Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 12:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2c423eb142d12b9db832006028b8a93f78cf308c55352a8b670909b132953b34.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
2c423eb142d12b9db832006028b8a93f78cf308c55352a8b670909b132953b34.exe
-
Size
392KB
-
MD5
1bc060afc435292129dd044081cb0bf0
-
SHA1
a3e1c41de3a2b2d678a5cfa72a137a3596c13fc4
-
SHA256
2c423eb142d12b9db832006028b8a93f78cf308c55352a8b670909b132953b34
-
SHA512
5585562d72bd2e8cb52a96a53469aa40ef3c91b40a080085ace70e929739bc1464d957f04919e0d60a2a16c0d56eef128aa4a9a7af1348e8bdc1ada57af99f9c
-
SSDEEP
6144:n3C9BRIG0asYFm71mPfkVB8dKwaO5CVwOy:n3C9uYA7okVqdKwaO5CVQ
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/2740-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1728-21-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1728-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2948-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2288-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2808-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2136-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1792-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2124-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/572-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1468-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1540-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2184-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/920-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pjvdj.exe5xllrxl.exedvpdj.exe3nhhnt.exedvjpd.exexxxlflx.exeddvdj.exefxrlrxl.exevdpdd.exelfxxrxr.exevjppd.exepvvjj.exe3bbbnt.exepdddd.exetnhnbb.exebhbtnn.exe3pppj.exe5frxflr.exe7lxfxrf.exenntbtn.exexrlxlrf.exenhbntb.exe9jdpv.exefxxlrxl.exeppjdd.exexxrflxr.exetnhnbt.exejdvpd.exeflfxlxr.exebhnnnh.exerlxxfxl.exetnbhnn.exe7pvvd.exexxxlfll.exefxlrffl.exe3nnbhn.exe5dvdp.exerlffrxf.exeffrfrxl.exehbnthh.exeppppv.exe1lflrxl.exexxxrrxl.exehbbhnn.exebtnthn.exepjvjp.exefxrxxfr.exefxlxlfx.exebthtnb.exe5vdjp.exe7jdjv.exellfrlrl.exehnhtbh.exe7tnhhn.exevdjdp.exexrrxlxr.exefxrxrxl.exe7btbtb.exe1vpjp.exedjdjp.exexrflrrx.exehbbtnt.exe3jjvj.exevvvpv.exepid process 1728 pjvdj.exe 2948 5xllrxl.exe 2652 dvpdj.exe 2620 3nhhnt.exe 2580 dvjpd.exe 2676 xxxlflx.exe 2716 ddvdj.exe 2584 fxrlrxl.exe 2288 vdpdd.exe 284 lfxxrxr.exe 2532 vjppd.exe 2808 pvvjj.exe 2564 3bbbnt.exe 2136 pdddd.exe 1880 tnhnbb.exe 2356 bhbtnn.exe 1512 3pppj.exe 2912 5frxflr.exe 1792 7lxfxrf.exe 2124 nntbtn.exe 572 xrlxlrf.exe 1468 nhbntb.exe 328 9jdpv.exe 824 fxxlrxl.exe 3064 ppjdd.exe 1540 xxrflxr.exe 1348 tnhnbt.exe 2184 jdvpd.exe 920 flfxlxr.exe 2980 bhnnnh.exe 2204 rlxxfxl.exe 1716 tnbhnn.exe 2904 7pvvd.exe 2056 xxxlfll.exe 1596 fxlrffl.exe 1888 3nnbhn.exe 2996 5dvdp.exe 2200 rlffrxf.exe 2692 ffrfrxl.exe 2844 hbnthh.exe 2620 ppppv.exe 840 1lflrxl.exe 2576 xxxrrxl.exe 2484 hbbhnn.exe 2360 btnthn.exe 1876 pjvjp.exe 1992 fxrxxfr.exe 2440 fxlxlfx.exe 284 bthtnb.exe 2532 5vdjp.exe 784 7jdjv.exe 1668 llfrlrl.exe 1284 hnhtbh.exe 1988 7tnhhn.exe 1636 vdjdp.exe 2356 xrrxlxr.exe 1760 fxrxrxl.exe 1512 7btbtb.exe 2444 1vpjp.exe 1792 djdjp.exe 1240 xrflrrx.exe 2416 hbbtnt.exe 2788 3jjvj.exe 1756 vvvpv.exe -
Processes:
resource yara_rule behavioral1/memory/2740-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1728-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2136-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1792-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2124-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/572-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1468-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1540-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2184-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/920-279-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2c423eb142d12b9db832006028b8a93f78cf308c55352a8b670909b132953b34.exepjvdj.exe5xllrxl.exedvpdj.exe3nhhnt.exedvjpd.exexxxlflx.exeddvdj.exefxrlrxl.exevdpdd.exelfxxrxr.exevjppd.exepvvjj.exe3bbbnt.exepdddd.exetnhnbb.exedescription pid process target process PID 2740 wrote to memory of 1728 2740 2c423eb142d12b9db832006028b8a93f78cf308c55352a8b670909b132953b34.exe pjvdj.exe PID 2740 wrote to memory of 1728 2740 2c423eb142d12b9db832006028b8a93f78cf308c55352a8b670909b132953b34.exe pjvdj.exe PID 2740 wrote to memory of 1728 2740 2c423eb142d12b9db832006028b8a93f78cf308c55352a8b670909b132953b34.exe pjvdj.exe PID 2740 wrote to memory of 1728 2740 2c423eb142d12b9db832006028b8a93f78cf308c55352a8b670909b132953b34.exe pjvdj.exe PID 1728 wrote to memory of 2948 1728 pjvdj.exe 5xllrxl.exe PID 1728 wrote to memory of 2948 1728 pjvdj.exe 5xllrxl.exe PID 1728 wrote to memory of 2948 1728 pjvdj.exe 5xllrxl.exe PID 1728 wrote to memory of 2948 1728 pjvdj.exe 5xllrxl.exe PID 2948 wrote to memory of 2652 2948 5xllrxl.exe dvpdj.exe PID 2948 wrote to memory of 2652 2948 5xllrxl.exe dvpdj.exe PID 2948 wrote to memory of 2652 2948 5xllrxl.exe dvpdj.exe PID 2948 wrote to memory of 2652 2948 5xllrxl.exe dvpdj.exe PID 2652 wrote to memory of 2620 2652 dvpdj.exe 3nhhnt.exe PID 2652 wrote to memory of 2620 2652 dvpdj.exe 3nhhnt.exe PID 2652 wrote to memory of 2620 2652 dvpdj.exe 3nhhnt.exe PID 2652 wrote to memory of 2620 2652 dvpdj.exe 3nhhnt.exe PID 2620 wrote to memory of 2580 2620 3nhhnt.exe dvjpd.exe PID 2620 wrote to memory of 2580 2620 3nhhnt.exe dvjpd.exe PID 2620 wrote to memory of 2580 2620 3nhhnt.exe dvjpd.exe PID 2620 wrote to memory of 2580 2620 3nhhnt.exe dvjpd.exe PID 2580 wrote to memory of 2676 2580 dvjpd.exe xxxlflx.exe PID 2580 wrote to memory of 2676 2580 dvjpd.exe xxxlflx.exe PID 2580 wrote to memory of 2676 2580 dvjpd.exe xxxlflx.exe PID 2580 wrote to memory of 2676 2580 dvjpd.exe xxxlflx.exe PID 2676 wrote to memory of 2716 2676 xxxlflx.exe ddvdj.exe PID 2676 wrote to memory of 2716 2676 xxxlflx.exe ddvdj.exe PID 2676 wrote to memory of 2716 2676 xxxlflx.exe ddvdj.exe PID 2676 wrote to memory of 2716 2676 xxxlflx.exe ddvdj.exe PID 2716 wrote to memory of 2584 2716 ddvdj.exe fxrlrxl.exe PID 2716 wrote to memory of 2584 2716 ddvdj.exe fxrlrxl.exe PID 2716 wrote to memory of 2584 2716 ddvdj.exe fxrlrxl.exe PID 2716 wrote to memory of 2584 2716 ddvdj.exe fxrlrxl.exe PID 2584 wrote to memory of 2288 2584 fxrlrxl.exe vdpdd.exe PID 2584 wrote to memory of 2288 2584 fxrlrxl.exe vdpdd.exe PID 2584 wrote to memory of 2288 2584 fxrlrxl.exe vdpdd.exe PID 2584 wrote to memory of 2288 2584 fxrlrxl.exe vdpdd.exe PID 2288 wrote to memory of 284 2288 vdpdd.exe lfxxrxr.exe PID 2288 wrote to memory of 284 2288 vdpdd.exe lfxxrxr.exe PID 2288 wrote to memory of 284 2288 vdpdd.exe lfxxrxr.exe PID 2288 wrote to memory of 284 2288 vdpdd.exe lfxxrxr.exe PID 284 wrote to memory of 2532 284 lfxxrxr.exe vjppd.exe PID 284 wrote to memory of 2532 284 lfxxrxr.exe vjppd.exe PID 284 wrote to memory of 2532 284 lfxxrxr.exe vjppd.exe PID 284 wrote to memory of 2532 284 lfxxrxr.exe vjppd.exe PID 2532 wrote to memory of 2808 2532 vjppd.exe pvvjj.exe PID 2532 wrote to memory of 2808 2532 vjppd.exe pvvjj.exe PID 2532 wrote to memory of 2808 2532 vjppd.exe pvvjj.exe PID 2532 wrote to memory of 2808 2532 vjppd.exe pvvjj.exe PID 2808 wrote to memory of 2564 2808 pvvjj.exe 3bbbnt.exe PID 2808 wrote to memory of 2564 2808 pvvjj.exe 3bbbnt.exe PID 2808 wrote to memory of 2564 2808 pvvjj.exe 3bbbnt.exe PID 2808 wrote to memory of 2564 2808 pvvjj.exe 3bbbnt.exe PID 2564 wrote to memory of 2136 2564 3bbbnt.exe pdddd.exe PID 2564 wrote to memory of 2136 2564 3bbbnt.exe pdddd.exe PID 2564 wrote to memory of 2136 2564 3bbbnt.exe pdddd.exe PID 2564 wrote to memory of 2136 2564 3bbbnt.exe pdddd.exe PID 2136 wrote to memory of 1880 2136 pdddd.exe tnhnbb.exe PID 2136 wrote to memory of 1880 2136 pdddd.exe tnhnbb.exe PID 2136 wrote to memory of 1880 2136 pdddd.exe tnhnbb.exe PID 2136 wrote to memory of 1880 2136 pdddd.exe tnhnbb.exe PID 1880 wrote to memory of 2356 1880 tnhnbb.exe bhbtnn.exe PID 1880 wrote to memory of 2356 1880 tnhnbb.exe bhbtnn.exe PID 1880 wrote to memory of 2356 1880 tnhnbb.exe bhbtnn.exe PID 1880 wrote to memory of 2356 1880 tnhnbb.exe bhbtnn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c423eb142d12b9db832006028b8a93f78cf308c55352a8b670909b132953b34.exe"C:\Users\Admin\AppData\Local\Temp\2c423eb142d12b9db832006028b8a93f78cf308c55352a8b670909b132953b34.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\pjvdj.exec:\pjvdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5xllrxl.exec:\5xllrxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvpdj.exec:\dvpdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3nhhnt.exec:\3nhhnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvjpd.exec:\dvjpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxxlflx.exec:\xxxlflx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddvdj.exec:\ddvdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxrlrxl.exec:\fxrlrxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vdpdd.exec:\vdpdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfxxrxr.exec:\lfxxrxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjppd.exec:\vjppd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvvjj.exec:\pvvjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3bbbnt.exec:\3bbbnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdddd.exec:\pdddd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnhnbb.exec:\tnhnbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhbtnn.exec:\bhbtnn.exe17⤵
- Executes dropped EXE
-
\??\c:\3pppj.exec:\3pppj.exe18⤵
- Executes dropped EXE
-
\??\c:\5frxflr.exec:\5frxflr.exe19⤵
- Executes dropped EXE
-
\??\c:\7lxfxrf.exec:\7lxfxrf.exe20⤵
- Executes dropped EXE
-
\??\c:\nntbtn.exec:\nntbtn.exe21⤵
- Executes dropped EXE
-
\??\c:\xrlxlrf.exec:\xrlxlrf.exe22⤵
- Executes dropped EXE
-
\??\c:\nhbntb.exec:\nhbntb.exe23⤵
- Executes dropped EXE
-
\??\c:\9jdpv.exec:\9jdpv.exe24⤵
- Executes dropped EXE
-
\??\c:\fxxlrxl.exec:\fxxlrxl.exe25⤵
- Executes dropped EXE
-
\??\c:\ppjdd.exec:\ppjdd.exe26⤵
- Executes dropped EXE
-
\??\c:\xxrflxr.exec:\xxrflxr.exe27⤵
- Executes dropped EXE
-
\??\c:\tnhnbt.exec:\tnhnbt.exe28⤵
- Executes dropped EXE
-
\??\c:\jdvpd.exec:\jdvpd.exe29⤵
- Executes dropped EXE
-
\??\c:\flfxlxr.exec:\flfxlxr.exe30⤵
- Executes dropped EXE
-
\??\c:\bhnnnh.exec:\bhnnnh.exe31⤵
- Executes dropped EXE
-
\??\c:\rlxxfxl.exec:\rlxxfxl.exe32⤵
- Executes dropped EXE
-
\??\c:\tnbhnn.exec:\tnbhnn.exe33⤵
- Executes dropped EXE
-
\??\c:\7pvvd.exec:\7pvvd.exe34⤵
- Executes dropped EXE
-
\??\c:\xxxlfll.exec:\xxxlfll.exe35⤵
- Executes dropped EXE
-
\??\c:\fxlrffl.exec:\fxlrffl.exe36⤵
- Executes dropped EXE
-
\??\c:\3nnbhn.exec:\3nnbhn.exe37⤵
- Executes dropped EXE
-
\??\c:\5dvdp.exec:\5dvdp.exe38⤵
- Executes dropped EXE
-
\??\c:\rlffrxf.exec:\rlffrxf.exe39⤵
- Executes dropped EXE
-
\??\c:\ffrfrxl.exec:\ffrfrxl.exe40⤵
- Executes dropped EXE
-
\??\c:\hbnthh.exec:\hbnthh.exe41⤵
- Executes dropped EXE
-
\??\c:\ppppv.exec:\ppppv.exe42⤵
- Executes dropped EXE
-
\??\c:\1lflrxl.exec:\1lflrxl.exe43⤵
- Executes dropped EXE
-
\??\c:\xxxrrxl.exec:\xxxrrxl.exe44⤵
- Executes dropped EXE
-
\??\c:\hbbhnn.exec:\hbbhnn.exe45⤵
- Executes dropped EXE
-
\??\c:\btnthn.exec:\btnthn.exe46⤵
- Executes dropped EXE
-
\??\c:\pjvjp.exec:\pjvjp.exe47⤵
- Executes dropped EXE
-
\??\c:\fxrxxfr.exec:\fxrxxfr.exe48⤵
- Executes dropped EXE
-
\??\c:\fxlxlfx.exec:\fxlxlfx.exe49⤵
- Executes dropped EXE
-
\??\c:\bthtnb.exec:\bthtnb.exe50⤵
- Executes dropped EXE
-
\??\c:\5vdjp.exec:\5vdjp.exe51⤵
- Executes dropped EXE
-
\??\c:\7jdjv.exec:\7jdjv.exe52⤵
- Executes dropped EXE
-
\??\c:\llfrlrl.exec:\llfrlrl.exe53⤵
- Executes dropped EXE
-
\??\c:\hnhtbh.exec:\hnhtbh.exe54⤵
- Executes dropped EXE
-
\??\c:\7tnhhn.exec:\7tnhhn.exe55⤵
- Executes dropped EXE
-
\??\c:\vdjdp.exec:\vdjdp.exe56⤵
- Executes dropped EXE
-
\??\c:\xrrxlxr.exec:\xrrxlxr.exe57⤵
- Executes dropped EXE
-
\??\c:\fxrxrxl.exec:\fxrxrxl.exe58⤵
- Executes dropped EXE
-
\??\c:\7btbtb.exec:\7btbtb.exe59⤵
- Executes dropped EXE
-
\??\c:\1vpjp.exec:\1vpjp.exe60⤵
- Executes dropped EXE
-
\??\c:\djdjp.exec:\djdjp.exe61⤵
- Executes dropped EXE
-
\??\c:\xrflrrx.exec:\xrflrrx.exe62⤵
- Executes dropped EXE
-
\??\c:\hbbtnt.exec:\hbbtnt.exe63⤵
- Executes dropped EXE
-
\??\c:\3jjvj.exec:\3jjvj.exe64⤵
- Executes dropped EXE
-
\??\c:\vvvpv.exec:\vvvpv.exe65⤵
- Executes dropped EXE
-
\??\c:\3lrlrrx.exec:\3lrlrrx.exe66⤵
-
\??\c:\btbtnt.exec:\btbtnt.exe67⤵
-
\??\c:\tnbhtb.exec:\tnbhtb.exe68⤵
-
\??\c:\jpvjv.exec:\jpvjv.exe69⤵
-
\??\c:\rrrxllx.exec:\rrrxllx.exe70⤵
-
\??\c:\rfrlxrx.exec:\rfrlxrx.exe71⤵
-
\??\c:\bbnntb.exec:\bbnntb.exe72⤵
-
\??\c:\vjjdj.exec:\vjjdj.exe73⤵
-
\??\c:\5dvvd.exec:\5dvvd.exe74⤵
-
\??\c:\rlfrxfr.exec:\rlfrxfr.exe75⤵
-
\??\c:\bnhtbb.exec:\bnhtbb.exe76⤵
-
\??\c:\nhbhhn.exec:\nhbhhn.exe77⤵
-
\??\c:\jjddj.exec:\jjddj.exe78⤵
-
\??\c:\fxlrxxl.exec:\fxlrxxl.exe79⤵
-
\??\c:\btntbn.exec:\btntbn.exe80⤵
-
\??\c:\nhtntb.exec:\nhtntb.exe81⤵
-
\??\c:\jjdjd.exec:\jjdjd.exe82⤵
-
\??\c:\rfflfxr.exec:\rfflfxr.exe83⤵
-
\??\c:\rfxfrxr.exec:\rfxfrxr.exe84⤵
-
\??\c:\hhbhtb.exec:\hhbhtb.exe85⤵
-
\??\c:\pvjjp.exec:\pvjjp.exe86⤵
-
\??\c:\ddvjd.exec:\ddvjd.exe87⤵
-
\??\c:\rllrflx.exec:\rllrflx.exe88⤵
-
\??\c:\btntbh.exec:\btntbh.exe89⤵
-
\??\c:\3thbnb.exec:\3thbnb.exe90⤵
-
\??\c:\djjdp.exec:\djjdp.exe91⤵
-
\??\c:\rlfrffx.exec:\rlfrffx.exe92⤵
-
\??\c:\flxxffl.exec:\flxxffl.exe93⤵
-
\??\c:\1nbbbh.exec:\1nbbbh.exe94⤵
-
\??\c:\9jdjd.exec:\9jdjd.exe95⤵
-
\??\c:\fxxfrrf.exec:\fxxfrrf.exe96⤵
-
\??\c:\xxxlrxf.exec:\xxxlrxf.exe97⤵
-
\??\c:\nhbbnn.exec:\nhbbnn.exe98⤵
-
\??\c:\vvpvj.exec:\vvpvj.exe99⤵
-
\??\c:\vpdjv.exec:\vpdjv.exe100⤵
-
\??\c:\ffxfllx.exec:\ffxfllx.exe101⤵
-
\??\c:\btnbnn.exec:\btnbnn.exe102⤵
-
\??\c:\hhbthh.exec:\hhbthh.exe103⤵
-
\??\c:\9jjdv.exec:\9jjdv.exe104⤵
-
\??\c:\9xrxfrr.exec:\9xrxfrr.exe105⤵
-
\??\c:\bbhnnt.exec:\bbhnnt.exe106⤵
-
\??\c:\hbntnt.exec:\hbntnt.exe107⤵
-
\??\c:\5pvvp.exec:\5pvvp.exe108⤵
-
\??\c:\xrfflll.exec:\xrfflll.exe109⤵
-
\??\c:\lfxfrrf.exec:\lfxfrrf.exe110⤵
-
\??\c:\btnntt.exec:\btnntt.exe111⤵
-
\??\c:\vpjpd.exec:\vpjpd.exe112⤵
-
\??\c:\djjpd.exec:\djjpd.exe113⤵
-
\??\c:\lxrxxfr.exec:\lxrxxfr.exe114⤵
-
\??\c:\hbthhn.exec:\hbthhn.exe115⤵
-
\??\c:\3tntnt.exec:\3tntnt.exe116⤵
-
\??\c:\vpjpv.exec:\vpjpv.exe117⤵
-
\??\c:\5lllllr.exec:\5lllllr.exe118⤵
-
\??\c:\lxxfxfr.exec:\lxxfxfr.exe119⤵
-
\??\c:\hbtthn.exec:\hbtthn.exe120⤵
-
\??\c:\jdppv.exec:\jdppv.exe121⤵
-
\??\c:\vvpvd.exec:\vvpvd.exe122⤵
-
\??\c:\rlxflrf.exec:\rlxflrf.exe123⤵
-
\??\c:\nhthhh.exec:\nhthhh.exe124⤵
-
\??\c:\hbbhbh.exec:\hbbhbh.exe125⤵
-
\??\c:\ppjjv.exec:\ppjjv.exe126⤵
-
\??\c:\pjjpj.exec:\pjjpj.exe127⤵
-
\??\c:\rfxlxll.exec:\rfxlxll.exe128⤵
-
\??\c:\tnbhnn.exec:\tnbhnn.exe129⤵
-
\??\c:\dvjjv.exec:\dvjjv.exe130⤵
-
\??\c:\xrlrflf.exec:\xrlrflf.exe131⤵
-
\??\c:\bbbbtb.exec:\bbbbtb.exe132⤵
-
\??\c:\1httnt.exec:\1httnt.exe133⤵
-
\??\c:\ppjjd.exec:\ppjjd.exe134⤵
-
\??\c:\rrrxlrf.exec:\rrrxlrf.exe135⤵
-
\??\c:\lfxlrxl.exec:\lfxlrxl.exe136⤵
-
\??\c:\vpjjv.exec:\vpjjv.exe137⤵
-
\??\c:\vvjpv.exec:\vvjpv.exe138⤵
-
\??\c:\lflflll.exec:\lflflll.exe139⤵
-
\??\c:\nnbhtt.exec:\nnbhtt.exe140⤵
-
\??\c:\jdvjp.exec:\jdvjp.exe141⤵
-
\??\c:\9jdpd.exec:\9jdpd.exe142⤵
-
\??\c:\7xlflff.exec:\7xlflff.exe143⤵
-
\??\c:\bttnbh.exec:\bttnbh.exe144⤵
-
\??\c:\bnhtnt.exec:\bnhtnt.exe145⤵
-
\??\c:\pjpjp.exec:\pjpjp.exe146⤵
-
\??\c:\xlxlfxr.exec:\xlxlfxr.exe147⤵
-
\??\c:\lrrrflr.exec:\lrrrflr.exe148⤵
-
\??\c:\3nnhnn.exec:\3nnhnn.exe149⤵
-
\??\c:\pjjjd.exec:\pjjjd.exe150⤵
-
\??\c:\vvddv.exec:\vvddv.exe151⤵
-
\??\c:\fxxfrrf.exec:\fxxfrrf.exe152⤵
-
\??\c:\bbhntt.exec:\bbhntt.exe153⤵
-
\??\c:\7vdvj.exec:\7vdvj.exe154⤵
-
\??\c:\jvvdj.exec:\jvvdj.exe155⤵
-
\??\c:\xxrflrf.exec:\xxrflrf.exe156⤵
-
\??\c:\7bhnhb.exec:\7bhnhb.exe157⤵
-
\??\c:\btnbhn.exec:\btnbhn.exe158⤵
-
\??\c:\ddppd.exec:\ddppd.exe159⤵
-
\??\c:\1lxrxfl.exec:\1lxrxfl.exe160⤵
-
\??\c:\lffllxf.exec:\lffllxf.exe161⤵
-
\??\c:\htbtth.exec:\htbtth.exe162⤵
-
\??\c:\pdjdd.exec:\pdjdd.exe163⤵
-
\??\c:\ppjjp.exec:\ppjjp.exe164⤵
-
\??\c:\ffrxxrx.exec:\ffrxxrx.exe165⤵
-
\??\c:\1hhnbh.exec:\1hhnbh.exe166⤵
-
\??\c:\3htbnb.exec:\3htbnb.exe167⤵
-
\??\c:\dvpvj.exec:\dvpvj.exe168⤵
-
\??\c:\9lrxffx.exec:\9lrxffx.exe169⤵
-
\??\c:\xxlxrfr.exec:\xxlxrfr.exe170⤵
-
\??\c:\hbthtb.exec:\hbthtb.exe171⤵
-
\??\c:\vvppd.exec:\vvppd.exe172⤵
-
\??\c:\1frrlrr.exec:\1frrlrr.exe173⤵
-
\??\c:\rxrxxrr.exec:\rxrxxrr.exe174⤵
-
\??\c:\tnnbnn.exec:\tnnbnn.exe175⤵
-
\??\c:\pjvvd.exec:\pjvvd.exe176⤵
-
\??\c:\vjddd.exec:\vjddd.exe177⤵
-
\??\c:\9rlxlrl.exec:\9rlxlrl.exe178⤵
-
\??\c:\5nnnbh.exec:\5nnnbh.exe179⤵
-
\??\c:\ttntht.exec:\ttntht.exe180⤵
-
\??\c:\djjjv.exec:\djjjv.exe181⤵
-
\??\c:\7rxffff.exec:\7rxffff.exe182⤵
-
\??\c:\xrffllx.exec:\xrffllx.exe183⤵
-
\??\c:\ttbbnn.exec:\ttbbnn.exe184⤵
-
\??\c:\vdddj.exec:\vdddj.exe185⤵
-
\??\c:\ffxrffx.exec:\ffxrffx.exe186⤵
-
\??\c:\xflrxlr.exec:\xflrxlr.exe187⤵
-
\??\c:\bhtbht.exec:\bhtbht.exe188⤵
-
\??\c:\pdppp.exec:\pdppp.exe189⤵
-
\??\c:\7ppvp.exec:\7ppvp.exe190⤵
-
\??\c:\lllfrxf.exec:\lllfrxf.exe191⤵
-
\??\c:\bbnhtb.exec:\bbnhtb.exe192⤵
-
\??\c:\hhnhnb.exec:\hhnhnb.exe193⤵
-
\??\c:\1pvpv.exec:\1pvpv.exe194⤵
-
\??\c:\lrlxrlf.exec:\lrlxrlf.exe195⤵
-
\??\c:\5hhtbb.exec:\5hhtbb.exe196⤵
-
\??\c:\vpjpp.exec:\vpjpp.exe197⤵
-
\??\c:\fxlrxfl.exec:\fxlrxfl.exe198⤵
-
\??\c:\lxrlrfl.exec:\lxrlrfl.exe199⤵
-
\??\c:\1hbbnt.exec:\1hbbnt.exe200⤵
-
\??\c:\hbbnbh.exec:\hbbnbh.exe201⤵
-
\??\c:\vpjpd.exec:\vpjpd.exe202⤵
-
\??\c:\ffxlxlx.exec:\ffxlxlx.exe203⤵
-
\??\c:\rrxfrxl.exec:\rrxfrxl.exe204⤵
-
\??\c:\bbbhnn.exec:\bbbhnn.exe205⤵
-
\??\c:\pjdjp.exec:\pjdjp.exe206⤵
-
\??\c:\rflrflx.exec:\rflrflx.exe207⤵
-
\??\c:\7rlrffr.exec:\7rlrffr.exe208⤵
-
\??\c:\ttttbb.exec:\ttttbb.exe209⤵
-
\??\c:\jjppv.exec:\jjppv.exe210⤵
-
\??\c:\pvvdp.exec:\pvvdp.exe211⤵
-
\??\c:\llfrxfr.exec:\llfrxfr.exe212⤵
-
\??\c:\hbtthh.exec:\hbtthh.exe213⤵
-
\??\c:\hhhnbh.exec:\hhhnbh.exe214⤵
-
\??\c:\dvvjd.exec:\dvvjd.exe215⤵
-
\??\c:\3frxflr.exec:\3frxflr.exe216⤵
-
\??\c:\rllflfr.exec:\rllflfr.exe217⤵
-
\??\c:\bbthtt.exec:\bbthtt.exe218⤵
-
\??\c:\hhbhhh.exec:\hhbhhh.exe219⤵
-
\??\c:\3vjjd.exec:\3vjjd.exe220⤵
-
\??\c:\fxxlxfx.exec:\fxxlxfx.exe221⤵
-
\??\c:\nthttt.exec:\nthttt.exe222⤵
-
\??\c:\3bhbhh.exec:\3bhbhh.exe223⤵
-
\??\c:\7ddjv.exec:\7ddjv.exe224⤵
-
\??\c:\flxrfxl.exec:\flxrfxl.exe225⤵
-
\??\c:\xlffrrx.exec:\xlffrrx.exe226⤵
-
\??\c:\ttnhnn.exec:\ttnhnn.exe227⤵
-
\??\c:\7jvvp.exec:\7jvvp.exe228⤵
-
\??\c:\ppjpd.exec:\ppjpd.exe229⤵
-
\??\c:\xxlrffl.exec:\xxlrffl.exe230⤵
-
\??\c:\btnthh.exec:\btnthh.exe231⤵
-
\??\c:\hththt.exec:\hththt.exe232⤵
-
\??\c:\3jdjp.exec:\3jdjp.exe233⤵
-
\??\c:\ffxrxfx.exec:\ffxrxfx.exe234⤵
-
\??\c:\lllxlrf.exec:\lllxlrf.exe235⤵
-
\??\c:\tbtbnn.exec:\tbtbnn.exe236⤵
-
\??\c:\jdjvj.exec:\jdjvj.exe237⤵
-
\??\c:\9vpvd.exec:\9vpvd.exe238⤵
-
\??\c:\xrxflrf.exec:\xrxflrf.exe239⤵
-
\??\c:\ttnthn.exec:\ttnthn.exe240⤵
-
\??\c:\nthttt.exec:\nthttt.exe241⤵