Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 05:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
20c2ae1adf98979e676e81903e75a800_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
20c2ae1adf98979e676e81903e75a800_NeikiAnalytics.exe
-
Size
75KB
-
MD5
20c2ae1adf98979e676e81903e75a800
-
SHA1
90a9e1d227a8f2734fce9e66ce95a9d13125c822
-
SHA256
066e197becd04e501bb1faf937568c4b021aaac23b7765ee6b7f911fda05e686
-
SHA512
4bcad320fece15228c96188cebb7d8bfff8f69bc66fdee5138dcd48afc5746b29eb0f882c792528726bd8579e37b30b70a73dacf125fc7cf0eb609d6e22aa8dc
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIoAh2QpUnX1A2:ymb3NkkiQ3mdBjFIsIVbpUH
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/2580-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4684-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3224-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/944-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3868-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2068-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2328-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4964-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1272-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2444-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1912-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3376-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3424-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4704-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4064-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2612-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rxxrfxx.exe1hhhnn.exenhhhhh.exe3vddv.exe5lxlflf.exe1bnthn.exe7tnbbh.exerlxrfff.exefrffxff.exepvdvv.exerrffflr.exerxlxfxx.exe5vjjj.exe1ffxrrl.exebtbhbb.exebttnhh.exedppjj.exefxfxrlf.exe1hbnbt.exepjddd.exe7lfxrrl.exebbntbn.exevvdjj.exerflfrrl.exennhthh.exepjvvv.exerrxxrxr.exetbtnhh.exeddjdd.exelfrlrrr.exexlrrrrr.exehbnnbh.exedvppj.exeffffllr.exefxllfll.exe9tnnnt.exejjvvd.exe5pvvv.exexxlflfl.exe7ntttt.exe1nbbbb.exedvvpd.exevvvvd.exellxrrlf.exe7nhbhh.exeddddv.exe5xlrrxx.exenbbbhn.exepdddd.exe3rxrllf.exexxlrffl.exettttnn.exehbtttt.exepppjj.exelxxxrrr.exe5xlrrrr.exethhhhh.exejpjjj.exefxlfflf.exexrffxxr.exebthhnn.exejdpdd.exeppvvp.exelflfxxx.exepid process 4684 rxxrfxx.exe 3224 1hhhnn.exe 116 nhhhhh.exe 944 3vddv.exe 4756 5lxlflf.exe 3712 1bnthn.exe 3044 7tnbbh.exe 1832 rlxrfff.exe 3984 frffxff.exe 4976 pvdvv.exe 3624 rrffflr.exe 3868 rxlxfxx.exe 2068 5vjjj.exe 2328 1ffxrrl.exe 4996 btbhbb.exe 4964 bttnhh.exe 5060 dppjj.exe 3456 fxfxrlf.exe 4700 1hbnbt.exe 5116 pjddd.exe 1272 7lfxrrl.exe 2444 bbntbn.exe 1912 vvdjj.exe 3376 rflfrrl.exe 3424 nnhthh.exe 4704 pjvvv.exe 4064 rrxxrxr.exe 4988 tbtnhh.exe 2612 ddjdd.exe 4896 lfrlrrr.exe 2040 xlrrrrr.exe 3660 hbnnbh.exe 3436 dvppj.exe 2492 ffffllr.exe 1392 fxllfll.exe 2372 9tnnnt.exe 4616 jjvvd.exe 2620 5pvvv.exe 5064 xxlflfl.exe 4564 7ntttt.exe 4528 1nbbbb.exe 4876 dvvpd.exe 2396 vvvvd.exe 3252 llxrrlf.exe 224 7nhbhh.exe 4600 ddddv.exe 4124 5xlrrxx.exe 3560 nbbbhn.exe 2540 pdddd.exe 3152 3rxrllf.exe 1076 xxlrffl.exe 1396 ttttnn.exe 4992 hbtttt.exe 4976 pppjj.exe 2512 lxxxrrr.exe 2412 5xlrrrr.exe 5088 thhhhh.exe 2328 jpjjj.exe 3992 fxlfflf.exe 1224 xrffxxr.exe 1208 bthhnn.exe 5060 jdpdd.exe 1416 ppvvp.exe 1308 lflfxxx.exe -
Processes:
resource yara_rule behavioral2/memory/2580-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4684-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3224-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/944-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3984-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3868-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2068-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4964-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1272-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2444-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1912-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3376-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3424-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4704-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4064-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2612-189-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
20c2ae1adf98979e676e81903e75a800_NeikiAnalytics.exerxxrfxx.exe1hhhnn.exenhhhhh.exe3vddv.exe5lxlflf.exe1bnthn.exe7tnbbh.exerlxrfff.exefrffxff.exepvdvv.exerrffflr.exerxlxfxx.exe5vjjj.exe1ffxrrl.exebtbhbb.exebttnhh.exedppjj.exefxfxrlf.exe1hbnbt.exepjddd.exe7lfxrrl.exedescription pid process target process PID 2580 wrote to memory of 4684 2580 20c2ae1adf98979e676e81903e75a800_NeikiAnalytics.exe rxxrfxx.exe PID 2580 wrote to memory of 4684 2580 20c2ae1adf98979e676e81903e75a800_NeikiAnalytics.exe rxxrfxx.exe PID 2580 wrote to memory of 4684 2580 20c2ae1adf98979e676e81903e75a800_NeikiAnalytics.exe rxxrfxx.exe PID 4684 wrote to memory of 3224 4684 rxxrfxx.exe 1hhhnn.exe PID 4684 wrote to memory of 3224 4684 rxxrfxx.exe 1hhhnn.exe PID 4684 wrote to memory of 3224 4684 rxxrfxx.exe 1hhhnn.exe PID 3224 wrote to memory of 116 3224 1hhhnn.exe nhhhhh.exe PID 3224 wrote to memory of 116 3224 1hhhnn.exe nhhhhh.exe PID 3224 wrote to memory of 116 3224 1hhhnn.exe nhhhhh.exe PID 116 wrote to memory of 944 116 nhhhhh.exe 3vddv.exe PID 116 wrote to memory of 944 116 nhhhhh.exe 3vddv.exe PID 116 wrote to memory of 944 116 nhhhhh.exe 3vddv.exe PID 944 wrote to memory of 4756 944 3vddv.exe 5lxlflf.exe PID 944 wrote to memory of 4756 944 3vddv.exe 5lxlflf.exe PID 944 wrote to memory of 4756 944 3vddv.exe 5lxlflf.exe PID 4756 wrote to memory of 3712 4756 5lxlflf.exe 1bnthn.exe PID 4756 wrote to memory of 3712 4756 5lxlflf.exe 1bnthn.exe PID 4756 wrote to memory of 3712 4756 5lxlflf.exe 1bnthn.exe PID 3712 wrote to memory of 3044 3712 1bnthn.exe 7tnbbh.exe PID 3712 wrote to memory of 3044 3712 1bnthn.exe 7tnbbh.exe PID 3712 wrote to memory of 3044 3712 1bnthn.exe 7tnbbh.exe PID 3044 wrote to memory of 1832 3044 7tnbbh.exe rlxrfff.exe PID 3044 wrote to memory of 1832 3044 7tnbbh.exe rlxrfff.exe PID 3044 wrote to memory of 1832 3044 7tnbbh.exe rlxrfff.exe PID 1832 wrote to memory of 3984 1832 rlxrfff.exe frffxff.exe PID 1832 wrote to memory of 3984 1832 rlxrfff.exe frffxff.exe PID 1832 wrote to memory of 3984 1832 rlxrfff.exe frffxff.exe PID 3984 wrote to memory of 4976 3984 frffxff.exe pvdvv.exe PID 3984 wrote to memory of 4976 3984 frffxff.exe pvdvv.exe PID 3984 wrote to memory of 4976 3984 frffxff.exe pvdvv.exe PID 4976 wrote to memory of 3624 4976 pvdvv.exe rrffflr.exe PID 4976 wrote to memory of 3624 4976 pvdvv.exe rrffflr.exe PID 4976 wrote to memory of 3624 4976 pvdvv.exe rrffflr.exe PID 3624 wrote to memory of 3868 3624 rrffflr.exe rxlxfxx.exe PID 3624 wrote to memory of 3868 3624 rrffflr.exe rxlxfxx.exe PID 3624 wrote to memory of 3868 3624 rrffflr.exe rxlxfxx.exe PID 3868 wrote to memory of 2068 3868 rxlxfxx.exe 5vjjj.exe PID 3868 wrote to memory of 2068 3868 rxlxfxx.exe 5vjjj.exe PID 3868 wrote to memory of 2068 3868 rxlxfxx.exe 5vjjj.exe PID 2068 wrote to memory of 2328 2068 5vjjj.exe 1ffxrrl.exe PID 2068 wrote to memory of 2328 2068 5vjjj.exe 1ffxrrl.exe PID 2068 wrote to memory of 2328 2068 5vjjj.exe 1ffxrrl.exe PID 2328 wrote to memory of 4996 2328 1ffxrrl.exe btbhbb.exe PID 2328 wrote to memory of 4996 2328 1ffxrrl.exe btbhbb.exe PID 2328 wrote to memory of 4996 2328 1ffxrrl.exe btbhbb.exe PID 4996 wrote to memory of 4964 4996 btbhbb.exe bttnhh.exe PID 4996 wrote to memory of 4964 4996 btbhbb.exe bttnhh.exe PID 4996 wrote to memory of 4964 4996 btbhbb.exe bttnhh.exe PID 4964 wrote to memory of 5060 4964 bttnhh.exe dppjj.exe PID 4964 wrote to memory of 5060 4964 bttnhh.exe dppjj.exe PID 4964 wrote to memory of 5060 4964 bttnhh.exe dppjj.exe PID 5060 wrote to memory of 3456 5060 dppjj.exe fxfxrlf.exe PID 5060 wrote to memory of 3456 5060 dppjj.exe fxfxrlf.exe PID 5060 wrote to memory of 3456 5060 dppjj.exe fxfxrlf.exe PID 3456 wrote to memory of 4700 3456 fxfxrlf.exe 1hbnbt.exe PID 3456 wrote to memory of 4700 3456 fxfxrlf.exe 1hbnbt.exe PID 3456 wrote to memory of 4700 3456 fxfxrlf.exe 1hbnbt.exe PID 4700 wrote to memory of 5116 4700 1hbnbt.exe pjddd.exe PID 4700 wrote to memory of 5116 4700 1hbnbt.exe pjddd.exe PID 4700 wrote to memory of 5116 4700 1hbnbt.exe pjddd.exe PID 5116 wrote to memory of 1272 5116 pjddd.exe 7lfxrrl.exe PID 5116 wrote to memory of 1272 5116 pjddd.exe 7lfxrrl.exe PID 5116 wrote to memory of 1272 5116 pjddd.exe 7lfxrrl.exe PID 1272 wrote to memory of 2444 1272 7lfxrrl.exe bbntbn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\20c2ae1adf98979e676e81903e75a800_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\20c2ae1adf98979e676e81903e75a800_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\rxxrfxx.exec:\rxxrfxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1hhhnn.exec:\1hhhnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhhhhh.exec:\nhhhhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3vddv.exec:\3vddv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5lxlflf.exec:\5lxlflf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1bnthn.exec:\1bnthn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7tnbbh.exec:\7tnbbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlxrfff.exec:\rlxrfff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frffxff.exec:\frffxff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvdvv.exec:\pvdvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrffflr.exec:\rrffflr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rxlxfxx.exec:\rxlxfxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5vjjj.exec:\5vjjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1ffxrrl.exec:\1ffxrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btbhbb.exec:\btbhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bttnhh.exec:\bttnhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dppjj.exec:\dppjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxfxrlf.exec:\fxfxrlf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1hbnbt.exec:\1hbnbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjddd.exec:\pjddd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7lfxrrl.exec:\7lfxrrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbntbn.exec:\bbntbn.exe23⤵
- Executes dropped EXE
-
\??\c:\vvdjj.exec:\vvdjj.exe24⤵
- Executes dropped EXE
-
\??\c:\rflfrrl.exec:\rflfrrl.exe25⤵
- Executes dropped EXE
-
\??\c:\nnhthh.exec:\nnhthh.exe26⤵
- Executes dropped EXE
-
\??\c:\pjvvv.exec:\pjvvv.exe27⤵
- Executes dropped EXE
-
\??\c:\rrxxrxr.exec:\rrxxrxr.exe28⤵
- Executes dropped EXE
-
\??\c:\tbtnhh.exec:\tbtnhh.exe29⤵
- Executes dropped EXE
-
\??\c:\ddjdd.exec:\ddjdd.exe30⤵
- Executes dropped EXE
-
\??\c:\lfrlrrr.exec:\lfrlrrr.exe31⤵
- Executes dropped EXE
-
\??\c:\xlrrrrr.exec:\xlrrrrr.exe32⤵
- Executes dropped EXE
-
\??\c:\hbnnbh.exec:\hbnnbh.exe33⤵
- Executes dropped EXE
-
\??\c:\dvppj.exec:\dvppj.exe34⤵
- Executes dropped EXE
-
\??\c:\ffffllr.exec:\ffffllr.exe35⤵
- Executes dropped EXE
-
\??\c:\fxllfll.exec:\fxllfll.exe36⤵
- Executes dropped EXE
-
\??\c:\9tnnnt.exec:\9tnnnt.exe37⤵
- Executes dropped EXE
-
\??\c:\jjvvd.exec:\jjvvd.exe38⤵
- Executes dropped EXE
-
\??\c:\5pvvv.exec:\5pvvv.exe39⤵
- Executes dropped EXE
-
\??\c:\xxlflfl.exec:\xxlflfl.exe40⤵
- Executes dropped EXE
-
\??\c:\7ntttt.exec:\7ntttt.exe41⤵
- Executes dropped EXE
-
\??\c:\1nbbbb.exec:\1nbbbb.exe42⤵
- Executes dropped EXE
-
\??\c:\dvvpd.exec:\dvvpd.exe43⤵
- Executes dropped EXE
-
\??\c:\vvvvd.exec:\vvvvd.exe44⤵
- Executes dropped EXE
-
\??\c:\llxrrlf.exec:\llxrrlf.exe45⤵
- Executes dropped EXE
-
\??\c:\7nhbhh.exec:\7nhbhh.exe46⤵
- Executes dropped EXE
-
\??\c:\ddddv.exec:\ddddv.exe47⤵
- Executes dropped EXE
-
\??\c:\5xlrrxx.exec:\5xlrrxx.exe48⤵
- Executes dropped EXE
-
\??\c:\nbbbhn.exec:\nbbbhn.exe49⤵
- Executes dropped EXE
-
\??\c:\pdddd.exec:\pdddd.exe50⤵
- Executes dropped EXE
-
\??\c:\3rxrllf.exec:\3rxrllf.exe51⤵
- Executes dropped EXE
-
\??\c:\xxlrffl.exec:\xxlrffl.exe52⤵
- Executes dropped EXE
-
\??\c:\ttttnn.exec:\ttttnn.exe53⤵
- Executes dropped EXE
-
\??\c:\hbtttt.exec:\hbtttt.exe54⤵
- Executes dropped EXE
-
\??\c:\pppjj.exec:\pppjj.exe55⤵
- Executes dropped EXE
-
\??\c:\lxxxrrr.exec:\lxxxrrr.exe56⤵
- Executes dropped EXE
-
\??\c:\5xlrrrr.exec:\5xlrrrr.exe57⤵
- Executes dropped EXE
-
\??\c:\thhhhh.exec:\thhhhh.exe58⤵
- Executes dropped EXE
-
\??\c:\jpjjj.exec:\jpjjj.exe59⤵
- Executes dropped EXE
-
\??\c:\fxlfflf.exec:\fxlfflf.exe60⤵
- Executes dropped EXE
-
\??\c:\xrffxxr.exec:\xrffxxr.exe61⤵
- Executes dropped EXE
-
\??\c:\bthhnn.exec:\bthhnn.exe62⤵
- Executes dropped EXE
-
\??\c:\jdpdd.exec:\jdpdd.exe63⤵
- Executes dropped EXE
-
\??\c:\ppvvp.exec:\ppvvp.exe64⤵
- Executes dropped EXE
-
\??\c:\lflfxxx.exec:\lflfxxx.exe65⤵
- Executes dropped EXE
-
\??\c:\xxllrxf.exec:\xxllrxf.exe66⤵
-
\??\c:\hbbbbb.exec:\hbbbbb.exe67⤵
-
\??\c:\ppjdd.exec:\ppjdd.exe68⤵
-
\??\c:\jdjdd.exec:\jdjdd.exe69⤵
-
\??\c:\xrlxrrr.exec:\xrlxrrr.exe70⤵
-
\??\c:\9tttnt.exec:\9tttnt.exe71⤵
-
\??\c:\hhtnbt.exec:\hhtnbt.exe72⤵
-
\??\c:\lflllrf.exec:\lflllrf.exe73⤵
-
\??\c:\rllfffr.exec:\rllfffr.exe74⤵
-
\??\c:\bbhbnn.exec:\bbhbnn.exe75⤵
-
\??\c:\jdjdv.exec:\jdjdv.exe76⤵
-
\??\c:\jpvpj.exec:\jpvpj.exe77⤵
-
\??\c:\rlxxlrr.exec:\rlxxlrr.exe78⤵
-
\??\c:\xxxlffx.exec:\xxxlffx.exe79⤵
-
\??\c:\1tttnt.exec:\1tttnt.exe80⤵
-
\??\c:\ppjdp.exec:\ppjdp.exe81⤵
-
\??\c:\fxlfxxx.exec:\fxlfxxx.exe82⤵
-
\??\c:\frrrlrl.exec:\frrrlrl.exe83⤵
-
\??\c:\htbtth.exec:\htbtth.exe84⤵
-
\??\c:\hhtttt.exec:\hhtttt.exe85⤵
-
\??\c:\vdjdv.exec:\vdjdv.exe86⤵
-
\??\c:\ddppd.exec:\ddppd.exe87⤵
-
\??\c:\5xlfxxx.exec:\5xlfxxx.exe88⤵
-
\??\c:\bttnhh.exec:\bttnhh.exe89⤵
-
\??\c:\hnbhbh.exec:\hnbhbh.exe90⤵
-
\??\c:\9jvvp.exec:\9jvvp.exe91⤵
-
\??\c:\7pvvd.exec:\7pvvd.exe92⤵
-
\??\c:\xxlflxl.exec:\xxlflxl.exe93⤵
-
\??\c:\rxxrllf.exec:\rxxrllf.exe94⤵
-
\??\c:\7bnntb.exec:\7bnntb.exe95⤵
-
\??\c:\ttnhbt.exec:\ttnhbt.exe96⤵
-
\??\c:\djjdv.exec:\djjdv.exe97⤵
-
\??\c:\xflrxxx.exec:\xflrxxx.exe98⤵
-
\??\c:\rlrxxrf.exec:\rlrxxrf.exe99⤵
-
\??\c:\nbhhbt.exec:\nbhhbt.exe100⤵
-
\??\c:\hntnhh.exec:\hntnhh.exe101⤵
-
\??\c:\3dvvp.exec:\3dvvp.exe102⤵
-
\??\c:\vddvv.exec:\vddvv.exe103⤵
-
\??\c:\lflflff.exec:\lflflff.exe104⤵
-
\??\c:\lllfffx.exec:\lllfffx.exe105⤵
-
\??\c:\nhnhbh.exec:\nhnhbh.exe106⤵
-
\??\c:\ddjdj.exec:\ddjdj.exe107⤵
-
\??\c:\7dppv.exec:\7dppv.exe108⤵
-
\??\c:\xlxlrll.exec:\xlxlrll.exe109⤵
-
\??\c:\vpdpv.exec:\vpdpv.exe110⤵
-
\??\c:\llflxll.exec:\llflxll.exe111⤵
-
\??\c:\9hbtbb.exec:\9hbtbb.exe112⤵
-
\??\c:\vvvvp.exec:\vvvvp.exe113⤵
-
\??\c:\5xffrxf.exec:\5xffrxf.exe114⤵
-
\??\c:\hnnttt.exec:\hnnttt.exe115⤵
-
\??\c:\btnhtt.exec:\btnhtt.exe116⤵
-
\??\c:\dpvvp.exec:\dpvvp.exe117⤵
-
\??\c:\lffxrrl.exec:\lffxrrl.exe118⤵
-
\??\c:\lllxrxr.exec:\lllxrxr.exe119⤵
-
\??\c:\tbhbbt.exec:\tbhbbt.exe120⤵
-
\??\c:\vdpdd.exec:\vdpdd.exe121⤵
-
\??\c:\jpdvd.exec:\jpdvd.exe122⤵
-
\??\c:\frrrlxx.exec:\frrrlxx.exe123⤵
-
\??\c:\rfffxlr.exec:\rfffxlr.exe124⤵
-
\??\c:\hnnhbt.exec:\hnnhbt.exe125⤵
-
\??\c:\hhhbnn.exec:\hhhbnn.exe126⤵
-
\??\c:\dvdvv.exec:\dvdvv.exe127⤵
-
\??\c:\9vjdv.exec:\9vjdv.exe128⤵
-
\??\c:\llrrrlr.exec:\llrrrlr.exe129⤵
-
\??\c:\xrrlllf.exec:\xrrlllf.exe130⤵
-
\??\c:\btttnn.exec:\btttnn.exe131⤵
-
\??\c:\btnhnt.exec:\btnhnt.exe132⤵
-
\??\c:\vvjvp.exec:\vvjvp.exe133⤵
-
\??\c:\rrxrrrf.exec:\rrxrrrf.exe134⤵
-
\??\c:\ththbh.exec:\ththbh.exe135⤵
-
\??\c:\5vddj.exec:\5vddj.exe136⤵
-
\??\c:\ddvjv.exec:\ddvjv.exe137⤵
-
\??\c:\lrlffff.exec:\lrlffff.exe138⤵
-
\??\c:\3bbtnt.exec:\3bbtnt.exe139⤵
-
\??\c:\9ttbtt.exec:\9ttbtt.exe140⤵
-
\??\c:\jjjdd.exec:\jjjdd.exe141⤵
-
\??\c:\9lllfxx.exec:\9lllfxx.exe142⤵
-
\??\c:\rrxffff.exec:\rrxffff.exe143⤵
-
\??\c:\bbthhb.exec:\bbthhb.exe144⤵
-
\??\c:\5vvpj.exec:\5vvpj.exe145⤵
-
\??\c:\7vppp.exec:\7vppp.exe146⤵
-
\??\c:\pdvpj.exec:\pdvpj.exe147⤵
-
\??\c:\rxxfrxf.exec:\rxxfrxf.exe148⤵
-
\??\c:\1bnhnn.exec:\1bnhnn.exe149⤵
-
\??\c:\bnbhtn.exec:\bnbhtn.exe150⤵
-
\??\c:\1jpjd.exec:\1jpjd.exe151⤵
-
\??\c:\vvpjd.exec:\vvpjd.exe152⤵
-
\??\c:\hbbbbb.exec:\hbbbbb.exe153⤵
-
\??\c:\5hhtnn.exec:\5hhtnn.exe154⤵
-
\??\c:\dvpjj.exec:\dvpjj.exe155⤵
-
\??\c:\flxrllx.exec:\flxrllx.exe156⤵
-
\??\c:\3lxrlff.exec:\3lxrlff.exe157⤵
-
\??\c:\tbhhnt.exec:\tbhhnt.exe158⤵
-
\??\c:\hbbthh.exec:\hbbthh.exe159⤵
-
\??\c:\tnhbtt.exec:\tnhbtt.exe160⤵
-
\??\c:\7jppp.exec:\7jppp.exe161⤵
-
\??\c:\rllfxrx.exec:\rllfxrx.exe162⤵
-
\??\c:\lxrrrlx.exec:\lxrrrlx.exe163⤵
-
\??\c:\ntnthh.exec:\ntnthh.exe164⤵
-
\??\c:\5hnnbb.exec:\5hnnbb.exe165⤵
-
\??\c:\dpvpj.exec:\dpvpj.exe166⤵
-
\??\c:\5pvvp.exec:\5pvvp.exe167⤵
-
\??\c:\3rfflrf.exec:\3rfflrf.exe168⤵
-
\??\c:\rrffxlf.exec:\rrffxlf.exe169⤵
-
\??\c:\5tbbbh.exec:\5tbbbh.exe170⤵
-
\??\c:\thhhtt.exec:\thhhtt.exe171⤵
-
\??\c:\vdppj.exec:\vdppj.exe172⤵
-
\??\c:\xfxxlll.exec:\xfxxlll.exe173⤵
-
\??\c:\nhbbnb.exec:\nhbbnb.exe174⤵
-
\??\c:\3nttnn.exec:\3nttnn.exe175⤵
-
\??\c:\3dvvp.exec:\3dvvp.exe176⤵
-
\??\c:\pppjj.exec:\pppjj.exe177⤵
-
\??\c:\rlxrlrx.exec:\rlxrlrx.exe178⤵
-
\??\c:\9djdd.exec:\9djdd.exe179⤵
-
\??\c:\lffxxxx.exec:\lffxxxx.exe180⤵
-
\??\c:\nnbhhn.exec:\nnbhhn.exe181⤵
-
\??\c:\pvvjp.exec:\pvvjp.exe182⤵
-
\??\c:\llfflrl.exec:\llfflrl.exe183⤵
-
\??\c:\bhntnn.exec:\bhntnn.exe184⤵
-
\??\c:\djjjv.exec:\djjjv.exe185⤵
-
\??\c:\frxxrrl.exec:\frxxrrl.exe186⤵
-
\??\c:\lxffrrl.exec:\lxffrrl.exe187⤵
-
\??\c:\hhbttt.exec:\hhbttt.exe188⤵
-
\??\c:\hbbbtt.exec:\hbbbtt.exe189⤵
-
\??\c:\dvdvv.exec:\dvdvv.exe190⤵
-
\??\c:\vpvpj.exec:\vpvpj.exe191⤵
-
\??\c:\rfxlfll.exec:\rfxlfll.exe192⤵
-
\??\c:\rrllfxx.exec:\rrllfxx.exe193⤵
-
\??\c:\ttttnt.exec:\ttttnt.exe194⤵
-
\??\c:\nhnhhh.exec:\nhnhhh.exe195⤵
-
\??\c:\7jdvd.exec:\7jdvd.exe196⤵
-
\??\c:\lfrrrrf.exec:\lfrrrrf.exe197⤵
-
\??\c:\ffxfffx.exec:\ffxfffx.exe198⤵
-
\??\c:\ntthhb.exec:\ntthhb.exe199⤵
-
\??\c:\bhbhhn.exec:\bhbhhn.exe200⤵
-
\??\c:\ddddv.exec:\ddddv.exe201⤵
-
\??\c:\xxrffff.exec:\xxrffff.exe202⤵
-
\??\c:\tnnhhh.exec:\tnnhhh.exe203⤵
-
\??\c:\tbbhhh.exec:\tbbhhh.exe204⤵
-
\??\c:\pdddd.exec:\pdddd.exe205⤵
-
\??\c:\ppdjd.exec:\ppdjd.exe206⤵
-
\??\c:\1xfxrxr.exec:\1xfxrxr.exe207⤵
-
\??\c:\lxffxfx.exec:\lxffxfx.exe208⤵
-
\??\c:\tnthtb.exec:\tnthtb.exe209⤵
-
\??\c:\dpvpj.exec:\dpvpj.exe210⤵
-
\??\c:\jjddj.exec:\jjddj.exe211⤵
-
\??\c:\rrrrxlr.exec:\rrrrxlr.exe212⤵
-
\??\c:\rlfrrrr.exec:\rlfrrrr.exe213⤵
-
\??\c:\tttntn.exec:\tttntn.exe214⤵
-
\??\c:\hbttbb.exec:\hbttbb.exe215⤵
-
\??\c:\pdjdp.exec:\pdjdp.exe216⤵
-
\??\c:\pjddj.exec:\pjddj.exe217⤵
-
\??\c:\fllrxlr.exec:\fllrxlr.exe218⤵
-
\??\c:\fffxxxx.exec:\fffxxxx.exe219⤵
-
\??\c:\5frrrff.exec:\5frrrff.exe220⤵
-
\??\c:\nntbtb.exec:\nntbtb.exe221⤵
-
\??\c:\9vvpd.exec:\9vvpd.exe222⤵
-
\??\c:\5pddp.exec:\5pddp.exe223⤵
-
\??\c:\3lrrflr.exec:\3lrrflr.exe224⤵
-
\??\c:\llrlffx.exec:\llrlffx.exe225⤵
-
\??\c:\tbbhht.exec:\tbbhht.exe226⤵
-
\??\c:\bbhhbh.exec:\bbhhbh.exe227⤵
-
\??\c:\ddvjd.exec:\ddvjd.exe228⤵
-
\??\c:\vvdvp.exec:\vvdvp.exe229⤵
-
\??\c:\lfxrlll.exec:\lfxrlll.exe230⤵
-
\??\c:\lfffxxr.exec:\lfffxxr.exe231⤵
-
\??\c:\tnhtbt.exec:\tnhtbt.exe232⤵
-
\??\c:\thtnhb.exec:\thtnhb.exe233⤵
-
\??\c:\ppppj.exec:\ppppj.exe234⤵
-
\??\c:\1vvpj.exec:\1vvpj.exe235⤵
-
\??\c:\xrrlfff.exec:\xrrlfff.exe236⤵
-
\??\c:\fxlrrrl.exec:\fxlrrrl.exe237⤵
-
\??\c:\frxrllr.exec:\frxrllr.exe238⤵
-
\??\c:\bnbttt.exec:\bnbttt.exe239⤵
-
\??\c:\dvvvv.exec:\dvvvv.exe240⤵
-
\??\c:\9pvvv.exec:\9pvvv.exe241⤵