Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 21:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3f8793cc4d9c90b236b10c79209638a99a997fc243ec8e5f4d9825d721339427.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
3f8793cc4d9c90b236b10c79209638a99a997fc243ec8e5f4d9825d721339427.exe
-
Size
72KB
-
MD5
0ceabfd083f145e8ec4effcef1a8ca80
-
SHA1
328ddcfea411bb426508e8c3da2a44f50d1c6c15
-
SHA256
3f8793cc4d9c90b236b10c79209638a99a997fc243ec8e5f4d9825d721339427
-
SHA512
ef44dede8d7bd46fb9519c8556a5bdc4d0b2d5a2e16fb18284a4194c1ac9e4adb1bcf2b925e870564657d4c87aaf2a3fd28bf0cf281bade2c82027212c09930b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIJSsD+cGUFzJ3:ymb3NkkiQ3mdBjFIwsDhbNF
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral1/memory/2060-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3060-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2268-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-60-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2712-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2228-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2808-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2320-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2044-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1540-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/240-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1040-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/588-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1684-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1892-297-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-2267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
3frxllr.exenhttnn.exetnthhn.exevpvpj.exe5fflrfr.exennbtht.exe9dvvd.exeddjpj.exexlxrxrx.exe7rfxfxf.exe7nbhnh.exejdppv.exepvvpv.exexrfrfxf.exetnbbhn.exebnhthn.exejjvvd.exepjvpv.exexrlrffr.exetnnbth.exebhtttt.exe1pjvv.exevjvjj.exerlfflrx.exetntnbb.exebttbhb.exe9pjjv.exelfrxflr.exebhhtht.exe9nnnnt.exejjdvj.exellxlfrf.exelfrfrrl.exenhhnbb.exetnbthh.exedpddj.exe3pvdj.exe9frrffx.exelrxxfff.exebbtnhn.exe9hnhbb.exevpvdj.exevdvdp.exexxrfxff.exe5lrrlfr.exenhhtbb.exe1bnbbh.exevvjjv.exejddpj.exexrflfxr.exe3rfrxfr.exenhtntt.exedddvv.exevpdjd.exerrrfflr.exellrxrlx.exellxxxxl.exehbthhn.exetnbhbh.exenhthtt.exeddpjv.exe3jjpv.exe7jdpj.exe3llrllr.exepid process 2728 3frxllr.exe 3060 nhttnn.exe 2268 tnthhn.exe 2656 vpvpj.exe 2712 5fflrfr.exe 2564 nnbtht.exe 2584 9dvvd.exe 2464 ddjpj.exe 2960 xlxrxrx.exe 2228 7rfxfxf.exe 2808 7nbhnh.exe 2320 jdppv.exe 1180 pvvpv.exe 2044 xrfrfxf.exe 2772 tnbbhn.exe 1540 bnhthn.exe 1088 jjvvd.exe 2296 pjvpv.exe 2284 xrlrffr.exe 1880 tnnbth.exe 1896 bhtttt.exe 240 1pjvv.exe 2624 vjvjj.exe 1040 rlfflrx.exe 1260 tntnbb.exe 2504 bttbhb.exe 588 9pjjv.exe 2880 lfrxflr.exe 2408 bhhtht.exe 1684 9nnnnt.exe 1892 jjdvj.exe 2860 llxlfrf.exe 2132 lfrfrrl.exe 2400 nhhnbb.exe 2588 tnbthh.exe 3004 dpddj.exe 2640 3pvdj.exe 2740 9frrffx.exe 2572 lrxxfff.exe 2116 bbtnhn.exe 2608 9hnhbb.exe 2496 vpvdj.exe 2956 vdvdp.exe 2796 xxrfxff.exe 2804 5lrrlfr.exe 2828 nhhtbb.exe 1668 1bnbbh.exe 1308 vvjjv.exe 2020 jddpj.exe 292 xrflfxr.exe 2760 3rfrxfr.exe 1160 nhtntt.exe 1680 dddvv.exe 1984 vpdjd.exe 1048 rrrfflr.exe 2404 llrxrlx.exe 1624 llxxxxl.exe 596 hbthhn.exe 884 tnbhbh.exe 584 nhthtt.exe 1368 ddpjv.exe 2036 3jjpv.exe 1040 7jdpj.exe 916 3llrllr.exe -
Processes:
resource yara_rule behavioral1/memory/2060-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2268-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2228-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2320-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1540-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/240-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1040-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/588-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1684-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1892-297-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-2267-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3f8793cc4d9c90b236b10c79209638a99a997fc243ec8e5f4d9825d721339427.exe3frxllr.exenhttnn.exetnthhn.exevpvpj.exe5fflrfr.exennbtht.exe9dvvd.exeddjpj.exexlxrxrx.exe7rfxfxf.exe7nbhnh.exejdppv.exepvvpv.exexrfrfxf.exetnbbhn.exedescription pid process target process PID 2060 wrote to memory of 2728 2060 3f8793cc4d9c90b236b10c79209638a99a997fc243ec8e5f4d9825d721339427.exe 3frxllr.exe PID 2060 wrote to memory of 2728 2060 3f8793cc4d9c90b236b10c79209638a99a997fc243ec8e5f4d9825d721339427.exe 3frxllr.exe PID 2060 wrote to memory of 2728 2060 3f8793cc4d9c90b236b10c79209638a99a997fc243ec8e5f4d9825d721339427.exe 3frxllr.exe PID 2060 wrote to memory of 2728 2060 3f8793cc4d9c90b236b10c79209638a99a997fc243ec8e5f4d9825d721339427.exe 3frxllr.exe PID 2728 wrote to memory of 3060 2728 3frxllr.exe nhttnn.exe PID 2728 wrote to memory of 3060 2728 3frxllr.exe nhttnn.exe PID 2728 wrote to memory of 3060 2728 3frxllr.exe nhttnn.exe PID 2728 wrote to memory of 3060 2728 3frxllr.exe nhttnn.exe PID 3060 wrote to memory of 2268 3060 nhttnn.exe tnthhn.exe PID 3060 wrote to memory of 2268 3060 nhttnn.exe tnthhn.exe PID 3060 wrote to memory of 2268 3060 nhttnn.exe tnthhn.exe PID 3060 wrote to memory of 2268 3060 nhttnn.exe tnthhn.exe PID 2268 wrote to memory of 2656 2268 tnthhn.exe vpvpj.exe PID 2268 wrote to memory of 2656 2268 tnthhn.exe vpvpj.exe PID 2268 wrote to memory of 2656 2268 tnthhn.exe vpvpj.exe PID 2268 wrote to memory of 2656 2268 tnthhn.exe vpvpj.exe PID 2656 wrote to memory of 2712 2656 vpvpj.exe 5fflrfr.exe PID 2656 wrote to memory of 2712 2656 vpvpj.exe 5fflrfr.exe PID 2656 wrote to memory of 2712 2656 vpvpj.exe 5fflrfr.exe PID 2656 wrote to memory of 2712 2656 vpvpj.exe 5fflrfr.exe PID 2712 wrote to memory of 2564 2712 5fflrfr.exe nnbtht.exe PID 2712 wrote to memory of 2564 2712 5fflrfr.exe nnbtht.exe PID 2712 wrote to memory of 2564 2712 5fflrfr.exe nnbtht.exe PID 2712 wrote to memory of 2564 2712 5fflrfr.exe nnbtht.exe PID 2564 wrote to memory of 2584 2564 nnbtht.exe 9dvvd.exe PID 2564 wrote to memory of 2584 2564 nnbtht.exe 9dvvd.exe PID 2564 wrote to memory of 2584 2564 nnbtht.exe 9dvvd.exe PID 2564 wrote to memory of 2584 2564 nnbtht.exe 9dvvd.exe PID 2584 wrote to memory of 2464 2584 9dvvd.exe ddjpj.exe PID 2584 wrote to memory of 2464 2584 9dvvd.exe ddjpj.exe PID 2584 wrote to memory of 2464 2584 9dvvd.exe ddjpj.exe PID 2584 wrote to memory of 2464 2584 9dvvd.exe ddjpj.exe PID 2464 wrote to memory of 2960 2464 ddjpj.exe xlxrxrx.exe PID 2464 wrote to memory of 2960 2464 ddjpj.exe xlxrxrx.exe PID 2464 wrote to memory of 2960 2464 ddjpj.exe xlxrxrx.exe PID 2464 wrote to memory of 2960 2464 ddjpj.exe xlxrxrx.exe PID 2960 wrote to memory of 2228 2960 xlxrxrx.exe 7rfxfxf.exe PID 2960 wrote to memory of 2228 2960 xlxrxrx.exe 7rfxfxf.exe PID 2960 wrote to memory of 2228 2960 xlxrxrx.exe 7rfxfxf.exe PID 2960 wrote to memory of 2228 2960 xlxrxrx.exe 7rfxfxf.exe PID 2228 wrote to memory of 2808 2228 7rfxfxf.exe 7nbhnh.exe PID 2228 wrote to memory of 2808 2228 7rfxfxf.exe 7nbhnh.exe PID 2228 wrote to memory of 2808 2228 7rfxfxf.exe 7nbhnh.exe PID 2228 wrote to memory of 2808 2228 7rfxfxf.exe 7nbhnh.exe PID 2808 wrote to memory of 2320 2808 7nbhnh.exe jdppv.exe PID 2808 wrote to memory of 2320 2808 7nbhnh.exe jdppv.exe PID 2808 wrote to memory of 2320 2808 7nbhnh.exe jdppv.exe PID 2808 wrote to memory of 2320 2808 7nbhnh.exe jdppv.exe PID 2320 wrote to memory of 1180 2320 jdppv.exe pvvpv.exe PID 2320 wrote to memory of 1180 2320 jdppv.exe pvvpv.exe PID 2320 wrote to memory of 1180 2320 jdppv.exe pvvpv.exe PID 2320 wrote to memory of 1180 2320 jdppv.exe pvvpv.exe PID 1180 wrote to memory of 2044 1180 pvvpv.exe xrfrfxf.exe PID 1180 wrote to memory of 2044 1180 pvvpv.exe xrfrfxf.exe PID 1180 wrote to memory of 2044 1180 pvvpv.exe xrfrfxf.exe PID 1180 wrote to memory of 2044 1180 pvvpv.exe xrfrfxf.exe PID 2044 wrote to memory of 2772 2044 xrfrfxf.exe tnbbhn.exe PID 2044 wrote to memory of 2772 2044 xrfrfxf.exe tnbbhn.exe PID 2044 wrote to memory of 2772 2044 xrfrfxf.exe tnbbhn.exe PID 2044 wrote to memory of 2772 2044 xrfrfxf.exe tnbbhn.exe PID 2772 wrote to memory of 1540 2772 tnbbhn.exe bnhthn.exe PID 2772 wrote to memory of 1540 2772 tnbbhn.exe bnhthn.exe PID 2772 wrote to memory of 1540 2772 tnbbhn.exe bnhthn.exe PID 2772 wrote to memory of 1540 2772 tnbbhn.exe bnhthn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f8793cc4d9c90b236b10c79209638a99a997fc243ec8e5f4d9825d721339427.exe"C:\Users\Admin\AppData\Local\Temp\3f8793cc4d9c90b236b10c79209638a99a997fc243ec8e5f4d9825d721339427.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\3frxllr.exec:\3frxllr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhttnn.exec:\nhttnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnthhn.exec:\tnthhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpvpj.exec:\vpvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5fflrfr.exec:\5fflrfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnbtht.exec:\nnbtht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9dvvd.exec:\9dvvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddjpj.exec:\ddjpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xlxrxrx.exec:\xlxrxrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7rfxfxf.exec:\7rfxfxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7nbhnh.exec:\7nbhnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdppv.exec:\jdppv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvvpv.exec:\pvvpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrfrfxf.exec:\xrfrfxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnbbhn.exec:\tnbbhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnhthn.exec:\bnhthn.exe17⤵
- Executes dropped EXE
-
\??\c:\jjvvd.exec:\jjvvd.exe18⤵
- Executes dropped EXE
-
\??\c:\pjvpv.exec:\pjvpv.exe19⤵
- Executes dropped EXE
-
\??\c:\xrlrffr.exec:\xrlrffr.exe20⤵
- Executes dropped EXE
-
\??\c:\tnnbth.exec:\tnnbth.exe21⤵
- Executes dropped EXE
-
\??\c:\bhtttt.exec:\bhtttt.exe22⤵
- Executes dropped EXE
-
\??\c:\1pjvv.exec:\1pjvv.exe23⤵
- Executes dropped EXE
-
\??\c:\vjvjj.exec:\vjvjj.exe24⤵
- Executes dropped EXE
-
\??\c:\rlfflrx.exec:\rlfflrx.exe25⤵
- Executes dropped EXE
-
\??\c:\tntnbb.exec:\tntnbb.exe26⤵
- Executes dropped EXE
-
\??\c:\bttbhb.exec:\bttbhb.exe27⤵
- Executes dropped EXE
-
\??\c:\9pjjv.exec:\9pjjv.exe28⤵
- Executes dropped EXE
-
\??\c:\lfrxflr.exec:\lfrxflr.exe29⤵
- Executes dropped EXE
-
\??\c:\bhhtht.exec:\bhhtht.exe30⤵
- Executes dropped EXE
-
\??\c:\9nnnnt.exec:\9nnnnt.exe31⤵
- Executes dropped EXE
-
\??\c:\jjdvj.exec:\jjdvj.exe32⤵
- Executes dropped EXE
-
\??\c:\llxlfrf.exec:\llxlfrf.exe33⤵
- Executes dropped EXE
-
\??\c:\lfrfrrl.exec:\lfrfrrl.exe34⤵
- Executes dropped EXE
-
\??\c:\nhhnbb.exec:\nhhnbb.exe35⤵
- Executes dropped EXE
-
\??\c:\tnbthh.exec:\tnbthh.exe36⤵
- Executes dropped EXE
-
\??\c:\dpddj.exec:\dpddj.exe37⤵
- Executes dropped EXE
-
\??\c:\3pvdj.exec:\3pvdj.exe38⤵
- Executes dropped EXE
-
\??\c:\9frrffx.exec:\9frrffx.exe39⤵
- Executes dropped EXE
-
\??\c:\lrxxfff.exec:\lrxxfff.exe40⤵
- Executes dropped EXE
-
\??\c:\bbtnhn.exec:\bbtnhn.exe41⤵
- Executes dropped EXE
-
\??\c:\9hnhbb.exec:\9hnhbb.exe42⤵
- Executes dropped EXE
-
\??\c:\vpvdj.exec:\vpvdj.exe43⤵
- Executes dropped EXE
-
\??\c:\vdvdp.exec:\vdvdp.exe44⤵
- Executes dropped EXE
-
\??\c:\xxrfxff.exec:\xxrfxff.exe45⤵
- Executes dropped EXE
-
\??\c:\5lrrlfr.exec:\5lrrlfr.exe46⤵
- Executes dropped EXE
-
\??\c:\nhhtbb.exec:\nhhtbb.exe47⤵
- Executes dropped EXE
-
\??\c:\1bnbbh.exec:\1bnbbh.exe48⤵
- Executes dropped EXE
-
\??\c:\vvjjv.exec:\vvjjv.exe49⤵
- Executes dropped EXE
-
\??\c:\jddpj.exec:\jddpj.exe50⤵
- Executes dropped EXE
-
\??\c:\xrflfxr.exec:\xrflfxr.exe51⤵
- Executes dropped EXE
-
\??\c:\3rfrxfr.exec:\3rfrxfr.exe52⤵
- Executes dropped EXE
-
\??\c:\nhtntt.exec:\nhtntt.exe53⤵
- Executes dropped EXE
-
\??\c:\dddvv.exec:\dddvv.exe54⤵
- Executes dropped EXE
-
\??\c:\vpdjd.exec:\vpdjd.exe55⤵
- Executes dropped EXE
-
\??\c:\rrrfflr.exec:\rrrfflr.exe56⤵
- Executes dropped EXE
-
\??\c:\llrxrlx.exec:\llrxrlx.exe57⤵
- Executes dropped EXE
-
\??\c:\llxxxxl.exec:\llxxxxl.exe58⤵
- Executes dropped EXE
-
\??\c:\hbthhn.exec:\hbthhn.exe59⤵
- Executes dropped EXE
-
\??\c:\tnbhbh.exec:\tnbhbh.exe60⤵
- Executes dropped EXE
-
\??\c:\nhthtt.exec:\nhthtt.exe61⤵
- Executes dropped EXE
-
\??\c:\ddpjv.exec:\ddpjv.exe62⤵
- Executes dropped EXE
-
\??\c:\3jjpv.exec:\3jjpv.exe63⤵
- Executes dropped EXE
-
\??\c:\7jdpj.exec:\7jdpj.exe64⤵
- Executes dropped EXE
-
\??\c:\3llrllr.exec:\3llrllr.exe65⤵
- Executes dropped EXE
-
\??\c:\bthntb.exec:\bthntb.exe66⤵
-
\??\c:\5pvjj.exec:\5pvjj.exe67⤵
-
\??\c:\jdpjp.exec:\jdpjp.exe68⤵
-
\??\c:\xxlxrxx.exec:\xxlxrxx.exe69⤵
-
\??\c:\xlflxxx.exec:\xlflxxx.exe70⤵
-
\??\c:\9nbttn.exec:\9nbttn.exe71⤵
-
\??\c:\tnhhhh.exec:\tnhhhh.exe72⤵
-
\??\c:\djpjp.exec:\djpjp.exe73⤵
-
\??\c:\7vddj.exec:\7vddj.exe74⤵
-
\??\c:\rxflffl.exec:\rxflffl.exe75⤵
-
\??\c:\lflrffl.exec:\lflrffl.exe76⤵
-
\??\c:\bbntbb.exec:\bbntbb.exe77⤵
-
\??\c:\nhhbtb.exec:\nhhbtb.exe78⤵
-
\??\c:\jdpjj.exec:\jdpjj.exe79⤵
-
\??\c:\fxfrrxx.exec:\fxfrrxx.exe80⤵
-
\??\c:\3rxxxxx.exec:\3rxxxxx.exe81⤵
-
\??\c:\hbntbn.exec:\hbntbn.exe82⤵
-
\??\c:\nbthnh.exec:\nbthnh.exe83⤵
-
\??\c:\nhnbbh.exec:\nhnbbh.exe84⤵
-
\??\c:\pjpvp.exec:\pjpvp.exe85⤵
-
\??\c:\7vjjj.exec:\7vjjj.exe86⤵
-
\??\c:\fflllxf.exec:\fflllxf.exe87⤵
-
\??\c:\fxxfrrf.exec:\fxxfrrf.exe88⤵
-
\??\c:\1ntnth.exec:\1ntnth.exe89⤵
-
\??\c:\bhntnn.exec:\bhntnn.exe90⤵
-
\??\c:\dpjvp.exec:\dpjvp.exe91⤵
-
\??\c:\9pddv.exec:\9pddv.exe92⤵
-
\??\c:\pdppj.exec:\pdppj.exe93⤵
-
\??\c:\7lxrlfl.exec:\7lxrlfl.exe94⤵
-
\??\c:\rrffffl.exec:\rrffffl.exe95⤵
-
\??\c:\bthhnn.exec:\bthhnn.exe96⤵
-
\??\c:\9tbhhb.exec:\9tbhhb.exe97⤵
-
\??\c:\9vjjp.exec:\9vjjp.exe98⤵
-
\??\c:\pjvpv.exec:\pjvpv.exe99⤵
-
\??\c:\9xffllx.exec:\9xffllx.exe100⤵
-
\??\c:\fxxfrxl.exec:\fxxfrxl.exe101⤵
-
\??\c:\7thhtt.exec:\7thhtt.exe102⤵
-
\??\c:\thbbhb.exec:\thbbhb.exe103⤵
-
\??\c:\3nbhht.exec:\3nbhht.exe104⤵
-
\??\c:\1vdjp.exec:\1vdjp.exe105⤵
-
\??\c:\9dvdj.exec:\9dvdj.exe106⤵
-
\??\c:\lxflxxf.exec:\lxflxxf.exe107⤵
-
\??\c:\fxrfxrx.exec:\fxrfxrx.exe108⤵
-
\??\c:\hbhhhh.exec:\hbhhhh.exe109⤵
-
\??\c:\hbhhhb.exec:\hbhhhb.exe110⤵
-
\??\c:\nhnbtb.exec:\nhnbtb.exe111⤵
-
\??\c:\pdpvd.exec:\pdpvd.exe112⤵
-
\??\c:\pdpvv.exec:\pdpvv.exe113⤵
-
\??\c:\flrxflr.exec:\flrxflr.exe114⤵
-
\??\c:\xrllrrx.exec:\xrllrrx.exe115⤵
-
\??\c:\nhbhnt.exec:\nhbhnt.exe116⤵
-
\??\c:\btbhhb.exec:\btbhhb.exe117⤵
-
\??\c:\jdppj.exec:\jdppj.exe118⤵
-
\??\c:\5vppp.exec:\5vppp.exe119⤵
-
\??\c:\lfrxllr.exec:\lfrxllr.exe120⤵
-
\??\c:\xflrfxx.exec:\xflrfxx.exe121⤵
-
\??\c:\1hbnnt.exec:\1hbnnt.exe122⤵
-
\??\c:\nhtbnb.exec:\nhtbnb.exe123⤵
-
\??\c:\1ttnhb.exec:\1ttnhb.exe124⤵
-
\??\c:\jjvvv.exec:\jjvvv.exe125⤵
-
\??\c:\9dpvv.exec:\9dpvv.exe126⤵
-
\??\c:\rrlfrrf.exec:\rrlfrrf.exe127⤵
-
\??\c:\xxllflf.exec:\xxllflf.exe128⤵
-
\??\c:\btntnn.exec:\btntnn.exe129⤵
-
\??\c:\thhnhh.exec:\thhnhh.exe130⤵
-
\??\c:\vpjjp.exec:\vpjjp.exe131⤵
-
\??\c:\ppjvj.exec:\ppjvj.exe132⤵
-
\??\c:\lfxxlll.exec:\lfxxlll.exe133⤵
-
\??\c:\3xxxfxl.exec:\3xxxfxl.exe134⤵
-
\??\c:\bnbhnn.exec:\bnbhnn.exe135⤵
-
\??\c:\hbnnhn.exec:\hbnnhn.exe136⤵
-
\??\c:\1bnthn.exec:\1bnthn.exe137⤵
-
\??\c:\jjvdv.exec:\jjvdv.exe138⤵
-
\??\c:\pdpvv.exec:\pdpvv.exe139⤵
-
\??\c:\rfrlrll.exec:\rfrlrll.exe140⤵
-
\??\c:\rffflll.exec:\rffflll.exe141⤵
-
\??\c:\7btbtt.exec:\7btbtt.exe142⤵
-
\??\c:\1httbh.exec:\1httbh.exe143⤵
-
\??\c:\vdjjv.exec:\vdjjv.exe144⤵
-
\??\c:\dvdjj.exec:\dvdjj.exe145⤵
-
\??\c:\lffrlxf.exec:\lffrlxf.exe146⤵
-
\??\c:\frlxfrf.exec:\frlxfrf.exe147⤵
-
\??\c:\hththn.exec:\hththn.exe148⤵
-
\??\c:\9nbhbh.exec:\9nbhbh.exe149⤵
-
\??\c:\htnhnh.exec:\htnhnh.exe150⤵
-
\??\c:\7dddd.exec:\7dddd.exe151⤵
-
\??\c:\dvjpj.exec:\dvjpj.exe152⤵
-
\??\c:\9fffxfr.exec:\9fffxfr.exe153⤵
-
\??\c:\xxrlxfr.exec:\xxrlxfr.exe154⤵
-
\??\c:\ntnbtt.exec:\ntnbtt.exe155⤵
-
\??\c:\5tnbnt.exec:\5tnbnt.exe156⤵
-
\??\c:\1bnnbb.exec:\1bnnbb.exe157⤵
-
\??\c:\7vpdd.exec:\7vpdd.exe158⤵
-
\??\c:\5pdpd.exec:\5pdpd.exe159⤵
-
\??\c:\pjjjp.exec:\pjjjp.exe160⤵
-
\??\c:\9xrxlxl.exec:\9xrxlxl.exe161⤵
-
\??\c:\xlflxlr.exec:\xlflxlr.exe162⤵
-
\??\c:\tnttht.exec:\tnttht.exe163⤵
-
\??\c:\bbhtnh.exec:\bbhtnh.exe164⤵
-
\??\c:\ppjpd.exec:\ppjpd.exe165⤵
-
\??\c:\vpvdj.exec:\vpvdj.exe166⤵
-
\??\c:\lxrxffr.exec:\lxrxffr.exe167⤵
-
\??\c:\ffxffll.exec:\ffxffll.exe168⤵
-
\??\c:\fxllxxl.exec:\fxllxxl.exe169⤵
-
\??\c:\nhnnnb.exec:\nhnnnb.exe170⤵
-
\??\c:\nnhtbh.exec:\nnhtbh.exe171⤵
-
\??\c:\dpddj.exec:\dpddj.exe172⤵
-
\??\c:\jdjdj.exec:\jdjdj.exe173⤵
-
\??\c:\7rlfflf.exec:\7rlfflf.exe174⤵
-
\??\c:\xrrxlxf.exec:\xrrxlxf.exe175⤵
-
\??\c:\flxfxlx.exec:\flxfxlx.exe176⤵
-
\??\c:\hnhbbh.exec:\hnhbbh.exe177⤵
-
\??\c:\7bhbhn.exec:\7bhbhn.exe178⤵
-
\??\c:\7dvdj.exec:\7dvdj.exe179⤵
-
\??\c:\pdjdp.exec:\pdjdp.exe180⤵
-
\??\c:\lfflllx.exec:\lfflllx.exe181⤵
-
\??\c:\xrfrfrx.exec:\xrfrfrx.exe182⤵
-
\??\c:\nhnntn.exec:\nhnntn.exe183⤵
-
\??\c:\hthhnb.exec:\hthhnb.exe184⤵
-
\??\c:\vdpjp.exec:\vdpjp.exe185⤵
-
\??\c:\ppdjv.exec:\ppdjv.exe186⤵
-
\??\c:\fllxxrr.exec:\fllxxrr.exe187⤵
-
\??\c:\xxllllx.exec:\xxllllx.exe188⤵
-
\??\c:\nnhnhh.exec:\nnhnhh.exe189⤵
-
\??\c:\bttthn.exec:\bttthn.exe190⤵
-
\??\c:\jdjdp.exec:\jdjdp.exe191⤵
-
\??\c:\dpvjp.exec:\dpvjp.exe192⤵
-
\??\c:\xrflxlr.exec:\xrflxlr.exe193⤵
-
\??\c:\xfflrxr.exec:\xfflrxr.exe194⤵
-
\??\c:\ttntbh.exec:\ttntbh.exe195⤵
-
\??\c:\3hhhhn.exec:\3hhhhn.exe196⤵
-
\??\c:\vpddj.exec:\vpddj.exe197⤵
-
\??\c:\3dvdd.exec:\3dvdd.exe198⤵
-
\??\c:\jjvdj.exec:\jjvdj.exe199⤵
-
\??\c:\xrrlxfl.exec:\xrrlxfl.exe200⤵
-
\??\c:\xrflxrf.exec:\xrflxrf.exe201⤵
-
\??\c:\hhnhbn.exec:\hhnhbn.exe202⤵
-
\??\c:\nnhbnb.exec:\nnhbnb.exe203⤵
-
\??\c:\dvpvd.exec:\dvpvd.exe204⤵
-
\??\c:\ppvdp.exec:\ppvdp.exe205⤵
-
\??\c:\xrflrxf.exec:\xrflrxf.exe206⤵
-
\??\c:\5xrxllf.exec:\5xrxllf.exe207⤵
-
\??\c:\9xrflrx.exec:\9xrflrx.exe208⤵
-
\??\c:\nttnht.exec:\nttnht.exe209⤵
-
\??\c:\vpdjp.exec:\vpdjp.exe210⤵
-
\??\c:\5dvvd.exec:\5dvvd.exe211⤵
-
\??\c:\jvpvd.exec:\jvpvd.exe212⤵
-
\??\c:\rlflxxl.exec:\rlflxxl.exe213⤵
-
\??\c:\3ffxfxl.exec:\3ffxfxl.exe214⤵
-
\??\c:\ttnbht.exec:\ttnbht.exe215⤵
-
\??\c:\bbbbht.exec:\bbbbht.exe216⤵
-
\??\c:\jdvjv.exec:\jdvjv.exe217⤵
-
\??\c:\vjdjp.exec:\vjdjp.exe218⤵
-
\??\c:\vpdvj.exec:\vpdvj.exe219⤵
-
\??\c:\lfxlxxl.exec:\lfxlxxl.exe220⤵
-
\??\c:\frfxfll.exec:\frfxfll.exe221⤵
-
\??\c:\hhthbh.exec:\hhthbh.exe222⤵
-
\??\c:\3dvjd.exec:\3dvjd.exe223⤵
-
\??\c:\pjdvd.exec:\pjdvd.exe224⤵
-
\??\c:\rllfflf.exec:\rllfflf.exe225⤵
-
\??\c:\rlrflxl.exec:\rlrflxl.exe226⤵
-
\??\c:\nhtbtn.exec:\nhtbtn.exe227⤵
-
\??\c:\hhhnth.exec:\hhhnth.exe228⤵
-
\??\c:\jjjpj.exec:\jjjpj.exe229⤵
-
\??\c:\jpdpv.exec:\jpdpv.exe230⤵
-
\??\c:\dvpvv.exec:\dvpvv.exe231⤵
-
\??\c:\xllrffr.exec:\xllrffr.exe232⤵
-
\??\c:\9xxflrr.exec:\9xxflrr.exe233⤵
-
\??\c:\nnbtnt.exec:\nnbtnt.exe234⤵
-
\??\c:\nhnbtt.exec:\nhnbtt.exe235⤵
-
\??\c:\jjvjj.exec:\jjvjj.exe236⤵
-
\??\c:\1djdv.exec:\1djdv.exe237⤵
-
\??\c:\7frlxlx.exec:\7frlxlx.exe238⤵
-
\??\c:\xrlxflf.exec:\xrlxflf.exe239⤵
-
\??\c:\bthnbb.exec:\bthnbb.exe240⤵
-
\??\c:\9tnbtb.exec:\9tnbtb.exe241⤵