Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 19:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
334a0d91274e5f9970460c5c7da9c4802d388610e1d14ec685d475d586ed66fe.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
-
Target
334a0d91274e5f9970460c5c7da9c4802d388610e1d14ec685d475d586ed66fe.exe
-
Size
54KB
-
MD5
149492700fbf4e3143a21e08136b0050
-
SHA1
58fb980f99257a95a934688796049b2b10a4650f
-
SHA256
334a0d91274e5f9970460c5c7da9c4802d388610e1d14ec685d475d586ed66fe
-
SHA512
d97a07f808358b0b985f8b6b284ebdaece16002724808af379d7434709faf4f8ff870e88b10da7614a8f710aae70e004864d61dd57152aa16b147d3c8aba4705
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFM:ymb3NkkiQ3mdBjFIFM
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral2/memory/3128-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1460-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3160-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3360-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/916-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3920-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3692-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3716-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4984-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3828-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5000-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4464-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/732-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4960-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3704-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5032-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1804-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4220-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2488-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3720-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rrrfxrl.exebtnbtn.exehhbbbn.exejdvpd.exerrlxllx.exe3bbbtt.exe1tnthb.exedvvjj.exefffrfxr.exejvvdd.exedppdp.exeffrxflx.exetbhbnh.exenbhnbh.exepdpjd.exelfrrlfr.exexlrlffx.exe5hnhbh.exevpppd.exejvdvj.exeffrrrrf.exe3bbnhh.exebbbbnn.exe1ddvp.exerfllxxx.exebbtttt.exenhnbhn.exepjjvd.exefffxrrr.exe9rlfllf.exetnnhhh.exe3htnnn.exejpvjd.exevdpjv.exefrrlrlf.exefxxxllf.exehbbbtt.exejvdvp.exejvpjd.exerxfxrxr.exerlxllll.exe7hnnbb.exehhbbtn.exepjppd.exe9lrrfll.exexlrrrrl.exenhbbtt.exebthbtt.exejddvj.exepjjvj.exefrxrllx.exelxffxxx.exelfffxxr.exebtbbtt.exethnntb.exe3vppd.exepdjdp.exerlrlxxr.exefrrlfff.exetnnnhh.exedpdvv.exe7jjdp.exellxrxxf.exe7bbttt.exepid process 1460 rrrfxrl.exe 3360 btnbtn.exe 3160 hhbbbn.exe 916 jdvpd.exe 3920 rrlxllx.exe 3692 3bbbtt.exe 4020 1tnthb.exe 1776 dvvjj.exe 3716 fffrfxr.exe 4984 jvvdd.exe 4796 dppdp.exe 4844 ffrxflx.exe 3828 tbhbnh.exe 5064 nbhnbh.exe 5000 pdpjd.exe 4536 lfrrlfr.exe 1548 xlrlffx.exe 4464 5hnhbh.exe 732 vpppd.exe 4960 jvdvj.exe 3704 ffrrrrf.exe 5032 3bbnhh.exe 1804 bbbbnn.exe 4220 1ddvp.exe 2488 rfllxxx.exe 3720 bbtttt.exe 832 nhnbhn.exe 2216 pjjvd.exe 3636 fffxrrr.exe 1448 9rlfllf.exe 2712 tnnhhh.exe 2424 3htnnn.exe 228 jpvjd.exe 3540 vdpjv.exe 1560 frrlrlf.exe 948 fxxxllf.exe 4444 hbbbtt.exe 3432 jvdvp.exe 3728 jvpjd.exe 3344 rxfxrxr.exe 3160 rlxllll.exe 3792 7hnnbb.exe 956 hhbbtn.exe 2996 pjppd.exe 3700 9lrrfll.exe 3680 xlrrrrl.exe 1304 nhbbtt.exe 4328 bthbtt.exe 1932 jddvj.exe 2020 pjjvj.exe 3760 frxrllx.exe 4804 lxffxxx.exe 2976 lfffxxr.exe 4596 btbbtt.exe 3572 thnntb.exe 5020 3vppd.exe 1644 pdjdp.exe 1112 rlrlxxr.exe 4292 frrlfff.exe 4536 tnnnhh.exe 3744 dpdvv.exe 1480 7jjdp.exe 4240 llxrxxf.exe 4580 7bbttt.exe -
Processes:
resource yara_rule behavioral2/memory/3128-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1460-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3360-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/916-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3692-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1776-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1776-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1776-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3716-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3716-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3716-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4984-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3828-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/732-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4960-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3704-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5032-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1804-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4220-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2488-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3720-177-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
334a0d91274e5f9970460c5c7da9c4802d388610e1d14ec685d475d586ed66fe.exerrrfxrl.exebtnbtn.exehhbbbn.exejdvpd.exerrlxllx.exe3bbbtt.exe1tnthb.exedvvjj.exefffrfxr.exejvvdd.exedppdp.exeffrxflx.exetbhbnh.exenbhnbh.exepdpjd.exelfrrlfr.exexlrlffx.exe5hnhbh.exevpppd.exejvdvj.exeffrrrrf.exedescription pid process target process PID 3128 wrote to memory of 1460 3128 334a0d91274e5f9970460c5c7da9c4802d388610e1d14ec685d475d586ed66fe.exe rrrfxrl.exe PID 3128 wrote to memory of 1460 3128 334a0d91274e5f9970460c5c7da9c4802d388610e1d14ec685d475d586ed66fe.exe rrrfxrl.exe PID 3128 wrote to memory of 1460 3128 334a0d91274e5f9970460c5c7da9c4802d388610e1d14ec685d475d586ed66fe.exe rrrfxrl.exe PID 1460 wrote to memory of 3360 1460 rrrfxrl.exe btnbtn.exe PID 1460 wrote to memory of 3360 1460 rrrfxrl.exe btnbtn.exe PID 1460 wrote to memory of 3360 1460 rrrfxrl.exe btnbtn.exe PID 3360 wrote to memory of 3160 3360 btnbtn.exe hhbbbn.exe PID 3360 wrote to memory of 3160 3360 btnbtn.exe hhbbbn.exe PID 3360 wrote to memory of 3160 3360 btnbtn.exe hhbbbn.exe PID 3160 wrote to memory of 916 3160 hhbbbn.exe jdvpd.exe PID 3160 wrote to memory of 916 3160 hhbbbn.exe jdvpd.exe PID 3160 wrote to memory of 916 3160 hhbbbn.exe jdvpd.exe PID 916 wrote to memory of 3920 916 jdvpd.exe rrlxllx.exe PID 916 wrote to memory of 3920 916 jdvpd.exe rrlxllx.exe PID 916 wrote to memory of 3920 916 jdvpd.exe rrlxllx.exe PID 3920 wrote to memory of 3692 3920 rrlxllx.exe 3bbbtt.exe PID 3920 wrote to memory of 3692 3920 rrlxllx.exe 3bbbtt.exe PID 3920 wrote to memory of 3692 3920 rrlxllx.exe 3bbbtt.exe PID 3692 wrote to memory of 4020 3692 3bbbtt.exe 1tnthb.exe PID 3692 wrote to memory of 4020 3692 3bbbtt.exe 1tnthb.exe PID 3692 wrote to memory of 4020 3692 3bbbtt.exe 1tnthb.exe PID 4020 wrote to memory of 1776 4020 1tnthb.exe dvvjj.exe PID 4020 wrote to memory of 1776 4020 1tnthb.exe dvvjj.exe PID 4020 wrote to memory of 1776 4020 1tnthb.exe dvvjj.exe PID 1776 wrote to memory of 3716 1776 dvvjj.exe fffrfxr.exe PID 1776 wrote to memory of 3716 1776 dvvjj.exe fffrfxr.exe PID 1776 wrote to memory of 3716 1776 dvvjj.exe fffrfxr.exe PID 3716 wrote to memory of 4984 3716 fffrfxr.exe jvvdd.exe PID 3716 wrote to memory of 4984 3716 fffrfxr.exe jvvdd.exe PID 3716 wrote to memory of 4984 3716 fffrfxr.exe jvvdd.exe PID 4984 wrote to memory of 4796 4984 jvvdd.exe dppdp.exe PID 4984 wrote to memory of 4796 4984 jvvdd.exe dppdp.exe PID 4984 wrote to memory of 4796 4984 jvvdd.exe dppdp.exe PID 4796 wrote to memory of 4844 4796 dppdp.exe ffrxflx.exe PID 4796 wrote to memory of 4844 4796 dppdp.exe ffrxflx.exe PID 4796 wrote to memory of 4844 4796 dppdp.exe ffrxflx.exe PID 4844 wrote to memory of 3828 4844 ffrxflx.exe tbhbnh.exe PID 4844 wrote to memory of 3828 4844 ffrxflx.exe tbhbnh.exe PID 4844 wrote to memory of 3828 4844 ffrxflx.exe tbhbnh.exe PID 3828 wrote to memory of 5064 3828 tbhbnh.exe nbhnbh.exe PID 3828 wrote to memory of 5064 3828 tbhbnh.exe nbhnbh.exe PID 3828 wrote to memory of 5064 3828 tbhbnh.exe nbhnbh.exe PID 5064 wrote to memory of 5000 5064 nbhnbh.exe pdpjd.exe PID 5064 wrote to memory of 5000 5064 nbhnbh.exe pdpjd.exe PID 5064 wrote to memory of 5000 5064 nbhnbh.exe pdpjd.exe PID 5000 wrote to memory of 4536 5000 pdpjd.exe lfrrlfr.exe PID 5000 wrote to memory of 4536 5000 pdpjd.exe lfrrlfr.exe PID 5000 wrote to memory of 4536 5000 pdpjd.exe lfrrlfr.exe PID 4536 wrote to memory of 1548 4536 lfrrlfr.exe xlrlffx.exe PID 4536 wrote to memory of 1548 4536 lfrrlfr.exe xlrlffx.exe PID 4536 wrote to memory of 1548 4536 lfrrlfr.exe xlrlffx.exe PID 1548 wrote to memory of 4464 1548 xlrlffx.exe 5hnhbh.exe PID 1548 wrote to memory of 4464 1548 xlrlffx.exe 5hnhbh.exe PID 1548 wrote to memory of 4464 1548 xlrlffx.exe 5hnhbh.exe PID 4464 wrote to memory of 732 4464 5hnhbh.exe vpppd.exe PID 4464 wrote to memory of 732 4464 5hnhbh.exe vpppd.exe PID 4464 wrote to memory of 732 4464 5hnhbh.exe vpppd.exe PID 732 wrote to memory of 4960 732 vpppd.exe jvdvj.exe PID 732 wrote to memory of 4960 732 vpppd.exe jvdvj.exe PID 732 wrote to memory of 4960 732 vpppd.exe jvdvj.exe PID 4960 wrote to memory of 3704 4960 jvdvj.exe ffrrrrf.exe PID 4960 wrote to memory of 3704 4960 jvdvj.exe ffrrrrf.exe PID 4960 wrote to memory of 3704 4960 jvdvj.exe ffrrrrf.exe PID 3704 wrote to memory of 5032 3704 ffrrrrf.exe 3bbnhh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\334a0d91274e5f9970460c5c7da9c4802d388610e1d14ec685d475d586ed66fe.exe"C:\Users\Admin\AppData\Local\Temp\334a0d91274e5f9970460c5c7da9c4802d388610e1d14ec685d475d586ed66fe.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\rrrfxrl.exec:\rrrfxrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btnbtn.exec:\btnbtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhbbbn.exec:\hhbbbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdvpd.exec:\jdvpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrlxllx.exec:\rrlxllx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3bbbtt.exec:\3bbbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1tnthb.exec:\1tnthb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvvjj.exec:\dvvjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fffrfxr.exec:\fffrfxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvvdd.exec:\jvvdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dppdp.exec:\dppdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffrxflx.exec:\ffrxflx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tbhbnh.exec:\tbhbnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbhnbh.exec:\nbhnbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdpjd.exec:\pdpjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfrrlfr.exec:\lfrrlfr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xlrlffx.exec:\xlrlffx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5hnhbh.exec:\5hnhbh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpppd.exec:\vpppd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvdvj.exec:\jvdvj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffrrrrf.exec:\ffrrrrf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3bbnhh.exec:\3bbnhh.exe23⤵
- Executes dropped EXE
-
\??\c:\bbbbnn.exec:\bbbbnn.exe24⤵
- Executes dropped EXE
-
\??\c:\1ddvp.exec:\1ddvp.exe25⤵
- Executes dropped EXE
-
\??\c:\rfllxxx.exec:\rfllxxx.exe26⤵
- Executes dropped EXE
-
\??\c:\bbtttt.exec:\bbtttt.exe27⤵
- Executes dropped EXE
-
\??\c:\nhnbhn.exec:\nhnbhn.exe28⤵
- Executes dropped EXE
-
\??\c:\pjjvd.exec:\pjjvd.exe29⤵
- Executes dropped EXE
-
\??\c:\fffxrrr.exec:\fffxrrr.exe30⤵
- Executes dropped EXE
-
\??\c:\9rlfllf.exec:\9rlfllf.exe31⤵
- Executes dropped EXE
-
\??\c:\tnnhhh.exec:\tnnhhh.exe32⤵
- Executes dropped EXE
-
\??\c:\3htnnn.exec:\3htnnn.exe33⤵
- Executes dropped EXE
-
\??\c:\jpvjd.exec:\jpvjd.exe34⤵
- Executes dropped EXE
-
\??\c:\vdpjv.exec:\vdpjv.exe35⤵
- Executes dropped EXE
-
\??\c:\frrlrlf.exec:\frrlrlf.exe36⤵
- Executes dropped EXE
-
\??\c:\fxxxllf.exec:\fxxxllf.exe37⤵
- Executes dropped EXE
-
\??\c:\hbbbtt.exec:\hbbbtt.exe38⤵
- Executes dropped EXE
-
\??\c:\jvdvp.exec:\jvdvp.exe39⤵
- Executes dropped EXE
-
\??\c:\jvpjd.exec:\jvpjd.exe40⤵
- Executes dropped EXE
-
\??\c:\rxfxrxr.exec:\rxfxrxr.exe41⤵
- Executes dropped EXE
-
\??\c:\rlxllll.exec:\rlxllll.exe42⤵
- Executes dropped EXE
-
\??\c:\7hnnbb.exec:\7hnnbb.exe43⤵
- Executes dropped EXE
-
\??\c:\hhbbtn.exec:\hhbbtn.exe44⤵
- Executes dropped EXE
-
\??\c:\pjppd.exec:\pjppd.exe45⤵
- Executes dropped EXE
-
\??\c:\9lrrfll.exec:\9lrrfll.exe46⤵
- Executes dropped EXE
-
\??\c:\xlrrrrl.exec:\xlrrrrl.exe47⤵
- Executes dropped EXE
-
\??\c:\nhbbtt.exec:\nhbbtt.exe48⤵
- Executes dropped EXE
-
\??\c:\bthbtt.exec:\bthbtt.exe49⤵
- Executes dropped EXE
-
\??\c:\jddvj.exec:\jddvj.exe50⤵
- Executes dropped EXE
-
\??\c:\pjjvj.exec:\pjjvj.exe51⤵
- Executes dropped EXE
-
\??\c:\frxrllx.exec:\frxrllx.exe52⤵
- Executes dropped EXE
-
\??\c:\lxffxxx.exec:\lxffxxx.exe53⤵
- Executes dropped EXE
-
\??\c:\lfffxxr.exec:\lfffxxr.exe54⤵
- Executes dropped EXE
-
\??\c:\btbbtt.exec:\btbbtt.exe55⤵
- Executes dropped EXE
-
\??\c:\thnntb.exec:\thnntb.exe56⤵
- Executes dropped EXE
-
\??\c:\3vppd.exec:\3vppd.exe57⤵
- Executes dropped EXE
-
\??\c:\pdjdp.exec:\pdjdp.exe58⤵
- Executes dropped EXE
-
\??\c:\rlrlxxr.exec:\rlrlxxr.exe59⤵
- Executes dropped EXE
-
\??\c:\frrlfff.exec:\frrlfff.exe60⤵
- Executes dropped EXE
-
\??\c:\tnnnhh.exec:\tnnnhh.exe61⤵
- Executes dropped EXE
-
\??\c:\dpdvv.exec:\dpdvv.exe62⤵
- Executes dropped EXE
-
\??\c:\7jjdp.exec:\7jjdp.exe63⤵
- Executes dropped EXE
-
\??\c:\llxrxxf.exec:\llxrxxf.exe64⤵
- Executes dropped EXE
-
\??\c:\7bbttt.exec:\7bbttt.exe65⤵
- Executes dropped EXE
-
\??\c:\ttthnt.exec:\ttthnt.exe66⤵
-
\??\c:\jppjd.exec:\jppjd.exe67⤵
-
\??\c:\djpjd.exec:\djpjd.exe68⤵
-
\??\c:\rffxrrl.exec:\rffxrrl.exe69⤵
-
\??\c:\lxffxrr.exec:\lxffxrr.exe70⤵
-
\??\c:\tnbhhn.exec:\tnbhhn.exe71⤵
-
\??\c:\bntnbb.exec:\bntnbb.exe72⤵
-
\??\c:\btnhhh.exec:\btnhhh.exe73⤵
-
\??\c:\pddvp.exec:\pddvp.exe74⤵
-
\??\c:\ddvvp.exec:\ddvvp.exe75⤵
-
\??\c:\flrlxxx.exec:\flrlxxx.exe76⤵
-
\??\c:\frxrxxr.exec:\frxrxxr.exe77⤵
-
\??\c:\nbbbbb.exec:\nbbbbb.exe78⤵
-
\??\c:\thhtbt.exec:\thhtbt.exe79⤵
-
\??\c:\hnbtnt.exec:\hnbtnt.exe80⤵
-
\??\c:\dvdvj.exec:\dvdvj.exe81⤵
-
\??\c:\jddvp.exec:\jddvp.exe82⤵
-
\??\c:\rfxrrrr.exec:\rfxrrrr.exe83⤵
-
\??\c:\rxrflrx.exec:\rxrflrx.exe84⤵
-
\??\c:\3hbbtt.exec:\3hbbtt.exe85⤵
-
\??\c:\tbbtnn.exec:\tbbtnn.exe86⤵
-
\??\c:\dppvv.exec:\dppvv.exe87⤵
-
\??\c:\jddvj.exec:\jddvj.exe88⤵
-
\??\c:\3frrfll.exec:\3frrfll.exe89⤵
-
\??\c:\ffrrrrx.exec:\ffrrrrx.exe90⤵
-
\??\c:\btbtbt.exec:\btbtbt.exe91⤵
-
\??\c:\nhhbtt.exec:\nhhbtt.exe92⤵
-
\??\c:\3dddp.exec:\3dddp.exe93⤵
-
\??\c:\7jjjv.exec:\7jjjv.exe94⤵
-
\??\c:\fxxrrrx.exec:\fxxrrrx.exe95⤵
-
\??\c:\xlxrrrf.exec:\xlxrrrf.exe96⤵
-
\??\c:\llrrxxf.exec:\llrrxxf.exe97⤵
-
\??\c:\nhnnhh.exec:\nhnnhh.exe98⤵
-
\??\c:\djjdv.exec:\djjdv.exe99⤵
-
\??\c:\vpvvp.exec:\vpvvp.exe100⤵
-
\??\c:\frrlllf.exec:\frrlllf.exe101⤵
-
\??\c:\fllrrrx.exec:\fllrrrx.exe102⤵
-
\??\c:\7llfffx.exec:\7llfffx.exe103⤵
-
\??\c:\thhhhh.exec:\thhhhh.exe104⤵
-
\??\c:\thhbtt.exec:\thhbtt.exe105⤵
-
\??\c:\vvvjv.exec:\vvvjv.exe106⤵
-
\??\c:\vppjp.exec:\vppjp.exe107⤵
-
\??\c:\ffrrllf.exec:\ffrrllf.exe108⤵
-
\??\c:\rrlffff.exec:\rrlffff.exe109⤵
-
\??\c:\5thhbn.exec:\5thhbn.exe110⤵
-
\??\c:\hhhbtt.exec:\hhhbtt.exe111⤵
-
\??\c:\dvdjd.exec:\dvdjd.exe112⤵
-
\??\c:\jjpjv.exec:\jjpjv.exe113⤵
-
\??\c:\9rrlxxx.exec:\9rrlxxx.exe114⤵
-
\??\c:\rffxrrr.exec:\rffxrrr.exe115⤵
-
\??\c:\bntttt.exec:\bntttt.exe116⤵
-
\??\c:\hhhtth.exec:\hhhtth.exe117⤵
-
\??\c:\dppjd.exec:\dppjd.exe118⤵
-
\??\c:\9vdpj.exec:\9vdpj.exe119⤵
-
\??\c:\lffllxx.exec:\lffllxx.exe120⤵
-
\??\c:\nnhnhh.exec:\nnhnhh.exe121⤵
-
\??\c:\vdvpj.exec:\vdvpj.exe122⤵
-
\??\c:\pjjpp.exec:\pjjpp.exe123⤵
-
\??\c:\xxfxrxx.exec:\xxfxrxx.exe124⤵
-
\??\c:\5bttnn.exec:\5bttnn.exe125⤵
-
\??\c:\tnttbb.exec:\tnttbb.exe126⤵
-
\??\c:\htbthh.exec:\htbthh.exe127⤵
-
\??\c:\jdjjd.exec:\jdjjd.exe128⤵
-
\??\c:\jjjdp.exec:\jjjdp.exe129⤵
-
\??\c:\fllrrxr.exec:\fllrrxr.exe130⤵
-
\??\c:\htbttt.exec:\htbttt.exe131⤵
-
\??\c:\hbtnnn.exec:\hbtnnn.exe132⤵
-
\??\c:\vpppd.exec:\vpppd.exe133⤵
-
\??\c:\5ddjv.exec:\5ddjv.exe134⤵
-
\??\c:\9lflxlf.exec:\9lflxlf.exe135⤵
-
\??\c:\rlllffx.exec:\rlllffx.exe136⤵
-
\??\c:\fxfxxff.exec:\fxfxxff.exe137⤵
-
\??\c:\hbhbhh.exec:\hbhbhh.exe138⤵
-
\??\c:\vjjdd.exec:\vjjdd.exe139⤵
-
\??\c:\vdjdp.exec:\vdjdp.exe140⤵
-
\??\c:\rrrrlfx.exec:\rrrrlfx.exe141⤵
-
\??\c:\rfffxrx.exec:\rfffxrx.exe142⤵
-
\??\c:\btbtnn.exec:\btbtnn.exe143⤵
-
\??\c:\tnhbhh.exec:\tnhbhh.exe144⤵
-
\??\c:\jjvvp.exec:\jjvvp.exe145⤵
-
\??\c:\3jdvj.exec:\3jdvj.exe146⤵
-
\??\c:\lffxlll.exec:\lffxlll.exe147⤵
-
\??\c:\xflxrlr.exec:\xflxrlr.exe148⤵
-
\??\c:\nttnhn.exec:\nttnhn.exe149⤵
-
\??\c:\bhbhth.exec:\bhbhth.exe150⤵
-
\??\c:\pvdjd.exec:\pvdjd.exe151⤵
-
\??\c:\9llfxxr.exec:\9llfxxr.exe152⤵
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe153⤵
-
\??\c:\rlxxrrl.exec:\rlxxrrl.exe154⤵
-
\??\c:\dvvvp.exec:\dvvvp.exe155⤵
-
\??\c:\lxxrxlx.exec:\lxxrxlx.exe156⤵
-
\??\c:\nthhnn.exec:\nthhnn.exe157⤵
-
\??\c:\nhhnhb.exec:\nhhnhb.exe158⤵
-
\??\c:\hhttbb.exec:\hhttbb.exe159⤵
-
\??\c:\vjppd.exec:\vjppd.exe160⤵
-
\??\c:\pppjv.exec:\pppjv.exe161⤵
-
\??\c:\lrrlxxl.exec:\lrrlxxl.exe162⤵
-
\??\c:\tnbttt.exec:\tnbttt.exe163⤵
-
\??\c:\3hhnbb.exec:\3hhnbb.exe164⤵
-
\??\c:\hhttnn.exec:\hhttnn.exe165⤵
-
\??\c:\jvjjj.exec:\jvjjj.exe166⤵
-
\??\c:\dppjd.exec:\dppjd.exe167⤵
-
\??\c:\lxfrrfr.exec:\lxfrrfr.exe168⤵
-
\??\c:\frrllll.exec:\frrllll.exe169⤵
-
\??\c:\3ntnnn.exec:\3ntnnn.exe170⤵
-
\??\c:\hhbtnh.exec:\hhbtnh.exe171⤵
-
\??\c:\vjjjj.exec:\vjjjj.exe172⤵
-
\??\c:\pdpjv.exec:\pdpjv.exe173⤵
-
\??\c:\3vjdp.exec:\3vjdp.exe174⤵
-
\??\c:\lxxxrrl.exec:\lxxxrrl.exe175⤵
-
\??\c:\btbttt.exec:\btbttt.exe176⤵
-
\??\c:\bnhbtn.exec:\bnhbtn.exe177⤵
-
\??\c:\vvjjv.exec:\vvjjv.exe178⤵
-
\??\c:\pjpjd.exec:\pjpjd.exe179⤵
-
\??\c:\jvdvj.exec:\jvdvj.exe180⤵
-
\??\c:\llrrfff.exec:\llrrfff.exe181⤵
-
\??\c:\lxrllrr.exec:\lxrllrr.exe182⤵
-
\??\c:\hbbbhh.exec:\hbbbhh.exe183⤵
-
\??\c:\ttbnbt.exec:\ttbnbt.exe184⤵
-
\??\c:\vpppp.exec:\vpppp.exe185⤵
-
\??\c:\pjvpj.exec:\pjvpj.exe186⤵
-
\??\c:\lrxxlfr.exec:\lrxxlfr.exe187⤵
-
\??\c:\nbtntn.exec:\nbtntn.exe188⤵
-
\??\c:\htbbbb.exec:\htbbbb.exe189⤵
-
\??\c:\pjjjd.exec:\pjjjd.exe190⤵
-
\??\c:\pdjjv.exec:\pdjjv.exe191⤵
-
\??\c:\xllfxrr.exec:\xllfxrr.exe192⤵
-
\??\c:\ffxrxfl.exec:\ffxrxfl.exe193⤵
-
\??\c:\bbbbth.exec:\bbbbth.exe194⤵
-
\??\c:\jdvpv.exec:\jdvpv.exe195⤵
-
\??\c:\djdvp.exec:\djdvp.exe196⤵
-
\??\c:\xrrffxx.exec:\xrrffxx.exe197⤵
-
\??\c:\3llllll.exec:\3llllll.exe198⤵
-
\??\c:\bthhnh.exec:\bthhnh.exe199⤵
-
\??\c:\pjjjv.exec:\pjjjv.exe200⤵
-
\??\c:\vjppj.exec:\vjppj.exe201⤵
-
\??\c:\9xffrxx.exec:\9xffrxx.exe202⤵
-
\??\c:\5flfffl.exec:\5flfffl.exe203⤵
-
\??\c:\xflfffx.exec:\xflfffx.exe204⤵
-
\??\c:\hbbbtt.exec:\hbbbtt.exe205⤵
-
\??\c:\jjvvv.exec:\jjvvv.exe206⤵
-
\??\c:\fxffrxr.exec:\fxffrxr.exe207⤵
-
\??\c:\lrxrlxr.exec:\lrxrlxr.exe208⤵
-
\??\c:\frfxxff.exec:\frfxxff.exe209⤵
-
\??\c:\nhhbhh.exec:\nhhbhh.exe210⤵
-
\??\c:\ntnnht.exec:\ntnnht.exe211⤵
-
\??\c:\dvjjp.exec:\dvjjp.exe212⤵
-
\??\c:\vdjdv.exec:\vdjdv.exe213⤵
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe214⤵
-
\??\c:\rfllllr.exec:\rfllllr.exe215⤵
-
\??\c:\hnbbtt.exec:\hnbbtt.exe216⤵
-
\??\c:\ttnhbb.exec:\ttnhbb.exe217⤵
-
\??\c:\ntbbbb.exec:\ntbbbb.exe218⤵
-
\??\c:\3ppjv.exec:\3ppjv.exe219⤵
-
\??\c:\dvdvj.exec:\dvdvj.exe220⤵
-
\??\c:\xrrfxxx.exec:\xrrfxxx.exe221⤵
-
\??\c:\rfllllf.exec:\rfllllf.exe222⤵
-
\??\c:\tbbnhh.exec:\tbbnhh.exe223⤵
-
\??\c:\ttnhbt.exec:\ttnhbt.exe224⤵
-
\??\c:\vddvj.exec:\vddvj.exe225⤵
-
\??\c:\vpvpd.exec:\vpvpd.exe226⤵
-
\??\c:\3ppjp.exec:\3ppjp.exe227⤵
-
\??\c:\lflrrrx.exec:\lflrrrx.exe228⤵
-
\??\c:\hbbbbb.exec:\hbbbbb.exe229⤵
-
\??\c:\hbtthh.exec:\hbtthh.exe230⤵
-
\??\c:\thtnbh.exec:\thtnbh.exe231⤵
-
\??\c:\7pvvv.exec:\7pvvv.exe232⤵
-
\??\c:\fxrrllf.exec:\fxrrllf.exe233⤵
-
\??\c:\lfxxrff.exec:\lfxxrff.exe234⤵
-
\??\c:\tbhbtt.exec:\tbhbtt.exe235⤵
-
\??\c:\5hhbtt.exec:\5hhbtt.exe236⤵
-
\??\c:\pjpjp.exec:\pjpjp.exe237⤵
-
\??\c:\xlffxfx.exec:\xlffxfx.exe238⤵
-
\??\c:\1xfxrrl.exec:\1xfxrrl.exe239⤵
-
\??\c:\hbnntt.exec:\hbnntt.exe240⤵
-
\??\c:\nttttt.exec:\nttttt.exe241⤵