Analysis
-
max time kernel
149s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 19:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
071724ce31366f800f04f3ed10f6ea00_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
071724ce31366f800f04f3ed10f6ea00_NeikiAnalytics.exe
-
Size
60KB
-
MD5
071724ce31366f800f04f3ed10f6ea00
-
SHA1
eac7ef090b246984ecfdae6bced81505037575d9
-
SHA256
a58166adb95932e89137cc187b1aeec06304c968f54db3bb244d7462ee883483
-
SHA512
8c65735d71823a6f5c83784d880e434ad7fd8edcc0b98ce48d8be8152d2138f944b99d56eb63c977b98a0cb6f20cb3919f6eaf9ba53b6b007f41772aa1032fb7
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvAEaFJLw:ymb3NkkiQ3mdBjFIvAvw
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/2668-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-17-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2564-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1032-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4444-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4484-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1460-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3100-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2816-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2284-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4740-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3516-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2384-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4540-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4208-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3756-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2764-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3152-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2568-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1120-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2748-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bntttt.exedvvvv.exe7dpjd.exepdjdv.exejpvvd.exefrxxxfl.exejjdvj.exexxlflrl.exe1rxxxff.exehhbbnn.exejjvdj.exe3rxrlll.exenhhhbb.exejjjpj.exexrrlflr.exerflfxxr.exehbtttn.exevjddv.exefrffxfx.exetbhbtt.exedvvpj.exelffflxr.exebthtnn.exehbnbth.exedjvvj.exexxlfxrx.exethnhhh.exeddvdv.exedpvpd.exeffllxff.exebthbnn.exepjddd.exelrxlxfr.exetnnnhh.exetnnhbt.exeppjvp.exelrrxxfl.exerxxlfrx.exetbhnbt.exehbtbtt.exe7dpvd.exevpjpd.exerllxrlr.exebthhhh.exe5jddv.exejpjpj.exerrllrll.exexlflffr.exebbbtnt.exenbhbhb.exeppvvd.exexlrllrr.exebnnhbb.exenntnbb.exedpddp.exexlrflll.exebhntbh.exe7ththb.exevjvvj.exe7xxxxff.exebntnhb.exebnbbhh.exepvjpd.exefxxrrrr.exepid process 2344 bntttt.exe 2564 dvvvv.exe 4484 7dpjd.exe 4444 pdjdv.exe 1032 jpvvd.exe 1460 frxxxfl.exe 4068 jjdvj.exe 3100 xxlflrl.exe 2816 1rxxxff.exe 4568 hhbbnn.exe 2284 jjvdj.exe 2720 3rxrlll.exe 1116 nhhhbb.exe 4740 jjjpj.exe 3984 xrrlflr.exe 3516 rflfxxr.exe 2384 hbtttn.exe 4540 vjddv.exe 4208 frffxfx.exe 3756 tbhbtt.exe 4536 dvvpj.exe 2764 lffflxr.exe 4900 bthtnn.exe 3152 hbnbth.exe 2568 djvvj.exe 1972 xxlfxrx.exe 5040 thnhhh.exe 1120 ddvdv.exe 4232 dpvpd.exe 2748 ffllxff.exe 3956 bthbnn.exe 1976 pjddd.exe 1432 lrxlxfr.exe 4944 tnnnhh.exe 244 tnnhbt.exe 3656 ppjvp.exe 2628 lrrxxfl.exe 2308 rxxlfrx.exe 1736 tbhnbt.exe 2056 hbtbtt.exe 2240 7dpvd.exe 2524 vpjpd.exe 3596 rllxrlr.exe 4444 bthhhh.exe 1628 5jddv.exe 4440 jpjpj.exe 3608 rrllrll.exe 4716 xlflffr.exe 2364 bbbtnt.exe 1984 nbhbhb.exe 1272 ppvvd.exe 2284 xlrllrr.exe 3864 bnnhbb.exe 5072 nntnbb.exe 5104 dpddp.exe 4740 xlrflll.exe 1188 bhntbh.exe 456 7ththb.exe 2500 vjvvj.exe 2384 7xxxxff.exe 4540 bntnhb.exe 2768 bnbbhh.exe 1764 pvjpd.exe 3792 fxxrrrr.exe -
Processes:
resource yara_rule behavioral2/memory/2668-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2564-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1032-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4484-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4484-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1460-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3100-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4568-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2284-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4740-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3984-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3516-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2384-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4540-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4208-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3756-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2764-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3152-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2568-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1120-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2748-197-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
071724ce31366f800f04f3ed10f6ea00_NeikiAnalytics.exebntttt.exedvvvv.exe7dpjd.exepdjdv.exejpvvd.exefrxxxfl.exejjdvj.exexxlflrl.exe1rxxxff.exehhbbnn.exejjvdj.exe3rxrlll.exenhhhbb.exejjjpj.exexrrlflr.exerflfxxr.exehbtttn.exevjddv.exefrffxfx.exetbhbtt.exedvvpj.exedescription pid process target process PID 2668 wrote to memory of 2344 2668 071724ce31366f800f04f3ed10f6ea00_NeikiAnalytics.exe bntttt.exe PID 2668 wrote to memory of 2344 2668 071724ce31366f800f04f3ed10f6ea00_NeikiAnalytics.exe bntttt.exe PID 2668 wrote to memory of 2344 2668 071724ce31366f800f04f3ed10f6ea00_NeikiAnalytics.exe bntttt.exe PID 2344 wrote to memory of 2564 2344 bntttt.exe dvvvv.exe PID 2344 wrote to memory of 2564 2344 bntttt.exe dvvvv.exe PID 2344 wrote to memory of 2564 2344 bntttt.exe dvvvv.exe PID 2564 wrote to memory of 4484 2564 dvvvv.exe 7dpjd.exe PID 2564 wrote to memory of 4484 2564 dvvvv.exe 7dpjd.exe PID 2564 wrote to memory of 4484 2564 dvvvv.exe 7dpjd.exe PID 4484 wrote to memory of 4444 4484 7dpjd.exe pdjdv.exe PID 4484 wrote to memory of 4444 4484 7dpjd.exe pdjdv.exe PID 4484 wrote to memory of 4444 4484 7dpjd.exe pdjdv.exe PID 4444 wrote to memory of 1032 4444 pdjdv.exe jpvvd.exe PID 4444 wrote to memory of 1032 4444 pdjdv.exe jpvvd.exe PID 4444 wrote to memory of 1032 4444 pdjdv.exe jpvvd.exe PID 1032 wrote to memory of 1460 1032 jpvvd.exe frxxxfl.exe PID 1032 wrote to memory of 1460 1032 jpvvd.exe frxxxfl.exe PID 1032 wrote to memory of 1460 1032 jpvvd.exe frxxxfl.exe PID 1460 wrote to memory of 4068 1460 frxxxfl.exe jjdvj.exe PID 1460 wrote to memory of 4068 1460 frxxxfl.exe jjdvj.exe PID 1460 wrote to memory of 4068 1460 frxxxfl.exe jjdvj.exe PID 4068 wrote to memory of 3100 4068 jjdvj.exe xxlflrl.exe PID 4068 wrote to memory of 3100 4068 jjdvj.exe xxlflrl.exe PID 4068 wrote to memory of 3100 4068 jjdvj.exe xxlflrl.exe PID 3100 wrote to memory of 2816 3100 xxlflrl.exe 1rxxxff.exe PID 3100 wrote to memory of 2816 3100 xxlflrl.exe 1rxxxff.exe PID 3100 wrote to memory of 2816 3100 xxlflrl.exe 1rxxxff.exe PID 2816 wrote to memory of 4568 2816 1rxxxff.exe hhbbnn.exe PID 2816 wrote to memory of 4568 2816 1rxxxff.exe hhbbnn.exe PID 2816 wrote to memory of 4568 2816 1rxxxff.exe hhbbnn.exe PID 4568 wrote to memory of 2284 4568 hhbbnn.exe jjvdj.exe PID 4568 wrote to memory of 2284 4568 hhbbnn.exe jjvdj.exe PID 4568 wrote to memory of 2284 4568 hhbbnn.exe jjvdj.exe PID 2284 wrote to memory of 2720 2284 jjvdj.exe 3rxrlll.exe PID 2284 wrote to memory of 2720 2284 jjvdj.exe 3rxrlll.exe PID 2284 wrote to memory of 2720 2284 jjvdj.exe 3rxrlll.exe PID 2720 wrote to memory of 1116 2720 3rxrlll.exe nhhhbb.exe PID 2720 wrote to memory of 1116 2720 3rxrlll.exe nhhhbb.exe PID 2720 wrote to memory of 1116 2720 3rxrlll.exe nhhhbb.exe PID 1116 wrote to memory of 4740 1116 nhhhbb.exe jjjpj.exe PID 1116 wrote to memory of 4740 1116 nhhhbb.exe jjjpj.exe PID 1116 wrote to memory of 4740 1116 nhhhbb.exe jjjpj.exe PID 4740 wrote to memory of 3984 4740 jjjpj.exe xrrlflr.exe PID 4740 wrote to memory of 3984 4740 jjjpj.exe xrrlflr.exe PID 4740 wrote to memory of 3984 4740 jjjpj.exe xrrlflr.exe PID 3984 wrote to memory of 3516 3984 xrrlflr.exe rflfxxr.exe PID 3984 wrote to memory of 3516 3984 xrrlflr.exe rflfxxr.exe PID 3984 wrote to memory of 3516 3984 xrrlflr.exe rflfxxr.exe PID 3516 wrote to memory of 2384 3516 rflfxxr.exe hbtttn.exe PID 3516 wrote to memory of 2384 3516 rflfxxr.exe hbtttn.exe PID 3516 wrote to memory of 2384 3516 rflfxxr.exe hbtttn.exe PID 2384 wrote to memory of 4540 2384 hbtttn.exe vjddv.exe PID 2384 wrote to memory of 4540 2384 hbtttn.exe vjddv.exe PID 2384 wrote to memory of 4540 2384 hbtttn.exe vjddv.exe PID 4540 wrote to memory of 4208 4540 vjddv.exe frffxfx.exe PID 4540 wrote to memory of 4208 4540 vjddv.exe frffxfx.exe PID 4540 wrote to memory of 4208 4540 vjddv.exe frffxfx.exe PID 4208 wrote to memory of 3756 4208 frffxfx.exe tbhbtt.exe PID 4208 wrote to memory of 3756 4208 frffxfx.exe tbhbtt.exe PID 4208 wrote to memory of 3756 4208 frffxfx.exe tbhbtt.exe PID 3756 wrote to memory of 4536 3756 tbhbtt.exe dvvpj.exe PID 3756 wrote to memory of 4536 3756 tbhbtt.exe dvvpj.exe PID 3756 wrote to memory of 4536 3756 tbhbtt.exe dvvpj.exe PID 4536 wrote to memory of 2764 4536 dvvpj.exe lffflxr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\071724ce31366f800f04f3ed10f6ea00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\071724ce31366f800f04f3ed10f6ea00_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\bntttt.exec:\bntttt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvvvv.exec:\dvvvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7dpjd.exec:\7dpjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdjdv.exec:\pdjdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpvvd.exec:\jpvvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frxxxfl.exec:\frxxxfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjdvj.exec:\jjdvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxlflrl.exec:\xxlflrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1rxxxff.exec:\1rxxxff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhbbnn.exec:\hhbbnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjvdj.exec:\jjvdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3rxrlll.exec:\3rxrlll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhhhbb.exec:\nhhhbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjjpj.exec:\jjjpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrrlflr.exec:\xrrlflr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rflfxxr.exec:\rflfxxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbtttn.exec:\hbtttn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjddv.exec:\vjddv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frffxfx.exec:\frffxfx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tbhbtt.exec:\tbhbtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvvpj.exec:\dvvpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lffflxr.exec:\lffflxr.exe23⤵
- Executes dropped EXE
-
\??\c:\bthtnn.exec:\bthtnn.exe24⤵
- Executes dropped EXE
-
\??\c:\hbnbth.exec:\hbnbth.exe25⤵
- Executes dropped EXE
-
\??\c:\djvvj.exec:\djvvj.exe26⤵
- Executes dropped EXE
-
\??\c:\xxlfxrx.exec:\xxlfxrx.exe27⤵
- Executes dropped EXE
-
\??\c:\thnhhh.exec:\thnhhh.exe28⤵
- Executes dropped EXE
-
\??\c:\ddvdv.exec:\ddvdv.exe29⤵
- Executes dropped EXE
-
\??\c:\dpvpd.exec:\dpvpd.exe30⤵
- Executes dropped EXE
-
\??\c:\ffllxff.exec:\ffllxff.exe31⤵
- Executes dropped EXE
-
\??\c:\bthbnn.exec:\bthbnn.exe32⤵
- Executes dropped EXE
-
\??\c:\pjddd.exec:\pjddd.exe33⤵
- Executes dropped EXE
-
\??\c:\lrxlxfr.exec:\lrxlxfr.exe34⤵
- Executes dropped EXE
-
\??\c:\tnnnhh.exec:\tnnnhh.exe35⤵
- Executes dropped EXE
-
\??\c:\tnnhbt.exec:\tnnhbt.exe36⤵
- Executes dropped EXE
-
\??\c:\ppjvp.exec:\ppjvp.exe37⤵
- Executes dropped EXE
-
\??\c:\lrrxxfl.exec:\lrrxxfl.exe38⤵
- Executes dropped EXE
-
\??\c:\rxxlfrx.exec:\rxxlfrx.exe39⤵
- Executes dropped EXE
-
\??\c:\tbhnbt.exec:\tbhnbt.exe40⤵
- Executes dropped EXE
-
\??\c:\hbtbtt.exec:\hbtbtt.exe41⤵
- Executes dropped EXE
-
\??\c:\7dpvd.exec:\7dpvd.exe42⤵
- Executes dropped EXE
-
\??\c:\vpjpd.exec:\vpjpd.exe43⤵
- Executes dropped EXE
-
\??\c:\rllxrlr.exec:\rllxrlr.exe44⤵
- Executes dropped EXE
-
\??\c:\bthhhh.exec:\bthhhh.exe45⤵
- Executes dropped EXE
-
\??\c:\5jddv.exec:\5jddv.exe46⤵
- Executes dropped EXE
-
\??\c:\jpjpj.exec:\jpjpj.exe47⤵
- Executes dropped EXE
-
\??\c:\rrllrll.exec:\rrllrll.exe48⤵
- Executes dropped EXE
-
\??\c:\xlflffr.exec:\xlflffr.exe49⤵
- Executes dropped EXE
-
\??\c:\bbbtnt.exec:\bbbtnt.exe50⤵
- Executes dropped EXE
-
\??\c:\nbhbhb.exec:\nbhbhb.exe51⤵
- Executes dropped EXE
-
\??\c:\ppvvd.exec:\ppvvd.exe52⤵
- Executes dropped EXE
-
\??\c:\xlrllrr.exec:\xlrllrr.exe53⤵
- Executes dropped EXE
-
\??\c:\bnnhbb.exec:\bnnhbb.exe54⤵
- Executes dropped EXE
-
\??\c:\nntnbb.exec:\nntnbb.exe55⤵
- Executes dropped EXE
-
\??\c:\dpddp.exec:\dpddp.exe56⤵
- Executes dropped EXE
-
\??\c:\xlrflll.exec:\xlrflll.exe57⤵
- Executes dropped EXE
-
\??\c:\bhntbh.exec:\bhntbh.exe58⤵
- Executes dropped EXE
-
\??\c:\7ththb.exec:\7ththb.exe59⤵
- Executes dropped EXE
-
\??\c:\vjvvj.exec:\vjvvj.exe60⤵
- Executes dropped EXE
-
\??\c:\7xxxxff.exec:\7xxxxff.exe61⤵
- Executes dropped EXE
-
\??\c:\bntnhb.exec:\bntnhb.exe62⤵
- Executes dropped EXE
-
\??\c:\bnbbhh.exec:\bnbbhh.exe63⤵
- Executes dropped EXE
-
\??\c:\pvjpd.exec:\pvjpd.exe64⤵
- Executes dropped EXE
-
\??\c:\fxxrrrr.exec:\fxxrrrr.exe65⤵
- Executes dropped EXE
-
\??\c:\fxfffff.exec:\fxfffff.exe66⤵
-
\??\c:\9bbnbt.exec:\9bbnbt.exe67⤵
-
\??\c:\vvvdj.exec:\vvvdj.exe68⤵
-
\??\c:\vvvpd.exec:\vvvpd.exe69⤵
-
\??\c:\xlfxrrl.exec:\xlfxrrl.exe70⤵
-
\??\c:\xlffxxx.exec:\xlffxxx.exe71⤵
-
\??\c:\jvpjv.exec:\jvpjv.exe72⤵
-
\??\c:\pppjv.exec:\pppjv.exe73⤵
-
\??\c:\rllllll.exec:\rllllll.exe74⤵
-
\??\c:\bnttbb.exec:\bnttbb.exe75⤵
-
\??\c:\djjdv.exec:\djjdv.exe76⤵
-
\??\c:\jjvpv.exec:\jjvpv.exe77⤵
-
\??\c:\rfxrllf.exec:\rfxrllf.exe78⤵
-
\??\c:\xrxrlff.exec:\xrxrlff.exe79⤵
-
\??\c:\hbnbhh.exec:\hbnbhh.exe80⤵
-
\??\c:\dvdvj.exec:\dvdvj.exe81⤵
-
\??\c:\jvjdp.exec:\jvjdp.exe82⤵
-
\??\c:\lfxrrfx.exec:\lfxrrfx.exe83⤵
-
\??\c:\btbtnn.exec:\btbtnn.exe84⤵
-
\??\c:\pjddv.exec:\pjddv.exe85⤵
-
\??\c:\vjdjd.exec:\vjdjd.exe86⤵
-
\??\c:\lfffxxx.exec:\lfffxxx.exe87⤵
-
\??\c:\xfffxxl.exec:\xfffxxl.exe88⤵
-
\??\c:\nbtnhh.exec:\nbtnhh.exe89⤵
-
\??\c:\ddpjj.exec:\ddpjj.exe90⤵
-
\??\c:\5djjd.exec:\5djjd.exe91⤵
-
\??\c:\lffxrrl.exec:\lffxrrl.exe92⤵
-
\??\c:\xxfrlxx.exec:\xxfrlxx.exe93⤵
-
\??\c:\tbnnhh.exec:\tbnnhh.exe94⤵
-
\??\c:\hnnhhb.exec:\hnnhhb.exe95⤵
-
\??\c:\djjjj.exec:\djjjj.exe96⤵
-
\??\c:\vpvjd.exec:\vpvjd.exe97⤵
-
\??\c:\rffxxrl.exec:\rffxxrl.exe98⤵
-
\??\c:\7hnttb.exec:\7hnttb.exe99⤵
-
\??\c:\ntttnt.exec:\ntttnt.exe100⤵
-
\??\c:\dvjpj.exec:\dvjpj.exe101⤵
-
\??\c:\pvpjd.exec:\pvpjd.exe102⤵
-
\??\c:\1lfllxx.exec:\1lfllxx.exe103⤵
-
\??\c:\llllrxf.exec:\llllrxf.exe104⤵
-
\??\c:\9htttb.exec:\9htttb.exe105⤵
-
\??\c:\ttbbtb.exec:\ttbbtb.exe106⤵
-
\??\c:\jdjjj.exec:\jdjjj.exe107⤵
-
\??\c:\ddvvp.exec:\ddvvp.exe108⤵
-
\??\c:\llrrrfl.exec:\llrrrfl.exe109⤵
-
\??\c:\xfxxlrl.exec:\xfxxlrl.exe110⤵
-
\??\c:\tttbbh.exec:\tttbbh.exe111⤵
-
\??\c:\ntbnnn.exec:\ntbnnn.exe112⤵
-
\??\c:\3pppj.exec:\3pppj.exe113⤵
-
\??\c:\pjpjp.exec:\pjpjp.exe114⤵
-
\??\c:\xlxfrxf.exec:\xlxfrxf.exe115⤵
-
\??\c:\lfllflf.exec:\lfllflf.exe116⤵
-
\??\c:\hbnntb.exec:\hbnntb.exe117⤵
-
\??\c:\bnttnt.exec:\bnttnt.exe118⤵
-
\??\c:\7jpvv.exec:\7jpvv.exe119⤵
-
\??\c:\ppppj.exec:\ppppj.exe120⤵
-
\??\c:\9frxxxr.exec:\9frxxxr.exe121⤵
-
\??\c:\rxrxxfl.exec:\rxrxxfl.exe122⤵
-
\??\c:\vjvdj.exec:\vjvdj.exe123⤵
-
\??\c:\lfffffr.exec:\lfffffr.exe124⤵
-
\??\c:\tthhnn.exec:\tthhnn.exe125⤵
-
\??\c:\7hbhhh.exec:\7hbhhh.exe126⤵
-
\??\c:\dpddd.exec:\dpddd.exe127⤵
-
\??\c:\vdvvj.exec:\vdvvj.exe128⤵
-
\??\c:\xxllrxr.exec:\xxllrxr.exe129⤵
-
\??\c:\3flrxlr.exec:\3flrxlr.exe130⤵
-
\??\c:\nhbhhn.exec:\nhbhhn.exe131⤵
-
\??\c:\9vjjj.exec:\9vjjj.exe132⤵
-
\??\c:\ppppp.exec:\ppppp.exe133⤵
-
\??\c:\rrxxffl.exec:\rrxxffl.exe134⤵
-
\??\c:\lffxrrr.exec:\lffxrrr.exe135⤵
-
\??\c:\htthhh.exec:\htthhh.exe136⤵
-
\??\c:\bbhhbb.exec:\bbhhbb.exe137⤵
-
\??\c:\1ddvp.exec:\1ddvp.exe138⤵
-
\??\c:\jdvvv.exec:\jdvvv.exe139⤵
-
\??\c:\rlxllrx.exec:\rlxllrx.exe140⤵
-
\??\c:\nbttbt.exec:\nbttbt.exe141⤵
-
\??\c:\tthhbh.exec:\tthhbh.exe142⤵
-
\??\c:\jvpvd.exec:\jvpvd.exe143⤵
-
\??\c:\rrxfflr.exec:\rrxfflr.exe144⤵
-
\??\c:\tntnnh.exec:\tntnnh.exe145⤵
-
\??\c:\3tbttt.exec:\3tbttt.exe146⤵
-
\??\c:\pjjpd.exec:\pjjpd.exe147⤵
-
\??\c:\fxxxxxx.exec:\fxxxxxx.exe148⤵
-
\??\c:\tnbthh.exec:\tnbthh.exe149⤵
-
\??\c:\3tnntb.exec:\3tnntb.exe150⤵
-
\??\c:\vpppj.exec:\vpppj.exe151⤵
-
\??\c:\fxxxrrl.exec:\fxxxrrl.exe152⤵
-
\??\c:\ppjjd.exec:\ppjjd.exe153⤵
-
\??\c:\jdjjd.exec:\jdjjd.exe154⤵
-
\??\c:\xrfffll.exec:\xrfffll.exe155⤵
-
\??\c:\nttnnn.exec:\nttnnn.exe156⤵
-
\??\c:\vjjdd.exec:\vjjdd.exe157⤵
-
\??\c:\lrffffx.exec:\lrffffx.exe158⤵
-
\??\c:\vvddd.exec:\vvddd.exe159⤵
-
\??\c:\frfrxxf.exec:\frfrxxf.exe160⤵
-
\??\c:\hnntbh.exec:\hnntbh.exe161⤵
-
\??\c:\djjdv.exec:\djjdv.exe162⤵
-
\??\c:\rxlfflr.exec:\rxlfflr.exe163⤵
-
\??\c:\llrffff.exec:\llrffff.exe164⤵
-
\??\c:\tttnbb.exec:\tttnbb.exe165⤵
-
\??\c:\ttnnnt.exec:\ttnnnt.exe166⤵
-
\??\c:\djdjp.exec:\djdjp.exe167⤵
-
\??\c:\frfxrxf.exec:\frfxrxf.exe168⤵
-
\??\c:\bthnhb.exec:\bthnhb.exe169⤵
-
\??\c:\htbhhn.exec:\htbhhn.exe170⤵
-
\??\c:\jpdpj.exec:\jpdpj.exe171⤵
-
\??\c:\vdvjd.exec:\vdvjd.exe172⤵
-
\??\c:\rfxfxll.exec:\rfxfxll.exe173⤵
-
\??\c:\thntnt.exec:\thntnt.exe174⤵
-
\??\c:\vjjdv.exec:\vjjdv.exe175⤵
-
\??\c:\pjpjj.exec:\pjpjj.exe176⤵
-
\??\c:\xffffll.exec:\xffffll.exe177⤵
-
\??\c:\lxllrrx.exec:\lxllrrx.exe178⤵
-
\??\c:\bbttnt.exec:\bbttnt.exe179⤵
-
\??\c:\hbbbtn.exec:\hbbbtn.exe180⤵
-
\??\c:\pjppd.exec:\pjppd.exe181⤵
-
\??\c:\rrllfrr.exec:\rrllfrr.exe182⤵
-
\??\c:\tbbhht.exec:\tbbhht.exe183⤵
-
\??\c:\tbnnhh.exec:\tbnnhh.exe184⤵
-
\??\c:\vvdvv.exec:\vvdvv.exe185⤵
-
\??\c:\lxlxfff.exec:\lxlxfff.exe186⤵
-
\??\c:\tnbtbb.exec:\tnbtbb.exe187⤵
-
\??\c:\hthhhn.exec:\hthhhn.exe188⤵
-
\??\c:\vvjpv.exec:\vvjpv.exe189⤵
-
\??\c:\pvddv.exec:\pvddv.exe190⤵
-
\??\c:\fxlfrll.exec:\fxlfrll.exe191⤵
-
\??\c:\5htnnt.exec:\5htnnt.exe192⤵
-
\??\c:\htbthn.exec:\htbthn.exe193⤵
-
\??\c:\vdjdv.exec:\vdjdv.exe194⤵
-
\??\c:\pdjvd.exec:\pdjvd.exe195⤵
-
\??\c:\frrxxrl.exec:\frrxxrl.exe196⤵
-
\??\c:\dvjjd.exec:\dvjjd.exe197⤵
-
\??\c:\rlllrrx.exec:\rlllrrx.exe198⤵
-
\??\c:\xxxfffl.exec:\xxxfffl.exe199⤵
-
\??\c:\hnhbbt.exec:\hnhbbt.exe200⤵
-
\??\c:\pjpvp.exec:\pjpvp.exe201⤵
-
\??\c:\pdvjj.exec:\pdvjj.exe202⤵
-
\??\c:\ffffxfr.exec:\ffffxfr.exe203⤵
-
\??\c:\nbbnhb.exec:\nbbnhb.exe204⤵
-
\??\c:\nnnhbt.exec:\nnnhbt.exe205⤵
-
\??\c:\jdpdd.exec:\jdpdd.exe206⤵
-
\??\c:\xxlflrf.exec:\xxlflrf.exe207⤵
-
\??\c:\bthttb.exec:\bthttb.exe208⤵
-
\??\c:\jppjv.exec:\jppjv.exe209⤵
-
\??\c:\pdjjp.exec:\pdjjp.exe210⤵
-
\??\c:\xlllxll.exec:\xlllxll.exe211⤵
-
\??\c:\ntnhbb.exec:\ntnhbb.exe212⤵
-
\??\c:\dpppj.exec:\dpppj.exe213⤵
-
\??\c:\xlflrrf.exec:\xlflrrf.exe214⤵
-
\??\c:\hbthtb.exec:\hbthtb.exe215⤵
-
\??\c:\pvpjd.exec:\pvpjd.exe216⤵
-
\??\c:\xxfllrr.exec:\xxfllrr.exe217⤵
-
\??\c:\hhtbht.exec:\hhtbht.exe218⤵
-
\??\c:\btbhbh.exec:\btbhbh.exe219⤵
-
\??\c:\jjjdp.exec:\jjjdp.exe220⤵
-
\??\c:\pppjv.exec:\pppjv.exe221⤵
-
\??\c:\llrrlrr.exec:\llrrlrr.exe222⤵
-
\??\c:\rfrxlxl.exec:\rfrxlxl.exe223⤵
-
\??\c:\1thhnt.exec:\1thhnt.exe224⤵
-
\??\c:\dvddj.exec:\dvddj.exe225⤵
-
\??\c:\dvjdv.exec:\dvjdv.exe226⤵
-
\??\c:\9pdjj.exec:\9pdjj.exe227⤵
-
\??\c:\lxllfll.exec:\lxllfll.exe228⤵
-
\??\c:\bbhhbb.exec:\bbhhbb.exe229⤵
-
\??\c:\nhtttb.exec:\nhtttb.exe230⤵
-
\??\c:\jpvvj.exec:\jpvvj.exe231⤵
-
\??\c:\jvjjj.exec:\jvjjj.exe232⤵
-
\??\c:\lxrrrlr.exec:\lxrrrlr.exe233⤵
-
\??\c:\3xfffff.exec:\3xfffff.exe234⤵
-
\??\c:\lfxfxrr.exec:\lfxfxrr.exe235⤵
-
\??\c:\nhhhht.exec:\nhhhht.exe236⤵
-
\??\c:\pdddv.exec:\pdddv.exe237⤵
-
\??\c:\jdppp.exec:\jdppp.exe238⤵
-
\??\c:\lrrlxrf.exec:\lrrlxrf.exe239⤵
-
\??\c:\lrrxxxf.exec:\lrrxxxf.exe240⤵
-
\??\c:\jvddj.exec:\jvddj.exe241⤵