Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 20:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
08cf870dff8ab5b94798450629194b00_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
08cf870dff8ab5b94798450629194b00_NeikiAnalytics.exe
-
Size
69KB
-
MD5
08cf870dff8ab5b94798450629194b00
-
SHA1
b3aca8725ecd97e93b671baca07d63d4f9ddfdbc
-
SHA256
f32705db5b7b830938af02f25dad0602d65c0b3cb121576181e9ebecb6abb09f
-
SHA512
47f4f32472b400415a734c14969f381d4297b9e1dd129ac9722ac1089f95d95e4bff307f03d7a8a9fb942fba1244f4288f317c70883c68b97ff82f37a1dafabd
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUwcsbY3Z:ymb3NkkiQ3mdBjF0yjcsMp
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/2328-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1676-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1688-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1640-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1528-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/944-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1456-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1432-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/808-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1132-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1728-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
htbhht.exejvdjj.exerffxxxx.exe9nbtbb.exeddppd.exe7ppdp.exerxfffxr.exe3btttn.exeththnt.exepdpjj.exe7dppp.exe3lllxfr.exebnnnbh.exenhntbh.exejddvd.exe1jdjd.exelrfffff.exerflrxxx.exehbhbhb.exebbntht.exe1vdvv.exefxrxfxf.exerfrxxxf.exerxfrxfx.exenhtttn.exe9jjdd.exepdppj.exe9lxllfr.exe1lfllfl.exebntttt.exe9tnnhb.exedpddv.exe5vddv.exelffflll.exe9rxxfxf.exethhbhb.exe7nhhbh.exe7jvjj.exe3jddj.exeflxrrlx.exe3rllxxx.exe5frllff.exehbbbtb.exehbhnhh.exe7ddvd.exevvdvv.exeflrlrll.exe1rxxlfl.exe9thbhb.exehbhnhb.exedddjj.exeffrffrr.exenthnbh.exentnhbb.exejvpdp.exevppvp.exe5xrlrrx.exe3thhnt.exe1hbttt.exethnnnn.exepjpdd.exepjddj.exexrxxllr.exerfffllr.exepid process 1676 htbhht.exe 2852 jvdjj.exe 1688 rffxxxx.exe 2572 9nbtbb.exe 2788 ddppd.exe 2640 7ppdp.exe 1600 rxfffxr.exe 2424 3btttn.exe 1660 ththnt.exe 1640 pdpjj.exe 2736 7dppp.exe 2676 3lllxfr.exe 1528 bnnnbh.exe 944 nhntbh.exe 1456 jddvd.exe 2740 1jdjd.exe 1348 lrfffff.exe 2120 rflrxxx.exe 2860 hbhbhb.exe 2056 bbntht.exe 2008 1vdvv.exe 528 fxrxfxf.exe 1432 rfrxxxf.exe 808 rxfrxfx.exe 352 nhtttn.exe 1132 9jjdd.exe 1116 pdppj.exe 2504 9lxllfr.exe 2040 1lfllfl.exe 1728 bntttt.exe 2908 9tnnhb.exe 1028 dpddv.exe 2176 5vddv.exe 1696 lffflll.exe 2112 9rxxfxf.exe 2552 thhbhb.exe 2656 7nhhbh.exe 2668 7jvjj.exe 2620 3jddj.exe 2260 flxrrlx.exe 2388 3rllxxx.exe 2432 5frllff.exe 2544 hbbbtb.exe 2500 hbhnhh.exe 1644 7ddvd.exe 1452 vvdvv.exe 2492 flrlrll.exe 2308 1rxxlfl.exe 2132 9thbhb.exe 1496 hbhnhb.exe 1944 dddjj.exe 2708 ffrffrr.exe 2756 nthnbh.exe 1744 ntnhbb.exe 3064 jvpdp.exe 2072 vppvp.exe 2860 5xrlrrx.exe 2024 3thhnt.exe 2052 1hbttt.exe 484 thnnnn.exe 568 pjpdd.exe 780 pjddj.exe 1152 xrxxllr.exe 352 rfffllr.exe -
Processes:
resource yara_rule behavioral1/memory/2328-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1676-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1688-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1528-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/944-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1456-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1432-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/808-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1132-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1728-290-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1676-834-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
08cf870dff8ab5b94798450629194b00_NeikiAnalytics.exehtbhht.exejvdjj.exerffxxxx.exe9nbtbb.exeddppd.exe7ppdp.exerxfffxr.exe3btttn.exeththnt.exepdpjj.exe7dppp.exe3lllxfr.exebnnnbh.exenhntbh.exejddvd.exedescription pid process target process PID 2328 wrote to memory of 1676 2328 08cf870dff8ab5b94798450629194b00_NeikiAnalytics.exe htbhht.exe PID 2328 wrote to memory of 1676 2328 08cf870dff8ab5b94798450629194b00_NeikiAnalytics.exe htbhht.exe PID 2328 wrote to memory of 1676 2328 08cf870dff8ab5b94798450629194b00_NeikiAnalytics.exe htbhht.exe PID 2328 wrote to memory of 1676 2328 08cf870dff8ab5b94798450629194b00_NeikiAnalytics.exe htbhht.exe PID 1676 wrote to memory of 2852 1676 htbhht.exe jvdjj.exe PID 1676 wrote to memory of 2852 1676 htbhht.exe jvdjj.exe PID 1676 wrote to memory of 2852 1676 htbhht.exe jvdjj.exe PID 1676 wrote to memory of 2852 1676 htbhht.exe jvdjj.exe PID 2852 wrote to memory of 1688 2852 jvdjj.exe rffxxxx.exe PID 2852 wrote to memory of 1688 2852 jvdjj.exe rffxxxx.exe PID 2852 wrote to memory of 1688 2852 jvdjj.exe rffxxxx.exe PID 2852 wrote to memory of 1688 2852 jvdjj.exe rffxxxx.exe PID 1688 wrote to memory of 2572 1688 rffxxxx.exe 9nbtbb.exe PID 1688 wrote to memory of 2572 1688 rffxxxx.exe 9nbtbb.exe PID 1688 wrote to memory of 2572 1688 rffxxxx.exe 9nbtbb.exe PID 1688 wrote to memory of 2572 1688 rffxxxx.exe 9nbtbb.exe PID 2572 wrote to memory of 2788 2572 9nbtbb.exe ddppd.exe PID 2572 wrote to memory of 2788 2572 9nbtbb.exe ddppd.exe PID 2572 wrote to memory of 2788 2572 9nbtbb.exe ddppd.exe PID 2572 wrote to memory of 2788 2572 9nbtbb.exe ddppd.exe PID 2788 wrote to memory of 2640 2788 ddppd.exe 7ppdp.exe PID 2788 wrote to memory of 2640 2788 ddppd.exe 7ppdp.exe PID 2788 wrote to memory of 2640 2788 ddppd.exe 7ppdp.exe PID 2788 wrote to memory of 2640 2788 ddppd.exe 7ppdp.exe PID 2640 wrote to memory of 1600 2640 7ppdp.exe rxfffxr.exe PID 2640 wrote to memory of 1600 2640 7ppdp.exe rxfffxr.exe PID 2640 wrote to memory of 1600 2640 7ppdp.exe rxfffxr.exe PID 2640 wrote to memory of 1600 2640 7ppdp.exe rxfffxr.exe PID 1600 wrote to memory of 2424 1600 rxfffxr.exe 3btttn.exe PID 1600 wrote to memory of 2424 1600 rxfffxr.exe 3btttn.exe PID 1600 wrote to memory of 2424 1600 rxfffxr.exe 3btttn.exe PID 1600 wrote to memory of 2424 1600 rxfffxr.exe 3btttn.exe PID 2424 wrote to memory of 1660 2424 3btttn.exe ththnt.exe PID 2424 wrote to memory of 1660 2424 3btttn.exe ththnt.exe PID 2424 wrote to memory of 1660 2424 3btttn.exe ththnt.exe PID 2424 wrote to memory of 1660 2424 3btttn.exe ththnt.exe PID 1660 wrote to memory of 1640 1660 ththnt.exe pdpjj.exe PID 1660 wrote to memory of 1640 1660 ththnt.exe pdpjj.exe PID 1660 wrote to memory of 1640 1660 ththnt.exe pdpjj.exe PID 1660 wrote to memory of 1640 1660 ththnt.exe pdpjj.exe PID 1640 wrote to memory of 2736 1640 pdpjj.exe 7dppp.exe PID 1640 wrote to memory of 2736 1640 pdpjj.exe 7dppp.exe PID 1640 wrote to memory of 2736 1640 pdpjj.exe 7dppp.exe PID 1640 wrote to memory of 2736 1640 pdpjj.exe 7dppp.exe PID 2736 wrote to memory of 2676 2736 7dppp.exe 3lllxfr.exe PID 2736 wrote to memory of 2676 2736 7dppp.exe 3lllxfr.exe PID 2736 wrote to memory of 2676 2736 7dppp.exe 3lllxfr.exe PID 2736 wrote to memory of 2676 2736 7dppp.exe 3lllxfr.exe PID 2676 wrote to memory of 1528 2676 3lllxfr.exe bnnnbh.exe PID 2676 wrote to memory of 1528 2676 3lllxfr.exe bnnnbh.exe PID 2676 wrote to memory of 1528 2676 3lllxfr.exe bnnnbh.exe PID 2676 wrote to memory of 1528 2676 3lllxfr.exe bnnnbh.exe PID 1528 wrote to memory of 944 1528 bnnnbh.exe nhntbh.exe PID 1528 wrote to memory of 944 1528 bnnnbh.exe nhntbh.exe PID 1528 wrote to memory of 944 1528 bnnnbh.exe nhntbh.exe PID 1528 wrote to memory of 944 1528 bnnnbh.exe nhntbh.exe PID 944 wrote to memory of 1456 944 nhntbh.exe jddvd.exe PID 944 wrote to memory of 1456 944 nhntbh.exe jddvd.exe PID 944 wrote to memory of 1456 944 nhntbh.exe jddvd.exe PID 944 wrote to memory of 1456 944 nhntbh.exe jddvd.exe PID 1456 wrote to memory of 2740 1456 jddvd.exe 1jdjd.exe PID 1456 wrote to memory of 2740 1456 jddvd.exe 1jdjd.exe PID 1456 wrote to memory of 2740 1456 jddvd.exe 1jdjd.exe PID 1456 wrote to memory of 2740 1456 jddvd.exe 1jdjd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\08cf870dff8ab5b94798450629194b00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\08cf870dff8ab5b94798450629194b00_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\htbhht.exec:\htbhht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvdjj.exec:\jvdjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rffxxxx.exec:\rffxxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9nbtbb.exec:\9nbtbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddppd.exec:\ddppd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7ppdp.exec:\7ppdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rxfffxr.exec:\rxfffxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3btttn.exec:\3btttn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ththnt.exec:\ththnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdpjj.exec:\pdpjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7dppp.exec:\7dppp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3lllxfr.exec:\3lllxfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnnnbh.exec:\bnnnbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhntbh.exec:\nhntbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jddvd.exec:\jddvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1jdjd.exec:\1jdjd.exe17⤵
- Executes dropped EXE
-
\??\c:\lrfffff.exec:\lrfffff.exe18⤵
- Executes dropped EXE
-
\??\c:\rflrxxx.exec:\rflrxxx.exe19⤵
- Executes dropped EXE
-
\??\c:\hbhbhb.exec:\hbhbhb.exe20⤵
- Executes dropped EXE
-
\??\c:\bbntht.exec:\bbntht.exe21⤵
- Executes dropped EXE
-
\??\c:\1vdvv.exec:\1vdvv.exe22⤵
- Executes dropped EXE
-
\??\c:\fxrxfxf.exec:\fxrxfxf.exe23⤵
- Executes dropped EXE
-
\??\c:\rfrxxxf.exec:\rfrxxxf.exe24⤵
- Executes dropped EXE
-
\??\c:\rxfrxfx.exec:\rxfrxfx.exe25⤵
- Executes dropped EXE
-
\??\c:\nhtttn.exec:\nhtttn.exe26⤵
- Executes dropped EXE
-
\??\c:\9jjdd.exec:\9jjdd.exe27⤵
- Executes dropped EXE
-
\??\c:\pdppj.exec:\pdppj.exe28⤵
- Executes dropped EXE
-
\??\c:\9lxllfr.exec:\9lxllfr.exe29⤵
- Executes dropped EXE
-
\??\c:\1lfllfl.exec:\1lfllfl.exe30⤵
- Executes dropped EXE
-
\??\c:\bntttt.exec:\bntttt.exe31⤵
- Executes dropped EXE
-
\??\c:\9tnnhb.exec:\9tnnhb.exe32⤵
- Executes dropped EXE
-
\??\c:\dpddv.exec:\dpddv.exe33⤵
- Executes dropped EXE
-
\??\c:\5vddv.exec:\5vddv.exe34⤵
- Executes dropped EXE
-
\??\c:\lffflll.exec:\lffflll.exe35⤵
- Executes dropped EXE
-
\??\c:\9rxxfxf.exec:\9rxxfxf.exe36⤵
- Executes dropped EXE
-
\??\c:\thhbhb.exec:\thhbhb.exe37⤵
- Executes dropped EXE
-
\??\c:\7nhhbh.exec:\7nhhbh.exe38⤵
- Executes dropped EXE
-
\??\c:\7jvjj.exec:\7jvjj.exe39⤵
- Executes dropped EXE
-
\??\c:\3jddj.exec:\3jddj.exe40⤵
- Executes dropped EXE
-
\??\c:\flxrrlx.exec:\flxrrlx.exe41⤵
- Executes dropped EXE
-
\??\c:\3rllxxx.exec:\3rllxxx.exe42⤵
- Executes dropped EXE
-
\??\c:\5frllff.exec:\5frllff.exe43⤵
- Executes dropped EXE
-
\??\c:\hbbbtb.exec:\hbbbtb.exe44⤵
- Executes dropped EXE
-
\??\c:\hbhnhh.exec:\hbhnhh.exe45⤵
- Executes dropped EXE
-
\??\c:\7ddvd.exec:\7ddvd.exe46⤵
- Executes dropped EXE
-
\??\c:\vvdvv.exec:\vvdvv.exe47⤵
- Executes dropped EXE
-
\??\c:\flrlrll.exec:\flrlrll.exe48⤵
- Executes dropped EXE
-
\??\c:\1rxxlfl.exec:\1rxxlfl.exe49⤵
- Executes dropped EXE
-
\??\c:\9thbhb.exec:\9thbhb.exe50⤵
- Executes dropped EXE
-
\??\c:\hbhnhb.exec:\hbhnhb.exe51⤵
- Executes dropped EXE
-
\??\c:\dddjj.exec:\dddjj.exe52⤵
- Executes dropped EXE
-
\??\c:\ffrffrr.exec:\ffrffrr.exe53⤵
- Executes dropped EXE
-
\??\c:\nthnbh.exec:\nthnbh.exe54⤵
- Executes dropped EXE
-
\??\c:\ntnhbb.exec:\ntnhbb.exe55⤵
- Executes dropped EXE
-
\??\c:\jvpdp.exec:\jvpdp.exe56⤵
- Executes dropped EXE
-
\??\c:\vppvp.exec:\vppvp.exe57⤵
- Executes dropped EXE
-
\??\c:\5xrlrrx.exec:\5xrlrrx.exe58⤵
- Executes dropped EXE
-
\??\c:\3thhnt.exec:\3thhnt.exe59⤵
- Executes dropped EXE
-
\??\c:\1hbttt.exec:\1hbttt.exe60⤵
- Executes dropped EXE
-
\??\c:\thnnnn.exec:\thnnnn.exe61⤵
- Executes dropped EXE
-
\??\c:\pjpdd.exec:\pjpdd.exe62⤵
- Executes dropped EXE
-
\??\c:\pjddj.exec:\pjddj.exe63⤵
- Executes dropped EXE
-
\??\c:\xrxxllr.exec:\xrxxllr.exe64⤵
- Executes dropped EXE
-
\??\c:\rfffllr.exec:\rfffllr.exe65⤵
- Executes dropped EXE
-
\??\c:\9bntbh.exec:\9bntbh.exe66⤵
-
\??\c:\hbnnhh.exec:\hbnnhh.exe67⤵
-
\??\c:\dvpjp.exec:\dvpjp.exe68⤵
-
\??\c:\vjppv.exec:\vjppv.exe69⤵
-
\??\c:\lfllrxf.exec:\lfllrxf.exe70⤵
-
\??\c:\9rllxxf.exec:\9rllxxf.exe71⤵
-
\??\c:\5hbbtt.exec:\5hbbtt.exe72⤵
-
\??\c:\9nbnnt.exec:\9nbnnt.exe73⤵
-
\??\c:\jdjdj.exec:\jdjdj.exe74⤵
-
\??\c:\dpjjd.exec:\dpjjd.exe75⤵
-
\??\c:\lrflfxf.exec:\lrflfxf.exe76⤵
-
\??\c:\xfxrrlf.exec:\xfxrrlf.exe77⤵
-
\??\c:\htbhhb.exec:\htbhhb.exe78⤵
-
\??\c:\vvpjd.exec:\vvpjd.exe79⤵
-
\??\c:\vjvjp.exec:\vjvjp.exe80⤵
-
\??\c:\3fllrlf.exec:\3fllrlf.exe81⤵
-
\??\c:\rffxlxr.exec:\rffxlxr.exe82⤵
-
\??\c:\htntbh.exec:\htntbh.exe83⤵
-
\??\c:\7hbbbb.exec:\7hbbbb.exe84⤵
-
\??\c:\1vddd.exec:\1vddd.exe85⤵
-
\??\c:\1dvvd.exec:\1dvvd.exe86⤵
-
\??\c:\1rrfxlr.exec:\1rrfxlr.exe87⤵
-
\??\c:\1xrlrrf.exec:\1xrlrrf.exe88⤵
-
\??\c:\nhtthn.exec:\nhtthn.exe89⤵
-
\??\c:\1hnthh.exec:\1hnthh.exe90⤵
-
\??\c:\vjjjj.exec:\vjjjj.exe91⤵
-
\??\c:\dvvjj.exec:\dvvjj.exe92⤵
-
\??\c:\frffrrx.exec:\frffrrx.exe93⤵
-
\??\c:\thnnbb.exec:\thnnbb.exe94⤵
-
\??\c:\nbtttt.exec:\nbtttt.exe95⤵
-
\??\c:\djpdd.exec:\djpdd.exe96⤵
-
\??\c:\jpjvd.exec:\jpjvd.exe97⤵
-
\??\c:\ffxxrxx.exec:\ffxxrxx.exe98⤵
-
\??\c:\lflrrlx.exec:\lflrrlx.exe99⤵
-
\??\c:\bbnhbn.exec:\bbnhbn.exe100⤵
-
\??\c:\jjvpv.exec:\jjvpv.exe101⤵
-
\??\c:\7ddjp.exec:\7ddjp.exe102⤵
-
\??\c:\3rxfffl.exec:\3rxfffl.exe103⤵
-
\??\c:\xrxxxlr.exec:\xrxxxlr.exe104⤵
-
\??\c:\nhnthh.exec:\nhnthh.exe105⤵
-
\??\c:\bbnntb.exec:\bbnntb.exe106⤵
-
\??\c:\vpdpv.exec:\vpdpv.exe107⤵
-
\??\c:\djdpj.exec:\djdpj.exe108⤵
-
\??\c:\rrrrrxx.exec:\rrrrrxx.exe109⤵
-
\??\c:\ffxfffx.exec:\ffxfffx.exe110⤵
-
\??\c:\tntthn.exec:\tntthn.exe111⤵
-
\??\c:\nbhhhh.exec:\nbhhhh.exe112⤵
-
\??\c:\jvppp.exec:\jvppp.exe113⤵
-
\??\c:\djpvv.exec:\djpvv.exe114⤵
-
\??\c:\1xxfxlf.exec:\1xxfxlf.exe115⤵
-
\??\c:\rlxxxxf.exec:\rlxxxxf.exe116⤵
-
\??\c:\5lfflfl.exec:\5lfflfl.exe117⤵
-
\??\c:\nnbhnh.exec:\nnbhnh.exe118⤵
-
\??\c:\bnbnnh.exec:\bnbnnh.exe119⤵
-
\??\c:\jvjpd.exec:\jvjpd.exe120⤵
-
\??\c:\1pjpp.exec:\1pjpp.exe121⤵
-
\??\c:\rrrflfx.exec:\rrrflfx.exe122⤵
-
\??\c:\bbnbbh.exec:\bbnbbh.exe123⤵
-
\??\c:\5nbhnn.exec:\5nbhnn.exe124⤵
-
\??\c:\hhbtth.exec:\hhbtth.exe125⤵
-
\??\c:\5pddj.exec:\5pddj.exe126⤵
-
\??\c:\fxlfrxf.exec:\fxlfrxf.exe127⤵
-
\??\c:\lxlxllr.exec:\lxlxllr.exe128⤵
-
\??\c:\1tnbht.exec:\1tnbht.exe129⤵
-
\??\c:\tthnbb.exec:\tthnbb.exe130⤵
-
\??\c:\ppjdv.exec:\ppjdv.exe131⤵
-
\??\c:\jdvdp.exec:\jdvdp.exe132⤵
-
\??\c:\7lflxfr.exec:\7lflxfr.exe133⤵
-
\??\c:\fxlllll.exec:\fxlllll.exe134⤵
-
\??\c:\9fxxxxf.exec:\9fxxxxf.exe135⤵
-
\??\c:\nhtbhn.exec:\nhtbhn.exe136⤵
-
\??\c:\3nntbt.exec:\3nntbt.exe137⤵
-
\??\c:\3jvvd.exec:\3jvvd.exe138⤵
-
\??\c:\9pdjd.exec:\9pdjd.exe139⤵
-
\??\c:\3xrlffl.exec:\3xrlffl.exe140⤵
-
\??\c:\hhhthn.exec:\hhhthn.exe141⤵
-
\??\c:\7nhnbn.exec:\7nhnbn.exe142⤵
-
\??\c:\vvppp.exec:\vvppp.exe143⤵
-
\??\c:\jvjjv.exec:\jvjjv.exe144⤵
-
\??\c:\5ffxxxf.exec:\5ffxxxf.exe145⤵
-
\??\c:\lxrxxxl.exec:\lxrxxxl.exe146⤵
-
\??\c:\rfrxlrr.exec:\rfrxlrr.exe147⤵
-
\??\c:\tnhnnn.exec:\tnhnnn.exe148⤵
-
\??\c:\5nbttn.exec:\5nbttn.exe149⤵
-
\??\c:\tnhntb.exec:\tnhntb.exe150⤵
-
\??\c:\5pjpp.exec:\5pjpp.exe151⤵
-
\??\c:\dpddj.exec:\dpddj.exe152⤵
-
\??\c:\xxlxflr.exec:\xxlxflr.exe153⤵
-
\??\c:\5xlfllr.exec:\5xlfllr.exe154⤵
-
\??\c:\xrxflll.exec:\xrxflll.exe155⤵
-
\??\c:\3bnhhb.exec:\3bnhhb.exe156⤵
-
\??\c:\hbhhhn.exec:\hbhhhn.exe157⤵
-
\??\c:\ppdjj.exec:\ppdjj.exe158⤵
-
\??\c:\vpdjp.exec:\vpdjp.exe159⤵
-
\??\c:\lfxflll.exec:\lfxflll.exe160⤵
-
\??\c:\7xrxxxx.exec:\7xrxxxx.exe161⤵
-
\??\c:\tnbnnt.exec:\tnbnnt.exe162⤵
-
\??\c:\hbntbb.exec:\hbntbb.exe163⤵
-
\??\c:\vvvjv.exec:\vvvjv.exe164⤵
-
\??\c:\5pdjj.exec:\5pdjj.exe165⤵
-
\??\c:\jvjdj.exec:\jvjdj.exe166⤵
-
\??\c:\lfrrrrx.exec:\lfrrrrx.exe167⤵
-
\??\c:\rflrxlf.exec:\rflrxlf.exe168⤵
-
\??\c:\hbbbhh.exec:\hbbbhh.exe169⤵
-
\??\c:\nhtttn.exec:\nhtttn.exe170⤵
-
\??\c:\nbhthh.exec:\nbhthh.exe171⤵
-
\??\c:\jvppj.exec:\jvppj.exe172⤵
-
\??\c:\vvpvv.exec:\vvpvv.exe173⤵
-
\??\c:\ffflxxl.exec:\ffflxxl.exe174⤵
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe175⤵
-
\??\c:\ttthbh.exec:\ttthbh.exe176⤵
-
\??\c:\bthntt.exec:\bthntt.exe177⤵
-
\??\c:\1bnttn.exec:\1bnttn.exe178⤵
-
\??\c:\jvddd.exec:\jvddd.exe179⤵
-
\??\c:\9vvdp.exec:\9vvdp.exe180⤵
-
\??\c:\rfrrrrf.exec:\rfrrrrf.exe181⤵
-
\??\c:\ffxfrxf.exec:\ffxfrxf.exe182⤵
-
\??\c:\htbttn.exec:\htbttn.exe183⤵
-
\??\c:\tbbhtb.exec:\tbbhtb.exe184⤵
-
\??\c:\5tnhnh.exec:\5tnhnh.exe185⤵
-
\??\c:\5vjdj.exec:\5vjdj.exe186⤵
-
\??\c:\vpjpp.exec:\vpjpp.exe187⤵
-
\??\c:\3xxllfr.exec:\3xxllfr.exe188⤵
-
\??\c:\ffrfrlx.exec:\ffrfrlx.exe189⤵
-
\??\c:\htnbht.exec:\htnbht.exe190⤵
-
\??\c:\7thhhh.exec:\7thhhh.exe191⤵
-
\??\c:\jjpdj.exec:\jjpdj.exe192⤵
-
\??\c:\pdvpd.exec:\pdvpd.exe193⤵
-
\??\c:\rxlflff.exec:\rxlflff.exe194⤵
-
\??\c:\xllrxff.exec:\xllrxff.exe195⤵
-
\??\c:\hhbbtt.exec:\hhbbtt.exe196⤵
-
\??\c:\3btbtn.exec:\3btbtn.exe197⤵
-
\??\c:\jdpdv.exec:\jdpdv.exe198⤵
-
\??\c:\dpvpv.exec:\dpvpv.exe199⤵
-
\??\c:\lxlxfll.exec:\lxlxfll.exe200⤵
-
\??\c:\fxlllff.exec:\fxlllff.exe201⤵
-
\??\c:\hbhtbt.exec:\hbhtbt.exe202⤵
-
\??\c:\hbnbnt.exec:\hbnbnt.exe203⤵
-
\??\c:\vpvvp.exec:\vpvvp.exe204⤵
-
\??\c:\vpdpj.exec:\vpdpj.exe205⤵
-
\??\c:\3rxrlrr.exec:\3rxrlrr.exe206⤵
-
\??\c:\3fllrrr.exec:\3fllrrr.exe207⤵
-
\??\c:\5tnhhb.exec:\5tnhhb.exe208⤵
-
\??\c:\thbttt.exec:\thbttt.exe209⤵
-
\??\c:\thnnbb.exec:\thnnbb.exe210⤵
-
\??\c:\1jdjv.exec:\1jdjv.exe211⤵
-
\??\c:\dpppv.exec:\dpppv.exe212⤵
-
\??\c:\lffrxxl.exec:\lffrxxl.exe213⤵
-
\??\c:\frfllfl.exec:\frfllfl.exe214⤵
-
\??\c:\ttbbbt.exec:\ttbbbt.exe215⤵
-
\??\c:\hbtttt.exec:\hbtttt.exe216⤵
-
\??\c:\9htbhh.exec:\9htbhh.exe217⤵
-
\??\c:\dvpvv.exec:\dvpvv.exe218⤵
-
\??\c:\xlrfllr.exec:\xlrfllr.exe219⤵
-
\??\c:\5btbhn.exec:\5btbhn.exe220⤵
-
\??\c:\tnbtbn.exec:\tnbtbn.exe221⤵
-
\??\c:\vpvdd.exec:\vpvdd.exe222⤵
-
\??\c:\vpjjj.exec:\vpjjj.exe223⤵
-
\??\c:\rfrxxxf.exec:\rfrxxxf.exe224⤵
-
\??\c:\xflxxlx.exec:\xflxxlx.exe225⤵
-
\??\c:\bbbnhb.exec:\bbbnhb.exe226⤵
-
\??\c:\tttnnb.exec:\tttnnb.exe227⤵
-
\??\c:\jjpvv.exec:\jjpvv.exe228⤵
-
\??\c:\vddjd.exec:\vddjd.exe229⤵
-
\??\c:\fxlxxrl.exec:\fxlxxrl.exe230⤵
-
\??\c:\7xlrxxf.exec:\7xlrxxf.exe231⤵
-
\??\c:\rrrrfff.exec:\rrrrfff.exe232⤵
-
\??\c:\btbhnn.exec:\btbhnn.exe233⤵
-
\??\c:\9ntbhn.exec:\9ntbhn.exe234⤵
-
\??\c:\vvjjj.exec:\vvjjj.exe235⤵
-
\??\c:\jjvdp.exec:\jjvdp.exe236⤵
-
\??\c:\rxrrxrx.exec:\rxrrxrx.exe237⤵
-
\??\c:\rxfffxf.exec:\rxfffxf.exe238⤵
-
\??\c:\hbtntb.exec:\hbtntb.exe239⤵
-
\??\c:\5bbtbt.exec:\5bbtbt.exe240⤵
-
\??\c:\dpdjd.exec:\dpdjd.exe241⤵