Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
06-06-2024 08:01
Static task
static1
Behavioral task
behavioral1
Sample
d7b947c8f4365722e24b430542fb015c86d7dafc180e300279e9742e4f6fe8ae.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
d7b947c8f4365722e24b430542fb015c86d7dafc180e300279e9742e4f6fe8ae.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
d9c96b2b7c433fb567d6a5f3abca5c6ada92682bd759f48638d0b6d3cf43ce45.exe
Resource
win7-20240508-en
General
-
Target
d9c96b2b7c433fb567d6a5f3abca5c6ada92682bd759f48638d0b6d3cf43ce45.exe
-
Size
86KB
-
MD5
7fff6d0a3cdbf7320ab4f7a378c92c85
-
SHA1
de363c54132e4276e51d6a15f95b9e157aa98592
-
SHA256
d9c96b2b7c433fb567d6a5f3abca5c6ada92682bd759f48638d0b6d3cf43ce45
-
SHA512
cb3aef588e122b0da6efb4d3e730cd3b1a4967591919d25469e20ae8748991007531ed3bf24bb73adb73f6919ff8a6151056b116d46be3229bfa10f1faf89a3b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73t6MlYqn+jMp9jXX8:ymb3NkkiQ3mdBjFo73tvn+Yp9jn8
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral3/memory/1276-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral3/memory/2424-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral3/memory/2424-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral3/memory/2388-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral3/memory/2716-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral3/memory/2640-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral3/memory/3068-59-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral3/memory/2844-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral3/memory/2516-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral3/memory/2516-83-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral3/memory/2228-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral3/memory/2228-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral3/memory/1988-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral3/memory/376-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral3/memory/1300-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral3/memory/2164-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral3/memory/564-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral3/memory/1604-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral3/memory/1748-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral3/memory/2108-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral3/memory/704-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral3/memory/1804-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral3/memory/276-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral3/memory/2324-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral3/memory/872-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral3/memory/1324-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
7fffrxf.exebtnnbb.exe3pddj.exexrflffr.exebtnttb.exehhbnth.exellxxlxx.exe7xrxfrx.exe3jjdp.exedpddv.exe1lfrfrx.exe1htbhn.exe9tnbtb.exe3jjvp.exellfrflf.exerrxfflx.exebbnntb.exejjvvj.exedvdjv.exerlflxfl.exehhbbnb.exebhtthh.exeddppd.exepjpjp.exe1frfflx.exennbbhh.exe5jdpv.exevpppd.exerlxfxxr.exetthbbn.exebthnbh.exepjdpp.exerrrfxlx.exebththh.exe3hbbhh.exehhhtbb.exepjppv.exeppvvj.exe3lxfrrx.exe7xfrlrx.exenhhhnn.exebtnntt.exejddjv.exevvpdp.exe1fxfflr.exe3fllffx.exetnhnhh.exenhtnbb.exejpvjd.exe9jddj.exelfxfffr.exe9rrlffr.exenbhntt.exenhtthh.exerlrrrrx.exe7fxlxfl.exe1tntbb.exetnttbh.exejdppd.exe3vjvd.exexrfrrll.exe7frrrxl.exeflxfrlx.exetnhnbt.exepid process 1276 7fffrxf.exe 2388 btnnbb.exe 2716 3pddj.exe 2640 xrflffr.exe 3068 btnttb.exe 2844 hhbnth.exe 2516 llxxlxx.exe 2228 7xrxfrx.exe 1988 3jjdp.exe 2756 dpddv.exe 2968 1lfrfrx.exe 376 1htbhn.exe 1300 9tnbtb.exe 2164 3jjvp.exe 564 llfrflf.exe 2504 rrxfflx.exe 1604 bbnntb.exe 1748 jjvvj.exe 2108 dvdjv.exe 2412 rlflxfl.exe 2076 hhbbnb.exe 704 bhtthh.exe 1632 ddppd.exe 1816 pjpjp.exe 1804 1frfflx.exe 276 nnbbhh.exe 2324 5jdpv.exe 752 vpppd.exe 872 rlxfxxr.exe 3040 tthbbn.exe 1324 bthnbh.exe 2204 pjdpp.exe 2196 rrrfxlx.exe 2060 bththh.exe 3056 3hbbhh.exe 1388 hhhtbb.exe 2744 pjppv.exe 2724 ppvvj.exe 2272 3lxfrrx.exe 2808 7xfrlrx.exe 2552 nhhhnn.exe 2572 btnntt.exe 2588 jddjv.exe 2792 vvpdp.exe 1924 1fxfflr.exe 2840 3fllffx.exe 2880 tnhnhh.exe 2396 nhtnbb.exe 884 jpvjd.exe 2172 9jddj.exe 760 lfxfffr.exe 1272 9rrlffr.exe 1692 nbhntt.exe 1796 nhtthh.exe 2604 rlrrrrx.exe 2320 7fxlxfl.exe 2112 1tntbb.exe 2256 tnttbh.exe 2912 jdppd.exe 2412 3vjvd.exe 968 xrfrrll.exe 580 7frrrxl.exe 3064 flxfrlx.exe 1348 tnhnbt.exe -
Processes:
resource yara_rule behavioral3/memory/1276-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral3/memory/2424-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral3/memory/2388-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral3/memory/2716-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral3/memory/2640-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral3/memory/2844-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral3/memory/2844-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral3/memory/2844-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral3/memory/2844-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral3/memory/2516-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral3/memory/2228-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral3/memory/2228-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral3/memory/1988-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral3/memory/376-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral3/memory/1300-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral3/memory/2164-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral3/memory/564-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral3/memory/1604-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral3/memory/1748-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral3/memory/2108-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral3/memory/704-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral3/memory/1804-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral3/memory/276-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral3/memory/2324-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral3/memory/872-283-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral3/memory/1324-301-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d9c96b2b7c433fb567d6a5f3abca5c6ada92682bd759f48638d0b6d3cf43ce45.exe7fffrxf.exebtnnbb.exe3pddj.exexrflffr.exebtnttb.exehhbnth.exellxxlxx.exe7xrxfrx.exe3jjdp.exedpddv.exe1lfrfrx.exe1htbhn.exe9tnbtb.exe3jjvp.exellfrflf.exedescription pid process target process PID 2424 wrote to memory of 1276 2424 d9c96b2b7c433fb567d6a5f3abca5c6ada92682bd759f48638d0b6d3cf43ce45.exe 7fffrxf.exe PID 2424 wrote to memory of 1276 2424 d9c96b2b7c433fb567d6a5f3abca5c6ada92682bd759f48638d0b6d3cf43ce45.exe 7fffrxf.exe PID 2424 wrote to memory of 1276 2424 d9c96b2b7c433fb567d6a5f3abca5c6ada92682bd759f48638d0b6d3cf43ce45.exe 7fffrxf.exe PID 2424 wrote to memory of 1276 2424 d9c96b2b7c433fb567d6a5f3abca5c6ada92682bd759f48638d0b6d3cf43ce45.exe 7fffrxf.exe PID 1276 wrote to memory of 2388 1276 7fffrxf.exe btnnbb.exe PID 1276 wrote to memory of 2388 1276 7fffrxf.exe btnnbb.exe PID 1276 wrote to memory of 2388 1276 7fffrxf.exe btnnbb.exe PID 1276 wrote to memory of 2388 1276 7fffrxf.exe btnnbb.exe PID 2388 wrote to memory of 2716 2388 btnnbb.exe 3pddj.exe PID 2388 wrote to memory of 2716 2388 btnnbb.exe 3pddj.exe PID 2388 wrote to memory of 2716 2388 btnnbb.exe 3pddj.exe PID 2388 wrote to memory of 2716 2388 btnnbb.exe 3pddj.exe PID 2716 wrote to memory of 2640 2716 3pddj.exe xrflffr.exe PID 2716 wrote to memory of 2640 2716 3pddj.exe xrflffr.exe PID 2716 wrote to memory of 2640 2716 3pddj.exe xrflffr.exe PID 2716 wrote to memory of 2640 2716 3pddj.exe xrflffr.exe PID 2640 wrote to memory of 3068 2640 xrflffr.exe btnttb.exe PID 2640 wrote to memory of 3068 2640 xrflffr.exe btnttb.exe PID 2640 wrote to memory of 3068 2640 xrflffr.exe btnttb.exe PID 2640 wrote to memory of 3068 2640 xrflffr.exe btnttb.exe PID 3068 wrote to memory of 2844 3068 btnttb.exe hhbnth.exe PID 3068 wrote to memory of 2844 3068 btnttb.exe hhbnth.exe PID 3068 wrote to memory of 2844 3068 btnttb.exe hhbnth.exe PID 3068 wrote to memory of 2844 3068 btnttb.exe hhbnth.exe PID 2844 wrote to memory of 2516 2844 hhbnth.exe llxxlxx.exe PID 2844 wrote to memory of 2516 2844 hhbnth.exe llxxlxx.exe PID 2844 wrote to memory of 2516 2844 hhbnth.exe llxxlxx.exe PID 2844 wrote to memory of 2516 2844 hhbnth.exe llxxlxx.exe PID 2516 wrote to memory of 2228 2516 llxxlxx.exe 7xrxfrx.exe PID 2516 wrote to memory of 2228 2516 llxxlxx.exe 7xrxfrx.exe PID 2516 wrote to memory of 2228 2516 llxxlxx.exe 7xrxfrx.exe PID 2516 wrote to memory of 2228 2516 llxxlxx.exe 7xrxfrx.exe PID 2228 wrote to memory of 1988 2228 7xrxfrx.exe 3jjdp.exe PID 2228 wrote to memory of 1988 2228 7xrxfrx.exe 3jjdp.exe PID 2228 wrote to memory of 1988 2228 7xrxfrx.exe 3jjdp.exe PID 2228 wrote to memory of 1988 2228 7xrxfrx.exe 3jjdp.exe PID 1988 wrote to memory of 2756 1988 3jjdp.exe dpddv.exe PID 1988 wrote to memory of 2756 1988 3jjdp.exe dpddv.exe PID 1988 wrote to memory of 2756 1988 3jjdp.exe dpddv.exe PID 1988 wrote to memory of 2756 1988 3jjdp.exe dpddv.exe PID 2756 wrote to memory of 2968 2756 dpddv.exe 1lfrfrx.exe PID 2756 wrote to memory of 2968 2756 dpddv.exe 1lfrfrx.exe PID 2756 wrote to memory of 2968 2756 dpddv.exe 1lfrfrx.exe PID 2756 wrote to memory of 2968 2756 dpddv.exe 1lfrfrx.exe PID 2968 wrote to memory of 376 2968 1lfrfrx.exe 1htbhn.exe PID 2968 wrote to memory of 376 2968 1lfrfrx.exe 1htbhn.exe PID 2968 wrote to memory of 376 2968 1lfrfrx.exe 1htbhn.exe PID 2968 wrote to memory of 376 2968 1lfrfrx.exe 1htbhn.exe PID 376 wrote to memory of 1300 376 1htbhn.exe 9tnbtb.exe PID 376 wrote to memory of 1300 376 1htbhn.exe 9tnbtb.exe PID 376 wrote to memory of 1300 376 1htbhn.exe 9tnbtb.exe PID 376 wrote to memory of 1300 376 1htbhn.exe 9tnbtb.exe PID 1300 wrote to memory of 2164 1300 9tnbtb.exe 3jjvp.exe PID 1300 wrote to memory of 2164 1300 9tnbtb.exe 3jjvp.exe PID 1300 wrote to memory of 2164 1300 9tnbtb.exe 3jjvp.exe PID 1300 wrote to memory of 2164 1300 9tnbtb.exe 3jjvp.exe PID 2164 wrote to memory of 564 2164 3jjvp.exe llfrflf.exe PID 2164 wrote to memory of 564 2164 3jjvp.exe llfrflf.exe PID 2164 wrote to memory of 564 2164 3jjvp.exe llfrflf.exe PID 2164 wrote to memory of 564 2164 3jjvp.exe llfrflf.exe PID 564 wrote to memory of 2504 564 llfrflf.exe rrxfflx.exe PID 564 wrote to memory of 2504 564 llfrflf.exe rrxfflx.exe PID 564 wrote to memory of 2504 564 llfrflf.exe rrxfflx.exe PID 564 wrote to memory of 2504 564 llfrflf.exe rrxfflx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9c96b2b7c433fb567d6a5f3abca5c6ada92682bd759f48638d0b6d3cf43ce45.exe"C:\Users\Admin\AppData\Local\Temp\d9c96b2b7c433fb567d6a5f3abca5c6ada92682bd759f48638d0b6d3cf43ce45.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\7fffrxf.exec:\7fffrxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btnnbb.exec:\btnnbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3pddj.exec:\3pddj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrflffr.exec:\xrflffr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btnttb.exec:\btnttb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhbnth.exec:\hhbnth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llxxlxx.exec:\llxxlxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7xrxfrx.exec:\7xrxfrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3jjdp.exec:\3jjdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dpddv.exec:\dpddv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1lfrfrx.exec:\1lfrfrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1htbhn.exec:\1htbhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9tnbtb.exec:\9tnbtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3jjvp.exec:\3jjvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llfrflf.exec:\llfrflf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrxfflx.exec:\rrxfflx.exe17⤵
- Executes dropped EXE
-
\??\c:\bbnntb.exec:\bbnntb.exe18⤵
- Executes dropped EXE
-
\??\c:\jjvvj.exec:\jjvvj.exe19⤵
- Executes dropped EXE
-
\??\c:\dvdjv.exec:\dvdjv.exe20⤵
- Executes dropped EXE
-
\??\c:\rlflxfl.exec:\rlflxfl.exe21⤵
- Executes dropped EXE
-
\??\c:\hhbbnb.exec:\hhbbnb.exe22⤵
- Executes dropped EXE
-
\??\c:\bhtthh.exec:\bhtthh.exe23⤵
- Executes dropped EXE
-
\??\c:\ddppd.exec:\ddppd.exe24⤵
- Executes dropped EXE
-
\??\c:\pjpjp.exec:\pjpjp.exe25⤵
- Executes dropped EXE
-
\??\c:\1frfflx.exec:\1frfflx.exe26⤵
- Executes dropped EXE
-
\??\c:\nnbbhh.exec:\nnbbhh.exe27⤵
- Executes dropped EXE
-
\??\c:\5jdpv.exec:\5jdpv.exe28⤵
- Executes dropped EXE
-
\??\c:\vpppd.exec:\vpppd.exe29⤵
- Executes dropped EXE
-
\??\c:\rlxfxxr.exec:\rlxfxxr.exe30⤵
- Executes dropped EXE
-
\??\c:\tthbbn.exec:\tthbbn.exe31⤵
- Executes dropped EXE
-
\??\c:\bthnbh.exec:\bthnbh.exe32⤵
- Executes dropped EXE
-
\??\c:\pjdpp.exec:\pjdpp.exe33⤵
- Executes dropped EXE
-
\??\c:\rrrfxlx.exec:\rrrfxlx.exe34⤵
- Executes dropped EXE
-
\??\c:\llflflf.exec:\llflflf.exe35⤵
-
\??\c:\bththh.exec:\bththh.exe36⤵
- Executes dropped EXE
-
\??\c:\3hbbhh.exec:\3hbbhh.exe37⤵
- Executes dropped EXE
-
\??\c:\hhhtbb.exec:\hhhtbb.exe38⤵
- Executes dropped EXE
-
\??\c:\pjppv.exec:\pjppv.exe39⤵
- Executes dropped EXE
-
\??\c:\ppvvj.exec:\ppvvj.exe40⤵
- Executes dropped EXE
-
\??\c:\3lxfrrx.exec:\3lxfrrx.exe41⤵
- Executes dropped EXE
-
\??\c:\7xfrlrx.exec:\7xfrlrx.exe42⤵
- Executes dropped EXE
-
\??\c:\nhhhnn.exec:\nhhhnn.exe43⤵
- Executes dropped EXE
-
\??\c:\btnntt.exec:\btnntt.exe44⤵
- Executes dropped EXE
-
\??\c:\jddjv.exec:\jddjv.exe45⤵
- Executes dropped EXE
-
\??\c:\vvpdp.exec:\vvpdp.exe46⤵
- Executes dropped EXE
-
\??\c:\1fxfflr.exec:\1fxfflr.exe47⤵
- Executes dropped EXE
-
\??\c:\3fllffx.exec:\3fllffx.exe48⤵
- Executes dropped EXE
-
\??\c:\tnhnhh.exec:\tnhnhh.exe49⤵
- Executes dropped EXE
-
\??\c:\nhtnbb.exec:\nhtnbb.exe50⤵
- Executes dropped EXE
-
\??\c:\jpvjd.exec:\jpvjd.exe51⤵
- Executes dropped EXE
-
\??\c:\9jddj.exec:\9jddj.exe52⤵
- Executes dropped EXE
-
\??\c:\lfxfffr.exec:\lfxfffr.exe53⤵
- Executes dropped EXE
-
\??\c:\9rrlffr.exec:\9rrlffr.exe54⤵
- Executes dropped EXE
-
\??\c:\nbhntt.exec:\nbhntt.exe55⤵
- Executes dropped EXE
-
\??\c:\nhtthh.exec:\nhtthh.exe56⤵
- Executes dropped EXE
-
\??\c:\rlrrrrx.exec:\rlrrrrx.exe57⤵
- Executes dropped EXE
-
\??\c:\7fxlxfl.exec:\7fxlxfl.exe58⤵
- Executes dropped EXE
-
\??\c:\1tntbb.exec:\1tntbb.exe59⤵
- Executes dropped EXE
-
\??\c:\tnttbh.exec:\tnttbh.exe60⤵
- Executes dropped EXE
-
\??\c:\jdppd.exec:\jdppd.exe61⤵
- Executes dropped EXE
-
\??\c:\3vjvd.exec:\3vjvd.exe62⤵
- Executes dropped EXE
-
\??\c:\xrfrrll.exec:\xrfrrll.exe63⤵
- Executes dropped EXE
-
\??\c:\7frrrxl.exec:\7frrrxl.exe64⤵
- Executes dropped EXE
-
\??\c:\flxfrlx.exec:\flxfrlx.exe65⤵
- Executes dropped EXE
-
\??\c:\tnhnbt.exec:\tnhnbt.exe66⤵
- Executes dropped EXE
-
\??\c:\nnhthn.exec:\nnhthn.exe67⤵
-
\??\c:\1pdvv.exec:\1pdvv.exe68⤵
-
\??\c:\jdpvv.exec:\jdpvv.exe69⤵
-
\??\c:\7frlrxx.exec:\7frlrxx.exe70⤵
-
\??\c:\lfxlxfr.exec:\lfxlxfr.exe71⤵
-
\??\c:\hhbbbb.exec:\hhbbbb.exe72⤵
-
\??\c:\1htbbn.exec:\1htbbn.exe73⤵
-
\??\c:\tttbnn.exec:\tttbnn.exe74⤵
-
\??\c:\jdpdj.exec:\jdpdj.exe75⤵
-
\??\c:\1ddjj.exec:\1ddjj.exe76⤵
-
\??\c:\rrlxxlr.exec:\rrlxxlr.exe77⤵
-
\??\c:\lffllrf.exec:\lffllrf.exe78⤵
-
\??\c:\7hbntn.exec:\7hbntn.exe79⤵
-
\??\c:\hbbntb.exec:\hbbntb.exe80⤵
-
\??\c:\3pjpp.exec:\3pjpp.exe81⤵
-
\??\c:\dvddj.exec:\dvddj.exe82⤵
-
\??\c:\rfxxffl.exec:\rfxxffl.exe83⤵
-
\??\c:\fxfflrf.exec:\fxfflrf.exe84⤵
-
\??\c:\lllxxll.exec:\lllxxll.exe85⤵
-
\??\c:\bththh.exec:\bththh.exe86⤵
-
\??\c:\hbtbhn.exec:\hbtbhn.exe87⤵
-
\??\c:\dpjpv.exec:\dpjpv.exe88⤵
-
\??\c:\pjvdp.exec:\pjvdp.exe89⤵
-
\??\c:\llfflxr.exec:\llfflxr.exe90⤵
-
\??\c:\xxrlrfr.exec:\xxrlrfr.exe91⤵
-
\??\c:\3ttbtb.exec:\3ttbtb.exe92⤵
-
\??\c:\9ththh.exec:\9ththh.exe93⤵
-
\??\c:\hbhhtt.exec:\hbhhtt.exe94⤵
-
\??\c:\vpjjv.exec:\vpjjv.exe95⤵
-
\??\c:\jdvpv.exec:\jdvpv.exe96⤵
-
\??\c:\1rrxflx.exec:\1rrxflx.exe97⤵
-
\??\c:\xxrfxrf.exec:\xxrfxrf.exe98⤵
-
\??\c:\tnbhtt.exec:\tnbhtt.exe99⤵
-
\??\c:\9ddpd.exec:\9ddpd.exe100⤵
-
\??\c:\ppjvj.exec:\ppjvj.exe101⤵
-
\??\c:\xlxrffl.exec:\xlxrffl.exe102⤵
-
\??\c:\rlflrxf.exec:\rlflrxf.exe103⤵
-
\??\c:\5rflrxr.exec:\5rflrxr.exe104⤵
-
\??\c:\bthtbb.exec:\bthtbb.exe105⤵
-
\??\c:\7nbthn.exec:\7nbthn.exe106⤵
-
\??\c:\pjddp.exec:\pjddp.exe107⤵
-
\??\c:\jdpjp.exec:\jdpjp.exe108⤵
-
\??\c:\xrllrrx.exec:\xrllrrx.exe109⤵
-
\??\c:\llfrrfl.exec:\llfrrfl.exe110⤵
-
\??\c:\3tbnbb.exec:\3tbnbb.exe111⤵
-
\??\c:\nhnnth.exec:\nhnnth.exe112⤵
-
\??\c:\3thntb.exec:\3thntb.exe113⤵
-
\??\c:\9vjpv.exec:\9vjpv.exe114⤵
-
\??\c:\3djjj.exec:\3djjj.exe115⤵
-
\??\c:\9lflrxf.exec:\9lflrxf.exe116⤵
-
\??\c:\xlrrxfl.exec:\xlrrxfl.exe117⤵
-
\??\c:\hbnbnb.exec:\hbnbnb.exe118⤵
-
\??\c:\7bhhnn.exec:\7bhhnn.exe119⤵
-
\??\c:\vjpdd.exec:\vjpdd.exe120⤵
-
\??\c:\jddjp.exec:\jddjp.exe121⤵
-
\??\c:\xrxfrrf.exec:\xrxfrrf.exe122⤵
-
\??\c:\ffrxlrl.exec:\ffrxlrl.exe123⤵
-
\??\c:\hbntbn.exec:\hbntbn.exe124⤵
-
\??\c:\hbnhhb.exec:\hbnhhb.exe125⤵
-
\??\c:\1bntnh.exec:\1bntnh.exe126⤵
-
\??\c:\vpdjv.exec:\vpdjv.exe127⤵
-
\??\c:\dpjjj.exec:\dpjjj.exe128⤵
-
\??\c:\7xxfflx.exec:\7xxfflx.exe129⤵
-
\??\c:\rllxlxl.exec:\rllxlxl.exe130⤵
-
\??\c:\ttnthh.exec:\ttnthh.exe131⤵
-
\??\c:\hhbbhn.exec:\hhbbhn.exe132⤵
-
\??\c:\5jvvj.exec:\5jvvj.exe133⤵
-
\??\c:\9pvjv.exec:\9pvjv.exe134⤵
-
\??\c:\7fxfrrf.exec:\7fxfrrf.exe135⤵
-
\??\c:\llxfrfl.exec:\llxfrfl.exe136⤵
-
\??\c:\3lllxfr.exec:\3lllxfr.exe137⤵
-
\??\c:\tnbhnn.exec:\tnbhnn.exe138⤵
-
\??\c:\nnhhbh.exec:\nnhhbh.exe139⤵
-
\??\c:\1pddj.exec:\1pddj.exe140⤵
-
\??\c:\djpvj.exec:\djpvj.exe141⤵
-
\??\c:\fxllllr.exec:\fxllllr.exe142⤵
-
\??\c:\rlrxxlx.exec:\rlrxxlx.exe143⤵
-
\??\c:\nhtbhh.exec:\nhtbhh.exe144⤵
-
\??\c:\hhtthn.exec:\hhtthn.exe145⤵
-
\??\c:\bbnthn.exec:\bbnthn.exe146⤵
-
\??\c:\vdppp.exec:\vdppp.exe147⤵
-
\??\c:\3pdjp.exec:\3pdjp.exe148⤵
-
\??\c:\7xlxllx.exec:\7xlxllx.exe149⤵
-
\??\c:\1flxxrx.exec:\1flxxrx.exe150⤵
-
\??\c:\tnbnbb.exec:\tnbnbb.exe151⤵
-
\??\c:\nbnnbh.exec:\nbnnbh.exe152⤵
-
\??\c:\dpjjj.exec:\dpjjj.exe153⤵
-
\??\c:\lfxflxl.exec:\lfxflxl.exe154⤵
-
\??\c:\lfllrfl.exec:\lfllrfl.exe155⤵
-
\??\c:\3rlrffl.exec:\3rlrffl.exe156⤵
-
\??\c:\9hbhtb.exec:\9hbhtb.exe157⤵
-
\??\c:\9nhhtb.exec:\9nhhtb.exe158⤵
-
\??\c:\1ddvd.exec:\1ddvd.exe159⤵
-
\??\c:\pjdjv.exec:\pjdjv.exe160⤵
-
\??\c:\xxrfrrx.exec:\xxrfrrx.exe161⤵
-
\??\c:\ffxfrxr.exec:\ffxfrxr.exe162⤵
-
\??\c:\nhttbh.exec:\nhttbh.exe163⤵
-
\??\c:\pjjjp.exec:\pjjjp.exe164⤵
-
\??\c:\9jjjp.exec:\9jjjp.exe165⤵
-
\??\c:\pdvvd.exec:\pdvvd.exe166⤵
-
\??\c:\rlxxllr.exec:\rlxxllr.exe167⤵
-
\??\c:\llrrfxl.exec:\llrrfxl.exe168⤵
-
\??\c:\nbntbh.exec:\nbntbh.exe169⤵
-
\??\c:\vpdjp.exec:\vpdjp.exe170⤵
-
\??\c:\7vjpd.exec:\7vjpd.exe171⤵
-
\??\c:\fffrrxl.exec:\fffrrxl.exe172⤵
-
\??\c:\xfrrxfl.exec:\xfrrxfl.exe173⤵
-
\??\c:\nhtbhh.exec:\nhtbhh.exe174⤵
-
\??\c:\hhbhbt.exec:\hhbhbt.exe175⤵
-
\??\c:\7ddjp.exec:\7ddjp.exe176⤵
-
\??\c:\jdvvv.exec:\jdvvv.exe177⤵
-
\??\c:\3pjpp.exec:\3pjpp.exe178⤵
-
\??\c:\5xrrllr.exec:\5xrrllr.exe179⤵
-
\??\c:\9ttbnt.exec:\9ttbnt.exe180⤵
-
\??\c:\9hnhnt.exec:\9hnhnt.exe181⤵
-
\??\c:\dvdjp.exec:\dvdjp.exe182⤵
-
\??\c:\pjjpj.exec:\pjjpj.exe183⤵
-
\??\c:\9xrflrx.exec:\9xrflrx.exe184⤵
-
\??\c:\ffxfxfr.exec:\ffxfxfr.exe185⤵
-
\??\c:\llxflrx.exec:\llxflrx.exe186⤵
-
\??\c:\btnttt.exec:\btnttt.exe187⤵
-
\??\c:\bthntt.exec:\bthntt.exe188⤵
-
\??\c:\7vppv.exec:\7vppv.exe189⤵
-
\??\c:\jjdjv.exec:\jjdjv.exe190⤵
-
\??\c:\xrxfrxl.exec:\xrxfrxl.exe191⤵
-
\??\c:\lflrxfl.exec:\lflrxfl.exe192⤵
-
\??\c:\5hnnth.exec:\5hnnth.exe193⤵
-
\??\c:\tbbnnn.exec:\tbbnnn.exe194⤵
-
\??\c:\5ddpd.exec:\5ddpd.exe195⤵
-
\??\c:\7jppv.exec:\7jppv.exe196⤵
-
\??\c:\lfrxffx.exec:\lfrxffx.exe197⤵
-
\??\c:\llxlfff.exec:\llxlfff.exe198⤵
-
\??\c:\bthbhn.exec:\bthbhn.exe199⤵
-
\??\c:\9nnthh.exec:\9nnthh.exe200⤵
-
\??\c:\jdjpv.exec:\jdjpv.exe201⤵
-
\??\c:\5pdpv.exec:\5pdpv.exe202⤵
-
\??\c:\9xrflrf.exec:\9xrflrf.exe203⤵
-
\??\c:\ffxllrx.exec:\ffxllrx.exe204⤵
-
\??\c:\1bntbh.exec:\1bntbh.exe205⤵
-
\??\c:\hhbnht.exec:\hhbnht.exe206⤵
-
\??\c:\jdvvj.exec:\jdvvj.exe207⤵
-
\??\c:\jdddp.exec:\jdddp.exe208⤵
-
\??\c:\9rlrxfl.exec:\9rlrxfl.exe209⤵
-
\??\c:\7nbbhh.exec:\7nbbhh.exe210⤵
-
\??\c:\3ppjv.exec:\3ppjv.exe211⤵
-
\??\c:\jdppv.exec:\jdppv.exe212⤵
-
\??\c:\llfrffx.exec:\llfrffx.exe213⤵
-
\??\c:\thnntb.exec:\thnntb.exe214⤵
-
\??\c:\9vvjp.exec:\9vvjp.exe215⤵
-
\??\c:\dvppj.exec:\dvppj.exe216⤵
-
\??\c:\lflfflf.exec:\lflfflf.exe217⤵
-
\??\c:\lfxxrrf.exec:\lfxxrrf.exe218⤵
-
\??\c:\7ttntb.exec:\7ttntb.exe219⤵
-
\??\c:\hthbbh.exec:\hthbbh.exe220⤵
-
\??\c:\dpjpp.exec:\dpjpp.exe221⤵
-
\??\c:\pjppd.exec:\pjppd.exe222⤵
-
\??\c:\fxxlllf.exec:\fxxlllf.exe223⤵
-
\??\c:\rrflxfl.exec:\rrflxfl.exe224⤵
-
\??\c:\llxxxlr.exec:\llxxxlr.exe225⤵
-
\??\c:\bbnbhn.exec:\bbnbhn.exe226⤵
-
\??\c:\nhtbbt.exec:\nhtbbt.exe227⤵
-
\??\c:\jdjjj.exec:\jdjjj.exe228⤵
-
\??\c:\rlxxffr.exec:\rlxxffr.exe229⤵
-
\??\c:\frxfllr.exec:\frxfllr.exe230⤵
-
\??\c:\7bbbnt.exec:\7bbbnt.exe231⤵
-
\??\c:\9tbhbh.exec:\9tbhbh.exe232⤵
-
\??\c:\dvjjv.exec:\dvjjv.exe233⤵
-
\??\c:\dvvvd.exec:\dvvvd.exe234⤵
-
\??\c:\1xffllr.exec:\1xffllr.exe235⤵
-
\??\c:\9rfflrf.exec:\9rfflrf.exe236⤵
-
\??\c:\bttttt.exec:\bttttt.exe237⤵
-
\??\c:\bthnnn.exec:\bthnnn.exe238⤵
-
\??\c:\dddjp.exec:\dddjp.exe239⤵
-
\??\c:\7lxflrx.exec:\7lxflrx.exe240⤵
-
\??\c:\xrlrrxl.exec:\xrlrrxl.exe241⤵