Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 11:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
423ef5895c5425f4adc62778d383277dedee234499182b8f6ff1c5fbe5366031_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
423ef5895c5425f4adc62778d383277dedee234499182b8f6ff1c5fbe5366031_NeikiAnalytics.exe
-
Size
64KB
-
MD5
995fbd6e176e7b01a4b7c01fa4d4dfa0
-
SHA1
28ac9f6ba3a392a557b3abadbcd4ab0526f9dc00
-
SHA256
423ef5895c5425f4adc62778d383277dedee234499182b8f6ff1c5fbe5366031
-
SHA512
0830b6d4ff22a52872fbb5aead55fb93233fd262ff943562b895115ed596e8143eda48dbdec4a146b4716c69c6fec63dffb2431f2f9cd076ba35882b4b0e9c1f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUuYp+5C8+Luvd7:ymb3NkkiQ3mdBjF0yMlC
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/1612-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1224-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1360-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/380-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1744-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1676-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/724-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/948-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2964-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xlxxllf.exepjpvd.exe9xxlrxx.exerrrxxfr.exebbnthh.exe9vppj.exepjdjv.exexlffrrx.exebhthnh.exehbtbhn.exeddvvj.exejvpjj.exellllxlx.exebtnthh.exe9bbhtb.exe7vvjp.exerlrxlrf.exerlxfrxf.exettnbnb.exebtthnb.exepjdpd.exelflrxxf.exelxlrxfl.exebbhnhh.exedvpvd.exevpjpv.exerlrrxxl.exexxrfllr.exe9hnthh.exeppdjv.exe1lxlxrf.exerlxxxxx.exennhnbn.exenhthnt.exe3vpjp.exe5jdpv.exeffrflrx.exefxrfrfr.exettnbnt.exepdpdv.exedvjvv.exerlxxllr.exehbtbnn.exe1nbbtb.exe7dvdv.exexxrffxl.exennbhbb.exetnbhhh.exedjjdj.exexxrfrrl.exennbbhn.exenhhnth.exe7jdpv.exejvppv.exe1rlxlff.exe3nbbnn.exenhnnnt.exennnttt.exedvdjd.exedpjvj.exerrrlrxf.exerlxfxfl.exennbtht.exethbbhn.exepid process 2620 xlxxllf.exe 2564 pjpvd.exe 2540 9xxlrxx.exe 2616 rrrxxfr.exe 2772 bbnthh.exe 2492 9vppj.exe 2508 pjdjv.exe 2916 xlffrrx.exe 1224 bhthnh.exe 1360 hbtbhn.exe 2724 ddvvj.exe 2700 jvpjj.exe 380 llllxlx.exe 1648 btnthh.exe 1744 9bbhtb.exe 2064 7vvjp.exe 2036 rlrxlrf.exe 1676 rlxfrxf.exe 2784 ttnbnb.exe 1924 btthnb.exe 1916 pjdpd.exe 724 lflrxxf.exe 1568 lxlrxfl.exe 800 bbhnhh.exe 2184 dvpvd.exe 948 vpjpv.exe 1620 rlrrxxl.exe 2320 xxrfllr.exe 2964 9hnthh.exe 2848 ppdjv.exe 1632 1lxlxrf.exe 1496 rlxxxxx.exe 1900 nnhnbn.exe 1520 nhthnt.exe 2996 3vpjp.exe 2620 5jdpv.exe 2828 ffrflrx.exe 2716 fxrfrfr.exe 2544 ttnbnt.exe 2464 pdpdv.exe 2732 dvjvv.exe 2448 rlxxllr.exe 2896 hbtbnn.exe 1760 1nbbtb.exe 848 7dvdv.exe 1128 xxrffxl.exe 2704 nnbhbb.exe 1764 tnbhhh.exe 2120 djjdj.exe 2104 xxrfrrl.exe 1608 nnbbhn.exe 2388 nhhnth.exe 1744 7jdpv.exe 1548 jvppv.exe 2776 1rlxlff.exe 2908 3nbbnn.exe 2912 nhnnnt.exe 1996 nnnttt.exe 2164 dvdjd.exe 2416 dpjvj.exe 1916 rrrlrxf.exe 1400 rlxfxfl.exe 832 nnbtht.exe 1280 thbbhn.exe -
Processes:
resource yara_rule behavioral1/memory/1612-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1224-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1360-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/380-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1744-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1676-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/724-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/948-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-279-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
423ef5895c5425f4adc62778d383277dedee234499182b8f6ff1c5fbe5366031_NeikiAnalytics.exexlxxllf.exepjpvd.exe9xxlrxx.exerrrxxfr.exebbnthh.exe9vppj.exepjdjv.exexlffrrx.exebhthnh.exehbtbhn.exeddvvj.exejvpjj.exellllxlx.exebtnthh.exe9bbhtb.exedescription pid process target process PID 1612 wrote to memory of 2620 1612 423ef5895c5425f4adc62778d383277dedee234499182b8f6ff1c5fbe5366031_NeikiAnalytics.exe xlxxllf.exe PID 1612 wrote to memory of 2620 1612 423ef5895c5425f4adc62778d383277dedee234499182b8f6ff1c5fbe5366031_NeikiAnalytics.exe xlxxllf.exe PID 1612 wrote to memory of 2620 1612 423ef5895c5425f4adc62778d383277dedee234499182b8f6ff1c5fbe5366031_NeikiAnalytics.exe xlxxllf.exe PID 1612 wrote to memory of 2620 1612 423ef5895c5425f4adc62778d383277dedee234499182b8f6ff1c5fbe5366031_NeikiAnalytics.exe xlxxllf.exe PID 2620 wrote to memory of 2564 2620 xlxxllf.exe pjpvd.exe PID 2620 wrote to memory of 2564 2620 xlxxllf.exe pjpvd.exe PID 2620 wrote to memory of 2564 2620 xlxxllf.exe pjpvd.exe PID 2620 wrote to memory of 2564 2620 xlxxllf.exe pjpvd.exe PID 2564 wrote to memory of 2540 2564 pjpvd.exe 9xxlrxx.exe PID 2564 wrote to memory of 2540 2564 pjpvd.exe 9xxlrxx.exe PID 2564 wrote to memory of 2540 2564 pjpvd.exe 9xxlrxx.exe PID 2564 wrote to memory of 2540 2564 pjpvd.exe 9xxlrxx.exe PID 2540 wrote to memory of 2616 2540 9xxlrxx.exe rrrxxfr.exe PID 2540 wrote to memory of 2616 2540 9xxlrxx.exe rrrxxfr.exe PID 2540 wrote to memory of 2616 2540 9xxlrxx.exe rrrxxfr.exe PID 2540 wrote to memory of 2616 2540 9xxlrxx.exe rrrxxfr.exe PID 2616 wrote to memory of 2772 2616 rrrxxfr.exe bbnthh.exe PID 2616 wrote to memory of 2772 2616 rrrxxfr.exe bbnthh.exe PID 2616 wrote to memory of 2772 2616 rrrxxfr.exe bbnthh.exe PID 2616 wrote to memory of 2772 2616 rrrxxfr.exe bbnthh.exe PID 2772 wrote to memory of 2492 2772 bbnthh.exe 9vppj.exe PID 2772 wrote to memory of 2492 2772 bbnthh.exe 9vppj.exe PID 2772 wrote to memory of 2492 2772 bbnthh.exe 9vppj.exe PID 2772 wrote to memory of 2492 2772 bbnthh.exe 9vppj.exe PID 2492 wrote to memory of 2508 2492 9vppj.exe pjdjv.exe PID 2492 wrote to memory of 2508 2492 9vppj.exe pjdjv.exe PID 2492 wrote to memory of 2508 2492 9vppj.exe pjdjv.exe PID 2492 wrote to memory of 2508 2492 9vppj.exe pjdjv.exe PID 2508 wrote to memory of 2916 2508 pjdjv.exe xlffrrx.exe PID 2508 wrote to memory of 2916 2508 pjdjv.exe xlffrrx.exe PID 2508 wrote to memory of 2916 2508 pjdjv.exe xlffrrx.exe PID 2508 wrote to memory of 2916 2508 pjdjv.exe xlffrrx.exe PID 2916 wrote to memory of 1224 2916 xlffrrx.exe bhthnh.exe PID 2916 wrote to memory of 1224 2916 xlffrrx.exe bhthnh.exe PID 2916 wrote to memory of 1224 2916 xlffrrx.exe bhthnh.exe PID 2916 wrote to memory of 1224 2916 xlffrrx.exe bhthnh.exe PID 1224 wrote to memory of 1360 1224 bhthnh.exe hbtbhn.exe PID 1224 wrote to memory of 1360 1224 bhthnh.exe hbtbhn.exe PID 1224 wrote to memory of 1360 1224 bhthnh.exe hbtbhn.exe PID 1224 wrote to memory of 1360 1224 bhthnh.exe hbtbhn.exe PID 1360 wrote to memory of 2724 1360 hbtbhn.exe ddvvj.exe PID 1360 wrote to memory of 2724 1360 hbtbhn.exe ddvvj.exe PID 1360 wrote to memory of 2724 1360 hbtbhn.exe ddvvj.exe PID 1360 wrote to memory of 2724 1360 hbtbhn.exe ddvvj.exe PID 2724 wrote to memory of 2700 2724 ddvvj.exe jvpjj.exe PID 2724 wrote to memory of 2700 2724 ddvvj.exe jvpjj.exe PID 2724 wrote to memory of 2700 2724 ddvvj.exe jvpjj.exe PID 2724 wrote to memory of 2700 2724 ddvvj.exe jvpjj.exe PID 2700 wrote to memory of 380 2700 jvpjj.exe llllxlx.exe PID 2700 wrote to memory of 380 2700 jvpjj.exe llllxlx.exe PID 2700 wrote to memory of 380 2700 jvpjj.exe llllxlx.exe PID 2700 wrote to memory of 380 2700 jvpjj.exe llllxlx.exe PID 380 wrote to memory of 1648 380 llllxlx.exe btnthh.exe PID 380 wrote to memory of 1648 380 llllxlx.exe btnthh.exe PID 380 wrote to memory of 1648 380 llllxlx.exe btnthh.exe PID 380 wrote to memory of 1648 380 llllxlx.exe btnthh.exe PID 1648 wrote to memory of 1744 1648 btnthh.exe 9bbhtb.exe PID 1648 wrote to memory of 1744 1648 btnthh.exe 9bbhtb.exe PID 1648 wrote to memory of 1744 1648 btnthh.exe 9bbhtb.exe PID 1648 wrote to memory of 1744 1648 btnthh.exe 9bbhtb.exe PID 1744 wrote to memory of 2064 1744 9bbhtb.exe 7vvjp.exe PID 1744 wrote to memory of 2064 1744 9bbhtb.exe 7vvjp.exe PID 1744 wrote to memory of 2064 1744 9bbhtb.exe 7vvjp.exe PID 1744 wrote to memory of 2064 1744 9bbhtb.exe 7vvjp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\423ef5895c5425f4adc62778d383277dedee234499182b8f6ff1c5fbe5366031_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\423ef5895c5425f4adc62778d383277dedee234499182b8f6ff1c5fbe5366031_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\xlxxllf.exec:\xlxxllf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjpvd.exec:\pjpvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9xxlrxx.exec:\9xxlrxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrrxxfr.exec:\rrrxxfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbnthh.exec:\bbnthh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9vppj.exec:\9vppj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjdjv.exec:\pjdjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xlffrrx.exec:\xlffrrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhthnh.exec:\bhthnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbtbhn.exec:\hbtbhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddvvj.exec:\ddvvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvpjj.exec:\jvpjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llllxlx.exec:\llllxlx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btnthh.exec:\btnthh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9bbhtb.exec:\9bbhtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7vvjp.exec:\7vvjp.exe17⤵
- Executes dropped EXE
-
\??\c:\rlrxlrf.exec:\rlrxlrf.exe18⤵
- Executes dropped EXE
-
\??\c:\rlxfrxf.exec:\rlxfrxf.exe19⤵
- Executes dropped EXE
-
\??\c:\ttnbnb.exec:\ttnbnb.exe20⤵
- Executes dropped EXE
-
\??\c:\btthnb.exec:\btthnb.exe21⤵
- Executes dropped EXE
-
\??\c:\pjdpd.exec:\pjdpd.exe22⤵
- Executes dropped EXE
-
\??\c:\lflrxxf.exec:\lflrxxf.exe23⤵
- Executes dropped EXE
-
\??\c:\lxlrxfl.exec:\lxlrxfl.exe24⤵
- Executes dropped EXE
-
\??\c:\bbhnhh.exec:\bbhnhh.exe25⤵
- Executes dropped EXE
-
\??\c:\dvpvd.exec:\dvpvd.exe26⤵
- Executes dropped EXE
-
\??\c:\vpjpv.exec:\vpjpv.exe27⤵
- Executes dropped EXE
-
\??\c:\rlrrxxl.exec:\rlrrxxl.exe28⤵
- Executes dropped EXE
-
\??\c:\xxrfllr.exec:\xxrfllr.exe29⤵
- Executes dropped EXE
-
\??\c:\9hnthh.exec:\9hnthh.exe30⤵
- Executes dropped EXE
-
\??\c:\ppdjv.exec:\ppdjv.exe31⤵
- Executes dropped EXE
-
\??\c:\1lxlxrf.exec:\1lxlxrf.exe32⤵
- Executes dropped EXE
-
\??\c:\rlxxxxx.exec:\rlxxxxx.exe33⤵
- Executes dropped EXE
-
\??\c:\nnhnbn.exec:\nnhnbn.exe34⤵
- Executes dropped EXE
-
\??\c:\nhthnt.exec:\nhthnt.exe35⤵
- Executes dropped EXE
-
\??\c:\3vpjp.exec:\3vpjp.exe36⤵
- Executes dropped EXE
-
\??\c:\5jdpv.exec:\5jdpv.exe37⤵
- Executes dropped EXE
-
\??\c:\ffrflrx.exec:\ffrflrx.exe38⤵
- Executes dropped EXE
-
\??\c:\fxrfrfr.exec:\fxrfrfr.exe39⤵
- Executes dropped EXE
-
\??\c:\ttnbnt.exec:\ttnbnt.exe40⤵
- Executes dropped EXE
-
\??\c:\pdpdv.exec:\pdpdv.exe41⤵
- Executes dropped EXE
-
\??\c:\dvjvv.exec:\dvjvv.exe42⤵
- Executes dropped EXE
-
\??\c:\rlxxllr.exec:\rlxxllr.exe43⤵
- Executes dropped EXE
-
\??\c:\hbtbnn.exec:\hbtbnn.exe44⤵
- Executes dropped EXE
-
\??\c:\1nbbtb.exec:\1nbbtb.exe45⤵
- Executes dropped EXE
-
\??\c:\7dvdv.exec:\7dvdv.exe46⤵
- Executes dropped EXE
-
\??\c:\xxrffxl.exec:\xxrffxl.exe47⤵
- Executes dropped EXE
-
\??\c:\nnbhbb.exec:\nnbhbb.exe48⤵
- Executes dropped EXE
-
\??\c:\tnbhhh.exec:\tnbhhh.exe49⤵
- Executes dropped EXE
-
\??\c:\djjdj.exec:\djjdj.exe50⤵
- Executes dropped EXE
-
\??\c:\xxrfrrl.exec:\xxrfrrl.exe51⤵
- Executes dropped EXE
-
\??\c:\nnbbhn.exec:\nnbbhn.exe52⤵
- Executes dropped EXE
-
\??\c:\nhhnth.exec:\nhhnth.exe53⤵
- Executes dropped EXE
-
\??\c:\7jdpv.exec:\7jdpv.exe54⤵
- Executes dropped EXE
-
\??\c:\jvppv.exec:\jvppv.exe55⤵
- Executes dropped EXE
-
\??\c:\1rlxlff.exec:\1rlxlff.exe56⤵
- Executes dropped EXE
-
\??\c:\3nbbnn.exec:\3nbbnn.exe57⤵
- Executes dropped EXE
-
\??\c:\nhnnnt.exec:\nhnnnt.exe58⤵
- Executes dropped EXE
-
\??\c:\nnnttt.exec:\nnnttt.exe59⤵
- Executes dropped EXE
-
\??\c:\dvdjd.exec:\dvdjd.exe60⤵
- Executes dropped EXE
-
\??\c:\dpjvj.exec:\dpjvj.exe61⤵
- Executes dropped EXE
-
\??\c:\rrrlrxf.exec:\rrrlrxf.exe62⤵
- Executes dropped EXE
-
\??\c:\rlxfxfl.exec:\rlxfxfl.exe63⤵
- Executes dropped EXE
-
\??\c:\nnbtht.exec:\nnbtht.exe64⤵
- Executes dropped EXE
-
\??\c:\thbbhn.exec:\thbbhn.exe65⤵
- Executes dropped EXE
-
\??\c:\7dvjv.exec:\7dvjv.exe66⤵
-
\??\c:\vjjvv.exec:\vjjvv.exe67⤵
-
\??\c:\lfllffl.exec:\lfllffl.exe68⤵
-
\??\c:\fxlxfxf.exec:\fxlxfxf.exe69⤵
-
\??\c:\7thnbh.exec:\7thnbh.exe70⤵
-
\??\c:\tnbhhn.exec:\tnbhhn.exe71⤵
-
\??\c:\jjjjv.exec:\jjjjv.exe72⤵
-
\??\c:\dvjjp.exec:\dvjjp.exe73⤵
-
\??\c:\fxfxxxf.exec:\fxfxxxf.exe74⤵
-
\??\c:\rffxxrl.exec:\rffxxrl.exe75⤵
-
\??\c:\hhbnhh.exec:\hhbnhh.exe76⤵
-
\??\c:\bthntn.exec:\bthntn.exe77⤵
-
\??\c:\vvvpp.exec:\vvvpp.exe78⤵
-
\??\c:\dvvjp.exec:\dvvjp.exe79⤵
-
\??\c:\xxlxxfx.exec:\xxlxxfx.exe80⤵
-
\??\c:\7rrfrxr.exec:\7rrfrxr.exe81⤵
-
\??\c:\xrlrxxf.exec:\xrlrxxf.exe82⤵
-
\??\c:\hbhnbh.exec:\hbhnbh.exe83⤵
-
\??\c:\7btntb.exec:\7btntb.exe84⤵
-
\??\c:\dpdjp.exec:\dpdjp.exe85⤵
-
\??\c:\jdvdj.exec:\jdvdj.exe86⤵
-
\??\c:\xrrrffl.exec:\xrrrffl.exe87⤵
-
\??\c:\hthhtn.exec:\hthhtn.exe88⤵
-
\??\c:\1bnnnn.exec:\1bnnnn.exe89⤵
-
\??\c:\pppdp.exec:\pppdp.exe90⤵
-
\??\c:\jjdjv.exec:\jjdjv.exe91⤵
-
\??\c:\ddvvd.exec:\ddvvd.exe92⤵
-
\??\c:\fxxlllf.exec:\fxxlllf.exe93⤵
-
\??\c:\3xlxfxf.exec:\3xlxfxf.exe94⤵
-
\??\c:\tnbhbt.exec:\tnbhbt.exe95⤵
-
\??\c:\btbbhb.exec:\btbbhb.exe96⤵
-
\??\c:\vpdpd.exec:\vpdpd.exe97⤵
-
\??\c:\pppvd.exec:\pppvd.exe98⤵
-
\??\c:\7rfrfxl.exec:\7rfrfxl.exe99⤵
-
\??\c:\lllffrf.exec:\lllffrf.exe100⤵
-
\??\c:\9rllrxr.exec:\9rllrxr.exe101⤵
-
\??\c:\hbnhnt.exec:\hbnhnt.exe102⤵
-
\??\c:\tntbbh.exec:\tntbbh.exe103⤵
-
\??\c:\ppjvj.exec:\ppjvj.exe104⤵
-
\??\c:\jdpvd.exec:\jdpvd.exe105⤵
-
\??\c:\xxxxlrx.exec:\xxxxlrx.exe106⤵
-
\??\c:\xrffllx.exec:\xrffllx.exe107⤵
-
\??\c:\tththh.exec:\tththh.exe108⤵
-
\??\c:\nnttbt.exec:\nnttbt.exe109⤵
-
\??\c:\7dvdj.exec:\7dvdj.exe110⤵
-
\??\c:\jjjpj.exec:\jjjpj.exe111⤵
-
\??\c:\jjdjj.exec:\jjdjj.exe112⤵
-
\??\c:\rrxfrlr.exec:\rrxfrlr.exe113⤵
-
\??\c:\thhtbn.exec:\thhtbn.exe114⤵
-
\??\c:\hhbbbh.exec:\hhbbbh.exe115⤵
-
\??\c:\btnnnh.exec:\btnnnh.exe116⤵
-
\??\c:\jdpvd.exec:\jdpvd.exe117⤵
-
\??\c:\jvjpp.exec:\jvjpp.exe118⤵
-
\??\c:\fxxfxlx.exec:\fxxfxlx.exe119⤵
-
\??\c:\xxrfrfx.exec:\xxrfrfx.exe120⤵
-
\??\c:\tntthh.exec:\tntthh.exe121⤵
-
\??\c:\nbnbhh.exec:\nbnbhh.exe122⤵
-
\??\c:\dvjpd.exec:\dvjpd.exe123⤵
-
\??\c:\dvjvd.exec:\dvjvd.exe124⤵
-
\??\c:\7lfxxfx.exec:\7lfxxfx.exe125⤵
-
\??\c:\xxfrllr.exec:\xxfrllr.exe126⤵
-
\??\c:\nnhnbb.exec:\nnhnbb.exe127⤵
-
\??\c:\9ntttb.exec:\9ntttb.exe128⤵
-
\??\c:\9ppvd.exec:\9ppvd.exe129⤵
-
\??\c:\jdvdd.exec:\jdvdd.exe130⤵
-
\??\c:\lflxffr.exec:\lflxffr.exe131⤵
-
\??\c:\lfrxffl.exec:\lfrxffl.exe132⤵
-
\??\c:\bbhbhb.exec:\bbhbhb.exe133⤵
-
\??\c:\tnbbbb.exec:\tnbbbb.exe134⤵
-
\??\c:\pjdjv.exec:\pjdjv.exe135⤵
-
\??\c:\5pdpj.exec:\5pdpj.exe136⤵
-
\??\c:\lffflrr.exec:\lffflrr.exe137⤵
-
\??\c:\lfxrxlr.exec:\lfxrxlr.exe138⤵
-
\??\c:\lxrfrrf.exec:\lxrfrrf.exe139⤵
-
\??\c:\9hhbtb.exec:\9hhbtb.exe140⤵
-
\??\c:\3tnbth.exec:\3tnbth.exe141⤵
-
\??\c:\jvjpv.exec:\jvjpv.exe142⤵
-
\??\c:\xxxffll.exec:\xxxffll.exe143⤵
-
\??\c:\5xrfxfr.exec:\5xrfxfr.exe144⤵
-
\??\c:\7xrlrxl.exec:\7xrlrxl.exe145⤵
-
\??\c:\bbhnht.exec:\bbhnht.exe146⤵
-
\??\c:\bbhbnn.exec:\bbhbnn.exe147⤵
-
\??\c:\5vvjj.exec:\5vvjj.exe148⤵
-
\??\c:\jpjdp.exec:\jpjdp.exe149⤵
-
\??\c:\xrflrfr.exec:\xrflrfr.exe150⤵
-
\??\c:\3lxfflx.exec:\3lxfflx.exe151⤵
-
\??\c:\nbtttb.exec:\nbtttb.exe152⤵
-
\??\c:\7nhhnb.exec:\7nhhnb.exe153⤵
-
\??\c:\vvpvv.exec:\vvpvv.exe154⤵
-
\??\c:\vpvvv.exec:\vpvvv.exe155⤵
-
\??\c:\lrrxxfx.exec:\lrrxxfx.exe156⤵
-
\??\c:\ffxrxfr.exec:\ffxrxfr.exe157⤵
-
\??\c:\bhnhnb.exec:\bhnhnb.exe158⤵
-
\??\c:\bthhhn.exec:\bthhhn.exe159⤵
-
\??\c:\vjpvp.exec:\vjpvp.exe160⤵
-
\??\c:\dpjjp.exec:\dpjjp.exe161⤵
-
\??\c:\9rlrllr.exec:\9rlrllr.exe162⤵
-
\??\c:\xfflxrr.exec:\xfflxrr.exe163⤵
-
\??\c:\3htbhn.exec:\3htbhn.exe164⤵
-
\??\c:\bnhnnh.exec:\bnhnnh.exe165⤵
-
\??\c:\pjdpp.exec:\pjdpp.exe166⤵
-
\??\c:\1vjpv.exec:\1vjpv.exe167⤵
-
\??\c:\frfxrrr.exec:\frfxrrr.exe168⤵
-
\??\c:\frxxffr.exec:\frxxffr.exe169⤵
-
\??\c:\htbbtn.exec:\htbbtn.exe170⤵
-
\??\c:\nbntbb.exec:\nbntbb.exe171⤵
-
\??\c:\btbttt.exec:\btbttt.exe172⤵
-
\??\c:\vjvjj.exec:\vjvjj.exe173⤵
-
\??\c:\pjdjj.exec:\pjdjj.exe174⤵
-
\??\c:\fxrrxxx.exec:\fxrrxxx.exe175⤵
-
\??\c:\fxlrxfl.exec:\fxlrxfl.exe176⤵
-
\??\c:\nhbhnn.exec:\nhbhnn.exe177⤵
-
\??\c:\9hnbhb.exec:\9hnbhb.exe178⤵
-
\??\c:\7djpv.exec:\7djpv.exe179⤵
-
\??\c:\3vjpd.exec:\3vjpd.exe180⤵
-
\??\c:\5xxrxrx.exec:\5xxrxrx.exe181⤵
-
\??\c:\llllrrx.exec:\llllrrx.exe182⤵
-
\??\c:\lflxllx.exec:\lflxllx.exe183⤵
-
\??\c:\ttnbbt.exec:\ttnbbt.exe184⤵
-
\??\c:\nnnbht.exec:\nnnbht.exe185⤵
-
\??\c:\pppdj.exec:\pppdj.exe186⤵
-
\??\c:\vdpdv.exec:\vdpdv.exe187⤵
-
\??\c:\rlrrxxl.exec:\rlrrxxl.exe188⤵
-
\??\c:\1lffrrx.exec:\1lffrrx.exe189⤵
-
\??\c:\9nhhhh.exec:\9nhhhh.exe190⤵
-
\??\c:\tntbhn.exec:\tntbhn.exe191⤵
-
\??\c:\9jvdj.exec:\9jvdj.exe192⤵
-
\??\c:\7jvvd.exec:\7jvvd.exe193⤵
-
\??\c:\xlxxfxx.exec:\xlxxfxx.exe194⤵
-
\??\c:\fxffrrf.exec:\fxffrrf.exe195⤵
-
\??\c:\thnthh.exec:\thnthh.exe196⤵
-
\??\c:\hbnnnn.exec:\hbnnnn.exe197⤵
-
\??\c:\5thhnn.exec:\5thhnn.exe198⤵
-
\??\c:\ddppv.exec:\ddppv.exe199⤵
-
\??\c:\vjdjp.exec:\vjdjp.exe200⤵
-
\??\c:\lxrflrx.exec:\lxrflrx.exe201⤵
-
\??\c:\fxffrrr.exec:\fxffrrr.exe202⤵
-
\??\c:\hbnnnn.exec:\hbnnnn.exe203⤵
-
\??\c:\5hbnhh.exec:\5hbnhh.exe204⤵
-
\??\c:\jdvdj.exec:\jdvdj.exe205⤵
-
\??\c:\pdjjp.exec:\pdjjp.exe206⤵
-
\??\c:\3frlxfl.exec:\3frlxfl.exe207⤵
-
\??\c:\xxrxrrx.exec:\xxrxrrx.exe208⤵
-
\??\c:\5btnth.exec:\5btnth.exe209⤵
-
\??\c:\jdpvv.exec:\jdpvv.exe210⤵
-
\??\c:\ddppd.exec:\ddppd.exe211⤵
-
\??\c:\rrlfxrf.exec:\rrlfxrf.exe212⤵
-
\??\c:\1fxxflx.exec:\1fxxflx.exe213⤵
-
\??\c:\htbhtt.exec:\htbhtt.exe214⤵
-
\??\c:\hbnhnn.exec:\hbnhnn.exe215⤵
-
\??\c:\3jddj.exec:\3jddj.exe216⤵
-
\??\c:\jvdvj.exec:\jvdvj.exe217⤵
-
\??\c:\xlxxllr.exec:\xlxxllr.exe218⤵
-
\??\c:\rfxffxx.exec:\rfxffxx.exe219⤵
-
\??\c:\1ntbth.exec:\1ntbth.exe220⤵
-
\??\c:\btnhnn.exec:\btnhnn.exe221⤵
-
\??\c:\jdpdv.exec:\jdpdv.exe222⤵
-
\??\c:\5vpdd.exec:\5vpdd.exe223⤵
-
\??\c:\9vpdj.exec:\9vpdj.exe224⤵
-
\??\c:\lfrlflx.exec:\lfrlflx.exe225⤵
-
\??\c:\nhnbnt.exec:\nhnbnt.exe226⤵
-
\??\c:\hbnbnh.exec:\hbnbnh.exe227⤵
-
\??\c:\7htntt.exec:\7htntt.exe228⤵
-
\??\c:\7pjpv.exec:\7pjpv.exe229⤵
-
\??\c:\jdppv.exec:\jdppv.exe230⤵
-
\??\c:\ffxfffr.exec:\ffxfffr.exe231⤵
-
\??\c:\xlfflrl.exec:\xlfflrl.exe232⤵
-
\??\c:\hnbtnt.exec:\hnbtnt.exe233⤵
-
\??\c:\hbtbth.exec:\hbtbth.exe234⤵
-
\??\c:\dvpdv.exec:\dvpdv.exe235⤵
-
\??\c:\pjvvd.exec:\pjvvd.exe236⤵
-
\??\c:\9fxllrx.exec:\9fxllrx.exe237⤵
-
\??\c:\rlrxffl.exec:\rlrxffl.exe238⤵
-
\??\c:\3lfrxxf.exec:\3lfrxxf.exe239⤵
-
\??\c:\bnbbhh.exec:\bnbbhh.exe240⤵
-
\??\c:\jdpvd.exec:\jdpvd.exe241⤵