Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 20:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0d2457b01a542d1a6012f89e24fddc40_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
0d2457b01a542d1a6012f89e24fddc40_NeikiAnalytics.exe
-
Size
79KB
-
MD5
0d2457b01a542d1a6012f89e24fddc40
-
SHA1
f4c91357dc70b98d1c7922a1cbf8e839c690c24c
-
SHA256
6b00e05bbc18b72c85c41ac20a47bf15d9470580e7628a6bd4df07e3ead553a9
-
SHA512
df83117e79f96baa3b5c8411f986bdfc31f4e159c5068a6a0ca568b6fd083066e37d048734801ab8ca4ccd705dd1216f1e046833b345722f490327cda62aa061
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIjaQkPcy8WTeAwHWkDLnR:ymb3NkkiQ3mdBjFIpkPcy8qsHjDDR
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/2648-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3252-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1800-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3360-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2108-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1044-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1984-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2860-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2184-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2432-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/856-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1352-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3692-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/368-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4400-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4552-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/712-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2532-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1512-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1340-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3256-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
frxxlfl.exehtbnbn.exedvjdj.exelrrllfl.exehtnthh.exevdjdv.exexlrlllf.exetnhnhh.exedjpjv.exelfxffxf.exejvvpj.exe7dppd.exenhhbtn.exerlrlrrx.exebhhhbb.exepjvjd.exellffxxr.exenbtnnh.exe7vjvv.exexllrrxx.exe3rxrxxf.exehbbbbb.exedjpjj.exexrrrxxx.exehhnhbb.exe1ppjj.exe7rfxxxx.exe1nnnbb.exe7dvpj.exeffxflff.exebtnhbt.exepvjdd.exerfrlfxr.exetnbbbb.exeppjdd.exe3dpdd.exelrxrllf.exettbbbt.exejppdd.exe7xxrffx.exe1tnnbb.exethnhbb.exerrxrxxf.exeffxxrrr.exepjjdv.exevpvjv.exeflllrlx.exevpvvv.exejdddd.exexxfxlrl.exethhbnn.exennhhtt.exepvvpj.exelrlxxfr.exethnnnt.exe1pjpp.exerrffxfl.exefxrrllf.exennbbnn.exevdjjj.exelfllxxx.exetbbttn.exevppdj.exe9dpjv.exepid process 3252 frxxlfl.exe 220 htbnbn.exe 1800 dvjdj.exe 3360 lrrllfl.exe 2364 htnthh.exe 2108 vdjdv.exe 1044 xlrlllf.exe 1984 tnhnhh.exe 5004 djpjv.exe 2860 lfxffxf.exe 2184 jvvpj.exe 2432 7dppd.exe 856 nhhbtn.exe 1352 rlrlrrx.exe 4964 bhhhbb.exe 5060 pjvjd.exe 3692 llffxxr.exe 5020 nbtnnh.exe 368 7vjvv.exe 4648 xllrrxx.exe 712 3rxrxxf.exe 4552 hbbbbb.exe 4400 djpjj.exe 2532 xrrrxxx.exe 2712 hhnhbb.exe 1924 1ppjj.exe 1512 7rfxxxx.exe 1340 1nnnbb.exe 2612 7dvpj.exe 448 ffxflff.exe 3256 btnhbt.exe 1588 pvjdd.exe 3076 rfrlfxr.exe 4236 tnbbbb.exe 3244 ppjdd.exe 4900 3dpdd.exe 3068 lrxrllf.exe 644 ttbbbt.exe 4828 jppdd.exe 632 7xxrffx.exe 4312 1tnnbb.exe 4812 thnhbb.exe 224 rrxrxxf.exe 944 ffxxrrr.exe 1708 pjjdv.exe 2344 vpvjv.exe 3560 flllrlx.exe 3196 vpvvv.exe 2108 jdddd.exe 1968 xxfxlrl.exe 3232 thhbnn.exe 768 nnhhtt.exe 2512 pvvpj.exe 2860 lrlxxfr.exe 2544 thnnnt.exe 1620 1pjpp.exe 3112 rrffxfl.exe 3980 fxrrllf.exe 2924 nnbbnn.exe 4804 vdjjj.exe 1848 lfllxxx.exe 3692 tbbttn.exe 4508 vppdj.exe 688 9dpjv.exe -
Processes:
resource yara_rule behavioral2/memory/2648-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3252-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1800-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3360-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2108-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1044-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1044-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1984-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2860-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2184-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2432-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/856-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1352-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3692-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/368-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4552-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/712-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2532-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1512-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1340-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3256-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0d2457b01a542d1a6012f89e24fddc40_NeikiAnalytics.exefrxxlfl.exehtbnbn.exedvjdj.exelrrllfl.exehtnthh.exevdjdv.exexlrlllf.exetnhnhh.exedjpjv.exelfxffxf.exejvvpj.exe7dppd.exenhhbtn.exerlrlrrx.exebhhhbb.exepjvjd.exellffxxr.exenbtnnh.exe7vjvv.exexllrrxx.exe3rxrxxf.exedescription pid process target process PID 2648 wrote to memory of 3252 2648 0d2457b01a542d1a6012f89e24fddc40_NeikiAnalytics.exe frxxlfl.exe PID 2648 wrote to memory of 3252 2648 0d2457b01a542d1a6012f89e24fddc40_NeikiAnalytics.exe frxxlfl.exe PID 2648 wrote to memory of 3252 2648 0d2457b01a542d1a6012f89e24fddc40_NeikiAnalytics.exe frxxlfl.exe PID 3252 wrote to memory of 220 3252 frxxlfl.exe htbnbn.exe PID 3252 wrote to memory of 220 3252 frxxlfl.exe htbnbn.exe PID 3252 wrote to memory of 220 3252 frxxlfl.exe htbnbn.exe PID 220 wrote to memory of 1800 220 htbnbn.exe dvjdj.exe PID 220 wrote to memory of 1800 220 htbnbn.exe dvjdj.exe PID 220 wrote to memory of 1800 220 htbnbn.exe dvjdj.exe PID 1800 wrote to memory of 3360 1800 dvjdj.exe lrrllfl.exe PID 1800 wrote to memory of 3360 1800 dvjdj.exe lrrllfl.exe PID 1800 wrote to memory of 3360 1800 dvjdj.exe lrrllfl.exe PID 3360 wrote to memory of 2364 3360 lrrllfl.exe htnthh.exe PID 3360 wrote to memory of 2364 3360 lrrllfl.exe htnthh.exe PID 3360 wrote to memory of 2364 3360 lrrllfl.exe htnthh.exe PID 2364 wrote to memory of 2108 2364 htnthh.exe vdjdv.exe PID 2364 wrote to memory of 2108 2364 htnthh.exe vdjdv.exe PID 2364 wrote to memory of 2108 2364 htnthh.exe vdjdv.exe PID 2108 wrote to memory of 1044 2108 vdjdv.exe xlrlllf.exe PID 2108 wrote to memory of 1044 2108 vdjdv.exe xlrlllf.exe PID 2108 wrote to memory of 1044 2108 vdjdv.exe xlrlllf.exe PID 1044 wrote to memory of 1984 1044 xlrlllf.exe tnhnhh.exe PID 1044 wrote to memory of 1984 1044 xlrlllf.exe tnhnhh.exe PID 1044 wrote to memory of 1984 1044 xlrlllf.exe tnhnhh.exe PID 1984 wrote to memory of 5004 1984 tnhnhh.exe djpjv.exe PID 1984 wrote to memory of 5004 1984 tnhnhh.exe djpjv.exe PID 1984 wrote to memory of 5004 1984 tnhnhh.exe djpjv.exe PID 5004 wrote to memory of 2860 5004 djpjv.exe lfxffxf.exe PID 5004 wrote to memory of 2860 5004 djpjv.exe lfxffxf.exe PID 5004 wrote to memory of 2860 5004 djpjv.exe lfxffxf.exe PID 2860 wrote to memory of 2184 2860 lfxffxf.exe jvvpj.exe PID 2860 wrote to memory of 2184 2860 lfxffxf.exe jvvpj.exe PID 2860 wrote to memory of 2184 2860 lfxffxf.exe jvvpj.exe PID 2184 wrote to memory of 2432 2184 jvvpj.exe 7dppd.exe PID 2184 wrote to memory of 2432 2184 jvvpj.exe 7dppd.exe PID 2184 wrote to memory of 2432 2184 jvvpj.exe 7dppd.exe PID 2432 wrote to memory of 856 2432 7dppd.exe nhhbtn.exe PID 2432 wrote to memory of 856 2432 7dppd.exe nhhbtn.exe PID 2432 wrote to memory of 856 2432 7dppd.exe nhhbtn.exe PID 856 wrote to memory of 1352 856 nhhbtn.exe rlrlrrx.exe PID 856 wrote to memory of 1352 856 nhhbtn.exe rlrlrrx.exe PID 856 wrote to memory of 1352 856 nhhbtn.exe rlrlrrx.exe PID 1352 wrote to memory of 4964 1352 rlrlrrx.exe bhhhbb.exe PID 1352 wrote to memory of 4964 1352 rlrlrrx.exe bhhhbb.exe PID 1352 wrote to memory of 4964 1352 rlrlrrx.exe bhhhbb.exe PID 4964 wrote to memory of 5060 4964 bhhhbb.exe pjvjd.exe PID 4964 wrote to memory of 5060 4964 bhhhbb.exe pjvjd.exe PID 4964 wrote to memory of 5060 4964 bhhhbb.exe pjvjd.exe PID 5060 wrote to memory of 3692 5060 pjvjd.exe llffxxr.exe PID 5060 wrote to memory of 3692 5060 pjvjd.exe llffxxr.exe PID 5060 wrote to memory of 3692 5060 pjvjd.exe llffxxr.exe PID 3692 wrote to memory of 5020 3692 llffxxr.exe nbtnnh.exe PID 3692 wrote to memory of 5020 3692 llffxxr.exe nbtnnh.exe PID 3692 wrote to memory of 5020 3692 llffxxr.exe nbtnnh.exe PID 5020 wrote to memory of 368 5020 nbtnnh.exe 7vjvv.exe PID 5020 wrote to memory of 368 5020 nbtnnh.exe 7vjvv.exe PID 5020 wrote to memory of 368 5020 nbtnnh.exe 7vjvv.exe PID 368 wrote to memory of 4648 368 7vjvv.exe xllrrxx.exe PID 368 wrote to memory of 4648 368 7vjvv.exe xllrrxx.exe PID 368 wrote to memory of 4648 368 7vjvv.exe xllrrxx.exe PID 4648 wrote to memory of 712 4648 xllrrxx.exe 3rxrxxf.exe PID 4648 wrote to memory of 712 4648 xllrrxx.exe 3rxrxxf.exe PID 4648 wrote to memory of 712 4648 xllrrxx.exe 3rxrxxf.exe PID 712 wrote to memory of 4552 712 3rxrxxf.exe hbbbbb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d2457b01a542d1a6012f89e24fddc40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0d2457b01a542d1a6012f89e24fddc40_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\frxxlfl.exec:\frxxlfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\htbnbn.exec:\htbnbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvjdj.exec:\dvjdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrrllfl.exec:\lrrllfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\htnthh.exec:\htnthh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vdjdv.exec:\vdjdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xlrlllf.exec:\xlrlllf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnhnhh.exec:\tnhnhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\djpjv.exec:\djpjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfxffxf.exec:\lfxffxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvvpj.exec:\jvvpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7dppd.exec:\7dppd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhhbtn.exec:\nhhbtn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlrlrrx.exec:\rlrlrrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhhhbb.exec:\bhhhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjvjd.exec:\pjvjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llffxxr.exec:\llffxxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbtnnh.exec:\nbtnnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7vjvv.exec:\7vjvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xllrrxx.exec:\xllrrxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3rxrxxf.exec:\3rxrxxf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbbbbb.exec:\hbbbbb.exe23⤵
- Executes dropped EXE
-
\??\c:\djpjj.exec:\djpjj.exe24⤵
- Executes dropped EXE
-
\??\c:\xrrrxxx.exec:\xrrrxxx.exe25⤵
- Executes dropped EXE
-
\??\c:\hhnhbb.exec:\hhnhbb.exe26⤵
- Executes dropped EXE
-
\??\c:\1ppjj.exec:\1ppjj.exe27⤵
- Executes dropped EXE
-
\??\c:\7rfxxxx.exec:\7rfxxxx.exe28⤵
- Executes dropped EXE
-
\??\c:\1nnnbb.exec:\1nnnbb.exe29⤵
- Executes dropped EXE
-
\??\c:\7dvpj.exec:\7dvpj.exe30⤵
- Executes dropped EXE
-
\??\c:\ffxflff.exec:\ffxflff.exe31⤵
- Executes dropped EXE
-
\??\c:\btnhbt.exec:\btnhbt.exe32⤵
- Executes dropped EXE
-
\??\c:\pvjdd.exec:\pvjdd.exe33⤵
- Executes dropped EXE
-
\??\c:\rfrlfxr.exec:\rfrlfxr.exe34⤵
- Executes dropped EXE
-
\??\c:\tnbbbb.exec:\tnbbbb.exe35⤵
- Executes dropped EXE
-
\??\c:\ppjdd.exec:\ppjdd.exe36⤵
- Executes dropped EXE
-
\??\c:\3dpdd.exec:\3dpdd.exe37⤵
- Executes dropped EXE
-
\??\c:\lrxrllf.exec:\lrxrllf.exe38⤵
- Executes dropped EXE
-
\??\c:\ttbbbt.exec:\ttbbbt.exe39⤵
- Executes dropped EXE
-
\??\c:\jppdd.exec:\jppdd.exe40⤵
- Executes dropped EXE
-
\??\c:\7xxrffx.exec:\7xxrffx.exe41⤵
- Executes dropped EXE
-
\??\c:\1tnnbb.exec:\1tnnbb.exe42⤵
- Executes dropped EXE
-
\??\c:\thnhbb.exec:\thnhbb.exe43⤵
- Executes dropped EXE
-
\??\c:\jpppj.exec:\jpppj.exe44⤵
-
\??\c:\rrxrxxf.exec:\rrxrxxf.exe45⤵
- Executes dropped EXE
-
\??\c:\ffxxrrr.exec:\ffxxrrr.exe46⤵
- Executes dropped EXE
-
\??\c:\pjjdv.exec:\pjjdv.exe47⤵
- Executes dropped EXE
-
\??\c:\vpvjv.exec:\vpvjv.exe48⤵
- Executes dropped EXE
-
\??\c:\flllrlx.exec:\flllrlx.exe49⤵
- Executes dropped EXE
-
\??\c:\vpvvv.exec:\vpvvv.exe50⤵
- Executes dropped EXE
-
\??\c:\jdddd.exec:\jdddd.exe51⤵
- Executes dropped EXE
-
\??\c:\xxfxlrl.exec:\xxfxlrl.exe52⤵
- Executes dropped EXE
-
\??\c:\thhbnn.exec:\thhbnn.exe53⤵
- Executes dropped EXE
-
\??\c:\nnhhtt.exec:\nnhhtt.exe54⤵
- Executes dropped EXE
-
\??\c:\pvvpj.exec:\pvvpj.exe55⤵
- Executes dropped EXE
-
\??\c:\lrlxxfr.exec:\lrlxxfr.exe56⤵
- Executes dropped EXE
-
\??\c:\thnnnt.exec:\thnnnt.exe57⤵
- Executes dropped EXE
-
\??\c:\1pjpp.exec:\1pjpp.exe58⤵
- Executes dropped EXE
-
\??\c:\rrffxfl.exec:\rrffxfl.exe59⤵
- Executes dropped EXE
-
\??\c:\fxrrllf.exec:\fxrrllf.exe60⤵
- Executes dropped EXE
-
\??\c:\nnbbnn.exec:\nnbbnn.exe61⤵
- Executes dropped EXE
-
\??\c:\vdjjj.exec:\vdjjj.exe62⤵
- Executes dropped EXE
-
\??\c:\lfllxxx.exec:\lfllxxx.exe63⤵
- Executes dropped EXE
-
\??\c:\tbbttn.exec:\tbbttn.exe64⤵
- Executes dropped EXE
-
\??\c:\vppdj.exec:\vppdj.exe65⤵
- Executes dropped EXE
-
\??\c:\9dpjv.exec:\9dpjv.exe66⤵
- Executes dropped EXE
-
\??\c:\llxxflr.exec:\llxxflr.exe67⤵
-
\??\c:\tttntt.exec:\tttntt.exe68⤵
-
\??\c:\pvjdv.exec:\pvjdv.exe69⤵
-
\??\c:\llxrlrl.exec:\llxrlrl.exe70⤵
-
\??\c:\tbbbbb.exec:\tbbbbb.exe71⤵
-
\??\c:\pjjpj.exec:\pjjpj.exe72⤵
-
\??\c:\lffxrrr.exec:\lffxrrr.exe73⤵
-
\??\c:\lfllfff.exec:\lfllfff.exe74⤵
-
\??\c:\pvvdv.exec:\pvvdv.exe75⤵
-
\??\c:\lrfllll.exec:\lrfllll.exe76⤵
-
\??\c:\bhtnnh.exec:\bhtnnh.exe77⤵
-
\??\c:\ddjdd.exec:\ddjdd.exe78⤵
-
\??\c:\xflrffx.exec:\xflrffx.exe79⤵
-
\??\c:\frxrlrr.exec:\frxrlrr.exe80⤵
-
\??\c:\bbhttt.exec:\bbhttt.exe81⤵
-
\??\c:\ppdpd.exec:\ppdpd.exe82⤵
-
\??\c:\dpvpv.exec:\dpvpv.exe83⤵
-
\??\c:\3rlffll.exec:\3rlffll.exe84⤵
-
\??\c:\hbbnth.exec:\hbbnth.exe85⤵
-
\??\c:\pdjdd.exec:\pdjdd.exe86⤵
-
\??\c:\pjpjp.exec:\pjpjp.exe87⤵
-
\??\c:\llffxff.exec:\llffxff.exe88⤵
-
\??\c:\7llrlrl.exec:\7llrlrl.exe89⤵
-
\??\c:\1llfrxf.exec:\1llfrxf.exe90⤵
-
\??\c:\fllffll.exec:\fllffll.exe91⤵
-
\??\c:\nnbthn.exec:\nnbthn.exe92⤵
-
\??\c:\vvvpj.exec:\vvvpj.exe93⤵
-
\??\c:\lllfxxx.exec:\lllfxxx.exe94⤵
-
\??\c:\bttttt.exec:\bttttt.exe95⤵
-
\??\c:\hnhnbb.exec:\hnhnbb.exe96⤵
-
\??\c:\xxxxxff.exec:\xxxxxff.exe97⤵
-
\??\c:\fxxxxxx.exec:\fxxxxxx.exe98⤵
-
\??\c:\thbhtt.exec:\thbhtt.exe99⤵
-
\??\c:\dddvv.exec:\dddvv.exe100⤵
-
\??\c:\frrxflr.exec:\frrxflr.exe101⤵
-
\??\c:\7hnnhn.exec:\7hnnhn.exe102⤵
-
\??\c:\vpjjj.exec:\vpjjj.exe103⤵
-
\??\c:\xrrxfxl.exec:\xrrxfxl.exe104⤵
-
\??\c:\fxrrlxr.exec:\fxrrlxr.exe105⤵
-
\??\c:\ntbbhn.exec:\ntbbhn.exe106⤵
-
\??\c:\7nnnht.exec:\7nnnht.exe107⤵
-
\??\c:\jjjdp.exec:\jjjdp.exe108⤵
-
\??\c:\frfllll.exec:\frfllll.exe109⤵
-
\??\c:\bttttt.exec:\bttttt.exe110⤵
-
\??\c:\thnttn.exec:\thnttn.exe111⤵
-
\??\c:\jdpjd.exec:\jdpjd.exe112⤵
-
\??\c:\vjpdv.exec:\vjpdv.exe113⤵
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe114⤵
-
\??\c:\5rrrlll.exec:\5rrrlll.exe115⤵
-
\??\c:\nhnnnt.exec:\nhnnnt.exe116⤵
-
\??\c:\1jppj.exec:\1jppj.exe117⤵
-
\??\c:\vdddv.exec:\vdddv.exe118⤵
-
\??\c:\5fflxll.exec:\5fflxll.exe119⤵
-
\??\c:\bthhbb.exec:\bthhbb.exe120⤵
-
\??\c:\bhnnbh.exec:\bhnnbh.exe121⤵
-
\??\c:\9jpjj.exec:\9jpjj.exe122⤵
-
\??\c:\xllffll.exec:\xllffll.exe123⤵
-
\??\c:\bnttnn.exec:\bnttnn.exe124⤵
-
\??\c:\3lrrrrx.exec:\3lrrrrx.exe125⤵
-
\??\c:\hhnnbb.exec:\hhnnbb.exe126⤵
-
\??\c:\dpppj.exec:\dpppj.exe127⤵
-
\??\c:\rxfxxxx.exec:\rxfxxxx.exe128⤵
-
\??\c:\bthnbh.exec:\bthnbh.exe129⤵
-
\??\c:\bnnhbh.exec:\bnnhbh.exe130⤵
-
\??\c:\vpppp.exec:\vpppp.exe131⤵
-
\??\c:\xrrflfx.exec:\xrrflfx.exe132⤵
-
\??\c:\tbhbbb.exec:\tbhbbb.exe133⤵
-
\??\c:\pjjjv.exec:\pjjjv.exe134⤵
-
\??\c:\fxlfrrx.exec:\fxlfrrx.exe135⤵
-
\??\c:\llrxffx.exec:\llrxffx.exe136⤵
-
\??\c:\nbnnnt.exec:\nbnnnt.exe137⤵
-
\??\c:\9dppd.exec:\9dppd.exe138⤵
-
\??\c:\9pppp.exec:\9pppp.exe139⤵
-
\??\c:\frlfllf.exec:\frlfllf.exe140⤵
-
\??\c:\fflfxxx.exec:\fflfxxx.exe141⤵
-
\??\c:\htbhhh.exec:\htbhhh.exe142⤵
-
\??\c:\jvdvv.exec:\jvdvv.exe143⤵
-
\??\c:\rxfxllx.exec:\rxfxllx.exe144⤵
-
\??\c:\3thnhh.exec:\3thnhh.exe145⤵
-
\??\c:\dvdjp.exec:\dvdjp.exe146⤵
-
\??\c:\vvjpv.exec:\vvjpv.exe147⤵
-
\??\c:\xlrrrxf.exec:\xlrrrxf.exe148⤵
-
\??\c:\ttbnbt.exec:\ttbnbt.exe149⤵
-
\??\c:\bbtthh.exec:\bbtthh.exe150⤵
-
\??\c:\ffffxxx.exec:\ffffxxx.exe151⤵
-
\??\c:\nnbbnt.exec:\nnbbnt.exe152⤵
-
\??\c:\7vjpj.exec:\7vjpj.exe153⤵
-
\??\c:\xrffllr.exec:\xrffllr.exe154⤵
-
\??\c:\ttttnt.exec:\ttttnt.exe155⤵
-
\??\c:\pvjvp.exec:\pvjvp.exe156⤵
-
\??\c:\vpdvv.exec:\vpdvv.exe157⤵
-
\??\c:\ffxllfr.exec:\ffxllfr.exe158⤵
-
\??\c:\lxlfxll.exec:\lxlfxll.exe159⤵
-
\??\c:\nbhbth.exec:\nbhbth.exe160⤵
-
\??\c:\5pdjp.exec:\5pdjp.exe161⤵
-
\??\c:\pdvpj.exec:\pdvpj.exe162⤵
-
\??\c:\rllfxxx.exec:\rllfxxx.exe163⤵
-
\??\c:\lxfxxrr.exec:\lxfxxrr.exe164⤵
-
\??\c:\bnnnhn.exec:\bnnnhn.exe165⤵
-
\??\c:\djjjd.exec:\djjjd.exe166⤵
-
\??\c:\5jppp.exec:\5jppp.exe167⤵
-
\??\c:\xrrrrrr.exec:\xrrrrrr.exe168⤵
-
\??\c:\ttbhnt.exec:\ttbhnt.exe169⤵
-
\??\c:\7ntthn.exec:\7ntthn.exe170⤵
-
\??\c:\9dpjd.exec:\9dpjd.exe171⤵
-
\??\c:\9jvvp.exec:\9jvvp.exe172⤵
-
\??\c:\7ffrllx.exec:\7ffrllx.exe173⤵
-
\??\c:\hnthbn.exec:\hnthbn.exe174⤵
-
\??\c:\nnbbtt.exec:\nnbbtt.exe175⤵
-
\??\c:\pjppd.exec:\pjppd.exe176⤵
-
\??\c:\jdjjd.exec:\jdjjd.exe177⤵
-
\??\c:\lrlllll.exec:\lrlllll.exe178⤵
-
\??\c:\llllfll.exec:\llllfll.exe179⤵
-
\??\c:\ttnhnb.exec:\ttnhnb.exe180⤵
-
\??\c:\vjjjp.exec:\vjjjp.exe181⤵
-
\??\c:\1ppjd.exec:\1ppjd.exe182⤵
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe183⤵
-
\??\c:\3rxffrr.exec:\3rxffrr.exe184⤵
-
\??\c:\thnnbh.exec:\thnnbh.exe185⤵
-
\??\c:\jppvp.exec:\jppvp.exe186⤵
-
\??\c:\fffxlxx.exec:\fffxlxx.exe187⤵
-
\??\c:\nhhbhb.exec:\nhhbhb.exe188⤵
-
\??\c:\7pppp.exec:\7pppp.exe189⤵
-
\??\c:\pdvpv.exec:\pdvpv.exe190⤵
-
\??\c:\rxrflxx.exec:\rxrflxx.exe191⤵
-
\??\c:\hbnhhh.exec:\hbnhhh.exe192⤵
-
\??\c:\jpppj.exec:\jpppj.exe193⤵
-
\??\c:\ddpvp.exec:\ddpvp.exe194⤵
-
\??\c:\5ffxrxx.exec:\5ffxrxx.exe195⤵
-
\??\c:\9htntt.exec:\9htntt.exe196⤵
-
\??\c:\rrflfrr.exec:\rrflfrr.exe197⤵
-
\??\c:\bhbntt.exec:\bhbntt.exe198⤵
-
\??\c:\btbtnn.exec:\btbtnn.exe199⤵
-
\??\c:\vvjdv.exec:\vvjdv.exe200⤵
-
\??\c:\vdjjd.exec:\vdjjd.exe201⤵
-
\??\c:\rflxrll.exec:\rflxrll.exe202⤵
-
\??\c:\llrxxxx.exec:\llrxxxx.exe203⤵
-
\??\c:\tbnttb.exec:\tbnttb.exe204⤵
-
\??\c:\jdddp.exec:\jdddp.exe205⤵
-
\??\c:\dvpjd.exec:\dvpjd.exe206⤵
-
\??\c:\1llffff.exec:\1llffff.exe207⤵
-
\??\c:\xrffrrf.exec:\xrffrrf.exe208⤵
-
\??\c:\hhbttt.exec:\hhbttt.exe209⤵
-
\??\c:\jvjdv.exec:\jvjdv.exe210⤵
-
\??\c:\vpvvp.exec:\vpvvp.exe211⤵
-
\??\c:\rrfrrff.exec:\rrfrrff.exe212⤵
-
\??\c:\dppjd.exec:\dppjd.exe213⤵
-
\??\c:\7lffxll.exec:\7lffxll.exe214⤵
-
\??\c:\xrffffx.exec:\xrffffx.exe215⤵
-
\??\c:\hnnhbb.exec:\hnnhbb.exe216⤵
-
\??\c:\1vvvp.exec:\1vvvp.exe217⤵
-
\??\c:\pjddv.exec:\pjddv.exe218⤵
-
\??\c:\xxlrrfl.exec:\xxlrrfl.exe219⤵
-
\??\c:\lllflfr.exec:\lllflfr.exe220⤵
-
\??\c:\hbnnhh.exec:\hbnnhh.exe221⤵
-
\??\c:\vjppp.exec:\vjppp.exe222⤵
-
\??\c:\djjdp.exec:\djjdp.exe223⤵
-
\??\c:\rffllxx.exec:\rffllxx.exe224⤵
-
\??\c:\nhhbnh.exec:\nhhbnh.exe225⤵
-
\??\c:\1jvpj.exec:\1jvpj.exe226⤵
-
\??\c:\3vddd.exec:\3vddd.exe227⤵
-
\??\c:\7lfxrrl.exec:\7lfxrrl.exe228⤵
-
\??\c:\rlxffff.exec:\rlxffff.exe229⤵
-
\??\c:\tthntb.exec:\tthntb.exe230⤵
-
\??\c:\3jpvj.exec:\3jpvj.exe231⤵
-
\??\c:\ddvvv.exec:\ddvvv.exe232⤵
-
\??\c:\fflfxxx.exec:\fflfxxx.exe233⤵
-
\??\c:\rlxrxrl.exec:\rlxrxrl.exe234⤵
-
\??\c:\rfrllrl.exec:\rfrllrl.exe235⤵
-
\??\c:\3hnhbh.exec:\3hnhbh.exe236⤵
-
\??\c:\hhhhhn.exec:\hhhhhn.exe237⤵
-
\??\c:\9vdvp.exec:\9vdvp.exe238⤵
-
\??\c:\lfxfxll.exec:\lfxfxll.exe239⤵
-
\??\c:\fxlfffx.exec:\fxlfffx.exe240⤵
-
\??\c:\xlrrlrr.exec:\xlrrlrr.exe241⤵