Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
05-07-2024 03:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
32f95965b04a39661a1bf8129f7a7fd4dd9b32a631ca9ab0e10bd25437da6a3c.exe
Resource
win7-20240611-en
5 signatures
150 seconds
General
-
Target
32f95965b04a39661a1bf8129f7a7fd4dd9b32a631ca9ab0e10bd25437da6a3c.exe
-
Size
55KB
-
MD5
7cefaaaea4523c57ba4f36d15cf8f1d0
-
SHA1
3641510b3d849adeb24a18affba41544d87666ca
-
SHA256
32f95965b04a39661a1bf8129f7a7fd4dd9b32a631ca9ab0e10bd25437da6a3c
-
SHA512
256a1270c68c89bb833b68b39bc7fb87450c86bc63ccaf48eaae5a6b3d2c3d2f1c634cf3f6b3893f7c6f755087ac40184a22d62953ddd29a7fd0fd5d8b3625a9
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFJX:ymb3NkkiQ3mdBjFIFJX
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral2/memory/424-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3896-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3708-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2848-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2696-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3332-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2900-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2196-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2700-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2232-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1800-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4128-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3848-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4784-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3572-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3512-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4412-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1316-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1372-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2328-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/972-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rfxlffx.exethtnbb.exevddvj.exevjvjj.exexrrrffx.exethbthh.exenhtnhb.exejpdjd.exefxlfxxf.exenthhtn.exevppvp.exejvdvj.exentbnhh.exeddjdd.exefrfxlxl.exebnbbtn.exevdvdp.exe3ddjj.exe3lrlfxr.exebtthnh.exevvdvp.exerxxrfrl.exe1lrrrrr.exettthth.exejdvvp.exe5lrfxfx.exebhhhtt.exennbbbb.exevpvjp.exexfxrfxr.exe7rxffxr.exenbbnth.exejdpdd.exexfxxlxl.exe1llrlfx.exehtbthh.exevpjdv.exejjpjp.exelxrllll.exetnbttn.exetnttht.exepjdvj.exerlfxflr.exentnbtt.exelrfxrxr.exehhnttb.exepvvdd.exelxxffrr.exetnhnbn.exevvvdp.exepddvj.exelrrflrx.exetnntht.exebntnbt.exe3pvdp.exefxfxxxx.exebbttnt.exe7hbbhh.exedvdvp.exelrflllf.exebtnbbn.exepddvp.exennhhbh.exebhnhbt.exepid process 3896 rfxlffx.exe 3708 thtnbb.exe 2848 vddvj.exe 804 vjvjj.exe 4724 xrrrffx.exe 2696 thbthh.exe 3332 nhtnhb.exe 1172 jpdjd.exe 2196 fxlfxxf.exe 2900 nthhtn.exe 2700 vppvp.exe 2232 jvdvj.exe 1800 ntbnhh.exe 5076 ddjdd.exe 4128 frfxlxl.exe 3848 bnbbtn.exe 1552 vdvdp.exe 4784 3ddjj.exe 3572 3lrlfxr.exe 3512 btthnh.exe 3384 vvdvp.exe 4412 rxxrfrl.exe 1316 1lrrrrr.exe 1372 ttthth.exe 4888 jdvvp.exe 3292 5lrfxfx.exe 5092 bhhhtt.exe 4808 nnbbbb.exe 2328 vpvjp.exe 972 xfxrfxr.exe 320 7rxffxr.exe 1916 nbbnth.exe 2920 jdpdd.exe 1860 xfxxlxl.exe 1564 1llrlfx.exe 740 htbthh.exe 608 vpjdv.exe 4448 jjpjp.exe 1604 lxrllll.exe 4900 tnbttn.exe 4276 tnttht.exe 4520 pjdvj.exe 4444 rlfxflr.exe 1704 ntnbtt.exe 2880 lrfxrxr.exe 2616 hhnttb.exe 1752 pvvdd.exe 4804 lxxffrr.exe 5064 tnhnbn.exe 3984 vvvdp.exe 2696 pddvj.exe 3048 lrrflrx.exe 4660 tnntht.exe 4720 bntnbt.exe 3300 3pvdp.exe 2608 fxfxxxx.exe 2592 bbttnt.exe 5048 7hbbhh.exe 4100 dvdvp.exe 3660 lrflllf.exe 1228 btnbbn.exe 3112 pddvp.exe 3756 nnhhbh.exe 1964 bhnhbt.exe -
Processes:
resource yara_rule behavioral2/memory/424-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3896-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3708-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2848-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2696-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3332-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3332-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2196-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2196-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2196-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2900-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2196-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2700-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2232-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1800-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4128-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3848-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3512-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4412-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1316-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1372-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/972-199-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
32f95965b04a39661a1bf8129f7a7fd4dd9b32a631ca9ab0e10bd25437da6a3c.exerfxlffx.exethtnbb.exevddvj.exevjvjj.exexrrrffx.exethbthh.exenhtnhb.exejpdjd.exefxlfxxf.exenthhtn.exevppvp.exejvdvj.exentbnhh.exeddjdd.exefrfxlxl.exebnbbtn.exevdvdp.exe3ddjj.exe3lrlfxr.exebtthnh.exevvdvp.exedescription pid process target process PID 424 wrote to memory of 3896 424 32f95965b04a39661a1bf8129f7a7fd4dd9b32a631ca9ab0e10bd25437da6a3c.exe rfxlffx.exe PID 424 wrote to memory of 3896 424 32f95965b04a39661a1bf8129f7a7fd4dd9b32a631ca9ab0e10bd25437da6a3c.exe rfxlffx.exe PID 424 wrote to memory of 3896 424 32f95965b04a39661a1bf8129f7a7fd4dd9b32a631ca9ab0e10bd25437da6a3c.exe rfxlffx.exe PID 3896 wrote to memory of 3708 3896 rfxlffx.exe thtnbb.exe PID 3896 wrote to memory of 3708 3896 rfxlffx.exe thtnbb.exe PID 3896 wrote to memory of 3708 3896 rfxlffx.exe thtnbb.exe PID 3708 wrote to memory of 2848 3708 thtnbb.exe vddvj.exe PID 3708 wrote to memory of 2848 3708 thtnbb.exe vddvj.exe PID 3708 wrote to memory of 2848 3708 thtnbb.exe vddvj.exe PID 2848 wrote to memory of 804 2848 vddvj.exe vjvjj.exe PID 2848 wrote to memory of 804 2848 vddvj.exe vjvjj.exe PID 2848 wrote to memory of 804 2848 vddvj.exe vjvjj.exe PID 804 wrote to memory of 4724 804 vjvjj.exe xrrrffx.exe PID 804 wrote to memory of 4724 804 vjvjj.exe xrrrffx.exe PID 804 wrote to memory of 4724 804 vjvjj.exe xrrrffx.exe PID 4724 wrote to memory of 2696 4724 xrrrffx.exe thbthh.exe PID 4724 wrote to memory of 2696 4724 xrrrffx.exe thbthh.exe PID 4724 wrote to memory of 2696 4724 xrrrffx.exe thbthh.exe PID 2696 wrote to memory of 3332 2696 thbthh.exe nhtnhb.exe PID 2696 wrote to memory of 3332 2696 thbthh.exe nhtnhb.exe PID 2696 wrote to memory of 3332 2696 thbthh.exe nhtnhb.exe PID 3332 wrote to memory of 1172 3332 nhtnhb.exe jpdjd.exe PID 3332 wrote to memory of 1172 3332 nhtnhb.exe jpdjd.exe PID 3332 wrote to memory of 1172 3332 nhtnhb.exe jpdjd.exe PID 1172 wrote to memory of 2196 1172 jpdjd.exe fxlfxxf.exe PID 1172 wrote to memory of 2196 1172 jpdjd.exe fxlfxxf.exe PID 1172 wrote to memory of 2196 1172 jpdjd.exe fxlfxxf.exe PID 2196 wrote to memory of 2900 2196 fxlfxxf.exe nthhtn.exe PID 2196 wrote to memory of 2900 2196 fxlfxxf.exe nthhtn.exe PID 2196 wrote to memory of 2900 2196 fxlfxxf.exe nthhtn.exe PID 2900 wrote to memory of 2700 2900 nthhtn.exe vppvp.exe PID 2900 wrote to memory of 2700 2900 nthhtn.exe vppvp.exe PID 2900 wrote to memory of 2700 2900 nthhtn.exe vppvp.exe PID 2700 wrote to memory of 2232 2700 vppvp.exe jvdvj.exe PID 2700 wrote to memory of 2232 2700 vppvp.exe jvdvj.exe PID 2700 wrote to memory of 2232 2700 vppvp.exe jvdvj.exe PID 2232 wrote to memory of 1800 2232 jvdvj.exe ntbnhh.exe PID 2232 wrote to memory of 1800 2232 jvdvj.exe ntbnhh.exe PID 2232 wrote to memory of 1800 2232 jvdvj.exe ntbnhh.exe PID 1800 wrote to memory of 5076 1800 ntbnhh.exe ddjdd.exe PID 1800 wrote to memory of 5076 1800 ntbnhh.exe ddjdd.exe PID 1800 wrote to memory of 5076 1800 ntbnhh.exe ddjdd.exe PID 5076 wrote to memory of 4128 5076 ddjdd.exe frfxlxl.exe PID 5076 wrote to memory of 4128 5076 ddjdd.exe frfxlxl.exe PID 5076 wrote to memory of 4128 5076 ddjdd.exe frfxlxl.exe PID 4128 wrote to memory of 3848 4128 frfxlxl.exe bnbbtn.exe PID 4128 wrote to memory of 3848 4128 frfxlxl.exe bnbbtn.exe PID 4128 wrote to memory of 3848 4128 frfxlxl.exe bnbbtn.exe PID 3848 wrote to memory of 1552 3848 bnbbtn.exe vdvdp.exe PID 3848 wrote to memory of 1552 3848 bnbbtn.exe vdvdp.exe PID 3848 wrote to memory of 1552 3848 bnbbtn.exe vdvdp.exe PID 1552 wrote to memory of 4784 1552 vdvdp.exe 3ddjj.exe PID 1552 wrote to memory of 4784 1552 vdvdp.exe 3ddjj.exe PID 1552 wrote to memory of 4784 1552 vdvdp.exe 3ddjj.exe PID 4784 wrote to memory of 3572 4784 3ddjj.exe 3lrlfxr.exe PID 4784 wrote to memory of 3572 4784 3ddjj.exe 3lrlfxr.exe PID 4784 wrote to memory of 3572 4784 3ddjj.exe 3lrlfxr.exe PID 3572 wrote to memory of 3512 3572 3lrlfxr.exe btthnh.exe PID 3572 wrote to memory of 3512 3572 3lrlfxr.exe btthnh.exe PID 3572 wrote to memory of 3512 3572 3lrlfxr.exe btthnh.exe PID 3512 wrote to memory of 3384 3512 btthnh.exe vvdvp.exe PID 3512 wrote to memory of 3384 3512 btthnh.exe vvdvp.exe PID 3512 wrote to memory of 3384 3512 btthnh.exe vvdvp.exe PID 3384 wrote to memory of 4412 3384 vvdvp.exe rxxrfrl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\32f95965b04a39661a1bf8129f7a7fd4dd9b32a631ca9ab0e10bd25437da6a3c.exe"C:\Users\Admin\AppData\Local\Temp\32f95965b04a39661a1bf8129f7a7fd4dd9b32a631ca9ab0e10bd25437da6a3c.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\rfxlffx.exec:\rfxlffx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thtnbb.exec:\thtnbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vddvj.exec:\vddvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjvjj.exec:\vjvjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrrrffx.exec:\xrrrffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thbthh.exec:\thbthh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhtnhb.exec:\nhtnhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpdjd.exec:\jpdjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxlfxxf.exec:\fxlfxxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nthhtn.exec:\nthhtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vppvp.exec:\vppvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvdvj.exec:\jvdvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ntbnhh.exec:\ntbnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddjdd.exec:\ddjdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frfxlxl.exec:\frfxlxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnbbtn.exec:\bnbbtn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vdvdp.exec:\vdvdp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3ddjj.exec:\3ddjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3lrlfxr.exec:\3lrlfxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btthnh.exec:\btthnh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvdvp.exec:\vvdvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rxxrfrl.exec:\rxxrfrl.exe23⤵
- Executes dropped EXE
-
\??\c:\1lrrrrr.exec:\1lrrrrr.exe24⤵
- Executes dropped EXE
-
\??\c:\ttthth.exec:\ttthth.exe25⤵
- Executes dropped EXE
-
\??\c:\jdvvp.exec:\jdvvp.exe26⤵
- Executes dropped EXE
-
\??\c:\5lrfxfx.exec:\5lrfxfx.exe27⤵
- Executes dropped EXE
-
\??\c:\bhhhtt.exec:\bhhhtt.exe28⤵
- Executes dropped EXE
-
\??\c:\nnbbbb.exec:\nnbbbb.exe29⤵
- Executes dropped EXE
-
\??\c:\vpvjp.exec:\vpvjp.exe30⤵
- Executes dropped EXE
-
\??\c:\xfxrfxr.exec:\xfxrfxr.exe31⤵
- Executes dropped EXE
-
\??\c:\7rxffxr.exec:\7rxffxr.exe32⤵
- Executes dropped EXE
-
\??\c:\nbbnth.exec:\nbbnth.exe33⤵
- Executes dropped EXE
-
\??\c:\jdpdd.exec:\jdpdd.exe34⤵
- Executes dropped EXE
-
\??\c:\xfxxlxl.exec:\xfxxlxl.exe35⤵
- Executes dropped EXE
-
\??\c:\1llrlfx.exec:\1llrlfx.exe36⤵
- Executes dropped EXE
-
\??\c:\htbthh.exec:\htbthh.exe37⤵
- Executes dropped EXE
-
\??\c:\vpjdv.exec:\vpjdv.exe38⤵
- Executes dropped EXE
-
\??\c:\jjpjp.exec:\jjpjp.exe39⤵
- Executes dropped EXE
-
\??\c:\lxrllll.exec:\lxrllll.exe40⤵
- Executes dropped EXE
-
\??\c:\tnbttn.exec:\tnbttn.exe41⤵
- Executes dropped EXE
-
\??\c:\tnttht.exec:\tnttht.exe42⤵
- Executes dropped EXE
-
\??\c:\pjdvj.exec:\pjdvj.exe43⤵
- Executes dropped EXE
-
\??\c:\rlfxflr.exec:\rlfxflr.exe44⤵
- Executes dropped EXE
-
\??\c:\ntnbtt.exec:\ntnbtt.exe45⤵
- Executes dropped EXE
-
\??\c:\lrfxrxr.exec:\lrfxrxr.exe46⤵
- Executes dropped EXE
-
\??\c:\hhnttb.exec:\hhnttb.exe47⤵
- Executes dropped EXE
-
\??\c:\pvvdd.exec:\pvvdd.exe48⤵
- Executes dropped EXE
-
\??\c:\lxxffrr.exec:\lxxffrr.exe49⤵
- Executes dropped EXE
-
\??\c:\tnhnbn.exec:\tnhnbn.exe50⤵
- Executes dropped EXE
-
\??\c:\vvvdp.exec:\vvvdp.exe51⤵
- Executes dropped EXE
-
\??\c:\pddvj.exec:\pddvj.exe52⤵
- Executes dropped EXE
-
\??\c:\lrrflrx.exec:\lrrflrx.exe53⤵
- Executes dropped EXE
-
\??\c:\tnntht.exec:\tnntht.exe54⤵
- Executes dropped EXE
-
\??\c:\bntnbt.exec:\bntnbt.exe55⤵
- Executes dropped EXE
-
\??\c:\3pvdp.exec:\3pvdp.exe56⤵
- Executes dropped EXE
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe57⤵
- Executes dropped EXE
-
\??\c:\bbttnt.exec:\bbttnt.exe58⤵
- Executes dropped EXE
-
\??\c:\7hbbhh.exec:\7hbbhh.exe59⤵
- Executes dropped EXE
-
\??\c:\dvdvp.exec:\dvdvp.exe60⤵
- Executes dropped EXE
-
\??\c:\lrflllf.exec:\lrflllf.exe61⤵
- Executes dropped EXE
-
\??\c:\btnbbn.exec:\btnbbn.exe62⤵
- Executes dropped EXE
-
\??\c:\pddvp.exec:\pddvp.exe63⤵
- Executes dropped EXE
-
\??\c:\nnhhbh.exec:\nnhhbh.exe64⤵
- Executes dropped EXE
-
\??\c:\bhnhbt.exec:\bhnhbt.exe65⤵
- Executes dropped EXE
-
\??\c:\vpjdp.exec:\vpjdp.exe66⤵
-
\??\c:\vjjdv.exec:\vjjdv.exe67⤵
-
\??\c:\frfrfxl.exec:\frfrfxl.exe68⤵
-
\??\c:\tnbnth.exec:\tnbnth.exe69⤵
-
\??\c:\btttnn.exec:\btttnn.exe70⤵
-
\??\c:\vpjdp.exec:\vpjdp.exe71⤵
-
\??\c:\pppjd.exec:\pppjd.exe72⤵
-
\??\c:\5rxlxxr.exec:\5rxlxxr.exe73⤵
-
\??\c:\nbbntt.exec:\nbbntt.exe74⤵
-
\??\c:\nnhbtt.exec:\nnhbtt.exe75⤵
-
\??\c:\ppvpd.exec:\ppvpd.exe76⤵
-
\??\c:\pjjjd.exec:\pjjjd.exe77⤵
-
\??\c:\flxlffx.exec:\flxlffx.exe78⤵
-
\??\c:\9nhbtn.exec:\9nhbtn.exe79⤵
-
\??\c:\rfflxrl.exec:\rfflxrl.exe80⤵
-
\??\c:\lllfxxl.exec:\lllfxxl.exe81⤵
-
\??\c:\bnhbtb.exec:\bnhbtb.exe82⤵
-
\??\c:\dpvpd.exec:\dpvpd.exe83⤵
-
\??\c:\vddvp.exec:\vddvp.exe84⤵
-
\??\c:\flrlfrl.exec:\flrlfrl.exe85⤵
-
\??\c:\lffxfll.exec:\lffxfll.exe86⤵
-
\??\c:\ttthbt.exec:\ttthbt.exe87⤵
-
\??\c:\7vdpp.exec:\7vdpp.exe88⤵
-
\??\c:\pdjjv.exec:\pdjjv.exe89⤵
-
\??\c:\rrlxlrx.exec:\rrlxlrx.exe90⤵
-
\??\c:\thnnhh.exec:\thnnhh.exe91⤵
-
\??\c:\thtnnn.exec:\thtnnn.exe92⤵
-
\??\c:\jjjdd.exec:\jjjdd.exe93⤵
-
\??\c:\3lfffrr.exec:\3lfffrr.exe94⤵
-
\??\c:\lffrrlr.exec:\lffrrlr.exe95⤵
-
\??\c:\bbnbhb.exec:\bbnbhb.exe96⤵
-
\??\c:\btbbtt.exec:\btbbtt.exe97⤵
-
\??\c:\pvdvp.exec:\pvdvp.exe98⤵
-
\??\c:\rlfxrrx.exec:\rlfxrrx.exe99⤵
-
\??\c:\nbtntn.exec:\nbtntn.exe100⤵
-
\??\c:\bntttt.exec:\bntttt.exe101⤵
-
\??\c:\vjpjd.exec:\vjpjd.exe102⤵
-
\??\c:\rlfxrrr.exec:\rlfxrrr.exe103⤵
-
\??\c:\xrffffx.exec:\xrffffx.exe104⤵
-
\??\c:\ntbbtt.exec:\ntbbtt.exe105⤵
-
\??\c:\xrrxlll.exec:\xrrxlll.exe106⤵
-
\??\c:\thnhbb.exec:\thnhbb.exe107⤵
-
\??\c:\bbnnnn.exec:\bbnnnn.exe108⤵
-
\??\c:\pjjdj.exec:\pjjdj.exe109⤵
-
\??\c:\ffrlfff.exec:\ffrlfff.exe110⤵
-
\??\c:\rfrflfx.exec:\rfrflfx.exe111⤵
-
\??\c:\bntnhh.exec:\bntnhh.exe112⤵
-
\??\c:\ttthhh.exec:\ttthhh.exe113⤵
-
\??\c:\ddvdd.exec:\ddvdd.exe114⤵
-
\??\c:\ffffrrr.exec:\ffffrrr.exe115⤵
-
\??\c:\9rlfxxf.exec:\9rlfxxf.exe116⤵
-
\??\c:\ttbthb.exec:\ttbthb.exe117⤵
-
\??\c:\9dppp.exec:\9dppp.exe118⤵
-
\??\c:\rffxlll.exec:\rffxlll.exe119⤵
-
\??\c:\3rxrlrl.exec:\3rxrlrl.exe120⤵
-
\??\c:\5nttth.exec:\5nttth.exe121⤵
-
\??\c:\jpvvv.exec:\jpvvv.exe122⤵
-
\??\c:\lxrlxxx.exec:\lxrlxxx.exe123⤵
-
\??\c:\btnbth.exec:\btnbth.exe124⤵
-
\??\c:\btthht.exec:\btthht.exe125⤵
-
\??\c:\ppdjd.exec:\ppdjd.exe126⤵
-
\??\c:\7lflfll.exec:\7lflfll.exe127⤵
-
\??\c:\lfxxlxl.exec:\lfxxlxl.exe128⤵
-
\??\c:\ttnbtb.exec:\ttnbtb.exe129⤵
-
\??\c:\pddvj.exec:\pddvj.exe130⤵
-
\??\c:\vddpv.exec:\vddpv.exe131⤵
-
\??\c:\fllfflf.exec:\fllfflf.exe132⤵
-
\??\c:\lfxlfrl.exec:\lfxlfrl.exe133⤵
-
\??\c:\ttbtnh.exec:\ttbtnh.exe134⤵
-
\??\c:\pjjdd.exec:\pjjdd.exe135⤵
-
\??\c:\lfflflx.exec:\lfflflx.exe136⤵
-
\??\c:\1lrrxfl.exec:\1lrrxfl.exe137⤵
-
\??\c:\tthtnt.exec:\tthtnt.exe138⤵
-
\??\c:\jjjpd.exec:\jjjpd.exe139⤵
-
\??\c:\djdvj.exec:\djdvj.exe140⤵
-
\??\c:\xrfrrxx.exec:\xrfrrxx.exe141⤵
-
\??\c:\9rffrrf.exec:\9rffrrf.exe142⤵
-
\??\c:\nhhtnt.exec:\nhhtnt.exe143⤵
-
\??\c:\pvpvj.exec:\pvpvj.exe144⤵
-
\??\c:\rfrlrlr.exec:\rfrlrlr.exe145⤵
-
\??\c:\tnhbtn.exec:\tnhbtn.exe146⤵
-
\??\c:\vpvpd.exec:\vpvpd.exe147⤵
-
\??\c:\rlrrfxr.exec:\rlrrfxr.exe148⤵
-
\??\c:\rlxxllx.exec:\rlxxllx.exe149⤵
-
\??\c:\ntntbb.exec:\ntntbb.exe150⤵
-
\??\c:\djdvj.exec:\djdvj.exe151⤵
-
\??\c:\vdddd.exec:\vdddd.exe152⤵
-
\??\c:\xrlxllf.exec:\xrlxllf.exe153⤵
-
\??\c:\thbhbn.exec:\thbhbn.exe154⤵
-
\??\c:\bhtbnb.exec:\bhtbnb.exe155⤵
-
\??\c:\jjjvd.exec:\jjjvd.exe156⤵
-
\??\c:\frrlffx.exec:\frrlffx.exe157⤵
-
\??\c:\lfxrllf.exec:\lfxrllf.exe158⤵
-
\??\c:\bhtbht.exec:\bhtbht.exe159⤵
-
\??\c:\jpdpp.exec:\jpdpp.exe160⤵
-
\??\c:\vdpvj.exec:\vdpvj.exe161⤵
-
\??\c:\5lxrlll.exec:\5lxrlll.exe162⤵
-
\??\c:\bttnhh.exec:\bttnhh.exe163⤵
-
\??\c:\jpvvj.exec:\jpvvj.exe164⤵
-
\??\c:\vvvpd.exec:\vvvpd.exe165⤵
-
\??\c:\9fxrrlf.exec:\9fxrrlf.exe166⤵
-
\??\c:\nnhhhh.exec:\nnhhhh.exe167⤵
-
\??\c:\tthnbt.exec:\tthnbt.exe168⤵
-
\??\c:\pvvpp.exec:\pvvpp.exe169⤵
-
\??\c:\lrrfffr.exec:\lrrfffr.exe170⤵
-
\??\c:\xxrlfff.exec:\xxrlfff.exe171⤵
-
\??\c:\tttnhb.exec:\tttnhb.exe172⤵
-
\??\c:\7dddp.exec:\7dddp.exe173⤵
-
\??\c:\rlrrfff.exec:\rlrrfff.exe174⤵
-
\??\c:\xxrrrxf.exec:\xxrrrxf.exe175⤵
-
\??\c:\nbnnnn.exec:\nbnnnn.exe176⤵
-
\??\c:\vdvjv.exec:\vdvjv.exe177⤵
-
\??\c:\frlrrxl.exec:\frlrrxl.exe178⤵
-
\??\c:\lrrxlfl.exec:\lrrxlfl.exe179⤵
-
\??\c:\ttnbtt.exec:\ttnbtt.exe180⤵
-
\??\c:\jdvpp.exec:\jdvpp.exe181⤵
-
\??\c:\xfxlxfl.exec:\xfxlxfl.exe182⤵
-
\??\c:\thbthb.exec:\thbthb.exe183⤵
-
\??\c:\hntttt.exec:\hntttt.exe184⤵
-
\??\c:\5dvvj.exec:\5dvvj.exe185⤵
-
\??\c:\lrlflff.exec:\lrlflff.exe186⤵
-
\??\c:\frxffrx.exec:\frxffrx.exe187⤵
-
\??\c:\hbtbnt.exec:\hbtbnt.exe188⤵
-
\??\c:\vdpvv.exec:\vdpvv.exe189⤵
-
\??\c:\jvvdv.exec:\jvvdv.exe190⤵
-
\??\c:\llffffx.exec:\llffffx.exe191⤵
-
\??\c:\nbbtnn.exec:\nbbtnn.exe192⤵
-
\??\c:\pjpjd.exec:\pjpjd.exe193⤵
-
\??\c:\xfxrllr.exec:\xfxrllr.exe194⤵
-
\??\c:\bnhbnt.exec:\bnhbnt.exe195⤵
-
\??\c:\3nnhtn.exec:\3nnhtn.exe196⤵
-
\??\c:\vvdpd.exec:\vvdpd.exe197⤵
-
\??\c:\vpvjj.exec:\vpvjj.exe198⤵
-
\??\c:\ffxxxxx.exec:\ffxxxxx.exe199⤵
-
\??\c:\rrlrlxf.exec:\rrlrlxf.exe200⤵
-
\??\c:\thhbnt.exec:\thhbnt.exe201⤵
-
\??\c:\hthhtb.exec:\hthhtb.exe202⤵
-
\??\c:\jjpvv.exec:\jjpvv.exe203⤵
-
\??\c:\jpjvp.exec:\jpjvp.exe204⤵
-
\??\c:\9lrffxf.exec:\9lrffxf.exe205⤵
-
\??\c:\bntbnh.exec:\bntbnh.exe206⤵
-
\??\c:\vddpd.exec:\vddpd.exe207⤵
-
\??\c:\7rrlxrl.exec:\7rrlxrl.exe208⤵
-
\??\c:\tbthtn.exec:\tbthtn.exe209⤵
-
\??\c:\ttnhtt.exec:\ttnhtt.exe210⤵
-
\??\c:\5vjdp.exec:\5vjdp.exe211⤵
-
\??\c:\vvdpj.exec:\vvdpj.exe212⤵
-
\??\c:\flffxrl.exec:\flffxrl.exe213⤵
-
\??\c:\7bnhtb.exec:\7bnhtb.exe214⤵
-
\??\c:\dddpd.exec:\dddpd.exe215⤵
-
\??\c:\pdjpv.exec:\pdjpv.exe216⤵
-
\??\c:\fxrfrrl.exec:\fxrfrrl.exe217⤵
-
\??\c:\bnnhbb.exec:\bnnhbb.exe218⤵
-
\??\c:\bhbhtn.exec:\bhbhtn.exe219⤵
-
\??\c:\vjpjj.exec:\vjpjj.exe220⤵
-
\??\c:\xrxlxxr.exec:\xrxlxxr.exe221⤵
-
\??\c:\nttbhn.exec:\nttbhn.exe222⤵
-
\??\c:\vdpjd.exec:\vdpjd.exe223⤵
-
\??\c:\jvjvd.exec:\jvjvd.exe224⤵
-
\??\c:\1rrlxxr.exec:\1rrlxxr.exe225⤵
-
\??\c:\xllfxrl.exec:\xllfxrl.exe226⤵
-
\??\c:\nbhhbt.exec:\nbhhbt.exe227⤵
-
\??\c:\dvdvv.exec:\dvdvv.exe228⤵
-
\??\c:\fxflxxf.exec:\fxflxxf.exe229⤵
-
\??\c:\xffxrlf.exec:\xffxrlf.exe230⤵
-
\??\c:\thbnhn.exec:\thbnhn.exe231⤵
-
\??\c:\jjdpd.exec:\jjdpd.exe232⤵
-
\??\c:\jvddd.exec:\jvddd.exe233⤵
-
\??\c:\llfrlxx.exec:\llfrlxx.exe234⤵
-
\??\c:\xrrlxfx.exec:\xrrlxfx.exe235⤵
-
\??\c:\nntbbb.exec:\nntbbb.exe236⤵
-
\??\c:\vdppj.exec:\vdppj.exe237⤵
-
\??\c:\lxxlfrf.exec:\lxxlfrf.exe238⤵
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe239⤵
-
\??\c:\btnnhh.exec:\btnnhh.exe240⤵
-
\??\c:\pdjvj.exec:\pdjvj.exe241⤵