Analysis Overview
SHA256
699b5fb8c9fba4f5cf706e2aec41c4b3fbf69b139ff0950444bc8fe2aeb10b89
Threat Level: Known bad
The file 586b0bd5539aca526d396624015ac2f4_JaffaCakes118 was found to be: Known bad.
Malicious Activity Summary
Blackmoon, KrBanker
Detect Blackmoon payload
Executes dropped EXE
UPX packed file
System Location Discovery: System Language Discovery
Unsigned PE
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-10-18 16:24
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-10-18 16:24
Reported
2024-10-18 16:27
Platform
win7-20240903-en
Max time kernel
150s
Max time network
122s
Command Line
Signatures
Blackmoon, KrBanker
Detect Blackmoon payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\ffflxlr.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\lrffrll.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\7lflllx.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\jdpdp.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\vpddp.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\pjdpd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\1vjjj.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\hhthbh.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\1ttbtn.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\fxxlxfr.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\pjvdp.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\nhhtnb.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\fflffrr.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\fxxrflx.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\lffrxxf.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2316 wrote to memory of 2300 | N/A | C:\Users\Admin\AppData\Local\Temp\586b0bd5539aca526d396624015ac2f4_JaffaCakes118.exe | \??\c:\tnhhbn.exe |
| PID 2316 wrote to memory of 2300 | N/A | C:\Users\Admin\AppData\Local\Temp\586b0bd5539aca526d396624015ac2f4_JaffaCakes118.exe | \??\c:\tnhhbn.exe |
| PID 2316 wrote to memory of 2300 | N/A | C:\Users\Admin\AppData\Local\Temp\586b0bd5539aca526d396624015ac2f4_JaffaCakes118.exe | \??\c:\tnhhbn.exe |
| PID 2316 wrote to memory of 2300 | N/A | C:\Users\Admin\AppData\Local\Temp\586b0bd5539aca526d396624015ac2f4_JaffaCakes118.exe | \??\c:\tnhhbn.exe |
| PID 2300 wrote to memory of 2808 | N/A | \??\c:\tnhhbn.exe | \??\c:\pppvp.exe |
| PID 2300 wrote to memory of 2808 | N/A | \??\c:\tnhhbn.exe | \??\c:\pppvp.exe |
| PID 2300 wrote to memory of 2808 | N/A | \??\c:\tnhhbn.exe | \??\c:\pppvp.exe |
| PID 2300 wrote to memory of 2808 | N/A | \??\c:\tnhhbn.exe | \??\c:\pppvp.exe |
| PID 2808 wrote to memory of 2856 | N/A | \??\c:\pppvp.exe | \??\c:\lrflxrf.exe |
| PID 2808 wrote to memory of 2856 | N/A | \??\c:\pppvp.exe | \??\c:\lrflxrf.exe |
| PID 2808 wrote to memory of 2856 | N/A | \??\c:\pppvp.exe | \??\c:\lrflxrf.exe |
| PID 2808 wrote to memory of 2856 | N/A | \??\c:\pppvp.exe | \??\c:\lrflxrf.exe |
| PID 2856 wrote to memory of 2888 | N/A | \??\c:\lrflxrf.exe | \??\c:\1ntbht.exe |
| PID 2856 wrote to memory of 2888 | N/A | \??\c:\lrflxrf.exe | \??\c:\1ntbht.exe |
| PID 2856 wrote to memory of 2888 | N/A | \??\c:\lrflxrf.exe | \??\c:\1ntbht.exe |
| PID 2856 wrote to memory of 2888 | N/A | \??\c:\lrflxrf.exe | \??\c:\1ntbht.exe |
| PID 2888 wrote to memory of 2620 | N/A | \??\c:\1ntbht.exe | \??\c:\lffrxxf.exe |
| PID 2888 wrote to memory of 2620 | N/A | \??\c:\1ntbht.exe | \??\c:\lffrxxf.exe |
| PID 2888 wrote to memory of 2620 | N/A | \??\c:\1ntbht.exe | \??\c:\lffrxxf.exe |
| PID 2888 wrote to memory of 2620 | N/A | \??\c:\1ntbht.exe | \??\c:\lffrxxf.exe |
| PID 2620 wrote to memory of 2640 | N/A | \??\c:\lffrxxf.exe | \??\c:\xxlflrf.exe |
| PID 2620 wrote to memory of 2640 | N/A | \??\c:\lffrxxf.exe | \??\c:\xxlflrf.exe |
| PID 2620 wrote to memory of 2640 | N/A | \??\c:\lffrxxf.exe | \??\c:\xxlflrf.exe |
| PID 2620 wrote to memory of 2640 | N/A | \??\c:\lffrxxf.exe | \??\c:\xxlflrf.exe |
| PID 2640 wrote to memory of 1904 | N/A | \??\c:\xxlflrf.exe | \??\c:\ddvdp.exe |
| PID 2640 wrote to memory of 1904 | N/A | \??\c:\xxlflrf.exe | \??\c:\ddvdp.exe |
| PID 2640 wrote to memory of 1904 | N/A | \??\c:\xxlflrf.exe | \??\c:\ddvdp.exe |
| PID 2640 wrote to memory of 1904 | N/A | \??\c:\xxlflrf.exe | \??\c:\ddvdp.exe |
| PID 1904 wrote to memory of 2236 | N/A | \??\c:\ddvdp.exe | \??\c:\jdjpp.exe |
| PID 1904 wrote to memory of 2236 | N/A | \??\c:\ddvdp.exe | \??\c:\jdjpp.exe |
| PID 1904 wrote to memory of 2236 | N/A | \??\c:\ddvdp.exe | \??\c:\jdjpp.exe |
| PID 1904 wrote to memory of 2236 | N/A | \??\c:\ddvdp.exe | \??\c:\jdjpp.exe |
| PID 2236 wrote to memory of 1576 | N/A | \??\c:\jdjpp.exe | \??\c:\xrlxrxf.exe |
| PID 2236 wrote to memory of 1576 | N/A | \??\c:\jdjpp.exe | \??\c:\xrlxrxf.exe |
| PID 2236 wrote to memory of 1576 | N/A | \??\c:\jdjpp.exe | \??\c:\xrlxrxf.exe |
| PID 2236 wrote to memory of 1576 | N/A | \??\c:\jdjpp.exe | \??\c:\xrlxrxf.exe |
| PID 1576 wrote to memory of 2760 | N/A | \??\c:\xrlxrxf.exe | \??\c:\3tbntb.exe |
| PID 1576 wrote to memory of 2760 | N/A | \??\c:\xrlxrxf.exe | \??\c:\3tbntb.exe |
| PID 1576 wrote to memory of 2760 | N/A | \??\c:\xrlxrxf.exe | \??\c:\3tbntb.exe |
| PID 1576 wrote to memory of 2760 | N/A | \??\c:\xrlxrxf.exe | \??\c:\3tbntb.exe |
| PID 2760 wrote to memory of 2784 | N/A | \??\c:\3tbntb.exe | \??\c:\ppdjp.exe |
| PID 2760 wrote to memory of 2784 | N/A | \??\c:\3tbntb.exe | \??\c:\ppdjp.exe |
| PID 2760 wrote to memory of 2784 | N/A | \??\c:\3tbntb.exe | \??\c:\ppdjp.exe |
| PID 2760 wrote to memory of 2784 | N/A | \??\c:\3tbntb.exe | \??\c:\ppdjp.exe |
| PID 2784 wrote to memory of 2916 | N/A | \??\c:\ppdjp.exe | \??\c:\vvvdj.exe |
| PID 2784 wrote to memory of 2916 | N/A | \??\c:\ppdjp.exe | \??\c:\vvvdj.exe |
| PID 2784 wrote to memory of 2916 | N/A | \??\c:\ppdjp.exe | \??\c:\vvvdj.exe |
| PID 2784 wrote to memory of 2916 | N/A | \??\c:\ppdjp.exe | \??\c:\vvvdj.exe |
| PID 2916 wrote to memory of 2332 | N/A | \??\c:\vvvdj.exe | \??\c:\9rrfrfl.exe |
| PID 2916 wrote to memory of 2332 | N/A | \??\c:\vvvdj.exe | \??\c:\9rrfrfl.exe |
| PID 2916 wrote to memory of 2332 | N/A | \??\c:\vvvdj.exe | \??\c:\9rrfrfl.exe |
| PID 2916 wrote to memory of 2332 | N/A | \??\c:\vvvdj.exe | \??\c:\9rrfrfl.exe |
| PID 2332 wrote to memory of 2304 | N/A | \??\c:\9rrfrfl.exe | \??\c:\frlfflr.exe |
| PID 2332 wrote to memory of 2304 | N/A | \??\c:\9rrfrfl.exe | \??\c:\frlfflr.exe |
| PID 2332 wrote to memory of 2304 | N/A | \??\c:\9rrfrfl.exe | \??\c:\frlfflr.exe |
| PID 2332 wrote to memory of 2304 | N/A | \??\c:\9rrfrfl.exe | \??\c:\frlfflr.exe |
| PID 2304 wrote to memory of 1612 | N/A | \??\c:\frlfflr.exe | \??\c:\5bthtt.exe |
| PID 2304 wrote to memory of 1612 | N/A | \??\c:\frlfflr.exe | \??\c:\5bthtt.exe |
| PID 2304 wrote to memory of 1612 | N/A | \??\c:\frlfflr.exe | \??\c:\5bthtt.exe |
| PID 2304 wrote to memory of 1612 | N/A | \??\c:\frlfflr.exe | \??\c:\5bthtt.exe |
| PID 1612 wrote to memory of 888 | N/A | \??\c:\5bthtt.exe | \??\c:\jvpdj.exe |
| PID 1612 wrote to memory of 888 | N/A | \??\c:\5bthtt.exe | \??\c:\jvpdj.exe |
| PID 1612 wrote to memory of 888 | N/A | \??\c:\5bthtt.exe | \??\c:\jvpdj.exe |
| PID 1612 wrote to memory of 888 | N/A | \??\c:\5bthtt.exe | \??\c:\jvpdj.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\586b0bd5539aca526d396624015ac2f4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\586b0bd5539aca526d396624015ac2f4_JaffaCakes118.exe"
\??\c:\tnhhbn.exe
c:\tnhhbn.exe
\??\c:\pppvp.exe
c:\pppvp.exe
\??\c:\lrflxrf.exe
c:\lrflxrf.exe
\??\c:\1ntbht.exe
c:\1ntbht.exe
\??\c:\lffrxxf.exe
c:\lffrxxf.exe
\??\c:\xxlflrf.exe
c:\xxlflrf.exe
\??\c:\ddvdp.exe
c:\ddvdp.exe
\??\c:\jdjpp.exe
c:\jdjpp.exe
\??\c:\xrlxrxf.exe
c:\xrlxrxf.exe
\??\c:\3tbntb.exe
c:\3tbntb.exe
\??\c:\ppdjp.exe
c:\ppdjp.exe
\??\c:\vvvdj.exe
c:\vvvdj.exe
\??\c:\9rrfrfl.exe
c:\9rrfrfl.exe
\??\c:\frlfflr.exe
c:\frlfflr.exe
\??\c:\5bthtt.exe
c:\5bthtt.exe
\??\c:\jvpdj.exe
c:\jvpdj.exe
\??\c:\xxrffrf.exe
c:\xxrffrf.exe
\??\c:\7bnbbh.exe
c:\7bnbbh.exe
\??\c:\jvvjp.exe
c:\jvvjp.exe
\??\c:\dvjjd.exe
c:\dvjjd.exe
\??\c:\lfrfxxr.exe
c:\lfrfxxr.exe
\??\c:\nnnthh.exe
c:\nnnthh.exe
\??\c:\vdpjd.exe
c:\vdpjd.exe
\??\c:\lfrfllx.exe
c:\lfrfllx.exe
\??\c:\5nthth.exe
c:\5nthth.exe
\??\c:\bththt.exe
c:\bththt.exe
\??\c:\jjjpj.exe
c:\jjjpj.exe
\??\c:\xxrxxxx.exe
c:\xxrxxxx.exe
\??\c:\bbtthh.exe
c:\bbtthh.exe
\??\c:\vpjvj.exe
c:\vpjvj.exe
\??\c:\5frrxxf.exe
c:\5frrxxf.exe
\??\c:\rxrllfx.exe
c:\rxrllfx.exe
\??\c:\1nnhtn.exe
c:\1nnhtn.exe
\??\c:\vvvvj.exe
c:\vvvvj.exe
\??\c:\vvpvp.exe
c:\vvpvp.exe
\??\c:\lfxlflx.exe
c:\lfxlflx.exe
\??\c:\ttnthh.exe
c:\ttnthh.exe
\??\c:\nnhtnt.exe
c:\nnhtnt.exe
\??\c:\3dvpv.exe
c:\3dvpv.exe
\??\c:\vpvdp.exe
c:\vpvdp.exe
\??\c:\xfrlrff.exe
c:\xfrlrff.exe
\??\c:\7nthbb.exe
c:\7nthbb.exe
\??\c:\nnhtht.exe
c:\nnhtht.exe
\??\c:\vvvjd.exe
c:\vvvjd.exe
\??\c:\jddjj.exe
c:\jddjj.exe
\??\c:\xfrrxrl.exe
c:\xfrrxrl.exe
\??\c:\1lxfxfx.exe
c:\1lxfxfx.exe
\??\c:\bnbtnn.exe
c:\bnbtnn.exe
\??\c:\vvppd.exe
c:\vvppd.exe
\??\c:\ddjpd.exe
c:\ddjpd.exe
\??\c:\5llxffx.exe
c:\5llxffx.exe
\??\c:\llfxrxl.exe
c:\llfxrxl.exe
\??\c:\ntbttn.exe
c:\ntbttn.exe
\??\c:\nnbhbh.exe
c:\nnbhbh.exe
\??\c:\pppdv.exe
c:\pppdv.exe
\??\c:\ppjpd.exe
c:\ppjpd.exe
\??\c:\lxrrllx.exe
c:\lxrrllx.exe
\??\c:\ffrfrrf.exe
c:\ffrfrrf.exe
\??\c:\hhhnbb.exe
c:\hhhnbb.exe
\??\c:\9nhbhh.exe
c:\9nhbhh.exe
\??\c:\vpjjd.exe
c:\vpjjd.exe
\??\c:\3vjdj.exe
c:\3vjdj.exe
\??\c:\rxxllxl.exe
c:\rxxllxl.exe
\??\c:\xxxxxfx.exe
c:\xxxxxfx.exe
\??\c:\tnbbhb.exe
c:\tnbbhb.exe
\??\c:\pvpdj.exe
c:\pvpdj.exe
\??\c:\1pvjd.exe
c:\1pvjd.exe
\??\c:\fxrxfxf.exe
c:\fxrxfxf.exe
\??\c:\7lfxfxx.exe
c:\7lfxfxx.exe
\??\c:\thnhbh.exe
c:\thnhbh.exe
\??\c:\jvvvd.exe
c:\jvvvd.exe
\??\c:\vvpdv.exe
c:\vvpdv.exe
\??\c:\lxlxlfx.exe
c:\lxlxlfx.exe
\??\c:\tnhbnn.exe
c:\tnhbnn.exe
\??\c:\btnthh.exe
c:\btnthh.exe
\??\c:\pdppd.exe
c:\pdppd.exe
\??\c:\vpjvj.exe
c:\vpjvj.exe
\??\c:\llllxxl.exe
c:\llllxxl.exe
\??\c:\llxrfrx.exe
c:\llxrfrx.exe
\??\c:\hbnbnt.exe
c:\hbnbnt.exe
\??\c:\5jdpv.exe
c:\5jdpv.exe
\??\c:\vjddj.exe
c:\vjddj.exe
\??\c:\3fxlrfr.exe
c:\3fxlrfr.exe
\??\c:\3xxrflx.exe
c:\3xxrflx.exe
\??\c:\tthbth.exe
c:\tthbth.exe
\??\c:\bhtbhh.exe
c:\bhtbhh.exe
\??\c:\vpjdj.exe
c:\vpjdj.exe
\??\c:\fxrxllx.exe
c:\fxrxllx.exe
\??\c:\3rrllfx.exe
c:\3rrllfx.exe
\??\c:\bbbthn.exe
c:\bbbthn.exe
\??\c:\vvdpv.exe
c:\vvdpv.exe
\??\c:\dvjjp.exe
c:\dvjjp.exe
\??\c:\1xxxlrl.exe
c:\1xxxlrl.exe
\??\c:\rlxfllr.exe
c:\rlxfllr.exe
\??\c:\7bbnbh.exe
c:\7bbnbh.exe
\??\c:\dddvj.exe
c:\dddvj.exe
\??\c:\jdjjp.exe
c:\jdjjp.exe
\??\c:\fflffrr.exe
c:\fflffrr.exe
\??\c:\7frxlrl.exe
c:\7frxlrl.exe
\??\c:\hhbnbb.exe
c:\hhbnbb.exe
\??\c:\vvjjv.exe
c:\vvjjv.exe
\??\c:\jdpdd.exe
c:\jdpdd.exe
\??\c:\lxrrffr.exe
c:\lxrrffr.exe
\??\c:\xxxlxlr.exe
c:\xxxlxlr.exe
\??\c:\tththn.exe
c:\tththn.exe
\??\c:\nnbnbh.exe
c:\nnbnbh.exe
\??\c:\ddvjd.exe
c:\ddvjd.exe
\??\c:\ddpvj.exe
c:\ddpvj.exe
\??\c:\fxxxfrf.exe
c:\fxxxfrf.exe
\??\c:\5tnhbn.exe
c:\5tnhbn.exe
\??\c:\9jdvp.exe
c:\9jdvp.exe
\??\c:\vpjvv.exe
c:\vpjvv.exe
\??\c:\rxfxlff.exe
c:\rxfxlff.exe
\??\c:\hbnbth.exe
c:\hbnbth.exe
\??\c:\hhbbnt.exe
c:\hhbbnt.exe
\??\c:\7jdpj.exe
c:\7jdpj.exe
\??\c:\lllrxfl.exe
c:\lllrxfl.exe
\??\c:\rrlxxfr.exe
c:\rrlxxfr.exe
\??\c:\5hbtnb.exe
c:\5hbtnb.exe
\??\c:\tbtbth.exe
c:\tbtbth.exe
\??\c:\jdppd.exe
c:\jdppd.exe
\??\c:\vvvjj.exe
c:\vvvjj.exe
\??\c:\lfrfxxr.exe
c:\lfrfxxr.exe
\??\c:\nnbnbh.exe
c:\nnbnbh.exe
\??\c:\bbbtbh.exe
c:\bbbtbh.exe
\??\c:\7dvvj.exe
c:\7dvvj.exe
\??\c:\jdpdp.exe
c:\jdpdp.exe
\??\c:\rrlxxrl.exe
c:\rrlxxrl.exe
\??\c:\fxfxrlx.exe
c:\fxfxrlx.exe
\??\c:\7nnntb.exe
c:\7nnntb.exe
\??\c:\5hthtb.exe
c:\5hthtb.exe
\??\c:\vdddj.exe
c:\vdddj.exe
\??\c:\jdpvp.exe
c:\jdpvp.exe
\??\c:\xrfrlxl.exe
c:\xrfrlxl.exe
\??\c:\thbbtt.exe
c:\thbbtt.exe
\??\c:\7tnnnb.exe
c:\7tnnnb.exe
\??\c:\jjjjd.exe
c:\jjjjd.exe
\??\c:\9pjpj.exe
c:\9pjpj.exe
\??\c:\5llxlxl.exe
c:\5llxlxl.exe
\??\c:\rxlxrfr.exe
c:\rxlxrfr.exe
\??\c:\9nntnn.exe
c:\9nntnn.exe
\??\c:\nthnhn.exe
c:\nthnhn.exe
\??\c:\1pjdj.exe
c:\1pjdj.exe
\??\c:\rrfxrfr.exe
c:\rrfxrfr.exe
\??\c:\lffrxxf.exe
c:\lffrxxf.exe
\??\c:\3btnnt.exe
c:\3btnnt.exe
\??\c:\ttbhhn.exe
c:\ttbhhn.exe
\??\c:\dvdjd.exe
c:\dvdjd.exe
\??\c:\lxrxflr.exe
c:\lxrxflr.exe
\??\c:\rfllxfl.exe
c:\rfllxfl.exe
\??\c:\tthtnb.exe
c:\tthtnb.exe
\??\c:\nthtbn.exe
c:\nthtbn.exe
\??\c:\dvdjd.exe
c:\dvdjd.exe
\??\c:\fxrxfrr.exe
c:\fxrxfrr.exe
\??\c:\llllllf.exe
c:\llllllf.exe
\??\c:\9htnth.exe
c:\9htnth.exe
\??\c:\tnhnbn.exe
c:\tnhnbn.exe
\??\c:\pjvpd.exe
c:\pjvpd.exe
\??\c:\5jvvd.exe
c:\5jvvd.exe
\??\c:\xlrxxxl.exe
c:\xlrxxxl.exe
\??\c:\xfrfffx.exe
c:\xfrfffx.exe
\??\c:\hhbnhb.exe
c:\hhbnhb.exe
\??\c:\ttntnt.exe
c:\ttntnt.exe
\??\c:\vdjdj.exe
c:\vdjdj.exe
\??\c:\ddvdj.exe
c:\ddvdj.exe
\??\c:\rrfflrl.exe
c:\rrfflrl.exe
\??\c:\3ffxfxf.exe
c:\3ffxfxf.exe
\??\c:\7nhbhh.exe
c:\7nhbhh.exe
\??\c:\pjpdp.exe
c:\pjpdp.exe
\??\c:\dvjjv.exe
c:\dvjjv.exe
\??\c:\rflxrfx.exe
c:\rflxrfx.exe
\??\c:\9lllfrl.exe
c:\9lllfrl.exe
\??\c:\nbnhhh.exe
c:\nbnhhh.exe
\??\c:\ddvjj.exe
c:\ddvjj.exe
\??\c:\rllrxlr.exe
c:\rllrxlr.exe
\??\c:\llxlxfx.exe
c:\llxlxfx.exe
\??\c:\nntntt.exe
c:\nntntt.exe
\??\c:\bbtbtt.exe
c:\bbtbtt.exe
\??\c:\5dvjv.exe
c:\5dvjv.exe
\??\c:\3lxllfl.exe
c:\3lxllfl.exe
\??\c:\bhhntb.exe
c:\bhhntb.exe
\??\c:\djddj.exe
c:\djddj.exe
\??\c:\llrlfrf.exe
c:\llrlfrf.exe
\??\c:\rxfxfrl.exe
c:\rxfxfrl.exe
\??\c:\ttthnt.exe
c:\ttthnt.exe
\??\c:\hhntht.exe
c:\hhntht.exe
\??\c:\vvppp.exe
c:\vvppp.exe
\??\c:\3rlrllr.exe
c:\3rlrllr.exe
\??\c:\xxffrxf.exe
c:\xxffrxf.exe
\??\c:\tnnhbh.exe
c:\tnnhbh.exe
\??\c:\nhnnbh.exe
c:\nhnnbh.exe
\??\c:\vddjd.exe
c:\vddjd.exe
\??\c:\jdpdj.exe
c:\jdpdj.exe
\??\c:\fxxlxfr.exe
c:\fxxlxfr.exe
\??\c:\5fflflr.exe
c:\5fflflr.exe
\??\c:\hbtbtb.exe
c:\hbtbtb.exe
\??\c:\nthnbh.exe
c:\nthnbh.exe
\??\c:\jpjdv.exe
c:\jpjdv.exe
\??\c:\9vpvj.exe
c:\9vpvj.exe
\??\c:\3xxlxlx.exe
c:\3xxlxlx.exe
\??\c:\lfllxfr.exe
c:\lfllxfr.exe
\??\c:\nnnbnb.exe
c:\nnnbnb.exe
\??\c:\ppjpd.exe
c:\ppjpd.exe
\??\c:\jjdvv.exe
c:\jjdvv.exe
\??\c:\9lrrxfr.exe
c:\9lrrxfr.exe
\??\c:\xffxxlx.exe
c:\xffxxlx.exe
\??\c:\1bthtb.exe
c:\1bthtb.exe
\??\c:\jjdvd.exe
c:\jjdvd.exe
\??\c:\jdpvd.exe
c:\jdpvd.exe
\??\c:\fxffxxf.exe
c:\fxffxxf.exe
\??\c:\fxlxxfr.exe
c:\fxlxxfr.exe
\??\c:\5bhbhb.exe
c:\5bhbhb.exe
\??\c:\nhbhbn.exe
c:\nhbhbn.exe
\??\c:\3vdpv.exe
c:\3vdpv.exe
\??\c:\ppddj.exe
c:\ppddj.exe
\??\c:\lllrrff.exe
c:\lllrrff.exe
\??\c:\ffxlrxr.exe
c:\ffxlrxr.exe
\??\c:\btthtb.exe
c:\btthtb.exe
\??\c:\jjdjp.exe
c:\jjdjp.exe
\??\c:\pjdvp.exe
c:\pjdvp.exe
\??\c:\ffxlrxr.exe
c:\ffxlrxr.exe
\??\c:\llfxllx.exe
c:\llfxllx.exe
\??\c:\bbthtb.exe
c:\bbthtb.exe
\??\c:\tnhbbh.exe
c:\tnhbbh.exe
\??\c:\ppjdv.exe
c:\ppjdv.exe
\??\c:\pppdd.exe
c:\pppdd.exe
\??\c:\7rrfxlf.exe
c:\7rrfxlf.exe
\??\c:\bbhnnb.exe
c:\bbhnnb.exe
\??\c:\nnhthh.exe
c:\nnhthh.exe
\??\c:\jpddd.exe
c:\jpddd.exe
\??\c:\lrffrrl.exe
c:\lrffrrl.exe
\??\c:\rrxfxxl.exe
c:\rrxfxxl.exe
\??\c:\bbhnnn.exe
c:\bbhnnn.exe
\??\c:\1ddvd.exe
c:\1ddvd.exe
\??\c:\9vpjj.exe
c:\9vpjj.exe
\??\c:\ffxrxrx.exe
c:\ffxrxrx.exe
\??\c:\xllffrx.exe
c:\xllffrx.exe
\??\c:\1bbbht.exe
c:\1bbbht.exe
\??\c:\jjdpd.exe
c:\jjdpd.exe
\??\c:\9pdpv.exe
c:\9pdpv.exe
\??\c:\fxffflx.exe
c:\fxffflx.exe
\??\c:\hthnnn.exe
c:\hthnnn.exe
\??\c:\nthhtt.exe
c:\nthhtt.exe
\??\c:\5pdpv.exe
c:\5pdpv.exe
\??\c:\pjdjp.exe
c:\pjdjp.exe
\??\c:\xrlxrrf.exe
c:\xrlxrrf.exe
\??\c:\bthhtn.exe
c:\bthhtn.exe
\??\c:\nbnhnh.exe
c:\nbnhnh.exe
\??\c:\dddpj.exe
c:\dddpj.exe
\??\c:\jjjvj.exe
c:\jjjvj.exe
\??\c:\xxlrffl.exe
c:\xxlrffl.exe
\??\c:\7xxfrrf.exe
c:\7xxfrrf.exe
\??\c:\nnthtb.exe
c:\nnthtb.exe
\??\c:\1htttb.exe
c:\1htttb.exe
\??\c:\dvpdd.exe
c:\dvpdd.exe
\??\c:\lffrxlx.exe
c:\lffrxlx.exe
\??\c:\rllxffr.exe
c:\rllxffr.exe
\??\c:\3ttbhn.exe
c:\3ttbhn.exe
\??\c:\hhtnhn.exe
c:\hhtnhn.exe
\??\c:\jpddv.exe
c:\jpddv.exe
\??\c:\vvjvd.exe
c:\vvjvd.exe
\??\c:\rlfrlrf.exe
c:\rlfrlrf.exe
\??\c:\hhbbbh.exe
c:\hhbbbh.exe
\??\c:\hnhnbh.exe
c:\hnhnbh.exe
\??\c:\dpvjp.exe
c:\dpvjp.exe
\??\c:\ppjjv.exe
c:\ppjjv.exe
\??\c:\rrllxxl.exe
c:\rrllxxl.exe
\??\c:\nnhnbh.exe
c:\nnhnbh.exe
\??\c:\nhnbnb.exe
c:\nhnbnb.exe
\??\c:\9dvpv.exe
c:\9dvpv.exe
\??\c:\rlfrfrf.exe
c:\rlfrfrf.exe
\??\c:\ffrllxx.exe
c:\ffrllxx.exe
\??\c:\9thnbb.exe
c:\9thnbb.exe
\??\c:\hbtbtt.exe
c:\hbtbtt.exe
\??\c:\djvpd.exe
c:\djvpd.exe
\??\c:\lrllxlf.exe
c:\lrllxlf.exe
\??\c:\rllrlrx.exe
c:\rllrlrx.exe
\??\c:\hnhttt.exe
c:\hnhttt.exe
\??\c:\bbthnb.exe
c:\bbthnb.exe
\??\c:\ppddd.exe
c:\ppddd.exe
\??\c:\ppjpv.exe
c:\ppjpv.exe
\??\c:\lllxrlr.exe
c:\lllxrlr.exe
\??\c:\9tnbht.exe
c:\9tnbht.exe
\??\c:\1tbbnn.exe
c:\1tbbnn.exe
\??\c:\ppppd.exe
c:\ppppd.exe
\??\c:\pdvpj.exe
c:\pdvpj.exe
\??\c:\ffflxfr.exe
c:\ffflxfr.exe
\??\c:\hhhnbh.exe
c:\hhhnbh.exe
\??\c:\3nhhhh.exe
c:\3nhhhh.exe
\??\c:\9djvv.exe
c:\9djvv.exe
\??\c:\vvpvj.exe
c:\vvpvj.exe
\??\c:\xxrlrll.exe
c:\xxrlrll.exe
\??\c:\lxlrfrf.exe
c:\lxlrfrf.exe
\??\c:\hthbbb.exe
c:\hthbbb.exe
\??\c:\jvjjp.exe
c:\jvjjp.exe
\??\c:\vpppd.exe
c:\vpppd.exe
\??\c:\fxrflrf.exe
c:\fxrflrf.exe
\??\c:\1fxrlxr.exe
c:\1fxrlxr.exe
\??\c:\bbhtnn.exe
c:\bbhtnn.exe
\??\c:\9dpdp.exe
c:\9dpdp.exe
\??\c:\jjdjj.exe
c:\jjdjj.exe
\??\c:\frfxlfl.exe
c:\frfxlfl.exe
\??\c:\xxflxlf.exe
c:\xxflxlf.exe
\??\c:\nthttt.exe
c:\nthttt.exe
\??\c:\5bhntb.exe
c:\5bhntb.exe
\??\c:\vpjvp.exe
c:\vpjvp.exe
\??\c:\xxllfff.exe
c:\xxllfff.exe
\??\c:\7fflfrf.exe
c:\7fflfrf.exe
\??\c:\nhthbh.exe
c:\nhthbh.exe
\??\c:\nnhthh.exe
c:\nnhthh.exe
\??\c:\jpppp.exe
c:\jpppp.exe
\??\c:\5rrxxxx.exe
c:\5rrxxxx.exe
\??\c:\9fxlxrl.exe
c:\9fxlxrl.exe
\??\c:\hhthbh.exe
c:\hhthbh.exe
\??\c:\3bbnbb.exe
c:\3bbnbb.exe
\??\c:\9jddj.exe
c:\9jddj.exe
\??\c:\vvvvp.exe
c:\vvvvp.exe
\??\c:\rlxlxfl.exe
c:\rlxlxfl.exe
\??\c:\bhtbbh.exe
c:\bhtbbh.exe
\??\c:\tthhnn.exe
c:\tthhnn.exe
\??\c:\vpjpv.exe
c:\vpjpv.exe
\??\c:\5jvjp.exe
c:\5jvjp.exe
\??\c:\xrlxlrf.exe
c:\xrlxlrf.exe
\??\c:\hbhnbh.exe
c:\hbhnbh.exe
\??\c:\hhbbhb.exe
c:\hhbbhb.exe
\??\c:\pppvj.exe
c:\pppvj.exe
\??\c:\1lfrxlf.exe
c:\1lfrxlf.exe
\??\c:\rrflrxl.exe
c:\rrflrxl.exe
\??\c:\nnbhhh.exe
c:\nnbhhh.exe
\??\c:\1vjjj.exe
c:\1vjjj.exe
\??\c:\dvjjv.exe
c:\dvjjv.exe
\??\c:\fxfrlfx.exe
c:\fxfrlfx.exe
\??\c:\rfrxrxf.exe
c:\rfrxrxf.exe
\??\c:\hbthbn.exe
c:\hbthbn.exe
\??\c:\btbhnn.exe
c:\btbhnn.exe
\??\c:\vvdjp.exe
c:\vvdjp.exe
\??\c:\xxxfrxr.exe
c:\xxxfrxr.exe
\??\c:\rrxxxxx.exe
c:\rrxxxxx.exe
\??\c:\nnthnt.exe
c:\nnthnt.exe
\??\c:\1bhttt.exe
c:\1bhttt.exe
\??\c:\1jpvj.exe
c:\1jpvj.exe
\??\c:\lllflff.exe
c:\lllflff.exe
\??\c:\ffxrlxl.exe
c:\ffxrlxl.exe
\??\c:\thtnnh.exe
c:\thtnnh.exe
\??\c:\tnhthb.exe
c:\tnhthb.exe
\??\c:\dppjj.exe
c:\dppjj.exe
\??\c:\lxlrxxf.exe
c:\lxlrxxf.exe
\??\c:\9rxrllr.exe
c:\9rxrllr.exe
\??\c:\1tbtbb.exe
c:\1tbtbb.exe
\??\c:\btnbnb.exe
c:\btnbnb.exe
\??\c:\3pjdv.exe
c:\3pjdv.exe
\??\c:\1dvjd.exe
c:\1dvjd.exe
\??\c:\9lflrfx.exe
c:\9lflrfx.exe
\??\c:\1llfllx.exe
c:\1llfllx.exe
\??\c:\thbntt.exe
c:\thbntt.exe
\??\c:\jpddj.exe
c:\jpddj.exe
\??\c:\djjvd.exe
c:\djjvd.exe
\??\c:\rrlfxfr.exe
c:\rrlfxfr.exe
\??\c:\bnbthn.exe
c:\bnbthn.exe
\??\c:\5nnhtn.exe
c:\5nnhtn.exe
\??\c:\vddpp.exe
c:\vddpp.exe
\??\c:\xflrflf.exe
c:\xflrflf.exe
\??\c:\hhhtnt.exe
c:\hhhtnt.exe
\??\c:\jjjvj.exe
c:\jjjvj.exe
\??\c:\vpjpv.exe
c:\vpjpv.exe
\??\c:\lrllxfx.exe
c:\lrllxfx.exe
\??\c:\rlxfxll.exe
c:\rlxfxll.exe
\??\c:\bbbnhh.exe
c:\bbbnhh.exe
\??\c:\nhbhhn.exe
c:\nhbhhn.exe
\??\c:\5dvdd.exe
c:\5dvdd.exe
\??\c:\ppjvp.exe
c:\ppjvp.exe
\??\c:\7ffllfl.exe
c:\7ffllfl.exe
\??\c:\xxllxll.exe
c:\xxllxll.exe
\??\c:\ttbntb.exe
c:\ttbntb.exe
\??\c:\dpvjj.exe
c:\dpvjj.exe
\??\c:\7jvjv.exe
c:\7jvjv.exe
\??\c:\xxxxflf.exe
c:\xxxxflf.exe
\??\c:\5bnbbn.exe
c:\5bnbbn.exe
\??\c:\3tbhbn.exe
c:\3tbhbn.exe
\??\c:\ddpjv.exe
c:\ddpjv.exe
\??\c:\ddjjv.exe
c:\ddjjv.exe
\??\c:\fffxxxf.exe
c:\fffxxxf.exe
\??\c:\1lflxlx.exe
c:\1lflxlx.exe
\??\c:\5tnntb.exe
c:\5tnntb.exe
\??\c:\jppjp.exe
c:\jppjp.exe
\??\c:\vdppj.exe
c:\vdppj.exe
\??\c:\llfrflf.exe
c:\llfrflf.exe
\??\c:\fxfrrll.exe
c:\fxfrrll.exe
\??\c:\ntbbbt.exe
c:\ntbbbt.exe
\??\c:\pjdpp.exe
c:\pjdpp.exe
\??\c:\7ddpd.exe
c:\7ddpd.exe
\??\c:\lfllxxf.exe
c:\lfllxxf.exe
\??\c:\frfxfxl.exe
c:\frfxfxl.exe
\??\c:\3tttbh.exe
c:\3tttbh.exe
\??\c:\ppjpd.exe
c:\ppjpd.exe
\??\c:\1pppd.exe
c:\1pppd.exe
\??\c:\xfrllrf.exe
c:\xfrllrf.exe
\??\c:\rrlfxxl.exe
c:\rrlfxxl.exe
\??\c:\thhbnb.exe
c:\thhbnb.exe
\??\c:\pdpjp.exe
c:\pdpjp.exe
\??\c:\pvvdj.exe
c:\pvvdj.exe
\??\c:\xlrlxrx.exe
c:\xlrlxrx.exe
\??\c:\lxxrfll.exe
c:\lxxrfll.exe
\??\c:\5btbtt.exe
c:\5btbtt.exe
\??\c:\1vpdp.exe
c:\1vpdp.exe
\??\c:\5dpvd.exe
c:\5dpvd.exe
\??\c:\3fxxllx.exe
c:\3fxxllx.exe
\??\c:\7lrllfl.exe
c:\7lrllfl.exe
\??\c:\nnnhth.exe
c:\nnnhth.exe
\??\c:\nntntn.exe
c:\nntntn.exe
\??\c:\7vpjv.exe
c:\7vpjv.exe
\??\c:\xrflxlr.exe
c:\xrflxlr.exe
\??\c:\rfffrrf.exe
c:\rfffrrf.exe
\??\c:\bhthth.exe
c:\bhthth.exe
\??\c:\hnnhnb.exe
c:\hnnhnb.exe
\??\c:\9pjvj.exe
c:\9pjvj.exe
\??\c:\fflrflx.exe
c:\fflrflx.exe
\??\c:\fflxxlx.exe
c:\fflxxlx.exe
\??\c:\hntbnn.exe
c:\hntbnn.exe
\??\c:\tbtttn.exe
c:\tbtttn.exe
\??\c:\pdpjd.exe
c:\pdpjd.exe
\??\c:\rxfxlfr.exe
c:\rxfxlfr.exe
\??\c:\fxxrflx.exe
c:\fxxrflx.exe
\??\c:\thtbbh.exe
c:\thtbbh.exe
\??\c:\djdjv.exe
c:\djdjv.exe
\??\c:\1jvpj.exe
c:\1jvpj.exe
\??\c:\1lrfflx.exe
c:\1lrfflx.exe
\??\c:\rrlxxfx.exe
c:\rrlxxfx.exe
\??\c:\tbtnbn.exe
c:\tbtnbn.exe
\??\c:\dddjd.exe
c:\dddjd.exe
\??\c:\vdvvj.exe
c:\vdvvj.exe
\??\c:\xrlxrrl.exe
c:\xrlxrrl.exe
\??\c:\1lflrfr.exe
c:\1lflrfr.exe
\??\c:\1nbbnt.exe
c:\1nbbnt.exe
\??\c:\1vppv.exe
c:\1vppv.exe
\??\c:\9dvjd.exe
c:\9dvjd.exe
\??\c:\xrflxfl.exe
c:\xrflxfl.exe
\??\c:\rlfxflr.exe
c:\rlfxflr.exe
\??\c:\1nbnhh.exe
c:\1nbnhh.exe
\??\c:\bbthbt.exe
c:\bbthbt.exe
\??\c:\vvdjv.exe
c:\vvdjv.exe
\??\c:\fxrfxfr.exe
c:\fxrfxfr.exe
\??\c:\rfflxrl.exe
c:\rfflxrl.exe
\??\c:\bbbnbb.exe
c:\bbbnbb.exe
\??\c:\pjjpj.exe
c:\pjjpj.exe
\??\c:\9dvpv.exe
c:\9dvpv.exe
\??\c:\5rlrlfx.exe
c:\5rlrlfx.exe
\??\c:\fxrlfrx.exe
c:\fxrlfrx.exe
\??\c:\nnntnt.exe
c:\nnntnt.exe
\??\c:\7nnbhn.exe
c:\7nnbhn.exe
\??\c:\ppjjj.exe
c:\ppjjj.exe
\??\c:\ffrrxrr.exe
c:\ffrrxrr.exe
\??\c:\9xllffr.exe
c:\9xllffr.exe
\??\c:\btnnhh.exe
c:\btnnhh.exe
\??\c:\tnbbbh.exe
c:\tnbbbh.exe
\??\c:\djpjj.exe
c:\djpjj.exe
\??\c:\xxlrrlx.exe
c:\xxlrrlx.exe
\??\c:\flrxrfr.exe
c:\flrxrfr.exe
\??\c:\3bnttb.exe
c:\3bnttb.exe
\??\c:\nthtnt.exe
c:\nthtnt.exe
\??\c:\7djvj.exe
c:\7djvj.exe
\??\c:\xxlfrxf.exe
c:\xxlfrxf.exe
\??\c:\ffrlxlx.exe
c:\ffrlxlx.exe
\??\c:\bthtnh.exe
c:\bthtnh.exe
\??\c:\1bnbhh.exe
c:\1bnbhh.exe
\??\c:\3vjvp.exe
c:\3vjvp.exe
\??\c:\llllrfr.exe
c:\llllrfr.exe
\??\c:\ffllxrl.exe
c:\ffllxrl.exe
\??\c:\thttbb.exe
c:\thttbb.exe
\??\c:\tnbnbh.exe
c:\tnbnbh.exe
\??\c:\ppvpj.exe
c:\ppvpj.exe
\??\c:\xrlxfrf.exe
c:\xrlxfrf.exe
\??\c:\xxlrxxf.exe
c:\xxlrxxf.exe
\??\c:\9bbnbh.exe
c:\9bbnbh.exe
\??\c:\7vdpj.exe
c:\7vdpj.exe
\??\c:\pdpvj.exe
c:\pdpvj.exe
\??\c:\7lffllx.exe
c:\7lffllx.exe
\??\c:\nnbnht.exe
c:\nnbnht.exe
\??\c:\nnttnt.exe
c:\nnttnt.exe
\??\c:\dddjd.exe
c:\dddjd.exe
\??\c:\ddvjv.exe
c:\ddvjv.exe
\??\c:\xrlxrxl.exe
c:\xrlxrxl.exe
\??\c:\nnhtnt.exe
c:\nnhtnt.exe
\??\c:\hnnhnb.exe
c:\hnnhnb.exe
\??\c:\vpjpd.exe
c:\vpjpd.exe
\??\c:\rrflrrx.exe
c:\rrflrrx.exe
\??\c:\lxfxfxx.exe
c:\lxfxfxx.exe
\??\c:\tbtbbb.exe
c:\tbtbbb.exe
\??\c:\tbbbbt.exe
c:\tbbbbt.exe
\??\c:\vjvpv.exe
c:\vjvpv.exe
\??\c:\9xrlfxx.exe
c:\9xrlfxx.exe
\??\c:\fffrlxl.exe
c:\fffrlxl.exe
\??\c:\nbnbnh.exe
c:\nbnbnh.exe
\??\c:\pjdpd.exe
c:\pjdpd.exe
\??\c:\pvjvd.exe
c:\pvjvd.exe
\??\c:\llfrrxr.exe
c:\llfrrxr.exe
\??\c:\1htbnn.exe
c:\1htbnn.exe
\??\c:\7nbhtb.exe
c:\7nbhtb.exe
\??\c:\vvjvp.exe
c:\vvjvp.exe
\??\c:\pvpjp.exe
c:\pvpjp.exe
\??\c:\ffrlrlx.exe
c:\ffrlrlx.exe
\??\c:\hhtnbb.exe
c:\hhtnbb.exe
\??\c:\7tnhbn.exe
c:\7tnhbn.exe
\??\c:\ddvvj.exe
c:\ddvvj.exe
\??\c:\vppvj.exe
c:\vppvj.exe
\??\c:\fxflxxx.exe
c:\fxflxxx.exe
\??\c:\llrxlxr.exe
c:\llrxlxr.exe
\??\c:\tthnhn.exe
c:\tthnhn.exe
\??\c:\3thbtb.exe
c:\3thbtb.exe
\??\c:\ddppv.exe
c:\ddppv.exe
\??\c:\1xfxflx.exe
c:\1xfxflx.exe
\??\c:\llfrffl.exe
c:\llfrffl.exe
\??\c:\nthntb.exe
c:\nthntb.exe
\??\c:\bbnnhh.exe
c:\bbnnhh.exe
\??\c:\pvjpj.exe
c:\pvjpj.exe
\??\c:\vvppd.exe
c:\vvppd.exe
\??\c:\xfrlrfr.exe
c:\xfrlrfr.exe
\??\c:\9bbtbn.exe
c:\9bbtbn.exe
\??\c:\nnhtnb.exe
c:\nnhtnb.exe
\??\c:\dpdpp.exe
c:\dpdpp.exe
\??\c:\ppdjj.exe
c:\ppdjj.exe
\??\c:\lxxlxrr.exe
c:\lxxlxrr.exe
\??\c:\nbbtth.exe
c:\nbbtth.exe
\??\c:\5bbtnb.exe
c:\5bbtnb.exe
\??\c:\jjddp.exe
c:\jjddp.exe
\??\c:\ppjvj.exe
c:\ppjvj.exe
\??\c:\flxrrrx.exe
c:\flxrrrx.exe
\??\c:\hbtnbb.exe
c:\hbtnbb.exe
\??\c:\tbtbnt.exe
c:\tbtbnt.exe
\??\c:\ppdjv.exe
c:\ppdjv.exe
\??\c:\7pppp.exe
c:\7pppp.exe
\??\c:\xrffrxl.exe
c:\xrffrxl.exe
\??\c:\fflxlrx.exe
c:\fflxlrx.exe
\??\c:\nnbhhn.exe
c:\nnbhhn.exe
\??\c:\dvjvj.exe
c:\dvjvj.exe
\??\c:\vvjjj.exe
c:\vvjjj.exe
\??\c:\xxlflfl.exe
c:\xxlflfl.exe
\??\c:\xfxrrlr.exe
c:\xfxrrlr.exe
\??\c:\1nntnt.exe
c:\1nntnt.exe
\??\c:\tnhtth.exe
c:\tnhtth.exe
\??\c:\pjdjj.exe
c:\pjdjj.exe
\??\c:\xrrrllx.exe
c:\xrrrllx.exe
\??\c:\llfxlrf.exe
c:\llfxlrf.exe
\??\c:\nbbthb.exe
c:\nbbthb.exe
\??\c:\htnbht.exe
c:\htnbht.exe
\??\c:\vpjvv.exe
c:\vpjvv.exe
\??\c:\llrrflr.exe
c:\llrrflr.exe
\??\c:\xxrlrlr.exe
c:\xxrlrlr.exe
\??\c:\5nnbhh.exe
c:\5nnbhh.exe
\??\c:\hhbtnt.exe
c:\hhbtnt.exe
\??\c:\jpjvv.exe
c:\jpjvv.exe
\??\c:\ddjjv.exe
c:\ddjjv.exe
\??\c:\lfxffrx.exe
c:\lfxffrx.exe
\??\c:\htbbnt.exe
c:\htbbnt.exe
\??\c:\vjvpv.exe
c:\vjvpv.exe
\??\c:\pppdp.exe
c:\pppdp.exe
\??\c:\xrflfrl.exe
c:\xrflfrl.exe
\??\c:\bthnbn.exe
c:\bthnbn.exe
\??\c:\tthnbh.exe
c:\tthnbh.exe
\??\c:\vddjd.exe
c:\vddjd.exe
\??\c:\jdvdj.exe
c:\jdvdj.exe
\??\c:\rrfrlrf.exe
c:\rrfrlrf.exe
\??\c:\hbthnt.exe
c:\hbthnt.exe
\??\c:\hthhbn.exe
c:\hthhbn.exe
\??\c:\3pvvp.exe
c:\3pvvp.exe
\??\c:\pjvdp.exe
c:\pjvdp.exe
\??\c:\xxfxllr.exe
c:\xxfxllr.exe
\??\c:\9lfrlrl.exe
c:\9lfrlrl.exe
\??\c:\1tnhbn.exe
c:\1tnhbn.exe
\??\c:\hhbhtt.exe
c:\hhbhtt.exe
\??\c:\jjddv.exe
c:\jjddv.exe
\??\c:\fllxrxx.exe
c:\fllxrxx.exe
\??\c:\rrfrlxl.exe
c:\rrfrlxl.exe
\??\c:\bnnttn.exe
c:\bnnttn.exe
\??\c:\3nnbnt.exe
c:\3nnbnt.exe
\??\c:\dvjjv.exe
c:\dvjjv.exe
\??\c:\dvvpd.exe
c:\dvvpd.exe
\??\c:\5rflxlr.exe
c:\5rflxlr.exe
\??\c:\xrllxfl.exe
c:\xrllxfl.exe
\??\c:\9tthhh.exe
c:\9tthhh.exe
\??\c:\dpddp.exe
c:\dpddp.exe
\??\c:\jpvdj.exe
c:\jpvdj.exe
\??\c:\rrllrrf.exe
c:\rrllrrf.exe
\??\c:\fflfrlf.exe
c:\fflfrlf.exe
\??\c:\1ttbtn.exe
c:\1ttbtn.exe
\??\c:\vpddp.exe
c:\vpddp.exe
\??\c:\djpjp.exe
c:\djpjp.exe
\??\c:\rllfxll.exe
c:\rllfxll.exe
\??\c:\frffrrf.exe
c:\frffrrf.exe
\??\c:\ntnthh.exe
c:\ntnthh.exe
\??\c:\pvvpj.exe
c:\pvvpj.exe
\??\c:\pjddj.exe
c:\pjddj.exe
\??\c:\rfrrxlr.exe
c:\rfrrxlr.exe
\??\c:\rlxfflx.exe
c:\rlxfflx.exe
\??\c:\hbthtb.exe
c:\hbthtb.exe
\??\c:\tttbtb.exe
c:\tttbtb.exe
\??\c:\7vvdj.exe
c:\7vvdj.exe
\??\c:\vvjpj.exe
c:\vvjpj.exe
\??\c:\9lxfrxr.exe
c:\9lxfrxr.exe
\??\c:\tttbnb.exe
c:\tttbnb.exe
\??\c:\3hhtht.exe
c:\3hhtht.exe
\??\c:\ddvjd.exe
c:\ddvjd.exe
\??\c:\pjjvv.exe
c:\pjjvv.exe
\??\c:\rlxrrrf.exe
c:\rlxrrrf.exe
\??\c:\xfxxrfx.exe
c:\xfxxrfx.exe
\??\c:\bhtbth.exe
c:\bhtbth.exe
\??\c:\jvjjp.exe
c:\jvjjp.exe
\??\c:\ddvvj.exe
c:\ddvvj.exe
\??\c:\xxxrrlr.exe
c:\xxxrrlr.exe
\??\c:\nbnnnh.exe
c:\nbnnnh.exe
\??\c:\djvjv.exe
c:\djvjv.exe
\??\c:\jppjp.exe
c:\jppjp.exe
\??\c:\xlxxlfr.exe
c:\xlxxlfr.exe
\??\c:\tnhnbh.exe
c:\tnhnbh.exe
\??\c:\3hbnth.exe
c:\3hbnth.exe
\??\c:\vvpvp.exe
c:\vvpvp.exe
\??\c:\vjjvd.exe
c:\vjjvd.exe
\??\c:\xxlrxfx.exe
c:\xxlrxfx.exe
\??\c:\7nnbnt.exe
c:\7nnbnt.exe
\??\c:\nthbbb.exe
c:\nthbbb.exe
\??\c:\1dvvv.exe
c:\1dvvv.exe
\??\c:\dpvpv.exe
c:\dpvpv.exe
\??\c:\lrxxfff.exe
c:\lrxxfff.exe
\??\c:\bbbtnh.exe
c:\bbbtnh.exe
\??\c:\nbhtbh.exe
c:\nbhtbh.exe
\??\c:\9vdjd.exe
c:\9vdjd.exe
\??\c:\lfxfrxl.exe
c:\lfxfrxl.exe
\??\c:\lxllrrr.exe
c:\lxllrrr.exe
\??\c:\9nnnnb.exe
c:\9nnnnb.exe
\??\c:\9jjjv.exe
c:\9jjjv.exe
\??\c:\vdvjv.exe
c:\vdvjv.exe
\??\c:\rlflxfr.exe
c:\rlflxfr.exe
\??\c:\lrlxrxr.exe
c:\lrlxrxr.exe
\??\c:\hbntnt.exe
c:\hbntnt.exe
\??\c:\bbbtnt.exe
c:\bbbtnt.exe
\??\c:\jjjvv.exe
c:\jjjvv.exe
\??\c:\rrxxfrl.exe
c:\rrxxfrl.exe
\??\c:\fffxlxl.exe
c:\fffxlxl.exe
\??\c:\bbthbb.exe
c:\bbthbb.exe
\??\c:\bbbbnn.exe
c:\bbbbnn.exe
\??\c:\dpjdd.exe
c:\dpjdd.exe
\??\c:\9lllrxl.exe
c:\9lllrxl.exe
\??\c:\rrrfxxl.exe
c:\rrrfxxl.exe
\??\c:\bhtttn.exe
c:\bhtttn.exe
\??\c:\vddjd.exe
c:\vddjd.exe
\??\c:\dpvpv.exe
c:\dpvpv.exe
\??\c:\fxfxxlf.exe
c:\fxfxxlf.exe
\??\c:\rfrrxrr.exe
c:\rfrrxrr.exe
\??\c:\ntbtbt.exe
c:\ntbtbt.exe
\??\c:\vdjjp.exe
c:\vdjjp.exe
\??\c:\jdvpp.exe
c:\jdvpp.exe
\??\c:\1lrxrxl.exe
c:\1lrxrxl.exe
\??\c:\fffrxxx.exe
c:\fffrxxx.exe
\??\c:\3hbhbh.exe
c:\3hbhbh.exe
\??\c:\vpjvj.exe
c:\vpjvj.exe
\??\c:\1jjjv.exe
c:\1jjjv.exe
\??\c:\xrflxfl.exe
c:\xrflxfl.exe
\??\c:\fxfxlrf.exe
c:\fxfxlrf.exe
\??\c:\htnnhn.exe
c:\htnnhn.exe
\??\c:\jpdvp.exe
c:\jpdvp.exe
\??\c:\vjppd.exe
c:\vjppd.exe
\??\c:\7frllfl.exe
c:\7frllfl.exe
\??\c:\frfxxxl.exe
c:\frfxxxl.exe
\??\c:\hbhhtn.exe
c:\hbhhtn.exe
\??\c:\jjjvj.exe
c:\jjjvj.exe
\??\c:\vpdpd.exe
c:\vpdpd.exe
\??\c:\lfxlxlx.exe
c:\lfxlxlx.exe
\??\c:\xxlxxxl.exe
c:\xxlxxxl.exe
\??\c:\bhbtbn.exe
c:\bhbtbn.exe
\??\c:\vdpdp.exe
c:\vdpdp.exe
\??\c:\jdpvj.exe
c:\jdpvj.exe
\??\c:\rffxxxx.exe
c:\rffxxxx.exe
\??\c:\bntbbb.exe
c:\bntbbb.exe
\??\c:\1thhnt.exe
c:\1thhnt.exe
\??\c:\7jjdj.exe
c:\7jjdj.exe
\??\c:\pjdvd.exe
c:\pjdvd.exe
\??\c:\5rlrxlf.exe
c:\5rlrxlf.exe
\??\c:\tttnhh.exe
c:\tttnhh.exe
\??\c:\hbthbn.exe
c:\hbthbn.exe
\??\c:\jjdjp.exe
c:\jjdjp.exe
\??\c:\jvvjj.exe
c:\jvvjj.exe
\??\c:\5xlxrxr.exe
c:\5xlxrxr.exe
\??\c:\ttnbtn.exe
c:\ttnbtn.exe
\??\c:\7hhnht.exe
c:\7hhnht.exe
\??\c:\9jvdj.exe
c:\9jvdj.exe
\??\c:\flrlrrr.exe
c:\flrlrrr.exe
\??\c:\rrlfxrx.exe
c:\rrlfxrx.exe
\??\c:\tbbnbn.exe
c:\tbbnbn.exe
\??\c:\ttnbtb.exe
c:\ttnbtb.exe
\??\c:\pjvdp.exe
c:\pjvdp.exe
\??\c:\3jjvj.exe
c:\3jjvj.exe
\??\c:\rlfxrxf.exe
c:\rlfxrxf.exe
\??\c:\tthtbh.exe
c:\tthtbh.exe
\??\c:\nhntbh.exe
c:\nhntbh.exe
\??\c:\5vvjj.exe
c:\5vvjj.exe
\??\c:\7jjpd.exe
c:\7jjpd.exe
\??\c:\xxrxrxl.exe
c:\xxrxrxl.exe
\??\c:\fffxlxr.exe
c:\fffxlxr.exe
\??\c:\httnbn.exe
c:\httnbn.exe
\??\c:\bhnhht.exe
c:\bhnhht.exe
\??\c:\dvjvv.exe
c:\dvjvv.exe
\??\c:\ppjjv.exe
c:\ppjjv.exe
\??\c:\lfflfrl.exe
c:\lfflfrl.exe
\??\c:\rrllxfr.exe
c:\rrllxfr.exe
\??\c:\nhtnbn.exe
c:\nhtnbn.exe
\??\c:\nhthth.exe
c:\nhthth.exe
\??\c:\dpjjp.exe
c:\dpjjp.exe
\??\c:\9jjjv.exe
c:\9jjjv.exe
\??\c:\rlxxllx.exe
c:\rlxxllx.exe
\??\c:\fxllxlr.exe
c:\fxllxlr.exe
\??\c:\bbhtnh.exe
c:\bbhtnh.exe
\??\c:\vpjdp.exe
c:\vpjdp.exe
\??\c:\vvdjd.exe
c:\vvdjd.exe
\??\c:\fxxlxfx.exe
c:\fxxlxfx.exe
\??\c:\bbbnbh.exe
c:\bbbnbh.exe
\??\c:\hhhhtb.exe
c:\hhhhtb.exe
\??\c:\pjddj.exe
c:\pjddj.exe
\??\c:\ppddj.exe
c:\ppddj.exe
\??\c:\frxrrlf.exe
c:\frxrrlf.exe
\??\c:\tbtnbh.exe
c:\tbtnbh.exe
\??\c:\tntbnh.exe
c:\tntbnh.exe
\??\c:\pjvvj.exe
c:\pjvvj.exe
\??\c:\jdjpj.exe
c:\jdjpj.exe
\??\c:\frxrrlr.exe
c:\frxrrlr.exe
\??\c:\xxxxrfr.exe
c:\xxxxrfr.exe
\??\c:\bhnbnb.exe
c:\bhnbnb.exe
\??\c:\djjdj.exe
c:\djjdj.exe
\??\c:\jjdjd.exe
c:\jjdjd.exe
\??\c:\xxllxfr.exe
c:\xxllxfr.exe
\??\c:\3llrfxl.exe
c:\3llrfxl.exe
\??\c:\7hbnbb.exe
c:\7hbnbb.exe
\??\c:\vdvdp.exe
c:\vdvdp.exe
\??\c:\3jvdp.exe
c:\3jvdp.exe
\??\c:\xxlxlrx.exe
c:\xxlxlrx.exe
\??\c:\rfxflff.exe
c:\rfxflff.exe
\??\c:\nhbnnt.exe
c:\nhbnnt.exe
\??\c:\3hbbnt.exe
c:\3hbbnt.exe
\??\c:\jdjjj.exe
c:\jdjjj.exe
\??\c:\7vvdp.exe
c:\7vvdp.exe
\??\c:\xrxxllx.exe
c:\xrxxllx.exe
\??\c:\fflfflf.exe
c:\fflfflf.exe
\??\c:\nhthtb.exe
c:\nhthtb.exe
\??\c:\dvdjv.exe
c:\dvdjv.exe
\??\c:\jjjpv.exe
c:\jjjpv.exe
\??\c:\ffxfxxx.exe
c:\ffxfxxx.exe
\??\c:\xxllxfl.exe
c:\xxllxfl.exe
\??\c:\3hnbnt.exe
c:\3hnbnt.exe
\??\c:\hbtnbb.exe
c:\hbtnbb.exe
\??\c:\djjjd.exe
c:\djjjd.exe
\??\c:\vppjd.exe
c:\vppjd.exe
\??\c:\rllrxfr.exe
c:\rllrxfr.exe
\??\c:\xxrllfl.exe
c:\xxrllfl.exe
\??\c:\hbthnb.exe
c:\hbthnb.exe
\??\c:\bbttbh.exe
c:\bbttbh.exe
\??\c:\jppdv.exe
c:\jppdv.exe
\??\c:\pvjpd.exe
c:\pvjpd.exe
\??\c:\rrflxrl.exe
c:\rrflxrl.exe
\??\c:\nntnnh.exe
c:\nntnnh.exe
\??\c:\tnnhbn.exe
c:\tnnhbn.exe
\??\c:\dvpvd.exe
c:\dvpvd.exe
\??\c:\jjjdd.exe
c:\jjjdd.exe
\??\c:\xxrrlll.exe
c:\xxrrlll.exe
\??\c:\fflrrlx.exe
c:\fflrrlx.exe
\??\c:\tbtbnn.exe
c:\tbtbnn.exe
\??\c:\9jjpp.exe
c:\9jjpp.exe
\??\c:\pjvjv.exe
c:\pjvjv.exe
\??\c:\rlffrfr.exe
c:\rlffrfr.exe
\??\c:\lllrflf.exe
c:\lllrflf.exe
\??\c:\bththn.exe
c:\bththn.exe
\??\c:\vvddv.exe
c:\vvddv.exe
\??\c:\pjdjp.exe
c:\pjdjp.exe
\??\c:\frlrrxf.exe
c:\frlrrxf.exe
\??\c:\frflxxf.exe
c:\frflxxf.exe
\??\c:\nnbtnb.exe
c:\nnbtnb.exe
\??\c:\1jvvp.exe
c:\1jvvp.exe
\??\c:\vvpvj.exe
c:\vvpvj.exe
\??\c:\rflffxx.exe
c:\rflffxx.exe
\??\c:\rrrrflx.exe
c:\rrrrflx.exe
\??\c:\hhbhth.exe
c:\hhbhth.exe
\??\c:\jdppp.exe
c:\jdppp.exe
\??\c:\jvppv.exe
c:\jvppv.exe
\??\c:\frrxlll.exe
c:\frrxlll.exe
\??\c:\5xxxllr.exe
c:\5xxxllr.exe
\??\c:\bnhbbn.exe
c:\bnhbbn.exe
\??\c:\9ddvp.exe
c:\9ddvp.exe
\??\c:\vvpdd.exe
c:\vvpdd.exe
\??\c:\lrrlrrr.exe
c:\lrrlrrr.exe
\??\c:\thnbhh.exe
c:\thnbhh.exe
\??\c:\nhhhbn.exe
c:\nhhhbn.exe
\??\c:\jjjjp.exe
c:\jjjjp.exe
\??\c:\ffxffrf.exe
c:\ffxffrf.exe
\??\c:\frlfrrr.exe
c:\frlfrrr.exe
\??\c:\htbttn.exe
c:\htbttn.exe
\??\c:\tbnnhh.exe
c:\tbnnhh.exe
\??\c:\ppjjd.exe
c:\ppjjd.exe
\??\c:\fxxlflx.exe
c:\fxxlflx.exe
\??\c:\nbtbnt.exe
c:\nbtbnt.exe
\??\c:\htbtbt.exe
c:\htbtbt.exe
\??\c:\djjdp.exe
c:\djjdp.exe
\??\c:\vpjjp.exe
c:\vpjjp.exe
\??\c:\3rrrxfr.exe
c:\3rrrxfr.exe
\??\c:\rrxrlrl.exe
c:\rrxrlrl.exe
\??\c:\3hntnt.exe
c:\3hntnt.exe
\??\c:\ntthht.exe
c:\ntthht.exe
\??\c:\pjddp.exe
c:\pjddp.exe
\??\c:\9vdvd.exe
c:\9vdvd.exe
\??\c:\rllrflx.exe
c:\rllrflx.exe
\??\c:\fxflxff.exe
c:\fxflxff.exe
\??\c:\hhthtb.exe
c:\hhthtb.exe
\??\c:\jppvp.exe
c:\jppvp.exe
\??\c:\pjdvp.exe
c:\pjdvp.exe
\??\c:\7lfrxxr.exe
c:\7lfrxxr.exe
\??\c:\xffffrf.exe
c:\xffffrf.exe
\??\c:\tnhhbb.exe
c:\tnhhbb.exe
\??\c:\9vvvp.exe
c:\9vvvp.exe
\??\c:\3dppd.exe
c:\3dppd.exe
\??\c:\1xxlrrf.exe
c:\1xxlrrf.exe
\??\c:\llrxxfr.exe
c:\llrxxfr.exe
\??\c:\1bbnhn.exe
c:\1bbnhn.exe
\??\c:\pppvj.exe
c:\pppvj.exe
\??\c:\ddvjj.exe
c:\ddvjj.exe
\??\c:\dvjjv.exe
c:\dvjjv.exe
\??\c:\rrlllrf.exe
c:\rrlllrf.exe
\??\c:\3bhthn.exe
c:\3bhthn.exe
\??\c:\3bbnbh.exe
c:\3bbnbh.exe
\??\c:\vvvdv.exe
c:\vvvdv.exe
\??\c:\ppvjp.exe
c:\ppvjp.exe
\??\c:\jjdjv.exe
c:\jjdjv.exe
\??\c:\lrffrll.exe
c:\lrffrll.exe
\??\c:\xrlrfrr.exe
c:\xrlrfrr.exe
\??\c:\hhnhhn.exe
c:\hhnhhn.exe
\??\c:\vdvdp.exe
c:\vdvdp.exe
\??\c:\jjdpj.exe
c:\jjdpj.exe
\??\c:\xxrxlrf.exe
c:\xxrxlrf.exe
\??\c:\flrflrl.exe
c:\flrflrl.exe
\??\c:\ntntnt.exe
c:\ntntnt.exe
\??\c:\hhhtth.exe
c:\hhhtth.exe
\??\c:\jjddd.exe
c:\jjddd.exe
\??\c:\ddppj.exe
c:\ddppj.exe
\??\c:\rxflllr.exe
c:\rxflllr.exe
\??\c:\7lxfrxl.exe
c:\7lxfrxl.exe
\??\c:\bbtnbh.exe
c:\bbtnbh.exe
\??\c:\ppddd.exe
c:\ppddd.exe
\??\c:\pjjpv.exe
c:\pjjpv.exe
\??\c:\rrlrffr.exe
c:\rrlrffr.exe
\??\c:\xffffff.exe
c:\xffffff.exe
\??\c:\tnbnnb.exe
c:\tnbnnb.exe
\??\c:\7nhhnn.exe
c:\7nhhnn.exe
\??\c:\dvjpd.exe
c:\dvjpd.exe
\??\c:\dvjpv.exe
c:\dvjpv.exe
\??\c:\llflrrf.exe
c:\llflrrf.exe
\??\c:\9frrxlf.exe
c:\9frrxlf.exe
\??\c:\btthhb.exe
c:\btthhb.exe
\??\c:\jpdvp.exe
c:\jpdvp.exe
\??\c:\ddpdv.exe
c:\ddpdv.exe
\??\c:\ffflxlr.exe
c:\ffflxlr.exe
\??\c:\lrrrfrl.exe
c:\lrrrfrl.exe
\??\c:\ttthtn.exe
c:\ttthtn.exe
\??\c:\hhtnbb.exe
c:\hhtnbb.exe
\??\c:\dvdpv.exe
c:\dvdpv.exe
\??\c:\1dvjp.exe
c:\1dvjp.exe
\??\c:\9xrrxfl.exe
c:\9xrrxfl.exe
\??\c:\rrfrrlf.exe
c:\rrfrrlf.exe
\??\c:\thhbht.exe
c:\thhbht.exe
\??\c:\vvvdp.exe
c:\vvvdp.exe
\??\c:\jdvdj.exe
c:\jdvdj.exe
\??\c:\rrfflxl.exe
c:\rrfflxl.exe
\??\c:\lrfllll.exe
c:\lrfllll.exe
\??\c:\hhhbbt.exe
c:\hhhbbt.exe
\??\c:\ttnttb.exe
c:\ttnttb.exe
\??\c:\jdvjj.exe
c:\jdvjj.exe
\??\c:\jjdpd.exe
c:\jjdpd.exe
\??\c:\fxxllxl.exe
c:\fxxllxl.exe
\??\c:\lllxrrx.exe
c:\lllxrrx.exe
\??\c:\ttnthn.exe
c:\ttnthn.exe
\??\c:\jjdjd.exe
c:\jjdjd.exe
\??\c:\ddpvj.exe
c:\ddpvj.exe
\??\c:\1lfrllx.exe
c:\1lfrllx.exe
\??\c:\rlxfllf.exe
c:\rlxfllf.exe
\??\c:\bnbhnh.exe
c:\bnbhnh.exe
\??\c:\vpjpd.exe
c:\vpjpd.exe
\??\c:\vvpdp.exe
c:\vvpdp.exe
\??\c:\llxxlrf.exe
c:\llxxlrf.exe
\??\c:\7fxrrrl.exe
c:\7fxrrrl.exe
\??\c:\nnhbnn.exe
c:\nnhbnn.exe
\??\c:\nnthhh.exe
c:\nnthhh.exe
\??\c:\dvdpj.exe
c:\dvdpj.exe
\??\c:\jdddp.exe
c:\jdddp.exe
\??\c:\xrllrfr.exe
c:\xrllrfr.exe
\??\c:\lfrxrrf.exe
c:\lfrxrrf.exe
\??\c:\nnhbtb.exe
c:\nnhbtb.exe
\??\c:\nhhtnb.exe
c:\nhhtnb.exe
\??\c:\1nhntb.exe
c:\1nhntb.exe
\??\c:\jpvjd.exe
c:\jpvjd.exe
\??\c:\1jjdp.exe
c:\1jjdp.exe
\??\c:\1lrxllf.exe
c:\1lrxllf.exe
\??\c:\ttbnhn.exe
c:\ttbnhn.exe
\??\c:\hhthnn.exe
c:\hhthnn.exe
\??\c:\nnhthn.exe
c:\nnhthn.exe
\??\c:\5dpdj.exe
c:\5dpdj.exe
\??\c:\7lflllx.exe
c:\7lflllx.exe
\??\c:\ffxrxlx.exe
c:\ffxrxlx.exe
\??\c:\bbhtnt.exe
c:\bbhtnt.exe
\??\c:\nthnbn.exe
c:\nthnbn.exe
\??\c:\ddpvj.exe
c:\ddpvj.exe
\??\c:\vjdpj.exe
c:\vjdpj.exe
\??\c:\xxlrflf.exe
c:\xxlrflf.exe
\??\c:\5rxrffl.exe
c:\5rxrffl.exe
\??\c:\tnhntb.exe
c:\tnhntb.exe
\??\c:\3hhtbh.exe
c:\3hhtbh.exe
\??\c:\dddpv.exe
c:\dddpv.exe
\??\c:\xxllrxl.exe
c:\xxllrxl.exe
\??\c:\fffrfrf.exe
c:\fffrfrf.exe
\??\c:\hhhnbh.exe
c:\hhhnbh.exe
\??\c:\tbthnt.exe
c:\tbthnt.exe
\??\c:\vpjpd.exe
c:\vpjpd.exe
\??\c:\dvdpp.exe
c:\dvdpp.exe
\??\c:\xlffrxl.exe
c:\xlffrxl.exe
\??\c:\flllxrx.exe
c:\flllxrx.exe
\??\c:\btbhtb.exe
c:\btbhtb.exe
\??\c:\jjpvp.exe
c:\jjpvp.exe
\??\c:\vpdpp.exe
c:\vpdpp.exe
\??\c:\jjpvd.exe
c:\jjpvd.exe
\??\c:\ffxlflx.exe
c:\ffxlflx.exe
\??\c:\rrlxrfl.exe
c:\rrlxrfl.exe
\??\c:\tnbhnh.exe
c:\tnbhnh.exe
\??\c:\5nhhbn.exe
c:\5nhhbn.exe
\??\c:\jjdpd.exe
c:\jjdpd.exe
\??\c:\vpjpj.exe
c:\vpjpj.exe
\??\c:\llrrxxl.exe
c:\llrrxxl.exe
\??\c:\tttbnb.exe
c:\tttbnb.exe
\??\c:\tthhbb.exe
c:\tthhbb.exe
\??\c:\vpjpv.exe
c:\vpjpv.exe
\??\c:\pppdj.exe
c:\pppdj.exe
\??\c:\llfxxxl.exe
c:\llfxxxl.exe
\??\c:\frfxrlr.exe
c:\frfxrlr.exe
\??\c:\bnnhtn.exe
c:\bnnhtn.exe
\??\c:\pjvvj.exe
c:\pjvvj.exe
\??\c:\jjvdj.exe
c:\jjvdj.exe
\??\c:\rfrrfll.exe
c:\rfrrfll.exe
\??\c:\rxllrfl.exe
c:\rxllrfl.exe
\??\c:\btbhtb.exe
c:\btbhtb.exe
\??\c:\btnttn.exe
c:\btnttn.exe
\??\c:\9dvpj.exe
c:\9dvpj.exe
\??\c:\1fflrxf.exe
c:\1fflrxf.exe
\??\c:\lrfxfrr.exe
c:\lrfxfrr.exe
\??\c:\hbthbh.exe
c:\hbthbh.exe
\??\c:\tbbhhn.exe
c:\tbbhhn.exe
\??\c:\vpvvd.exe
c:\vpvvd.exe
\??\c:\djvpd.exe
c:\djvpd.exe
\??\c:\fxlxxfr.exe
c:\fxlxxfr.exe
\??\c:\rlxxllr.exe
c:\rlxxllr.exe
\??\c:\tttbnb.exe
c:\tttbnb.exe
\??\c:\5hbbnt.exe
c:\5hbbnt.exe
\??\c:\pjdpd.exe
c:\pjdpd.exe
\??\c:\ffxxflx.exe
c:\ffxxflx.exe
\??\c:\1rlrrxl.exe
c:\1rlrrxl.exe
\??\c:\nbtnbb.exe
c:\nbtnbb.exe
\??\c:\btthtb.exe
c:\btthtb.exe
\??\c:\vpjjv.exe
c:\vpjjv.exe
\??\c:\pjjjp.exe
c:\pjjjp.exe
\??\c:\3xlfxlf.exe
c:\3xlfxlf.exe
\??\c:\rrfxxfr.exe
c:\rrfxxfr.exe
\??\c:\tttnbn.exe
c:\tttnbn.exe
\??\c:\htbthh.exe
c:\htbthh.exe
\??\c:\1jddj.exe
c:\1jddj.exe
\??\c:\vvvdv.exe
c:\vvvdv.exe
\??\c:\7rffxxr.exe
c:\7rffxxr.exe
\??\c:\fflrlxl.exe
c:\fflrlxl.exe
\??\c:\nnhtnt.exe
c:\nnhtnt.exe
\??\c:\nhhnhh.exe
c:\nhhnhh.exe
\??\c:\3jdpp.exe
c:\3jdpp.exe
\??\c:\5dvvp.exe
c:\5dvvp.exe
\??\c:\lllfrfr.exe
c:\lllfrfr.exe
\??\c:\7ttthh.exe
c:\7ttthh.exe
\??\c:\9tnttn.exe
c:\9tnttn.exe
\??\c:\vvjvj.exe
c:\vvjvj.exe
\??\c:\ddvdp.exe
c:\ddvdp.exe
\??\c:\frxxlff.exe
c:\frxxlff.exe
\??\c:\xxlxlfr.exe
c:\xxlxlfr.exe
\??\c:\bhbthh.exe
c:\bhbthh.exe
\??\c:\hhhhtb.exe
c:\hhhhtb.exe
\??\c:\jpjvv.exe
c:\jpjvv.exe
\??\c:\ppdvd.exe
c:\ppdvd.exe
\??\c:\5rrxrfr.exe
c:\5rrxrfr.exe
\??\c:\nhbbtb.exe
c:\nhbbtb.exe
\??\c:\3tbhth.exe
c:\3tbhth.exe
\??\c:\dddjv.exe
c:\dddjv.exe
\??\c:\lfxllrf.exe
c:\lfxllrf.exe
\??\c:\rlxxrlf.exe
c:\rlxxrlf.exe
\??\c:\nnbntn.exe
c:\nnbntn.exe
\??\c:\dpjdd.exe
c:\dpjdd.exe
\??\c:\5jdjv.exe
c:\5jdjv.exe
\??\c:\lfflflx.exe
c:\lfflflx.exe
\??\c:\llfrrlf.exe
c:\llfrrlf.exe
\??\c:\tnhbbh.exe
c:\tnhbbh.exe
\??\c:\vpdpd.exe
c:\vpdpd.exe
\??\c:\pdpvd.exe
c:\pdpvd.exe
\??\c:\fxxllrf.exe
c:\fxxllrf.exe
\??\c:\hhbnbn.exe
c:\hhbnbn.exe
\??\c:\hhtbth.exe
c:\hhtbth.exe
\??\c:\7vpdd.exe
c:\7vpdd.exe
\??\c:\vvdjd.exe
c:\vvdjd.exe
\??\c:\lflrlxr.exe
c:\lflrlxr.exe
\??\c:\htbttn.exe
c:\htbttn.exe
\??\c:\bnbbnt.exe
c:\bnbbnt.exe
\??\c:\dvjpp.exe
c:\dvjpp.exe
\??\c:\vvpdd.exe
c:\vvpdd.exe
\??\c:\7xrflrf.exe
c:\7xrflrf.exe
\??\c:\xxflxff.exe
c:\xxflxff.exe
\??\c:\hhnttb.exe
c:\hhnttb.exe
\??\c:\vdjpd.exe
c:\vdjpd.exe
\??\c:\dddvd.exe
c:\dddvd.exe
\??\c:\3lxrrlx.exe
c:\3lxrrlx.exe
\??\c:\ntnhtb.exe
c:\ntnhtb.exe
\??\c:\vdvjj.exe
c:\vdvjj.exe
\??\c:\vdddp.exe
c:\vdddp.exe
\??\c:\xxxxllx.exe
c:\xxxxllx.exe
\??\c:\fxrlfrf.exe
c:\fxrlfrf.exe
\??\c:\1hthtb.exe
c:\1hthtb.exe
\??\c:\jjvpd.exe
c:\jjvpd.exe
\??\c:\vddvv.exe
c:\vddvv.exe
\??\c:\llxrflr.exe
c:\llxrflr.exe
Network
Files
memory/2316-0-0x0000000000220000-0x000000000022C000-memory.dmp
memory/2316-3-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2316-2-0x0000000000427000-0x0000000000428000-memory.dmp
memory/2316-1-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2316-10-0x0000000000400000-0x0000000000429000-memory.dmp
\??\c:\tnhhbn.exe
| MD5 | 2e8a1a0ebce6241888d02309a941424e |
| SHA1 | 533ee3ac2a12770f263740090b332e13e4b3ddca |
| SHA256 | 169d32bdc58041fa16b1ea83f786cf0de81fded118bb8eeec00e3c81d33c9dd7 |
| SHA512 | 767e84e895bf98c90bfa81223b613e421ce551a23ccb659825b2fa013b14d404686201a1fbe66448bc8910f8ac6ce7fa6bd026e5dcb118e2425991f40731144b |
memory/2300-15-0x0000000000400000-0x0000000000429000-memory.dmp
C:\pppvp.exe
| MD5 | 54f7be84995f2412294ed87f39ea1216 |
| SHA1 | de5ceeddf80a8e2861390cc40cd695a6c242af2b |
| SHA256 | a789dcabb5d527a74a43381f19d7ce73fc5bd640241f40854c81b8e17358bb23 |
| SHA512 | afedd5ad3395ef806419e7490399f1c37db977c2f4130a351e24049a9d9186f8e80d525ea60c9da7a550312fa7bf9d1aad6f736422bdcd6bb3e1acc789d44e14 |
memory/2300-21-0x0000000000401000-0x0000000000427000-memory.dmp
memory/2808-26-0x0000000000400000-0x0000000000429000-memory.dmp
C:\lrflxrf.exe
| MD5 | fd449a2491f6636ac17000ce8a9eceb4 |
| SHA1 | 860aa0ef837bb5551dd9ea81fc869d8750ced0bf |
| SHA256 | 6dcab590a2714b71fd725b8b30241fb6e40aac01fc778dfcfcaf9111799b7e00 |
| SHA512 | de19058361b1e8cd29ffa7412163e2345b295e25340eebdf8edafb2d7af2ee682db5c0c688fdfd675ff7b10a70075df34cd7127767804a9a5532ef412190ea3a |
memory/2856-36-0x0000000000400000-0x0000000000429000-memory.dmp
C:\1ntbht.exe
| MD5 | 3642eb620ba29d1cc5ebb88ea330f535 |
| SHA1 | d25308706f9249ea5be9b6a470d0d482755856f4 |
| SHA256 | 25c763e8f2a05893eeee5fc2b1f5eb3b5340d757f686e0c5d3c2e0367883ab1d |
| SHA512 | f1d669aaec78b4f192bce4743be0ae64dc73dbdf2c5e4fb4d49c8a2e9fa16e1af8fc981251cce7141425f2409416eb3675811975af6ac658666f9979e9c1e144 |
memory/2888-46-0x0000000000400000-0x0000000000429000-memory.dmp
C:\lffrxxf.exe
| MD5 | 6f3a227255eda3f11f1fa81c669fbe15 |
| SHA1 | a0b8ef74c9480e29eea643860b1203b4724d51b1 |
| SHA256 | 9db5f81af2851a9b89316147aa1a30ef92b0c8d826214708336766595c91b654 |
| SHA512 | a7e1b83767dd76423418843f84992a092b0d51c59fd90e3201b9ffe45ac83663e7345ca15f335215eecb6c97e1cd5787d58176f5a9b1b9d7a4ea3e99096479d5 |
memory/2620-56-0x0000000000400000-0x0000000000429000-memory.dmp
C:\xxlflrf.exe
| MD5 | 27dd0284ed13dd1f80c072c746931f7b |
| SHA1 | 0600103c580d1b7b9a8f8401ff69fe005539488d |
| SHA256 | cc78db0251cdf16f5b373909e3a8ddad64b4c4df1159106c934cdc070b60b8ad |
| SHA512 | d3db5f69a44428395f4087b17d257cfc8665f0b1666022422d86d0505c6ee54a02c70e249c058528566dc282f3ab1d536ee5136606b5f3a608459363f2569aff |
memory/2640-66-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2640-65-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2640-64-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2640-75-0x0000000000400000-0x0000000000429000-memory.dmp
C:\ddvdp.exe
| MD5 | ade478e05ef15fe36a873186627e3e96 |
| SHA1 | 2f7b078e6c8b1f86d052a5c4d96789592d1a9acd |
| SHA256 | 30aa67dc8d74c823b26a33d2247486b88f28643094a2abd361699b9a3a3845a5 |
| SHA512 | 394b839700221827341432b1798bfb4866a6d660e854c556085f0c3578b607d8653c52b740a0482030fa63e68ca23dfc2d5ea62387dd94086a9e3c382c50a84b |
memory/1904-79-0x0000000000400000-0x0000000000429000-memory.dmp
C:\jdjpp.exe
| MD5 | fc78e5ab8604d51a5611f627b9b7a915 |
| SHA1 | 4ac97520a4d34e8c935e085ff823b39cb9cd1b2f |
| SHA256 | 387c3c258e75b73ee95afdea1058dca6037d64ec7e0e0f3fb8baf37080343d4a |
| SHA512 | 03ca4f723a40f6a5d35851148ae06db0f5f7d69727730d1c54c7a7f1f009a21e15acda97dd52975604e19613feb999580df6973d869b94763f7eb73c1acf5956 |
memory/2236-87-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2236-89-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2236-88-0x0000000000400000-0x0000000000429000-memory.dmp
\??\c:\3tbntb.exe
| MD5 | d4d842f369adbdad36b78d0188d66214 |
| SHA1 | 95723349f8bcc864d39e104ffd13c00a4fe7d5e8 |
| SHA256 | 5fbc1a14600ba93f8e7facdabbc0f66ceb03ccadc70b07dc82900d7e33bc1638 |
| SHA512 | 432cc8911d79259fe5089a7238afcd3f82f20ce11d29f6f477eea9c9a4dec46e53510a9ef758ae18e41f2c64d9c3b01dc0a6ae0575682d97240cd53b0c347b4d |
\??\c:\xrlxrxf.exe
| MD5 | 70bdfdef5735123b70cfcb0d2a6b6dec |
| SHA1 | e68892fd69b89be7f85036bee80e0c6de7517366 |
| SHA256 | 91bffa6a3e06efd8bc1cfb7909f4bef7124ef2780e158416252d3d7c7766f3c5 |
| SHA512 | c93583aec3a69ba947c5d7a7214ea2073ff387fbd443156e92a7f44f62ead834c596d99fadb5a31708310f285932686b6883b7b98ed730e8d6f43b7203e82b07 |
memory/2236-98-0x0000000000400000-0x0000000000429000-memory.dmp
\??\c:\ppdjp.exe
| MD5 | 6ecd24976ef454f35d3eb1b160ce6e53 |
| SHA1 | 82bd687ad39bdeefa2c69a7d9742b6b8f4e15d5d |
| SHA256 | 3966320d578e4ef524347c446364a8bf12432ebcb72bd397c0771774d1bc9e1f |
| SHA512 | b2119e2a4552f22a202e45e9da9318098388850c90b88461f97445b334651bbdd6eb31f17463d0bf140d62bbbc0fd5298773f7bd99fbe11bfcf70c0ff59a77da |
\??\c:\vvvdj.exe
| MD5 | c5ddb313aec6d7e1dfb0903243cc75f6 |
| SHA1 | 4110c62aedc60d32581dd188ad7a57e9bebedff2 |
| SHA256 | e12b2a3729e68b6dc229b2f838452d7e0805d557cd12874e37794ca2db657a2b |
| SHA512 | 824feac6d019a2fba3dcf984de810f6713e65a61e45ad9b422b8197458844bec53ecf5676e3e6e26d76e595972017bc866f5d53a43ed539340825c2ebe0b4a51 |
C:\9rrfrfl.exe
| MD5 | b32c9d9f083792d49abfeffd5ece7f25 |
| SHA1 | 392a193c5618123a0ffab7bc277477051ad7a1b8 |
| SHA256 | 53d5048f25fa1c2552596e16a858eae516cdae5ee2571aebca394e0d05055686 |
| SHA512 | feaecaccfa01eeb6fc0af5418b719b548f1ad03394a047459a232903f56e39d4d34a77ef8b16dd35bbe714f30e6f927da2afc857318bba3a0db7764aebf3c560 |
C:\frlfflr.exe
| MD5 | 84bb9ea0eb81565f2fc8467a02b03ece |
| SHA1 | 8b98008e5bdd0c285a8705e334668ccb1ef2f450 |
| SHA256 | 20cd36f94373ecda2924980135331b53e359912086565ee9b23eb1c5d917649f |
| SHA512 | 7ca02fff7f75f1a45992e445cfa36e145b19dd1bb119f83ff1fd164831cc87712397d4813247c1ff5b434e9c52836877ca3e981f49b5cbb59e84153cbebdf46f |
memory/2332-142-0x0000000000400000-0x0000000000429000-memory.dmp
\??\c:\5bthtt.exe
| MD5 | a768540901b4e1cb8def52ad5c6c5368 |
| SHA1 | 812fd24c79d50e0cf5d7d7f937997c4ac0a19a18 |
| SHA256 | 92f080237ec42cdc2b18a350734c69047239e83de3b83ed36fe3224bf0f4daa5 |
| SHA512 | 0f3521efd211aabcd38ab2251d71cf4d9015cfba60a6589e1ca9542b7a58a1f8e60eee5ceaf3231a2e0d4d514d79a38eae91338c217ca3926c1bd2779c76ea71 |
C:\jvpdj.exe
| MD5 | 2ef4d4a7988a8ec8a13329125f99e3ae |
| SHA1 | 2db2de73705611cfecf626a5e559be313f15f1f3 |
| SHA256 | 41d2e174aea258a0db67b264c6996a411b9d17269000324b661d0e90ae035bc6 |
| SHA512 | 4d6d5c0cc7b3bb2aa61491fed40001cae132e5662be977481ff3ec25b26e0c4f7631dabe6f8b5bf3aa413b6ab46a3901a526254f910af17478cbd717bdcd652e |
memory/1612-160-0x0000000000400000-0x0000000000429000-memory.dmp
C:\xxrffrf.exe
| MD5 | 515896092a02abd27d1d7f3df73d67f1 |
| SHA1 | b4940e23050c375548a8d0b2ecf92dbabaee1115 |
| SHA256 | 46781d32a0cbb1a601e4099764c68995eed4b58495422d069ccf8c406fdb443a |
| SHA512 | 3548e0430d9ad509ed8de593e35b62b4871007cbadbb13425178e7158aa3014123f7848ff84eba3d618f1fb698a756b771cee45fdadea8bd13049fe92d3b7abf |
memory/568-178-0x0000000000400000-0x0000000000429000-memory.dmp
C:\7bnbbh.exe
| MD5 | a5ec06793c36f6ae1b06b47eb57cb789 |
| SHA1 | b269ff45cbf425d5b72a20a2ae49d90e9b1cd5e2 |
| SHA256 | 004a545677604b993932bd9cf80875098ad2d5b2440f6e9cf5cae30e340c5a82 |
| SHA512 | 326e0f37c7b97cb46f62d5a670208faa445109317b871751a78ce60284ea00e6d624a1f11ee31769750dc4b3ae47645ab96ab1e3bb4b98f4e50dc63feb5701cd |
C:\jvvjp.exe
| MD5 | 389c50ac1428ba52b62786bc5f10d5ab |
| SHA1 | 9d9924871d9913b62cce6974a52e0d940c86e828 |
| SHA256 | 222fe88d149497e7caaadd96d771c1feced821873fd77cd0e917eb5c81bd51d5 |
| SHA512 | 74191e03e62320f9196a1afe1aedd8d3605ca3e47a2a1a6c146cd9441cd879543127e6b6965bf894d4e00e2d2eba889872d27c57fb09005d0d731f5d16b0cd21 |
memory/2244-196-0x0000000000400000-0x0000000000429000-memory.dmp
C:\dvjjd.exe
| MD5 | 0c5e2489d9e4b04c0f8b279a8f3e3796 |
| SHA1 | a760f93e152a58ae430cfb9e21fd255fc3576ea3 |
| SHA256 | 7949f7df573bc20b5a78314a6f3d56fa85d739d2f687ae15d5345741e7658102 |
| SHA512 | bb0f34632d34290b3eb3a18b0271d38ae25d00136624fdb751e00698559dab5e190a24fa7a6c051be247e7b97ef763d727a23f93f7c798663bf263959d2a5631 |
C:\lfrfxxr.exe
| MD5 | f39fb73afca956516dc4fbd7b8c4c0d5 |
| SHA1 | 646d0d53ffaf3d19142866e7b2840b1fc6e8b8cf |
| SHA256 | 64a52dff964bab12513f80ce722a77515711c2c08fcb49551ff655cda9295315 |
| SHA512 | b0ee512f67c9388c0024b0b122ba5e0eb8bc65c53cec5eba5ba3555719d903e4e54e33f8fdd47933bbe722a836c5cb4a01b8566754edf5450c66c123cf893572 |
C:\nnnthh.exe
| MD5 | 37be1785348a9d0fb9229911214e68f3 |
| SHA1 | 207c3874a3f87131742ae9d8f0660bac59b6304c |
| SHA256 | 4396df0ffde04ee0758f9851b39d16b59b3ae5d1d20ade3dea0d4c20f9b0a0e0 |
| SHA512 | 81472c33af96c66ae4bd59b42eb00998eac47ed15d37bc8f5618e93f0e874ab5927b02f858cb732d3210bfb3ceb9635909689b7d5e0735ec612cffd1cd2bf37f |
memory/1344-214-0x0000000000400000-0x0000000000429000-memory.dmp
memory/624-224-0x0000000000400000-0x0000000000429000-memory.dmp
C:\vdpjd.exe
| MD5 | 29994369c7e347ee720f0e3f114785c7 |
| SHA1 | 754e8551f925ed18fe5ca4445884ad1389fbda07 |
| SHA256 | 2bd574f9937fdf48b1ea3340629c7bc676ed414d78f9d9d4ebae6018d61883ee |
| SHA512 | 31034d70ebe9ad0b78080376132d47ddac0340e7807dc15c3b75eb094b809da3b31476010c5eb56847157d3edbebff144ae1051e462bdfa06afd867fba3106b8 |
memory/1884-232-0x0000000000400000-0x0000000000429000-memory.dmp
C:\lfrfllx.exe
| MD5 | 2eadbbdf3ba941fa113b1d92ed83ce2a |
| SHA1 | 1ab112deab14b0b1291d02a69a4634c67a02bd80 |
| SHA256 | d7139c94137ccfe58387076382582b1cdd2b9f06013f08a3f66fbd07c7311834 |
| SHA512 | 48b250553c1de350e5372856bc5690c9b53380e69280e6a0956cfc90ec10595c79ff480308f20d33515abb04b62b90c6301238d6549308e1b40ea65b635c763d |
C:\5nthth.exe
| MD5 | 8705ce21b347b7b6f67d1a3c8d7dbfea |
| SHA1 | 8df13f9fd0346f7d0a28f32ae24f6281ac6fbe8f |
| SHA256 | 9e8eeae79574f0b3d3651d9583793e1c3720685ada1a78f636d2dcd44b270237 |
| SHA512 | 8b42b569299faace5f63a7088a37981d1a18b4addce53e88b3c8e745546d9dcbcbb519f46e69a845997f9230703242e9a0efa6bad0a21c5ed47dbd951fc9f518 |
memory/1908-250-0x0000000000400000-0x0000000000429000-memory.dmp
C:\bththt.exe
| MD5 | be4243b8f32a416987fc9644a9afa793 |
| SHA1 | 3d1832826f3cabb47b5432899142118527f5f810 |
| SHA256 | 89eb9ce6b641b059214d246f1a3bc40b81205faf0b7188ce419887d0aac45ba4 |
| SHA512 | f9f884ec6d367c8a44120242a0c1dfc61ddb6693220f5c6520ba59080368e3c2b0b3cc078091610f8f8151998136859bfdf863c6600cf9913497316d0268f581 |
memory/284-259-0x0000000000400000-0x0000000000429000-memory.dmp
\??\c:\jjjpj.exe
| MD5 | cd53356691879179d444a997a885844d |
| SHA1 | eb1dde968d5bfa368ca5a0098a83c0969d7cf357 |
| SHA256 | 0f77ae42d08695da11ed75474a47e3396963a9b8bfd91a56cd68f08524108006 |
| SHA512 | a0635e8afa8fda398af0e9a700ae1ab9a3252cea45a06bd78c43a7ba654c91d0f09eeb9f1f48a146c545dca60f01df1203af6ddc45acbd6a2140987a0151edd5 |
C:\xxrxxxx.exe
| MD5 | 54e0aa34a21c2120eb2de7a7bf7a2a9e |
| SHA1 | b9ac2155d15b62586a3371d3ec99fc90a80187ee |
| SHA256 | 83ae04cee4d1516ac948120d4ec923ba5d838bbd36d553e48189617bd63d8c5a |
| SHA512 | 6500f5d1355b54f22fbf349327ac74d096423353e6cf090a65b1909f19913671122c40d81f286cb1c998552eb6f9294483ea30840ad70cc3f7d3ffb2a667bb70 |
C:\bbtthh.exe
| MD5 | aa4753c6621ff8338e8abd9f0845bb25 |
| SHA1 | 41994ce85c56dcde6a3031012ed934e029228985 |
| SHA256 | c137dd72ff9bc55cab625945175554f0c552063a41ff468435029bf08fa32494 |
| SHA512 | c1f66f8a3472c0268fe02cd7c02b01870499348f14e802ab99f08ee63bf2a57d34955e131fdd3e7cf557301b1bc3f999b8ef44c5912d8c13530bc6d9273e6bc4 |
C:\vpjvj.exe
| MD5 | 395f68ed96aad3a9127daa91f6ef0ed3 |
| SHA1 | 0084499cfdaf93d9bcede159f159c6790fa0fe2e |
| SHA256 | ebd6ebe8888c5975a9537ffd5d82bc708f51e08473b8abe78ce0d2fe6086c593 |
| SHA512 | 10eb25f0fa7fdbd5e4e42d28681559264a101e55ec3e461b01e5165aec4719cf665bf5ee5ebea771a07812619bf66a41221936628e05ebeee945521b5d4d2d3d |
C:\5frrxxf.exe
| MD5 | c07874c367dce93dfcef144240783063 |
| SHA1 | 5163c74bfd63a670a343021f50092ac24bbc2069 |
| SHA256 | 047a52d7193a5844c840ce482220498900fa9dfe8824aa80056d2442ff191158 |
| SHA512 | 65d3cc41c77330b80172e232af5d5d96fa7c4ac1de1550b633c71ebeeba8c9ee40f1a600b2c46afe00e36c3752a470d54ded41f30e9595394a2959014744d74c |
C:\rxrllfx.exe
| MD5 | 36404788c4370ed54fd923134e88cfed |
| SHA1 | 60650e2d7829c3d2293d0c5e1acaf9289f4ffba5 |
| SHA256 | 8e9de5e1279e3e7fd5f9da194901a0f057671a10872fa0422bac09b079d4ee37 |
| SHA512 | 93edd2805783402260f2d21e1e5b8952c696d2317c3de88a2306072b8cd1b2d83e6affeb5fb56ec5b882d61df5dc6a78cb3407e90b29cd72ac4323d11d9ee68d |
memory/2300-2211-0x0000000000400000-0x0000000000429000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-10-18 16:24
Reported
2024-10-18 16:27
Platform
win10v2004-20241007-en
Max time kernel
150s
Max time network
141s
Command Line
Signatures
Blackmoon, KrBanker
Detect Blackmoon payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\vvdvd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\bhbhhb.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\tnbhbh.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\3htttb.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\vvdvp.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\hthbtn.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\pjjjd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\vpdvp.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\pjdvp.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3144 wrote to memory of 1632 | N/A | C:\Users\Admin\AppData\Local\Temp\586b0bd5539aca526d396624015ac2f4_JaffaCakes118.exe | \??\c:\bthhbb.exe |
| PID 3144 wrote to memory of 1632 | N/A | C:\Users\Admin\AppData\Local\Temp\586b0bd5539aca526d396624015ac2f4_JaffaCakes118.exe | \??\c:\bthhbb.exe |
| PID 3144 wrote to memory of 1632 | N/A | C:\Users\Admin\AppData\Local\Temp\586b0bd5539aca526d396624015ac2f4_JaffaCakes118.exe | \??\c:\bthhbb.exe |
| PID 1632 wrote to memory of 3992 | N/A | \??\c:\bthhbb.exe | \??\c:\nnntnt.exe |
| PID 1632 wrote to memory of 3992 | N/A | \??\c:\bthhbb.exe | \??\c:\nnntnt.exe |
| PID 1632 wrote to memory of 3992 | N/A | \??\c:\bthhbb.exe | \??\c:\nnntnt.exe |
| PID 3992 wrote to memory of 4860 | N/A | \??\c:\nnntnt.exe | \??\c:\jjdvp.exe |
| PID 3992 wrote to memory of 4860 | N/A | \??\c:\nnntnt.exe | \??\c:\jjdvp.exe |
| PID 3992 wrote to memory of 4860 | N/A | \??\c:\nnntnt.exe | \??\c:\jjdvp.exe |
| PID 4860 wrote to memory of 3568 | N/A | \??\c:\jjdvp.exe | \??\c:\xllxrrl.exe |
| PID 4860 wrote to memory of 3568 | N/A | \??\c:\jjdvp.exe | \??\c:\xllxrrl.exe |
| PID 4860 wrote to memory of 3568 | N/A | \??\c:\jjdvp.exe | \??\c:\xllxrrl.exe |
| PID 3568 wrote to memory of 4456 | N/A | \??\c:\xllxrrl.exe | \??\c:\hhhhbh.exe |
| PID 3568 wrote to memory of 4456 | N/A | \??\c:\xllxrrl.exe | \??\c:\hhhhbh.exe |
| PID 3568 wrote to memory of 4456 | N/A | \??\c:\xllxrrl.exe | \??\c:\hhhhbh.exe |
| PID 4456 wrote to memory of 3912 | N/A | \??\c:\hhhhbh.exe | \??\c:\1nbttn.exe |
| PID 4456 wrote to memory of 3912 | N/A | \??\c:\hhhhbh.exe | \??\c:\1nbttn.exe |
| PID 4456 wrote to memory of 3912 | N/A | \??\c:\hhhhbh.exe | \??\c:\1nbttn.exe |
| PID 3912 wrote to memory of 4512 | N/A | \??\c:\1nbttn.exe | \??\c:\rrxrxrr.exe |
| PID 3912 wrote to memory of 4512 | N/A | \??\c:\1nbttn.exe | \??\c:\rrxrxrr.exe |
| PID 3912 wrote to memory of 4512 | N/A | \??\c:\1nbttn.exe | \??\c:\rrxrxrr.exe |
| PID 4512 wrote to memory of 4372 | N/A | \??\c:\rrxrxrr.exe | \??\c:\3bhbtt.exe |
| PID 4512 wrote to memory of 4372 | N/A | \??\c:\rrxrxrr.exe | \??\c:\3bhbtt.exe |
| PID 4512 wrote to memory of 4372 | N/A | \??\c:\rrxrxrr.exe | \??\c:\3bhbtt.exe |
| PID 4372 wrote to memory of 4688 | N/A | \??\c:\3bhbtt.exe | \??\c:\vvdjp.exe |
| PID 4372 wrote to memory of 4688 | N/A | \??\c:\3bhbtt.exe | \??\c:\vvdjp.exe |
| PID 4372 wrote to memory of 4688 | N/A | \??\c:\3bhbtt.exe | \??\c:\vvdjp.exe |
| PID 4688 wrote to memory of 2876 | N/A | \??\c:\vvdjp.exe | \??\c:\tnbbbb.exe |
| PID 4688 wrote to memory of 2876 | N/A | \??\c:\vvdjp.exe | \??\c:\tnbbbb.exe |
| PID 4688 wrote to memory of 2876 | N/A | \??\c:\vvdjp.exe | \??\c:\tnbbbb.exe |
| PID 2876 wrote to memory of 244 | N/A | \??\c:\tnbbbb.exe | \??\c:\5vpvp.exe |
| PID 2876 wrote to memory of 244 | N/A | \??\c:\tnbbbb.exe | \??\c:\5vpvp.exe |
| PID 2876 wrote to memory of 244 | N/A | \??\c:\tnbbbb.exe | \??\c:\5vpvp.exe |
| PID 244 wrote to memory of 4708 | N/A | \??\c:\5vpvp.exe | \??\c:\fxlffff.exe |
| PID 244 wrote to memory of 4708 | N/A | \??\c:\5vpvp.exe | \??\c:\fxlffff.exe |
| PID 244 wrote to memory of 4708 | N/A | \??\c:\5vpvp.exe | \??\c:\fxlffff.exe |
| PID 4708 wrote to memory of 1608 | N/A | \??\c:\fxlffff.exe | \??\c:\nbnbth.exe |
| PID 4708 wrote to memory of 1608 | N/A | \??\c:\fxlffff.exe | \??\c:\nbnbth.exe |
| PID 4708 wrote to memory of 1608 | N/A | \??\c:\fxlffff.exe | \??\c:\nbnbth.exe |
| PID 1608 wrote to memory of 3180 | N/A | \??\c:\nbnbth.exe | \??\c:\hbhhnh.exe |
| PID 1608 wrote to memory of 3180 | N/A | \??\c:\nbnbth.exe | \??\c:\hbhhnh.exe |
| PID 1608 wrote to memory of 3180 | N/A | \??\c:\nbnbth.exe | \??\c:\hbhhnh.exe |
| PID 3180 wrote to memory of 1968 | N/A | \??\c:\hbhhnh.exe | \??\c:\rxlrlfl.exe |
| PID 3180 wrote to memory of 1968 | N/A | \??\c:\hbhhnh.exe | \??\c:\rxlrlfl.exe |
| PID 3180 wrote to memory of 1968 | N/A | \??\c:\hbhhnh.exe | \??\c:\rxlrlfl.exe |
| PID 1968 wrote to memory of 4368 | N/A | \??\c:\rxlrlfl.exe | \??\c:\bbbttb.exe |
| PID 1968 wrote to memory of 4368 | N/A | \??\c:\rxlrlfl.exe | \??\c:\bbbttb.exe |
| PID 1968 wrote to memory of 4368 | N/A | \??\c:\rxlrlfl.exe | \??\c:\bbbttb.exe |
| PID 4368 wrote to memory of 2892 | N/A | \??\c:\bbbttb.exe | \??\c:\3vjpj.exe |
| PID 4368 wrote to memory of 2892 | N/A | \??\c:\bbbttb.exe | \??\c:\3vjpj.exe |
| PID 4368 wrote to memory of 2892 | N/A | \??\c:\bbbttb.exe | \??\c:\3vjpj.exe |
| PID 2892 wrote to memory of 4644 | N/A | \??\c:\3vjpj.exe | \??\c:\xlxrrfl.exe |
| PID 2892 wrote to memory of 4644 | N/A | \??\c:\3vjpj.exe | \??\c:\xlxrrfl.exe |
| PID 2892 wrote to memory of 4644 | N/A | \??\c:\3vjpj.exe | \??\c:\xlxrrfl.exe |
| PID 4644 wrote to memory of 980 | N/A | \??\c:\xlxrrfl.exe | \??\c:\ffffxrr.exe |
| PID 4644 wrote to memory of 980 | N/A | \??\c:\xlxrrfl.exe | \??\c:\ffffxrr.exe |
| PID 4644 wrote to memory of 980 | N/A | \??\c:\xlxrrfl.exe | \??\c:\ffffxrr.exe |
| PID 980 wrote to memory of 4996 | N/A | \??\c:\ffffxrr.exe | \??\c:\nhnhbb.exe |
| PID 980 wrote to memory of 4996 | N/A | \??\c:\ffffxrr.exe | \??\c:\nhnhbb.exe |
| PID 980 wrote to memory of 4996 | N/A | \??\c:\ffffxrr.exe | \??\c:\nhnhbb.exe |
| PID 4996 wrote to memory of 1464 | N/A | \??\c:\nhnhbb.exe | \??\c:\vvdvd.exe |
| PID 4996 wrote to memory of 1464 | N/A | \??\c:\nhnhbb.exe | \??\c:\vvdvd.exe |
| PID 4996 wrote to memory of 1464 | N/A | \??\c:\nhnhbb.exe | \??\c:\vvdvd.exe |
| PID 1464 wrote to memory of 3648 | N/A | \??\c:\vvdvd.exe | \??\c:\7vpjj.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\586b0bd5539aca526d396624015ac2f4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\586b0bd5539aca526d396624015ac2f4_JaffaCakes118.exe"
\??\c:\bthhbb.exe
c:\bthhbb.exe
\??\c:\nnntnt.exe
c:\nnntnt.exe
\??\c:\jjdvp.exe
c:\jjdvp.exe
\??\c:\xllxrrl.exe
c:\xllxrrl.exe
\??\c:\hhhhbh.exe
c:\hhhhbh.exe
\??\c:\1nbttn.exe
c:\1nbttn.exe
\??\c:\rrxrxrr.exe
c:\rrxrxrr.exe
\??\c:\3bhbtt.exe
c:\3bhbtt.exe
\??\c:\vvdjp.exe
c:\vvdjp.exe
\??\c:\tnbbbb.exe
c:\tnbbbb.exe
\??\c:\5vpvp.exe
c:\5vpvp.exe
\??\c:\fxlffff.exe
c:\fxlffff.exe
\??\c:\nbnbth.exe
c:\nbnbth.exe
\??\c:\hbhhnh.exe
c:\hbhhnh.exe
\??\c:\rxlrlfl.exe
c:\rxlrlfl.exe
\??\c:\bbbttb.exe
c:\bbbttb.exe
\??\c:\3vjpj.exe
c:\3vjpj.exe
\??\c:\xlxrrfl.exe
c:\xlxrrfl.exe
\??\c:\ffffxrr.exe
c:\ffffxrr.exe
\??\c:\nhnhbb.exe
c:\nhnhbb.exe
\??\c:\vvdvd.exe
c:\vvdvd.exe
\??\c:\7vpjj.exe
c:\7vpjj.exe
\??\c:\rfrlxlx.exe
c:\rfrlxlx.exe
\??\c:\bntnnh.exe
c:\bntnnh.exe
\??\c:\dvpvj.exe
c:\dvpvj.exe
\??\c:\9lllllr.exe
c:\9lllllr.exe
\??\c:\xrrrrxx.exe
c:\xrrrrxx.exe
\??\c:\hhtbhh.exe
c:\hhtbhh.exe
\??\c:\pdppd.exe
c:\pdppd.exe
\??\c:\fxfxrll.exe
c:\fxfxrll.exe
\??\c:\rrxrffl.exe
c:\rrxrffl.exe
\??\c:\9hthbb.exe
c:\9hthbb.exe
\??\c:\nnhthn.exe
c:\nnhthn.exe
\??\c:\jjjpj.exe
c:\jjjpj.exe
\??\c:\lfrlffr.exe
c:\lfrlffr.exe
\??\c:\bnbttb.exe
c:\bnbttb.exe
\??\c:\llrrllf.exe
c:\llrrllf.exe
\??\c:\3lfxrrr.exe
c:\3lfxrrr.exe
\??\c:\ntnntb.exe
c:\ntnntb.exe
\??\c:\hbhhbh.exe
c:\hbhhbh.exe
\??\c:\ppvjj.exe
c:\ppvjj.exe
\??\c:\xlrxrxx.exe
c:\xlrxrxx.exe
\??\c:\xrrlflf.exe
c:\xrrlflf.exe
\??\c:\bhnnhh.exe
c:\bhnnhh.exe
\??\c:\pdppj.exe
c:\pdppj.exe
\??\c:\3rrlrrr.exe
c:\3rrlrrr.exe
\??\c:\btttnn.exe
c:\btttnn.exe
\??\c:\vpdpv.exe
c:\vpdpv.exe
\??\c:\flfrrrr.exe
c:\flfrrrr.exe
\??\c:\ththbh.exe
c:\ththbh.exe
\??\c:\xxflfrr.exe
c:\xxflfrr.exe
\??\c:\flxxrxx.exe
c:\flxxrxx.exe
\??\c:\5hntbt.exe
c:\5hntbt.exe
\??\c:\htbhbt.exe
c:\htbhbt.exe
\??\c:\ddddv.exe
c:\ddddv.exe
\??\c:\xrxxlrl.exe
c:\xrxxlrl.exe
\??\c:\xflllll.exe
c:\xflllll.exe
\??\c:\hhbbhh.exe
c:\hhbbhh.exe
\??\c:\dvvvv.exe
c:\dvvvv.exe
\??\c:\dpjjd.exe
c:\dpjjd.exe
\??\c:\xrrrlll.exe
c:\xrrrlll.exe
\??\c:\hhhhht.exe
c:\hhhhht.exe
\??\c:\ddddd.exe
c:\ddddd.exe
\??\c:\1vpvd.exe
c:\1vpvd.exe
\??\c:\rxfxlrl.exe
c:\rxfxlrl.exe
\??\c:\xlxrrrr.exe
c:\xlxrrrr.exe
\??\c:\ntttnh.exe
c:\ntttnh.exe
\??\c:\dvvvj.exe
c:\dvvvj.exe
\??\c:\ddjdj.exe
c:\ddjdj.exe
\??\c:\lfllrrl.exe
c:\lfllrrl.exe
\??\c:\rlrfffx.exe
c:\rlrfffx.exe
\??\c:\bnhhhh.exe
c:\bnhhhh.exe
\??\c:\5ppjd.exe
c:\5ppjd.exe
\??\c:\rllfxll.exe
c:\rllfxll.exe
\??\c:\9xxflll.exe
c:\9xxflll.exe
\??\c:\nhnnnn.exe
c:\nhnnnn.exe
\??\c:\thbthn.exe
c:\thbthn.exe
\??\c:\jppdd.exe
c:\jppdd.exe
\??\c:\rflllll.exe
c:\rflllll.exe
\??\c:\3xllrrl.exe
c:\3xllrrl.exe
\??\c:\tnbtbn.exe
c:\tnbtbn.exe
\??\c:\tnnhhh.exe
c:\tnnhhh.exe
\??\c:\9ddvp.exe
c:\9ddvp.exe
\??\c:\ffrffxl.exe
c:\ffrffxl.exe
\??\c:\hnbhhb.exe
c:\hnbhhb.exe
\??\c:\tntttt.exe
c:\tntttt.exe
\??\c:\jpjjd.exe
c:\jpjjd.exe
\??\c:\frxxrrl.exe
c:\frxxrrl.exe
\??\c:\xxfxflr.exe
c:\xxfxflr.exe
\??\c:\7tnnhb.exe
c:\7tnnhb.exe
\??\c:\bhbhhb.exe
c:\bhbhhb.exe
\??\c:\jvvpj.exe
c:\jvvpj.exe
\??\c:\pvpdp.exe
c:\pvpdp.exe
\??\c:\1ffxxff.exe
c:\1ffxxff.exe
\??\c:\7xffxxx.exe
c:\7xffxxx.exe
\??\c:\bnbnbh.exe
c:\bnbnbh.exe
\??\c:\vvvjv.exe
c:\vvvjv.exe
\??\c:\vvddj.exe
c:\vvddj.exe
\??\c:\rlffffl.exe
c:\rlffffl.exe
\??\c:\hhbhtt.exe
c:\hhbhtt.exe
\??\c:\hhntth.exe
c:\hhntth.exe
\??\c:\vjpjd.exe
c:\vjpjd.exe
\??\c:\vdjdd.exe
c:\vdjdd.exe
\??\c:\rxxrlll.exe
c:\rxxrlll.exe
\??\c:\hbhntt.exe
c:\hbhntt.exe
\??\c:\bhbtnn.exe
c:\bhbtnn.exe
\??\c:\jvvdv.exe
c:\jvvdv.exe
\??\c:\vjdpd.exe
c:\vjdpd.exe
\??\c:\rfflxxl.exe
c:\rfflxxl.exe
\??\c:\nbbnbn.exe
c:\nbbnbn.exe
\??\c:\bbnbnh.exe
c:\bbnbnh.exe
\??\c:\vvjdv.exe
c:\vvjdv.exe
\??\c:\lflfrrx.exe
c:\lflfrrx.exe
\??\c:\fxlfxrf.exe
c:\fxlfxrf.exe
\??\c:\nnhnbn.exe
c:\nnhnbn.exe
\??\c:\dppvj.exe
c:\dppvj.exe
\??\c:\7vvpp.exe
c:\7vvpp.exe
\??\c:\frrfxrr.exe
c:\frrfxrr.exe
\??\c:\nhnbnb.exe
c:\nhnbnb.exe
\??\c:\5hhbtt.exe
c:\5hhbtt.exe
\??\c:\dddpd.exe
c:\dddpd.exe
\??\c:\vppjd.exe
c:\vppjd.exe
\??\c:\fxrrxxx.exe
c:\fxrrxxx.exe
\??\c:\rffxxxl.exe
c:\rffxxxl.exe
\??\c:\bntbtt.exe
c:\bntbtt.exe
\??\c:\bbbtnh.exe
c:\bbbtnh.exe
\??\c:\jdvpv.exe
c:\jdvpv.exe
\??\c:\dvjdv.exe
c:\dvjdv.exe
\??\c:\fxxrxxf.exe
c:\fxxrxxf.exe
\??\c:\xfxxrrl.exe
c:\xfxxrrl.exe
\??\c:\nhnnhh.exe
c:\nhnnhh.exe
\??\c:\3bthbh.exe
c:\3bthbh.exe
\??\c:\pjdjv.exe
c:\pjdjv.exe
\??\c:\fxffxxf.exe
c:\fxffxxf.exe
\??\c:\thbthb.exe
c:\thbthb.exe
\??\c:\hnhhbt.exe
c:\hnhhbt.exe
\??\c:\nhhbtt.exe
c:\nhhbtt.exe
\??\c:\dppjd.exe
c:\dppjd.exe
\??\c:\vdvdj.exe
c:\vdvdj.exe
\??\c:\rlxrllr.exe
c:\rlxrllr.exe
\??\c:\bbnbtt.exe
c:\bbnbtt.exe
\??\c:\1hhbbb.exe
c:\1hhbbb.exe
\??\c:\pddvv.exe
c:\pddvv.exe
\??\c:\ddjdj.exe
c:\ddjdj.exe
\??\c:\pjjjd.exe
c:\pjjjd.exe
\??\c:\7lffffr.exe
c:\7lffffr.exe
\??\c:\rlfxrrr.exe
c:\rlfxrrr.exe
\??\c:\htbbbb.exe
c:\htbbbb.exe
\??\c:\tnhtbn.exe
c:\tnhtbn.exe
\??\c:\pjdpp.exe
c:\pjdpp.exe
\??\c:\dpvpp.exe
c:\dpvpp.exe
\??\c:\frrrllf.exe
c:\frrrllf.exe
\??\c:\ttnbnh.exe
c:\ttnbnh.exe
\??\c:\hbbttt.exe
c:\hbbttt.exe
\??\c:\llxflxr.exe
c:\llxflxr.exe
\??\c:\nbbbbb.exe
c:\nbbbbb.exe
\??\c:\pjdvp.exe
c:\pjdvp.exe
\??\c:\3jppj.exe
c:\3jppj.exe
\??\c:\bbbnnn.exe
c:\bbbnnn.exe
\??\c:\1djvp.exe
c:\1djvp.exe
\??\c:\1pjdv.exe
c:\1pjdv.exe
\??\c:\frllxxx.exe
c:\frllxxx.exe
\??\c:\lffxrrr.exe
c:\lffxrrr.exe
\??\c:\thtntt.exe
c:\thtntt.exe
\??\c:\3jdvp.exe
c:\3jdvp.exe
\??\c:\vpdvv.exe
c:\vpdvv.exe
\??\c:\lfxrlxx.exe
c:\lfxrlxx.exe
\??\c:\frrlffx.exe
c:\frrlffx.exe
\??\c:\thhbtt.exe
c:\thhbtt.exe
\??\c:\jvjdv.exe
c:\jvjdv.exe
\??\c:\vjjdp.exe
c:\vjjdp.exe
\??\c:\fxfxrrr.exe
c:\fxfxrrr.exe
\??\c:\lxfrllx.exe
c:\lxfrllx.exe
\??\c:\btbbhh.exe
c:\btbbhh.exe
\??\c:\jddvp.exe
c:\jddvp.exe
\??\c:\rrrlffx.exe
c:\rrrlffx.exe
\??\c:\frllffx.exe
c:\frllffx.exe
\??\c:\nhhhhn.exe
c:\nhhhhn.exe
\??\c:\jpvjd.exe
c:\jpvjd.exe
\??\c:\5xxrfff.exe
c:\5xxrfff.exe
\??\c:\rlxxfxx.exe
c:\rlxxfxx.exe
\??\c:\btnhtt.exe
c:\btnhtt.exe
\??\c:\hbbhtt.exe
c:\hbbhtt.exe
\??\c:\jpppj.exe
c:\jpppj.exe
\??\c:\pddvj.exe
c:\pddvj.exe
\??\c:\fffrlll.exe
c:\fffrlll.exe
\??\c:\fxxxrrr.exe
c:\fxxxrrr.exe
\??\c:\hnbttn.exe
c:\hnbttn.exe
\??\c:\pppvp.exe
c:\pppvp.exe
\??\c:\xllfxxr.exe
c:\xllfxxr.exe
\??\c:\rrlfxfx.exe
c:\rrlfxfx.exe
\??\c:\3bhbnt.exe
c:\3bhbnt.exe
\??\c:\bhnnnn.exe
c:\bhnnnn.exe
\??\c:\dpdjd.exe
c:\dpdjd.exe
\??\c:\djjvj.exe
c:\djjvj.exe
\??\c:\frrlrfr.exe
c:\frrlrfr.exe
\??\c:\tbhbbb.exe
c:\tbhbbb.exe
\??\c:\ttbhnh.exe
c:\ttbhnh.exe
\??\c:\ppvpj.exe
c:\ppvpj.exe
\??\c:\vpvvp.exe
c:\vpvvp.exe
\??\c:\xrfxrrx.exe
c:\xrfxrrx.exe
\??\c:\llrxlxx.exe
c:\llrxlxx.exe
\??\c:\fxrlrxx.exe
c:\fxrlrxx.exe
\??\c:\tthbnn.exe
c:\tthbnn.exe
\??\c:\hnbbnn.exe
c:\hnbbnn.exe
\??\c:\jdddd.exe
c:\jdddd.exe
\??\c:\lrrrlll.exe
c:\lrrrlll.exe
\??\c:\xxlxxrf.exe
c:\xxlxxrf.exe
\??\c:\ttbtbb.exe
c:\ttbtbb.exe
\??\c:\nhhbbb.exe
c:\nhhbbb.exe
\??\c:\3hbnhh.exe
c:\3hbnhh.exe
\??\c:\pjdvp.exe
c:\pjdvp.exe
\??\c:\1vjdv.exe
c:\1vjdv.exe
\??\c:\7llfflf.exe
c:\7llfflf.exe
\??\c:\ttbbnn.exe
c:\ttbbnn.exe
\??\c:\nhnhbn.exe
c:\nhnhbn.exe
\??\c:\jpddd.exe
c:\jpddd.exe
\??\c:\xlrlfll.exe
c:\xlrlfll.exe
\??\c:\rrfffll.exe
c:\rrfffll.exe
\??\c:\btnttn.exe
c:\btnttn.exe
\??\c:\vddjd.exe
c:\vddjd.exe
\??\c:\3pvpj.exe
c:\3pvpj.exe
\??\c:\xflllxl.exe
c:\xflllxl.exe
\??\c:\3llfxfx.exe
c:\3llfxfx.exe
\??\c:\bnnbtb.exe
c:\bnnbtb.exe
\??\c:\ddvvp.exe
c:\ddvvp.exe
\??\c:\dpvdp.exe
c:\dpvdp.exe
\??\c:\lflffxx.exe
c:\lflffxx.exe
\??\c:\xfllfrx.exe
c:\xfllfrx.exe
\??\c:\bnnnnn.exe
c:\bnnnnn.exe
\??\c:\nbhhhn.exe
c:\nbhhhn.exe
\??\c:\vvvvp.exe
c:\vvvvp.exe
\??\c:\vjvpv.exe
c:\vjvpv.exe
\??\c:\lxxxxff.exe
c:\lxxxxff.exe
\??\c:\5hbttt.exe
c:\5hbttt.exe
\??\c:\bthtnn.exe
c:\bthtnn.exe
\??\c:\hthbtn.exe
c:\hthbtn.exe
\??\c:\9jjjj.exe
c:\9jjjj.exe
\??\c:\fxfxrrr.exe
c:\fxfxrrr.exe
\??\c:\rrrrrxr.exe
c:\rrrrrxr.exe
\??\c:\frfxrrl.exe
c:\frfxrrl.exe
\??\c:\hbbtbb.exe
c:\hbbtbb.exe
\??\c:\pjvpj.exe
c:\pjvpj.exe
\??\c:\vpvpp.exe
c:\vpvpp.exe
\??\c:\frxrfxx.exe
c:\frxrfxx.exe
\??\c:\xrffrxf.exe
c:\xrffrxf.exe
\??\c:\bttnhh.exe
c:\bttnhh.exe
\??\c:\bhbtbn.exe
c:\bhbtbn.exe
\??\c:\pdjjv.exe
c:\pdjjv.exe
\??\c:\jpdvj.exe
c:\jpdvj.exe
\??\c:\fxxfxxr.exe
c:\fxxfxxr.exe
\??\c:\bntnbb.exe
c:\bntnbb.exe
\??\c:\nnnhbb.exe
c:\nnnhbb.exe
\??\c:\ppddp.exe
c:\ppddp.exe
\??\c:\vvjdv.exe
c:\vvjdv.exe
\??\c:\ddjdd.exe
c:\ddjdd.exe
\??\c:\xrlfxff.exe
c:\xrlfxff.exe
\??\c:\rlfxrrl.exe
c:\rlfxrrl.exe
\??\c:\hhbbtt.exe
c:\hhbbtt.exe
\??\c:\tbthnh.exe
c:\tbthnh.exe
\??\c:\pvvpp.exe
c:\pvvpp.exe
\??\c:\xxxxrrr.exe
c:\xxxxrrr.exe
\??\c:\bnnttb.exe
c:\bnnttb.exe
\??\c:\7btnhh.exe
c:\7btnhh.exe
\??\c:\7ddvv.exe
c:\7ddvv.exe
\??\c:\pvddp.exe
c:\pvddp.exe
\??\c:\ffrlxxf.exe
c:\ffrlxxf.exe
\??\c:\thhbtt.exe
c:\thhbtt.exe
\??\c:\ttbbtb.exe
c:\ttbbtb.exe
\??\c:\jvdvp.exe
c:\jvdvp.exe
\??\c:\pjjdp.exe
c:\pjjdp.exe
\??\c:\rlrlrrr.exe
c:\rlrlrrr.exe
\??\c:\lxlrrfr.exe
c:\lxlrrfr.exe
\??\c:\ttbbbn.exe
c:\ttbbbn.exe
\??\c:\nnnhhh.exe
c:\nnnhhh.exe
\??\c:\vvdvp.exe
c:\vvdvp.exe
\??\c:\jjpjd.exe
c:\jjpjd.exe
\??\c:\3frlfff.exe
c:\3frlfff.exe
\??\c:\lxxxxxx.exe
c:\lxxxxxx.exe
\??\c:\tnbttb.exe
c:\tnbttb.exe
\??\c:\nbbtnn.exe
c:\nbbtnn.exe
\??\c:\1pdvv.exe
c:\1pdvv.exe
\??\c:\fffllll.exe
c:\fffllll.exe
\??\c:\xffxlfr.exe
c:\xffxlfr.exe
\??\c:\htttbn.exe
c:\htttbn.exe
\??\c:\jdppd.exe
c:\jdppd.exe
\??\c:\pvppd.exe
c:\pvppd.exe
\??\c:\xfrlfxx.exe
c:\xfrlfxx.exe
\??\c:\5fxxxxx.exe
c:\5fxxxxx.exe
\??\c:\hthhbt.exe
c:\hthhbt.exe
\??\c:\thbbhb.exe
c:\thbbhb.exe
\??\c:\vjpjj.exe
c:\vjpjj.exe
\??\c:\pdpjj.exe
c:\pdpjj.exe
\??\c:\xlffrrr.exe
c:\xlffrrr.exe
\??\c:\frfxrrx.exe
c:\frfxrrx.exe
\??\c:\thtnnn.exe
c:\thtnnn.exe
\??\c:\tnhbtt.exe
c:\tnhbtt.exe
\??\c:\9jpjp.exe
c:\9jpjp.exe
\??\c:\vpddj.exe
c:\vpddj.exe
\??\c:\fxfxfxf.exe
c:\fxfxfxf.exe
\??\c:\3llxrrx.exe
c:\3llxrrx.exe
\??\c:\3tttnb.exe
c:\3tttnb.exe
\??\c:\nbbtnn.exe
c:\nbbtnn.exe
\??\c:\jjjpj.exe
c:\jjjpj.exe
\??\c:\jjvvd.exe
c:\jjvvd.exe
\??\c:\rlrllll.exe
c:\rlrllll.exe
\??\c:\lfrlrrx.exe
c:\lfrlrrx.exe
\??\c:\thnnbb.exe
c:\thnnbb.exe
\??\c:\bbbnnn.exe
c:\bbbnnn.exe
\??\c:\jjpvp.exe
c:\jjpvp.exe
\??\c:\jdvpp.exe
c:\jdvpp.exe
\??\c:\rfxrllf.exe
c:\rfxrllf.exe
\??\c:\xlflrxf.exe
c:\xlflrxf.exe
\??\c:\hnhhbb.exe
c:\hnhhbb.exe
\??\c:\hbhbhh.exe
c:\hbhbhh.exe
\??\c:\jjvdd.exe
c:\jjvdd.exe
\??\c:\7jddd.exe
c:\7jddd.exe
\??\c:\5xrlllf.exe
c:\5xrlllf.exe
\??\c:\thhhhh.exe
c:\thhhhh.exe
\??\c:\nbhbnn.exe
c:\nbhbnn.exe
\??\c:\3vdpd.exe
c:\3vdpd.exe
\??\c:\frrrfff.exe
c:\frrrfff.exe
\??\c:\lxxrllr.exe
c:\lxxrllr.exe
\??\c:\thhhbb.exe
c:\thhhbb.exe
\??\c:\nhbttt.exe
c:\nhbttt.exe
\??\c:\3jjpj.exe
c:\3jjpj.exe
\??\c:\vvppp.exe
c:\vvppp.exe
\??\c:\7xfxffl.exe
c:\7xfxffl.exe
\??\c:\fxfxxxf.exe
c:\fxfxxxf.exe
\??\c:\lxfxxrl.exe
c:\lxfxxrl.exe
\??\c:\bttnhh.exe
c:\bttnhh.exe
\??\c:\hbbtnn.exe
c:\hbbtnn.exe
\??\c:\jvjjj.exe
c:\jvjjj.exe
\??\c:\rrrrlrr.exe
c:\rrrrlrr.exe
\??\c:\3rllrrx.exe
c:\3rllrrx.exe
\??\c:\tbhhbb.exe
c:\tbhhbb.exe
\??\c:\nnnnnn.exe
c:\nnnnnn.exe
\??\c:\vpdvp.exe
c:\vpdvp.exe
\??\c:\pdjjv.exe
c:\pdjjv.exe
\??\c:\ddpjd.exe
c:\ddpjd.exe
\??\c:\lxlfxxx.exe
c:\lxlfxxx.exe
\??\c:\3nhhbb.exe
c:\3nhhbb.exe
\??\c:\7tnnhh.exe
c:\7tnnhh.exe
\??\c:\dppdj.exe
c:\dppdj.exe
\??\c:\dvpdj.exe
c:\dvpdj.exe
\??\c:\3xrrlrr.exe
c:\3xrrlrr.exe
\??\c:\flllfff.exe
c:\flllfff.exe
\??\c:\7hnbtn.exe
c:\7hnbtn.exe
\??\c:\9ppjd.exe
c:\9ppjd.exe
\??\c:\jpppj.exe
c:\jpppj.exe
\??\c:\3rxrllf.exe
c:\3rxrllf.exe
\??\c:\7xxflrx.exe
c:\7xxflrx.exe
\??\c:\bnhnht.exe
c:\bnhnht.exe
\??\c:\7hhtnn.exe
c:\7hhtnn.exe
\??\c:\vpppp.exe
c:\vpppp.exe
\??\c:\jvvpj.exe
c:\jvvpj.exe
\??\c:\rrxxrrl.exe
c:\rrxxrrl.exe
\??\c:\hbhbbh.exe
c:\hbhbbh.exe
\??\c:\nbnhbb.exe
c:\nbnhbb.exe
\??\c:\vjjdv.exe
c:\vjjdv.exe
\??\c:\vpvvv.exe
c:\vpvvv.exe
\??\c:\rrxlrll.exe
c:\rrxlrll.exe
\??\c:\xlrlllf.exe
c:\xlrlllf.exe
\??\c:\btbtnt.exe
c:\btbtnt.exe
\??\c:\hbbnnh.exe
c:\hbbnnh.exe
\??\c:\jppjd.exe
c:\jppjd.exe
\??\c:\ppvvj.exe
c:\ppvvj.exe
\??\c:\rrlrrxx.exe
c:\rrlrrxx.exe
\??\c:\lrxrllf.exe
c:\lrxrllf.exe
\??\c:\bthhbb.exe
c:\bthhbb.exe
\??\c:\ttbbtt.exe
c:\ttbbtt.exe
\??\c:\jvvpj.exe
c:\jvvpj.exe
\??\c:\ppvpj.exe
c:\ppvpj.exe
\??\c:\fflfxxr.exe
c:\fflfxxr.exe
\??\c:\fxlxrxx.exe
c:\fxlxrxx.exe
\??\c:\7bnntb.exe
c:\7bnntb.exe
\??\c:\nhtntt.exe
c:\nhtntt.exe
\??\c:\9vddp.exe
c:\9vddp.exe
\??\c:\vvjdd.exe
c:\vvjdd.exe
\??\c:\rxrfxfr.exe
c:\rxrfxfr.exe
\??\c:\fxlxxrx.exe
c:\fxlxxrx.exe
\??\c:\nhhhnn.exe
c:\nhhhnn.exe
\??\c:\bbhbtt.exe
c:\bbhbtt.exe
\??\c:\djvjd.exe
c:\djvjd.exe
\??\c:\pvvvp.exe
c:\pvvvp.exe
\??\c:\fxfflrx.exe
c:\fxfflrx.exe
\??\c:\nhttbh.exe
c:\nhttbh.exe
\??\c:\djjjj.exe
c:\djjjj.exe
\??\c:\jpjjv.exe
c:\jpjjv.exe
\??\c:\xrrxlrr.exe
c:\xrrxlrr.exe
\??\c:\llfffff.exe
c:\llfffff.exe
\??\c:\5hnnnn.exe
c:\5hnnnn.exe
\??\c:\ppddd.exe
c:\ppddd.exe
\??\c:\dvjdv.exe
c:\dvjdv.exe
\??\c:\7xfxfll.exe
c:\7xfxfll.exe
\??\c:\hhhbbb.exe
c:\hhhbbb.exe
\??\c:\bhnntt.exe
c:\bhnntt.exe
\??\c:\ddjjp.exe
c:\ddjjp.exe
\??\c:\lffffxr.exe
c:\lffffxr.exe
\??\c:\tbbtnh.exe
c:\tbbtnh.exe
\??\c:\httnnb.exe
c:\httnnb.exe
\??\c:\ddddp.exe
c:\ddddp.exe
\??\c:\vjdjp.exe
c:\vjdjp.exe
\??\c:\lllxffr.exe
c:\lllxffr.exe
\??\c:\tttnht.exe
c:\tttnht.exe
\??\c:\vpvpp.exe
c:\vpvpp.exe
\??\c:\ddjjd.exe
c:\ddjjd.exe
\??\c:\xrxrfff.exe
c:\xrxrfff.exe
\??\c:\hntthh.exe
c:\hntthh.exe
\??\c:\pdvvd.exe
c:\pdvvd.exe
\??\c:\9ppjd.exe
c:\9ppjd.exe
\??\c:\jjppj.exe
c:\jjppj.exe
\??\c:\ffffxff.exe
c:\ffffxff.exe
\??\c:\rflxxlx.exe
c:\rflxxlx.exe
\??\c:\ttbbtt.exe
c:\ttbbtt.exe
\??\c:\bhtnbn.exe
c:\bhtnbn.exe
\??\c:\dvjpj.exe
c:\dvjpj.exe
\??\c:\lfxrxxx.exe
c:\lfxrxxx.exe
\??\c:\llfxllx.exe
c:\llfxllx.exe
\??\c:\bhhbtt.exe
c:\bhhbtt.exe
\??\c:\7hhbtt.exe
c:\7hhbtt.exe
\??\c:\pvddv.exe
c:\pvddv.exe
\??\c:\dpdvp.exe
c:\dpdvp.exe
\??\c:\rllfxll.exe
c:\rllfxll.exe
\??\c:\btbbbn.exe
c:\btbbbn.exe
\??\c:\tbbhtb.exe
c:\tbbhtb.exe
\??\c:\vdjjd.exe
c:\vdjjd.exe
\??\c:\pvvvv.exe
c:\pvvvv.exe
\??\c:\xrlrfrx.exe
c:\xrlrfrx.exe
\??\c:\lrlflfr.exe
c:\lrlflfr.exe
\??\c:\httnbh.exe
c:\httnbh.exe
\??\c:\pppjd.exe
c:\pppjd.exe
\??\c:\vddvp.exe
c:\vddvp.exe
\??\c:\1vvvj.exe
c:\1vvvj.exe
\??\c:\llxlfll.exe
c:\llxlfll.exe
\??\c:\rlrlllr.exe
c:\rlrlllr.exe
\??\c:\thnnnn.exe
c:\thnnnn.exe
\??\c:\jppjd.exe
c:\jppjd.exe
\??\c:\7jvvp.exe
c:\7jvvp.exe
\??\c:\llrlxfx.exe
c:\llrlxfx.exe
\??\c:\xrrlrrl.exe
c:\xrrlrrl.exe
\??\c:\ntbhbn.exe
c:\ntbhbn.exe
\??\c:\vjvpj.exe
c:\vjvpj.exe
\??\c:\ppppj.exe
c:\ppppj.exe
\??\c:\rflxrxx.exe
c:\rflxrxx.exe
\??\c:\htbtnh.exe
c:\htbtnh.exe
\??\c:\nbnthh.exe
c:\nbnthh.exe
\??\c:\dvvvp.exe
c:\dvvvp.exe
\??\c:\frflrxf.exe
c:\frflrxf.exe
\??\c:\xrllxxr.exe
c:\xrllxxr.exe
\??\c:\nbnttb.exe
c:\nbnttb.exe
\??\c:\vvjdv.exe
c:\vvjdv.exe
\??\c:\9pjdv.exe
c:\9pjdv.exe
\??\c:\frrfxrl.exe
c:\frrfxrl.exe
\??\c:\bthnbh.exe
c:\bthnbh.exe
\??\c:\hbtnhh.exe
c:\hbtnhh.exe
\??\c:\3vdvp.exe
c:\3vdvp.exe
\??\c:\lffxfxf.exe
c:\lffxfxf.exe
\??\c:\lxxxxfl.exe
c:\lxxxxfl.exe
\??\c:\1ntbtt.exe
c:\1ntbtt.exe
\??\c:\dvvvv.exe
c:\dvvvv.exe
\??\c:\jpdpd.exe
c:\jpdpd.exe
\??\c:\xrxxxrl.exe
c:\xrxxxrl.exe
\??\c:\hbbbhh.exe
c:\hbbbhh.exe
\??\c:\nnnnhh.exe
c:\nnnnhh.exe
\??\c:\djjjd.exe
c:\djjjd.exe
\??\c:\rlfllfl.exe
c:\rlfllfl.exe
\??\c:\xrrrlrl.exe
c:\xrrrlrl.exe
\??\c:\3htbnn.exe
c:\3htbnn.exe
\??\c:\nntntt.exe
c:\nntntt.exe
\??\c:\dpdvv.exe
c:\dpdvv.exe
\??\c:\frflllf.exe
c:\frflllf.exe
\??\c:\nntntt.exe
c:\nntntt.exe
\??\c:\9ttnhb.exe
c:\9ttnhb.exe
\??\c:\dppjj.exe
c:\dppjj.exe
\??\c:\frxxrll.exe
c:\frxxrll.exe
\??\c:\rxfxxrx.exe
c:\rxfxxrx.exe
\??\c:\btntnt.exe
c:\btntnt.exe
\??\c:\jddjj.exe
c:\jddjj.exe
\??\c:\dpdvv.exe
c:\dpdvv.exe
\??\c:\xxxrrlf.exe
c:\xxxrrlf.exe
\??\c:\7rrllxr.exe
c:\7rrllxr.exe
\??\c:\btnhbb.exe
c:\btnhbb.exe
\??\c:\ddjpp.exe
c:\ddjpp.exe
\??\c:\jdpjd.exe
c:\jdpjd.exe
\??\c:\3llfrff.exe
c:\3llfrff.exe
\??\c:\lffxrlf.exe
c:\lffxrlf.exe
\??\c:\3ntntt.exe
c:\3ntntt.exe
\??\c:\5ddvp.exe
c:\5ddvp.exe
\??\c:\fllfxxr.exe
c:\fllfxxr.exe
\??\c:\rrrrffl.exe
c:\rrrrffl.exe
\??\c:\ntttnn.exe
c:\ntttnn.exe
\??\c:\dpppd.exe
c:\dpppd.exe
\??\c:\dpvvp.exe
c:\dpvvp.exe
\??\c:\frllxff.exe
c:\frllxff.exe
\??\c:\nhhhhn.exe
c:\nhhhhn.exe
\??\c:\vvvvj.exe
c:\vvvvj.exe
\??\c:\pjvpv.exe
c:\pjvpv.exe
\??\c:\lxlrlll.exe
c:\lxlrlll.exe
\??\c:\rlrrxrf.exe
c:\rlrrxrf.exe
\??\c:\hthbtt.exe
c:\hthbtt.exe
\??\c:\vpvpj.exe
c:\vpvpj.exe
\??\c:\rlrlffx.exe
c:\rlrlffx.exe
\??\c:\tthhhh.exe
c:\tthhhh.exe
\??\c:\jdddp.exe
c:\jdddp.exe
\??\c:\fxfrxrf.exe
c:\fxfrxrf.exe
\??\c:\rrrrllx.exe
c:\rrrrllx.exe
\??\c:\7nbhhh.exe
c:\7nbhhh.exe
\??\c:\bnttbb.exe
c:\bnttbb.exe
\??\c:\jjjjj.exe
c:\jjjjj.exe
\??\c:\lrflfxl.exe
c:\lrflfxl.exe
\??\c:\lrxrrrl.exe
c:\lrxrrrl.exe
\??\c:\btttnn.exe
c:\btttnn.exe
\??\c:\nhhnbb.exe
c:\nhhnbb.exe
\??\c:\jvdvj.exe
c:\jvdvj.exe
\??\c:\lxxlrlf.exe
c:\lxxlrlf.exe
\??\c:\7rrlllf.exe
c:\7rrlllf.exe
\??\c:\thbbtt.exe
c:\thbbtt.exe
\??\c:\3pjjd.exe
c:\3pjjd.exe
\??\c:\pvjdd.exe
c:\pvjdd.exe
\??\c:\lrxlfll.exe
c:\lrxlfll.exe
\??\c:\xxffxff.exe
c:\xxffxff.exe
\??\c:\bhttbb.exe
c:\bhttbb.exe
\??\c:\nhttnt.exe
c:\nhttnt.exe
\??\c:\vvddd.exe
c:\vvddd.exe
\??\c:\1flffll.exe
c:\1flffll.exe
\??\c:\rxxxxxx.exe
c:\rxxxxxx.exe
\??\c:\3btbbh.exe
c:\3btbbh.exe
\??\c:\jvvvv.exe
c:\jvvvv.exe
\??\c:\dddjj.exe
c:\dddjj.exe
\??\c:\rlrxllf.exe
c:\rlrxllf.exe
\??\c:\rrrlffx.exe
c:\rrrlffx.exe
\??\c:\tbbtnb.exe
c:\tbbtnb.exe
\??\c:\nbhhbb.exe
c:\nbhhbb.exe
\??\c:\ddvvv.exe
c:\ddvvv.exe
\??\c:\3xfxxxr.exe
c:\3xfxxxr.exe
\??\c:\xxlxlrr.exe
c:\xxlxlrr.exe
\??\c:\3bbbtb.exe
c:\3bbbtb.exe
\??\c:\1bbbtb.exe
c:\1bbbtb.exe
\??\c:\vjpvp.exe
c:\vjpvp.exe
\??\c:\5pjjd.exe
c:\5pjjd.exe
\??\c:\xlllffx.exe
c:\xlllffx.exe
\??\c:\bbbthb.exe
c:\bbbthb.exe
\??\c:\vjvvj.exe
c:\vjvvj.exe
\??\c:\jjvvp.exe
c:\jjvvp.exe
\??\c:\1xllrrf.exe
c:\1xllrrf.exe
\??\c:\nnnntt.exe
c:\nnnntt.exe
\??\c:\thhttb.exe
c:\thhttb.exe
\??\c:\vdvvp.exe
c:\vdvvp.exe
\??\c:\rfffxfx.exe
c:\rfffxfx.exe
\??\c:\xrxffrr.exe
c:\xrxffrr.exe
\??\c:\nhtbnn.exe
c:\nhtbnn.exe
\??\c:\vjjjj.exe
c:\vjjjj.exe
\??\c:\1pjdd.exe
c:\1pjdd.exe
\??\c:\xlfllxx.exe
c:\xlfllxx.exe
\??\c:\bnthbt.exe
c:\bnthbt.exe
\??\c:\hhbbbh.exe
c:\hhbbbh.exe
\??\c:\djdpj.exe
c:\djdpj.exe
\??\c:\dvpjd.exe
c:\dvpjd.exe
\??\c:\xrlfrff.exe
c:\xrlfrff.exe
\??\c:\tnnbbb.exe
c:\tnnbbb.exe
\??\c:\pjjdv.exe
c:\pjjdv.exe
\??\c:\pjvpd.exe
c:\pjvpd.exe
\??\c:\5lfrffr.exe
c:\5lfrffr.exe
\??\c:\htnbbh.exe
c:\htnbbh.exe
\??\c:\3bbtbt.exe
c:\3bbtbt.exe
\??\c:\xfffxff.exe
c:\xfffxff.exe
\??\c:\lrrrlrr.exe
c:\lrrrlrr.exe
\??\c:\tbhtnh.exe
c:\tbhtnh.exe
\??\c:\httbbh.exe
c:\httbbh.exe
\??\c:\7jvvd.exe
c:\7jvvd.exe
\??\c:\9rxxlll.exe
c:\9rxxlll.exe
\??\c:\lrrxflx.exe
c:\lrrxflx.exe
\??\c:\nbttbh.exe
c:\nbttbh.exe
\??\c:\jvddp.exe
c:\jvddp.exe
\??\c:\fxxxrlf.exe
c:\fxxxrlf.exe
\??\c:\9rfxrlx.exe
c:\9rfxrlx.exe
\??\c:\hhbhnt.exe
c:\hhbhnt.exe
\??\c:\pjvvv.exe
c:\pjvvv.exe
\??\c:\lllffff.exe
c:\lllffff.exe
\??\c:\flflflx.exe
c:\flflflx.exe
\??\c:\nnnnbn.exe
c:\nnnnbn.exe
\??\c:\thhbnt.exe
c:\thhbnt.exe
\??\c:\jjvvd.exe
c:\jjvvd.exe
\??\c:\xfrrrxx.exe
c:\xfrrrxx.exe
\??\c:\rlrfxfx.exe
c:\rlrfxfx.exe
\??\c:\ttbnbn.exe
c:\ttbnbn.exe
\??\c:\1dpvd.exe
c:\1dpvd.exe
\??\c:\jjpjj.exe
c:\jjpjj.exe
\??\c:\lfxxllx.exe
c:\lfxxllx.exe
\??\c:\flxrrxx.exe
c:\flxrrxx.exe
\??\c:\hnhbtb.exe
c:\hnhbtb.exe
\??\c:\djvjp.exe
c:\djvjp.exe
\??\c:\jpppv.exe
c:\jpppv.exe
\??\c:\xfrllll.exe
c:\xfrllll.exe
\??\c:\hbbttt.exe
c:\hbbttt.exe
\??\c:\bbttbh.exe
c:\bbttbh.exe
\??\c:\9nttnn.exe
c:\9nttnn.exe
\??\c:\ddppj.exe
c:\ddppj.exe
\??\c:\xlfllll.exe
c:\xlfllll.exe
\??\c:\rlfrlrr.exe
c:\rlfrlrr.exe
\??\c:\hhhhbt.exe
c:\hhhhbt.exe
\??\c:\1nthhh.exe
c:\1nthhh.exe
\??\c:\jvjdj.exe
c:\jvjdj.exe
\??\c:\rllrfff.exe
c:\rllrfff.exe
\??\c:\lflllrr.exe
c:\lflllrr.exe
\??\c:\hbntbh.exe
c:\hbntbh.exe
\??\c:\jvdjp.exe
c:\jvdjp.exe
\??\c:\1vdvj.exe
c:\1vdvj.exe
\??\c:\rxrrfxf.exe
c:\rxrrfxf.exe
\??\c:\lfxxxxx.exe
c:\lfxxxxx.exe
\??\c:\nhhhbb.exe
c:\nhhhbb.exe
\??\c:\bhhbhh.exe
c:\bhhbhh.exe
\??\c:\9dvjd.exe
c:\9dvjd.exe
\??\c:\jjvvj.exe
c:\jjvvj.exe
\??\c:\5fxxrrr.exe
c:\5fxxrrr.exe
\??\c:\rlflllx.exe
c:\rlflllx.exe
\??\c:\nnnnhh.exe
c:\nnnnhh.exe
\??\c:\9nttbt.exe
c:\9nttbt.exe
\??\c:\jdjpj.exe
c:\jdjpj.exe
\??\c:\3vvpp.exe
c:\3vvpp.exe
\??\c:\xxrlrrf.exe
c:\xxrlrrf.exe
\??\c:\hhtbbh.exe
c:\hhtbbh.exe
\??\c:\hbtthh.exe
c:\hbtthh.exe
\??\c:\tthnhh.exe
c:\tthnhh.exe
\??\c:\vpppv.exe
c:\vpppv.exe
\??\c:\vvddv.exe
c:\vvddv.exe
\??\c:\llxxlll.exe
c:\llxxlll.exe
\??\c:\rlfxrrx.exe
c:\rlfxrrx.exe
\??\c:\ttbttt.exe
c:\ttbttt.exe
\??\c:\bhhbbh.exe
c:\bhhbbh.exe
\??\c:\3pvdp.exe
c:\3pvdp.exe
\??\c:\jvpvp.exe
c:\jvpvp.exe
\??\c:\jvvpj.exe
c:\jvvpj.exe
\??\c:\ffrrlll.exe
c:\ffrrlll.exe
\??\c:\llfxxfr.exe
c:\llfxxfr.exe
\??\c:\tnbhbh.exe
c:\tnbhbh.exe
\??\c:\nnhnth.exe
c:\nnhnth.exe
\??\c:\jpdjj.exe
c:\jpdjj.exe
\??\c:\rlxrrrl.exe
c:\rlxrrrl.exe
\??\c:\fxrllll.exe
c:\fxrllll.exe
\??\c:\bhnnnn.exe
c:\bhnnnn.exe
\??\c:\pdvdv.exe
c:\pdvdv.exe
\??\c:\ddvvj.exe
c:\ddvvj.exe
\??\c:\lllfrlx.exe
c:\lllfrlx.exe
\??\c:\tttnnn.exe
c:\tttnnn.exe
\??\c:\1dvjd.exe
c:\1dvjd.exe
\??\c:\llxrxfl.exe
c:\llxrxfl.exe
\??\c:\lrrlffx.exe
c:\lrrlffx.exe
\??\c:\nbnbbh.exe
c:\nbnbbh.exe
\??\c:\frxxrxr.exe
c:\frxxrxr.exe
\??\c:\rxfflfl.exe
c:\rxfflfl.exe
\??\c:\nbhnnb.exe
c:\nbhnnb.exe
\??\c:\pjppj.exe
c:\pjppj.exe
\??\c:\djpjd.exe
c:\djpjd.exe
\??\c:\lrffxlf.exe
c:\lrffxlf.exe
\??\c:\lrlfxxr.exe
c:\lrlfxxr.exe
\??\c:\5ttntb.exe
c:\5ttntb.exe
\??\c:\bbtbnn.exe
c:\bbtbnn.exe
\??\c:\9pjdj.exe
c:\9pjdj.exe
\??\c:\1pjjd.exe
c:\1pjjd.exe
\??\c:\xlrffll.exe
c:\xlrffll.exe
\??\c:\btbtbb.exe
c:\btbtbb.exe
\??\c:\hbnhbb.exe
c:\hbnhbb.exe
\??\c:\7jdvv.exe
c:\7jdvv.exe
\??\c:\jvjdv.exe
c:\jvjdv.exe
\??\c:\rlxlfff.exe
c:\rlxlfff.exe
\??\c:\9fxllrf.exe
c:\9fxllrf.exe
\??\c:\bthhhh.exe
c:\bthhhh.exe
\??\c:\dvdjd.exe
c:\dvdjd.exe
\??\c:\vvvpp.exe
c:\vvvpp.exe
\??\c:\rfllxfx.exe
c:\rfllxfx.exe
\??\c:\fflxfll.exe
c:\fflxfll.exe
\??\c:\3htttb.exe
c:\3htttb.exe
\??\c:\pvpjd.exe
c:\pvpjd.exe
\??\c:\pjdvj.exe
c:\pjdvj.exe
\??\c:\vvdpj.exe
c:\vvdpj.exe
\??\c:\xlxrfff.exe
c:\xlxrfff.exe
\??\c:\tbbbtb.exe
c:\tbbbtb.exe
\??\c:\1nbhnb.exe
c:\1nbhnb.exe
\??\c:\jjjpj.exe
c:\jjjpj.exe
\??\c:\jjvpv.exe
c:\jjvpv.exe
\??\c:\3ffxxxx.exe
c:\3ffxxxx.exe
\??\c:\1hbhnt.exe
c:\1hbhnt.exe
\??\c:\nbhbbb.exe
c:\nbhbbb.exe
\??\c:\7dvpj.exe
c:\7dvpj.exe
\??\c:\dpjjd.exe
c:\dpjjd.exe
\??\c:\lrrxlxf.exe
c:\lrrxlxf.exe
\??\c:\nnbtbb.exe
c:\nnbtbb.exe
\??\c:\tbbntt.exe
c:\tbbntt.exe
\??\c:\ddjdv.exe
c:\ddjdv.exe
\??\c:\jdvpv.exe
c:\jdvpv.exe
\??\c:\rlxrlll.exe
c:\rlxrlll.exe
\??\c:\fffxffl.exe
c:\fffxffl.exe
\??\c:\tnbbtn.exe
c:\tnbbtn.exe
\??\c:\5nhnhb.exe
c:\5nhnhb.exe
\??\c:\vdvjv.exe
c:\vdvjv.exe
\??\c:\djvpp.exe
c:\djvpp.exe
\??\c:\lfxxflr.exe
c:\lfxxflr.exe
\??\c:\tnhnth.exe
c:\tnhnth.exe
\??\c:\tttnnh.exe
c:\tttnnh.exe
\??\c:\7jjdv.exe
c:\7jjdv.exe
\??\c:\pddvj.exe
c:\pddvj.exe
\??\c:\rrrlfll.exe
c:\rrrlfll.exe
\??\c:\7tbbhn.exe
c:\7tbbhn.exe
\??\c:\tbnbtt.exe
c:\tbnbtt.exe
\??\c:\vdvvp.exe
c:\vdvvp.exe
\??\c:\jjjjj.exe
c:\jjjjj.exe
\??\c:\7lrlrrx.exe
c:\7lrlrrx.exe
\??\c:\xrrllxx.exe
c:\xrrllxx.exe
\??\c:\5nnhbh.exe
c:\5nnhbh.exe
\??\c:\tnhbtt.exe
c:\tnhbtt.exe
\??\c:\jdppd.exe
c:\jdppd.exe
\??\c:\pjpjd.exe
c:\pjpjd.exe
\??\c:\frrlffx.exe
c:\frrlffx.exe
\??\c:\lfxlrrl.exe
c:\lfxlrrl.exe
\??\c:\5btnnn.exe
c:\5btnnn.exe
\??\c:\3jjdv.exe
c:\3jjdv.exe
\??\c:\dvdvp.exe
c:\dvdvp.exe
\??\c:\lfrlfrf.exe
c:\lfrlfrf.exe
\??\c:\xxffffl.exe
c:\xxffffl.exe
\??\c:\nhntbh.exe
c:\nhntbh.exe
\??\c:\ppdpd.exe
c:\ppdpd.exe
\??\c:\dpjjj.exe
c:\dpjjj.exe
\??\c:\fflrrff.exe
c:\fflrrff.exe
\??\c:\llllfrl.exe
c:\llllfrl.exe
\??\c:\bnbhhb.exe
c:\bnbhhb.exe
\??\c:\pjvpp.exe
c:\pjvpp.exe
\??\c:\jjpdd.exe
c:\jjpdd.exe
\??\c:\vjvvd.exe
c:\vjvvd.exe
\??\c:\rrlllxf.exe
c:\rrlllxf.exe
\??\c:\hntbtt.exe
c:\hntbtt.exe
\??\c:\bntbbn.exe
c:\bntbbn.exe
\??\c:\nhtnnt.exe
c:\nhtnnt.exe
\??\c:\vvvpd.exe
c:\vvvpd.exe
\??\c:\jpjdv.exe
c:\jpjdv.exe
\??\c:\rffxxxr.exe
c:\rffxxxr.exe
\??\c:\hhbbbb.exe
c:\hhbbbb.exe
\??\c:\ntbnnb.exe
c:\ntbnnb.exe
\??\c:\dvddv.exe
c:\dvddv.exe
\??\c:\jdjjd.exe
c:\jdjjd.exe
\??\c:\fxxrlll.exe
c:\fxxrlll.exe
\??\c:\7nhbtt.exe
c:\7nhbtt.exe
\??\c:\1bnnnh.exe
c:\1bnnnh.exe
\??\c:\jpvvv.exe
c:\jpvvv.exe
\??\c:\pvppp.exe
c:\pvppp.exe
\??\c:\5lrxxxf.exe
c:\5lrxxxf.exe
\??\c:\3ntbth.exe
c:\3ntbth.exe
\??\c:\nhhbtt.exe
c:\nhhbtt.exe
\??\c:\vppjj.exe
c:\vppjj.exe
\??\c:\pdddv.exe
c:\pdddv.exe
\??\c:\dpddj.exe
c:\dpddj.exe
\??\c:\rllfxfr.exe
c:\rllfxfr.exe
\??\c:\3tbhbb.exe
c:\3tbhbb.exe
\??\c:\bttnhh.exe
c:\bttnhh.exe
\??\c:\jpjvj.exe
c:\jpjvj.exe
\??\c:\ddpvd.exe
c:\ddpvd.exe
\??\c:\3rxrlrr.exe
c:\3rxrlrr.exe
\??\c:\rlrxrrl.exe
c:\rlrxrrl.exe
\??\c:\tnnnhh.exe
c:\tnnnhh.exe
\??\c:\vpvvp.exe
c:\vpvvp.exe
\??\c:\pjpjd.exe
c:\pjpjd.exe
\??\c:\xxxfxll.exe
c:\xxxfxll.exe
\??\c:\7rrllll.exe
c:\7rrllll.exe
\??\c:\nhhnhb.exe
c:\nhhnhb.exe
\??\c:\tttttt.exe
c:\tttttt.exe
\??\c:\9jjdv.exe
c:\9jjdv.exe
\??\c:\xxxlfxx.exe
c:\xxxlfxx.exe
\??\c:\rlfxrrl.exe
c:\rlfxrrl.exe
\??\c:\llrrlrl.exe
c:\llrrlrl.exe
\??\c:\hthnhh.exe
c:\hthnhh.exe
\??\c:\dpdjv.exe
c:\dpdjv.exe
\??\c:\xrfxlfr.exe
c:\xrfxlfr.exe
\??\c:\llxxfll.exe
c:\llxxfll.exe
\??\c:\3hthbt.exe
c:\3hthbt.exe
\??\c:\jpvpj.exe
c:\jpvpj.exe
\??\c:\7dddj.exe
c:\7dddj.exe
\??\c:\llfffff.exe
c:\llfffff.exe
\??\c:\fxlfllx.exe
c:\fxlfllx.exe
\??\c:\bbthtb.exe
c:\bbthtb.exe
\??\c:\htnnnb.exe
c:\htnnnb.exe
\??\c:\pdjjj.exe
c:\pdjjj.exe
\??\c:\xrflrxf.exe
c:\xrflrxf.exe
\??\c:\tnhntb.exe
c:\tnhntb.exe
\??\c:\nbhhbb.exe
c:\nbhhbb.exe
\??\c:\pvjjv.exe
c:\pvjjv.exe
\??\c:\vdvvv.exe
c:\vdvvv.exe
\??\c:\5lflflf.exe
c:\5lflflf.exe
\??\c:\lrlllrl.exe
c:\lrlllrl.exe
\??\c:\bthbhh.exe
c:\bthbhh.exe
\??\c:\vpdvp.exe
c:\vpdvp.exe
\??\c:\7vjjd.exe
c:\7vjjd.exe
\??\c:\jvjjj.exe
c:\jvjjj.exe
\??\c:\lrxllrl.exe
c:\lrxllrl.exe
\??\c:\7nnnhn.exe
c:\7nnnhn.exe
\??\c:\hhhnbn.exe
c:\hhhnbn.exe
\??\c:\pvvjp.exe
c:\pvvjp.exe
\??\c:\dvvpp.exe
c:\dvvpp.exe
\??\c:\rrrrrxx.exe
c:\rrrrrxx.exe
\??\c:\fxfxrrr.exe
c:\fxfxrrr.exe
\??\c:\5bbtth.exe
c:\5bbtth.exe
\??\c:\pvjjd.exe
c:\pvjjd.exe
\??\c:\pjdvj.exe
c:\pjdvj.exe
\??\c:\3vddv.exe
c:\3vddv.exe
\??\c:\7rrlxlf.exe
c:\7rrlxlf.exe
\??\c:\tnbttb.exe
c:\tnbttb.exe
\??\c:\5tnnnb.exe
c:\5tnnnb.exe
\??\c:\dvjdv.exe
c:\dvjdv.exe
\??\c:\ppdjj.exe
c:\ppdjj.exe
\??\c:\fxfxxrr.exe
c:\fxfxxrr.exe
\??\c:\frrrrrl.exe
c:\frrrrrl.exe
\??\c:\nhtnhh.exe
c:\nhtnhh.exe
\??\c:\1nttnn.exe
c:\1nttnn.exe
\??\c:\dppvp.exe
c:\dppvp.exe
\??\c:\jvvvp.exe
c:\jvvvp.exe
\??\c:\lfrrxxl.exe
c:\lfrrxxl.exe
\??\c:\7nhnht.exe
c:\7nhnht.exe
\??\c:\ttbbnn.exe
c:\ttbbnn.exe
\??\c:\3vpdv.exe
c:\3vpdv.exe
\??\c:\ppvpp.exe
c:\ppvpp.exe
\??\c:\xfxrfxf.exe
c:\xfxrfxf.exe
\??\c:\1hbnnn.exe
c:\1hbnnn.exe
\??\c:\hhttbt.exe
c:\hhttbt.exe
\??\c:\7jjdv.exe
c:\7jjdv.exe
\??\c:\vppjd.exe
c:\vppjd.exe
\??\c:\fflllll.exe
c:\fflllll.exe
\??\c:\xlllflf.exe
c:\xlllflf.exe
\??\c:\bttbnb.exe
c:\bttbnb.exe
\??\c:\jdpvd.exe
c:\jdpvd.exe
\??\c:\jjddj.exe
c:\jjddj.exe
\??\c:\9fxxxxx.exe
c:\9fxxxxx.exe
\??\c:\rllfxxr.exe
c:\rllfxxr.exe
\??\c:\nhhbtb.exe
c:\nhhbtb.exe
\??\c:\bbtnbt.exe
c:\bbtnbt.exe
\??\c:\nnntnt.exe
c:\nnntnt.exe
\??\c:\jdjdp.exe
c:\jdjdp.exe
\??\c:\rlrlrlr.exe
c:\rlrlrlr.exe
\??\c:\rfrrlll.exe
c:\rfrrlll.exe
\??\c:\7xllffx.exe
c:\7xllffx.exe
\??\c:\btnbtb.exe
c:\btnbtb.exe
\??\c:\pjjdv.exe
c:\pjjdv.exe
\??\c:\jddvj.exe
c:\jddvj.exe
\??\c:\xllfrrl.exe
c:\xllfrrl.exe
\??\c:\xllfxxx.exe
c:\xllfxxx.exe
\??\c:\tnhhbb.exe
c:\tnhhbb.exe
\??\c:\thnbtt.exe
c:\thnbtt.exe
\??\c:\vpvpj.exe
c:\vpvpj.exe
\??\c:\7jvpj.exe
c:\7jvpj.exe
\??\c:\frffxff.exe
c:\frffxff.exe
\??\c:\nntttt.exe
c:\nntttt.exe
\??\c:\nntthh.exe
c:\nntthh.exe
\??\c:\pddvp.exe
c:\pddvp.exe
\??\c:\ddvvj.exe
c:\ddvvj.exe
\??\c:\xrfxxxx.exe
c:\xrfxxxx.exe
\??\c:\xrxxlff.exe
c:\xrxxlff.exe
\??\c:\hthbnn.exe
c:\hthbnn.exe
\??\c:\httbnh.exe
c:\httbnh.exe
\??\c:\jvjjv.exe
c:\jvjjv.exe
\??\c:\5jjdv.exe
c:\5jjdv.exe
\??\c:\flrrfxl.exe
c:\flrrfxl.exe
\??\c:\xxlxlxf.exe
c:\xxlxlxf.exe
\??\c:\1ntnnn.exe
c:\1ntnnn.exe
\??\c:\dvjjd.exe
c:\dvjjd.exe
\??\c:\dppdv.exe
c:\dppdv.exe
\??\c:\lfrrxlf.exe
c:\lfrrxlf.exe
\??\c:\btbtbb.exe
c:\btbtbb.exe
\??\c:\hhhtnh.exe
c:\hhhtnh.exe
\??\c:\1djdd.exe
c:\1djdd.exe
\??\c:\7pjjd.exe
c:\7pjjd.exe
\??\c:\7rrlflf.exe
c:\7rrlflf.exe
\??\c:\lflfllr.exe
c:\lflfllr.exe
\??\c:\1hbbtt.exe
c:\1hbbtt.exe
\??\c:\htthtt.exe
c:\htthtt.exe
\??\c:\vjpjp.exe
c:\vjpjp.exe
\??\c:\lfxrllf.exe
c:\lfxrllf.exe
\??\c:\fxrfxff.exe
c:\fxrfxff.exe
\??\c:\tbbttn.exe
c:\tbbttn.exe
\??\c:\nhhnhn.exe
c:\nhhnhn.exe
\??\c:\1vvpj.exe
c:\1vvpj.exe
\??\c:\pjpjj.exe
c:\pjpjj.exe
\??\c:\xxflllr.exe
c:\xxflllr.exe
\??\c:\xrxfxfl.exe
c:\xrxfxfl.exe
\??\c:\hbtthh.exe
c:\hbtthh.exe
\??\c:\bntbth.exe
c:\bntbth.exe
\??\c:\jddvj.exe
c:\jddvj.exe
\??\c:\ddvdv.exe
c:\ddvdv.exe
\??\c:\flffrxl.exe
c:\flffrxl.exe
\??\c:\htnhbb.exe
c:\htnhbb.exe
\??\c:\jpjjj.exe
c:\jpjjj.exe
\??\c:\ddvpj.exe
c:\ddvpj.exe
\??\c:\7lxrlrx.exe
c:\7lxrlrx.exe
\??\c:\xxxllff.exe
c:\xxxllff.exe
\??\c:\tbhhbb.exe
c:\tbhhbb.exe
\??\c:\ttnnhh.exe
c:\ttnnhh.exe
\??\c:\vpddv.exe
c:\vpddv.exe
\??\c:\xrrlllf.exe
c:\xrrlllf.exe
\??\c:\rlflfff.exe
c:\rlflfff.exe
\??\c:\nntbth.exe
c:\nntbth.exe
\??\c:\nbbtnn.exe
c:\nbbtnn.exe
\??\c:\3pddv.exe
c:\3pddv.exe
\??\c:\jdvvv.exe
c:\jdvvv.exe
\??\c:\xxflflf.exe
c:\xxflflf.exe
\??\c:\ffrlxxf.exe
c:\ffrlxxf.exe
\??\c:\bthhnh.exe
c:\bthhnh.exe
\??\c:\1dvvp.exe
c:\1dvvp.exe
\??\c:\djddp.exe
c:\djddp.exe
\??\c:\3rxrllf.exe
c:\3rxrllf.exe
\??\c:\rrxrfll.exe
c:\rrxrfll.exe
\??\c:\lflfrlx.exe
c:\lflfrlx.exe
\??\c:\thtbht.exe
c:\thtbht.exe
\??\c:\dppjd.exe
c:\dppjd.exe
\??\c:\5jvpj.exe
c:\5jvpj.exe
\??\c:\xrxfxrf.exe
c:\xrxfxrf.exe
\??\c:\tnnnnb.exe
c:\tnnnnb.exe
\??\c:\tnhbbt.exe
c:\tnhbbt.exe
\??\c:\5ddvp.exe
c:\5ddvp.exe
\??\c:\ddddj.exe
c:\ddddj.exe
\??\c:\9rxrrxr.exe
c:\9rxrrxr.exe
\??\c:\xxrlrrf.exe
c:\xxrlrrf.exe
\??\c:\tnnhnh.exe
c:\tnnhnh.exe
\??\c:\bnnhtb.exe
c:\bnnhtb.exe
\??\c:\pvjvd.exe
c:\pvjvd.exe
\??\c:\jdddv.exe
c:\jdddv.exe
\??\c:\rflfxxr.exe
c:\rflfxxr.exe
\??\c:\thnhbb.exe
c:\thnhbb.exe
\??\c:\hbbtnn.exe
c:\hbbtnn.exe
\??\c:\jvvpp.exe
c:\jvvpp.exe
\??\c:\7ddvv.exe
c:\7ddvv.exe
\??\c:\3fxffrl.exe
c:\3fxffrl.exe
\??\c:\xlfffff.exe
c:\xlfffff.exe
\??\c:\nhnhhn.exe
c:\nhnhhn.exe
\??\c:\jvjdv.exe
c:\jvjdv.exe
\??\c:\ddjjv.exe
c:\ddjjv.exe
\??\c:\3llfffx.exe
c:\3llfffx.exe
\??\c:\hbhnnt.exe
c:\hbhnnt.exe
\??\c:\bnbtth.exe
c:\bnbtth.exe
\??\c:\1pddv.exe
c:\1pddv.exe
\??\c:\5rrxxrr.exe
c:\5rrxxrr.exe
\??\c:\xxrxxxx.exe
c:\xxrxxxx.exe
\??\c:\btnnhn.exe
c:\btnnhn.exe
\??\c:\httttb.exe
c:\httttb.exe
\??\c:\djppj.exe
c:\djppj.exe
\??\c:\flffrrr.exe
c:\flffrrr.exe
\??\c:\hhnbhb.exe
c:\hhnbhb.exe
\??\c:\7nbtnn.exe
c:\7nbtnn.exe
\??\c:\pjddd.exe
c:\pjddd.exe
\??\c:\1rlfrrx.exe
c:\1rlfrrx.exe
\??\c:\7rlffff.exe
c:\7rlffff.exe
\??\c:\tnnhnh.exe
c:\tnnhnh.exe
\??\c:\dpvpp.exe
c:\dpvpp.exe
\??\c:\jdpdj.exe
c:\jdpdj.exe
\??\c:\fxxrrrl.exe
c:\fxxrrrl.exe
\??\c:\tbtnnn.exe
c:\tbtnnn.exe
\??\c:\dvdvv.exe
c:\dvdvv.exe
\??\c:\jdvjd.exe
c:\jdvjd.exe
\??\c:\rffxrrr.exe
c:\rffxrrr.exe
\??\c:\tnnnhh.exe
c:\tnnnhh.exe
\??\c:\1tbbnb.exe
c:\1tbbnb.exe
\??\c:\pjdvp.exe
c:\pjdvp.exe
\??\c:\vjpdp.exe
c:\vjpdp.exe
\??\c:\xxlrlll.exe
c:\xxlrlll.exe
\??\c:\tbttth.exe
c:\tbttth.exe
\??\c:\jdjjd.exe
c:\jdjjd.exe
\??\c:\llrrlxx.exe
c:\llrrlxx.exe
\??\c:\lrlxxxx.exe
c:\lrlxxxx.exe
\??\c:\tthhnn.exe
c:\tthhnn.exe
\??\c:\jvpdp.exe
c:\jvpdp.exe
\??\c:\fffrrll.exe
c:\fffrrll.exe
\??\c:\tthhth.exe
c:\tthhth.exe
\??\c:\tttnnh.exe
c:\tttnnh.exe
\??\c:\jjpvv.exe
c:\jjpvv.exe
\??\c:\9pppj.exe
c:\9pppj.exe
\??\c:\nbnbnn.exe
c:\nbnbnn.exe
\??\c:\hhbbhh.exe
c:\hhbbhh.exe
\??\c:\bbnntt.exe
c:\bbnntt.exe
\??\c:\vvjjd.exe
c:\vvjjd.exe
\??\c:\9rxrfff.exe
c:\9rxrfff.exe
\??\c:\hthnhh.exe
c:\hthnhh.exe
\??\c:\nnnnhb.exe
c:\nnnnhb.exe
\??\c:\jvvvv.exe
c:\jvvvv.exe
\??\c:\flffxxx.exe
c:\flffxxx.exe
\??\c:\nbtnnn.exe
c:\nbtnnn.exe
\??\c:\ppppp.exe
c:\ppppp.exe
\??\c:\jjppd.exe
c:\jjppd.exe
\??\c:\xxxrlrl.exe
c:\xxxrlrl.exe
\??\c:\hbtnbt.exe
c:\hbtnbt.exe
\??\c:\jdddv.exe
c:\jdddv.exe
\??\c:\jjdvv.exe
c:\jjdvv.exe
\??\c:\llxflff.exe
c:\llxflff.exe
\??\c:\9rrrlrf.exe
c:\9rrrlrf.exe
\??\c:\vpjpp.exe
c:\vpjpp.exe
\??\c:\flffxxr.exe
c:\flffxxr.exe
\??\c:\rxlxfxr.exe
c:\rxlxfxr.exe
\??\c:\bnhbtt.exe
c:\bnhbtt.exe
\??\c:\hthhbb.exe
c:\hthhbb.exe
\??\c:\djvdj.exe
c:\djvdj.exe
\??\c:\rrrlffr.exe
c:\rrrlffr.exe
\??\c:\hbbbtt.exe
c:\hbbbtt.exe
\??\c:\9ddvp.exe
c:\9ddvp.exe
\??\c:\jjdjp.exe
c:\jjdjp.exe
\??\c:\ffrrrxf.exe
c:\ffrrrxf.exe
\??\c:\thhhbb.exe
c:\thhhbb.exe
\??\c:\hthnbh.exe
c:\hthnbh.exe
\??\c:\dpjpj.exe
c:\dpjpj.exe
\??\c:\rxllffx.exe
c:\rxllffx.exe
\??\c:\xrxrlll.exe
c:\xrxrlll.exe
\??\c:\thbhth.exe
c:\thbhth.exe
\??\c:\pjjjd.exe
c:\pjjjd.exe
\??\c:\pjvdp.exe
c:\pjvdp.exe
\??\c:\lllfrll.exe
c:\lllfrll.exe
\??\c:\rlrrlll.exe
c:\rlrrlll.exe
\??\c:\nnbnht.exe
c:\nnbnht.exe
\??\c:\5pvvp.exe
c:\5pvvp.exe
\??\c:\xxxrfxr.exe
c:\xxxrfxr.exe
\??\c:\xfllxrf.exe
c:\xfllxrf.exe
\??\c:\btttnt.exe
c:\btttnt.exe
\??\c:\jjddv.exe
c:\jjddv.exe
\??\c:\pvvpj.exe
c:\pvvpj.exe
\??\c:\frrllxx.exe
c:\frrllxx.exe
\??\c:\7bnnhh.exe
c:\7bnnhh.exe
\??\c:\nhhttb.exe
c:\nhhttb.exe
\??\c:\7pvvj.exe
c:\7pvvj.exe
\??\c:\xrlxxfl.exe
c:\xrlxxfl.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.209.201.84.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 76.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.163.202.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.42.69.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
Files
memory/3144-2-0x0000000000427000-0x0000000000428000-memory.dmp
memory/3144-0-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3144-1-0x0000000002170000-0x000000000217C000-memory.dmp
memory/3144-3-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3144-10-0x0000000000400000-0x0000000000429000-memory.dmp
\??\c:\bthhbb.exe
| MD5 | 4a91a3dff67e6a53d13b2242fb4035fb |
| SHA1 | 2930abbeb6c54735097bd0eebccc02c7cdbf727c |
| SHA256 | aefb482a13ebcb5bf4e323dd0f6909993250700f4db6eab190ffd0ed6a6c4ff5 |
| SHA512 | 5f8c1737ef44c4646804b972c710a2f6b17aa407d3a2f1a543235860b965dc47ed5a87e5ee4fbf9808d63ebcba1bb53c6be03e90aa0ab542fa06933d5216e6d6 |
C:\nnntnt.exe
| MD5 | 2bd97dcd2e74e06fb8fa3fe273fbf512 |
| SHA1 | 0b4a126e29b30b69ef6938f84b8985dfa3f4c700 |
| SHA256 | db0089f965ddbbb840b8934c58eacb9c81cccc4bdda784cf4ebea333b4cadce2 |
| SHA512 | 9a09de781396cde4776ee653af8c5375e7562dc5826c07e30ee2950f8336aa8ce67853ba9c93677a8282b5bb9670497fb0ad23b0cbb002dcbb0d5b41f200d390 |
C:\jjdvp.exe
| MD5 | 71828322cf002693f86040034176e5b8 |
| SHA1 | 4abf94201ed3c4d2d90028f8213430c9c9ca56b2 |
| SHA256 | 6d88945543b9f7a80690e8b607015929f777cb48e071ade39551e91533ca1ee5 |
| SHA512 | 74fbfe14c4fb067c143f843d8218c21bc936cd3f7a02f6d5515e3c1d4991c9b582f3d840fdb3755d78496d35c8f68d8818428f428aef02f8e8caeb8fa4049a77 |
memory/3992-18-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4860-25-0x0000000000400000-0x0000000000429000-memory.dmp
C:\xllxrrl.exe
| MD5 | 1bca1bb9cfc224615f70b53d6ab6ae5a |
| SHA1 | 6d2d08fd0165754331ab7e6ef031429ad18c518c |
| SHA256 | 27476b507de0c0358de65c14286a1984ff06c3c85f300ae38f123f44f6b88777 |
| SHA512 | e002ff55c2778777640eb3b6482be080c4f325afde69504353daa1fc63c359e1ef078624b60bcb61e7b990bc8e679fa035a81ada107796180604a73d18552602 |
\??\c:\hhhhbh.exe
| MD5 | 386c299f2eee7b11c801e709f32b1028 |
| SHA1 | 2d81badce84da4f6b3b408889a57197b8578ac39 |
| SHA256 | a6e06a1cb4cfd1928dc563e3993784626f216a9d5b75b27e1460d8f7004fd6e1 |
| SHA512 | 635923854319ef07d923efb9be83ed6c6bbeb887d77de37b57af7c796c339ccc88f17168c1c9880837a77753b86d4bde4f0395ca25f767074e85c6fdabfe1d0f |
memory/4456-39-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4456-38-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4456-37-0x0000000000400000-0x0000000000429000-memory.dmp
\??\c:\1nbttn.exe
| MD5 | 27aad5af26861d9d383744259549cd8b |
| SHA1 | 1f4ba5d427aca1af549b1c84536f848da5377672 |
| SHA256 | 4a7487da785ac248c74a19dffd32b25e24532670ea7e75edcba611da6730abb1 |
| SHA512 | 7af2f1de41fe6b5968a2ea2356299a56064696ddb81cf38b8e76b12434429984f0d61eeb74e65af60a12c11ef60816a77ef8430d57c2d81b5b6c63f73b84b51d |
memory/3912-48-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3912-47-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3912-46-0x0000000000400000-0x0000000000429000-memory.dmp
C:\rrxrxrr.exe
| MD5 | 02ebb53e8b1bd9532a5cfa72419afcc1 |
| SHA1 | 9ce24d6f38c40957e16e2654f3c842a77b4ddfe0 |
| SHA256 | e5645bf18d038d51881b117b2a6be1974f7e80271e81d629b9c752c3320a1850 |
| SHA512 | 9f6e1c579857f995c4abeccf9919758fcc0b279c64d7a011deff643f0628a18b50b9b02ebab9358f0591a463cf3a504fe04c3826e9a631f9ec5348f151f6a944 |
memory/3912-54-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4512-55-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4512-58-0x0000000000400000-0x0000000000429000-memory.dmp
C:\3bhbtt.exe
| MD5 | 437ba2c294b5e7143a1f0ca0ebbf58e9 |
| SHA1 | c32bd0c76a510c6bd5af71b53605a9f2ffbd669e |
| SHA256 | 71789bae7deef51c5549dcc6123532dde28d2dfe05f750a13c82268ef6302ed7 |
| SHA512 | 8be53e5cd4548125f19b3264831b4dc99126d006d33acb1d92c741405ee260e9c590d980b61962c9c77f2e49ebe25c2d9e56c7a2e5951c099e171a26146227ee |
memory/4372-66-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4372-65-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4372-64-0x0000000000400000-0x0000000000429000-memory.dmp
C:\vvdjp.exe
| MD5 | 86040cd92b24d172082b98b6feb888c3 |
| SHA1 | f51bce6bc668b2063658ed31932098e40eb411ca |
| SHA256 | 58a965c2e64349bbcca14aa3596309a418fe7ee4a37947a1a79e7aa2e1caa10f |
| SHA512 | 2658362f3378d3d646e6e3af886c14790af868d61ef7fac09fa019bd7ae429138aabc7d7acbfed9eeab885b2e2c6e01c56d447ea650d264c817213b33dc11937 |
memory/4688-73-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4688-74-0x0000000000400000-0x0000000000429000-memory.dmp
C:\tnbbbb.exe
| MD5 | f9d540bba47f7dabe3267e0bb231241c |
| SHA1 | 8aad511786804ee4c41749d4b4bfd13d0dc95fd1 |
| SHA256 | 40db50504275c4da64e8fd9e55c709fdc5bebd2d3adebb3a0197992cab11d1db |
| SHA512 | 2ad101f06e25dc10498ad5bd41796d12e04d7a06eb75b19f81c3e51c574cd6cf14d452cc98410cd26351748ab0f911c9270dd6a82784268e239702cae9c90b10 |
memory/4688-79-0x0000000000400000-0x0000000000429000-memory.dmp
C:\5vpvp.exe
| MD5 | 50b3ee4cc0fb6a733f6a73175b31295a |
| SHA1 | 2e894d4f88b82ebd325114f39415a65773ea0c7c |
| SHA256 | 06fe5202930640dd259651c87947d0954139ec6d2257c7f3261dcb291fcdc19d |
| SHA512 | 3d99654e51991002596b0609d9413f70e02f9863c25291e8cfd80eb46add1a495d0b8a58603313dffcd79e206d4f79e79f37a66fe9b22d628464beb0d45a1405 |
memory/244-91-0x0000000000400000-0x0000000000429000-memory.dmp
C:\fxlffff.exe
| MD5 | da9e5aa2ae1865199d973956dd9bcc5e |
| SHA1 | 995aba0dd60298ad7ff94ec9da3808dd17612321 |
| SHA256 | b04a4bbf60377df6bef698e48fd7a2c9a73ec823bed2ec319ecbeeafebae5fcb |
| SHA512 | a1a83f61d162c034f7e3ad2cefa6d69b6202859acb2904cb4ea25e689324dc729f87947fb441e576417158dbca08d39fc50231b3fb9997d38291af1ddd7f4efc |
\??\c:\nbnbth.exe
| MD5 | b7483c0e8d653abc04946c519ca022ba |
| SHA1 | f87b2575d2dc219e9890e9702a53f1f940546d30 |
| SHA256 | 2df29d5d33256aec10a7453f42c68a606cc4e22bddf760b2219ce82a7350473d |
| SHA512 | ebc764cc34288245944f32ee9f90c9c1a79bdc3f0eef8c3a82b3018ba6c40ef666f8d8a3548cbb7728869037d5a5e906affcb8019c99d9968f75619490c33560 |
memory/4708-97-0x0000000000400000-0x0000000000429000-memory.dmp
C:\hbhhnh.exe
| MD5 | 8aae74723783f6ec84179bb70bd6e516 |
| SHA1 | f58d4ec2c391613c5714e78121eafc333ea5fe3f |
| SHA256 | dbb9d64a07a7933cc639c6218079f81594c56b87941817f75b77d17b83bac54f |
| SHA512 | 7b8ae8836e6a1a65dc7b8c8ffdd2b94adf865e301be8a216852df124386af4987c2b24411bd05166aa58419cb41114d4912beae5c1c273dda61ece2629e80331 |
memory/1608-103-0x0000000000400000-0x0000000000429000-memory.dmp
C:\rxlrlfl.exe
| MD5 | 39423e15769d62f99d0bc6244fd92a9e |
| SHA1 | 565885f8f5276aa9a351ec1aea856540bdb6f568 |
| SHA256 | aa2b078d96c45857a3e287b8bcca376664bc984dec2d69da906cf7b74db18fa9 |
| SHA512 | 645fa95e54e55d1a96d54318ac2c0e645e5691a8aea42fd0ebc46da607afb94f71b694fee74c52781f179cf46a92a4658ad037006e76b572d97d245657b20453 |
memory/3180-108-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1968-114-0x0000000000400000-0x0000000000429000-memory.dmp
C:\bbbttb.exe
| MD5 | 2b4596e3d282b41d08dfab037d0b5f1f |
| SHA1 | 6e2bd19ce3c9e862a7d8cc48b561fa9d3dee3c88 |
| SHA256 | 21c91092b75a9d60568aead4aad9ade4747d20e6323a3273e0b4350fa1988579 |
| SHA512 | a870581cccc436ea2d3bc6b78b505159d519f84ccda5857743f2eb374a8329cf1b5072080c4f21fcf73dc73874185839550223dcb4bac85b81c95313d516c458 |
C:\3vjpj.exe
| MD5 | 54ef3430fdee7374ebf13b78a575997e |
| SHA1 | eba08b8a694a3d6a6a00fd59d5567e532354d260 |
| SHA256 | 2bc694c2d590226424562f1b205422633bef36dac08cc138596fea2343a6ba1e |
| SHA512 | d0af6f875503819b61906ea049c94176a22c6f968f2bce77ea325491a04fd174914716f32cc81c21d81a56fb4cdc119579c81b6f4e9cae3dc554615f11162e8e |
C:\xlxrrfl.exe
| MD5 | 31535eeb1a48289494a172d245362dc2 |
| SHA1 | 9a1f2af570c463f6fbd01ee5b3a50320b145721a |
| SHA256 | cde65a294ed9f59e705c86912bc74008c77b41b7fbb4226c1a7bf51ec48a9a03 |
| SHA512 | 5488662f2fc804b88e359542e71e9900e40ed7f37d381a3c387940b97d12dcebbde533716b058aabdeaf1e786f62c4f4e16cc8f0647c572971a30eff01462221 |
C:\ffffxrr.exe
| MD5 | 1a67f2b93cb9ec4bc7000ebcbd002345 |
| SHA1 | 7ed44de1402fa74d1a5c048fdf573c2f3dfba163 |
| SHA256 | 6117dc58dafa0ae9d8ef0b8cc93c93485a3fa3d2f10ef5873f761797c6283fb3 |
| SHA512 | 13d55cb50aafac952c153cd36054ed76587221ea6f3d9064c51f31982c7b7f1abf97e31ea68ffb32d42043dc73e3cd72bd5306d3b3c17ee5c92894652349f894 |
memory/4644-132-0x0000000000400000-0x0000000000429000-memory.dmp
memory/980-139-0x0000000000400000-0x0000000000429000-memory.dmp
C:\nhnhbb.exe
| MD5 | 67b043af9def3d5e900766a49b3841ba |
| SHA1 | 726c94d3a33b739c8c07785f9cf8b0364405eeab |
| SHA256 | e10e93a5ad52ada2fe00cd3bac73e91c12a364f81d71eceb0ff6b0d5c237562d |
| SHA512 | bca5a523ecd56eeb9e69a4688404f221d8a0942fc5e1d0446aa489d2faaae98d6b00655354d4bce3c1d6406edfe2b6bf88f0b3ba5bb0808e031d2a85811af9a1 |
C:\vvdvd.exe
| MD5 | f5008ab235ba93ace63f9c116f13fcf9 |
| SHA1 | 55fbdea7a1b5fe2b2130d1f5522406bd0909cfb2 |
| SHA256 | a7a02170df244d6c9131406aa2fcd68d55b353d054c2f1823d5e17c2eb8f9ea9 |
| SHA512 | e2879da0baa0e12f5dd98f7daab3eae8b4bb674968f166146a3b7bf31bd7f05a8a5015940f504662f985ae944a47cad7f8b592de519a1693d691eb66b5ab4bc0 |
memory/4996-145-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1464-151-0x0000000000400000-0x0000000000429000-memory.dmp
\??\c:\7vpjj.exe
| MD5 | 5a9d64abbf596a940d73a7dc55054080 |
| SHA1 | 59a67ed9d88d5c03ae51378e3d7671e8d2a2671a |
| SHA256 | d38ca8ba4163b179540a6211ebcbc23ab97d0d5f14182e8849711349ae5410fc |
| SHA512 | 5848590f922aa1a32e7d35b4127f2a94c7c296bc4d3307ccc2077756328ff8dfe2dd97b1abad7bfa531c97060067c7c8a73115aee5d5fedef4c451a2a6ec179e |
C:\rfrlxlx.exe
| MD5 | 0cd1588395fdff94c6b1d6d43a4a118a |
| SHA1 | fc2685aced18375a7c269126e4fa678ad3bcfb80 |
| SHA256 | 95aac0b26622f2a1af0f1025cbd74b3fc85a77d9c3702bbc904e3e0e0dc2390d |
| SHA512 | 5e476b0b20bc28dac1768af9978d9ad8df25e93ff11fefe3ac659b932a839bd26c7836cab3ebab5b33f3b3890b4d2c44d7564e80d76eaf6c661e88806352d33a |
C:\bntnnh.exe
| MD5 | c76a8699834d47174bcf4f771fa12063 |
| SHA1 | 78ea9fec937e441071681f24c8ae9a1fb66ec779 |
| SHA256 | f0bbaad5f5dba3d4d4e16c7e81c982b82edb4317e8cd2059ab452240a9bf3f30 |
| SHA512 | 8e03dd66c81828f8c19d7907f8c8bc83ad99baec39a1400a6db328d6d47e4544f9d964f13a496fc05809f1d28e35f1b3b624e5c1a19dbba8aad106907117dc44 |
memory/3940-163-0x0000000000400000-0x0000000000429000-memory.dmp
C:\dvpvj.exe
| MD5 | 36b26302e8e9e9ef9b6fcb08e40289bd |
| SHA1 | 3de2836c89721fdd6151d0540bf7ef608fb40ba5 |
| SHA256 | 2ac040a28f78202c37b98b894c81421b043f14ded40532f5c1de52980fc5ccb7 |
| SHA512 | c5716523e2cbe96695675b9e82acf3c58ad772fe0af6cbeb2affd3822d5db82833f685e7d9e8d47144702bded14b2ae1a58ba1a13811eccaf71e6d943ac65d25 |
C:\9lllllr.exe
| MD5 | 325f51a5fde76d5880cccc848bb50ff3 |
| SHA1 | 480cc10c7a2e2b8f49100ed15e2c9327d9496c06 |
| SHA256 | 4e70f7d0aae6b9a78b1554b36e6dbeec7164061c3c8e5872ef7ec1d84b985a00 |
| SHA512 | 41a9789af894da13c2314e2418c3b8195c793f5c50a67decf4cb0be1e5269543fb6944d8829a262c59dcfb36c0ff4a1ead7dd5758113aad371e015182238e073 |
memory/3440-174-0x0000000000400000-0x0000000000429000-memory.dmp
C:\xrrrrxx.exe
| MD5 | 41a56e91da54c0c2e345b7a0e8bacd59 |
| SHA1 | 5e8bbd1fdc35b31c563584f4f9c422da010d1607 |
| SHA256 | d5e061f7eb8dc4ec0c05f64cc2a39b96004be5250cf6b57729b61f91d8af5819 |
| SHA512 | 52bd21d268f938cefb0bdf2656f48389daebdc646daf299c22f1b745b84f3958eb2f35c1b8a58bddaf6375e466490f7e46e05ba639542313648b19d6bab961e9 |
C:\hhtbhh.exe
| MD5 | 88917c5248cee233886b3127f64fbd26 |
| SHA1 | f3a0543bb3a17137dea742fdf67ed4b30733fb59 |
| SHA256 | 983ef65b8474a6a870799763a1010de2d67d2c37c50290102ccd4c06bbbfdf10 |
| SHA512 | 23290f3361b16a8713da2201a8576db72c30e48892812ac14fe81589cc30f23a867a388c36af0869f53fe3f3a6f0d0c35cca72adf154234a12b7d2b70fbe5adf |
memory/2928-193-0x0000000000400000-0x0000000000429000-memory.dmp
C:\pdppd.exe
| MD5 | 54ec694b08f0eb465305b7f1812f782e |
| SHA1 | 21f8e5fce44215051c95de0a83624f055cd03400 |
| SHA256 | bd829a8ab51cf1124e418e9808e3fae9d17af619eaf8d5fa002929e9fd03270b |
| SHA512 | 600c909a8d78100d31ce1b1382c083f0b6276a6afde70651a46f9399d8e65077a05bc856974a520596d00865d9e50de592cb806c3267e8e39010e328199aabc0 |
C:\fxfxrll.exe
| MD5 | 902e5963d4e250392729ce99001dcfc3 |
| SHA1 | 2086de2bbd7b94e163a9dd768ff87738aef476b7 |
| SHA256 | dbbba65627a7679518cf9d7aab22e4603150a21b5e2c6c6101f5846bda2e64dc |
| SHA512 | 28a8e9238fb97b6c9e81553af3e1c5a5b198c037544708720609dc4438eae894ad03e2fb8af506432a36d9a4bafa374ea673fcd6a9ec9cdceb8a2a8705adf3c9 |
memory/1904-199-0x0000000000400000-0x0000000000429000-memory.dmp
C:\rrxrffl.exe
| MD5 | 3d9f7750c4464efa326a6ef9852e01c6 |
| SHA1 | c4b599786d3185d7441f17833003fc2269f6be62 |
| SHA256 | 29d39d25cc27a0d2a135a9220ee067de88155f0b7c374a1b927b10258f1e3126 |
| SHA512 | 9f5e98a8a9fe697dc3b861ddc3eb8cb41245dbac19110b6a1d65ba4a41571ce453670d3215ee7178ce59347f69db657334728a87402e69bc442402ff79588a1e |
C:\9hthbb.exe
| MD5 | 29ad1657dd7179ff8ae0906e878d9b54 |
| SHA1 | 3b24c3d85f69771935e379d0373958c286e9edf7 |
| SHA256 | 781fff28fb0ecfcf2801a002acb9ca36d5663ccbe9ae5a9c4ae4f3335ddd85b6 |
| SHA512 | c65c42766b5a3f5246663b9554409ffa90f971c0db3b9cecb8083c792c4bbd39a37bdc4c164acf0220d0606296065a8c1f2c21c3fe902f758b7fb7b3954ca559 |