Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 12:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
28a1e046290f45815f164f70734ec3ebd94ae5a7326b9a1ec605e2241f02c8de.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
-
Target
28a1e046290f45815f164f70734ec3ebd94ae5a7326b9a1ec605e2241f02c8de.exe
-
Size
63KB
-
MD5
28cd7d92c7c90c4c8516649545d2e440
-
SHA1
95fb0e1fe12329b230d5cedc847b3a4abf0ab1a6
-
SHA256
28a1e046290f45815f164f70734ec3ebd94ae5a7326b9a1ec605e2241f02c8de
-
SHA512
6147087e1c00d4543f2d541b2ed8c4f543c37029eacf5ee4f110d9c921024c0b04980cc63b6073ca82dba07148c0f7c4cd64abc58f77034b0e99644d1e2c8f20
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6Mu/ePS3AL:ymb3NkkiQ3mdBjFI46TQL
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral1/memory/2052-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-21-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1956-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1956-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2948-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2200-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/324-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2904-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1540-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1640-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1256-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1492-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1936-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2272-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-611-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jdvvv.exerlfrlfl.exebbbnhb.exedpjpp.exe9xxflxl.exe7lffxfr.exethbhhh.exejdpjp.exefxrfrxx.exelfrrllx.exebtbhnn.exe1htbbn.exe9jddp.exefxrxrxr.exebthtbb.exennhhth.exe3vjdp.exellfxlrl.exelfrrffl.exehhbbnn.exe5vpjp.exe7frlffl.exefxlrxxr.exenhhtbh.exennbnbh.exe3ppjp.exepjvvv.exefrflrrx.exehbtbnt.exenbtbhh.exe3jvdj.exejjpjp.exelfxfllx.exennhhtb.exebbtbnn.exeppdjp.exe3pdjp.exexlxxffr.exexlxflff.exetnhhbt.exe7httnh.exejvddp.exexrrlrll.exexxlrxxl.exe5btbtb.exe3bnbbb.exejdpvj.exe3ddvj.exelfxffll.exe5fxlxfl.exetnhtbb.exetntthh.exe3pjpd.exedvjpp.exexlxxffl.exerlrxlff.exefxxfrxl.exe1thhhn.exedvpvj.exepddpd.exepdvvj.exelfllrxl.exelxrfrfx.exenhnthn.exepid process 2232 jdvvv.exe 1956 rlfrlfl.exe 2740 bbbnhb.exe 2948 dpjpp.exe 2568 9xxflxl.exe 2556 7lffxfr.exe 2544 thbhhh.exe 2200 jdpjp.exe 324 fxrfrxx.exe 2876 lfrrllx.exe 2904 btbhnn.exe 1540 1htbbn.exe 1640 9jddp.exe 2036 fxrxrxr.exe 2184 bthtbb.exe 2592 nnhhth.exe 2168 3vjdp.exe 1256 llfxlrl.exe 2016 lfrrffl.exe 2916 hhbbnn.exe 2968 5vpjp.exe 592 7frlffl.exe 1392 fxlrxxr.exe 1492 nhhtbh.exe 1056 nnbnbh.exe 1936 3ppjp.exe 820 pjvvv.exe 1660 frflrrx.exe 1656 hbtbnt.exe 2272 nbtbhh.exe 2996 3jvdj.exe 2328 jjpjp.exe 1028 lfxfllx.exe 3060 nnhhtb.exe 2480 bbtbnn.exe 2432 ppdjp.exe 2744 3pdjp.exe 2660 xlxxffr.exe 2740 xlxflff.exe 2560 tnhhbt.exe 2832 7httnh.exe 2768 jvddp.exe 2584 xrrlrll.exe 2088 xxlrxxl.exe 3040 5btbtb.exe 2868 3bnbbb.exe 2788 jdpvj.exe 2876 3ddvj.exe 1536 lfxffll.exe 1716 5fxlxfl.exe 1688 tnhtbb.exe 1692 tntthh.exe 2420 3pjpd.exe 2604 dvjpp.exe 2520 xlxxffl.exe 1248 rlrxlff.exe 2012 fxxfrxl.exe 2016 1thhhn.exe 2512 dvpvj.exe 2916 pddpd.exe 688 pdvvj.exe 1008 lfllrxl.exe 1120 lxrfrfx.exe 3048 nhnthn.exe -
Processes:
resource yara_rule behavioral1/memory/2052-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1956-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1956-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1956-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1956-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/324-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1540-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1256-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1492-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1936-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-611-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
28a1e046290f45815f164f70734ec3ebd94ae5a7326b9a1ec605e2241f02c8de.exejdvvv.exerlfrlfl.exebbbnhb.exedpjpp.exe9xxflxl.exe7lffxfr.exethbhhh.exejdpjp.exefxrfrxx.exelfrrllx.exebtbhnn.exe1htbbn.exe9jddp.exefxrxrxr.exebthtbb.exedescription pid process target process PID 2052 wrote to memory of 2232 2052 28a1e046290f45815f164f70734ec3ebd94ae5a7326b9a1ec605e2241f02c8de.exe jdvvv.exe PID 2052 wrote to memory of 2232 2052 28a1e046290f45815f164f70734ec3ebd94ae5a7326b9a1ec605e2241f02c8de.exe jdvvv.exe PID 2052 wrote to memory of 2232 2052 28a1e046290f45815f164f70734ec3ebd94ae5a7326b9a1ec605e2241f02c8de.exe jdvvv.exe PID 2052 wrote to memory of 2232 2052 28a1e046290f45815f164f70734ec3ebd94ae5a7326b9a1ec605e2241f02c8de.exe jdvvv.exe PID 2232 wrote to memory of 1956 2232 jdvvv.exe rlfrlfl.exe PID 2232 wrote to memory of 1956 2232 jdvvv.exe rlfrlfl.exe PID 2232 wrote to memory of 1956 2232 jdvvv.exe rlfrlfl.exe PID 2232 wrote to memory of 1956 2232 jdvvv.exe rlfrlfl.exe PID 1956 wrote to memory of 2740 1956 rlfrlfl.exe bbbnhb.exe PID 1956 wrote to memory of 2740 1956 rlfrlfl.exe bbbnhb.exe PID 1956 wrote to memory of 2740 1956 rlfrlfl.exe bbbnhb.exe PID 1956 wrote to memory of 2740 1956 rlfrlfl.exe bbbnhb.exe PID 2740 wrote to memory of 2948 2740 bbbnhb.exe dpjpp.exe PID 2740 wrote to memory of 2948 2740 bbbnhb.exe dpjpp.exe PID 2740 wrote to memory of 2948 2740 bbbnhb.exe dpjpp.exe PID 2740 wrote to memory of 2948 2740 bbbnhb.exe dpjpp.exe PID 2948 wrote to memory of 2568 2948 dpjpp.exe 9xxflxl.exe PID 2948 wrote to memory of 2568 2948 dpjpp.exe 9xxflxl.exe PID 2948 wrote to memory of 2568 2948 dpjpp.exe 9xxflxl.exe PID 2948 wrote to memory of 2568 2948 dpjpp.exe 9xxflxl.exe PID 2568 wrote to memory of 2556 2568 9xxflxl.exe 7lffxfr.exe PID 2568 wrote to memory of 2556 2568 9xxflxl.exe 7lffxfr.exe PID 2568 wrote to memory of 2556 2568 9xxflxl.exe 7lffxfr.exe PID 2568 wrote to memory of 2556 2568 9xxflxl.exe 7lffxfr.exe PID 2556 wrote to memory of 2544 2556 7lffxfr.exe thbhhh.exe PID 2556 wrote to memory of 2544 2556 7lffxfr.exe thbhhh.exe PID 2556 wrote to memory of 2544 2556 7lffxfr.exe thbhhh.exe PID 2556 wrote to memory of 2544 2556 7lffxfr.exe thbhhh.exe PID 2544 wrote to memory of 2200 2544 thbhhh.exe jdpjp.exe PID 2544 wrote to memory of 2200 2544 thbhhh.exe jdpjp.exe PID 2544 wrote to memory of 2200 2544 thbhhh.exe jdpjp.exe PID 2544 wrote to memory of 2200 2544 thbhhh.exe jdpjp.exe PID 2200 wrote to memory of 324 2200 jdpjp.exe fxrfrxx.exe PID 2200 wrote to memory of 324 2200 jdpjp.exe fxrfrxx.exe PID 2200 wrote to memory of 324 2200 jdpjp.exe fxrfrxx.exe PID 2200 wrote to memory of 324 2200 jdpjp.exe fxrfrxx.exe PID 324 wrote to memory of 2876 324 fxrfrxx.exe lfrrllx.exe PID 324 wrote to memory of 2876 324 fxrfrxx.exe lfrrllx.exe PID 324 wrote to memory of 2876 324 fxrfrxx.exe lfrrllx.exe PID 324 wrote to memory of 2876 324 fxrfrxx.exe lfrrllx.exe PID 2876 wrote to memory of 2904 2876 lfrrllx.exe btbhnn.exe PID 2876 wrote to memory of 2904 2876 lfrrllx.exe btbhnn.exe PID 2876 wrote to memory of 2904 2876 lfrrllx.exe btbhnn.exe PID 2876 wrote to memory of 2904 2876 lfrrllx.exe btbhnn.exe PID 2904 wrote to memory of 1540 2904 btbhnn.exe 1htbbn.exe PID 2904 wrote to memory of 1540 2904 btbhnn.exe 1htbbn.exe PID 2904 wrote to memory of 1540 2904 btbhnn.exe 1htbbn.exe PID 2904 wrote to memory of 1540 2904 btbhnn.exe 1htbbn.exe PID 1540 wrote to memory of 1640 1540 1htbbn.exe 9jddp.exe PID 1540 wrote to memory of 1640 1540 1htbbn.exe 9jddp.exe PID 1540 wrote to memory of 1640 1540 1htbbn.exe 9jddp.exe PID 1540 wrote to memory of 1640 1540 1htbbn.exe 9jddp.exe PID 1640 wrote to memory of 2036 1640 9jddp.exe fxrxrxr.exe PID 1640 wrote to memory of 2036 1640 9jddp.exe fxrxrxr.exe PID 1640 wrote to memory of 2036 1640 9jddp.exe fxrxrxr.exe PID 1640 wrote to memory of 2036 1640 9jddp.exe fxrxrxr.exe PID 2036 wrote to memory of 2184 2036 fxrxrxr.exe bthtbb.exe PID 2036 wrote to memory of 2184 2036 fxrxrxr.exe bthtbb.exe PID 2036 wrote to memory of 2184 2036 fxrxrxr.exe bthtbb.exe PID 2036 wrote to memory of 2184 2036 fxrxrxr.exe bthtbb.exe PID 2184 wrote to memory of 2592 2184 bthtbb.exe nnhhth.exe PID 2184 wrote to memory of 2592 2184 bthtbb.exe nnhhth.exe PID 2184 wrote to memory of 2592 2184 bthtbb.exe nnhhth.exe PID 2184 wrote to memory of 2592 2184 bthtbb.exe nnhhth.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\28a1e046290f45815f164f70734ec3ebd94ae5a7326b9a1ec605e2241f02c8de.exe"C:\Users\Admin\AppData\Local\Temp\28a1e046290f45815f164f70734ec3ebd94ae5a7326b9a1ec605e2241f02c8de.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\jdvvv.exec:\jdvvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlfrlfl.exec:\rlfrlfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbbnhb.exec:\bbbnhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dpjpp.exec:\dpjpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9xxflxl.exec:\9xxflxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7lffxfr.exec:\7lffxfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thbhhh.exec:\thbhhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdpjp.exec:\jdpjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxrfrxx.exec:\fxrfrxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfrrllx.exec:\lfrrllx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btbhnn.exec:\btbhnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1htbbn.exec:\1htbbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9jddp.exec:\9jddp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxrxrxr.exec:\fxrxrxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bthtbb.exec:\bthtbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnhhth.exec:\nnhhth.exe17⤵
- Executes dropped EXE
-
\??\c:\3vjdp.exec:\3vjdp.exe18⤵
- Executes dropped EXE
-
\??\c:\llfxlrl.exec:\llfxlrl.exe19⤵
- Executes dropped EXE
-
\??\c:\lfrrffl.exec:\lfrrffl.exe20⤵
- Executes dropped EXE
-
\??\c:\hhbbnn.exec:\hhbbnn.exe21⤵
- Executes dropped EXE
-
\??\c:\5vpjp.exec:\5vpjp.exe22⤵
- Executes dropped EXE
-
\??\c:\7frlffl.exec:\7frlffl.exe23⤵
- Executes dropped EXE
-
\??\c:\fxlrxxr.exec:\fxlrxxr.exe24⤵
- Executes dropped EXE
-
\??\c:\nhhtbh.exec:\nhhtbh.exe25⤵
- Executes dropped EXE
-
\??\c:\nnbnbh.exec:\nnbnbh.exe26⤵
- Executes dropped EXE
-
\??\c:\3ppjp.exec:\3ppjp.exe27⤵
- Executes dropped EXE
-
\??\c:\pjvvv.exec:\pjvvv.exe28⤵
- Executes dropped EXE
-
\??\c:\frflrrx.exec:\frflrrx.exe29⤵
- Executes dropped EXE
-
\??\c:\hbtbnt.exec:\hbtbnt.exe30⤵
- Executes dropped EXE
-
\??\c:\nbtbhh.exec:\nbtbhh.exe31⤵
- Executes dropped EXE
-
\??\c:\3jvdj.exec:\3jvdj.exe32⤵
- Executes dropped EXE
-
\??\c:\jjpjp.exec:\jjpjp.exe33⤵
- Executes dropped EXE
-
\??\c:\lfxfllx.exec:\lfxfllx.exe34⤵
- Executes dropped EXE
-
\??\c:\nnhhtb.exec:\nnhhtb.exe35⤵
- Executes dropped EXE
-
\??\c:\bbtbnn.exec:\bbtbnn.exe36⤵
- Executes dropped EXE
-
\??\c:\ppdjp.exec:\ppdjp.exe37⤵
- Executes dropped EXE
-
\??\c:\3pdjp.exec:\3pdjp.exe38⤵
- Executes dropped EXE
-
\??\c:\xlxxffr.exec:\xlxxffr.exe39⤵
- Executes dropped EXE
-
\??\c:\xlxflff.exec:\xlxflff.exe40⤵
- Executes dropped EXE
-
\??\c:\tnhhbt.exec:\tnhhbt.exe41⤵
- Executes dropped EXE
-
\??\c:\7httnh.exec:\7httnh.exe42⤵
- Executes dropped EXE
-
\??\c:\jvddp.exec:\jvddp.exe43⤵
- Executes dropped EXE
-
\??\c:\xrrlrll.exec:\xrrlrll.exe44⤵
- Executes dropped EXE
-
\??\c:\xxlrxxl.exec:\xxlrxxl.exe45⤵
- Executes dropped EXE
-
\??\c:\5btbtb.exec:\5btbtb.exe46⤵
- Executes dropped EXE
-
\??\c:\3bnbbb.exec:\3bnbbb.exe47⤵
- Executes dropped EXE
-
\??\c:\jdpvj.exec:\jdpvj.exe48⤵
- Executes dropped EXE
-
\??\c:\3ddvj.exec:\3ddvj.exe49⤵
- Executes dropped EXE
-
\??\c:\lfxffll.exec:\lfxffll.exe50⤵
- Executes dropped EXE
-
\??\c:\5fxlxfl.exec:\5fxlxfl.exe51⤵
- Executes dropped EXE
-
\??\c:\tnhtbb.exec:\tnhtbb.exe52⤵
- Executes dropped EXE
-
\??\c:\tntthh.exec:\tntthh.exe53⤵
- Executes dropped EXE
-
\??\c:\3pjpd.exec:\3pjpd.exe54⤵
- Executes dropped EXE
-
\??\c:\dvjpp.exec:\dvjpp.exe55⤵
- Executes dropped EXE
-
\??\c:\xlxxffl.exec:\xlxxffl.exe56⤵
- Executes dropped EXE
-
\??\c:\rlrxlff.exec:\rlrxlff.exe57⤵
- Executes dropped EXE
-
\??\c:\fxxfrxl.exec:\fxxfrxl.exe58⤵
- Executes dropped EXE
-
\??\c:\1thhhn.exec:\1thhhn.exe59⤵
- Executes dropped EXE
-
\??\c:\dvpvj.exec:\dvpvj.exe60⤵
- Executes dropped EXE
-
\??\c:\pddpd.exec:\pddpd.exe61⤵
- Executes dropped EXE
-
\??\c:\pdvvj.exec:\pdvvj.exe62⤵
- Executes dropped EXE
-
\??\c:\lfllrxl.exec:\lfllrxl.exe63⤵
- Executes dropped EXE
-
\??\c:\lxrfrfx.exec:\lxrfrfx.exe64⤵
- Executes dropped EXE
-
\??\c:\nhnthn.exec:\nhnthn.exe65⤵
- Executes dropped EXE
-
\??\c:\5btntt.exec:\5btntt.exe66⤵
-
\??\c:\ppjpd.exec:\ppjpd.exe67⤵
-
\??\c:\vvdjp.exec:\vvdjp.exe68⤵
-
\??\c:\fxflrfl.exec:\fxflrfl.exe69⤵
-
\??\c:\llxlrxf.exec:\llxlrxf.exe70⤵
-
\??\c:\nhthtt.exec:\nhthtt.exe71⤵
-
\??\c:\5hbtth.exec:\5hbtth.exe72⤵
-
\??\c:\5ppjv.exec:\5ppjv.exe73⤵
-
\??\c:\5ppjp.exec:\5ppjp.exe74⤵
-
\??\c:\xrffllx.exec:\xrffllx.exe75⤵
-
\??\c:\7ffrxxl.exec:\7ffrxxl.exe76⤵
-
\??\c:\btbhhh.exec:\btbhhh.exe77⤵
-
\??\c:\7pjvj.exec:\7pjvj.exe78⤵
-
\??\c:\7jvdv.exec:\7jvdv.exe79⤵
-
\??\c:\9fflrxf.exec:\9fflrxf.exe80⤵
-
\??\c:\flffrrx.exec:\flffrrx.exe81⤵
-
\??\c:\nnttnb.exec:\nnttnb.exe82⤵
-
\??\c:\5bntbh.exec:\5bntbh.exe83⤵
-
\??\c:\jvjpj.exec:\jvjpj.exe84⤵
-
\??\c:\7jddd.exec:\7jddd.exe85⤵
-
\??\c:\lfrrllx.exec:\lfrrllx.exe86⤵
-
\??\c:\lxrrffr.exec:\lxrrffr.exe87⤵
-
\??\c:\hbhhtt.exec:\hbhhtt.exe88⤵
-
\??\c:\1hnntt.exec:\1hnntt.exe89⤵
-
\??\c:\dddpp.exec:\dddpp.exe90⤵
-
\??\c:\vpjjv.exec:\vpjjv.exe91⤵
-
\??\c:\3rflrrr.exec:\3rflrrr.exe92⤵
-
\??\c:\7rrrxrr.exec:\7rrrxrr.exe93⤵
-
\??\c:\hthtth.exec:\hthtth.exe94⤵
-
\??\c:\dvjjv.exec:\dvjjv.exe95⤵
-
\??\c:\vpvvd.exec:\vpvvd.exe96⤵
-
\??\c:\llrrxrx.exec:\llrrxrx.exe97⤵
-
\??\c:\3lflxrr.exec:\3lflxrr.exe98⤵
-
\??\c:\hhnthh.exec:\hhnthh.exe99⤵
-
\??\c:\hbbhtt.exec:\hbbhtt.exe100⤵
-
\??\c:\jvjvv.exec:\jvjvv.exe101⤵
-
\??\c:\dvdvv.exec:\dvdvv.exe102⤵
-
\??\c:\xlrrxxf.exec:\xlrrxxf.exe103⤵
-
\??\c:\xrffrxr.exec:\xrffrxr.exe104⤵
-
\??\c:\nhhhtt.exec:\nhhhtt.exe105⤵
-
\??\c:\5tttnb.exec:\5tttnb.exe106⤵
-
\??\c:\vvjpp.exec:\vvjpp.exe107⤵
-
\??\c:\9vjvj.exec:\9vjvj.exe108⤵
-
\??\c:\rlxrfxl.exec:\rlxrfxl.exe109⤵
-
\??\c:\rlfxxrr.exec:\rlfxxrr.exe110⤵
-
\??\c:\thnnnn.exec:\thnnnn.exe111⤵
-
\??\c:\hhbttt.exec:\hhbttt.exe112⤵
-
\??\c:\pvjpv.exec:\pvjpv.exe113⤵
-
\??\c:\jdvvd.exec:\jdvvd.exe114⤵
-
\??\c:\lfxxffr.exec:\lfxxffr.exe115⤵
-
\??\c:\fxllxfl.exec:\fxllxfl.exe116⤵
-
\??\c:\3xrxfrr.exec:\3xrxfrr.exe117⤵
-
\??\c:\bbnbhn.exec:\bbnbhn.exe118⤵
-
\??\c:\bnbbhh.exec:\bnbbhh.exe119⤵
-
\??\c:\vpjpv.exec:\vpjpv.exe120⤵
-
\??\c:\pjpvv.exec:\pjpvv.exe121⤵
-
\??\c:\lxllrrx.exec:\lxllrrx.exe122⤵
-
\??\c:\rlrrrrf.exec:\rlrrrrf.exe123⤵
-
\??\c:\btttbb.exec:\btttbb.exe124⤵
-
\??\c:\tnbhnn.exec:\tnbhnn.exe125⤵
-
\??\c:\jjdjj.exec:\jjdjj.exe126⤵
-
\??\c:\3vjjv.exec:\3vjjv.exe127⤵
-
\??\c:\rlxxfrf.exec:\rlxxfrf.exe128⤵
-
\??\c:\rflrlll.exec:\rflrlll.exe129⤵
-
\??\c:\hhbbtt.exec:\hhbbtt.exe130⤵
-
\??\c:\hbhhnn.exec:\hbhhnn.exe131⤵
-
\??\c:\vpjpv.exec:\vpjpv.exe132⤵
-
\??\c:\5lxfrrx.exec:\5lxfrrx.exe133⤵
-
\??\c:\3lflxxl.exec:\3lflxxl.exe134⤵
-
\??\c:\xlxxffr.exec:\xlxxffr.exe135⤵
-
\??\c:\hbhnhb.exec:\hbhnhb.exe136⤵
-
\??\c:\9tnnbh.exec:\9tnnbh.exe137⤵
-
\??\c:\1pddp.exec:\1pddp.exe138⤵
-
\??\c:\ppjdp.exec:\ppjdp.exe139⤵
-
\??\c:\fxflrrf.exec:\fxflrrf.exe140⤵
-
\??\c:\lxrrrrl.exec:\lxrrrrl.exe141⤵
-
\??\c:\hthhnt.exec:\hthhnt.exe142⤵
-
\??\c:\1tnnnn.exec:\1tnnnn.exe143⤵
-
\??\c:\vpddp.exec:\vpddp.exe144⤵
-
\??\c:\7dppp.exec:\7dppp.exe145⤵
-
\??\c:\lflfllr.exec:\lflfllr.exe146⤵
-
\??\c:\lfrrfff.exec:\lfrrfff.exe147⤵
-
\??\c:\htbthb.exec:\htbthb.exe148⤵
-
\??\c:\bbntbh.exec:\bbntbh.exe149⤵
-
\??\c:\dvpdp.exec:\dvpdp.exe150⤵
-
\??\c:\3vdjp.exec:\3vdjp.exe151⤵
-
\??\c:\xfrlxrx.exec:\xfrlxrx.exe152⤵
-
\??\c:\llfrrfr.exec:\llfrrfr.exe153⤵
-
\??\c:\1bbbhh.exec:\1bbbhh.exe154⤵
-
\??\c:\9bnthn.exec:\9bnthn.exe155⤵
-
\??\c:\jvddj.exec:\jvddj.exe156⤵
-
\??\c:\7ddjj.exec:\7ddjj.exe157⤵
-
\??\c:\vjvvj.exec:\vjvvj.exe158⤵
-
\??\c:\xfxflfr.exec:\xfxflfr.exe159⤵
-
\??\c:\1lffrrf.exec:\1lffrrf.exe160⤵
-
\??\c:\nhttbh.exec:\nhttbh.exe161⤵
-
\??\c:\btntbh.exec:\btntbh.exe162⤵
-
\??\c:\7vpvd.exec:\7vpvd.exe163⤵
-
\??\c:\pjddp.exec:\pjddp.exe164⤵
-
\??\c:\vdjpj.exec:\vdjpj.exe165⤵
-
\??\c:\5llrxxf.exec:\5llrxxf.exe166⤵
-
\??\c:\5xrxxfr.exec:\5xrxxfr.exe167⤵
-
\??\c:\1bbthh.exec:\1bbthh.exe168⤵
-
\??\c:\nbnhtt.exec:\nbnhtt.exe169⤵
-
\??\c:\3jpdj.exec:\3jpdj.exe170⤵
-
\??\c:\3ddvd.exec:\3ddvd.exe171⤵
-
\??\c:\llffxfl.exec:\llffxfl.exe172⤵
-
\??\c:\lxffffl.exec:\lxffffl.exe173⤵
-
\??\c:\lflrxxl.exec:\lflrxxl.exe174⤵
-
\??\c:\nhntbh.exec:\nhntbh.exe175⤵
-
\??\c:\hbttnn.exec:\hbttnn.exe176⤵
-
\??\c:\jvpdd.exec:\jvpdd.exe177⤵
-
\??\c:\ddjdp.exec:\ddjdp.exe178⤵
-
\??\c:\lflflll.exec:\lflflll.exe179⤵
-
\??\c:\xrffllx.exec:\xrffllx.exe180⤵
-
\??\c:\7tbtbh.exec:\7tbtbh.exe181⤵
-
\??\c:\bthbbh.exec:\bthbbh.exe182⤵
-
\??\c:\tnbbbh.exec:\tnbbbh.exe183⤵
-
\??\c:\3vjvd.exec:\3vjvd.exe184⤵
-
\??\c:\jdpjp.exec:\jdpjp.exe185⤵
-
\??\c:\lxffllr.exec:\lxffllr.exe186⤵
-
\??\c:\lxffllr.exec:\lxffllr.exe187⤵
-
\??\c:\7nbhnt.exec:\7nbhnt.exe188⤵
-
\??\c:\hbnbhh.exec:\hbnbhh.exe189⤵
-
\??\c:\htbhnt.exec:\htbhnt.exe190⤵
-
\??\c:\vpdjv.exec:\vpdjv.exe191⤵
-
\??\c:\jdjdj.exec:\jdjdj.exe192⤵
-
\??\c:\1rfllrf.exec:\1rfllrf.exe193⤵
-
\??\c:\frflrrr.exec:\frflrrr.exe194⤵
-
\??\c:\nthnhn.exec:\nthnhn.exe195⤵
-
\??\c:\hhtntb.exec:\hhtntb.exe196⤵
-
\??\c:\1ppvj.exec:\1ppvj.exe197⤵
-
\??\c:\jjvpp.exec:\jjvpp.exe198⤵
-
\??\c:\lfrrxxl.exec:\lfrrxxl.exe199⤵
-
\??\c:\9fffrlx.exec:\9fffrlx.exe200⤵
-
\??\c:\lflrlrl.exec:\lflrlrl.exe201⤵
-
\??\c:\7hbbnt.exec:\7hbbnt.exe202⤵
-
\??\c:\hbbhht.exec:\hbbhht.exe203⤵
-
\??\c:\vjvpv.exec:\vjvpv.exe204⤵
-
\??\c:\pjdjj.exec:\pjdjj.exe205⤵
-
\??\c:\llflxxf.exec:\llflxxf.exe206⤵
-
\??\c:\nbhhtt.exec:\nbhhtt.exe207⤵
-
\??\c:\hbbnbb.exec:\hbbnbb.exe208⤵
-
\??\c:\dpvvv.exec:\dpvvv.exe209⤵
-
\??\c:\xrrxllx.exec:\xrrxllx.exe210⤵
-
\??\c:\7nbttt.exec:\7nbttt.exe211⤵
-
\??\c:\thbnbb.exec:\thbnbb.exe212⤵
-
\??\c:\7dvjv.exec:\7dvjv.exe213⤵
-
\??\c:\jdvdj.exec:\jdvdj.exe214⤵
-
\??\c:\1lxflrx.exec:\1lxflrx.exe215⤵
-
\??\c:\rfrrllx.exec:\rfrrllx.exe216⤵
-
\??\c:\hbhhnt.exec:\hbhhnt.exe217⤵
-
\??\c:\ppddj.exec:\ppddj.exe218⤵
-
\??\c:\rlrrflr.exec:\rlrrflr.exe219⤵
-
\??\c:\nnntth.exec:\nnntth.exe220⤵
-
\??\c:\nhntbt.exec:\nhntbt.exe221⤵
-
\??\c:\dvddj.exec:\dvddj.exe222⤵
-
\??\c:\jvpvj.exec:\jvpvj.exe223⤵
-
\??\c:\rfrllrx.exec:\rfrllrx.exe224⤵
-
\??\c:\1flrxrf.exec:\1flrxrf.exe225⤵
-
\??\c:\hhnbtt.exec:\hhnbtt.exe226⤵
-
\??\c:\hbntbt.exec:\hbntbt.exe227⤵
-
\??\c:\ppjdp.exec:\ppjdp.exe228⤵
-
\??\c:\dvjpd.exec:\dvjpd.exe229⤵
-
\??\c:\rlffrrx.exec:\rlffrrx.exe230⤵
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe231⤵
-
\??\c:\lfflrxf.exec:\lfflrxf.exe232⤵
-
\??\c:\bntttt.exec:\bntttt.exe233⤵
-
\??\c:\nbnntn.exec:\nbnntn.exe234⤵
-
\??\c:\dvdpd.exec:\dvdpd.exe235⤵
-
\??\c:\vpddd.exec:\vpddd.exe236⤵
-
\??\c:\fxrxffl.exec:\fxrxffl.exe237⤵
-
\??\c:\xffxfrl.exec:\xffxfrl.exe238⤵
-
\??\c:\9llllxf.exec:\9llllxf.exe239⤵
-
\??\c:\nntbhn.exec:\nntbhn.exe240⤵
-
\??\c:\bthbbb.exec:\bthbbb.exe241⤵