Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 19:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1d8db73d352bdece316df0f381ccf74bfc9998789b68d311b348c37197f68f36.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
1d8db73d352bdece316df0f381ccf74bfc9998789b68d311b348c37197f68f36.exe
-
Size
76KB
-
MD5
803cccb715ccf18e0804751fe6d15406
-
SHA1
0a4c38c1f0f4f5b0a4e489c78eecec9283197cbd
-
SHA256
1d8db73d352bdece316df0f381ccf74bfc9998789b68d311b348c37197f68f36
-
SHA512
1b00a11c9e04fca68ff1063bb9495081d10005498cfec9b9e77ee6d648bbeeb1a799f6c98d93c29874711594d45036b41d6d87c90b0832a7488194743634a4ee
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrAw:ymb3NkkiQ3mdBjFIIp9L9QrrAw
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral2/memory/3988-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3716-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1572-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3108-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1960-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1280-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3940-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2184-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1836-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2124-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3808-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3104-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/8-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3140-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2312-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3168-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2496-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/264-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1920-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4308-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
flllffx.exerlfrlll.exethnhbh.exepppvp.exexrflfxx.exellrlxxr.exehbhbth.exe1hhbnn.exejdvpj.exejvpjv.exe7xffxff.exetnnnhh.exebhtnht.exe1pjdv.exellffrrr.exerrxrlff.exehnttnn.exenhnhbb.exepjdpj.exe1llfxxr.exelrrflfx.exenhhbtt.exeddvvj.exejvjdv.exexrrfffx.exehhntnn.exenntbnn.exe1dpjd.exevdpjd.exelxxrrlr.exe7hbttn.exebhnnnn.exevvvpp.exejjpjv.exefxxxllx.exexxrrrxx.exebbntbb.exevpdvv.exerlfxxrl.exefxxxlll.exetnnhbb.exe1ppdv.exejvpdv.exexflrxll.exellflfff.exehtbhtn.exe1ddvp.exexfxrrll.exennbttn.exehnhhbn.exevjppp.exe9xfxlfl.exe5hnhbb.exethttnn.exejvvvj.exerlrlllf.exe3xrxrxr.exenhhhbb.exenhhttt.exedjvvj.exe7vvjv.exe7fxrllf.exe3frrrlf.exe7nhttt.exepid process 3716 flllffx.exe 1572 rlfrlll.exe 3108 thnhbh.exe 1960 pppvp.exe 1280 xrflfxx.exe 3940 llrlxxr.exe 2184 hbhbth.exe 1836 1hhbnn.exe 2124 jdvpj.exe 4568 jvpjv.exe 3808 7xffxff.exe 4600 tnnnhh.exe 4468 bhtnht.exe 3104 1pjdv.exe 8 llffrrr.exe 5008 rrxrlff.exe 3928 hnttnn.exe 3140 nhnhbb.exe 2312 pjdpj.exe 4372 1llfxxr.exe 3168 lrrflfx.exe 2196 nhhbtt.exe 2496 ddvvj.exe 4044 jvjdv.exe 408 xrrfffx.exe 4480 hhntnn.exe 264 nntbnn.exe 4464 1dpjd.exe 1920 vdpjd.exe 3760 lxxrrlr.exe 4308 7hbttn.exe 1916 bhnnnn.exe 2400 vvvpp.exe 1476 jjpjv.exe 4604 fxxxllx.exe 3544 xxrrrxx.exe 4216 bbntbb.exe 4336 vpdvv.exe 2964 rlfxxrl.exe 1552 fxxxlll.exe 3716 tnnhbb.exe 3192 1ppdv.exe 2860 jvpdv.exe 3776 xflrxll.exe 1196 llflfff.exe 2684 htbhtn.exe 3556 1ddvp.exe 4532 xfxrrll.exe 2244 nnbttn.exe 4568 hnhhbn.exe 4832 vjppp.exe 4884 9xfxlfl.exe 3540 5hnhbb.exe 1732 thttnn.exe 3704 jvvvj.exe 3520 rlrlllf.exe 4088 3xrxrxr.exe 840 nhhhbb.exe 3524 nhhttt.exe 2568 djvvj.exe 2000 7vvjv.exe 3060 7fxrllf.exe 2256 3frrrlf.exe 2196 7nhttt.exe -
Processes:
resource yara_rule behavioral2/memory/3988-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3716-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1572-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3108-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1960-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1280-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3940-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2184-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1836-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1836-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2124-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4568-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3808-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3104-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/8-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3140-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3168-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2496-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/264-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1920-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1d8db73d352bdece316df0f381ccf74bfc9998789b68d311b348c37197f68f36.exeflllffx.exerlfrlll.exethnhbh.exepppvp.exexrflfxx.exellrlxxr.exehbhbth.exe1hhbnn.exejdvpj.exejvpjv.exe7xffxff.exetnnnhh.exebhtnht.exe1pjdv.exellffrrr.exerrxrlff.exehnttnn.exenhnhbb.exepjdpj.exe1llfxxr.exelrrflfx.exedescription pid process target process PID 3988 wrote to memory of 3716 3988 1d8db73d352bdece316df0f381ccf74bfc9998789b68d311b348c37197f68f36.exe flllffx.exe PID 3988 wrote to memory of 3716 3988 1d8db73d352bdece316df0f381ccf74bfc9998789b68d311b348c37197f68f36.exe flllffx.exe PID 3988 wrote to memory of 3716 3988 1d8db73d352bdece316df0f381ccf74bfc9998789b68d311b348c37197f68f36.exe flllffx.exe PID 3716 wrote to memory of 1572 3716 flllffx.exe rlfrlll.exe PID 3716 wrote to memory of 1572 3716 flllffx.exe rlfrlll.exe PID 3716 wrote to memory of 1572 3716 flllffx.exe rlfrlll.exe PID 1572 wrote to memory of 3108 1572 rlfrlll.exe thnhbh.exe PID 1572 wrote to memory of 3108 1572 rlfrlll.exe thnhbh.exe PID 1572 wrote to memory of 3108 1572 rlfrlll.exe thnhbh.exe PID 3108 wrote to memory of 1960 3108 thnhbh.exe pppvp.exe PID 3108 wrote to memory of 1960 3108 thnhbh.exe pppvp.exe PID 3108 wrote to memory of 1960 3108 thnhbh.exe pppvp.exe PID 1960 wrote to memory of 1280 1960 pppvp.exe xrflfxx.exe PID 1960 wrote to memory of 1280 1960 pppvp.exe xrflfxx.exe PID 1960 wrote to memory of 1280 1960 pppvp.exe xrflfxx.exe PID 1280 wrote to memory of 3940 1280 xrflfxx.exe llrlxxr.exe PID 1280 wrote to memory of 3940 1280 xrflfxx.exe llrlxxr.exe PID 1280 wrote to memory of 3940 1280 xrflfxx.exe llrlxxr.exe PID 3940 wrote to memory of 2184 3940 llrlxxr.exe hbhbth.exe PID 3940 wrote to memory of 2184 3940 llrlxxr.exe hbhbth.exe PID 3940 wrote to memory of 2184 3940 llrlxxr.exe hbhbth.exe PID 2184 wrote to memory of 1836 2184 hbhbth.exe 1hhbnn.exe PID 2184 wrote to memory of 1836 2184 hbhbth.exe 1hhbnn.exe PID 2184 wrote to memory of 1836 2184 hbhbth.exe 1hhbnn.exe PID 1836 wrote to memory of 2124 1836 1hhbnn.exe jdvpj.exe PID 1836 wrote to memory of 2124 1836 1hhbnn.exe jdvpj.exe PID 1836 wrote to memory of 2124 1836 1hhbnn.exe jdvpj.exe PID 2124 wrote to memory of 4568 2124 jdvpj.exe jvpjv.exe PID 2124 wrote to memory of 4568 2124 jdvpj.exe jvpjv.exe PID 2124 wrote to memory of 4568 2124 jdvpj.exe jvpjv.exe PID 4568 wrote to memory of 3808 4568 jvpjv.exe 7xffxff.exe PID 4568 wrote to memory of 3808 4568 jvpjv.exe 7xffxff.exe PID 4568 wrote to memory of 3808 4568 jvpjv.exe 7xffxff.exe PID 3808 wrote to memory of 4600 3808 7xffxff.exe tnnnhh.exe PID 3808 wrote to memory of 4600 3808 7xffxff.exe tnnnhh.exe PID 3808 wrote to memory of 4600 3808 7xffxff.exe tnnnhh.exe PID 4600 wrote to memory of 4468 4600 tnnnhh.exe bhtnht.exe PID 4600 wrote to memory of 4468 4600 tnnnhh.exe bhtnht.exe PID 4600 wrote to memory of 4468 4600 tnnnhh.exe bhtnht.exe PID 4468 wrote to memory of 3104 4468 bhtnht.exe 1pjdv.exe PID 4468 wrote to memory of 3104 4468 bhtnht.exe 1pjdv.exe PID 4468 wrote to memory of 3104 4468 bhtnht.exe 1pjdv.exe PID 3104 wrote to memory of 8 3104 1pjdv.exe llffrrr.exe PID 3104 wrote to memory of 8 3104 1pjdv.exe llffrrr.exe PID 3104 wrote to memory of 8 3104 1pjdv.exe llffrrr.exe PID 8 wrote to memory of 5008 8 llffrrr.exe rrxrlff.exe PID 8 wrote to memory of 5008 8 llffrrr.exe rrxrlff.exe PID 8 wrote to memory of 5008 8 llffrrr.exe rrxrlff.exe PID 5008 wrote to memory of 3928 5008 rrxrlff.exe hnttnn.exe PID 5008 wrote to memory of 3928 5008 rrxrlff.exe hnttnn.exe PID 5008 wrote to memory of 3928 5008 rrxrlff.exe hnttnn.exe PID 3928 wrote to memory of 3140 3928 hnttnn.exe nhnhbb.exe PID 3928 wrote to memory of 3140 3928 hnttnn.exe nhnhbb.exe PID 3928 wrote to memory of 3140 3928 hnttnn.exe nhnhbb.exe PID 3140 wrote to memory of 2312 3140 nhnhbb.exe pjdpj.exe PID 3140 wrote to memory of 2312 3140 nhnhbb.exe pjdpj.exe PID 3140 wrote to memory of 2312 3140 nhnhbb.exe pjdpj.exe PID 2312 wrote to memory of 4372 2312 pjdpj.exe 1llfxxr.exe PID 2312 wrote to memory of 4372 2312 pjdpj.exe 1llfxxr.exe PID 2312 wrote to memory of 4372 2312 pjdpj.exe 1llfxxr.exe PID 4372 wrote to memory of 3168 4372 1llfxxr.exe lrrflfx.exe PID 4372 wrote to memory of 3168 4372 1llfxxr.exe lrrflfx.exe PID 4372 wrote to memory of 3168 4372 1llfxxr.exe lrrflfx.exe PID 3168 wrote to memory of 2196 3168 lrrflfx.exe nhhbtt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d8db73d352bdece316df0f381ccf74bfc9998789b68d311b348c37197f68f36.exe"C:\Users\Admin\AppData\Local\Temp\1d8db73d352bdece316df0f381ccf74bfc9998789b68d311b348c37197f68f36.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\flllffx.exec:\flllffx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlfrlll.exec:\rlfrlll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thnhbh.exec:\thnhbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pppvp.exec:\pppvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrflfxx.exec:\xrflfxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llrlxxr.exec:\llrlxxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbhbth.exec:\hbhbth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1hhbnn.exec:\1hhbnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdvpj.exec:\jdvpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvpjv.exec:\jvpjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7xffxff.exec:\7xffxff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnnnhh.exec:\tnnnhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhtnht.exec:\bhtnht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1pjdv.exec:\1pjdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llffrrr.exec:\llffrrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrxrlff.exec:\rrxrlff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hnttnn.exec:\hnttnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhnhbb.exec:\nhnhbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjdpj.exec:\pjdpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1llfxxr.exec:\1llfxxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrrflfx.exec:\lrrflfx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhhbtt.exec:\nhhbtt.exe23⤵
- Executes dropped EXE
-
\??\c:\ddvvj.exec:\ddvvj.exe24⤵
- Executes dropped EXE
-
\??\c:\jvjdv.exec:\jvjdv.exe25⤵
- Executes dropped EXE
-
\??\c:\xrrfffx.exec:\xrrfffx.exe26⤵
- Executes dropped EXE
-
\??\c:\hhntnn.exec:\hhntnn.exe27⤵
- Executes dropped EXE
-
\??\c:\nntbnn.exec:\nntbnn.exe28⤵
- Executes dropped EXE
-
\??\c:\1dpjd.exec:\1dpjd.exe29⤵
- Executes dropped EXE
-
\??\c:\vdpjd.exec:\vdpjd.exe30⤵
- Executes dropped EXE
-
\??\c:\lxxrrlr.exec:\lxxrrlr.exe31⤵
- Executes dropped EXE
-
\??\c:\7hbttn.exec:\7hbttn.exe32⤵
- Executes dropped EXE
-
\??\c:\bhnnnn.exec:\bhnnnn.exe33⤵
- Executes dropped EXE
-
\??\c:\vvvpp.exec:\vvvpp.exe34⤵
- Executes dropped EXE
-
\??\c:\jjpjv.exec:\jjpjv.exe35⤵
- Executes dropped EXE
-
\??\c:\fxxxllx.exec:\fxxxllx.exe36⤵
- Executes dropped EXE
-
\??\c:\xxrrrxx.exec:\xxrrrxx.exe37⤵
- Executes dropped EXE
-
\??\c:\bbntbb.exec:\bbntbb.exe38⤵
- Executes dropped EXE
-
\??\c:\vpdvv.exec:\vpdvv.exe39⤵
- Executes dropped EXE
-
\??\c:\rlfxxrl.exec:\rlfxxrl.exe40⤵
- Executes dropped EXE
-
\??\c:\fxxxlll.exec:\fxxxlll.exe41⤵
- Executes dropped EXE
-
\??\c:\tnnhbb.exec:\tnnhbb.exe42⤵
- Executes dropped EXE
-
\??\c:\1ppdv.exec:\1ppdv.exe43⤵
- Executes dropped EXE
-
\??\c:\jvpdv.exec:\jvpdv.exe44⤵
- Executes dropped EXE
-
\??\c:\xflrxll.exec:\xflrxll.exe45⤵
- Executes dropped EXE
-
\??\c:\llflfff.exec:\llflfff.exe46⤵
- Executes dropped EXE
-
\??\c:\htbhtn.exec:\htbhtn.exe47⤵
- Executes dropped EXE
-
\??\c:\1ddvp.exec:\1ddvp.exe48⤵
- Executes dropped EXE
-
\??\c:\xfxrrll.exec:\xfxrrll.exe49⤵
- Executes dropped EXE
-
\??\c:\nnbttn.exec:\nnbttn.exe50⤵
- Executes dropped EXE
-
\??\c:\hnhhbn.exec:\hnhhbn.exe51⤵
- Executes dropped EXE
-
\??\c:\vjppp.exec:\vjppp.exe52⤵
- Executes dropped EXE
-
\??\c:\9xfxlfl.exec:\9xfxlfl.exe53⤵
- Executes dropped EXE
-
\??\c:\5hnhbb.exec:\5hnhbb.exe54⤵
- Executes dropped EXE
-
\??\c:\thttnn.exec:\thttnn.exe55⤵
- Executes dropped EXE
-
\??\c:\jvvvj.exec:\jvvvj.exe56⤵
- Executes dropped EXE
-
\??\c:\rlrlllf.exec:\rlrlllf.exe57⤵
- Executes dropped EXE
-
\??\c:\3xrxrxr.exec:\3xrxrxr.exe58⤵
- Executes dropped EXE
-
\??\c:\nhhhbb.exec:\nhhhbb.exe59⤵
- Executes dropped EXE
-
\??\c:\nhhttt.exec:\nhhttt.exe60⤵
- Executes dropped EXE
-
\??\c:\djvvj.exec:\djvvj.exe61⤵
- Executes dropped EXE
-
\??\c:\7vvjv.exec:\7vvjv.exe62⤵
- Executes dropped EXE
-
\??\c:\7fxrllf.exec:\7fxrllf.exe63⤵
- Executes dropped EXE
-
\??\c:\3frrrlf.exec:\3frrrlf.exe64⤵
- Executes dropped EXE
-
\??\c:\7nhttt.exec:\7nhttt.exe65⤵
- Executes dropped EXE
-
\??\c:\bhttnt.exec:\bhttnt.exe66⤵
-
\??\c:\1dppj.exec:\1dppj.exe67⤵
-
\??\c:\dpvpd.exec:\dpvpd.exe68⤵
-
\??\c:\fxfxxxr.exec:\fxfxxxr.exe69⤵
-
\??\c:\xlfxrrl.exec:\xlfxrrl.exe70⤵
-
\??\c:\1nttbb.exec:\1nttbb.exe71⤵
-
\??\c:\7nbttn.exec:\7nbttn.exe72⤵
-
\??\c:\dpdpj.exec:\dpdpj.exe73⤵
-
\??\c:\pdddv.exec:\pdddv.exe74⤵
-
\??\c:\llxrlrr.exec:\llxrlrr.exe75⤵
-
\??\c:\rxxxrrl.exec:\rxxxrrl.exe76⤵
-
\??\c:\5nhhbh.exec:\5nhhbh.exe77⤵
-
\??\c:\vjpvp.exec:\vjpvp.exe78⤵
-
\??\c:\jvpjj.exec:\jvpjj.exe79⤵
-
\??\c:\xlllxxl.exec:\xlllxxl.exe80⤵
-
\??\c:\xrrrrxx.exec:\xrrrrxx.exe81⤵
-
\??\c:\bhnnhh.exec:\bhnnhh.exe82⤵
-
\??\c:\bbnnbb.exec:\bbnnbb.exe83⤵
-
\??\c:\dpvvv.exec:\dpvvv.exe84⤵
-
\??\c:\vpjvp.exec:\vpjvp.exe85⤵
-
\??\c:\lffrlrl.exec:\lffrlrl.exe86⤵
-
\??\c:\rllrlfx.exec:\rllrlfx.exe87⤵
-
\??\c:\bbnbnn.exec:\bbnbnn.exe88⤵
-
\??\c:\ppdvv.exec:\ppdvv.exe89⤵
-
\??\c:\djpjv.exec:\djpjv.exe90⤵
-
\??\c:\lfxrfll.exec:\lfxrfll.exe91⤵
-
\??\c:\xlrllll.exec:\xlrllll.exe92⤵
-
\??\c:\tthnnb.exec:\tthnnb.exe93⤵
-
\??\c:\vdjdv.exec:\vdjdv.exe94⤵
-
\??\c:\rllfxxr.exec:\rllfxxr.exe95⤵
-
\??\c:\9fllllr.exec:\9fllllr.exe96⤵
-
\??\c:\htbbtn.exec:\htbbtn.exe97⤵
-
\??\c:\nhhhbb.exec:\nhhhbb.exe98⤵
-
\??\c:\ddjjj.exec:\ddjjj.exe99⤵
-
\??\c:\pdpjv.exec:\pdpjv.exe100⤵
-
\??\c:\xlllxxx.exec:\xlllxxx.exe101⤵
-
\??\c:\7rxrllf.exec:\7rxrllf.exe102⤵
-
\??\c:\hthnhh.exec:\hthnhh.exe103⤵
-
\??\c:\bttnnn.exec:\bttnnn.exe104⤵
-
\??\c:\jpvvv.exec:\jpvvv.exe105⤵
-
\??\c:\pppjd.exec:\pppjd.exe106⤵
-
\??\c:\fxxxrlf.exec:\fxxxrlf.exe107⤵
-
\??\c:\nnhhhh.exec:\nnhhhh.exe108⤵
-
\??\c:\tntnbh.exec:\tntnbh.exe109⤵
-
\??\c:\dvdvp.exec:\dvdvp.exe110⤵
-
\??\c:\lfllxxx.exec:\lfllxxx.exe111⤵
-
\??\c:\rrxxrxr.exec:\rrxxrxr.exe112⤵
-
\??\c:\hbnnnn.exec:\hbnnnn.exe113⤵
-
\??\c:\ttnnbb.exec:\ttnnbb.exe114⤵
-
\??\c:\djvvj.exec:\djvvj.exe115⤵
-
\??\c:\jpdvp.exec:\jpdvp.exe116⤵
-
\??\c:\xflfxxr.exec:\xflfxxr.exe117⤵
-
\??\c:\5xlfxxr.exec:\5xlfxxr.exe118⤵
-
\??\c:\tnhhth.exec:\tnhhth.exe119⤵
-
\??\c:\3ntnhh.exec:\3ntnhh.exe120⤵
-
\??\c:\pppdv.exec:\pppdv.exe121⤵
-
\??\c:\frrlffx.exec:\frrlffx.exe122⤵
-
\??\c:\rxlllll.exec:\rxlllll.exe123⤵
-
\??\c:\hhnnnn.exec:\hhnnnn.exe124⤵
-
\??\c:\bthhbb.exec:\bthhbb.exe125⤵
-
\??\c:\djvpj.exec:\djvpj.exe126⤵
-
\??\c:\pjjjj.exec:\pjjjj.exe127⤵
-
\??\c:\xxrrrrr.exec:\xxrrrrr.exe128⤵
-
\??\c:\fflllxr.exec:\fflllxr.exe129⤵
-
\??\c:\hhbbbb.exec:\hhbbbb.exe130⤵
-
\??\c:\9nbbhh.exec:\9nbbhh.exe131⤵
-
\??\c:\vjvdv.exec:\vjvdv.exe132⤵
-
\??\c:\vpvpj.exec:\vpvpj.exe133⤵
-
\??\c:\ffllffr.exec:\ffllffr.exe134⤵
-
\??\c:\llllflf.exec:\llllflf.exe135⤵
-
\??\c:\hbbttt.exec:\hbbttt.exe136⤵
-
\??\c:\nhtnhh.exec:\nhtnhh.exe137⤵
-
\??\c:\ddvvp.exec:\ddvvp.exe138⤵
-
\??\c:\5djdv.exec:\5djdv.exe139⤵
-
\??\c:\5rrlfff.exec:\5rrlfff.exe140⤵
-
\??\c:\xllfrlr.exec:\xllfrlr.exe141⤵
-
\??\c:\lllrrrx.exec:\lllrrrx.exe142⤵
-
\??\c:\hhnnhh.exec:\hhnnhh.exe143⤵
-
\??\c:\nthtnn.exec:\nthtnn.exe144⤵
-
\??\c:\dvddv.exec:\dvddv.exe145⤵
-
\??\c:\vpjpj.exec:\vpjpj.exe146⤵
-
\??\c:\xrfxxxx.exec:\xrfxxxx.exe147⤵
-
\??\c:\7rrllrl.exec:\7rrllrl.exe148⤵
-
\??\c:\tthhbh.exec:\tthhbh.exe149⤵
-
\??\c:\9htthh.exec:\9htthh.exe150⤵
-
\??\c:\bhttnn.exec:\bhttnn.exe151⤵
-
\??\c:\bbnnbb.exec:\bbnnbb.exe152⤵
-
\??\c:\hhnhbb.exec:\hhnhbb.exe153⤵
-
\??\c:\5dppd.exec:\5dppd.exe154⤵
-
\??\c:\7pjpv.exec:\7pjpv.exe155⤵
-
\??\c:\fxlfrrx.exec:\fxlfrrx.exe156⤵
-
\??\c:\frxfxxx.exec:\frxfxxx.exe157⤵
-
\??\c:\thnhbt.exec:\thnhbt.exe158⤵
-
\??\c:\nnbbnn.exec:\nnbbnn.exe159⤵
-
\??\c:\jjjdd.exec:\jjjdd.exe160⤵
-
\??\c:\ppdvv.exec:\ppdvv.exe161⤵
-
\??\c:\jdjdv.exec:\jdjdv.exe162⤵
-
\??\c:\rxrrfff.exec:\rxrrfff.exe163⤵
-
\??\c:\lllxxxx.exec:\lllxxxx.exe164⤵
-
\??\c:\bthhnn.exec:\bthhnn.exe165⤵
-
\??\c:\thnhbb.exec:\thnhbb.exe166⤵
-
\??\c:\5ttthh.exec:\5ttthh.exe167⤵
-
\??\c:\7dddp.exec:\7dddp.exe168⤵
-
\??\c:\flxxlxx.exec:\flxxlxx.exe169⤵
-
\??\c:\frrlxxl.exec:\frrlxxl.exe170⤵
-
\??\c:\lxxxxxx.exec:\lxxxxxx.exe171⤵
-
\??\c:\hbhhtt.exec:\hbhhtt.exe172⤵
-
\??\c:\9bbbtn.exec:\9bbbtn.exe173⤵
-
\??\c:\jvdpp.exec:\jvdpp.exe174⤵
-
\??\c:\dppjj.exec:\dppjj.exe175⤵
-
\??\c:\rllflfr.exec:\rllflfr.exe176⤵
-
\??\c:\5rxxxxr.exec:\5rxxxxr.exe177⤵
-
\??\c:\bnttnn.exec:\bnttnn.exe178⤵
-
\??\c:\bttthh.exec:\bttthh.exe179⤵
-
\??\c:\vjvvj.exec:\vjvvj.exe180⤵
-
\??\c:\jvvvd.exec:\jvvvd.exe181⤵
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe182⤵
-
\??\c:\xlxrlff.exec:\xlxrlff.exe183⤵
-
\??\c:\xrfxrxx.exec:\xrfxrxx.exe184⤵
-
\??\c:\hbtttt.exec:\hbtttt.exe185⤵
-
\??\c:\jvvjj.exec:\jvvjj.exe186⤵
-
\??\c:\1pdvp.exec:\1pdvp.exe187⤵
-
\??\c:\fxfxxfl.exec:\fxfxxfl.exe188⤵
-
\??\c:\rffffff.exec:\rffffff.exe189⤵
-
\??\c:\nnbbhh.exec:\nnbbhh.exe190⤵
-
\??\c:\3htnbh.exec:\3htnbh.exe191⤵
-
\??\c:\vpdjp.exec:\vpdjp.exe192⤵
-
\??\c:\pppjj.exec:\pppjj.exe193⤵
-
\??\c:\rlfxflf.exec:\rlfxflf.exe194⤵
-
\??\c:\lfffflf.exec:\lfffflf.exe195⤵
-
\??\c:\tthntt.exec:\tthntt.exe196⤵
-
\??\c:\bnbbtt.exec:\bnbbtt.exe197⤵
-
\??\c:\vpvvj.exec:\vpvvj.exe198⤵
-
\??\c:\rffxrrl.exec:\rffxrrl.exe199⤵
-
\??\c:\llffxxr.exec:\llffxxr.exe200⤵
-
\??\c:\xrrrlff.exec:\xrrrlff.exe201⤵
-
\??\c:\hhnntn.exec:\hhnntn.exe202⤵
-
\??\c:\3rxxlxf.exec:\3rxxlxf.exe203⤵
-
\??\c:\ffffxxx.exec:\ffffxxx.exe204⤵
-
\??\c:\btttnn.exec:\btttnn.exe205⤵
-
\??\c:\nnhbtt.exec:\nnhbtt.exe206⤵
-
\??\c:\tbtnbn.exec:\tbtnbn.exe207⤵
-
\??\c:\7dppj.exec:\7dppj.exe208⤵
-
\??\c:\5pjjv.exec:\5pjjv.exe209⤵
-
\??\c:\5xrlffx.exec:\5xrlffx.exe210⤵
-
\??\c:\jdvvd.exec:\jdvvd.exe211⤵
-
\??\c:\rrlffxf.exec:\rrlffxf.exe212⤵
-
\??\c:\hthhnh.exec:\hthhnh.exe213⤵
-
\??\c:\bthnnt.exec:\bthnnt.exe214⤵
-
\??\c:\9djjp.exec:\9djjp.exe215⤵
-
\??\c:\9pjdv.exec:\9pjdv.exe216⤵
-
\??\c:\xfffrxr.exec:\xfffrxr.exe217⤵
-
\??\c:\xrflrrf.exec:\xrflrrf.exe218⤵
-
\??\c:\lrlrllf.exec:\lrlrllf.exe219⤵
-
\??\c:\bbnntb.exec:\bbnntb.exe220⤵
-
\??\c:\thbbbb.exec:\thbbbb.exe221⤵
-
\??\c:\9jppp.exec:\9jppp.exe222⤵
-
\??\c:\ppvvv.exec:\ppvvv.exe223⤵
-
\??\c:\vvddv.exec:\vvddv.exe224⤵
-
\??\c:\rrfrxxf.exec:\rrfrxxf.exe225⤵
-
\??\c:\lffxrrf.exec:\lffxrrf.exe226⤵
-
\??\c:\bbtnnn.exec:\bbtnnn.exe227⤵
-
\??\c:\bnthnb.exec:\bnthnb.exe228⤵
-
\??\c:\7jvjv.exec:\7jvjv.exe229⤵
-
\??\c:\rrfxrrr.exec:\rrfxrrr.exe230⤵
-
\??\c:\7ppjd.exec:\7ppjd.exe231⤵
-
\??\c:\rllfxlf.exec:\rllfxlf.exe232⤵
-
\??\c:\5frrxxl.exec:\5frrxxl.exe233⤵
-
\??\c:\bbbnbb.exec:\bbbnbb.exe234⤵
-
\??\c:\tbbbtt.exec:\tbbbtt.exe235⤵
-
\??\c:\jdddv.exec:\jdddv.exe236⤵
-
\??\c:\jjdpd.exec:\jjdpd.exe237⤵
-
\??\c:\xrlxxrf.exec:\xrlxxrf.exe238⤵
-
\??\c:\xxxxrrr.exec:\xxxxrrr.exe239⤵
-
\??\c:\tnbhbb.exec:\tnbhbb.exe240⤵
-
\??\c:\5hhbbb.exec:\5hhbbb.exe241⤵