdvv.exe75⤵
-
\??\c:\fxrlxxr.exec:\fxrlxxr.exe76⤵
-
\??\c:\lffflff.exec:\lffflff.exe77⤵
-
\??\c:\bthhhh.exec:\bthhhh.exe78⤵
-
\??\c:\jvjdd.exec:\jvjdd.exe79⤵
-
\??\c:\9djdj.exec:\9djdj.exe80⤵
-
\??\c:\ffxfrxr.exec:\ffxfrxr.exe81⤵
-
\??\c:\bhttbb.exec:\bhttbb.exe82⤵
-
\??\c:\thhbnh.exec:\thhbnh.exe83⤵
-
\??\c:\lllfxxr.exec:\lllfxxr.exe84⤵
-
\??\c:\lfxfrlx.exec:\lfxfrlx.exe85⤵
-
\??\c:\nbnhbt.exec:\nbnhbt.exe86⤵
-
\??\c:\9ppjv.exec:\9ppjv.exe87⤵
-
\??\c:\dpjdv.exec:\dpjdv.exe88⤵
-
\??\c:\rfxrfxf.exec:\rfxrfxf.exe89⤵
-
\??\c:\hhthbt.exec:\hhthbt.exe90⤵
-
\??\c:\jvvvp.exec:\jvvvp.exe91⤵
-
\??\c:\xrfffxx.exec:\xrfffxx.exe92⤵
-
\??\c:\thnhhb.exec:\thnhhb.exe93⤵
-
\??\c:\pddvp.exec:\pddvp.exe94⤵
-
\??\c:\rllxrrf.exec:\rllxrrf.exe95⤵
-
\??\c:\bthbtn.exec:\bthbtn.exe96⤵
-
\??\c:\nbnbnt.exec:\nbnbnt.exe97⤵
-
\??\c:\pdvpv.exec:\pdvpv.exe98⤵
-
\??\c:\lrxxrxr.exec:\lrxxrxr.exe99⤵
-
\??\c:\nbbnhb.exec:\nbbnhb.exe100⤵
-
\??\c:\vpvpd.exec:\vpvpd.exe101⤵
-
\??\c:\lfxxlfx.exec:\lfxxlfx.exe102⤵
-
\??\c:\9nnnhb.exec:\9nnnhb.exe103⤵
-
\??\c:\vjdvp.exec:\vjdvp.exe104⤵
-
\??\c:\jvdpj.exec:\jvdpj.exe105⤵
-
\??\c:\lrrlfff.exec:\lrrlfff.exe106⤵
-
\??\c:\fxflllx.exec:\fxflllx.exe107⤵
-
\??\c:\btttnn.exec:\btttnn.exe108⤵
-
\??\c:\jvvjd.exec:\jvvjd.exe109⤵
-
\??\c:\rxxlxxr.exec:\rxxlxxr.exe110⤵
-
\??\c:\xfffxrl.exec:\xfffxrl.exe111⤵
-
\??\c:\bbtbhh.exec:\bbtbhh.exe112⤵
-
\??\c:\nhthbh.exec:\nhthbh.exe113⤵
-
\??\c:\vdddp.exec:\vdddp.exe114⤵
-
\??\c:\lrfxrrl.exec:\lrfxrrl.exe115⤵
-
\??\c:\frlrffx.exec:\frlrffx.exe116⤵
-
\??\c:\htbthh.exec:\htbthh.exe117⤵
-
\??\c:\pjpjv.exec:\pjpjv.exe118⤵
-
\??\c:\vppjv.exec:\vppjv.exe119⤵
-
\??\c:\xrfxfxl.exec:\xrfxfxl.exe120⤵
-
\??\c:\nhhbtn.exec:\nhhbtn.exe121⤵
-
\??\c:\5nhbnn.exec:\5nhbnn.exe122⤵
-
\??\c:\pppjj.exec:\pppjj.exe123⤵
-
\??\c:\btnnhn.exec:\btnnhn.exe124⤵
-
\??\c:\hhhbnh.exec:\hhhbnh.exe125⤵
-
\??\c:\pvjdp.exec:\pvjdp.exe126⤵
-
\??\c:\fxlrlxf.exec:\fxlrlxf.exe127⤵
-
\??\c:\xlxrxxx.exec:\xlxrxxx.exe128⤵
-
\??\c:\bbttnn.exec:\bbttnn.exe129⤵
-
\??\c:\3hnhhb.exec:\3hnhhb.exe130⤵
-
\??\c:\vjddv.exec:\vjddv.exe131⤵
-
\??\c:\xrrlflf.exec:\xrrlflf.exe132⤵
-
\??\c:\xlrlfxr.exec:\xlrlfxr.exe133⤵
-
\??\c:\hbhbhn.exec:\hbhbhn.exe134⤵
-
\??\c:\pjvpp.exec:\pjvpp.exe135⤵
-
\??\c:\lfffrrf.exec:\lfffrrf.exe136⤵
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe137⤵
-
\??\c:\lrxrlfx.exec:\lrxrlfx.exe138⤵
-
\??\c:\nnhhbb.exec:\nnhhbb.exe139⤵
-
\??\c:\3jdpj.exec:\3jdpj.exe140⤵
-
\??\c:\jjjjd.exec:\jjjjd.exe141⤵
-
\??\c:\lxfxllf.exec:\lxfxllf.exe142⤵
-
\??\c:\nbttnn.exec:\nbttnn.exe143⤵
-
\??\c:\dvvjd.exec:\dvvjd.exe144⤵
-
\??\c:\ppjjj.exec:\ppjjj.exe145⤵
-
\??\c:\xrrlxxx.exec:\xrrlxxx.exe146⤵
-
\??\c:\hhtntt.exec:\hhtntt.exe147⤵
-
\??\c:\nnthbb.exec:\nnthbb.exe148⤵
-
\??\c:\pjjvp.exec:\pjjvp.exe149⤵
-
\??\c:\jppdp.exec:\jppdp.exe150⤵
-
\??\c:\frfrllf.exec:\frfrllf.exe151⤵
-
\??\c:\flrlxrr.exec:\flrlxrr.exe152⤵
-
\??\c:\hbtnnh.exec:\hbtnnh.exe153⤵
-
\??\c:\dvvvj.exec:\dvvvj.exe154⤵
-
\??\c:\xfrfrlx.exec:\xfrfrlx.exe155⤵
-
\??\c:\llxxllr.exec:\llxxllr.exe156⤵
-
\??\c:\bhhhhb.exec:\bhhhhb.exe157⤵
-
\??\c:\vppvp.exec:\vppvp.exe158⤵
-
\??\c:\dppjj.exec:\dppjj.exe159⤵
-
\??\c:\rlffrxl.exec:\rlffrxl.exe160⤵
-
\??\c:\tbhbtt.exec:\tbhbtt.exe161⤵
-
\??\c:\hhhthh.exec:\hhhthh.exe162⤵
-
\??\c:\jvdvj.exec:\jvdvj.exe163⤵
-
\??\c:\nbbnbb.exec:\nbbnbb.exe164⤵
-
\??\c:\thhbnn.exec:\thhbnn.exe165⤵
-
\??\c:\pjjpv.exec:\pjjpv.exe166⤵
-
\??\c:\fxfxrlf.exec:\fxfxrlf.exe167⤵
-
\??\c:\rrxxxrf.exec:\rrxxxrf.exe168⤵
-
\??\c:\nbnnbn.exec:\nbnnbn.exe169⤵
-
\??\c:\9bbtnn.exec:\9bbtnn.exe170⤵
-
\??\c:\dvpvp.exec:\dvpvp.exe171⤵
-
\??\c:\llfxrrl.exec:\llfxrrl.exe172⤵
-
\??\c:\fllfxrl.exec:\fllfxrl.exe173⤵
-
\??\c:\nhbbbb.exec:\nhbbbb.exe174⤵
-
\??\c:\vpvpv.exec:\vpvpv.exe175⤵
-
\??\c:\lxlffxf.exec:\lxlffxf.exe176⤵
-
\??\c:\frxxxxf.exec:\frxxxxf.exe177⤵
-
\??\c:\ttnnhb.exec:\ttnnhb.exe178⤵
-
\??\c:\bnttnh.exec:\bnttnh.exe179⤵
-
\??\c:\vvvvp.exec:\vvvvp.exe180⤵
-
\??\c:\pvddd.exec:\pvddd.exe181⤵
-
\??\c:\rrrlxxx.exec:\rrrlxxx.exe182⤵
-
\??\c:\bnnnnn.exec:\bnnnnn.exe183⤵
-
\??\c:\bnhbbb.exec:\bnhbbb.exe184⤵
-
\??\c:\vjjdv.exec:\vjjdv.exe185⤵
-
\??\c:\vpdpj.exec:\vpdpj.exe186⤵
-
\??\c:\rlrlfxf.exec:\rlrlfxf.exe187⤵
-
\??\c:\bnbbtt.exec:\bnbbtt.exe188⤵
-
\??\c:\httnbh.exec:\httnbh.exe189⤵
-
\??\c:\pjjjv.exec:\pjjjv.exe190⤵
-
\??\c:\vjdvp.exec:\vjdvp.exe191⤵
-
\??\c:\rflrllf.exec:\rflrllf.exe192⤵
-
\??\c:\ttttnb.exec:\ttttnb.exe193⤵
-
\??\c:\ttbbtn.exec:\ttbbtn.exe194⤵
-
\??\c:\ppvpj.exec:\ppvpj.exe195⤵
-
\??\c:\rxfxrrr.exec:\rxfxrrr.exe196⤵
-
\??\c:\frlfrlf.exec:\frlfrlf.exe197⤵
-
\??\c:\rflffxr.exec:\rflffxr.exe198⤵
-
\??\c:\tnhbtn.exec:\tnhbtn.exe199⤵
-
\??\c:\vpdpj.exec:\vpdpj.exe200⤵
-
\??\c:\vjpjd.exec:\vjpjd.exe201⤵
-
\??\c:\xrlxrlf.exec:\xrlxrlf.exe202⤵
-
\??\c:\fxxlfxr.exec:\fxxlfxr.exe203⤵
-
\??\c:\ttbbbb.exec:\ttbbbb.exe204⤵
-
\??\c:\bbtthh.exec:\bbtthh.exe205⤵
-
\??\c:\vvdjp.exec:\vvdjp.exe206⤵
-
\??\c:\pvdvp.exec:\pvdvp.exe207⤵
-
\??\c:\xrlfffx.exec:\xrlfffx.exe208⤵
-
\??\c:\bthhnn.exec:\bthhnn.exe209⤵
-
\??\c:\ttbthh.exec:\ttbthh.exe210⤵
-
\??\c:\dpvvp.exec:\dpvvp.exe211⤵
-
\??\c:\lflfffr.exec:\lflfffr.exe212⤵
-
\??\c:\rlrlrll.exec:\rlrlrll.exe213⤵
-
\??\c:\bnhhbb.exec:\bnhhbb.exe214⤵
-
\??\c:\nntthh.exec:\nntthh.exe215⤵
-
\??\c:\djpjv.exec:\djpjv.exe216⤵
-
\??\c:\vpdvj.exec:\vpdvj.exe217⤵
-
\??\c:\lxxrrrl.exec:\lxxrrrl.exe218⤵
-
\??\c:\rrxrlfx.exec:\rrxrlfx.exe219⤵
-
\??\c:\hbbhnh.exec:\hbbhnh.exe220⤵
-
\??\c:\vjdvp.exec:\vjdvp.exe221⤵
-
\??\c:\dpvvj.exec:\dpvvj.exe222⤵
-
\??\c:\xrlxlfr.exec:\xrlxlfr.exe223⤵
-
\??\c:\flxxrfx.exec:\flxxrfx.exe224⤵
-
\??\c:\bbbthh.exec:\bbbthh.exe225⤵
-
\??\c:\ddddv.exec:\ddddv.exe226⤵
-
\??\c:\jvpjv.exec:\jvpjv.exe227⤵
-
\??\c:\lrrrllf.exec:\lrrrllf.exe228⤵
-
\??\c:\httnnh.exec:\httnnh.exe229⤵
-
\??\c:\nhnhtb.exec:\nhnhtb.exe230⤵
-
\??\c:\pvjjd.exec:\pvjjd.exe231⤵
-
\??\c:\djdvj.exec:\djdvj.exe232⤵
-
\??\c:\rrfxllf.exec:\rrfxllf.exe233⤵
-
\??\c:\tnntnn.exec:\tnntnn.exe234⤵
-
\??\c:\bhttnt.exec:\bhttnt.exe235⤵
-
\??\c:\jpvvv.exec:\jpvvv.exe236⤵
-
\??\c:\lffffff.exec:\lffffff.exe237⤵
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe238⤵
-
\??\c:\frrrxrl.exec:\frrrxrl.exe239⤵
-
\??\c:\thhhbt.exec:\thhhbt.exe240⤵
-
\??\c:\dpddd.exec:\dpddd.exe241⤵