Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 19:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
037cbcbc174c6497326229b1dcec4c00_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
037cbcbc174c6497326229b1dcec4c00_NeikiAnalytics.exe
-
Size
55KB
-
MD5
037cbcbc174c6497326229b1dcec4c00
-
SHA1
267b94d48f671a1fa5a9d5f3851c9699964a584c
-
SHA256
9dd42d7142a324afb7d8df6fd3deaac9688cc96ea0cd10d7e325aa08970de53d
-
SHA512
e4cf5f4ec8fce3b380359e971ab2057dfe0a7a0adfd9ddac06ab029d94aef3a3753e74a5f1ee4bf735f80347a865e1178b744d77bbac53d9222456e8e9c77d0c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFk:ymb3NkkiQ3mdBjFIFk
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/2748-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2164-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1852-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4280-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3644-52-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1260-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2148-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2760-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3436-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3536-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3380-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1340-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3904-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4328-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3696-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4260-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2368-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3644-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4280-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3412-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1788-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pdpdj.exedvpjd.exelrffxxx.exehbbbhn.exehhnbtt.exepjpjj.exejppjj.exellllfff.exe3lxrlxr.exebnnnnn.exebbthbt.exe7jjdp.exe9pvpp.exe3ffxlll.exe7xxxxff.exethttbh.exebbbbtb.exejjppv.exepjvpj.exerfxrxxl.exelxrlfxr.exebhbtnh.exennhhtb.exe5dvpd.exelflrflf.exefrxrlll.exehhnhhh.exe9tnhhb.exetbhhth.exejdddv.exerxxlrfl.exerlrflll.exebbthhn.exenbbhtb.exepdjjd.exevjppj.exelxxxxff.exefrrlxrl.exebnnhbb.exehtntnb.exedppjd.exedvvpj.exeflfrlll.exexrlrflf.exelrrfxlx.exe9hnnnt.exebtbttn.exeddvpj.exexflxrlf.exerrrrlrl.exehhnhhb.exe1ppjj.exejddvj.exexxllfrl.exetntbth.exenhhhbb.exe5vddd.exevjpdv.exexllrlrl.exefrrlfxx.exehbhbnh.exe5djdv.exexxfrfxr.exehbbbbt.exepid process 2164 pdpdj.exe 1852 dvpjd.exe 1788 lrffxxx.exe 3412 hbbbhn.exe 4280 hhnbtt.exe 3644 pjpjj.exe 2368 jppjj.exe 1036 llllfff.exe 4996 3lxrlxr.exe 4260 bnnnnn.exe 220 bbthbt.exe 116 7jjdp.exe 4572 9pvpp.exe 1260 3ffxlll.exe 2148 7xxxxff.exe 3696 thttbh.exe 4732 bbbbtb.exe 4328 jjppv.exe 2760 pjvpj.exe 3460 rfxrxxl.exe 4960 lxrlfxr.exe 4560 bhbtnh.exe 4692 nnhhtb.exe 3904 5dvpd.exe 1340 lflrflf.exe 1964 frxrlll.exe 1324 hhnhhh.exe 3436 9tnhhb.exe 3536 tbhhth.exe 3380 jdddv.exe 3996 rxxlrfl.exe 3616 rlrflll.exe 4892 bbthhn.exe 4164 nbbhtb.exe 2172 pdjjd.exe 1700 vjppj.exe 4896 lxxxxff.exe 540 frrlxrl.exe 3040 bnnhbb.exe 736 htntnb.exe 2668 dppjd.exe 5044 dvvpj.exe 4232 flfrlll.exe 5096 xrlrflf.exe 2276 lrrfxlx.exe 392 9hnnnt.exe 2244 btbttn.exe 1416 ddvpj.exe 1196 xflxrlf.exe 2180 rrrrlrl.exe 4356 hhnhhb.exe 4728 1ppjj.exe 2464 jddvj.exe 4284 xxllfrl.exe 996 tntbth.exe 2224 nhhhbb.exe 3608 5vddd.exe 3836 vjpdv.exe 4276 xllrlrl.exe 3388 frrlfxx.exe 660 hbhbnh.exe 4912 5djdv.exe 3060 xxfrfxr.exe 1876 hbbbbt.exe -
Processes:
resource yara_rule behavioral2/memory/2748-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2164-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1852-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1788-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1788-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4280-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1260-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2760-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3436-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3536-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1340-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3904-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4328-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4260-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3644-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4280-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3412-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1788-32-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
037cbcbc174c6497326229b1dcec4c00_NeikiAnalytics.exepdpdj.exedvpjd.exelrffxxx.exehbbbhn.exehhnbtt.exepjpjj.exejppjj.exellllfff.exe3lxrlxr.exebnnnnn.exebbthbt.exe7jjdp.exe9pvpp.exe3ffxlll.exe7xxxxff.exethttbh.exebbbbtb.exejjppv.exepjvpj.exerfxrxxl.exelxrlfxr.exedescription pid process target process PID 2748 wrote to memory of 2164 2748 037cbcbc174c6497326229b1dcec4c00_NeikiAnalytics.exe pdpdj.exe PID 2748 wrote to memory of 2164 2748 037cbcbc174c6497326229b1dcec4c00_NeikiAnalytics.exe pdpdj.exe PID 2748 wrote to memory of 2164 2748 037cbcbc174c6497326229b1dcec4c00_NeikiAnalytics.exe pdpdj.exe PID 2164 wrote to memory of 1852 2164 pdpdj.exe dvpjd.exe PID 2164 wrote to memory of 1852 2164 pdpdj.exe dvpjd.exe PID 2164 wrote to memory of 1852 2164 pdpdj.exe dvpjd.exe PID 1852 wrote to memory of 1788 1852 dvpjd.exe lrffxxx.exe PID 1852 wrote to memory of 1788 1852 dvpjd.exe lrffxxx.exe PID 1852 wrote to memory of 1788 1852 dvpjd.exe lrffxxx.exe PID 1788 wrote to memory of 3412 1788 lrffxxx.exe hbbbhn.exe PID 1788 wrote to memory of 3412 1788 lrffxxx.exe hbbbhn.exe PID 1788 wrote to memory of 3412 1788 lrffxxx.exe hbbbhn.exe PID 3412 wrote to memory of 4280 3412 hbbbhn.exe hhnbtt.exe PID 3412 wrote to memory of 4280 3412 hbbbhn.exe hhnbtt.exe PID 3412 wrote to memory of 4280 3412 hbbbhn.exe hhnbtt.exe PID 4280 wrote to memory of 3644 4280 hhnbtt.exe pjpjj.exe PID 4280 wrote to memory of 3644 4280 hhnbtt.exe pjpjj.exe PID 4280 wrote to memory of 3644 4280 hhnbtt.exe pjpjj.exe PID 3644 wrote to memory of 2368 3644 pjpjj.exe jppjj.exe PID 3644 wrote to memory of 2368 3644 pjpjj.exe jppjj.exe PID 3644 wrote to memory of 2368 3644 pjpjj.exe jppjj.exe PID 2368 wrote to memory of 1036 2368 jppjj.exe llllfff.exe PID 2368 wrote to memory of 1036 2368 jppjj.exe llllfff.exe PID 2368 wrote to memory of 1036 2368 jppjj.exe llllfff.exe PID 1036 wrote to memory of 4996 1036 llllfff.exe 3lxrlxr.exe PID 1036 wrote to memory of 4996 1036 llllfff.exe 3lxrlxr.exe PID 1036 wrote to memory of 4996 1036 llllfff.exe 3lxrlxr.exe PID 4996 wrote to memory of 4260 4996 3lxrlxr.exe bnnnnn.exe PID 4996 wrote to memory of 4260 4996 3lxrlxr.exe bnnnnn.exe PID 4996 wrote to memory of 4260 4996 3lxrlxr.exe bnnnnn.exe PID 4260 wrote to memory of 220 4260 bnnnnn.exe bbthbt.exe PID 4260 wrote to memory of 220 4260 bnnnnn.exe bbthbt.exe PID 4260 wrote to memory of 220 4260 bnnnnn.exe bbthbt.exe PID 220 wrote to memory of 116 220 bbthbt.exe 7jjdp.exe PID 220 wrote to memory of 116 220 bbthbt.exe 7jjdp.exe PID 220 wrote to memory of 116 220 bbthbt.exe 7jjdp.exe PID 116 wrote to memory of 4572 116 7jjdp.exe 9pvpp.exe PID 116 wrote to memory of 4572 116 7jjdp.exe 9pvpp.exe PID 116 wrote to memory of 4572 116 7jjdp.exe 9pvpp.exe PID 4572 wrote to memory of 1260 4572 9pvpp.exe 3ffxlll.exe PID 4572 wrote to memory of 1260 4572 9pvpp.exe 3ffxlll.exe PID 4572 wrote to memory of 1260 4572 9pvpp.exe 3ffxlll.exe PID 1260 wrote to memory of 2148 1260 3ffxlll.exe 7xxxxff.exe PID 1260 wrote to memory of 2148 1260 3ffxlll.exe 7xxxxff.exe PID 1260 wrote to memory of 2148 1260 3ffxlll.exe 7xxxxff.exe PID 2148 wrote to memory of 3696 2148 7xxxxff.exe thttbh.exe PID 2148 wrote to memory of 3696 2148 7xxxxff.exe thttbh.exe PID 2148 wrote to memory of 3696 2148 7xxxxff.exe thttbh.exe PID 3696 wrote to memory of 4732 3696 thttbh.exe bbbbtb.exe PID 3696 wrote to memory of 4732 3696 thttbh.exe bbbbtb.exe PID 3696 wrote to memory of 4732 3696 thttbh.exe bbbbtb.exe PID 4732 wrote to memory of 4328 4732 bbbbtb.exe jjppv.exe PID 4732 wrote to memory of 4328 4732 bbbbtb.exe jjppv.exe PID 4732 wrote to memory of 4328 4732 bbbbtb.exe jjppv.exe PID 4328 wrote to memory of 2760 4328 jjppv.exe pjvpj.exe PID 4328 wrote to memory of 2760 4328 jjppv.exe pjvpj.exe PID 4328 wrote to memory of 2760 4328 jjppv.exe pjvpj.exe PID 2760 wrote to memory of 3460 2760 pjvpj.exe rfxrxxl.exe PID 2760 wrote to memory of 3460 2760 pjvpj.exe rfxrxxl.exe PID 2760 wrote to memory of 3460 2760 pjvpj.exe rfxrxxl.exe PID 3460 wrote to memory of 4960 3460 rfxrxxl.exe lxrlfxr.exe PID 3460 wrote to memory of 4960 3460 rfxrxxl.exe lxrlfxr.exe PID 3460 wrote to memory of 4960 3460 rfxrxxl.exe lxrlfxr.exe PID 4960 wrote to memory of 4560 4960 lxrlfxr.exe bhbtnh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\037cbcbc174c6497326229b1dcec4c00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\037cbcbc174c6497326229b1dcec4c00_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\pdpdj.exec:\pdpdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvpjd.exec:\dvpjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrffxxx.exec:\lrffxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbbbhn.exec:\hbbbhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhnbtt.exec:\hhnbtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjpjj.exec:\pjpjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jppjj.exec:\jppjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llllfff.exec:\llllfff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3lxrlxr.exec:\3lxrlxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnnnnn.exec:\bnnnnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbthbt.exec:\bbthbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7jjdp.exec:\7jjdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9pvpp.exec:\9pvpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3ffxlll.exec:\3ffxlll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7xxxxff.exec:\7xxxxff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thttbh.exec:\thttbh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbbbtb.exec:\bbbbtb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjppv.exec:\jjppv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjvpj.exec:\pjvpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rfxrxxl.exec:\rfxrxxl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxrlfxr.exec:\lxrlfxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhbtnh.exec:\bhbtnh.exe23⤵
- Executes dropped EXE
-
\??\c:\nnhhtb.exec:\nnhhtb.exe24⤵
- Executes dropped EXE
-
\??\c:\5dvpd.exec:\5dvpd.exe25⤵
- Executes dropped EXE
-
\??\c:\lflrflf.exec:\lflrflf.exe26⤵
- Executes dropped EXE
-
\??\c:\frxrlll.exec:\frxrlll.exe27⤵
- Executes dropped EXE
-
\??\c:\hhnhhh.exec:\hhnhhh.exe28⤵
- Executes dropped EXE
-
\??\c:\9tnhhb.exec:\9tnhhb.exe29⤵
- Executes dropped EXE
-
\??\c:\tbhhth.exec:\tbhhth.exe30⤵
- Executes dropped EXE
-
\??\c:\jdddv.exec:\jdddv.exe31⤵
- Executes dropped EXE
-
\??\c:\rxxlrfl.exec:\rxxlrfl.exe32⤵
- Executes dropped EXE
-
\??\c:\rlrflll.exec:\rlrflll.exe33⤵
- Executes dropped EXE
-
\??\c:\bbthhn.exec:\bbthhn.exe34⤵
- Executes dropped EXE
-
\??\c:\nbbhtb.exec:\nbbhtb.exe35⤵
- Executes dropped EXE
-
\??\c:\pdjjd.exec:\pdjjd.exe36⤵
- Executes dropped EXE
-
\??\c:\vjppj.exec:\vjppj.exe37⤵
- Executes dropped EXE
-
\??\c:\lxxxxff.exec:\lxxxxff.exe38⤵
- Executes dropped EXE
-
\??\c:\frrlxrl.exec:\frrlxrl.exe39⤵
- Executes dropped EXE
-
\??\c:\bnnhbb.exec:\bnnhbb.exe40⤵
- Executes dropped EXE
-
\??\c:\htntnb.exec:\htntnb.exe41⤵
- Executes dropped EXE
-
\??\c:\dppjd.exec:\dppjd.exe42⤵
- Executes dropped EXE
-
\??\c:\dvvpj.exec:\dvvpj.exe43⤵
- Executes dropped EXE
-
\??\c:\flfrlll.exec:\flfrlll.exe44⤵
- Executes dropped EXE
-
\??\c:\xrlrflf.exec:\xrlrflf.exe45⤵
- Executes dropped EXE
-
\??\c:\lrrfxlx.exec:\lrrfxlx.exe46⤵
- Executes dropped EXE
-
\??\c:\9hnnnt.exec:\9hnnnt.exe47⤵
- Executes dropped EXE
-
\??\c:\btbttn.exec:\btbttn.exe48⤵
- Executes dropped EXE
-
\??\c:\ddvpj.exec:\ddvpj.exe49⤵
- Executes dropped EXE
-
\??\c:\xflxrlf.exec:\xflxrlf.exe50⤵
- Executes dropped EXE
-
\??\c:\rrrrlrl.exec:\rrrrlrl.exe51⤵
- Executes dropped EXE
-
\??\c:\hhnhhb.exec:\hhnhhb.exe52⤵
- Executes dropped EXE
-
\??\c:\1ppjj.exec:\1ppjj.exe53⤵
- Executes dropped EXE
-
\??\c:\jddvj.exec:\jddvj.exe54⤵
- Executes dropped EXE
-
\??\c:\xxllfrl.exec:\xxllfrl.exe55⤵
- Executes dropped EXE
-
\??\c:\tntbth.exec:\tntbth.exe56⤵
- Executes dropped EXE
-
\??\c:\nhhhbb.exec:\nhhhbb.exe57⤵
- Executes dropped EXE
-
\??\c:\5vddd.exec:\5vddd.exe58⤵
- Executes dropped EXE
-
\??\c:\vjpdv.exec:\vjpdv.exe59⤵
- Executes dropped EXE
-
\??\c:\xllrlrl.exec:\xllrlrl.exe60⤵
- Executes dropped EXE
-
\??\c:\frrlfxx.exec:\frrlfxx.exe61⤵
- Executes dropped EXE
-
\??\c:\hbhbnh.exec:\hbhbnh.exe62⤵
- Executes dropped EXE
-
\??\c:\5djdv.exec:\5djdv.exe63⤵
- Executes dropped EXE
-
\??\c:\xxfrfxr.exec:\xxfrfxr.exe64⤵
- Executes dropped EXE
-
\??\c:\hbbbbt.exec:\hbbbbt.exe65⤵
- Executes dropped EXE
-
\??\c:\btnbnt.exec:\btnbnt.exe66⤵
-
\??\c:\7jvpv.exec:\7jvpv.exe67⤵
-
\??\c:\pjjvp.exec:\pjjvp.exe68⤵
-
\??\c:\rllffff.exec:\rllffff.exe69⤵
-
\??\c:\flrlfxr.exec:\flrlfxr.exe70⤵
-
\??\c:\tthhbb.exec:\tthhbb.exe71⤵
-
\??\c:\jjppd.exec:\jjppd.exe72⤵
-
\??\c:\dvpdp.exec:\dvpdp.exe73⤵
-
\??\c:\fffxfff.exec:\fffxfff.exe74⤵
-
\??\c:\rxxxlll.exec:\rxxxlll.exe75⤵
-
\??\c:\tthnbb.exec:\tthnbb.exe76⤵
-
\??\c:\dddvj.exec:\dddvj.exe77⤵
-
\??\c:\1vvpd.exec:\1vvpd.exe78⤵
-
\??\c:\lrrlxrl.exec:\lrrlxrl.exe79⤵
-
\??\c:\rrxlfxl.exec:\rrxlfxl.exe80⤵
-
\??\c:\thbhtn.exec:\thbhtn.exe81⤵
-
\??\c:\tbbtnn.exec:\tbbtnn.exe82⤵
-
\??\c:\dpjdp.exec:\dpjdp.exe83⤵
-
\??\c:\pvpdv.exec:\pvpdv.exe84⤵
-
\??\c:\1xrffxf.exec:\1xrffxf.exe85⤵
-
\??\c:\btnnbt.exec:\btnnbt.exe86⤵
-
\??\c:\7bbnbt.exec:\7bbnbt.exe87⤵
-
\??\c:\jjjvj.exec:\jjjvj.exe88⤵
-
\??\c:\5vpvj.exec:\5vpvj.exe89⤵
-
\??\c:\rflxlfx.exec:\rflxlfx.exe90⤵
-
\??\c:\ntnthb.exec:\ntnthb.exe91⤵
-
\??\c:\7pjvd.exec:\7pjvd.exe92⤵
-
\??\c:\pdvpd.exec:\pdvpd.exe93⤵
-
\??\c:\pddpj.exec:\pddpj.exe94⤵
-
\??\c:\lrlxlfx.exec:\lrlxlfx.exe95⤵
-
\??\c:\5ntnbb.exec:\5ntnbb.exe96⤵
-
\??\c:\1hbtbb.exec:\1hbtbb.exe97⤵
-
\??\c:\vpppp.exec:\vpppp.exe98⤵
-
\??\c:\pdpvd.exec:\pdpvd.exe99⤵
-
\??\c:\3ttnhb.exec:\3ttnhb.exe100⤵
-
\??\c:\5hhttn.exec:\5hhttn.exe101⤵
-
\??\c:\pddjj.exec:\pddjj.exe102⤵
-
\??\c:\vpjvj.exec:\vpjvj.exe103⤵
-
\??\c:\lxlxlfx.exec:\lxlxlfx.exe104⤵
-
\??\c:\lxxlxrl.exec:\lxxlxrl.exe105⤵
-
\??\c:\hbtnbb.exec:\hbtnbb.exe106⤵
-
\??\c:\vjvvd.exec:\vjvvd.exe107⤵
-
\??\c:\5pdpd.exec:\5pdpd.exe108⤵
-
\??\c:\xrrrlrr.exec:\xrrrlrr.exe109⤵
-
\??\c:\frlxrfr.exec:\frlxrfr.exe110⤵
-
\??\c:\tnthbb.exec:\tnthbb.exe111⤵
-
\??\c:\nhhnhh.exec:\nhhnhh.exe112⤵
-
\??\c:\dddjp.exec:\dddjp.exe113⤵
-
\??\c:\ffrrxlx.exec:\ffrrxlx.exe114⤵
-
\??\c:\rlfxxfl.exec:\rlfxxfl.exe115⤵
-
\??\c:\thbbtn.exec:\thbbtn.exe116⤵
-
\??\c:\5jddp.exec:\5jddp.exe117⤵
-
\??\c:\3pppd.exec:\3pppd.exe118⤵
-
\??\c:\xxfrfxx.exec:\xxfrfxx.exe119⤵
-
\??\c:\xxlxlrf.exec:\xxlxlrf.exe120⤵
-
\??\c:\thnhtn.exec:\thnhtn.exe121⤵
-
\??\c:\nhbhnn.exec:\nhbhnn.exe122⤵
-
\??\c:\jjpjv.exec:\jjpjv.exe123⤵
-
\??\c:\dpdvd.exec:\dpdvd.exe124⤵
-
\??\c:\xrrlffl.exec:\xrrlffl.exe125⤵
-
\??\c:\bnhbnh.exec:\bnhbnh.exe126⤵
-
\??\c:\nbttnb.exec:\nbttnb.exe127⤵
-
\??\c:\jjjjv.exec:\jjjjv.exe128⤵
-
\??\c:\pjdvd.exec:\pjdvd.exe129⤵
-
\??\c:\lllllfr.exec:\lllllfr.exe130⤵
-
\??\c:\tnttnn.exec:\tnttnn.exe131⤵
-
\??\c:\3ttnhn.exec:\3ttnhn.exe132⤵
-
\??\c:\5dvvj.exec:\5dvvj.exe133⤵
-
\??\c:\pdpjv.exec:\pdpjv.exe134⤵
-
\??\c:\lxrffxr.exec:\lxrffxr.exe135⤵
-
\??\c:\rlffrrl.exec:\rlffrrl.exe136⤵
-
\??\c:\bbhhnn.exec:\bbhhnn.exe137⤵
-
\??\c:\dpdpj.exec:\dpdpj.exe138⤵
-
\??\c:\jpdvj.exec:\jpdvj.exe139⤵
-
\??\c:\xxrlffx.exec:\xxrlffx.exe140⤵
-
\??\c:\1xrfrrf.exec:\1xrfrrf.exe141⤵
-
\??\c:\bnhbnh.exec:\bnhbnh.exe142⤵
-
\??\c:\nhbtbb.exec:\nhbtbb.exe143⤵
-
\??\c:\dvpdp.exec:\dvpdp.exe144⤵
-
\??\c:\xlrlxrl.exec:\xlrlxrl.exe145⤵
-
\??\c:\frlfxrl.exec:\frlfxrl.exe146⤵
-
\??\c:\bhbtht.exec:\bhbtht.exe147⤵
-
\??\c:\bhbhbn.exec:\bhbhbn.exe148⤵
-
\??\c:\1vvpd.exec:\1vvpd.exe149⤵
-
\??\c:\dpjdp.exec:\dpjdp.exe150⤵
-
\??\c:\7nbtnn.exec:\7nbtnn.exe151⤵
-
\??\c:\jdjdj.exec:\jdjdj.exe152⤵
-
\??\c:\vppdp.exec:\vppdp.exe153⤵
-
\??\c:\rfxflxf.exec:\rfxflxf.exe154⤵
-
\??\c:\htbtnh.exec:\htbtnh.exe155⤵
-
\??\c:\htnnbt.exec:\htnnbt.exe156⤵
-
\??\c:\jdddp.exec:\jdddp.exe157⤵
-
\??\c:\jjdvj.exec:\jjdvj.exe158⤵
-
\??\c:\5rlfrfx.exec:\5rlfrfx.exe159⤵
-
\??\c:\rfrllff.exec:\rfrllff.exe160⤵
-
\??\c:\7hnbtn.exec:\7hnbtn.exe161⤵
-
\??\c:\tnnbhb.exec:\tnnbhb.exe162⤵
-
\??\c:\pdvjd.exec:\pdvjd.exe163⤵
-
\??\c:\jpjdp.exec:\jpjdp.exe164⤵
-
\??\c:\9fxlxlx.exec:\9fxlxlx.exe165⤵
-
\??\c:\frrlxrl.exec:\frrlxrl.exe166⤵
-
\??\c:\hbhhbb.exec:\hbhhbb.exe167⤵
-
\??\c:\nhnntt.exec:\nhnntt.exe168⤵
-
\??\c:\1ppdp.exec:\1ppdp.exe169⤵
-
\??\c:\vpvjp.exec:\vpvjp.exe170⤵
-
\??\c:\xxrlrrf.exec:\xxrlrrf.exe171⤵
-
\??\c:\lfrlfxx.exec:\lfrlfxx.exe172⤵
-
\??\c:\bnnhnn.exec:\bnnhnn.exe173⤵
-
\??\c:\1ppjd.exec:\1ppjd.exe174⤵
-
\??\c:\vvvvp.exec:\vvvvp.exe175⤵
-
\??\c:\lfxlxrl.exec:\lfxlxrl.exe176⤵
-
\??\c:\fllxrxr.exec:\fllxrxr.exe177⤵
-
\??\c:\9nnntt.exec:\9nnntt.exe178⤵
-
\??\c:\htnhtt.exec:\htnhtt.exe179⤵
-
\??\c:\vpjdv.exec:\vpjdv.exe180⤵
-
\??\c:\fllfffl.exec:\fllfffl.exe181⤵
-
\??\c:\7rllflf.exec:\7rllflf.exe182⤵
-
\??\c:\tttnbt.exec:\tttnbt.exe183⤵
-
\??\c:\3nhbnt.exec:\3nhbnt.exe184⤵
-
\??\c:\pdpdd.exec:\pdpdd.exe185⤵
-
\??\c:\jvdjp.exec:\jvdjp.exe186⤵
-
\??\c:\frrlffx.exec:\frrlffx.exe187⤵
-
\??\c:\5xrlffx.exec:\5xrlffx.exe188⤵
-
\??\c:\bhnnhh.exec:\bhnnhh.exe189⤵
-
\??\c:\hnnhbt.exec:\hnnhbt.exe190⤵
-
\??\c:\lffxxll.exec:\lffxxll.exe191⤵
-
\??\c:\rrxrfxr.exec:\rrxrfxr.exe192⤵
-
\??\c:\jvpjj.exec:\jvpjj.exe193⤵
-
\??\c:\3jpjv.exec:\3jpjv.exe194⤵
-
\??\c:\rxxrlfx.exec:\rxxrlfx.exe195⤵
-
\??\c:\vjjdv.exec:\vjjdv.exe196⤵
-
\??\c:\frlrfxr.exec:\frlrfxr.exe197⤵
-
\??\c:\3tnnnn.exec:\3tnnnn.exe198⤵
-
\??\c:\rrrlxfx.exec:\rrrlxfx.exe199⤵
-
\??\c:\nbnnhh.exec:\nbnnhh.exe200⤵
-
\??\c:\5jjdd.exec:\5jjdd.exe201⤵
-
\??\c:\bthbtt.exec:\bthbtt.exe202⤵
-
\??\c:\nttnbb.exec:\nttnbb.exe203⤵
-
\??\c:\ppvjv.exec:\ppvjv.exe204⤵
-
\??\c:\7btnbn.exec:\7btnbn.exe205⤵
-
\??\c:\djppv.exec:\djppv.exe206⤵
-
\??\c:\9xrrllr.exec:\9xrrllr.exe207⤵
-
\??\c:\hnhtnn.exec:\hnhtnn.exe208⤵
-
\??\c:\5llrlfx.exec:\5llrlfx.exe209⤵
-
\??\c:\thhhbt.exec:\thhhbt.exe210⤵
-
\??\c:\bbhbhb.exec:\bbhbhb.exe211⤵
-
\??\c:\1htnbb.exec:\1htnbb.exe212⤵
-
\??\c:\vpddd.exec:\vpddd.exe213⤵
-
\??\c:\5bbtnh.exec:\5bbtnh.exe214⤵
-
\??\c:\jdjdp.exec:\jdjdp.exe215⤵
-
\??\c:\xxxxrxx.exec:\xxxxrxx.exe216⤵
-
\??\c:\tnnhhn.exec:\tnnhhn.exe217⤵
-
\??\c:\1pppd.exec:\1pppd.exe218⤵
-
\??\c:\3vpjd.exec:\3vpjd.exe219⤵
-
\??\c:\xllxlfx.exec:\xllxlfx.exe220⤵
-
\??\c:\xllfxrl.exec:\xllfxrl.exe221⤵
-
\??\c:\hnhntb.exec:\hnhntb.exe222⤵
-
\??\c:\5bbttt.exec:\5bbttt.exe223⤵
-
\??\c:\pjdvj.exec:\pjdvj.exe224⤵
-
\??\c:\vddpj.exec:\vddpj.exe225⤵
-
\??\c:\xxxllrf.exec:\xxxllrf.exe226⤵
-
\??\c:\fxffffr.exec:\fxffffr.exe227⤵
-
\??\c:\3nnbtt.exec:\3nnbtt.exe228⤵
-
\??\c:\hhhbtt.exec:\hhhbtt.exe229⤵
-
\??\c:\pppjp.exec:\pppjp.exe230⤵
-
\??\c:\vvvdd.exec:\vvvdd.exe231⤵
-
\??\c:\3frfxlf.exec:\3frfxlf.exe232⤵
-
\??\c:\1lfxxrl.exec:\1lfxxrl.exe233⤵
-
\??\c:\nbnbtn.exec:\nbnbtn.exe234⤵
-
\??\c:\5ttthh.exec:\5ttthh.exe235⤵
-
\??\c:\jddjj.exec:\jddjj.exe236⤵
-
\??\c:\vdpdj.exec:\vdpdj.exe237⤵
-
\??\c:\jpjvj.exec:\jpjvj.exe238⤵
-
\??\c:\xrlrxlr.exec:\xrlrxlr.exe239⤵
-
\??\c:\bnhbtt.exec:\bnhbtt.exe240⤵
-
\??\c:\nhbbnh.exec:\nhbbnh.exe241⤵