Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 04:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1e5335b90b1e83a53cda2810fee2c0e0_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
1e5335b90b1e83a53cda2810fee2c0e0_NeikiAnalytics.exe
-
Size
54KB
-
MD5
1e5335b90b1e83a53cda2810fee2c0e0
-
SHA1
3fd5f9eeebbaf050f86324fa517102c79784b2ff
-
SHA256
026bea583af4279cd861e09755b5f2d424954849325a2d3b8ba8c5969b4b264c
-
SHA512
88da5c039884916349d647118096f56f09b671fb343e3c9cb547a3681cdd09adaf66bdb714aebb1fae5e7047b19079b5ffa2e40f3f8cfab7b7a9b159ea121c69
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFvt:ymb3NkkiQ3mdBjFIF1
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/4504-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1232-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1628-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4204-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3160-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4900-43-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4900-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3960-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1508-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2596-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/540-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3384-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4316-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4816-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2848-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3640-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2444-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2380-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1904-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4824-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1680-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4440-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3804-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4988-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
1dppj.exefxrlxrl.exe9thtbn.exenhbtnh.exepvdvp.exejdddv.exefrxrlll.exe5nhhht.exevpvpv.exejdpjp.exefrrrrrr.exebbtnnn.exejvdvj.exe7vdpp.exerxlfxfr.exehhtthh.exejppjd.exedddvj.exexxfxxxx.exehbhhhh.exedvddv.exedjjdp.exe3rlxrll.exexrlllll.exehtnhbt.exepddvp.exexxffllf.exerlrrxll.exenhhhhh.exedjjjj.exe5xlfxrr.exeflrrrrl.exettntnn.exentbhhn.exevpddv.exejvdvp.exerfxrxxx.exelxrxxff.exetnntth.exe9bhbbb.exepjdvp.exe7rffxfl.exebbnntt.exebbnntt.exe7djdv.exe1vvdv.exelfrlllr.exenthhhh.exevvvdd.exe1vdvp.exexlffflx.exetthhbb.exe3hhtnt.exevpdvp.exepjvvp.exefrfrfxx.exe3tttbb.exejvddd.exepjjdv.exelxrlfxx.exe1rxrlfx.exebbbnbb.exe7jjpj.exe5rxlffx.exepid process 1232 1dppj.exe 1508 fxrlxrl.exe 3960 9thtbn.exe 1628 nhbtnh.exe 4900 pvdvp.exe 3160 jdddv.exe 4204 frxrlll.exe 3440 5nhhht.exe 2596 vpvpv.exe 540 jdpjp.exe 3384 frrrrrr.exe 4316 bbtnnn.exe 4816 jvdvj.exe 4420 7vdpp.exe 2848 rxlfxfr.exe 3640 hhtthh.exe 2444 jppjd.exe 3744 dddvj.exe 2380 xxfxxxx.exe 1904 hbhhhh.exe 1680 dvddv.exe 4824 djjdp.exe 948 3rlxrll.exe 3984 xrlllll.exe 4440 htnhbt.exe 3804 pddvp.exe 1672 xxffllf.exe 1444 rlrrxll.exe 4508 nhhhhh.exe 2632 djjjj.exe 4988 5xlfxrr.exe 4932 flrrrrl.exe 4604 ttntnn.exe 4488 ntbhhn.exe 2412 vpddv.exe 2924 jvdvp.exe 2928 rfxrxxx.exe 1120 lxrxxff.exe 4480 tnntth.exe 4852 9bhbbb.exe 2696 pjdvp.exe 3760 7rffxfl.exe 1896 bbnntt.exe 3704 bbnntt.exe 2984 7djdv.exe 1208 1vvdv.exe 3980 lfrlllr.exe 4900 nthhhh.exe 2656 vvvdd.exe 3540 1vdvp.exe 656 xlffflx.exe 3416 tthhbb.exe 772 3hhtnt.exe 2116 vpdvp.exe 4984 pjvvp.exe 4848 frfrfxx.exe 2112 3tttbb.exe 4340 jvddd.exe 2288 pjjdv.exe 5000 lxrlfxx.exe 4080 1rxrlfx.exe 2848 bbbnbb.exe 3640 7jjpj.exe 4320 5rxlffx.exe -
Processes:
resource yara_rule behavioral2/memory/4504-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1232-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1628-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4204-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3960-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1508-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1508-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1508-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2596-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/540-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3384-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4316-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4816-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2848-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3640-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2444-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2380-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1904-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1680-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4440-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3804-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4508-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1e5335b90b1e83a53cda2810fee2c0e0_NeikiAnalytics.exe1dppj.exefxrlxrl.exe9thtbn.exenhbtnh.exepvdvp.exejdddv.exefrxrlll.exe5nhhht.exevpvpv.exejdpjp.exefrrrrrr.exebbtnnn.exejvdvj.exe7vdpp.exerxlfxfr.exehhtthh.exejppjd.exedddvj.exexxfxxxx.exehbhhhh.exedvddv.exedescription pid process target process PID 4504 wrote to memory of 1232 4504 1e5335b90b1e83a53cda2810fee2c0e0_NeikiAnalytics.exe 1dppj.exe PID 4504 wrote to memory of 1232 4504 1e5335b90b1e83a53cda2810fee2c0e0_NeikiAnalytics.exe 1dppj.exe PID 4504 wrote to memory of 1232 4504 1e5335b90b1e83a53cda2810fee2c0e0_NeikiAnalytics.exe 1dppj.exe PID 1232 wrote to memory of 1508 1232 1dppj.exe fxrlxrl.exe PID 1232 wrote to memory of 1508 1232 1dppj.exe fxrlxrl.exe PID 1232 wrote to memory of 1508 1232 1dppj.exe fxrlxrl.exe PID 1508 wrote to memory of 3960 1508 fxrlxrl.exe 9thtbn.exe PID 1508 wrote to memory of 3960 1508 fxrlxrl.exe 9thtbn.exe PID 1508 wrote to memory of 3960 1508 fxrlxrl.exe 9thtbn.exe PID 3960 wrote to memory of 1628 3960 9thtbn.exe nhbtnh.exe PID 3960 wrote to memory of 1628 3960 9thtbn.exe nhbtnh.exe PID 3960 wrote to memory of 1628 3960 9thtbn.exe nhbtnh.exe PID 1628 wrote to memory of 4900 1628 nhbtnh.exe pvdvp.exe PID 1628 wrote to memory of 4900 1628 nhbtnh.exe pvdvp.exe PID 1628 wrote to memory of 4900 1628 nhbtnh.exe pvdvp.exe PID 4900 wrote to memory of 3160 4900 pvdvp.exe jdddv.exe PID 4900 wrote to memory of 3160 4900 pvdvp.exe jdddv.exe PID 4900 wrote to memory of 3160 4900 pvdvp.exe jdddv.exe PID 3160 wrote to memory of 4204 3160 jdddv.exe frxrlll.exe PID 3160 wrote to memory of 4204 3160 jdddv.exe frxrlll.exe PID 3160 wrote to memory of 4204 3160 jdddv.exe frxrlll.exe PID 4204 wrote to memory of 3440 4204 frxrlll.exe 5nhhht.exe PID 4204 wrote to memory of 3440 4204 frxrlll.exe 5nhhht.exe PID 4204 wrote to memory of 3440 4204 frxrlll.exe 5nhhht.exe PID 3440 wrote to memory of 2596 3440 5nhhht.exe vpvpv.exe PID 3440 wrote to memory of 2596 3440 5nhhht.exe vpvpv.exe PID 3440 wrote to memory of 2596 3440 5nhhht.exe vpvpv.exe PID 2596 wrote to memory of 540 2596 vpvpv.exe jdpjp.exe PID 2596 wrote to memory of 540 2596 vpvpv.exe jdpjp.exe PID 2596 wrote to memory of 540 2596 vpvpv.exe jdpjp.exe PID 540 wrote to memory of 3384 540 jdpjp.exe frrrrrr.exe PID 540 wrote to memory of 3384 540 jdpjp.exe frrrrrr.exe PID 540 wrote to memory of 3384 540 jdpjp.exe frrrrrr.exe PID 3384 wrote to memory of 4316 3384 frrrrrr.exe bbtnnn.exe PID 3384 wrote to memory of 4316 3384 frrrrrr.exe bbtnnn.exe PID 3384 wrote to memory of 4316 3384 frrrrrr.exe bbtnnn.exe PID 4316 wrote to memory of 4816 4316 bbtnnn.exe jvdvj.exe PID 4316 wrote to memory of 4816 4316 bbtnnn.exe jvdvj.exe PID 4316 wrote to memory of 4816 4316 bbtnnn.exe jvdvj.exe PID 4816 wrote to memory of 4420 4816 jvdvj.exe 7vdpp.exe PID 4816 wrote to memory of 4420 4816 jvdvj.exe 7vdpp.exe PID 4816 wrote to memory of 4420 4816 jvdvj.exe 7vdpp.exe PID 4420 wrote to memory of 2848 4420 7vdpp.exe rxlfxfr.exe PID 4420 wrote to memory of 2848 4420 7vdpp.exe rxlfxfr.exe PID 4420 wrote to memory of 2848 4420 7vdpp.exe rxlfxfr.exe PID 2848 wrote to memory of 3640 2848 rxlfxfr.exe hhtthh.exe PID 2848 wrote to memory of 3640 2848 rxlfxfr.exe hhtthh.exe PID 2848 wrote to memory of 3640 2848 rxlfxfr.exe hhtthh.exe PID 3640 wrote to memory of 2444 3640 hhtthh.exe jppjd.exe PID 3640 wrote to memory of 2444 3640 hhtthh.exe jppjd.exe PID 3640 wrote to memory of 2444 3640 hhtthh.exe jppjd.exe PID 2444 wrote to memory of 3744 2444 jppjd.exe dddvj.exe PID 2444 wrote to memory of 3744 2444 jppjd.exe dddvj.exe PID 2444 wrote to memory of 3744 2444 jppjd.exe dddvj.exe PID 3744 wrote to memory of 2380 3744 dddvj.exe xxfxxxx.exe PID 3744 wrote to memory of 2380 3744 dddvj.exe xxfxxxx.exe PID 3744 wrote to memory of 2380 3744 dddvj.exe xxfxxxx.exe PID 2380 wrote to memory of 1904 2380 xxfxxxx.exe hbhhhh.exe PID 2380 wrote to memory of 1904 2380 xxfxxxx.exe hbhhhh.exe PID 2380 wrote to memory of 1904 2380 xxfxxxx.exe hbhhhh.exe PID 1904 wrote to memory of 1680 1904 hbhhhh.exe dvddv.exe PID 1904 wrote to memory of 1680 1904 hbhhhh.exe dvddv.exe PID 1904 wrote to memory of 1680 1904 hbhhhh.exe dvddv.exe PID 1680 wrote to memory of 4824 1680 dvddv.exe djjdp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e5335b90b1e83a53cda2810fee2c0e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1e5335b90b1e83a53cda2810fee2c0e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\1dppj.exec:\1dppj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxrlxrl.exec:\fxrlxrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9thtbn.exec:\9thtbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhbtnh.exec:\nhbtnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvdvp.exec:\pvdvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdddv.exec:\jdddv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frxrlll.exec:\frxrlll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5nhhht.exec:\5nhhht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpvpv.exec:\vpvpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdpjp.exec:\jdpjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frrrrrr.exec:\frrrrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbtnnn.exec:\bbtnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvdvj.exec:\jvdvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7vdpp.exec:\7vdpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rxlfxfr.exec:\rxlfxfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhtthh.exec:\hhtthh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jppjd.exec:\jppjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dddvj.exec:\dddvj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxfxxxx.exec:\xxfxxxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbhhhh.exec:\hbhhhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvddv.exec:\dvddv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\djjdp.exec:\djjdp.exe23⤵
- Executes dropped EXE
-
\??\c:\3rlxrll.exec:\3rlxrll.exe24⤵
- Executes dropped EXE
-
\??\c:\xrlllll.exec:\xrlllll.exe25⤵
- Executes dropped EXE
-
\??\c:\htnhbt.exec:\htnhbt.exe26⤵
- Executes dropped EXE
-
\??\c:\pddvp.exec:\pddvp.exe27⤵
- Executes dropped EXE
-
\??\c:\xxffllf.exec:\xxffllf.exe28⤵
- Executes dropped EXE
-
\??\c:\rlrrxll.exec:\rlrrxll.exe29⤵
- Executes dropped EXE
-
\??\c:\nhhhhh.exec:\nhhhhh.exe30⤵
- Executes dropped EXE
-
\??\c:\djjjj.exec:\djjjj.exe31⤵
- Executes dropped EXE
-
\??\c:\5xlfxrr.exec:\5xlfxrr.exe32⤵
- Executes dropped EXE
-
\??\c:\flrrrrl.exec:\flrrrrl.exe33⤵
- Executes dropped EXE
-
\??\c:\ttntnn.exec:\ttntnn.exe34⤵
- Executes dropped EXE
-
\??\c:\ntbhhn.exec:\ntbhhn.exe35⤵
- Executes dropped EXE
-
\??\c:\vpddv.exec:\vpddv.exe36⤵
- Executes dropped EXE
-
\??\c:\jvdvp.exec:\jvdvp.exe37⤵
- Executes dropped EXE
-
\??\c:\rfxrxxx.exec:\rfxrxxx.exe38⤵
- Executes dropped EXE
-
\??\c:\lxrxxff.exec:\lxrxxff.exe39⤵
- Executes dropped EXE
-
\??\c:\tnntth.exec:\tnntth.exe40⤵
- Executes dropped EXE
-
\??\c:\9bhbbb.exec:\9bhbbb.exe41⤵
- Executes dropped EXE
-
\??\c:\pjdvp.exec:\pjdvp.exe42⤵
- Executes dropped EXE
-
\??\c:\1djjd.exec:\1djjd.exe43⤵
-
\??\c:\7rffxfl.exec:\7rffxfl.exe44⤵
- Executes dropped EXE
-
\??\c:\bbnntt.exec:\bbnntt.exe45⤵
- Executes dropped EXE
-
\??\c:\bbnntt.exec:\bbnntt.exe46⤵
- Executes dropped EXE
-
\??\c:\7djdv.exec:\7djdv.exe47⤵
- Executes dropped EXE
-
\??\c:\1vvdv.exec:\1vvdv.exe48⤵
- Executes dropped EXE
-
\??\c:\lfrlllr.exec:\lfrlllr.exe49⤵
- Executes dropped EXE
-
\??\c:\nthhhh.exec:\nthhhh.exe50⤵
- Executes dropped EXE
-
\??\c:\vvvdd.exec:\vvvdd.exe51⤵
- Executes dropped EXE
-
\??\c:\1vdvp.exec:\1vdvp.exe52⤵
- Executes dropped EXE
-
\??\c:\xlffflx.exec:\xlffflx.exe53⤵
- Executes dropped EXE
-
\??\c:\tthhbb.exec:\tthhbb.exe54⤵
- Executes dropped EXE
-
\??\c:\3hhtnt.exec:\3hhtnt.exe55⤵
- Executes dropped EXE
-
\??\c:\vpdvp.exec:\vpdvp.exe56⤵
- Executes dropped EXE
-
\??\c:\pjvvp.exec:\pjvvp.exe57⤵
- Executes dropped EXE
-
\??\c:\frfrfxx.exec:\frfrfxx.exe58⤵
- Executes dropped EXE
-
\??\c:\3tttbb.exec:\3tttbb.exe59⤵
- Executes dropped EXE
-
\??\c:\jvddd.exec:\jvddd.exe60⤵
- Executes dropped EXE
-
\??\c:\pjjdv.exec:\pjjdv.exe61⤵
- Executes dropped EXE
-
\??\c:\lxrlfxx.exec:\lxrlfxx.exe62⤵
- Executes dropped EXE
-
\??\c:\1rxrlfx.exec:\1rxrlfx.exe63⤵
- Executes dropped EXE
-
\??\c:\bbbnbb.exec:\bbbnbb.exe64⤵
- Executes dropped EXE
-
\??\c:\7jjpj.exec:\7jjpj.exe65⤵
- Executes dropped EXE
-
\??\c:\5rxlffx.exec:\5rxlffx.exe66⤵
- Executes dropped EXE
-
\??\c:\hhttnn.exec:\hhttnn.exe67⤵
-
\??\c:\9ttnbb.exec:\9ttnbb.exe68⤵
-
\??\c:\3dvjv.exec:\3dvjv.exe69⤵
-
\??\c:\5ddvj.exec:\5ddvj.exe70⤵
-
\??\c:\7xxrlrr.exec:\7xxrlrr.exe71⤵
-
\??\c:\bhbbnh.exec:\bhbbnh.exe72⤵
-
\??\c:\pdjvd.exec:\pdjvd.exe73⤵
-
\??\c:\jvvpj.exec:\jvvpj.exe74⤵
-
\??\c:\rxllllf.exec:\rxllllf.exe75⤵
-
\??\c:\bnttbb.exec:\bnttbb.exe76⤵
-
\??\c:\hhbhbb.exec:\hhbhbb.exe77⤵
-
\??\c:\dvdpj.exec:\dvdpj.exe78⤵
-
\??\c:\xrrlffx.exec:\xrrlffx.exe79⤵
-
\??\c:\7rxxxxr.exec:\7rxxxxr.exe80⤵
-
\??\c:\hnhhnn.exec:\hnhhnn.exe81⤵
-
\??\c:\dpvvv.exec:\dpvvv.exe82⤵
-
\??\c:\fxllrrx.exec:\fxllrrx.exe83⤵
-
\??\c:\rlffrll.exec:\rlffrll.exe84⤵
-
\??\c:\vpvvp.exec:\vpvvp.exe85⤵
-
\??\c:\vdvjp.exec:\vdvjp.exe86⤵
-
\??\c:\llfffff.exec:\llfffff.exe87⤵
-
\??\c:\3lffxxx.exec:\3lffxxx.exe88⤵
-
\??\c:\nhnntt.exec:\nhnntt.exe89⤵
-
\??\c:\1jjjv.exec:\1jjjv.exe90⤵
-
\??\c:\lllfrrr.exec:\lllfrrr.exe91⤵
-
\??\c:\lxrrrxr.exec:\lxrrrxr.exe92⤵
-
\??\c:\nnnbtt.exec:\nnnbtt.exe93⤵
-
\??\c:\1jjdv.exec:\1jjdv.exe94⤵
-
\??\c:\dpdvj.exec:\dpdvj.exe95⤵
-
\??\c:\5rrrlll.exec:\5rrrlll.exe96⤵
-
\??\c:\vjpjd.exec:\vjpjd.exe97⤵
-
\??\c:\pvpjd.exec:\pvpjd.exe98⤵
-
\??\c:\frxxxxx.exec:\frxxxxx.exe99⤵
-
\??\c:\hbhhnt.exec:\hbhhnt.exe100⤵
-
\??\c:\hbtnnn.exec:\hbtnnn.exe101⤵
-
\??\c:\jjdvv.exec:\jjdvv.exe102⤵
-
\??\c:\rlrlfrr.exec:\rlrlfrr.exe103⤵
-
\??\c:\lfffxxx.exec:\lfffxxx.exe104⤵
-
\??\c:\nhhbbb.exec:\nhhbbb.exe105⤵
-
\??\c:\tbnbtt.exec:\tbnbtt.exe106⤵
-
\??\c:\pvddv.exec:\pvddv.exe107⤵
-
\??\c:\flrlxxx.exec:\flrlxxx.exe108⤵
-
\??\c:\rlrrrrx.exec:\rlrrrrx.exe109⤵
-
\??\c:\9hbhtt.exec:\9hbhtt.exe110⤵
-
\??\c:\vpjjd.exec:\vpjjd.exe111⤵
-
\??\c:\dddvd.exec:\dddvd.exe112⤵
-
\??\c:\frxxrxr.exec:\frxxrxr.exe113⤵
-
\??\c:\xlxxxxr.exec:\xlxxxxr.exe114⤵
-
\??\c:\hbnnbn.exec:\hbnnbn.exe115⤵
-
\??\c:\nhnhhh.exec:\nhnhhh.exe116⤵
-
\??\c:\pdvpj.exec:\pdvpj.exe117⤵
-
\??\c:\7jpdv.exec:\7jpdv.exe118⤵
-
\??\c:\llrrlll.exec:\llrrlll.exe119⤵
-
\??\c:\7xxrllf.exec:\7xxrllf.exe120⤵
-
\??\c:\bbhhhn.exec:\bbhhhn.exe121⤵
-
\??\c:\dpppp.exec:\dpppp.exe122⤵
-
\??\c:\djjjv.exec:\djjjv.exe123⤵
-
\??\c:\rlllrrr.exec:\rlllrrr.exe124⤵
-
\??\c:\xfxfxxr.exec:\xfxfxxr.exe125⤵
-
\??\c:\vjppj.exec:\vjppj.exe126⤵
-
\??\c:\xlllffl.exec:\xlllffl.exe127⤵
-
\??\c:\flrrlff.exec:\flrrlff.exe128⤵
-
\??\c:\ntttbb.exec:\ntttbb.exe129⤵
-
\??\c:\nnttbb.exec:\nnttbb.exe130⤵
-
\??\c:\jvvpj.exec:\jvvpj.exe131⤵
-
\??\c:\ddppj.exec:\ddppj.exe132⤵
-
\??\c:\fxxrllf.exec:\fxxrllf.exe133⤵
-
\??\c:\fxlfrrf.exec:\fxlfrrf.exe134⤵
-
\??\c:\hthhhh.exec:\hthhhh.exe135⤵
-
\??\c:\pjjpp.exec:\pjjpp.exe136⤵
-
\??\c:\ppvpj.exec:\ppvpj.exe137⤵
-
\??\c:\llffrrr.exec:\llffrrr.exe138⤵
-
\??\c:\rrrrrrr.exec:\rrrrrrr.exe139⤵
-
\??\c:\hbnnnn.exec:\hbnnnn.exe140⤵
-
\??\c:\thhbtt.exec:\thhbtt.exe141⤵
-
\??\c:\rxfflfl.exec:\rxfflfl.exe142⤵
-
\??\c:\pjpdv.exec:\pjpdv.exe143⤵
-
\??\c:\7xfxrrl.exec:\7xfxrrl.exe144⤵
-
\??\c:\pvdvd.exec:\pvdvd.exe145⤵
-
\??\c:\3lrfxxr.exec:\3lrfxxr.exe146⤵
-
\??\c:\5dpjj.exec:\5dpjj.exe147⤵
-
\??\c:\9xffxxr.exec:\9xffxxr.exe148⤵
-
\??\c:\7hnhbb.exec:\7hnhbb.exe149⤵
-
\??\c:\3ttbht.exec:\3ttbht.exe150⤵
-
\??\c:\fflrrrl.exec:\fflrrrl.exe151⤵
-
\??\c:\7nnbtt.exec:\7nnbtt.exe152⤵
-
\??\c:\vdjpj.exec:\vdjpj.exe153⤵
-
\??\c:\1jpdp.exec:\1jpdp.exe154⤵
-
\??\c:\frffffl.exec:\frffffl.exe155⤵
-
\??\c:\5lrrlrf.exec:\5lrrlrf.exe156⤵
-
\??\c:\tntbbb.exec:\tntbbb.exe157⤵
-
\??\c:\tnhhbb.exec:\tnhhbb.exe158⤵
-
\??\c:\3dvpp.exec:\3dvpp.exe159⤵
-
\??\c:\hhttnn.exec:\hhttnn.exe160⤵
-
\??\c:\1hthtb.exec:\1hthtb.exe161⤵
-
\??\c:\7pjvp.exec:\7pjvp.exe162⤵
-
\??\c:\djvpp.exec:\djvpp.exe163⤵
-
\??\c:\lxllllf.exec:\lxllllf.exe164⤵
-
\??\c:\ttnnhh.exec:\ttnnhh.exe165⤵
-
\??\c:\hbbtbt.exec:\hbbtbt.exe166⤵
-
\??\c:\pjjjp.exec:\pjjjp.exe167⤵
-
\??\c:\9djdd.exec:\9djdd.exe168⤵
-
\??\c:\fxrlxxf.exec:\fxrlxxf.exe169⤵
-
\??\c:\lfxxrrr.exec:\lfxxrrr.exe170⤵
-
\??\c:\tbbnhh.exec:\tbbnhh.exe171⤵
-
\??\c:\htbtnn.exec:\htbtnn.exe172⤵
-
\??\c:\vpjpj.exec:\vpjpj.exe173⤵
-
\??\c:\jvpvj.exec:\jvpvj.exe174⤵
-
\??\c:\jddjj.exec:\jddjj.exe175⤵
-
\??\c:\xrlfxll.exec:\xrlfxll.exe176⤵
-
\??\c:\rfxrrrl.exec:\rfxrrrl.exe177⤵
-
\??\c:\bbbbbh.exec:\bbbbbh.exe178⤵
-
\??\c:\btnhnn.exec:\btnhnn.exe179⤵
-
\??\c:\dvddp.exec:\dvddp.exe180⤵
-
\??\c:\rxlfxxr.exec:\rxlfxxr.exe181⤵
-
\??\c:\htbbbb.exec:\htbbbb.exe182⤵
-
\??\c:\3bhbtt.exec:\3bhbtt.exe183⤵
-
\??\c:\vvvdv.exec:\vvvdv.exe184⤵
-
\??\c:\ddjdv.exec:\ddjdv.exe185⤵
-
\??\c:\lfrrxrx.exec:\lfrrxrx.exe186⤵
-
\??\c:\fxrfrfx.exec:\fxrfrfx.exe187⤵
-
\??\c:\nnttnt.exec:\nnttnt.exe188⤵
-
\??\c:\ttnhht.exec:\ttnhht.exe189⤵
-
\??\c:\jddvp.exec:\jddvp.exe190⤵
-
\??\c:\jddjd.exec:\jddjd.exe191⤵
-
\??\c:\rrxxrrr.exec:\rrxxrrr.exe192⤵
-
\??\c:\hnnntb.exec:\hnnntb.exe193⤵
-
\??\c:\bthnbh.exec:\bthnbh.exe194⤵
-
\??\c:\vvjdj.exec:\vvjdj.exe195⤵
-
\??\c:\1jppj.exec:\1jppj.exe196⤵
-
\??\c:\rrxxrrr.exec:\rrxxrrr.exe197⤵
-
\??\c:\ffrrxff.exec:\ffrrxff.exe198⤵
-
\??\c:\nhhhbb.exec:\nhhhbb.exe199⤵
-
\??\c:\jjdvj.exec:\jjdvj.exe200⤵
-
\??\c:\5jjpd.exec:\5jjpd.exe201⤵
-
\??\c:\xlxrfff.exec:\xlxrfff.exe202⤵
-
\??\c:\rrfffff.exec:\rrfffff.exe203⤵
-
\??\c:\bntttt.exec:\bntttt.exe204⤵
-
\??\c:\pdvvd.exec:\pdvvd.exe205⤵
-
\??\c:\1xxxrrr.exec:\1xxxrrr.exe206⤵
-
\??\c:\9fxrflr.exec:\9fxrflr.exe207⤵
-
\??\c:\tnttnn.exec:\tnttnn.exe208⤵
-
\??\c:\htbbbb.exec:\htbbbb.exe209⤵
-
\??\c:\7dpvv.exec:\7dpvv.exe210⤵
-
\??\c:\5ppdd.exec:\5ppdd.exe211⤵
-
\??\c:\ffxrllx.exec:\ffxrllx.exe212⤵
-
\??\c:\tnhhtb.exec:\tnhhtb.exe213⤵
-
\??\c:\hbbthh.exec:\hbbthh.exe214⤵
-
\??\c:\9vddv.exec:\9vddv.exe215⤵
-
\??\c:\ppvdv.exec:\ppvdv.exe216⤵
-
\??\c:\lfllfrl.exec:\lfllfrl.exe217⤵
-
\??\c:\5hhhhb.exec:\5hhhhb.exe218⤵
-
\??\c:\3bhhth.exec:\3bhhth.exe219⤵
-
\??\c:\pdpdp.exec:\pdpdp.exe220⤵
-
\??\c:\9ppjv.exec:\9ppjv.exe221⤵
-
\??\c:\llxxrrl.exec:\llxxrrl.exe222⤵
-
\??\c:\thbthh.exec:\thbthh.exe223⤵
-
\??\c:\nthhbb.exec:\nthhbb.exe224⤵
-
\??\c:\vpdjv.exec:\vpdjv.exe225⤵
-
\??\c:\fxllfff.exec:\fxllfff.exe226⤵
-
\??\c:\thnhhh.exec:\thnhhh.exe227⤵
-
\??\c:\nhtntt.exec:\nhtntt.exe228⤵
-
\??\c:\vvjdj.exec:\vvjdj.exe229⤵
-
\??\c:\9jdvj.exec:\9jdvj.exe230⤵
-
\??\c:\xlxrrrr.exec:\xlxrrrr.exe231⤵
-
\??\c:\9rlfxfx.exec:\9rlfxfx.exe232⤵
-
\??\c:\hbbnhb.exec:\hbbnhb.exe233⤵
-
\??\c:\vvpdp.exec:\vvpdp.exe234⤵
-
\??\c:\vdjvj.exec:\vdjvj.exe235⤵
-
\??\c:\lfllflf.exec:\lfllflf.exe236⤵
-
\??\c:\ntbtbb.exec:\ntbtbb.exe237⤵
-
\??\c:\1ntttt.exec:\1ntttt.exe238⤵
-
\??\c:\ppdpp.exec:\ppdpp.exe239⤵
-
\??\c:\jjpvp.exec:\jjpvp.exe240⤵
-
\??\c:\fxllxxl.exec:\fxllxxl.exe241⤵