Analysis
-
max time kernel
149s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 11:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3f8793cc4d9c90b236b10c79209638a99a997fc243ec8e5f4d9825d721339427_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
3f8793cc4d9c90b236b10c79209638a99a997fc243ec8e5f4d9825d721339427_NeikiAnalytics.exe
-
Size
72KB
-
MD5
0ceabfd083f145e8ec4effcef1a8ca80
-
SHA1
328ddcfea411bb426508e8c3da2a44f50d1c6c15
-
SHA256
3f8793cc4d9c90b236b10c79209638a99a997fc243ec8e5f4d9825d721339427
-
SHA512
ef44dede8d7bd46fb9519c8556a5bdc4d0b2d5a2e16fb18284a4194c1ac9e4adb1bcf2b925e870564657d4c87aaf2a3fd28bf0cf281bade2c82027212c09930b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIJSsD+cGUFzJ3:ymb3NkkiQ3mdBjFIwsDhbNF
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral2/memory/3840-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/224-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1400-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1968-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4068-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2168-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3492-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1248-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3120-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1860-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4276-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/936-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3692-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3196-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2668-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2412-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3464-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/964-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2644-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1912-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1916-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vvddd.exelfrlrrf.exerllllrl.exe3nnnht.exejdpjj.exe7dvvp.exe7lfxrrr.exe1ffxllx.exenhbnbh.exenntnhb.exe5jpjv.exefrrrflx.exenttnbh.exebbtnhb.exejjppj.exejdvpj.exelfxfxxr.exehntnnh.exehntnnn.exeppdvj.exe5lxxrxr.exefxxxrrr.exetbnnnh.exe3vjjj.exe5lrlrxr.exe9hnnhh.exe9ntnnn.exe3bbbtb.exe3djvp.exexxrrxxr.exenhtbhh.exe3tbbnh.exejpjdd.exedddvp.exexfllxxf.exetbtbtt.exehhhhth.exejdvpd.exe7xxxrrr.exexrrrrlf.exenhbbbb.exe1ttnbb.exevpjdv.exedjvpj.exerlfxrrl.exe9nnhbb.exevjppj.exepjjdv.exerxrlxxr.exeflrlxfl.exehttttt.exe3ddvj.exe3lllxff.exe3tnhtt.exehhnnhn.exepjdvp.exedpdvv.exexxllrxf.exentttnn.exe5hnhbn.exevdppd.exe7flfllr.exelfxrlff.exe7nnnnn.exepid process 224 vvddd.exe 1400 lfrlrrf.exe 1968 rllllrl.exe 4068 3nnnht.exe 3492 jdpjj.exe 2168 7dvvp.exe 4424 7lfxrrr.exe 1248 1ffxllx.exe 3120 nhbnbh.exe 1860 nntnhb.exe 4276 5jpjv.exe 936 frrrflx.exe 3692 nttnbh.exe 4416 bbtnhb.exe 3196 jjppj.exe 5080 jdvpj.exe 2372 lfxfxxr.exe 2668 hntnnh.exe 2412 hntnnn.exe 3464 ppdvj.exe 964 5lxxrxr.exe 4512 fxxxrrr.exe 2644 tbnnnh.exe 2500 3vjjj.exe 1912 5lrlrxr.exe 3600 9hnnhh.exe 1744 9ntnnn.exe 2480 3bbbtb.exe 1916 3djvp.exe 4624 xxrrxxr.exe 5104 nhtbhh.exe 1828 3tbbnh.exe 1812 jpjdd.exe 3528 dddvp.exe 1772 xfllxxf.exe 3516 tbtbtt.exe 3888 hhhhth.exe 2188 jdvpd.exe 1692 7xxxrrr.exe 4652 xrrrrlf.exe 4480 nhbbbb.exe 1628 1ttnbb.exe 3540 vpjdv.exe 4904 djvpj.exe 5116 rlfxrrl.exe 3128 9nnhbb.exe 4556 vjppj.exe 4208 pjjdv.exe 3492 rxrlxxr.exe 3088 flrlxfl.exe 3324 httttt.exe 1248 3ddvj.exe 3524 3lllxff.exe 5020 3tnhtt.exe 4760 hhnnhn.exe 3396 pjdvp.exe 2684 dpdvv.exe 2996 xxllrxf.exe 3392 ntttnn.exe 1032 5hnhbn.exe 4980 vdppd.exe 4952 7flfllr.exe 420 lfxrlff.exe 3076 7nnnnn.exe -
Processes:
resource yara_rule behavioral2/memory/3840-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1400-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1968-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4068-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2168-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3492-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1248-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3120-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1860-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4276-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/936-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3692-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3196-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2668-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2412-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3464-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/964-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2644-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1912-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-189-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3f8793cc4d9c90b236b10c79209638a99a997fc243ec8e5f4d9825d721339427_NeikiAnalytics.exevvddd.exelfrlrrf.exerllllrl.exe3nnnht.exejdpjj.exe7dvvp.exe7lfxrrr.exe1ffxllx.exenhbnbh.exenntnhb.exe5jpjv.exefrrrflx.exenttnbh.exebbtnhb.exejjppj.exejdvpj.exelfxfxxr.exehntnnh.exehntnnn.exeppdvj.exe5lxxrxr.exedescription pid process target process PID 3840 wrote to memory of 224 3840 3f8793cc4d9c90b236b10c79209638a99a997fc243ec8e5f4d9825d721339427_NeikiAnalytics.exe vvddd.exe PID 3840 wrote to memory of 224 3840 3f8793cc4d9c90b236b10c79209638a99a997fc243ec8e5f4d9825d721339427_NeikiAnalytics.exe vvddd.exe PID 3840 wrote to memory of 224 3840 3f8793cc4d9c90b236b10c79209638a99a997fc243ec8e5f4d9825d721339427_NeikiAnalytics.exe vvddd.exe PID 224 wrote to memory of 1400 224 vvddd.exe lfrlrrf.exe PID 224 wrote to memory of 1400 224 vvddd.exe lfrlrrf.exe PID 224 wrote to memory of 1400 224 vvddd.exe lfrlrrf.exe PID 1400 wrote to memory of 1968 1400 lfrlrrf.exe rllllrl.exe PID 1400 wrote to memory of 1968 1400 lfrlrrf.exe rllllrl.exe PID 1400 wrote to memory of 1968 1400 lfrlrrf.exe rllllrl.exe PID 1968 wrote to memory of 4068 1968 rllllrl.exe 3nnnht.exe PID 1968 wrote to memory of 4068 1968 rllllrl.exe 3nnnht.exe PID 1968 wrote to memory of 4068 1968 rllllrl.exe 3nnnht.exe PID 4068 wrote to memory of 3492 4068 3nnnht.exe jdpjj.exe PID 4068 wrote to memory of 3492 4068 3nnnht.exe jdpjj.exe PID 4068 wrote to memory of 3492 4068 3nnnht.exe jdpjj.exe PID 3492 wrote to memory of 2168 3492 jdpjj.exe 7dvvp.exe PID 3492 wrote to memory of 2168 3492 jdpjj.exe 7dvvp.exe PID 3492 wrote to memory of 2168 3492 jdpjj.exe 7dvvp.exe PID 2168 wrote to memory of 4424 2168 7dvvp.exe 7lfxrrr.exe PID 2168 wrote to memory of 4424 2168 7dvvp.exe 7lfxrrr.exe PID 2168 wrote to memory of 4424 2168 7dvvp.exe 7lfxrrr.exe PID 4424 wrote to memory of 1248 4424 7lfxrrr.exe 1ffxllx.exe PID 4424 wrote to memory of 1248 4424 7lfxrrr.exe 1ffxllx.exe PID 4424 wrote to memory of 1248 4424 7lfxrrr.exe 1ffxllx.exe PID 1248 wrote to memory of 3120 1248 1ffxllx.exe nhbnbh.exe PID 1248 wrote to memory of 3120 1248 1ffxllx.exe nhbnbh.exe PID 1248 wrote to memory of 3120 1248 1ffxllx.exe nhbnbh.exe PID 3120 wrote to memory of 1860 3120 nhbnbh.exe nntnhb.exe PID 3120 wrote to memory of 1860 3120 nhbnbh.exe nntnhb.exe PID 3120 wrote to memory of 1860 3120 nhbnbh.exe nntnhb.exe PID 1860 wrote to memory of 4276 1860 nntnhb.exe 5jpjv.exe PID 1860 wrote to memory of 4276 1860 nntnhb.exe 5jpjv.exe PID 1860 wrote to memory of 4276 1860 nntnhb.exe 5jpjv.exe PID 4276 wrote to memory of 936 4276 5jpjv.exe frrrflx.exe PID 4276 wrote to memory of 936 4276 5jpjv.exe frrrflx.exe PID 4276 wrote to memory of 936 4276 5jpjv.exe frrrflx.exe PID 936 wrote to memory of 3692 936 frrrflx.exe nttnbh.exe PID 936 wrote to memory of 3692 936 frrrflx.exe nttnbh.exe PID 936 wrote to memory of 3692 936 frrrflx.exe nttnbh.exe PID 3692 wrote to memory of 4416 3692 nttnbh.exe bbtnhb.exe PID 3692 wrote to memory of 4416 3692 nttnbh.exe bbtnhb.exe PID 3692 wrote to memory of 4416 3692 nttnbh.exe bbtnhb.exe PID 4416 wrote to memory of 3196 4416 bbtnhb.exe jjppj.exe PID 4416 wrote to memory of 3196 4416 bbtnhb.exe jjppj.exe PID 4416 wrote to memory of 3196 4416 bbtnhb.exe jjppj.exe PID 3196 wrote to memory of 5080 3196 jjppj.exe jdvpj.exe PID 3196 wrote to memory of 5080 3196 jjppj.exe jdvpj.exe PID 3196 wrote to memory of 5080 3196 jjppj.exe jdvpj.exe PID 5080 wrote to memory of 2372 5080 jdvpj.exe lfxfxxr.exe PID 5080 wrote to memory of 2372 5080 jdvpj.exe lfxfxxr.exe PID 5080 wrote to memory of 2372 5080 jdvpj.exe lfxfxxr.exe PID 2372 wrote to memory of 2668 2372 lfxfxxr.exe hntnnh.exe PID 2372 wrote to memory of 2668 2372 lfxfxxr.exe hntnnh.exe PID 2372 wrote to memory of 2668 2372 lfxfxxr.exe hntnnh.exe PID 2668 wrote to memory of 2412 2668 hntnnh.exe hntnnn.exe PID 2668 wrote to memory of 2412 2668 hntnnh.exe hntnnn.exe PID 2668 wrote to memory of 2412 2668 hntnnh.exe hntnnn.exe PID 2412 wrote to memory of 3464 2412 hntnnn.exe ppdvj.exe PID 2412 wrote to memory of 3464 2412 hntnnn.exe ppdvj.exe PID 2412 wrote to memory of 3464 2412 hntnnn.exe ppdvj.exe PID 3464 wrote to memory of 964 3464 ppdvj.exe 5lxxrxr.exe PID 3464 wrote to memory of 964 3464 ppdvj.exe 5lxxrxr.exe PID 3464 wrote to memory of 964 3464 ppdvj.exe 5lxxrxr.exe PID 964 wrote to memory of 4512 964 5lxxrxr.exe fxxxrrr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f8793cc4d9c90b236b10c79209638a99a997fc243ec8e5f4d9825d721339427_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3f8793cc4d9c90b236b10c79209638a99a997fc243ec8e5f4d9825d721339427_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\vvddd.exec:\vvddd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfrlrrf.exec:\lfrlrrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rllllrl.exec:\rllllrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3nnnht.exec:\3nnnht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdpjj.exec:\jdpjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7dvvp.exec:\7dvvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7lfxrrr.exec:\7lfxrrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1ffxllx.exec:\1ffxllx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhbnbh.exec:\nhbnbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nntnhb.exec:\nntnhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5jpjv.exec:\5jpjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frrrflx.exec:\frrrflx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nttnbh.exec:\nttnbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbtnhb.exec:\bbtnhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjppj.exec:\jjppj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdvpj.exec:\jdvpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfxfxxr.exec:\lfxfxxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hntnnh.exec:\hntnnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hntnnn.exec:\hntnnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ppdvj.exec:\ppdvj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5lxxrxr.exec:\5lxxrxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe23⤵
- Executes dropped EXE
-
\??\c:\tbnnnh.exec:\tbnnnh.exe24⤵
- Executes dropped EXE
-
\??\c:\3vjjj.exec:\3vjjj.exe25⤵
- Executes dropped EXE
-
\??\c:\5lrlrxr.exec:\5lrlrxr.exe26⤵
- Executes dropped EXE
-
\??\c:\9hnnhh.exec:\9hnnhh.exe27⤵
- Executes dropped EXE
-
\??\c:\9ntnnn.exec:\9ntnnn.exe28⤵
- Executes dropped EXE
-
\??\c:\3bbbtb.exec:\3bbbtb.exe29⤵
- Executes dropped EXE
-
\??\c:\3djvp.exec:\3djvp.exe30⤵
- Executes dropped EXE
-
\??\c:\xxrrxxr.exec:\xxrrxxr.exe31⤵
- Executes dropped EXE
-
\??\c:\nhtbhh.exec:\nhtbhh.exe32⤵
- Executes dropped EXE
-
\??\c:\3tbbnh.exec:\3tbbnh.exe33⤵
- Executes dropped EXE
-
\??\c:\jpjdd.exec:\jpjdd.exe34⤵
- Executes dropped EXE
-
\??\c:\dddvp.exec:\dddvp.exe35⤵
- Executes dropped EXE
-
\??\c:\xfllxxf.exec:\xfllxxf.exe36⤵
- Executes dropped EXE
-
\??\c:\tbtbtt.exec:\tbtbtt.exe37⤵
- Executes dropped EXE
-
\??\c:\hhhhth.exec:\hhhhth.exe38⤵
- Executes dropped EXE
-
\??\c:\jdvpd.exec:\jdvpd.exe39⤵
- Executes dropped EXE
-
\??\c:\7xxxrrr.exec:\7xxxrrr.exe40⤵
- Executes dropped EXE
-
\??\c:\xrrrrlf.exec:\xrrrrlf.exe41⤵
- Executes dropped EXE
-
\??\c:\nhbbbb.exec:\nhbbbb.exe42⤵
- Executes dropped EXE
-
\??\c:\1ttnbb.exec:\1ttnbb.exe43⤵
- Executes dropped EXE
-
\??\c:\vpjdv.exec:\vpjdv.exe44⤵
- Executes dropped EXE
-
\??\c:\djvpj.exec:\djvpj.exe45⤵
- Executes dropped EXE
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe46⤵
- Executes dropped EXE
-
\??\c:\9nnhbb.exec:\9nnhbb.exe47⤵
- Executes dropped EXE
-
\??\c:\vjppj.exec:\vjppj.exe48⤵
- Executes dropped EXE
-
\??\c:\pjjdv.exec:\pjjdv.exe49⤵
- Executes dropped EXE
-
\??\c:\rxrlxxr.exec:\rxrlxxr.exe50⤵
- Executes dropped EXE
-
\??\c:\flrlxfl.exec:\flrlxfl.exe51⤵
- Executes dropped EXE
-
\??\c:\httttt.exec:\httttt.exe52⤵
- Executes dropped EXE
-
\??\c:\3ddvj.exec:\3ddvj.exe53⤵
- Executes dropped EXE
-
\??\c:\3lllxff.exec:\3lllxff.exe54⤵
- Executes dropped EXE
-
\??\c:\3tnhtt.exec:\3tnhtt.exe55⤵
- Executes dropped EXE
-
\??\c:\hhnnhn.exec:\hhnnhn.exe56⤵
- Executes dropped EXE
-
\??\c:\pjdvp.exec:\pjdvp.exe57⤵
- Executes dropped EXE
-
\??\c:\dpdvv.exec:\dpdvv.exe58⤵
- Executes dropped EXE
-
\??\c:\xxllrxf.exec:\xxllrxf.exe59⤵
- Executes dropped EXE
-
\??\c:\ntttnn.exec:\ntttnn.exe60⤵
- Executes dropped EXE
-
\??\c:\5hnhbn.exec:\5hnhbn.exe61⤵
- Executes dropped EXE
-
\??\c:\vdppd.exec:\vdppd.exe62⤵
- Executes dropped EXE
-
\??\c:\7flfllr.exec:\7flfllr.exe63⤵
- Executes dropped EXE
-
\??\c:\lfxrlff.exec:\lfxrlff.exe64⤵
- Executes dropped EXE
-
\??\c:\7nnnnn.exec:\7nnnnn.exe65⤵
- Executes dropped EXE
-
\??\c:\tthntt.exec:\tthntt.exe66⤵
-
\??\c:\jdvpj.exec:\jdvpj.exe67⤵
-
\??\c:\djpvv.exec:\djpvv.exe68⤵
-
\??\c:\xrxrxxf.exec:\xrxrxxf.exe69⤵
-
\??\c:\fxxrllf.exec:\fxxrllf.exe70⤵
-
\??\c:\tnhbtb.exec:\tnhbtb.exe71⤵
-
\??\c:\9nnnnn.exec:\9nnnnn.exe72⤵
-
\??\c:\dvdvp.exec:\dvdvp.exe73⤵
-
\??\c:\fxrlxxr.exec:\fxrlxxr.exe74⤵
-
\??\c:\1lrrlff.exec:\1lrrlff.exe75⤵
-
\??\c:\5hnttt.exec:\5hnttt.exe76⤵
-
\??\c:\vppjd.exec:\vppjd.exe77⤵
-
\??\c:\7jpjd.exec:\7jpjd.exe78⤵
-
\??\c:\fxfrlrl.exec:\fxfrlrl.exe79⤵
-
\??\c:\thhhbb.exec:\thhhbb.exe80⤵
-
\??\c:\vddvp.exec:\vddvp.exe81⤵
-
\??\c:\dvvpp.exec:\dvvpp.exe82⤵
-
\??\c:\3xllrrx.exec:\3xllrrx.exe83⤵
-
\??\c:\lffffff.exec:\lffffff.exe84⤵
-
\??\c:\hnbhhb.exec:\hnbhhb.exe85⤵
-
\??\c:\thbnbt.exec:\thbnbt.exe86⤵
-
\??\c:\vvvvv.exec:\vvvvv.exe87⤵
-
\??\c:\pvdvp.exec:\pvdvp.exe88⤵
-
\??\c:\thtttn.exec:\thtttn.exe89⤵
-
\??\c:\bttnbt.exec:\bttnbt.exe90⤵
-
\??\c:\7jvpv.exec:\7jvpv.exe91⤵
-
\??\c:\5xfxrfx.exec:\5xfxrfx.exe92⤵
-
\??\c:\htthbt.exec:\htthbt.exe93⤵
-
\??\c:\9nttnn.exec:\9nttnn.exe94⤵
-
\??\c:\5jjdp.exec:\5jjdp.exe95⤵
-
\??\c:\vdjjv.exec:\vdjjv.exe96⤵
-
\??\c:\rrxlrlx.exec:\rrxlrlx.exe97⤵
-
\??\c:\5llffxr.exec:\5llffxr.exe98⤵
-
\??\c:\tnnnbb.exec:\tnnnbb.exe99⤵
-
\??\c:\pjjvp.exec:\pjjvp.exe100⤵
-
\??\c:\jvjjd.exec:\jvjjd.exe101⤵
-
\??\c:\fxlfffr.exec:\fxlfffr.exe102⤵
-
\??\c:\rlxxrrl.exec:\rlxxrrl.exe103⤵
-
\??\c:\hhbtnn.exec:\hhbtnn.exe104⤵
-
\??\c:\jvdvv.exec:\jvdvv.exe105⤵
-
\??\c:\fxrlllr.exec:\fxrlllr.exe106⤵
-
\??\c:\xlrrlll.exec:\xlrrlll.exe107⤵
-
\??\c:\7hnnhb.exec:\7hnnhb.exe108⤵
-
\??\c:\pvvpp.exec:\pvvpp.exe109⤵
-
\??\c:\lffxxrr.exec:\lffxxrr.exe110⤵
-
\??\c:\hnnnnh.exec:\hnnnnh.exe111⤵
-
\??\c:\bnnhbb.exec:\bnnhbb.exe112⤵
-
\??\c:\vpvpj.exec:\vpvpj.exe113⤵
-
\??\c:\ppdvp.exec:\ppdvp.exe114⤵
-
\??\c:\fllfxxx.exec:\fllfxxx.exe115⤵
-
\??\c:\9xxxxrr.exec:\9xxxxrr.exe116⤵
-
\??\c:\nttnhh.exec:\nttnhh.exe117⤵
-
\??\c:\hbtntt.exec:\hbtntt.exe118⤵
-
\??\c:\dvvvj.exec:\dvvvj.exe119⤵
-
\??\c:\ffrrllf.exec:\ffrrllf.exe120⤵
-
\??\c:\7rrrlrr.exec:\7rrrlrr.exe121⤵
-
\??\c:\bbttnn.exec:\bbttnn.exe122⤵
-
\??\c:\dddvv.exec:\dddvv.exe123⤵
-
\??\c:\dvvvp.exec:\dvvvp.exe124⤵
-
\??\c:\lllfxxr.exec:\lllfxxr.exe125⤵
-
\??\c:\tbttnn.exec:\tbttnn.exe126⤵
-
\??\c:\3nhbtt.exec:\3nhbtt.exe127⤵
-
\??\c:\pvvpj.exec:\pvvpj.exe128⤵
-
\??\c:\7xfxllf.exec:\7xfxllf.exe129⤵
-
\??\c:\hbbtnn.exec:\hbbtnn.exe130⤵
-
\??\c:\tbbthh.exec:\tbbthh.exe131⤵
-
\??\c:\dvvpj.exec:\dvvpj.exe132⤵
-
\??\c:\9ffxrfl.exec:\9ffxrfl.exe133⤵
-
\??\c:\bthhbb.exec:\bthhbb.exe134⤵
-
\??\c:\pdjpj.exec:\pdjpj.exe135⤵
-
\??\c:\pddvp.exec:\pddvp.exe136⤵
-
\??\c:\flffflf.exec:\flffflf.exe137⤵
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe138⤵
-
\??\c:\tbbtnn.exec:\tbbtnn.exe139⤵
-
\??\c:\tnhbtt.exec:\tnhbtt.exe140⤵
-
\??\c:\jvpjv.exec:\jvpjv.exe141⤵
-
\??\c:\ppjdj.exec:\ppjdj.exe142⤵
-
\??\c:\rffxlrl.exec:\rffxlrl.exe143⤵
-
\??\c:\bbtnnh.exec:\bbtnnh.exe144⤵
-
\??\c:\dvjdd.exec:\dvjdd.exe145⤵
-
\??\c:\lflffff.exec:\lflffff.exe146⤵
-
\??\c:\llxrrrr.exec:\llxrrrr.exe147⤵
-
\??\c:\ppjjd.exec:\ppjjd.exe148⤵
-
\??\c:\pjjdp.exec:\pjjdp.exe149⤵
-
\??\c:\frrrfrr.exec:\frrrfrr.exe150⤵
-
\??\c:\nhttbb.exec:\nhttbb.exe151⤵
-
\??\c:\ppvvv.exec:\ppvvv.exe152⤵
-
\??\c:\jvvdp.exec:\jvvdp.exe153⤵
-
\??\c:\rlllfff.exec:\rlllfff.exe154⤵
-
\??\c:\thtbbh.exec:\thtbbh.exe155⤵
-
\??\c:\bthhbn.exec:\bthhbn.exe156⤵
-
\??\c:\7jpjd.exec:\7jpjd.exe157⤵
-
\??\c:\5lrfxrl.exec:\5lrfxrl.exe158⤵
-
\??\c:\3pdvj.exec:\3pdvj.exe159⤵
-
\??\c:\3rrrfff.exec:\3rrrfff.exe160⤵
-
\??\c:\hhbntt.exec:\hhbntt.exe161⤵
-
\??\c:\5thbbb.exec:\5thbbb.exe162⤵
-
\??\c:\dvvvj.exec:\dvvvj.exe163⤵
-
\??\c:\xrxrlrf.exec:\xrxrlrf.exe164⤵
-
\??\c:\flxrrff.exec:\flxrrff.exe165⤵
-
\??\c:\5ntbhb.exec:\5ntbhb.exe166⤵
-
\??\c:\vpvvp.exec:\vpvvp.exe167⤵
-
\??\c:\fxxrrrr.exec:\fxxrrrr.exe168⤵
-
\??\c:\ttbbhn.exec:\ttbbhn.exe169⤵
-
\??\c:\jpvvd.exec:\jpvvd.exe170⤵
-
\??\c:\9vjdv.exec:\9vjdv.exe171⤵
-
\??\c:\rrxxlrr.exec:\rrxxlrr.exe172⤵
-
\??\c:\1rlllll.exec:\1rlllll.exe173⤵
-
\??\c:\ttbbnn.exec:\ttbbnn.exe174⤵
-
\??\c:\jddvp.exec:\jddvp.exe175⤵
-
\??\c:\ffllllx.exec:\ffllllx.exe176⤵
-
\??\c:\ffrllll.exec:\ffrllll.exe177⤵
-
\??\c:\thbtbb.exec:\thbtbb.exe178⤵
-
\??\c:\9bbbtb.exec:\9bbbtb.exe179⤵
-
\??\c:\vpjdv.exec:\vpjdv.exe180⤵
-
\??\c:\lfxfxxr.exec:\lfxfxxr.exe181⤵
-
\??\c:\fffflrx.exec:\fffflrx.exe182⤵
-
\??\c:\7bbttb.exec:\7bbttb.exe183⤵
-
\??\c:\httbnt.exec:\httbnt.exe184⤵
-
\??\c:\5jpjj.exec:\5jpjj.exe185⤵
-
\??\c:\lfllllf.exec:\lfllllf.exe186⤵
-
\??\c:\lrlllll.exec:\lrlllll.exe187⤵
-
\??\c:\bnnhbb.exec:\bnnhbb.exe188⤵
-
\??\c:\bbhbth.exec:\bbhbth.exe189⤵
-
\??\c:\vppjd.exec:\vppjd.exe190⤵
-
\??\c:\rllxlll.exec:\rllxlll.exe191⤵
-
\??\c:\xxfflrx.exec:\xxfflrx.exe192⤵
-
\??\c:\tnbtnt.exec:\tnbtnt.exe193⤵
-
\??\c:\3vdvd.exec:\3vdvd.exe194⤵
-
\??\c:\pvvpj.exec:\pvvpj.exe195⤵
-
\??\c:\llxxxfl.exec:\llxxxfl.exe196⤵
-
\??\c:\tnnhnn.exec:\tnnhnn.exe197⤵
-
\??\c:\bbbtnt.exec:\bbbtnt.exe198⤵
-
\??\c:\vvdvj.exec:\vvdvj.exe199⤵
-
\??\c:\rrxrlxx.exec:\rrxrlxx.exe200⤵
-
\??\c:\frrxxxr.exec:\frrxxxr.exe201⤵
-
\??\c:\3rllxxr.exec:\3rllxxr.exe202⤵
-
\??\c:\nnttnt.exec:\nnttnt.exe203⤵
-
\??\c:\httnhh.exec:\httnhh.exe204⤵
-
\??\c:\pjpjj.exec:\pjpjj.exe205⤵
-
\??\c:\fxrlxfx.exec:\fxrlxfx.exe206⤵
-
\??\c:\5lfxrrl.exec:\5lfxrrl.exe207⤵
-
\??\c:\nnttnn.exec:\nnttnn.exe208⤵
-
\??\c:\bbhbtt.exec:\bbhbtt.exe209⤵
-
\??\c:\pvjjd.exec:\pvjjd.exe210⤵
-
\??\c:\lffxxlr.exec:\lffxxlr.exe211⤵
-
\??\c:\rlrlffx.exec:\rlrlffx.exe212⤵
-
\??\c:\7fflrrl.exec:\7fflrrl.exe213⤵
-
\??\c:\nhhtnb.exec:\nhhtnb.exe214⤵
-
\??\c:\pppjj.exec:\pppjj.exe215⤵
-
\??\c:\pdvvv.exec:\pdvvv.exe216⤵
-
\??\c:\rrllfff.exec:\rrllfff.exe217⤵
-
\??\c:\7xflrff.exec:\7xflrff.exe218⤵
-
\??\c:\bnbbbb.exec:\bnbbbb.exe219⤵
-
\??\c:\7hnhnh.exec:\7hnhnh.exe220⤵
-
\??\c:\jjdpd.exec:\jjdpd.exe221⤵
-
\??\c:\pdjpj.exec:\pdjpj.exe222⤵
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe223⤵
-
\??\c:\rllfffx.exec:\rllfffx.exe224⤵
-
\??\c:\9tbhbb.exec:\9tbhbb.exe225⤵
-
\??\c:\7bhbtt.exec:\7bhbtt.exe226⤵
-
\??\c:\ddvpd.exec:\ddvpd.exe227⤵
-
\??\c:\lrffxfx.exec:\lrffxfx.exe228⤵
-
\??\c:\lrfxrxr.exec:\lrfxrxr.exe229⤵
-
\??\c:\7nbbbb.exec:\7nbbbb.exe230⤵
-
\??\c:\7ttbnb.exec:\7ttbnb.exe231⤵
-
\??\c:\vppjj.exec:\vppjj.exe232⤵
-
\??\c:\fllfrrr.exec:\fllfrrr.exe233⤵
-
\??\c:\lxxxxxx.exec:\lxxxxxx.exe234⤵
-
\??\c:\hbnhbb.exec:\hbnhbb.exe235⤵
-
\??\c:\bhtttt.exec:\bhtttt.exe236⤵
-
\??\c:\vvpjd.exec:\vvpjd.exe237⤵
-
\??\c:\jpjjj.exec:\jpjjj.exe238⤵
-
\??\c:\1rlfxxr.exec:\1rlfxxr.exe239⤵
-
\??\c:\fllfxxf.exec:\fllfxxf.exe240⤵
-
\??\c:\9bntbb.exec:\9bntbb.exe241⤵