Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 18:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6bd61cf1c7637ffd7e98d20c4e32e7e9_JaffaCakes118.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
6bd61cf1c7637ffd7e98d20c4e32e7e9_JaffaCakes118.exe
-
Size
78KB
-
MD5
6bd61cf1c7637ffd7e98d20c4e32e7e9
-
SHA1
2dd4aa09f3313e041567d5867de4a2c91c6e43b8
-
SHA256
96104f7526b22316b8c23e3180521f25a5f582239a74e89f74b557a8d368e2d5
-
SHA512
eae80cbf6d11e32bdddb59f94d5adea53732250e64cd9d232dc04296d2e3db69e195871c4092ba85dc59233948076f1bac32d12f20e906e4354050785eaf8a5c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDWiekja1br3GGBxfot3n3:ymb3NkkiQ3mdBjFWXkj7afodn3
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral2/memory/3308-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4000-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4440-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4440-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1368-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2912-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2464-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3540-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2848-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4028-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3080-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3080-73-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5032-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1168-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2032-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3176-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2284-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4760-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4672-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/740-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4556-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2268-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1744-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1108-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pdpdv.exe9rrrffl.exelxflfxx.exebbnntt.exehbttbb.exejdddd.exexxrrrrr.exelllllll.exebbnbbh.exejdjvp.exerlllrrl.exellfxlrx.exe3bntbn.exepvvpp.exerlllfll.exelrrxrxr.exehntthn.exenbttnt.exejdjjj.exefxfllrl.exe1tnnhn.exe5nhbtt.exepdjdj.exeffrllll.exe3lfffff.exebtbbbb.exennnhhh.exedvjjv.exe3rlfrff.exettbnnn.exe9ntnhh.exeddjpp.exe1xrlrrr.exerrxfffx.exehnnhhb.exethbbhn.exeppppp.exevpdvj.exexrrlrrr.exelfffflf.exettbhhh.exepjjjv.exe5jvpj.exeflxxxfx.exexxxrrrr.exexxllrrf.exetttttt.exedvjjd.exejdjjp.exexrfrfff.exexxfrlff.exetttthh.exe1ppjj.exe5pvjd.exefllfxxx.exelfxflll.exettnnhh.exebbtnhh.exeppdvp.exejpjvv.exe1rllfff.exennbhtt.exe5nttnb.exebhtttt.exepid process 2464 pdpdv.exe 4000 9rrrffl.exe 2912 lxflfxx.exe 1368 bbnntt.exe 4440 hbttbb.exe 3540 jdddd.exe 2848 xxrrrrr.exe 4028 lllllll.exe 3080 bbnbbh.exe 2720 jdjvp.exe 5032 rlllrrl.exe 1168 llfxlrx.exe 2032 3bntbn.exe 3176 pvvpp.exe 2284 rlllfll.exe 4760 lrrxrxr.exe 4924 hntthn.exe 4672 nbttnt.exe 4472 jdjjj.exe 740 fxfllrl.exe 5024 1tnnhn.exe 4556 5nhbtt.exe 4056 pdjdj.exe 5016 ffrllll.exe 3016 3lfffff.exe 2268 btbbbb.exe 4496 nnnhhh.exe 1744 dvjjv.exe 1108 3rlfrff.exe 808 ttbnnn.exe 3872 9ntnhh.exe 4352 ddjpp.exe 1680 1xrlrrr.exe 2400 rrxfffx.exe 3264 hnnhhb.exe 5116 thbbhn.exe 3800 ppppp.exe 2528 vpdvj.exe 3816 xrrlrrr.exe 4856 lfffflf.exe 4864 ttbhhh.exe 4896 pjjjv.exe 2964 5jvpj.exe 2612 flxxxfx.exe 4028 xxxrrrr.exe 2520 xxllrrf.exe 1692 tttttt.exe 2628 dvjjd.exe 4704 jdjjp.exe 4828 xrfrfff.exe 2624 xxfrlff.exe 2408 tttthh.exe 4736 1ppjj.exe 2444 5pvjd.exe 4264 fllfxxx.exe 5008 lfxflll.exe 4948 ttnnhh.exe 920 bbtnhh.exe 4032 ppdvp.exe 3652 jpjvv.exe 4460 1rllfff.exe 4152 nnbhtt.exe 2736 5nttnb.exe 3560 bhtttt.exe -
Processes:
resource yara_rule behavioral2/memory/3308-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3308-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4000-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4440-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4440-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1368-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2912-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2464-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3540-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2848-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4028-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3080-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5032-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1168-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2032-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3176-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2284-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4760-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4672-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/740-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4556-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2268-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1744-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1108-192-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6bd61cf1c7637ffd7e98d20c4e32e7e9_JaffaCakes118.exepdpdv.exe9rrrffl.exelxflfxx.exebbnntt.exehbttbb.exejdddd.exexxrrrrr.exelllllll.exebbnbbh.exejdjvp.exerlllrrl.exellfxlrx.exe3bntbn.exepvvpp.exerlllfll.exelrrxrxr.exehntthn.exenbttnt.exejdjjj.exefxfllrl.exe1tnnhn.exedescription pid process target process PID 3308 wrote to memory of 2464 3308 6bd61cf1c7637ffd7e98d20c4e32e7e9_JaffaCakes118.exe pdpdv.exe PID 3308 wrote to memory of 2464 3308 6bd61cf1c7637ffd7e98d20c4e32e7e9_JaffaCakes118.exe pdpdv.exe PID 3308 wrote to memory of 2464 3308 6bd61cf1c7637ffd7e98d20c4e32e7e9_JaffaCakes118.exe pdpdv.exe PID 2464 wrote to memory of 4000 2464 pdpdv.exe 9rrrffl.exe PID 2464 wrote to memory of 4000 2464 pdpdv.exe 9rrrffl.exe PID 2464 wrote to memory of 4000 2464 pdpdv.exe 9rrrffl.exe PID 4000 wrote to memory of 2912 4000 9rrrffl.exe lxflfxx.exe PID 4000 wrote to memory of 2912 4000 9rrrffl.exe lxflfxx.exe PID 4000 wrote to memory of 2912 4000 9rrrffl.exe lxflfxx.exe PID 2912 wrote to memory of 1368 2912 lxflfxx.exe bbnntt.exe PID 2912 wrote to memory of 1368 2912 lxflfxx.exe bbnntt.exe PID 2912 wrote to memory of 1368 2912 lxflfxx.exe bbnntt.exe PID 1368 wrote to memory of 4440 1368 bbnntt.exe hbttbb.exe PID 1368 wrote to memory of 4440 1368 bbnntt.exe hbttbb.exe PID 1368 wrote to memory of 4440 1368 bbnntt.exe hbttbb.exe PID 4440 wrote to memory of 3540 4440 hbttbb.exe jdddd.exe PID 4440 wrote to memory of 3540 4440 hbttbb.exe jdddd.exe PID 4440 wrote to memory of 3540 4440 hbttbb.exe jdddd.exe PID 3540 wrote to memory of 2848 3540 jdddd.exe xxrrrrr.exe PID 3540 wrote to memory of 2848 3540 jdddd.exe xxrrrrr.exe PID 3540 wrote to memory of 2848 3540 jdddd.exe xxrrrrr.exe PID 2848 wrote to memory of 4028 2848 xxrrrrr.exe lllllll.exe PID 2848 wrote to memory of 4028 2848 xxrrrrr.exe lllllll.exe PID 2848 wrote to memory of 4028 2848 xxrrrrr.exe lllllll.exe PID 4028 wrote to memory of 3080 4028 lllllll.exe bbnbbh.exe PID 4028 wrote to memory of 3080 4028 lllllll.exe bbnbbh.exe PID 4028 wrote to memory of 3080 4028 lllllll.exe bbnbbh.exe PID 3080 wrote to memory of 2720 3080 bbnbbh.exe jdjvp.exe PID 3080 wrote to memory of 2720 3080 bbnbbh.exe jdjvp.exe PID 3080 wrote to memory of 2720 3080 bbnbbh.exe jdjvp.exe PID 2720 wrote to memory of 5032 2720 jdjvp.exe rlllrrl.exe PID 2720 wrote to memory of 5032 2720 jdjvp.exe rlllrrl.exe PID 2720 wrote to memory of 5032 2720 jdjvp.exe rlllrrl.exe PID 5032 wrote to memory of 1168 5032 rlllrrl.exe llfxlrx.exe PID 5032 wrote to memory of 1168 5032 rlllrrl.exe llfxlrx.exe PID 5032 wrote to memory of 1168 5032 rlllrrl.exe llfxlrx.exe PID 1168 wrote to memory of 2032 1168 llfxlrx.exe 3bntbn.exe PID 1168 wrote to memory of 2032 1168 llfxlrx.exe 3bntbn.exe PID 1168 wrote to memory of 2032 1168 llfxlrx.exe 3bntbn.exe PID 2032 wrote to memory of 3176 2032 3bntbn.exe pvvpp.exe PID 2032 wrote to memory of 3176 2032 3bntbn.exe pvvpp.exe PID 2032 wrote to memory of 3176 2032 3bntbn.exe pvvpp.exe PID 3176 wrote to memory of 2284 3176 pvvpp.exe rlllfll.exe PID 3176 wrote to memory of 2284 3176 pvvpp.exe rlllfll.exe PID 3176 wrote to memory of 2284 3176 pvvpp.exe rlllfll.exe PID 2284 wrote to memory of 4760 2284 rlllfll.exe lrrxrxr.exe PID 2284 wrote to memory of 4760 2284 rlllfll.exe lrrxrxr.exe PID 2284 wrote to memory of 4760 2284 rlllfll.exe lrrxrxr.exe PID 4760 wrote to memory of 4924 4760 lrrxrxr.exe hntthn.exe PID 4760 wrote to memory of 4924 4760 lrrxrxr.exe hntthn.exe PID 4760 wrote to memory of 4924 4760 lrrxrxr.exe hntthn.exe PID 4924 wrote to memory of 4672 4924 hntthn.exe nbttnt.exe PID 4924 wrote to memory of 4672 4924 hntthn.exe nbttnt.exe PID 4924 wrote to memory of 4672 4924 hntthn.exe nbttnt.exe PID 4672 wrote to memory of 4472 4672 nbttnt.exe jdjjj.exe PID 4672 wrote to memory of 4472 4672 nbttnt.exe jdjjj.exe PID 4672 wrote to memory of 4472 4672 nbttnt.exe jdjjj.exe PID 4472 wrote to memory of 740 4472 jdjjj.exe fxfllrl.exe PID 4472 wrote to memory of 740 4472 jdjjj.exe fxfllrl.exe PID 4472 wrote to memory of 740 4472 jdjjj.exe fxfllrl.exe PID 740 wrote to memory of 5024 740 fxfllrl.exe 1tnnhn.exe PID 740 wrote to memory of 5024 740 fxfllrl.exe 1tnnhn.exe PID 740 wrote to memory of 5024 740 fxfllrl.exe 1tnnhn.exe PID 5024 wrote to memory of 4556 5024 1tnnhn.exe 5nhbtt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6bd61cf1c7637ffd7e98d20c4e32e7e9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6bd61cf1c7637ffd7e98d20c4e32e7e9_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\pdpdv.exec:\pdpdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9rrrffl.exec:\9rrrffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxflfxx.exec:\lxflfxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbnntt.exec:\bbnntt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbttbb.exec:\hbttbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdddd.exec:\jdddd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxrrrrr.exec:\xxrrrrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lllllll.exec:\lllllll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbnbbh.exec:\bbnbbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdjvp.exec:\jdjvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlllrrl.exec:\rlllrrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llfxlrx.exec:\llfxlrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3bntbn.exec:\3bntbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvvpp.exec:\pvvpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlllfll.exec:\rlllfll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrrxrxr.exec:\lrrxrxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hntthn.exec:\hntthn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbttnt.exec:\nbttnt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdjjj.exec:\jdjjj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxfllrl.exec:\fxfllrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1tnnhn.exec:\1tnnhn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5nhbtt.exec:\5nhbtt.exe23⤵
- Executes dropped EXE
-
\??\c:\pdjdj.exec:\pdjdj.exe24⤵
- Executes dropped EXE
-
\??\c:\ffrllll.exec:\ffrllll.exe25⤵
- Executes dropped EXE
-
\??\c:\3lfffff.exec:\3lfffff.exe26⤵
- Executes dropped EXE
-
\??\c:\btbbbb.exec:\btbbbb.exe27⤵
- Executes dropped EXE
-
\??\c:\nnnhhh.exec:\nnnhhh.exe28⤵
- Executes dropped EXE
-
\??\c:\dvjjv.exec:\dvjjv.exe29⤵
- Executes dropped EXE
-
\??\c:\3rlfrff.exec:\3rlfrff.exe30⤵
- Executes dropped EXE
-
\??\c:\ttbnnn.exec:\ttbnnn.exe31⤵
- Executes dropped EXE
-
\??\c:\9ntnhh.exec:\9ntnhh.exe32⤵
- Executes dropped EXE
-
\??\c:\ddjpp.exec:\ddjpp.exe33⤵
- Executes dropped EXE
-
\??\c:\1xrlrrr.exec:\1xrlrrr.exe34⤵
- Executes dropped EXE
-
\??\c:\rrxfffx.exec:\rrxfffx.exe35⤵
- Executes dropped EXE
-
\??\c:\hnnhhb.exec:\hnnhhb.exe36⤵
- Executes dropped EXE
-
\??\c:\thbbhn.exec:\thbbhn.exe37⤵
- Executes dropped EXE
-
\??\c:\ppppp.exec:\ppppp.exe38⤵
- Executes dropped EXE
-
\??\c:\vpdvj.exec:\vpdvj.exe39⤵
- Executes dropped EXE
-
\??\c:\xrrlrrr.exec:\xrrlrrr.exe40⤵
- Executes dropped EXE
-
\??\c:\lfffflf.exec:\lfffflf.exe41⤵
- Executes dropped EXE
-
\??\c:\ttbhhh.exec:\ttbhhh.exe42⤵
- Executes dropped EXE
-
\??\c:\pjjjv.exec:\pjjjv.exe43⤵
- Executes dropped EXE
-
\??\c:\5jvpj.exec:\5jvpj.exe44⤵
- Executes dropped EXE
-
\??\c:\flxxxfx.exec:\flxxxfx.exe45⤵
- Executes dropped EXE
-
\??\c:\xxxrrrr.exec:\xxxrrrr.exe46⤵
- Executes dropped EXE
-
\??\c:\xxllrrf.exec:\xxllrrf.exe47⤵
- Executes dropped EXE
-
\??\c:\tttttt.exec:\tttttt.exe48⤵
- Executes dropped EXE
-
\??\c:\dvjjd.exec:\dvjjd.exe49⤵
- Executes dropped EXE
-
\??\c:\jdjjp.exec:\jdjjp.exe50⤵
- Executes dropped EXE
-
\??\c:\xrfrfff.exec:\xrfrfff.exe51⤵
- Executes dropped EXE
-
\??\c:\xxfrlff.exec:\xxfrlff.exe52⤵
- Executes dropped EXE
-
\??\c:\tttthh.exec:\tttthh.exe53⤵
- Executes dropped EXE
-
\??\c:\1ppjj.exec:\1ppjj.exe54⤵
- Executes dropped EXE
-
\??\c:\5pvjd.exec:\5pvjd.exe55⤵
- Executes dropped EXE
-
\??\c:\fllfxxx.exec:\fllfxxx.exe56⤵
- Executes dropped EXE
-
\??\c:\lfxflll.exec:\lfxflll.exe57⤵
- Executes dropped EXE
-
\??\c:\ttnnhh.exec:\ttnnhh.exe58⤵
- Executes dropped EXE
-
\??\c:\bbtnhh.exec:\bbtnhh.exe59⤵
- Executes dropped EXE
-
\??\c:\ppdvp.exec:\ppdvp.exe60⤵
- Executes dropped EXE
-
\??\c:\jpjvv.exec:\jpjvv.exe61⤵
- Executes dropped EXE
-
\??\c:\1rllfff.exec:\1rllfff.exe62⤵
- Executes dropped EXE
-
\??\c:\nnbhtt.exec:\nnbhtt.exe63⤵
- Executes dropped EXE
-
\??\c:\5nttnb.exec:\5nttnb.exe64⤵
- Executes dropped EXE
-
\??\c:\bhtttt.exec:\bhtttt.exe65⤵
- Executes dropped EXE
-
\??\c:\1jppp.exec:\1jppp.exe66⤵
-
\??\c:\rlllfll.exec:\rlllfll.exe67⤵
-
\??\c:\fxlrlrx.exec:\fxlrlrx.exe68⤵
-
\??\c:\1rxxxff.exec:\1rxxxff.exe69⤵
-
\??\c:\7htttt.exec:\7htttt.exe70⤵
-
\??\c:\nnbbth.exec:\nnbbth.exe71⤵
-
\??\c:\vvjjp.exec:\vvjjp.exe72⤵
-
\??\c:\pvvpj.exec:\pvvpj.exe73⤵
-
\??\c:\1llfxxx.exec:\1llfxxx.exe74⤵
-
\??\c:\lllllll.exec:\lllllll.exe75⤵
-
\??\c:\3lfllll.exec:\3lfllll.exe76⤵
-
\??\c:\3nnnhn.exec:\3nnnhn.exe77⤵
-
\??\c:\tbhhtt.exec:\tbhhtt.exe78⤵
-
\??\c:\hbhbbb.exec:\hbhbbb.exe79⤵
-
\??\c:\vjppj.exec:\vjppj.exe80⤵
-
\??\c:\jpddd.exec:\jpddd.exe81⤵
-
\??\c:\lflfxxx.exec:\lflfxxx.exe82⤵
-
\??\c:\lrrllrr.exec:\lrrllrr.exe83⤵
-
\??\c:\tntttt.exec:\tntttt.exe84⤵
-
\??\c:\hhtntn.exec:\hhtntn.exe85⤵
-
\??\c:\dpjpp.exec:\dpjpp.exe86⤵
-
\??\c:\jdjjd.exec:\jdjjd.exe87⤵
-
\??\c:\xrlfxxx.exec:\xrlfxxx.exe88⤵
-
\??\c:\frxrlll.exec:\frxrlll.exe89⤵
-
\??\c:\tntbtb.exec:\tntbtb.exe90⤵
-
\??\c:\3vpvd.exec:\3vpvd.exe91⤵
-
\??\c:\jpddj.exec:\jpddj.exe92⤵
-
\??\c:\xllrlrr.exec:\xllrlrr.exe93⤵
-
\??\c:\5ffffff.exec:\5ffffff.exe94⤵
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe95⤵
-
\??\c:\7hbbtt.exec:\7hbbtt.exe96⤵
-
\??\c:\hbbbtt.exec:\hbbbtt.exe97⤵
-
\??\c:\ddvpd.exec:\ddvpd.exe98⤵
-
\??\c:\dvvpv.exec:\dvvpv.exe99⤵
-
\??\c:\lfffxff.exec:\lfffxff.exe100⤵
-
\??\c:\1xxxxxf.exec:\1xxxxxf.exe101⤵
-
\??\c:\hbnhtt.exec:\hbnhtt.exe102⤵
-
\??\c:\tnbbbn.exec:\tnbbbn.exe103⤵
-
\??\c:\ppvpv.exec:\ppvpv.exe104⤵
-
\??\c:\vdpdj.exec:\vdpdj.exe105⤵
-
\??\c:\frxrrrr.exec:\frxrrrr.exe106⤵
-
\??\c:\xxxrllf.exec:\xxxrllf.exe107⤵
-
\??\c:\tbhhhh.exec:\tbhhhh.exe108⤵
-
\??\c:\bhhhbb.exec:\bhhhbb.exe109⤵
-
\??\c:\jvddp.exec:\jvddp.exe110⤵
-
\??\c:\9pvpj.exec:\9pvpj.exe111⤵
-
\??\c:\xllrlrl.exec:\xllrlrl.exe112⤵
-
\??\c:\rlffxxx.exec:\rlffxxx.exe113⤵
-
\??\c:\tthhhb.exec:\tthhhb.exe114⤵
-
\??\c:\pdpvv.exec:\pdpvv.exe115⤵
-
\??\c:\rlrlfff.exec:\rlrlfff.exe116⤵
-
\??\c:\ffxlfrr.exec:\ffxlfrr.exe117⤵
-
\??\c:\bbttbb.exec:\bbttbb.exe118⤵
-
\??\c:\vvppp.exec:\vvppp.exe119⤵
-
\??\c:\jpjjv.exec:\jpjjv.exe120⤵
-
\??\c:\jjdvj.exec:\jjdvj.exe121⤵
-
\??\c:\flrllxx.exec:\flrllxx.exe122⤵
-
\??\c:\llllxxf.exec:\llllxxf.exe123⤵
-
\??\c:\nhbbbb.exec:\nhbbbb.exe124⤵
-
\??\c:\3bnhtt.exec:\3bnhtt.exe125⤵
-
\??\c:\jdpvv.exec:\jdpvv.exe126⤵
-
\??\c:\pjpjp.exec:\pjpjp.exe127⤵
-
\??\c:\rlxxrrl.exec:\rlxxrrl.exe128⤵
-
\??\c:\rrlfxfx.exec:\rrlfxfx.exe129⤵
-
\??\c:\1hhhhh.exec:\1hhhhh.exe130⤵
-
\??\c:\tnnnbb.exec:\tnnnbb.exe131⤵
-
\??\c:\jdjdd.exec:\jdjdd.exe132⤵
-
\??\c:\7rrfxxl.exec:\7rrfxxl.exe133⤵
-
\??\c:\bhtbtb.exec:\bhtbtb.exe134⤵
-
\??\c:\dpjjp.exec:\dpjjp.exe135⤵
-
\??\c:\vvvvp.exec:\vvvvp.exe136⤵
-
\??\c:\dpjjj.exec:\dpjjj.exe137⤵
-
\??\c:\5lrlffx.exec:\5lrlffx.exe138⤵
-
\??\c:\btbbnn.exec:\btbbnn.exe139⤵
-
\??\c:\hbbtnt.exec:\hbbtnt.exe140⤵
-
\??\c:\thnnhb.exec:\thnnhb.exe141⤵
-
\??\c:\7ppdp.exec:\7ppdp.exe142⤵
-
\??\c:\pppdp.exec:\pppdp.exe143⤵
-
\??\c:\llllxfx.exec:\llllxfx.exe144⤵
-
\??\c:\hnhnhh.exec:\hnhnhh.exe145⤵
-
\??\c:\thttnn.exec:\thttnn.exe146⤵
-
\??\c:\7nhhbb.exec:\7nhhbb.exe147⤵
-
\??\c:\pjjjd.exec:\pjjjd.exe148⤵
-
\??\c:\xfrrlll.exec:\xfrrlll.exe149⤵
-
\??\c:\llllfll.exec:\llllfll.exe150⤵
-
\??\c:\llxlffr.exec:\llxlffr.exe151⤵
-
\??\c:\tnttnn.exec:\tnttnn.exe152⤵
-
\??\c:\bbhttt.exec:\bbhttt.exe153⤵
-
\??\c:\pvvvp.exec:\pvvvp.exe154⤵
-
\??\c:\djppj.exec:\djppj.exe155⤵
-
\??\c:\jdvpv.exec:\jdvpv.exe156⤵
-
\??\c:\xrxfflr.exec:\xrxfflr.exe157⤵
-
\??\c:\fxrrlrr.exec:\fxrrlrr.exe158⤵
-
\??\c:\ttthht.exec:\ttthht.exe159⤵
-
\??\c:\tbhhhn.exec:\tbhhhn.exe160⤵
-
\??\c:\jvddd.exec:\jvddd.exe161⤵
-
\??\c:\ddppp.exec:\ddppp.exe162⤵
-
\??\c:\xxllxff.exec:\xxllxff.exe163⤵
-
\??\c:\ffxlffr.exec:\ffxlffr.exe164⤵
-
\??\c:\tttttt.exec:\tttttt.exe165⤵
-
\??\c:\7nnnbn.exec:\7nnnbn.exe166⤵
-
\??\c:\jvddp.exec:\jvddp.exe167⤵
-
\??\c:\1vpvj.exec:\1vpvj.exe168⤵
-
\??\c:\jpppp.exec:\jpppp.exe169⤵
-
\??\c:\llrrxxx.exec:\llrrxxx.exe170⤵
-
\??\c:\3flxxll.exec:\3flxxll.exe171⤵
-
\??\c:\dppjj.exec:\dppjj.exe172⤵
-
\??\c:\fflxxxf.exec:\fflxxxf.exe173⤵
-
\??\c:\rrxxxfl.exec:\rrxxxfl.exe174⤵
-
\??\c:\rlxrrrx.exec:\rlxrrrx.exe175⤵
-
\??\c:\7nbbtt.exec:\7nbbtt.exe176⤵
-
\??\c:\5bnttb.exec:\5bnttb.exe177⤵
-
\??\c:\jjjvv.exec:\jjjvv.exe178⤵
-
\??\c:\dvjdd.exec:\dvjdd.exe179⤵
-
\??\c:\frlfxfx.exec:\frlfxfx.exe180⤵
-
\??\c:\rxfxxxr.exec:\rxfxxxr.exe181⤵
-
\??\c:\hntnhn.exec:\hntnhn.exe182⤵
-
\??\c:\bttnbh.exec:\bttnbh.exe183⤵
-
\??\c:\tntbht.exec:\tntbht.exe184⤵
-
\??\c:\ddjdv.exec:\ddjdv.exe185⤵
-
\??\c:\9vdvp.exec:\9vdvp.exe186⤵
-
\??\c:\1xlrxxx.exec:\1xlrxxx.exe187⤵
-
\??\c:\llxxffl.exec:\llxxffl.exe188⤵
-
\??\c:\1bnhbh.exec:\1bnhbh.exe189⤵
-
\??\c:\tnhhtb.exec:\tnhhtb.exe190⤵
-
\??\c:\dvpjd.exec:\dvpjd.exe191⤵
-
\??\c:\ddjdv.exec:\ddjdv.exe192⤵
-
\??\c:\llxlfff.exec:\llxlfff.exe193⤵
-
\??\c:\xrlllrr.exec:\xrlllrr.exe194⤵
-
\??\c:\fxffflr.exec:\fxffflr.exe195⤵
-
\??\c:\3bbtth.exec:\3bbtth.exe196⤵
-
\??\c:\nhnntb.exec:\nhnntb.exe197⤵
-
\??\c:\dpppj.exec:\dpppj.exe198⤵
-
\??\c:\vdvvv.exec:\vdvvv.exe199⤵
-
\??\c:\9flrllr.exec:\9flrllr.exe200⤵
-
\??\c:\llrrrrr.exec:\llrrrrr.exe201⤵
-
\??\c:\nnhnbt.exec:\nnhnbt.exe202⤵
-
\??\c:\nbhntb.exec:\nbhntb.exe203⤵
-
\??\c:\9jjjd.exec:\9jjjd.exe204⤵
-
\??\c:\jpvvd.exec:\jpvvd.exe205⤵
-
\??\c:\xlrllll.exec:\xlrllll.exe206⤵
-
\??\c:\ffxfllx.exec:\ffxfllx.exe207⤵
-
\??\c:\1lrrlrr.exec:\1lrrlrr.exe208⤵
-
\??\c:\nhbbtt.exec:\nhbbtt.exe209⤵
-
\??\c:\hnnnbt.exec:\hnnnbt.exe210⤵
-
\??\c:\vdvjp.exec:\vdvjp.exe211⤵
-
\??\c:\fxrlxff.exec:\fxrlxff.exe212⤵
-
\??\c:\ffxfrfx.exec:\ffxfrfx.exe213⤵
-
\??\c:\9hnbbb.exec:\9hnbbb.exe214⤵
-
\??\c:\ppvvv.exec:\ppvvv.exe215⤵
-
\??\c:\vjjdp.exec:\vjjdp.exe216⤵
-
\??\c:\rrflxll.exec:\rrflxll.exe217⤵
-
\??\c:\thhhbh.exec:\thhhbh.exe218⤵
-
\??\c:\pvvpj.exec:\pvvpj.exe219⤵
-
\??\c:\ddvvp.exec:\ddvvp.exe220⤵
-
\??\c:\frxrxxx.exec:\frxrxxx.exe221⤵
-
\??\c:\9tbttb.exec:\9tbttb.exe222⤵
-
\??\c:\tnbthh.exec:\tnbthh.exe223⤵
-
\??\c:\vjjpv.exec:\vjjpv.exe224⤵
-
\??\c:\xxllxff.exec:\xxllxff.exe225⤵
-
\??\c:\fxxrllx.exec:\fxxrllx.exe226⤵
-
\??\c:\httttt.exec:\httttt.exe227⤵
-
\??\c:\jvvjv.exec:\jvvjv.exe228⤵
-
\??\c:\pvjdp.exec:\pvjdp.exe229⤵
-
\??\c:\llxfrxl.exec:\llxfrxl.exe230⤵
-
\??\c:\rrrrrrr.exec:\rrrrrrr.exe231⤵
-
\??\c:\nnhhhh.exec:\nnhhhh.exe232⤵
-
\??\c:\vdjdv.exec:\vdjdv.exe233⤵
-
\??\c:\jjjdv.exec:\jjjdv.exe234⤵
-
\??\c:\lffxrrr.exec:\lffxrrr.exe235⤵
-
\??\c:\rlxrfrf.exec:\rlxrfrf.exe236⤵
-
\??\c:\bnttbn.exec:\bnttbn.exe237⤵
-
\??\c:\vppjp.exec:\vppjp.exe238⤵
-
\??\c:\dddvv.exec:\dddvv.exe239⤵
-
\??\c:\rrxrlrr.exec:\rrxrlrr.exe240⤵
-
\??\c:\3tttnt.exec:\3tttnt.exe241⤵