Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 03:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7e3b36ae1a0bb983c492e03f5cca2fc0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
7e3b36ae1a0bb983c492e03f5cca2fc0_NeikiAnalytics.exe
-
Size
85KB
-
MD5
7e3b36ae1a0bb983c492e03f5cca2fc0
-
SHA1
000c0ab678e3a7ac09f5ccc08bc6e604e94c5a9c
-
SHA256
cf70e790cc076d6ef0802ef3b35750385a8485f9a031f8aff6da8c55bf07cab5
-
SHA512
fd023f1fa14e836fc0ca9bd8f307c52bfde21b0b791b1210084b32649a63e0dca1fa8120bc3e6ec0db7972ff4c26b492121ced56bb2f21baffcb10e85ad5d58d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIgt7WxZKmNDnX77lY8/X5QgrciN:ymb3NkkiQ3mdBjFIgte0mNb77Bptt3
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/4576-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5032-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1700-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2848-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1724-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1724-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4492-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2312-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4424-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1832-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2964-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/824-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4316-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2316-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4792-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4720-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2324-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2608-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4504-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1348-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4820-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rxllfll.exennhhhb.exevpppj.exelrlxfxf.exerlxxrrr.exetttnnb.exedvjjd.exedpddj.exexxlflll.exentbtnt.exehnhnht.exefxlfxxx.exelxrxfrr.exetbtbtb.exepjjdd.exexrlllll.exevpppv.exe3vvdv.exe1xfxrll.exehbhhnt.exejvvvv.exeppdjp.exefrfxlrl.exebnthnb.exejddvp.exevjddp.exerlfxffl.exexlrrxxf.exettbbhh.exedvppd.exexfxxxxx.exe1btthh.exenbhbtt.exe3jpjd.exe3xxlfff.exennbnnn.exeppjjp.exe9ddvj.exelrxxxrx.exehnnnhh.exethnhhn.exejjjpj.exelxlfffx.exebbbhbh.exehbbhbb.exejdppp.exerlxrrrf.exelxxxrrr.exetnhhbb.exe9bbbtt.exeppvvv.exepdpjd.exefxfffll.exe7ntntt.exejvppj.exe3ppjd.exe5xxxllf.exeffxfxxr.exe7hnntt.exe5vpjv.exejpdvj.exelfxrffx.exefxrrlfx.exe5bbhtt.exepid process 5032 rxllfll.exe 4908 nnhhhb.exe 1700 vpppj.exe 2848 lrlxfxf.exe 1724 rlxxrrr.exe 4492 tttnnb.exe 2312 dvjjd.exe 5116 dpddj.exe 4424 xxlflll.exe 4688 ntbtnt.exe 1832 hnhnht.exe 2964 fxlfxxx.exe 824 lxrxfrr.exe 116 tbtbtb.exe 2916 pjjdd.exe 1176 xrlllll.exe 4316 vpppv.exe 2316 3vvdv.exe 5036 1xfxrll.exe 4792 hbhhnt.exe 4720 jvvvv.exe 988 ppdjp.exe 2324 frfxlrl.exe 2608 bnthnb.exe 4300 jddvp.exe 4344 vjddp.exe 4504 rlfxffl.exe 2924 xlrrxxf.exe 1348 ttbbhh.exe 3104 dvppd.exe 4820 xfxxxxx.exe 3344 1btthh.exe 3936 nbhbtt.exe 4420 3jpjd.exe 3576 3xxlfff.exe 4816 nnbnnn.exe 3100 ppjjp.exe 4332 9ddvj.exe 3620 lrxxxrx.exe 4844 hnnnhh.exe 2448 thnhhn.exe 1700 jjjpj.exe 5028 lxlfffx.exe 3628 bbbhbh.exe 1300 hbbhbb.exe 2312 jdppp.exe 5076 rlxrrrf.exe 2824 lxxxrrr.exe 3720 tnhhbb.exe 2488 9bbbtt.exe 2724 ppvvv.exe 1036 pdpjd.exe 1584 fxfffll.exe 4916 7ntntt.exe 4632 jvppj.exe 2968 3ppjd.exe 4860 5xxxllf.exe 4316 ffxfxxr.exe 2316 7hnntt.exe 1628 5vpjv.exe 5016 jpdvj.exe 1500 lfxrffx.exe 1928 fxrrlfx.exe 3112 5bbhtt.exe -
Processes:
resource yara_rule behavioral2/memory/4576-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5032-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1700-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2848-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1724-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1724-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4492-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1832-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2964-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/824-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4316-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2316-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4792-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2324-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2608-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4504-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1348-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4820-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7e3b36ae1a0bb983c492e03f5cca2fc0_NeikiAnalytics.exerxllfll.exennhhhb.exevpppj.exelrlxfxf.exerlxxrrr.exetttnnb.exedvjjd.exedpddj.exexxlflll.exentbtnt.exehnhnht.exefxlfxxx.exelxrxfrr.exetbtbtb.exepjjdd.exexrlllll.exevpppv.exe3vvdv.exe1xfxrll.exehbhhnt.exejvvvv.exedescription pid process target process PID 4576 wrote to memory of 5032 4576 7e3b36ae1a0bb983c492e03f5cca2fc0_NeikiAnalytics.exe rxllfll.exe PID 4576 wrote to memory of 5032 4576 7e3b36ae1a0bb983c492e03f5cca2fc0_NeikiAnalytics.exe rxllfll.exe PID 4576 wrote to memory of 5032 4576 7e3b36ae1a0bb983c492e03f5cca2fc0_NeikiAnalytics.exe rxllfll.exe PID 5032 wrote to memory of 4908 5032 rxllfll.exe nnhhhb.exe PID 5032 wrote to memory of 4908 5032 rxllfll.exe nnhhhb.exe PID 5032 wrote to memory of 4908 5032 rxllfll.exe nnhhhb.exe PID 4908 wrote to memory of 1700 4908 nnhhhb.exe vpppj.exe PID 4908 wrote to memory of 1700 4908 nnhhhb.exe vpppj.exe PID 4908 wrote to memory of 1700 4908 nnhhhb.exe vpppj.exe PID 1700 wrote to memory of 2848 1700 vpppj.exe lrlxfxf.exe PID 1700 wrote to memory of 2848 1700 vpppj.exe lrlxfxf.exe PID 1700 wrote to memory of 2848 1700 vpppj.exe lrlxfxf.exe PID 2848 wrote to memory of 1724 2848 lrlxfxf.exe rlxxrrr.exe PID 2848 wrote to memory of 1724 2848 lrlxfxf.exe rlxxrrr.exe PID 2848 wrote to memory of 1724 2848 lrlxfxf.exe rlxxrrr.exe PID 1724 wrote to memory of 4492 1724 rlxxrrr.exe tttnnb.exe PID 1724 wrote to memory of 4492 1724 rlxxrrr.exe tttnnb.exe PID 1724 wrote to memory of 4492 1724 rlxxrrr.exe tttnnb.exe PID 4492 wrote to memory of 2312 4492 tttnnb.exe dvjjd.exe PID 4492 wrote to memory of 2312 4492 tttnnb.exe dvjjd.exe PID 4492 wrote to memory of 2312 4492 tttnnb.exe dvjjd.exe PID 2312 wrote to memory of 5116 2312 dvjjd.exe dpddj.exe PID 2312 wrote to memory of 5116 2312 dvjjd.exe dpddj.exe PID 2312 wrote to memory of 5116 2312 dvjjd.exe dpddj.exe PID 5116 wrote to memory of 4424 5116 dpddj.exe xxlflll.exe PID 5116 wrote to memory of 4424 5116 dpddj.exe xxlflll.exe PID 5116 wrote to memory of 4424 5116 dpddj.exe xxlflll.exe PID 4424 wrote to memory of 4688 4424 xxlflll.exe ntbtnt.exe PID 4424 wrote to memory of 4688 4424 xxlflll.exe ntbtnt.exe PID 4424 wrote to memory of 4688 4424 xxlflll.exe ntbtnt.exe PID 4688 wrote to memory of 1832 4688 ntbtnt.exe hnhnht.exe PID 4688 wrote to memory of 1832 4688 ntbtnt.exe hnhnht.exe PID 4688 wrote to memory of 1832 4688 ntbtnt.exe hnhnht.exe PID 1832 wrote to memory of 2964 1832 hnhnht.exe fxlfxxx.exe PID 1832 wrote to memory of 2964 1832 hnhnht.exe fxlfxxx.exe PID 1832 wrote to memory of 2964 1832 hnhnht.exe fxlfxxx.exe PID 2964 wrote to memory of 824 2964 fxlfxxx.exe lxrxfrr.exe PID 2964 wrote to memory of 824 2964 fxlfxxx.exe lxrxfrr.exe PID 2964 wrote to memory of 824 2964 fxlfxxx.exe lxrxfrr.exe PID 824 wrote to memory of 116 824 lxrxfrr.exe tbtbtb.exe PID 824 wrote to memory of 116 824 lxrxfrr.exe tbtbtb.exe PID 824 wrote to memory of 116 824 lxrxfrr.exe tbtbtb.exe PID 116 wrote to memory of 2916 116 tbtbtb.exe pjjdd.exe PID 116 wrote to memory of 2916 116 tbtbtb.exe pjjdd.exe PID 116 wrote to memory of 2916 116 tbtbtb.exe pjjdd.exe PID 2916 wrote to memory of 1176 2916 pjjdd.exe xrlllll.exe PID 2916 wrote to memory of 1176 2916 pjjdd.exe xrlllll.exe PID 2916 wrote to memory of 1176 2916 pjjdd.exe xrlllll.exe PID 1176 wrote to memory of 4316 1176 xrlllll.exe vpppv.exe PID 1176 wrote to memory of 4316 1176 xrlllll.exe vpppv.exe PID 1176 wrote to memory of 4316 1176 xrlllll.exe vpppv.exe PID 4316 wrote to memory of 2316 4316 vpppv.exe 3vvdv.exe PID 4316 wrote to memory of 2316 4316 vpppv.exe 3vvdv.exe PID 4316 wrote to memory of 2316 4316 vpppv.exe 3vvdv.exe PID 2316 wrote to memory of 5036 2316 3vvdv.exe 1xfxrll.exe PID 2316 wrote to memory of 5036 2316 3vvdv.exe 1xfxrll.exe PID 2316 wrote to memory of 5036 2316 3vvdv.exe 1xfxrll.exe PID 5036 wrote to memory of 4792 5036 1xfxrll.exe hbhhnt.exe PID 5036 wrote to memory of 4792 5036 1xfxrll.exe hbhhnt.exe PID 5036 wrote to memory of 4792 5036 1xfxrll.exe hbhhnt.exe PID 4792 wrote to memory of 4720 4792 hbhhnt.exe jvvvv.exe PID 4792 wrote to memory of 4720 4792 hbhhnt.exe jvvvv.exe PID 4792 wrote to memory of 4720 4792 hbhhnt.exe jvvvv.exe PID 4720 wrote to memory of 988 4720 jvvvv.exe ppdjp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e3b36ae1a0bb983c492e03f5cca2fc0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7e3b36ae1a0bb983c492e03f5cca2fc0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\rxllfll.exec:\rxllfll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnhhhb.exec:\nnhhhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpppj.exec:\vpppj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrlxfxf.exec:\lrlxfxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlxxrrr.exec:\rlxxrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tttnnb.exec:\tttnnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvjjd.exec:\dvjjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dpddj.exec:\dpddj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxlflll.exec:\xxlflll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ntbtnt.exec:\ntbtnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hnhnht.exec:\hnhnht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxlfxxx.exec:\fxlfxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxrxfrr.exec:\lxrxfrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tbtbtb.exec:\tbtbtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjjdd.exec:\pjjdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrlllll.exec:\xrlllll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpppv.exec:\vpppv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3vvdv.exec:\3vvdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1xfxrll.exec:\1xfxrll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbhhnt.exec:\hbhhnt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvvvv.exec:\jvvvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ppdjp.exec:\ppdjp.exe23⤵
- Executes dropped EXE
-
\??\c:\frfxlrl.exec:\frfxlrl.exe24⤵
- Executes dropped EXE
-
\??\c:\bnthnb.exec:\bnthnb.exe25⤵
- Executes dropped EXE
-
\??\c:\jddvp.exec:\jddvp.exe26⤵
- Executes dropped EXE
-
\??\c:\vjddp.exec:\vjddp.exe27⤵
- Executes dropped EXE
-
\??\c:\rlfxffl.exec:\rlfxffl.exe28⤵
- Executes dropped EXE
-
\??\c:\xlrrxxf.exec:\xlrrxxf.exe29⤵
- Executes dropped EXE
-
\??\c:\ttbbhh.exec:\ttbbhh.exe30⤵
- Executes dropped EXE
-
\??\c:\dvppd.exec:\dvppd.exe31⤵
- Executes dropped EXE
-
\??\c:\xfxxxxx.exec:\xfxxxxx.exe32⤵
- Executes dropped EXE
-
\??\c:\1btthh.exec:\1btthh.exe33⤵
- Executes dropped EXE
-
\??\c:\nbhbtt.exec:\nbhbtt.exe34⤵
- Executes dropped EXE
-
\??\c:\3jpjd.exec:\3jpjd.exe35⤵
- Executes dropped EXE
-
\??\c:\3xxlfff.exec:\3xxlfff.exe36⤵
- Executes dropped EXE
-
\??\c:\nnbnnn.exec:\nnbnnn.exe37⤵
- Executes dropped EXE
-
\??\c:\ppjjp.exec:\ppjjp.exe38⤵
- Executes dropped EXE
-
\??\c:\9ddvj.exec:\9ddvj.exe39⤵
- Executes dropped EXE
-
\??\c:\lrxxxrx.exec:\lrxxxrx.exe40⤵
- Executes dropped EXE
-
\??\c:\hnnnhh.exec:\hnnnhh.exe41⤵
- Executes dropped EXE
-
\??\c:\thnhhn.exec:\thnhhn.exe42⤵
- Executes dropped EXE
-
\??\c:\jjjpj.exec:\jjjpj.exe43⤵
- Executes dropped EXE
-
\??\c:\lxlfffx.exec:\lxlfffx.exe44⤵
- Executes dropped EXE
-
\??\c:\bbbhbh.exec:\bbbhbh.exe45⤵
- Executes dropped EXE
-
\??\c:\hbbhbb.exec:\hbbhbb.exe46⤵
- Executes dropped EXE
-
\??\c:\jdppp.exec:\jdppp.exe47⤵
- Executes dropped EXE
-
\??\c:\rlxrrrf.exec:\rlxrrrf.exe48⤵
- Executes dropped EXE
-
\??\c:\lxxxrrr.exec:\lxxxrrr.exe49⤵
- Executes dropped EXE
-
\??\c:\tnhhbb.exec:\tnhhbb.exe50⤵
- Executes dropped EXE
-
\??\c:\9bbbtt.exec:\9bbbtt.exe51⤵
- Executes dropped EXE
-
\??\c:\ppvvv.exec:\ppvvv.exe52⤵
- Executes dropped EXE
-
\??\c:\pdpjd.exec:\pdpjd.exe53⤵
- Executes dropped EXE
-
\??\c:\fxfffll.exec:\fxfffll.exe54⤵
- Executes dropped EXE
-
\??\c:\7ntntt.exec:\7ntntt.exe55⤵
- Executes dropped EXE
-
\??\c:\jvppj.exec:\jvppj.exe56⤵
- Executes dropped EXE
-
\??\c:\3ppjd.exec:\3ppjd.exe57⤵
- Executes dropped EXE
-
\??\c:\5xxxllf.exec:\5xxxllf.exe58⤵
- Executes dropped EXE
-
\??\c:\ffxfxxr.exec:\ffxfxxr.exe59⤵
- Executes dropped EXE
-
\??\c:\7hnntt.exec:\7hnntt.exe60⤵
- Executes dropped EXE
-
\??\c:\5vpjv.exec:\5vpjv.exe61⤵
- Executes dropped EXE
-
\??\c:\jpdvj.exec:\jpdvj.exe62⤵
- Executes dropped EXE
-
\??\c:\lfxrffx.exec:\lfxrffx.exe63⤵
- Executes dropped EXE
-
\??\c:\fxrrlfx.exec:\fxrrlfx.exe64⤵
- Executes dropped EXE
-
\??\c:\5bbhtt.exec:\5bbhtt.exe65⤵
- Executes dropped EXE
-
\??\c:\btttnn.exec:\btttnn.exe66⤵
-
\??\c:\7vjjp.exec:\7vjjp.exe67⤵
-
\??\c:\1djjd.exec:\1djjd.exe68⤵
-
\??\c:\7xfxrrx.exec:\7xfxrrx.exe69⤵
-
\??\c:\btbttt.exec:\btbttt.exe70⤵
-
\??\c:\jjjdj.exec:\jjjdj.exe71⤵
-
\??\c:\pjjdd.exec:\pjjdd.exe72⤵
-
\??\c:\ffxffff.exec:\ffxffff.exe73⤵
-
\??\c:\hntnhb.exec:\hntnhb.exe74⤵
-
\??\c:\bnhnhn.exec:\bnhnhn.exe75⤵
-
\??\c:\jpvvv.exec:\jpvvv.exe76⤵
-
\??\c:\rffxrrl.exec:\rffxrrl.exe77⤵
-
\??\c:\7lrrrxx.exec:\7lrrrxx.exe78⤵
-
\??\c:\httnhh.exec:\httnhh.exe79⤵
-
\??\c:\jvjjd.exec:\jvjjd.exe80⤵
-
\??\c:\ppjvp.exec:\ppjvp.exe81⤵
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe82⤵
-
\??\c:\hbbhbt.exec:\hbbhbt.exe83⤵
-
\??\c:\nbbttt.exec:\nbbttt.exe84⤵
-
\??\c:\xrlfllf.exec:\xrlfllf.exe85⤵
-
\??\c:\5btnbb.exec:\5btnbb.exe86⤵
-
\??\c:\nhtthh.exec:\nhtthh.exe87⤵
-
\??\c:\jjjdv.exec:\jjjdv.exe88⤵
-
\??\c:\5vpjj.exec:\5vpjj.exe89⤵
-
\??\c:\fxrrffr.exec:\fxrrffr.exe90⤵
-
\??\c:\hbhbtt.exec:\hbhbtt.exe91⤵
-
\??\c:\ttnhtt.exec:\ttnhtt.exe92⤵
-
\??\c:\dvdvv.exec:\dvdvv.exe93⤵
-
\??\c:\xrxxffx.exec:\xrxxffx.exe94⤵
-
\??\c:\5llffff.exec:\5llffff.exe95⤵
-
\??\c:\nbnhbb.exec:\nbnhbb.exe96⤵
-
\??\c:\bnnnnn.exec:\bnnnnn.exe97⤵
-
\??\c:\vvdvd.exec:\vvdvd.exe98⤵
-
\??\c:\rfrlxrr.exec:\rfrlxrr.exe99⤵
-
\??\c:\1rrxrrr.exec:\1rrxrrr.exe100⤵
-
\??\c:\tttnht.exec:\tttnht.exe101⤵
-
\??\c:\7pvvd.exec:\7pvvd.exe102⤵
-
\??\c:\7jvpd.exec:\7jvpd.exe103⤵
-
\??\c:\rlxllfl.exec:\rlxllfl.exe104⤵
-
\??\c:\rllfrlf.exec:\rllfrlf.exe105⤵
-
\??\c:\bhbtnh.exec:\bhbtnh.exe106⤵
-
\??\c:\5nnhtt.exec:\5nnhtt.exe107⤵
-
\??\c:\jdjdd.exec:\jdjdd.exe108⤵
-
\??\c:\rffxlff.exec:\rffxlff.exe109⤵
-
\??\c:\xrxrxrl.exec:\xrxrxrl.exe110⤵
-
\??\c:\5nbnhb.exec:\5nbnhb.exe111⤵
-
\??\c:\nbnhbb.exec:\nbnhbb.exe112⤵
-
\??\c:\vvjjj.exec:\vvjjj.exe113⤵
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe114⤵
-
\??\c:\rxrlfxr.exec:\rxrlfxr.exe115⤵
-
\??\c:\nthbhb.exec:\nthbhb.exe116⤵
-
\??\c:\hbtntn.exec:\hbtntn.exe117⤵
-
\??\c:\dvvdd.exec:\dvvdd.exe118⤵
-
\??\c:\rfxlllf.exec:\rfxlllf.exe119⤵
-
\??\c:\fflffff.exec:\fflffff.exe120⤵
-
\??\c:\hbbtnn.exec:\hbbtnn.exe121⤵
-
\??\c:\tttnnn.exec:\tttnnn.exe122⤵
-
\??\c:\dvdvv.exec:\dvdvv.exe123⤵
-
\??\c:\xxrllfx.exec:\xxrllfx.exe124⤵
-
\??\c:\pjddv.exec:\pjddv.exe125⤵
-
\??\c:\dppjd.exec:\dppjd.exe126⤵
-
\??\c:\rlllrlr.exec:\rlllrlr.exe127⤵
-
\??\c:\nbtttt.exec:\nbtttt.exe128⤵
-
\??\c:\hhhhtt.exec:\hhhhtt.exe129⤵
-
\??\c:\jpvpd.exec:\jpvpd.exe130⤵
-
\??\c:\rlxlxxf.exec:\rlxlxxf.exe131⤵
-
\??\c:\5fxlffr.exec:\5fxlffr.exe132⤵
-
\??\c:\lfffxxx.exec:\lfffxxx.exe133⤵
-
\??\c:\htttnn.exec:\htttnn.exe134⤵
-
\??\c:\7tbtnn.exec:\7tbtnn.exe135⤵
-
\??\c:\djjjd.exec:\djjjd.exe136⤵
-
\??\c:\dvdvp.exec:\dvdvp.exe137⤵
-
\??\c:\lfrlffx.exec:\lfrlffx.exe138⤵
-
\??\c:\hnhhnn.exec:\hnhhnn.exe139⤵
-
\??\c:\9bhbtb.exec:\9bhbtb.exe140⤵
-
\??\c:\jjjdd.exec:\jjjdd.exe141⤵
-
\??\c:\pddvj.exec:\pddvj.exe142⤵
-
\??\c:\xrfxrrl.exec:\xrfxrrl.exe143⤵
-
\??\c:\llxxrrr.exec:\llxxrrr.exe144⤵
-
\??\c:\hthbnh.exec:\hthbnh.exe145⤵
-
\??\c:\btbtnt.exec:\btbtnt.exe146⤵
-
\??\c:\vjpjv.exec:\vjpjv.exe147⤵
-
\??\c:\pvdvj.exec:\pvdvj.exe148⤵
-
\??\c:\lffxllf.exec:\lffxllf.exe149⤵
-
\??\c:\rrrrllr.exec:\rrrrllr.exe150⤵
-
\??\c:\tnnnnn.exec:\tnnnnn.exe151⤵
-
\??\c:\3vdvj.exec:\3vdvj.exe152⤵
-
\??\c:\djdpj.exec:\djdpj.exe153⤵
-
\??\c:\fxxrfff.exec:\fxxrfff.exe154⤵
-
\??\c:\rlrffll.exec:\rlrffll.exe155⤵
-
\??\c:\hbnnbb.exec:\hbnnbb.exe156⤵
-
\??\c:\jjpvp.exec:\jjpvp.exe157⤵
-
\??\c:\9vvpj.exec:\9vvpj.exe158⤵
-
\??\c:\5rxrrxx.exec:\5rxrrxx.exe159⤵
-
\??\c:\ffxrlrl.exec:\ffxrlrl.exe160⤵
-
\??\c:\nbhtbh.exec:\nbhtbh.exe161⤵
-
\??\c:\vddvj.exec:\vddvj.exe162⤵
-
\??\c:\frrflff.exec:\frrflff.exe163⤵
-
\??\c:\xxllfxr.exec:\xxllfxr.exe164⤵
-
\??\c:\3tnntt.exec:\3tnntt.exe165⤵
-
\??\c:\bbnbbb.exec:\bbnbbb.exe166⤵
-
\??\c:\xllfxrr.exec:\xllfxrr.exe167⤵
-
\??\c:\hnttnt.exec:\hnttnt.exe168⤵
-
\??\c:\tntbtn.exec:\tntbtn.exe169⤵
-
\??\c:\ppjjp.exec:\ppjjp.exe170⤵
-
\??\c:\3flffff.exec:\3flffff.exe171⤵
-
\??\c:\ffffrrx.exec:\ffffrrx.exe172⤵
-
\??\c:\3hnntt.exec:\3hnntt.exe173⤵
-
\??\c:\9tnbnh.exec:\9tnbnh.exe174⤵
-
\??\c:\1ppjj.exec:\1ppjj.exe175⤵
-
\??\c:\9vvpd.exec:\9vvpd.exe176⤵
-
\??\c:\frllffx.exec:\frllffx.exe177⤵
-
\??\c:\llrfxlx.exec:\llrfxlx.exe178⤵
-
\??\c:\9nnnhb.exec:\9nnnhb.exe179⤵
-
\??\c:\bhnhbb.exec:\bhnhbb.exe180⤵
-
\??\c:\jddvp.exec:\jddvp.exe181⤵
-
\??\c:\tnhhbh.exec:\tnhhbh.exe182⤵
-
\??\c:\1tnnbb.exec:\1tnnbb.exe183⤵
-
\??\c:\xllfrrf.exec:\xllfrrf.exe184⤵
-
\??\c:\btbtbt.exec:\btbtbt.exe185⤵
-
\??\c:\rrrrfff.exec:\rrrrfff.exe186⤵
-
\??\c:\nnntth.exec:\nnntth.exe187⤵
-
\??\c:\tnttnn.exec:\tnttnn.exe188⤵
-
\??\c:\pjjjj.exec:\pjjjj.exe189⤵
-
\??\c:\pvdvv.exec:\pvdvv.exe190⤵
-
\??\c:\xrrlfxx.exec:\xrrlfxx.exe191⤵
-
\??\c:\rlrrllf.exec:\rlrrllf.exe192⤵
-
\??\c:\nhbtnn.exec:\nhbtnn.exe193⤵
-
\??\c:\thnhhh.exec:\thnhhh.exe194⤵
-
\??\c:\thhbtt.exec:\thhbtt.exe195⤵
-
\??\c:\jvvpp.exec:\jvvpp.exe196⤵
-
\??\c:\rrxxrxx.exec:\rrxxrxx.exe197⤵
-
\??\c:\xrfxffx.exec:\xrfxffx.exe198⤵
-
\??\c:\3tbbtn.exec:\3tbbtn.exe199⤵
-
\??\c:\dppjv.exec:\dppjv.exe200⤵
-
\??\c:\djvpj.exec:\djvpj.exe201⤵
-
\??\c:\llrlrrx.exec:\llrlrrx.exe202⤵
-
\??\c:\5llfxff.exec:\5llfxff.exe203⤵
-
\??\c:\tnttnn.exec:\tnttnn.exe204⤵
-
\??\c:\btbttt.exec:\btbttt.exe205⤵
-
\??\c:\ppvjj.exec:\ppvjj.exe206⤵
-
\??\c:\fxlfrrf.exec:\fxlfrrf.exe207⤵
-
\??\c:\fxllfll.exec:\fxllfll.exe208⤵
-
\??\c:\9bnhnt.exec:\9bnhnt.exe209⤵
-
\??\c:\dpvvj.exec:\dpvvj.exe210⤵
-
\??\c:\pvvpj.exec:\pvvpj.exe211⤵
-
\??\c:\flfrrxl.exec:\flfrrxl.exe212⤵
-
\??\c:\lrrrllf.exec:\lrrrllf.exe213⤵
-
\??\c:\5bbhbb.exec:\5bbhbb.exe214⤵
-
\??\c:\ttbbnn.exec:\ttbbnn.exe215⤵
-
\??\c:\pvjdv.exec:\pvjdv.exe216⤵
-
\??\c:\djjjv.exec:\djjjv.exe217⤵
-
\??\c:\lxfxlxr.exec:\lxfxlxr.exe218⤵
-
\??\c:\xfxllll.exec:\xfxllll.exe219⤵
-
\??\c:\btbttn.exec:\btbttn.exe220⤵
-
\??\c:\9pppd.exec:\9pppd.exe221⤵
-
\??\c:\5ppvj.exec:\5ppvj.exe222⤵
-
\??\c:\dvpdp.exec:\dvpdp.exe223⤵
-
\??\c:\9llfxxr.exec:\9llfxxr.exe224⤵
-
\??\c:\xrrllff.exec:\xrrllff.exe225⤵
-
\??\c:\hhbbbb.exec:\hhbbbb.exe226⤵
-
\??\c:\jvvpp.exec:\jvvpp.exe227⤵
-
\??\c:\vpdvv.exec:\vpdvv.exe228⤵
-
\??\c:\dvvvj.exec:\dvvvj.exe229⤵
-
\??\c:\lrfxrrl.exec:\lrfxrrl.exe230⤵
-
\??\c:\lxrllff.exec:\lxrllff.exe231⤵
-
\??\c:\tnhhbb.exec:\tnhhbb.exe232⤵
-
\??\c:\nntthh.exec:\nntthh.exe233⤵
-
\??\c:\5jppp.exec:\5jppp.exe234⤵
-
\??\c:\vjppp.exec:\vjppp.exe235⤵
-
\??\c:\7lrrlrl.exec:\7lrrlrl.exe236⤵
-
\??\c:\3htttt.exec:\3htttt.exe237⤵
-
\??\c:\5bttnh.exec:\5bttnh.exe238⤵
-
\??\c:\5jvpp.exec:\5jvpp.exe239⤵
-
\??\c:\lfflfrl.exec:\lfflfrl.exe240⤵
-
\??\c:\rlrlflf.exec:\rlrlflf.exe241⤵