Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 22:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9a62a0ccd45f982cf5b209edbdaf95b0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
9a62a0ccd45f982cf5b209edbdaf95b0_NeikiAnalytics.exe
-
Size
104KB
-
MD5
9a62a0ccd45f982cf5b209edbdaf95b0
-
SHA1
02147364589cc3a4b695917d21ffffcf3dd22290
-
SHA256
814f7e860930a870ceb30d639347536be923f20e8931ddc7c8d47e02f611865c
-
SHA512
7790478fc663a7dd0baa30bd24538a2173d0d52d7c87ac5779f1952def3352eeb17fe6dc20cbb115b31e2f417337994cda097583d863de40a7b1618c8e7314e2
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoTNKDeS98hPUdHV7RNzfJNS:ymb3NkkiQ3mdBjFo5KDe88g1fDS
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral2/memory/1468-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4332-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1692-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1268-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4972-41-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4972-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4484-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3448-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3120-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1620-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3080-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/512-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2848-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/868-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4948-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/392-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2868-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4700-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1384-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4804-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2440-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3720-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3056-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
frffrlx.exebtbbbh.exenhbhnn.exejddjj.exejpppv.exedjddv.exefflffll.exellxrxfl.exe7lrxxll.exe7ntttb.exehnntbb.exejvdvd.exexfxxxxx.exe3nbbtb.exejdjdp.exevjvdd.exe3frllll.exettbbbh.exevvvvv.exebhhbbb.exehnbbbt.exellfxlrr.exe9lrrrrr.exebtnbhb.exe1vpvv.exenbbttn.exehbtnhh.exedvdjd.exexxlllfl.exettttbb.exedvvdv.exe1rflflr.exelxlflff.exe3hnhbh.exejdddp.exeffrlllx.exebttbbb.exenthntt.exe5vdjd.exelfxfxfl.exerrrrllr.exetbbbnn.exejdvvv.exejpppp.exefxllrrr.exebhnttb.exevvddd.exeppdjv.exerlllffl.exerlxxxfr.exenhhbtt.exenhnhth.exejpvpp.exexxfxrxx.exebbbttt.exedvjpp.exe1lrrrxf.exentbbnn.exe9frrxrr.exehntttb.exepvjpd.exelxffxff.exe9rlfxxr.exebnnnnn.exepid process 1692 frffrlx.exe 4776 btbbbh.exe 4332 nhbhnn.exe 1268 jddjj.exe 4972 jpppv.exe 4484 djddv.exe 3448 fflffll.exe 3120 llxrxfl.exe 1620 7lrxxll.exe 3080 7ntttb.exe 512 hnntbb.exe 5036 jvdvd.exe 2848 xfxxxxx.exe 868 3nbbtb.exe 3744 jdjdp.exe 4948 vjvdd.exe 392 3frllll.exe 2868 ttbbbh.exe 4700 vvvvv.exe 1280 bhhbbb.exe 1384 hnbbbt.exe 4932 llfxlrr.exe 1808 9lrrrrr.exe 4804 btnbhb.exe 5020 1vpvv.exe 2560 nbbttn.exe 2440 hbtnhh.exe 3720 dvdjd.exe 4696 xxlllfl.exe 4232 ttttbb.exe 3056 dvvdv.exe 680 1rflflr.exe 3776 lxlflff.exe 3904 3hnhbh.exe 2084 jdddp.exe 3860 ffrlllx.exe 1196 bttbbb.exe 4740 nthntt.exe 912 5vdjd.exe 4784 lfxfxfl.exe 4600 rrrrllr.exe 4772 tbbbnn.exe 4808 jdvvv.exe 1268 jpppp.exe 1276 fxllrrr.exe 4728 bhnttb.exe 1676 vvddd.exe 3120 ppdjv.exe 1396 rlllffl.exe 2316 rlxxxfr.exe 4924 nhhbtt.exe 3520 nhnhth.exe 2804 jpvpp.exe 5104 xxfxrxx.exe 4828 bbbttt.exe 4256 dvjpp.exe 3744 1lrrrxf.exe 2860 ntbbnn.exe 4472 9frrxrr.exe 4584 hntttb.exe 5060 pvjpd.exe 1356 lxffxff.exe 3672 9rlfxxr.exe 1264 bnnnnn.exe -
Processes:
resource yara_rule behavioral2/memory/1468-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4332-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1692-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1268-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4972-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4484-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3448-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3120-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1620-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3080-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/512-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2848-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/868-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4948-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/392-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2868-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4700-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1384-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4804-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2440-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3720-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3056-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9a62a0ccd45f982cf5b209edbdaf95b0_NeikiAnalytics.exefrffrlx.exebtbbbh.exenhbhnn.exejddjj.exejpppv.exedjddv.exefflffll.exellxrxfl.exe7lrxxll.exe7ntttb.exehnntbb.exejvdvd.exexfxxxxx.exe3nbbtb.exejdjdp.exevjvdd.exe3frllll.exettbbbh.exevvvvv.exebhhbbb.exehnbbbt.exedescription pid process target process PID 1468 wrote to memory of 1692 1468 9a62a0ccd45f982cf5b209edbdaf95b0_NeikiAnalytics.exe frffrlx.exe PID 1468 wrote to memory of 1692 1468 9a62a0ccd45f982cf5b209edbdaf95b0_NeikiAnalytics.exe frffrlx.exe PID 1468 wrote to memory of 1692 1468 9a62a0ccd45f982cf5b209edbdaf95b0_NeikiAnalytics.exe frffrlx.exe PID 1692 wrote to memory of 4776 1692 frffrlx.exe btbbbh.exe PID 1692 wrote to memory of 4776 1692 frffrlx.exe btbbbh.exe PID 1692 wrote to memory of 4776 1692 frffrlx.exe btbbbh.exe PID 4776 wrote to memory of 4332 4776 btbbbh.exe nhbhnn.exe PID 4776 wrote to memory of 4332 4776 btbbbh.exe nhbhnn.exe PID 4776 wrote to memory of 4332 4776 btbbbh.exe nhbhnn.exe PID 4332 wrote to memory of 1268 4332 nhbhnn.exe jddjj.exe PID 4332 wrote to memory of 1268 4332 nhbhnn.exe jddjj.exe PID 4332 wrote to memory of 1268 4332 nhbhnn.exe jddjj.exe PID 1268 wrote to memory of 4972 1268 jddjj.exe jpppv.exe PID 1268 wrote to memory of 4972 1268 jddjj.exe jpppv.exe PID 1268 wrote to memory of 4972 1268 jddjj.exe jpppv.exe PID 4972 wrote to memory of 4484 4972 jpppv.exe djddv.exe PID 4972 wrote to memory of 4484 4972 jpppv.exe djddv.exe PID 4972 wrote to memory of 4484 4972 jpppv.exe djddv.exe PID 4484 wrote to memory of 3448 4484 djddv.exe fflffll.exe PID 4484 wrote to memory of 3448 4484 djddv.exe fflffll.exe PID 4484 wrote to memory of 3448 4484 djddv.exe fflffll.exe PID 3448 wrote to memory of 3120 3448 fflffll.exe llxrxfl.exe PID 3448 wrote to memory of 3120 3448 fflffll.exe llxrxfl.exe PID 3448 wrote to memory of 3120 3448 fflffll.exe llxrxfl.exe PID 3120 wrote to memory of 1620 3120 llxrxfl.exe 7lrxxll.exe PID 3120 wrote to memory of 1620 3120 llxrxfl.exe 7lrxxll.exe PID 3120 wrote to memory of 1620 3120 llxrxfl.exe 7lrxxll.exe PID 1620 wrote to memory of 3080 1620 7lrxxll.exe 7ntttb.exe PID 1620 wrote to memory of 3080 1620 7lrxxll.exe 7ntttb.exe PID 1620 wrote to memory of 3080 1620 7lrxxll.exe 7ntttb.exe PID 3080 wrote to memory of 512 3080 7ntttb.exe hnntbb.exe PID 3080 wrote to memory of 512 3080 7ntttb.exe hnntbb.exe PID 3080 wrote to memory of 512 3080 7ntttb.exe hnntbb.exe PID 512 wrote to memory of 5036 512 hnntbb.exe jvdvd.exe PID 512 wrote to memory of 5036 512 hnntbb.exe jvdvd.exe PID 512 wrote to memory of 5036 512 hnntbb.exe jvdvd.exe PID 5036 wrote to memory of 2848 5036 jvdvd.exe xfxxxxx.exe PID 5036 wrote to memory of 2848 5036 jvdvd.exe xfxxxxx.exe PID 5036 wrote to memory of 2848 5036 jvdvd.exe xfxxxxx.exe PID 2848 wrote to memory of 868 2848 xfxxxxx.exe 3nbbtb.exe PID 2848 wrote to memory of 868 2848 xfxxxxx.exe 3nbbtb.exe PID 2848 wrote to memory of 868 2848 xfxxxxx.exe 3nbbtb.exe PID 868 wrote to memory of 3744 868 3nbbtb.exe jdjdp.exe PID 868 wrote to memory of 3744 868 3nbbtb.exe jdjdp.exe PID 868 wrote to memory of 3744 868 3nbbtb.exe jdjdp.exe PID 3744 wrote to memory of 4948 3744 jdjdp.exe vjvdd.exe PID 3744 wrote to memory of 4948 3744 jdjdp.exe vjvdd.exe PID 3744 wrote to memory of 4948 3744 jdjdp.exe vjvdd.exe PID 4948 wrote to memory of 392 4948 vjvdd.exe 3frllll.exe PID 4948 wrote to memory of 392 4948 vjvdd.exe 3frllll.exe PID 4948 wrote to memory of 392 4948 vjvdd.exe 3frllll.exe PID 392 wrote to memory of 2868 392 3frllll.exe ttbbbh.exe PID 392 wrote to memory of 2868 392 3frllll.exe ttbbbh.exe PID 392 wrote to memory of 2868 392 3frllll.exe ttbbbh.exe PID 2868 wrote to memory of 4700 2868 ttbbbh.exe vvvvv.exe PID 2868 wrote to memory of 4700 2868 ttbbbh.exe vvvvv.exe PID 2868 wrote to memory of 4700 2868 ttbbbh.exe vvvvv.exe PID 4700 wrote to memory of 1280 4700 vvvvv.exe bhhbbb.exe PID 4700 wrote to memory of 1280 4700 vvvvv.exe bhhbbb.exe PID 4700 wrote to memory of 1280 4700 vvvvv.exe bhhbbb.exe PID 1280 wrote to memory of 1384 1280 bhhbbb.exe hnbbbt.exe PID 1280 wrote to memory of 1384 1280 bhhbbb.exe hnbbbt.exe PID 1280 wrote to memory of 1384 1280 bhhbbb.exe hnbbbt.exe PID 1384 wrote to memory of 4932 1384 hnbbbt.exe llfxlrr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a62a0ccd45f982cf5b209edbdaf95b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9a62a0ccd45f982cf5b209edbdaf95b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\frffrlx.exec:\frffrlx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btbbbh.exec:\btbbbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhbhnn.exec:\nhbhnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jddjj.exec:\jddjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpppv.exec:\jpppv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\djddv.exec:\djddv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fflffll.exec:\fflffll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llxrxfl.exec:\llxrxfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7lrxxll.exec:\7lrxxll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7ntttb.exec:\7ntttb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hnntbb.exec:\hnntbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvdvd.exec:\jvdvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xfxxxxx.exec:\xfxxxxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3nbbtb.exec:\3nbbtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdjdp.exec:\jdjdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjvdd.exec:\vjvdd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3frllll.exec:\3frllll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ttbbbh.exec:\ttbbbh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvvvv.exec:\vvvvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhhbbb.exec:\bhhbbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hnbbbt.exec:\hnbbbt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llfxlrr.exec:\llfxlrr.exe23⤵
- Executes dropped EXE
-
\??\c:\9lrrrrr.exec:\9lrrrrr.exe24⤵
- Executes dropped EXE
-
\??\c:\btnbhb.exec:\btnbhb.exe25⤵
- Executes dropped EXE
-
\??\c:\1vpvv.exec:\1vpvv.exe26⤵
- Executes dropped EXE
-
\??\c:\nbbttn.exec:\nbbttn.exe27⤵
- Executes dropped EXE
-
\??\c:\hbtnhh.exec:\hbtnhh.exe28⤵
- Executes dropped EXE
-
\??\c:\dvdjd.exec:\dvdjd.exe29⤵
- Executes dropped EXE
-
\??\c:\xxlllfl.exec:\xxlllfl.exe30⤵
- Executes dropped EXE
-
\??\c:\ttttbb.exec:\ttttbb.exe31⤵
- Executes dropped EXE
-
\??\c:\dvvdv.exec:\dvvdv.exe32⤵
- Executes dropped EXE
-
\??\c:\1rflflr.exec:\1rflflr.exe33⤵
- Executes dropped EXE
-
\??\c:\lxlflff.exec:\lxlflff.exe34⤵
- Executes dropped EXE
-
\??\c:\3hnhbh.exec:\3hnhbh.exe35⤵
- Executes dropped EXE
-
\??\c:\jdddp.exec:\jdddp.exe36⤵
- Executes dropped EXE
-
\??\c:\ffrlllx.exec:\ffrlllx.exe37⤵
- Executes dropped EXE
-
\??\c:\bttbbb.exec:\bttbbb.exe38⤵
- Executes dropped EXE
-
\??\c:\nthntt.exec:\nthntt.exe39⤵
- Executes dropped EXE
-
\??\c:\vpjdj.exec:\vpjdj.exe40⤵
-
\??\c:\5vdjd.exec:\5vdjd.exe41⤵
- Executes dropped EXE
-
\??\c:\lfxfxfl.exec:\lfxfxfl.exe42⤵
- Executes dropped EXE
-
\??\c:\rrrrllr.exec:\rrrrllr.exe43⤵
- Executes dropped EXE
-
\??\c:\tbbbnn.exec:\tbbbnn.exe44⤵
- Executes dropped EXE
-
\??\c:\jdvvv.exec:\jdvvv.exe45⤵
- Executes dropped EXE
-
\??\c:\jpppp.exec:\jpppp.exe46⤵
- Executes dropped EXE
-
\??\c:\fxllrrr.exec:\fxllrrr.exe47⤵
- Executes dropped EXE
-
\??\c:\bhnttb.exec:\bhnttb.exe48⤵
- Executes dropped EXE
-
\??\c:\vvddd.exec:\vvddd.exe49⤵
- Executes dropped EXE
-
\??\c:\ppdjv.exec:\ppdjv.exe50⤵
- Executes dropped EXE
-
\??\c:\rlllffl.exec:\rlllffl.exe51⤵
- Executes dropped EXE
-
\??\c:\rlxxxfr.exec:\rlxxxfr.exe52⤵
- Executes dropped EXE
-
\??\c:\nhhbtt.exec:\nhhbtt.exe53⤵
- Executes dropped EXE
-
\??\c:\nhnhth.exec:\nhnhth.exe54⤵
- Executes dropped EXE
-
\??\c:\jpvpp.exec:\jpvpp.exe55⤵
- Executes dropped EXE
-
\??\c:\xxfxrxx.exec:\xxfxrxx.exe56⤵
- Executes dropped EXE
-
\??\c:\bbbttt.exec:\bbbttt.exe57⤵
- Executes dropped EXE
-
\??\c:\dvjpp.exec:\dvjpp.exe58⤵
- Executes dropped EXE
-
\??\c:\1lrrrxf.exec:\1lrrrxf.exe59⤵
- Executes dropped EXE
-
\??\c:\ntbbnn.exec:\ntbbnn.exe60⤵
- Executes dropped EXE
-
\??\c:\9frrxrr.exec:\9frrxrr.exe61⤵
- Executes dropped EXE
-
\??\c:\hntttb.exec:\hntttb.exe62⤵
- Executes dropped EXE
-
\??\c:\pvjpd.exec:\pvjpd.exe63⤵
- Executes dropped EXE
-
\??\c:\lxffxff.exec:\lxffxff.exe64⤵
- Executes dropped EXE
-
\??\c:\9rlfxxr.exec:\9rlfxxr.exe65⤵
- Executes dropped EXE
-
\??\c:\bnnnnn.exec:\bnnnnn.exe66⤵
- Executes dropped EXE
-
\??\c:\9hnnnb.exec:\9hnnnb.exe67⤵
-
\??\c:\vjjjd.exec:\vjjjd.exe68⤵
-
\??\c:\ddppd.exec:\ddppd.exe69⤵
-
\??\c:\frfffff.exec:\frfffff.exe70⤵
-
\??\c:\nhnnnh.exec:\nhnnnh.exe71⤵
-
\??\c:\bbhhbt.exec:\bbhhbt.exe72⤵
-
\??\c:\djjjd.exec:\djjjd.exe73⤵
-
\??\c:\ddppp.exec:\ddppp.exe74⤵
-
\??\c:\flffffx.exec:\flffffx.exe75⤵
-
\??\c:\ntbbhh.exec:\ntbbhh.exe76⤵
-
\??\c:\htbbbh.exec:\htbbbh.exe77⤵
-
\??\c:\pdddj.exec:\pdddj.exe78⤵
-
\??\c:\ppdpj.exec:\ppdpj.exe79⤵
-
\??\c:\lfllfff.exec:\lfllfff.exe80⤵
-
\??\c:\xxxfllx.exec:\xxxfllx.exe81⤵
-
\??\c:\5nnnhn.exec:\5nnnhn.exe82⤵
-
\??\c:\vpvvv.exec:\vpvvv.exe83⤵
-
\??\c:\jdvpv.exec:\jdvpv.exe84⤵
-
\??\c:\7xffxxf.exec:\7xffxxf.exe85⤵
-
\??\c:\rlrrrxf.exec:\rlrrrxf.exe86⤵
-
\??\c:\5nbttb.exec:\5nbttb.exe87⤵
-
\??\c:\tthhhn.exec:\tthhhn.exe88⤵
-
\??\c:\pvvpd.exec:\pvvpd.exe89⤵
-
\??\c:\dvpjj.exec:\dvpjj.exe90⤵
-
\??\c:\fxrrlrf.exec:\fxrrlrf.exe91⤵
-
\??\c:\3nbntb.exec:\3nbntb.exe92⤵
-
\??\c:\hhnhbh.exec:\hhnhbh.exe93⤵
-
\??\c:\1ddvd.exec:\1ddvd.exe94⤵
-
\??\c:\llxrllf.exec:\llxrllf.exe95⤵
-
\??\c:\flxrllf.exec:\flxrllf.exe96⤵
-
\??\c:\5btnnn.exec:\5btnnn.exe97⤵
-
\??\c:\tnhbbb.exec:\tnhbbb.exe98⤵
-
\??\c:\vdpdp.exec:\vdpdp.exe99⤵
-
\??\c:\9rrlflf.exec:\9rrlflf.exe100⤵
-
\??\c:\1fffxxx.exec:\1fffxxx.exe101⤵
-
\??\c:\tbbttt.exec:\tbbttt.exe102⤵
-
\??\c:\vvjvv.exec:\vvjvv.exe103⤵
-
\??\c:\ddvvd.exec:\ddvvd.exe104⤵
-
\??\c:\rfxrlff.exec:\rfxrlff.exe105⤵
-
\??\c:\9ffxrlf.exec:\9ffxrlf.exe106⤵
-
\??\c:\nnnhbb.exec:\nnnhbb.exe107⤵
-
\??\c:\9pvjv.exec:\9pvjv.exe108⤵
-
\??\c:\9djvp.exec:\9djvp.exe109⤵
-
\??\c:\rllxrrr.exec:\rllxrrr.exe110⤵
-
\??\c:\rxrxrlf.exec:\rxrxrlf.exe111⤵
-
\??\c:\nhhbbh.exec:\nhhbbh.exe112⤵
-
\??\c:\tnhbtt.exec:\tnhbtt.exe113⤵
-
\??\c:\3ppdp.exec:\3ppdp.exe114⤵
-
\??\c:\btbtnh.exec:\btbtnh.exe115⤵
-
\??\c:\bhntbt.exec:\bhntbt.exe116⤵
-
\??\c:\jpdjj.exec:\jpdjj.exe117⤵
-
\??\c:\xrxffff.exec:\xrxffff.exe118⤵
-
\??\c:\nhhnth.exec:\nhhnth.exe119⤵
-
\??\c:\btbtbb.exec:\btbtbb.exe120⤵
-
\??\c:\djpdp.exec:\djpdp.exe121⤵
-
\??\c:\fllxrxl.exec:\fllxrxl.exe122⤵
-
\??\c:\rxrrfff.exec:\rxrrfff.exe123⤵
-
\??\c:\bthhhh.exec:\bthhhh.exe124⤵
-
\??\c:\ppvpj.exec:\ppvpj.exe125⤵
-
\??\c:\ppjvp.exec:\ppjvp.exe126⤵
-
\??\c:\fllxfrr.exec:\fllxfrr.exe127⤵
-
\??\c:\lrrxxll.exec:\lrrxxll.exe128⤵
-
\??\c:\tnhhhn.exec:\tnhhhn.exe129⤵
-
\??\c:\djvjp.exec:\djvjp.exe130⤵
-
\??\c:\dpvvv.exec:\dpvvv.exe131⤵
-
\??\c:\xfxxrrl.exec:\xfxxrrl.exe132⤵
-
\??\c:\xrxxrrf.exec:\xrxxrrf.exe133⤵
-
\??\c:\bntthb.exec:\bntthb.exe134⤵
-
\??\c:\thnhhb.exec:\thnhhb.exe135⤵
-
\??\c:\jvddv.exec:\jvddv.exe136⤵
-
\??\c:\vdpjd.exec:\vdpjd.exe137⤵
-
\??\c:\fxlfffx.exec:\fxlfffx.exe138⤵
-
\??\c:\httnhh.exec:\httnhh.exe139⤵
-
\??\c:\bhnbhn.exec:\bhnbhn.exe140⤵
-
\??\c:\ddddv.exec:\ddddv.exe141⤵
-
\??\c:\1vvvd.exec:\1vvvd.exe142⤵
-
\??\c:\xrlrffx.exec:\xrlrffx.exe143⤵
-
\??\c:\xxfrxrx.exec:\xxfrxrx.exe144⤵
-
\??\c:\tthhhn.exec:\tthhhn.exe145⤵
-
\??\c:\nhnhtn.exec:\nhnhtn.exe146⤵
-
\??\c:\pdvpd.exec:\pdvpd.exe147⤵
-
\??\c:\fxxrffx.exec:\fxxrffx.exe148⤵
-
\??\c:\rxlflrr.exec:\rxlflrr.exe149⤵
-
\??\c:\btbttt.exec:\btbttt.exe150⤵
-
\??\c:\dvpjj.exec:\dvpjj.exe151⤵
-
\??\c:\lrrrfll.exec:\lrrrfll.exe152⤵
-
\??\c:\xfflffx.exec:\xfflffx.exe153⤵
-
\??\c:\bbbttt.exec:\bbbttt.exe154⤵
-
\??\c:\fflfxff.exec:\fflfxff.exe155⤵
-
\??\c:\hnnntn.exec:\hnnntn.exe156⤵
-
\??\c:\tbbtnt.exec:\tbbtnt.exe157⤵
-
\??\c:\dvddj.exec:\dvddj.exe158⤵
-
\??\c:\nnnnnn.exec:\nnnnnn.exe159⤵
-
\??\c:\dpdjv.exec:\dpdjv.exe160⤵
-
\??\c:\flrlxlr.exec:\flrlxlr.exe161⤵
-
\??\c:\nbtttt.exec:\nbtttt.exe162⤵
-
\??\c:\vjjdv.exec:\vjjdv.exe163⤵
-
\??\c:\lxxrlfx.exec:\lxxrlfx.exe164⤵
-
\??\c:\bnhhht.exec:\bnhhht.exe165⤵
-
\??\c:\pjvvd.exec:\pjvvd.exe166⤵
-
\??\c:\rlxrxxf.exec:\rlxrxxf.exe167⤵
-
\??\c:\5ffrrll.exec:\5ffrrll.exe168⤵
-
\??\c:\7thhhn.exec:\7thhhn.exe169⤵
-
\??\c:\nbthbb.exec:\nbthbb.exe170⤵
-
\??\c:\7pvjp.exec:\7pvjp.exe171⤵
-
\??\c:\fxxrlff.exec:\fxxrlff.exe172⤵
-
\??\c:\3xxrlll.exec:\3xxrlll.exe173⤵
-
\??\c:\nhnbtt.exec:\nhnbtt.exe174⤵
-
\??\c:\bthtth.exec:\bthtth.exe175⤵
-
\??\c:\vpjjd.exec:\vpjjd.exe176⤵
-
\??\c:\xrffrff.exec:\xrffrff.exe177⤵
-
\??\c:\llrlxrl.exec:\llrlxrl.exe178⤵
-
\??\c:\nhtbbh.exec:\nhtbbh.exe179⤵
-
\??\c:\dvdpp.exec:\dvdpp.exe180⤵
-
\??\c:\3rxrrrx.exec:\3rxrrrx.exe181⤵
-
\??\c:\rlffxxx.exec:\rlffxxx.exe182⤵
-
\??\c:\7nbtnn.exec:\7nbtnn.exe183⤵
-
\??\c:\hbhhtt.exec:\hbhhtt.exe184⤵
-
\??\c:\jvpjd.exec:\jvpjd.exe185⤵
-
\??\c:\llxrrrx.exec:\llxrrrx.exe186⤵
-
\??\c:\lxxrllf.exec:\lxxrllf.exe187⤵
-
\??\c:\nhhbtt.exec:\nhhbtt.exe188⤵
-
\??\c:\vjvpd.exec:\vjvpd.exe189⤵
-
\??\c:\vppvp.exec:\vppvp.exe190⤵
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe191⤵
-
\??\c:\flrlrfx.exec:\flrlrfx.exe192⤵
-
\??\c:\bbttnn.exec:\bbttnn.exe193⤵
-
\??\c:\9jddv.exec:\9jddv.exe194⤵
-
\??\c:\dvddv.exec:\dvddv.exe195⤵
-
\??\c:\xxffflr.exec:\xxffflr.exe196⤵
-
\??\c:\hbttbb.exec:\hbttbb.exe197⤵
-
\??\c:\tnhbtt.exec:\tnhbtt.exe198⤵
-
\??\c:\tttbtt.exec:\tttbtt.exe199⤵
-
\??\c:\pjdvj.exec:\pjdvj.exe200⤵
-
\??\c:\fxxlfxr.exec:\fxxlfxr.exe201⤵
-
\??\c:\fxxrllf.exec:\fxxrllf.exe202⤵
-
\??\c:\ttbbtt.exec:\ttbbtt.exe203⤵
-
\??\c:\thnbtt.exec:\thnbtt.exe204⤵
-
\??\c:\ddpdd.exec:\ddpdd.exe205⤵
-
\??\c:\djpjv.exec:\djpjv.exe206⤵
-
\??\c:\5xfxrrr.exec:\5xfxrrr.exe207⤵
-
\??\c:\7rllfll.exec:\7rllfll.exe208⤵
-
\??\c:\bthhbb.exec:\bthhbb.exe209⤵
-
\??\c:\tthhtn.exec:\tthhtn.exe210⤵
-
\??\c:\1vpdd.exec:\1vpdd.exe211⤵
-
\??\c:\rxrllxr.exec:\rxrllxr.exe212⤵
-
\??\c:\fxrlxxr.exec:\fxrlxxr.exe213⤵
-
\??\c:\nttbbt.exec:\nttbbt.exe214⤵
-
\??\c:\nntttt.exec:\nntttt.exe215⤵
-
\??\c:\vpppp.exec:\vpppp.exe216⤵
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe217⤵
-
\??\c:\1xrxxxx.exec:\1xrxxxx.exe218⤵
-
\??\c:\7ttnhh.exec:\7ttnhh.exe219⤵
-
\??\c:\9bbbtt.exec:\9bbbtt.exe220⤵
-
\??\c:\dvvvv.exec:\dvvvv.exe221⤵
-
\??\c:\jdppj.exec:\jdppj.exe222⤵
-
\??\c:\lrrrrfl.exec:\lrrrrfl.exe223⤵
-
\??\c:\thbtnn.exec:\thbtnn.exe224⤵
-
\??\c:\hbthbt.exec:\hbthbt.exe225⤵
-
\??\c:\vvdpd.exec:\vvdpd.exe226⤵
-
\??\c:\jjjdd.exec:\jjjdd.exe227⤵
-
\??\c:\llrllll.exec:\llrllll.exe228⤵
-
\??\c:\7llxrlf.exec:\7llxrlf.exe229⤵
-
\??\c:\tbnhbb.exec:\tbnhbb.exe230⤵
-
\??\c:\bbntbt.exec:\bbntbt.exe231⤵
-
\??\c:\1pjvp.exec:\1pjvp.exe232⤵
-
\??\c:\vpjdv.exec:\vpjdv.exe233⤵
-
\??\c:\5lfxlff.exec:\5lfxlff.exe234⤵
-
\??\c:\tttbtn.exec:\tttbtn.exe235⤵
-
\??\c:\7tttnn.exec:\7tttnn.exe236⤵
-
\??\c:\dvpjd.exec:\dvpjd.exe237⤵
-
\??\c:\9ddpv.exec:\9ddpv.exe238⤵
-
\??\c:\xfrlxxr.exec:\xfrlxxr.exe239⤵
-
\??\c:\nnhhtn.exec:\nnhhtn.exe240⤵
-
\??\c:\thttbn.exec:\thttbn.exe241⤵