Analysis
-
max time kernel
150s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 20:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
08cf870dff8ab5b94798450629194b00_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
08cf870dff8ab5b94798450629194b00_NeikiAnalytics.exe
-
Size
69KB
-
MD5
08cf870dff8ab5b94798450629194b00
-
SHA1
b3aca8725ecd97e93b671baca07d63d4f9ddfdbc
-
SHA256
f32705db5b7b830938af02f25dad0602d65c0b3cb121576181e9ebecb6abb09f
-
SHA512
47f4f32472b400415a734c14969f381d4297b9e1dd129ac9722ac1089f95d95e4bff307f03d7a8a9fb942fba1244f4288f317c70883c68b97ff82f37a1dafabd
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUwcsbY3Z:ymb3NkkiQ3mdBjF0yjcsMp
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral2/memory/3168-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2928-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5496-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3372-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/940-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2416-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3528-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/888-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5612-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3464-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/556-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4368-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5232-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1076-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1232-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5320-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1896-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5680-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3116-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5508-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4052-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2516-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5672-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2352-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/6048-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4548-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2148-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xrxrrrl.exe5tbhbb.exe5dvvj.exe7rlfxll.exe1tbbtb.exe3ntttb.exevjvvv.exeppddd.exefxfxrlf.exettnnbb.exedvvdd.exe9vddv.exerlllfff.exethhbtt.exedjjpj.exexlflflf.exelfrrxxf.exebhbhnh.exevvddv.exexfrlffx.exennttnb.exevvjjp.exepjjdv.exe7xxrllf.exe5nnhbb.exe5hbtnn.exe3jpvp.exe9xlflfl.exelfxxflx.exehthhbn.exepjjdj.exeffrrlxr.exefxfxxxx.exe9thhhh.exenhnnhb.exeppvjd.exe5vdvd.exe7ffxlll.exe7fllrrl.exexxxxxff.exehhhhht.exebbnhbt.exehbbtbb.exevpppd.exefxrlrrl.exerlrlllf.exettbnhh.exebnnhtt.exepppjj.exejjjdp.exelfllfff.exennnnhh.exe9vdvp.exejdpjd.exedjvvd.exexrlfxxr.exethnhbt.exedvjjv.exelxxrrll.exe7xlxllx.exe9bbtnn.exenhnnbb.exe1ddvj.exefxxrffr.exepid process 2928 xrxrrrl.exe 5496 5tbhbb.exe 3372 5dvvj.exe 888 7rlfxll.exe 940 1tbbtb.exe 3528 3ntttb.exe 2416 vjvvv.exe 5612 ppddd.exe 3464 fxfxrlf.exe 556 ttnnbb.exe 4368 dvvdd.exe 5232 9vddv.exe 1076 rlllfff.exe 712 thhbtt.exe 1232 djjpj.exe 5320 xlflflf.exe 1896 lfrrxxf.exe 5680 bhbhnh.exe 3116 vvddv.exe 5508 xfrlffx.exe 4052 nnttnb.exe 5112 vvjjp.exe 2516 pjjdv.exe 5672 7xxrllf.exe 840 5nnhbb.exe 2352 5hbtnn.exe 4072 3jpvp.exe 6048 9xlflfl.exe 4548 lfxxflx.exe 2148 hthhbn.exe 2684 pjjdj.exe 3260 ffrrlxr.exe 2236 fxfxxxx.exe 5760 9thhhh.exe 5900 nhnnhb.exe 1552 ppvjd.exe 5888 5vdvd.exe 1836 7ffxlll.exe 1540 7fllrrl.exe 3472 xxxxxff.exe 4400 hhhhht.exe 2740 bbnhbt.exe 2944 hbbtbb.exe 4148 vpppd.exe 5136 fxrlrrl.exe 3796 rlrlllf.exe 2200 ttbnhh.exe 2392 bnnhtt.exe 1632 pppjj.exe 436 jjjdp.exe 2056 lfllfff.exe 2264 nnnnhh.exe 3348 9vdvp.exe 4704 jdpjd.exe 2952 djvvd.exe 2476 xrlfxxr.exe 5272 thnhbt.exe 2020 dvjjv.exe 3744 lxxrrll.exe 1332 7xlxllx.exe 4920 9bbtnn.exe 3044 nhnnbb.exe 1516 1ddvj.exe 1500 fxxrffr.exe -
Processes:
resource yara_rule behavioral2/memory/3168-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2928-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5496-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3372-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3372-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3372-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3372-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/940-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2416-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3528-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/888-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5612-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3464-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/556-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4368-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5232-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1076-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1232-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5320-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1896-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5680-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3116-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5508-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4052-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2516-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5672-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2352-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/6048-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4548-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-200-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
08cf870dff8ab5b94798450629194b00_NeikiAnalytics.exexrxrrrl.exe5tbhbb.exe5dvvj.exe7rlfxll.exe1tbbtb.exe3ntttb.exevjvvv.exeppddd.exefxfxrlf.exettnnbb.exedvvdd.exe9vddv.exerlllfff.exethhbtt.exedjjpj.exexlflflf.exelfrrxxf.exebhbhnh.exevvddv.exexfrlffx.exennttnb.exedescription pid process target process PID 3168 wrote to memory of 2928 3168 08cf870dff8ab5b94798450629194b00_NeikiAnalytics.exe xrxrrrl.exe PID 3168 wrote to memory of 2928 3168 08cf870dff8ab5b94798450629194b00_NeikiAnalytics.exe xrxrrrl.exe PID 3168 wrote to memory of 2928 3168 08cf870dff8ab5b94798450629194b00_NeikiAnalytics.exe xrxrrrl.exe PID 2928 wrote to memory of 5496 2928 xrxrrrl.exe 5tbhbb.exe PID 2928 wrote to memory of 5496 2928 xrxrrrl.exe 5tbhbb.exe PID 2928 wrote to memory of 5496 2928 xrxrrrl.exe 5tbhbb.exe PID 5496 wrote to memory of 3372 5496 5tbhbb.exe 5dvvj.exe PID 5496 wrote to memory of 3372 5496 5tbhbb.exe 5dvvj.exe PID 5496 wrote to memory of 3372 5496 5tbhbb.exe 5dvvj.exe PID 3372 wrote to memory of 888 3372 5dvvj.exe 7rlfxll.exe PID 3372 wrote to memory of 888 3372 5dvvj.exe 7rlfxll.exe PID 3372 wrote to memory of 888 3372 5dvvj.exe 7rlfxll.exe PID 888 wrote to memory of 940 888 7rlfxll.exe 1tbbtb.exe PID 888 wrote to memory of 940 888 7rlfxll.exe 1tbbtb.exe PID 888 wrote to memory of 940 888 7rlfxll.exe 1tbbtb.exe PID 940 wrote to memory of 3528 940 1tbbtb.exe 3ntttb.exe PID 940 wrote to memory of 3528 940 1tbbtb.exe 3ntttb.exe PID 940 wrote to memory of 3528 940 1tbbtb.exe 3ntttb.exe PID 3528 wrote to memory of 2416 3528 3ntttb.exe vjvvv.exe PID 3528 wrote to memory of 2416 3528 3ntttb.exe vjvvv.exe PID 3528 wrote to memory of 2416 3528 3ntttb.exe vjvvv.exe PID 2416 wrote to memory of 5612 2416 vjvvv.exe ppddd.exe PID 2416 wrote to memory of 5612 2416 vjvvv.exe ppddd.exe PID 2416 wrote to memory of 5612 2416 vjvvv.exe ppddd.exe PID 5612 wrote to memory of 3464 5612 ppddd.exe fxfxrlf.exe PID 5612 wrote to memory of 3464 5612 ppddd.exe fxfxrlf.exe PID 5612 wrote to memory of 3464 5612 ppddd.exe fxfxrlf.exe PID 3464 wrote to memory of 556 3464 fxfxrlf.exe ttnnbb.exe PID 3464 wrote to memory of 556 3464 fxfxrlf.exe ttnnbb.exe PID 3464 wrote to memory of 556 3464 fxfxrlf.exe ttnnbb.exe PID 556 wrote to memory of 4368 556 ttnnbb.exe dvvdd.exe PID 556 wrote to memory of 4368 556 ttnnbb.exe dvvdd.exe PID 556 wrote to memory of 4368 556 ttnnbb.exe dvvdd.exe PID 4368 wrote to memory of 5232 4368 dvvdd.exe 9vddv.exe PID 4368 wrote to memory of 5232 4368 dvvdd.exe 9vddv.exe PID 4368 wrote to memory of 5232 4368 dvvdd.exe 9vddv.exe PID 5232 wrote to memory of 1076 5232 9vddv.exe rlllfff.exe PID 5232 wrote to memory of 1076 5232 9vddv.exe rlllfff.exe PID 5232 wrote to memory of 1076 5232 9vddv.exe rlllfff.exe PID 1076 wrote to memory of 712 1076 rlllfff.exe thhbtt.exe PID 1076 wrote to memory of 712 1076 rlllfff.exe thhbtt.exe PID 1076 wrote to memory of 712 1076 rlllfff.exe thhbtt.exe PID 712 wrote to memory of 1232 712 thhbtt.exe djjpj.exe PID 712 wrote to memory of 1232 712 thhbtt.exe djjpj.exe PID 712 wrote to memory of 1232 712 thhbtt.exe djjpj.exe PID 1232 wrote to memory of 5320 1232 djjpj.exe xlflflf.exe PID 1232 wrote to memory of 5320 1232 djjpj.exe xlflflf.exe PID 1232 wrote to memory of 5320 1232 djjpj.exe xlflflf.exe PID 5320 wrote to memory of 1896 5320 xlflflf.exe lfrrxxf.exe PID 5320 wrote to memory of 1896 5320 xlflflf.exe lfrrxxf.exe PID 5320 wrote to memory of 1896 5320 xlflflf.exe lfrrxxf.exe PID 1896 wrote to memory of 5680 1896 lfrrxxf.exe bhbhnh.exe PID 1896 wrote to memory of 5680 1896 lfrrxxf.exe bhbhnh.exe PID 1896 wrote to memory of 5680 1896 lfrrxxf.exe bhbhnh.exe PID 5680 wrote to memory of 3116 5680 bhbhnh.exe vvddv.exe PID 5680 wrote to memory of 3116 5680 bhbhnh.exe vvddv.exe PID 5680 wrote to memory of 3116 5680 bhbhnh.exe vvddv.exe PID 3116 wrote to memory of 5508 3116 vvddv.exe xfrlffx.exe PID 3116 wrote to memory of 5508 3116 vvddv.exe xfrlffx.exe PID 3116 wrote to memory of 5508 3116 vvddv.exe xfrlffx.exe PID 5508 wrote to memory of 4052 5508 xfrlffx.exe nnttnb.exe PID 5508 wrote to memory of 4052 5508 xfrlffx.exe nnttnb.exe PID 5508 wrote to memory of 4052 5508 xfrlffx.exe nnttnb.exe PID 4052 wrote to memory of 5112 4052 nnttnb.exe vvjjp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\08cf870dff8ab5b94798450629194b00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\08cf870dff8ab5b94798450629194b00_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\xrxrrrl.exec:\xrxrrrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5tbhbb.exec:\5tbhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5dvvj.exec:\5dvvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7rlfxll.exec:\7rlfxll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1tbbtb.exec:\1tbbtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3ntttb.exec:\3ntttb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjvvv.exec:\vjvvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ppddd.exec:\ppddd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxfxrlf.exec:\fxfxrlf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ttnnbb.exec:\ttnnbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvvdd.exec:\dvvdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9vddv.exec:\9vddv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlllfff.exec:\rlllfff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thhbtt.exec:\thhbtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\djjpj.exec:\djjpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xlflflf.exec:\xlflflf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhbhnh.exec:\bhbhnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvddv.exec:\vvddv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xfrlffx.exec:\xfrlffx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnttnb.exec:\nnttnb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvjjp.exec:\vvjjp.exe23⤵
- Executes dropped EXE
-
\??\c:\pjjdv.exec:\pjjdv.exe24⤵
- Executes dropped EXE
-
\??\c:\7xxrllf.exec:\7xxrllf.exe25⤵
- Executes dropped EXE
-
\??\c:\5nnhbb.exec:\5nnhbb.exe26⤵
- Executes dropped EXE
-
\??\c:\5hbtnn.exec:\5hbtnn.exe27⤵
- Executes dropped EXE
-
\??\c:\3jpvp.exec:\3jpvp.exe28⤵
- Executes dropped EXE
-
\??\c:\9xlflfl.exec:\9xlflfl.exe29⤵
- Executes dropped EXE
-
\??\c:\lfxxflx.exec:\lfxxflx.exe30⤵
- Executes dropped EXE
-
\??\c:\hthhbn.exec:\hthhbn.exe31⤵
- Executes dropped EXE
-
\??\c:\pjjdj.exec:\pjjdj.exe32⤵
- Executes dropped EXE
-
\??\c:\ffrrlxr.exec:\ffrrlxr.exe33⤵
- Executes dropped EXE
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe34⤵
- Executes dropped EXE
-
\??\c:\9thhhh.exec:\9thhhh.exe35⤵
- Executes dropped EXE
-
\??\c:\nhnnhb.exec:\nhnnhb.exe36⤵
- Executes dropped EXE
-
\??\c:\ppvjd.exec:\ppvjd.exe37⤵
- Executes dropped EXE
-
\??\c:\5vdvd.exec:\5vdvd.exe38⤵
- Executes dropped EXE
-
\??\c:\7ffxlll.exec:\7ffxlll.exe39⤵
- Executes dropped EXE
-
\??\c:\7fllrrl.exec:\7fllrrl.exe40⤵
- Executes dropped EXE
-
\??\c:\xxxxxff.exec:\xxxxxff.exe41⤵
- Executes dropped EXE
-
\??\c:\hhhhht.exec:\hhhhht.exe42⤵
- Executes dropped EXE
-
\??\c:\bbnhbt.exec:\bbnhbt.exe43⤵
- Executes dropped EXE
-
\??\c:\hbbtbb.exec:\hbbtbb.exe44⤵
- Executes dropped EXE
-
\??\c:\vpppd.exec:\vpppd.exe45⤵
- Executes dropped EXE
-
\??\c:\fxrlrrl.exec:\fxrlrrl.exe46⤵
- Executes dropped EXE
-
\??\c:\rlrlllf.exec:\rlrlllf.exe47⤵
- Executes dropped EXE
-
\??\c:\ttbnhh.exec:\ttbnhh.exe48⤵
- Executes dropped EXE
-
\??\c:\bnnhtt.exec:\bnnhtt.exe49⤵
- Executes dropped EXE
-
\??\c:\pppjj.exec:\pppjj.exe50⤵
- Executes dropped EXE
-
\??\c:\jjjdp.exec:\jjjdp.exe51⤵
- Executes dropped EXE
-
\??\c:\lfllfff.exec:\lfllfff.exe52⤵
- Executes dropped EXE
-
\??\c:\nnnnhh.exec:\nnnnhh.exe53⤵
- Executes dropped EXE
-
\??\c:\9vdvp.exec:\9vdvp.exe54⤵
- Executes dropped EXE
-
\??\c:\jdpjd.exec:\jdpjd.exe55⤵
- Executes dropped EXE
-
\??\c:\djvvd.exec:\djvvd.exe56⤵
- Executes dropped EXE
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe57⤵
- Executes dropped EXE
-
\??\c:\thnhbt.exec:\thnhbt.exe58⤵
- Executes dropped EXE
-
\??\c:\dvjjv.exec:\dvjjv.exe59⤵
- Executes dropped EXE
-
\??\c:\lxxrrll.exec:\lxxrrll.exe60⤵
- Executes dropped EXE
-
\??\c:\7xlxllx.exec:\7xlxllx.exe61⤵
- Executes dropped EXE
-
\??\c:\9bbtnn.exec:\9bbtnn.exe62⤵
- Executes dropped EXE
-
\??\c:\nhnnbb.exec:\nhnnbb.exe63⤵
- Executes dropped EXE
-
\??\c:\1ddvj.exec:\1ddvj.exe64⤵
- Executes dropped EXE
-
\??\c:\fxxrffr.exec:\fxxrffr.exe65⤵
- Executes dropped EXE
-
\??\c:\lxxxxrr.exec:\lxxxxrr.exe66⤵
-
\??\c:\ttbtbt.exec:\ttbtbt.exe67⤵
-
\??\c:\dvvvp.exec:\dvvvp.exe68⤵
-
\??\c:\1pjdp.exec:\1pjdp.exe69⤵
-
\??\c:\llxxxfl.exec:\llxxxfl.exe70⤵
-
\??\c:\5llfffx.exec:\5llfffx.exe71⤵
-
\??\c:\btnnhb.exec:\btnnhb.exe72⤵
-
\??\c:\7nthnh.exec:\7nthnh.exe73⤵
-
\??\c:\3pdvj.exec:\3pdvj.exe74⤵
-
\??\c:\jdjdd.exec:\jdjdd.exe75⤵
-
\??\c:\1lfxffr.exec:\1lfxffr.exe76⤵
-
\??\c:\nbbhbb.exec:\nbbhbb.exe77⤵
-
\??\c:\9djjd.exec:\9djjd.exe78⤵
-
\??\c:\dvvvp.exec:\dvvvp.exe79⤵
-
\??\c:\dvdvp.exec:\dvdvp.exe80⤵
-
\??\c:\5flxllf.exec:\5flxllf.exe81⤵
-
\??\c:\lfxfxrl.exec:\lfxfxrl.exe82⤵
-
\??\c:\hhbbtt.exec:\hhbbtt.exe83⤵
-
\??\c:\hntthn.exec:\hntthn.exe84⤵
-
\??\c:\vdddv.exec:\vdddv.exe85⤵
-
\??\c:\xlllfxx.exec:\xlllfxx.exe86⤵
-
\??\c:\ffffxxx.exec:\ffffxxx.exe87⤵
-
\??\c:\7nhhhh.exec:\7nhhhh.exe88⤵
-
\??\c:\1bbttb.exec:\1bbttb.exe89⤵
-
\??\c:\jdvpd.exec:\jdvpd.exe90⤵
-
\??\c:\9jjvp.exec:\9jjvp.exe91⤵
-
\??\c:\llffrxl.exec:\llffrxl.exe92⤵
-
\??\c:\ttbbbn.exec:\ttbbbn.exe93⤵
-
\??\c:\bbhbhn.exec:\bbhbhn.exe94⤵
-
\??\c:\pvpjj.exec:\pvpjj.exe95⤵
-
\??\c:\lxffrxr.exec:\lxffrxr.exe96⤵
-
\??\c:\rrrllll.exec:\rrrllll.exe97⤵
-
\??\c:\tthbtt.exec:\tthbtt.exe98⤵
-
\??\c:\thnhbt.exec:\thnhbt.exe99⤵
-
\??\c:\pjpjd.exec:\pjpjd.exe100⤵
-
\??\c:\jpjdv.exec:\jpjdv.exe101⤵
-
\??\c:\fllrrxx.exec:\fllrrxx.exe102⤵
-
\??\c:\bnthhb.exec:\bnthhb.exe103⤵
-
\??\c:\vpppj.exec:\vpppj.exe104⤵
-
\??\c:\5dddp.exec:\5dddp.exe105⤵
-
\??\c:\1lfxllx.exec:\1lfxllx.exe106⤵
-
\??\c:\rlrxxrr.exec:\rlrxxrr.exe107⤵
-
\??\c:\nbnhnn.exec:\nbnhnn.exe108⤵
-
\??\c:\nhbnhh.exec:\nhbnhh.exe109⤵
-
\??\c:\pjvpv.exec:\pjvpv.exe110⤵
-
\??\c:\pvppd.exec:\pvppd.exe111⤵
-
\??\c:\3rlfxll.exec:\3rlfxll.exe112⤵
-
\??\c:\lxfffxx.exec:\lxfffxx.exe113⤵
-
\??\c:\1nnbtn.exec:\1nnbtn.exe114⤵
-
\??\c:\htbbnt.exec:\htbbnt.exe115⤵
-
\??\c:\9dpdd.exec:\9dpdd.exe116⤵
-
\??\c:\ddvdv.exec:\ddvdv.exe117⤵
-
\??\c:\3lllfxf.exec:\3lllfxf.exe118⤵
-
\??\c:\lfffxxr.exec:\lfffxxr.exe119⤵
-
\??\c:\bbnnhn.exec:\bbnnhn.exe120⤵
-
\??\c:\vvppp.exec:\vvppp.exe121⤵
-
\??\c:\xrlfxrr.exec:\xrlfxrr.exe122⤵
-
\??\c:\lfxrrrr.exec:\lfxrrrr.exe123⤵
-
\??\c:\7ntnht.exec:\7ntnht.exe124⤵
-
\??\c:\5jpjd.exec:\5jpjd.exe125⤵
-
\??\c:\5xlxfxf.exec:\5xlxfxf.exe126⤵
-
\??\c:\rrrfrfx.exec:\rrrfrfx.exe127⤵
-
\??\c:\nnbbhh.exec:\nnbbhh.exe128⤵
-
\??\c:\hhtthh.exec:\hhtthh.exe129⤵
-
\??\c:\djvvp.exec:\djvvp.exe130⤵
-
\??\c:\vvvpd.exec:\vvvpd.exe131⤵
-
\??\c:\xxffllr.exec:\xxffllr.exe132⤵
-
\??\c:\fxffxff.exec:\fxffxff.exe133⤵
-
\??\c:\hntbtt.exec:\hntbtt.exe134⤵
-
\??\c:\hhhbtn.exec:\hhhbtn.exe135⤵
-
\??\c:\dpvpd.exec:\dpvpd.exe136⤵
-
\??\c:\vppjj.exec:\vppjj.exe137⤵
-
\??\c:\xxfxxxx.exec:\xxfxxxx.exe138⤵
-
\??\c:\3hbnbt.exec:\3hbnbt.exe139⤵
-
\??\c:\djpdp.exec:\djpdp.exe140⤵
-
\??\c:\pjjjv.exec:\pjjjv.exe141⤵
-
\??\c:\9rxxllf.exec:\9rxxllf.exe142⤵
-
\??\c:\7frrlll.exec:\7frrlll.exe143⤵
-
\??\c:\5bbbtt.exec:\5bbbtt.exe144⤵
-
\??\c:\hnnhtt.exec:\hnnhtt.exe145⤵
-
\??\c:\dppvp.exec:\dppvp.exe146⤵
-
\??\c:\vdvpp.exec:\vdvpp.exe147⤵
-
\??\c:\fxrfxrl.exec:\fxrfxrl.exe148⤵
-
\??\c:\xlfxllr.exec:\xlfxllr.exe149⤵
-
\??\c:\1ntnhn.exec:\1ntnhn.exe150⤵
-
\??\c:\tbhbnt.exec:\tbhbnt.exe151⤵
-
\??\c:\djjdv.exec:\djjdv.exe152⤵
-
\??\c:\jvvpd.exec:\jvvpd.exe153⤵
-
\??\c:\fxxlfrf.exec:\fxxlfrf.exe154⤵
-
\??\c:\3rxxlfx.exec:\3rxxlfx.exe155⤵
-
\??\c:\thbthh.exec:\thbthh.exe156⤵
-
\??\c:\nhnhbb.exec:\nhnhbb.exe157⤵
-
\??\c:\9pjdp.exec:\9pjdp.exe158⤵
-
\??\c:\7jjvp.exec:\7jjvp.exe159⤵
-
\??\c:\xlrrxfx.exec:\xlrrxfx.exe160⤵
-
\??\c:\1hhhtt.exec:\1hhhtt.exe161⤵
-
\??\c:\nthbbt.exec:\nthbbt.exe162⤵
-
\??\c:\nthhtt.exec:\nthhtt.exe163⤵
-
\??\c:\dvddp.exec:\dvddp.exe164⤵
-
\??\c:\vjjdp.exec:\vjjdp.exe165⤵
-
\??\c:\5rrlxrr.exec:\5rrlxrr.exe166⤵
-
\??\c:\1llfxrl.exec:\1llfxrl.exe167⤵
-
\??\c:\9ntnhh.exec:\9ntnhh.exe168⤵
-
\??\c:\htnhtn.exec:\htnhtn.exe169⤵
-
\??\c:\dpdvv.exec:\dpdvv.exe170⤵
-
\??\c:\ppvjj.exec:\ppvjj.exe171⤵
-
\??\c:\3llfrxl.exec:\3llfrxl.exe172⤵
-
\??\c:\1xrxrrl.exec:\1xrxrrl.exe173⤵
-
\??\c:\9htnhh.exec:\9htnhh.exe174⤵
-
\??\c:\bthbhb.exec:\bthbhb.exe175⤵
-
\??\c:\1ddpj.exec:\1ddpj.exe176⤵
-
\??\c:\jdvpp.exec:\jdvpp.exe177⤵
-
\??\c:\7ffxlxr.exec:\7ffxlxr.exe178⤵
-
\??\c:\3rrlfxf.exec:\3rrlfxf.exe179⤵
-
\??\c:\lffxxxx.exec:\lffxxxx.exe180⤵
-
\??\c:\7htbtt.exec:\7htbtt.exe181⤵
-
\??\c:\thnthn.exec:\thnthn.exe182⤵
-
\??\c:\5ddpd.exec:\5ddpd.exe183⤵
-
\??\c:\3jjvj.exec:\3jjvj.exe184⤵
-
\??\c:\3lfxllf.exec:\3lfxllf.exe185⤵
-
\??\c:\fxxrfxr.exec:\fxxrfxr.exe186⤵
-
\??\c:\nbtttt.exec:\nbtttt.exe187⤵
-
\??\c:\htnhtt.exec:\htnhtt.exe188⤵
-
\??\c:\pjppp.exec:\pjppp.exe189⤵
-
\??\c:\jpdpp.exec:\jpdpp.exe190⤵
-
\??\c:\3llfffx.exec:\3llfffx.exe191⤵
-
\??\c:\lrrllxf.exec:\lrrllxf.exe192⤵
-
\??\c:\nntnnn.exec:\nntnnn.exe193⤵
-
\??\c:\bbbnhb.exec:\bbbnhb.exe194⤵
-
\??\c:\ppdvp.exec:\ppdvp.exe195⤵
-
\??\c:\3dvjv.exec:\3dvjv.exe196⤵
-
\??\c:\xffrffx.exec:\xffrffx.exe197⤵
-
\??\c:\3lrxrxl.exec:\3lrxrxl.exe198⤵
-
\??\c:\tnhbtt.exec:\tnhbtt.exe199⤵
-
\??\c:\pppjv.exec:\pppjv.exe200⤵
-
\??\c:\dvdjd.exec:\dvdjd.exe201⤵
-
\??\c:\rffxllf.exec:\rffxllf.exe202⤵
-
\??\c:\5xfxrrl.exec:\5xfxrrl.exe203⤵
-
\??\c:\nbnhbh.exec:\nbnhbh.exe204⤵
-
\??\c:\tntnnn.exec:\tntnnn.exe205⤵
-
\??\c:\7vvpd.exec:\7vvpd.exe206⤵
-
\??\c:\vpvvd.exec:\vpvvd.exe207⤵
-
\??\c:\7jjjj.exec:\7jjjj.exe208⤵
-
\??\c:\xrrllrl.exec:\xrrllrl.exe209⤵
-
\??\c:\9xxfxrl.exec:\9xxfxrl.exe210⤵
-
\??\c:\nbbtnn.exec:\nbbtnn.exe211⤵
-
\??\c:\bntthb.exec:\bntthb.exe212⤵
-
\??\c:\dvjjp.exec:\dvjjp.exe213⤵
-
\??\c:\jdjvp.exec:\jdjvp.exe214⤵
-
\??\c:\9xffrrl.exec:\9xffrrl.exe215⤵
-
\??\c:\rflllll.exec:\rflllll.exe216⤵
-
\??\c:\1nnhbb.exec:\1nnhbb.exe217⤵
-
\??\c:\9hhhnn.exec:\9hhhnn.exe218⤵
-
\??\c:\pdjjv.exec:\pdjjv.exe219⤵
-
\??\c:\7jpjj.exec:\7jpjj.exe220⤵
-
\??\c:\3xxrxxr.exec:\3xxrxxr.exe221⤵
-
\??\c:\rrllfxf.exec:\rrllfxf.exe222⤵
-
\??\c:\thhhbb.exec:\thhhbb.exe223⤵
-
\??\c:\1nnnhb.exec:\1nnnhb.exe224⤵
-
\??\c:\vvjjd.exec:\vvjjd.exe225⤵
-
\??\c:\5pvvj.exec:\5pvvj.exe226⤵
-
\??\c:\bnbbhh.exec:\bnbbhh.exe227⤵
-
\??\c:\hnnhbb.exec:\hnnhbb.exe228⤵
-
\??\c:\3jpvj.exec:\3jpvj.exe229⤵
-
\??\c:\xxfxxfr.exec:\xxfxxfr.exe230⤵
-
\??\c:\lxfxxrx.exec:\lxfxxrx.exe231⤵
-
\??\c:\9hbtbh.exec:\9hbtbh.exe232⤵
-
\??\c:\5bhhbt.exec:\5bhhbt.exe233⤵
-
\??\c:\jvpdp.exec:\jvpdp.exe234⤵
-
\??\c:\pdddp.exec:\pdddp.exe235⤵
-
\??\c:\rxxfxxx.exec:\rxxfxxx.exe236⤵
-
\??\c:\tbbttn.exec:\tbbttn.exe237⤵
-
\??\c:\bhttnh.exec:\bhttnh.exe238⤵
-
\??\c:\flxrllf.exec:\flxrllf.exe239⤵
-
\??\c:\lfxrllf.exec:\lfxrllf.exe240⤵
-
\??\c:\thhhbn.exec:\thhhbn.exe241⤵