Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 12:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4f7143f94a9da9575d1f55b80629809abd27de639e899bb8edbc041981a59f37_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4f7143f94a9da9575d1f55b80629809abd27de639e899bb8edbc041981a59f37_NeikiAnalytics.exe
-
Size
66KB
-
MD5
e771e29e516cec7e1e32be8f482ca320
-
SHA1
4e631579e48a145d26800cf82a484c1e1e7642fe
-
SHA256
4f7143f94a9da9575d1f55b80629809abd27de639e899bb8edbc041981a59f37
-
SHA512
4ab348c94005d2c3cc2ebae6fadb56d4855646787e370ec506e8d327e9714105533b43aa471a6d99907d6bb8d85d0901eec0a5a39af8337c8b7ca41f415425c0
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFdJUDbAIw:ymb3NkkiQ3mdBjFIFdJ8bm
Malware Config
Signatures
-
Detect Blackmoon payload 17 IoCs
Processes:
resource yara_rule behavioral1/memory/1924-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1724-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2964-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-60-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2276-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2164-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1444-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
hbntbb.exepppjv.exexxrxrfx.exetnntbh.exetnhbnh.exepjvjj.exe3vpjp.exe9lflxxf.exe1nbhhb.exe5nbbbt.exejpdjj.exexrxflfl.exe7lrlrrx.exe9bnbbh.exe3ntnnh.exeddjpj.exe5vjdd.exe5xflxfl.exerlxlrlf.exetnbbnn.exehbbhnh.exepjvdj.exexlffffl.exexrfxfff.exentbhnb.exebthbtt.exevjjjd.exe1vjpp.exerlxlrxl.exefxrrxfl.exe5btbbn.exe9jddd.exepjvjp.exe1frxxxf.exerrxlrrx.exehbbhhn.exebntntn.exejdjpp.exedpjdp.exexlrlllr.exe7xxxfff.exetbbntn.exe9btnnn.exejddvd.exe1djpv.exe3jvvv.exexlrrxxl.exe3rfflfr.exenhtnnt.exepdjvd.exelfxfrrx.exeffrlxfl.exerfxxfxf.exe3hnbbb.exevpdvv.exevpppp.exedpvpv.exelxlllrx.exexlxxfrr.exebtttnn.exebthhhn.exejvpjj.exelxrlrff.exefflflxl.exepid process 1724 hbntbb.exe 2964 pppjv.exe 2664 xxrxrfx.exe 2700 tnntbh.exe 2696 tnhbnh.exe 2524 pjvjj.exe 2388 3vpjp.exe 2444 9lflxxf.exe 2460 1nbhhb.exe 2728 5nbbbt.exe 2748 jpdjj.exe 2800 xrxflfl.exe 340 7lrlrrx.exe 2276 9bnbbh.exe 2348 3ntnnh.exe 2164 ddjpj.exe 2032 5vjdd.exe 2068 5xflxfl.exe 1976 rlxlrlf.exe 2088 tnbbnn.exe 324 hbbhnh.exe 580 pjvdj.exe 1768 xlffffl.exe 2356 xrfxfff.exe 1916 ntbhnb.exe 964 bthbtt.exe 2248 vjjjd.exe 2960 1vjpp.exe 1444 rlxlrxl.exe 1936 fxrrxfl.exe 2948 5btbbn.exe 996 9jddd.exe 1532 pjvjp.exe 1496 1frxxxf.exe 1912 rrxlrrx.exe 2516 hbbhhn.exe 2536 bntntn.exe 2716 jdjpp.exe 2816 dpjdp.exe 2552 xlrlllr.exe 2448 7xxxfff.exe 2676 tbbntn.exe 2900 9btnnn.exe 2508 jddvd.exe 2636 1djpv.exe 2568 3jvvv.exe 2632 xlrrxxl.exe 1304 3rfflfr.exe 1252 nhtnnt.exe 2272 pdjvd.exe 1220 lfxfrrx.exe 1352 ffrlxfl.exe 2380 rfxxfxf.exe 2368 3hnbbb.exe 2036 vpdvv.exe 1932 vpppp.exe 2888 dpvpv.exe 1608 lxlllrx.exe 2616 xlxxfrr.exe 1732 btttnn.exe 1384 bthhhn.exe 1400 jvpjj.exe 1704 lxrlrff.exe 1900 fflflxl.exe -
Processes:
resource yara_rule behavioral1/memory/1924-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1924-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1724-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2276-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2164-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1444-281-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4f7143f94a9da9575d1f55b80629809abd27de639e899bb8edbc041981a59f37_NeikiAnalytics.exehbntbb.exepppjv.exexxrxrfx.exetnntbh.exetnhbnh.exepjvjj.exe3vpjp.exe9lflxxf.exe1nbhhb.exe5nbbbt.exejpdjj.exexrxflfl.exe7lrlrrx.exe9bnbbh.exe3ntnnh.exedescription pid process target process PID 1924 wrote to memory of 1724 1924 4f7143f94a9da9575d1f55b80629809abd27de639e899bb8edbc041981a59f37_NeikiAnalytics.exe hbntbb.exe PID 1924 wrote to memory of 1724 1924 4f7143f94a9da9575d1f55b80629809abd27de639e899bb8edbc041981a59f37_NeikiAnalytics.exe hbntbb.exe PID 1924 wrote to memory of 1724 1924 4f7143f94a9da9575d1f55b80629809abd27de639e899bb8edbc041981a59f37_NeikiAnalytics.exe hbntbb.exe PID 1924 wrote to memory of 1724 1924 4f7143f94a9da9575d1f55b80629809abd27de639e899bb8edbc041981a59f37_NeikiAnalytics.exe hbntbb.exe PID 1724 wrote to memory of 2964 1724 hbntbb.exe pppjv.exe PID 1724 wrote to memory of 2964 1724 hbntbb.exe pppjv.exe PID 1724 wrote to memory of 2964 1724 hbntbb.exe pppjv.exe PID 1724 wrote to memory of 2964 1724 hbntbb.exe pppjv.exe PID 2964 wrote to memory of 2664 2964 pppjv.exe xxrxrfx.exe PID 2964 wrote to memory of 2664 2964 pppjv.exe xxrxrfx.exe PID 2964 wrote to memory of 2664 2964 pppjv.exe xxrxrfx.exe PID 2964 wrote to memory of 2664 2964 pppjv.exe xxrxrfx.exe PID 2664 wrote to memory of 2700 2664 xxrxrfx.exe tnntbh.exe PID 2664 wrote to memory of 2700 2664 xxrxrfx.exe tnntbh.exe PID 2664 wrote to memory of 2700 2664 xxrxrfx.exe tnntbh.exe PID 2664 wrote to memory of 2700 2664 xxrxrfx.exe tnntbh.exe PID 2700 wrote to memory of 2696 2700 tnntbh.exe tnhbnh.exe PID 2700 wrote to memory of 2696 2700 tnntbh.exe tnhbnh.exe PID 2700 wrote to memory of 2696 2700 tnntbh.exe tnhbnh.exe PID 2700 wrote to memory of 2696 2700 tnntbh.exe tnhbnh.exe PID 2696 wrote to memory of 2524 2696 tnhbnh.exe pjvjj.exe PID 2696 wrote to memory of 2524 2696 tnhbnh.exe pjvjj.exe PID 2696 wrote to memory of 2524 2696 tnhbnh.exe pjvjj.exe PID 2696 wrote to memory of 2524 2696 tnhbnh.exe pjvjj.exe PID 2524 wrote to memory of 2388 2524 pjvjj.exe 3vpjp.exe PID 2524 wrote to memory of 2388 2524 pjvjj.exe 3vpjp.exe PID 2524 wrote to memory of 2388 2524 pjvjj.exe 3vpjp.exe PID 2524 wrote to memory of 2388 2524 pjvjj.exe 3vpjp.exe PID 2388 wrote to memory of 2444 2388 3vpjp.exe 9lflxxf.exe PID 2388 wrote to memory of 2444 2388 3vpjp.exe 9lflxxf.exe PID 2388 wrote to memory of 2444 2388 3vpjp.exe 9lflxxf.exe PID 2388 wrote to memory of 2444 2388 3vpjp.exe 9lflxxf.exe PID 2444 wrote to memory of 2460 2444 9lflxxf.exe 1nbhhb.exe PID 2444 wrote to memory of 2460 2444 9lflxxf.exe 1nbhhb.exe PID 2444 wrote to memory of 2460 2444 9lflxxf.exe 1nbhhb.exe PID 2444 wrote to memory of 2460 2444 9lflxxf.exe 1nbhhb.exe PID 2460 wrote to memory of 2728 2460 1nbhhb.exe 5nbbbt.exe PID 2460 wrote to memory of 2728 2460 1nbhhb.exe 5nbbbt.exe PID 2460 wrote to memory of 2728 2460 1nbhhb.exe 5nbbbt.exe PID 2460 wrote to memory of 2728 2460 1nbhhb.exe 5nbbbt.exe PID 2728 wrote to memory of 2748 2728 5nbbbt.exe jpdjj.exe PID 2728 wrote to memory of 2748 2728 5nbbbt.exe jpdjj.exe PID 2728 wrote to memory of 2748 2728 5nbbbt.exe jpdjj.exe PID 2728 wrote to memory of 2748 2728 5nbbbt.exe jpdjj.exe PID 2748 wrote to memory of 2800 2748 jpdjj.exe xrxflfl.exe PID 2748 wrote to memory of 2800 2748 jpdjj.exe xrxflfl.exe PID 2748 wrote to memory of 2800 2748 jpdjj.exe xrxflfl.exe PID 2748 wrote to memory of 2800 2748 jpdjj.exe xrxflfl.exe PID 2800 wrote to memory of 340 2800 xrxflfl.exe 7lrlrrx.exe PID 2800 wrote to memory of 340 2800 xrxflfl.exe 7lrlrrx.exe PID 2800 wrote to memory of 340 2800 xrxflfl.exe 7lrlrrx.exe PID 2800 wrote to memory of 340 2800 xrxflfl.exe 7lrlrrx.exe PID 340 wrote to memory of 2276 340 7lrlrrx.exe 9bnbbh.exe PID 340 wrote to memory of 2276 340 7lrlrrx.exe 9bnbbh.exe PID 340 wrote to memory of 2276 340 7lrlrrx.exe 9bnbbh.exe PID 340 wrote to memory of 2276 340 7lrlrrx.exe 9bnbbh.exe PID 2276 wrote to memory of 2348 2276 9bnbbh.exe 3ntnnh.exe PID 2276 wrote to memory of 2348 2276 9bnbbh.exe 3ntnnh.exe PID 2276 wrote to memory of 2348 2276 9bnbbh.exe 3ntnnh.exe PID 2276 wrote to memory of 2348 2276 9bnbbh.exe 3ntnnh.exe PID 2348 wrote to memory of 2164 2348 3ntnnh.exe ddjpj.exe PID 2348 wrote to memory of 2164 2348 3ntnnh.exe ddjpj.exe PID 2348 wrote to memory of 2164 2348 3ntnnh.exe ddjpj.exe PID 2348 wrote to memory of 2164 2348 3ntnnh.exe ddjpj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f7143f94a9da9575d1f55b80629809abd27de639e899bb8edbc041981a59f37_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4f7143f94a9da9575d1f55b80629809abd27de639e899bb8edbc041981a59f37_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\hbntbb.exec:\hbntbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pppjv.exec:\pppjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxrxrfx.exec:\xxrxrfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnntbh.exec:\tnntbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnhbnh.exec:\tnhbnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjvjj.exec:\pjvjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3vpjp.exec:\3vpjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9lflxxf.exec:\9lflxxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1nbhhb.exec:\1nbhhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5nbbbt.exec:\5nbbbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpdjj.exec:\jpdjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrxflfl.exec:\xrxflfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7lrlrrx.exec:\7lrlrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9bnbbh.exec:\9bnbbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3ntnnh.exec:\3ntnnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddjpj.exec:\ddjpj.exe17⤵
- Executes dropped EXE
-
\??\c:\5vjdd.exec:\5vjdd.exe18⤵
- Executes dropped EXE
-
\??\c:\5xflxfl.exec:\5xflxfl.exe19⤵
- Executes dropped EXE
-
\??\c:\rlxlrlf.exec:\rlxlrlf.exe20⤵
- Executes dropped EXE
-
\??\c:\tnbbnn.exec:\tnbbnn.exe21⤵
- Executes dropped EXE
-
\??\c:\hbbhnh.exec:\hbbhnh.exe22⤵
- Executes dropped EXE
-
\??\c:\pjvdj.exec:\pjvdj.exe23⤵
- Executes dropped EXE
-
\??\c:\xlffffl.exec:\xlffffl.exe24⤵
- Executes dropped EXE
-
\??\c:\xrfxfff.exec:\xrfxfff.exe25⤵
- Executes dropped EXE
-
\??\c:\ntbhnb.exec:\ntbhnb.exe26⤵
- Executes dropped EXE
-
\??\c:\bthbtt.exec:\bthbtt.exe27⤵
- Executes dropped EXE
-
\??\c:\vjjjd.exec:\vjjjd.exe28⤵
- Executes dropped EXE
-
\??\c:\1vjpp.exec:\1vjpp.exe29⤵
- Executes dropped EXE
-
\??\c:\rlxlrxl.exec:\rlxlrxl.exe30⤵
- Executes dropped EXE
-
\??\c:\fxrrxfl.exec:\fxrrxfl.exe31⤵
- Executes dropped EXE
-
\??\c:\5btbbn.exec:\5btbbn.exe32⤵
- Executes dropped EXE
-
\??\c:\9jddd.exec:\9jddd.exe33⤵
- Executes dropped EXE
-
\??\c:\pjvjp.exec:\pjvjp.exe34⤵
- Executes dropped EXE
-
\??\c:\1frxxxf.exec:\1frxxxf.exe35⤵
- Executes dropped EXE
-
\??\c:\rrxlrrx.exec:\rrxlrrx.exe36⤵
- Executes dropped EXE
-
\??\c:\hbbhhn.exec:\hbbhhn.exe37⤵
- Executes dropped EXE
-
\??\c:\bntntn.exec:\bntntn.exe38⤵
- Executes dropped EXE
-
\??\c:\jdjpp.exec:\jdjpp.exe39⤵
- Executes dropped EXE
-
\??\c:\dpjdp.exec:\dpjdp.exe40⤵
- Executes dropped EXE
-
\??\c:\xlrlllr.exec:\xlrlllr.exe41⤵
- Executes dropped EXE
-
\??\c:\7xxxfff.exec:\7xxxfff.exe42⤵
- Executes dropped EXE
-
\??\c:\tbbntn.exec:\tbbntn.exe43⤵
- Executes dropped EXE
-
\??\c:\9btnnn.exec:\9btnnn.exe44⤵
- Executes dropped EXE
-
\??\c:\jddvd.exec:\jddvd.exe45⤵
- Executes dropped EXE
-
\??\c:\1djpv.exec:\1djpv.exe46⤵
- Executes dropped EXE
-
\??\c:\3jvvv.exec:\3jvvv.exe47⤵
- Executes dropped EXE
-
\??\c:\xlrrxxl.exec:\xlrrxxl.exe48⤵
- Executes dropped EXE
-
\??\c:\3rfflfr.exec:\3rfflfr.exe49⤵
- Executes dropped EXE
-
\??\c:\nhtnnt.exec:\nhtnnt.exe50⤵
- Executes dropped EXE
-
\??\c:\pdjvd.exec:\pdjvd.exe51⤵
- Executes dropped EXE
-
\??\c:\lfxfrrx.exec:\lfxfrrx.exe52⤵
- Executes dropped EXE
-
\??\c:\ffrlxfl.exec:\ffrlxfl.exe53⤵
- Executes dropped EXE
-
\??\c:\rfxxfxf.exec:\rfxxfxf.exe54⤵
- Executes dropped EXE
-
\??\c:\3hnbbb.exec:\3hnbbb.exe55⤵
- Executes dropped EXE
-
\??\c:\vpdvv.exec:\vpdvv.exe56⤵
- Executes dropped EXE
-
\??\c:\vpppp.exec:\vpppp.exe57⤵
- Executes dropped EXE
-
\??\c:\dpvpv.exec:\dpvpv.exe58⤵
- Executes dropped EXE
-
\??\c:\lxlllrx.exec:\lxlllrx.exe59⤵
- Executes dropped EXE
-
\??\c:\xlxxfrr.exec:\xlxxfrr.exe60⤵
- Executes dropped EXE
-
\??\c:\btttnn.exec:\btttnn.exe61⤵
- Executes dropped EXE
-
\??\c:\bthhhn.exec:\bthhhn.exe62⤵
- Executes dropped EXE
-
\??\c:\jvpjj.exec:\jvpjj.exe63⤵
- Executes dropped EXE
-
\??\c:\lxrlrff.exec:\lxrlrff.exe64⤵
- Executes dropped EXE
-
\??\c:\fflflxl.exec:\fflflxl.exe65⤵
- Executes dropped EXE
-
\??\c:\1bhntt.exec:\1bhntt.exe66⤵
-
\??\c:\7nbthh.exec:\7nbthh.exe67⤵
-
\??\c:\vjvpv.exec:\vjvpv.exe68⤵
-
\??\c:\vjppp.exec:\vjppp.exe69⤵
-
\??\c:\rlxrxrl.exec:\rlxrxrl.exe70⤵
-
\??\c:\frrlxrf.exec:\frrlxrf.exe71⤵
-
\??\c:\5nbhtt.exec:\5nbhtt.exe72⤵
-
\??\c:\hnbhnt.exec:\hnbhnt.exe73⤵
-
\??\c:\dvddj.exec:\dvddj.exe74⤵
-
\??\c:\ppdpd.exec:\ppdpd.exe75⤵
-
\??\c:\fxlflrf.exec:\fxlflrf.exe76⤵
-
\??\c:\xrflrrf.exec:\xrflrrf.exe77⤵
-
\??\c:\nhnhnh.exec:\nhnhnh.exe78⤵
-
\??\c:\nbnnnh.exec:\nbnnnh.exe79⤵
-
\??\c:\tnbtnt.exec:\tnbtnt.exe80⤵
-
\??\c:\vvdjj.exec:\vvdjj.exe81⤵
-
\??\c:\pdvdd.exec:\pdvdd.exe82⤵
-
\??\c:\3xxlrrr.exec:\3xxlrrr.exe83⤵
-
\??\c:\9rlffff.exec:\9rlffff.exe84⤵
-
\??\c:\hthhhh.exec:\hthhhh.exe85⤵
-
\??\c:\btbtbt.exec:\btbtbt.exe86⤵
-
\??\c:\vvjjd.exec:\vvjjd.exe87⤵
-
\??\c:\1pddv.exec:\1pddv.exe88⤵
-
\??\c:\lfffrll.exec:\lfffrll.exe89⤵
-
\??\c:\lfflxfx.exec:\lfflxfx.exe90⤵
-
\??\c:\hbnhnn.exec:\hbnhnn.exe91⤵
-
\??\c:\bntttt.exec:\bntttt.exe92⤵
-
\??\c:\5vpdd.exec:\5vpdd.exe93⤵
-
\??\c:\9djjj.exec:\9djjj.exe94⤵
-
\??\c:\5vjdv.exec:\5vjdv.exe95⤵
-
\??\c:\fxfflff.exec:\fxfflff.exe96⤵
-
\??\c:\frllffr.exec:\frllffr.exe97⤵
-
\??\c:\3thbbb.exec:\3thbbb.exe98⤵
-
\??\c:\pjpjp.exec:\pjpjp.exe99⤵
-
\??\c:\ppdjj.exec:\ppdjj.exe100⤵
-
\??\c:\1frllff.exec:\1frllff.exe101⤵
-
\??\c:\xrrlrrx.exec:\xrrlrrx.exe102⤵
-
\??\c:\xrxrrxf.exec:\xrxrrxf.exe103⤵
-
\??\c:\tnnhhh.exec:\tnnhhh.exe104⤵
-
\??\c:\htttnn.exec:\htttnn.exe105⤵
-
\??\c:\vjvpp.exec:\vjvpp.exe106⤵
-
\??\c:\5vdvd.exec:\5vdvd.exe107⤵
-
\??\c:\fxllffl.exec:\fxllffl.exe108⤵
-
\??\c:\frfrrlr.exec:\frfrrlr.exe109⤵
-
\??\c:\frxlrll.exec:\frxlrll.exe110⤵
-
\??\c:\tbtnbt.exec:\tbtnbt.exe111⤵
-
\??\c:\hntttn.exec:\hntttn.exe112⤵
-
\??\c:\jpppp.exec:\jpppp.exe113⤵
-
\??\c:\1dpjj.exec:\1dpjj.exe114⤵
-
\??\c:\pdpvv.exec:\pdpvv.exe115⤵
-
\??\c:\rlxxffx.exec:\rlxxffx.exe116⤵
-
\??\c:\7frrrxr.exec:\7frrrxr.exe117⤵
-
\??\c:\nbbttb.exec:\nbbttb.exe118⤵
-
\??\c:\nbhtbt.exec:\nbhtbt.exe119⤵
-
\??\c:\3jvvd.exec:\3jvvd.exe120⤵
-
\??\c:\pdddv.exec:\pdddv.exe121⤵
-
\??\c:\pddvp.exec:\pddvp.exe122⤵
-
\??\c:\flxlrlr.exec:\flxlrlr.exe123⤵
-
\??\c:\9lrrffl.exec:\9lrrffl.exe124⤵
-
\??\c:\nbbbhb.exec:\nbbbhb.exe125⤵
-
\??\c:\htbhhh.exec:\htbhhh.exe126⤵
-
\??\c:\9tbntn.exec:\9tbntn.exe127⤵
-
\??\c:\dvvvj.exec:\dvvvj.exe128⤵
-
\??\c:\7jdjj.exec:\7jdjj.exe129⤵
-
\??\c:\frlfffl.exec:\frlfffl.exe130⤵
-
\??\c:\9lxfrrl.exec:\9lxfrrl.exe131⤵
-
\??\c:\btbbhb.exec:\btbbhb.exe132⤵
-
\??\c:\5tthbt.exec:\5tthbt.exe133⤵
-
\??\c:\1vpvv.exec:\1vpvv.exe134⤵
-
\??\c:\pdjjp.exec:\pdjjp.exe135⤵
-
\??\c:\rfrllxf.exec:\rfrllxf.exe136⤵
-
\??\c:\xlxxfxx.exec:\xlxxfxx.exe137⤵
-
\??\c:\xlxrxxx.exec:\xlxrxxx.exe138⤵
-
\??\c:\bttntn.exec:\bttntn.exe139⤵
-
\??\c:\5htbtt.exec:\5htbtt.exe140⤵
-
\??\c:\jdjjp.exec:\jdjjp.exe141⤵
-
\??\c:\vpddj.exec:\vpddj.exe142⤵
-
\??\c:\frfffxf.exec:\frfffxf.exe143⤵
-
\??\c:\xlxlrlx.exec:\xlxlrlx.exe144⤵
-
\??\c:\xlfllrr.exec:\xlfllrr.exe145⤵
-
\??\c:\hbbbnn.exec:\hbbbnn.exe146⤵
-
\??\c:\vpvvv.exec:\vpvvv.exe147⤵
-
\??\c:\vjdvd.exec:\vjdvd.exe148⤵
-
\??\c:\dpjdd.exec:\dpjdd.exe149⤵
-
\??\c:\rlrxfrx.exec:\rlrxfrx.exe150⤵
-
\??\c:\lxlxxxx.exec:\lxlxxxx.exe151⤵
-
\??\c:\7bhhhb.exec:\7bhhhb.exe152⤵
-
\??\c:\bntbnn.exec:\bntbnn.exe153⤵
-
\??\c:\jdpjp.exec:\jdpjp.exe154⤵
-
\??\c:\pjddd.exec:\pjddd.exe155⤵
-
\??\c:\ddvdp.exec:\ddvdp.exe156⤵
-
\??\c:\rfrlrrx.exec:\rfrlrrx.exe157⤵
-
\??\c:\fxllllr.exec:\fxllllr.exe158⤵
-
\??\c:\3bnntb.exec:\3bnntb.exe159⤵
-
\??\c:\1tbhbh.exec:\1tbhbh.exe160⤵
-
\??\c:\9vddd.exec:\9vddd.exe161⤵
-
\??\c:\pjppp.exec:\pjppp.exe162⤵
-
\??\c:\xlxfllr.exec:\xlxfllr.exe163⤵
-
\??\c:\lfrxrrx.exec:\lfrxrrx.exe164⤵
-
\??\c:\nhnnnn.exec:\nhnnnn.exe165⤵
-
\??\c:\ntbhbt.exec:\ntbhbt.exe166⤵
-
\??\c:\vpjdp.exec:\vpjdp.exe167⤵
-
\??\c:\3djdv.exec:\3djdv.exe168⤵
-
\??\c:\frlrrxf.exec:\frlrrxf.exe169⤵
-
\??\c:\9frxrxf.exec:\9frxrxf.exe170⤵
-
\??\c:\bbnnbb.exec:\bbnnbb.exe171⤵
-
\??\c:\3hbbbb.exec:\3hbbbb.exe172⤵
-
\??\c:\pjpvj.exec:\pjpvj.exe173⤵
-
\??\c:\jjdvj.exec:\jjdvj.exe174⤵
-
\??\c:\9xffrxf.exec:\9xffrxf.exe175⤵
-
\??\c:\5rfxffl.exec:\5rfxffl.exe176⤵
-
\??\c:\5rllrxx.exec:\5rllrxx.exe177⤵
-
\??\c:\ttnbhh.exec:\ttnbhh.exe178⤵
-
\??\c:\5bttht.exec:\5bttht.exe179⤵
-
\??\c:\1jdvv.exec:\1jdvv.exe180⤵
-
\??\c:\7pvvv.exec:\7pvvv.exe181⤵
-
\??\c:\7xlrrlr.exec:\7xlrrlr.exe182⤵
-
\??\c:\llxfllx.exec:\llxfllx.exe183⤵
-
\??\c:\3htttt.exec:\3htttt.exe184⤵
-
\??\c:\httbnh.exec:\httbnh.exe185⤵
-
\??\c:\1nnhnn.exec:\1nnhnn.exe186⤵
-
\??\c:\ppdvp.exec:\ppdvp.exe187⤵
-
\??\c:\3rfxfxf.exec:\3rfxfxf.exe188⤵
-
\??\c:\fxrxfxf.exec:\fxrxfxf.exe189⤵
-
\??\c:\rfllrxl.exec:\rfllrxl.exe190⤵
-
\??\c:\9hnnnh.exec:\9hnnnh.exe191⤵
-
\??\c:\vpvpd.exec:\vpvpd.exe192⤵
-
\??\c:\pdpjj.exec:\pdpjj.exe193⤵
-
\??\c:\1jddj.exec:\1jddj.exe194⤵
-
\??\c:\5lxxfxf.exec:\5lxxfxf.exe195⤵
-
\??\c:\rlrrrrl.exec:\rlrrrrl.exe196⤵
-
\??\c:\htbtbb.exec:\htbtbb.exe197⤵
-
\??\c:\tnthbt.exec:\tnthbt.exe198⤵
-
\??\c:\jvppd.exec:\jvppd.exe199⤵
-
\??\c:\vpvpp.exec:\vpvpp.exe200⤵
-
\??\c:\rlrrrlx.exec:\rlrrrlx.exe201⤵
-
\??\c:\xrxfffr.exec:\xrxfffr.exe202⤵
-
\??\c:\bttnbb.exec:\bttnbb.exe203⤵
-
\??\c:\nbnbtb.exec:\nbnbtb.exe204⤵
-
\??\c:\dvddd.exec:\dvddd.exe205⤵
-
\??\c:\jdpvj.exec:\jdpvj.exe206⤵
-
\??\c:\1lxxffr.exec:\1lxxffr.exe207⤵
-
\??\c:\lfrflll.exec:\lfrflll.exe208⤵
-
\??\c:\tntntt.exec:\tntntt.exe209⤵
-
\??\c:\tthhbb.exec:\tthhbb.exe210⤵
-
\??\c:\vpdjv.exec:\vpdjv.exe211⤵
-
\??\c:\1dvvd.exec:\1dvvd.exe212⤵
-
\??\c:\rrxxrlr.exec:\rrxxrlr.exe213⤵
-
\??\c:\frflxxl.exec:\frflxxl.exe214⤵
-
\??\c:\hntnbt.exec:\hntnbt.exe215⤵
-
\??\c:\hbbbnt.exec:\hbbbnt.exe216⤵
-
\??\c:\vjjjd.exec:\vjjjd.exe217⤵
-
\??\c:\dpjvv.exec:\dpjvv.exe218⤵
-
\??\c:\xlfxflr.exec:\xlfxflr.exe219⤵
-
\??\c:\1nbtbt.exec:\1nbtbt.exe220⤵
-
\??\c:\bntntn.exec:\bntntn.exe221⤵
-
\??\c:\vvjjj.exec:\vvjjj.exe222⤵
-
\??\c:\5fxrxxf.exec:\5fxrxxf.exe223⤵
-
\??\c:\3hnttt.exec:\3hnttt.exe224⤵
-
\??\c:\nnhhnt.exec:\nnhhnt.exe225⤵
-
\??\c:\1vjdd.exec:\1vjdd.exe226⤵
-
\??\c:\jvpvj.exec:\jvpvj.exe227⤵
-
\??\c:\xflflrf.exec:\xflflrf.exe228⤵
-
\??\c:\rlxfffl.exec:\rlxfffl.exe229⤵
-
\??\c:\hhnnbh.exec:\hhnnbh.exe230⤵
-
\??\c:\hhbbbt.exec:\hhbbbt.exe231⤵
-
\??\c:\vpvpv.exec:\vpvpv.exe232⤵
-
\??\c:\1xxlllr.exec:\1xxlllr.exe233⤵
-
\??\c:\3xrrxrf.exec:\3xrrxrf.exe234⤵
-
\??\c:\nhhbhh.exec:\nhhbhh.exe235⤵
-
\??\c:\nhnnnn.exec:\nhnnnn.exe236⤵
-
\??\c:\3vpjp.exec:\3vpjp.exe237⤵
-
\??\c:\9jjvp.exec:\9jjvp.exe238⤵
-
\??\c:\5rllxrx.exec:\5rllxrx.exe239⤵
-
\??\c:\ffxflrf.exec:\ffxflrf.exe240⤵
-
\??\c:\5thbbb.exec:\5thbbb.exe241⤵