Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 20:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
095bc37a9905ca2e65f35192bcfb3f00_NeikiAnalytics.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
-
Target
095bc37a9905ca2e65f35192bcfb3f00_NeikiAnalytics.exe
-
Size
115KB
-
MD5
095bc37a9905ca2e65f35192bcfb3f00
-
SHA1
1b490c4d7b65e85535c3ae0dae68fd3f1ecd0bbb
-
SHA256
716eda587d4f9d903ee6607c4064d64e618b9a40f170bd889c529b5cf0b3e611
-
SHA512
e8e1e08d10602336ef165ae21a7b4f71cca3ed2933dfd491a7ce32523da326748c8dd63d53773ceb0afca9372b85a1e297e0ee16cee59c2a0f9c7eda0d4c78b8
-
SSDEEP
3072:ymb3NkkiQ3mdBjFosxXGPXbXQMFHLgDWSmjlkFb:n3C9BRosxW8MFHLMWvlI
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral2/memory/4676-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1384-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2840-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2604-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2672-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1176-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1584-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3852-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2888-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3540-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4176-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3260-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1504-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1916-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1612-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3536-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4620-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4040-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2260-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3904-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4988-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vvjdp.exe3lrrlrr.exe5xffflr.exe3nnhhn.exeppjjd.exe1pvpp.exelflfxxx.exenbbbbb.exe7pdvp.exe9lrrrrl.exe3thhbh.exepvppp.exerrrrxxx.exelxffflf.exenbhhhh.exejppvp.exeffffxxx.exehbbthb.exedvdvv.exexfrllff.exerrxxrrr.exenhnnhh.exenhnttt.exepddvp.exe5flfxxx.exebtbttn.exenntnnh.exejppjj.exe1jpjd.exerlfrrrl.exefrrrlff.exe5bbhbb.exeddpjp.exe5rlrfrl.exenhnhnh.exetbbttt.exevjpjv.exefxfxrrl.exebtttnt.exevpvdv.exexllfrfr.exerffxrlf.exe5hbnhb.exevpppd.exe1dvpj.exexllfxrr.exelllfxrl.exennbnht.exevpvpv.exevpjvp.exerxxrffx.exe3lrlxrl.exehtttnh.exepjvpp.exefrrlffx.exehbhtnn.exebtnhtt.exepdjdp.exe9pvdp.exefrlllrl.exelfffxxr.exehttbtb.exetbbhhb.exejpvpj.exepid process 1384 vvjdp.exe 3656 3lrrlrr.exe 5004 5xffflr.exe 2840 3nnhhn.exe 5044 ppjjd.exe 2604 1pvpp.exe 2672 lflfxxx.exe 1176 nbbbbb.exe 1584 7pdvp.exe 3852 9lrrrrl.exe 2084 3thhbh.exe 2888 pvppp.exe 3540 rrrrxxx.exe 4176 lxffflf.exe 3260 nbhhhh.exe 1504 jppvp.exe 1916 ffffxxx.exe 1612 hbbthb.exe 400 dvdvv.exe 3536 xfrllff.exe 3636 rrxxrrr.exe 4620 nhnnhh.exe 1224 nhnttt.exe 2448 pddvp.exe 4040 5flfxxx.exe 4344 btbttn.exe 1312 nntnnh.exe 2260 jppjj.exe 3628 1jpjd.exe 3904 rlfrrrl.exe 4988 frrrlff.exe 1484 5bbhbb.exe 5072 ddpjp.exe 4084 5rlrfrl.exe 532 nhnhnh.exe 2756 tbbttt.exe 2344 vjpjv.exe 2588 fxfxrrl.exe 1684 btttnt.exe 3484 vpvdv.exe 2228 xllfrfr.exe 2988 rffxrlf.exe 1204 5hbnhb.exe 4160 vpppd.exe 4508 1dvpj.exe 4404 xllfxrr.exe 1732 lllfxrl.exe 4384 nnbnht.exe 400 vpvpv.exe 3024 vpjvp.exe 232 rxxrffx.exe 3216 3lrlxrl.exe 1488 htttnh.exe 3240 pjvpp.exe 2956 frrlffx.exe 3964 hbhtnn.exe 4040 btnhtt.exe 3396 pdjdp.exe 4344 9pvdp.exe 632 frlllrl.exe 3212 lfffxxr.exe 1400 httbtb.exe 4684 tbbhhb.exe 3672 jpvpj.exe -
Processes:
resource yara_rule behavioral2/memory/4676-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1384-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2840-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2672-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2672-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1176-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1584-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3852-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2888-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3540-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4176-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3260-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1504-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1612-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3536-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4620-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4040-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2260-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3904-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
095bc37a9905ca2e65f35192bcfb3f00_NeikiAnalytics.exevvjdp.exe3lrrlrr.exe5xffflr.exe3nnhhn.exeppjjd.exe1pvpp.exelflfxxx.exenbbbbb.exe7pdvp.exe9lrrrrl.exe3thhbh.exepvppp.exerrrrxxx.exelxffflf.exenbhhhh.exejppvp.exeffffxxx.exehbbthb.exedvdvv.exexfrllff.exerrxxrrr.exedescription pid process target process PID 4676 wrote to memory of 1384 4676 095bc37a9905ca2e65f35192bcfb3f00_NeikiAnalytics.exe vvjdp.exe PID 4676 wrote to memory of 1384 4676 095bc37a9905ca2e65f35192bcfb3f00_NeikiAnalytics.exe vvjdp.exe PID 4676 wrote to memory of 1384 4676 095bc37a9905ca2e65f35192bcfb3f00_NeikiAnalytics.exe vvjdp.exe PID 1384 wrote to memory of 3656 1384 vvjdp.exe 3lrrlrr.exe PID 1384 wrote to memory of 3656 1384 vvjdp.exe 3lrrlrr.exe PID 1384 wrote to memory of 3656 1384 vvjdp.exe 3lrrlrr.exe PID 3656 wrote to memory of 5004 3656 3lrrlrr.exe 5xffflr.exe PID 3656 wrote to memory of 5004 3656 3lrrlrr.exe 5xffflr.exe PID 3656 wrote to memory of 5004 3656 3lrrlrr.exe 5xffflr.exe PID 5004 wrote to memory of 2840 5004 5xffflr.exe 3nnhhn.exe PID 5004 wrote to memory of 2840 5004 5xffflr.exe 3nnhhn.exe PID 5004 wrote to memory of 2840 5004 5xffflr.exe 3nnhhn.exe PID 2840 wrote to memory of 5044 2840 3nnhhn.exe ppjjd.exe PID 2840 wrote to memory of 5044 2840 3nnhhn.exe ppjjd.exe PID 2840 wrote to memory of 5044 2840 3nnhhn.exe ppjjd.exe PID 5044 wrote to memory of 2604 5044 ppjjd.exe 1pvpp.exe PID 5044 wrote to memory of 2604 5044 ppjjd.exe 1pvpp.exe PID 5044 wrote to memory of 2604 5044 ppjjd.exe 1pvpp.exe PID 2604 wrote to memory of 2672 2604 1pvpp.exe lflfxxx.exe PID 2604 wrote to memory of 2672 2604 1pvpp.exe lflfxxx.exe PID 2604 wrote to memory of 2672 2604 1pvpp.exe lflfxxx.exe PID 2672 wrote to memory of 1176 2672 lflfxxx.exe nbbbbb.exe PID 2672 wrote to memory of 1176 2672 lflfxxx.exe nbbbbb.exe PID 2672 wrote to memory of 1176 2672 lflfxxx.exe nbbbbb.exe PID 1176 wrote to memory of 1584 1176 nbbbbb.exe 7pdvp.exe PID 1176 wrote to memory of 1584 1176 nbbbbb.exe 7pdvp.exe PID 1176 wrote to memory of 1584 1176 nbbbbb.exe 7pdvp.exe PID 1584 wrote to memory of 3852 1584 7pdvp.exe 9lrrrrl.exe PID 1584 wrote to memory of 3852 1584 7pdvp.exe 9lrrrrl.exe PID 1584 wrote to memory of 3852 1584 7pdvp.exe 9lrrrrl.exe PID 3852 wrote to memory of 2084 3852 9lrrrrl.exe 3thhbh.exe PID 3852 wrote to memory of 2084 3852 9lrrrrl.exe 3thhbh.exe PID 3852 wrote to memory of 2084 3852 9lrrrrl.exe 3thhbh.exe PID 2084 wrote to memory of 2888 2084 3thhbh.exe pvppp.exe PID 2084 wrote to memory of 2888 2084 3thhbh.exe pvppp.exe PID 2084 wrote to memory of 2888 2084 3thhbh.exe pvppp.exe PID 2888 wrote to memory of 3540 2888 pvppp.exe rrrrxxx.exe PID 2888 wrote to memory of 3540 2888 pvppp.exe rrrrxxx.exe PID 2888 wrote to memory of 3540 2888 pvppp.exe rrrrxxx.exe PID 3540 wrote to memory of 4176 3540 rrrrxxx.exe lxffflf.exe PID 3540 wrote to memory of 4176 3540 rrrrxxx.exe lxffflf.exe PID 3540 wrote to memory of 4176 3540 rrrrxxx.exe lxffflf.exe PID 4176 wrote to memory of 3260 4176 lxffflf.exe nbhhhh.exe PID 4176 wrote to memory of 3260 4176 lxffflf.exe nbhhhh.exe PID 4176 wrote to memory of 3260 4176 lxffflf.exe nbhhhh.exe PID 3260 wrote to memory of 1504 3260 nbhhhh.exe jppvp.exe PID 3260 wrote to memory of 1504 3260 nbhhhh.exe jppvp.exe PID 3260 wrote to memory of 1504 3260 nbhhhh.exe jppvp.exe PID 1504 wrote to memory of 1916 1504 jppvp.exe ffffxxx.exe PID 1504 wrote to memory of 1916 1504 jppvp.exe ffffxxx.exe PID 1504 wrote to memory of 1916 1504 jppvp.exe ffffxxx.exe PID 1916 wrote to memory of 1612 1916 ffffxxx.exe hbbthb.exe PID 1916 wrote to memory of 1612 1916 ffffxxx.exe hbbthb.exe PID 1916 wrote to memory of 1612 1916 ffffxxx.exe hbbthb.exe PID 1612 wrote to memory of 400 1612 hbbthb.exe dvdvv.exe PID 1612 wrote to memory of 400 1612 hbbthb.exe dvdvv.exe PID 1612 wrote to memory of 400 1612 hbbthb.exe dvdvv.exe PID 400 wrote to memory of 3536 400 dvdvv.exe xfrllff.exe PID 400 wrote to memory of 3536 400 dvdvv.exe xfrllff.exe PID 400 wrote to memory of 3536 400 dvdvv.exe xfrllff.exe PID 3536 wrote to memory of 3636 3536 xfrllff.exe rrxxrrr.exe PID 3536 wrote to memory of 3636 3536 xfrllff.exe rrxxrrr.exe PID 3536 wrote to memory of 3636 3536 xfrllff.exe rrxxrrr.exe PID 3636 wrote to memory of 4620 3636 rrxxrrr.exe nhnnhh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\095bc37a9905ca2e65f35192bcfb3f00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\095bc37a9905ca2e65f35192bcfb3f00_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\vvjdp.exec:\vvjdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3lrrlrr.exec:\3lrrlrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5xffflr.exec:\5xffflr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3nnhhn.exec:\3nnhhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ppjjd.exec:\ppjjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1pvpp.exec:\1pvpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lflfxxx.exec:\lflfxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbbbbb.exec:\nbbbbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7pdvp.exec:\7pdvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9lrrrrl.exec:\9lrrrrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3thhbh.exec:\3thhbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvppp.exec:\pvppp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrrrxxx.exec:\rrrrxxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxffflf.exec:\lxffflf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbhhhh.exec:\nbhhhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jppvp.exec:\jppvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffffxxx.exec:\ffffxxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbbthb.exec:\hbbthb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvdvv.exec:\dvdvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xfrllff.exec:\xfrllff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrxxrrr.exec:\rrxxrrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhnnhh.exec:\nhnnhh.exe23⤵
- Executes dropped EXE
-
\??\c:\nhnttt.exec:\nhnttt.exe24⤵
- Executes dropped EXE
-
\??\c:\pddvp.exec:\pddvp.exe25⤵
- Executes dropped EXE
-
\??\c:\5flfxxx.exec:\5flfxxx.exe26⤵
- Executes dropped EXE
-
\??\c:\btbttn.exec:\btbttn.exe27⤵
- Executes dropped EXE
-
\??\c:\nntnnh.exec:\nntnnh.exe28⤵
- Executes dropped EXE
-
\??\c:\jppjj.exec:\jppjj.exe29⤵
- Executes dropped EXE
-
\??\c:\1jpjd.exec:\1jpjd.exe30⤵
- Executes dropped EXE
-
\??\c:\rlfrrrl.exec:\rlfrrrl.exe31⤵
- Executes dropped EXE
-
\??\c:\frrrlff.exec:\frrrlff.exe32⤵
- Executes dropped EXE
-
\??\c:\5bbhbb.exec:\5bbhbb.exe33⤵
- Executes dropped EXE
-
\??\c:\ddpjp.exec:\ddpjp.exe34⤵
- Executes dropped EXE
-
\??\c:\5rlrfrl.exec:\5rlrfrl.exe35⤵
- Executes dropped EXE
-
\??\c:\nhnhnh.exec:\nhnhnh.exe36⤵
- Executes dropped EXE
-
\??\c:\tbbttt.exec:\tbbttt.exe37⤵
- Executes dropped EXE
-
\??\c:\vjpjv.exec:\vjpjv.exe38⤵
- Executes dropped EXE
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe39⤵
- Executes dropped EXE
-
\??\c:\btttnt.exec:\btttnt.exe40⤵
- Executes dropped EXE
-
\??\c:\vpvdv.exec:\vpvdv.exe41⤵
- Executes dropped EXE
-
\??\c:\xllfrfr.exec:\xllfrfr.exe42⤵
- Executes dropped EXE
-
\??\c:\rffxrlf.exec:\rffxrlf.exe43⤵
- Executes dropped EXE
-
\??\c:\5hbnhb.exec:\5hbnhb.exe44⤵
- Executes dropped EXE
-
\??\c:\vpppd.exec:\vpppd.exe45⤵
- Executes dropped EXE
-
\??\c:\1dvpj.exec:\1dvpj.exe46⤵
- Executes dropped EXE
-
\??\c:\xllfxrr.exec:\xllfxrr.exe47⤵
- Executes dropped EXE
-
\??\c:\lllfxrl.exec:\lllfxrl.exe48⤵
- Executes dropped EXE
-
\??\c:\nnbnht.exec:\nnbnht.exe49⤵
- Executes dropped EXE
-
\??\c:\vpvpv.exec:\vpvpv.exe50⤵
- Executes dropped EXE
-
\??\c:\vpjvp.exec:\vpjvp.exe51⤵
- Executes dropped EXE
-
\??\c:\rxxrffx.exec:\rxxrffx.exe52⤵
- Executes dropped EXE
-
\??\c:\3lrlxrl.exec:\3lrlxrl.exe53⤵
- Executes dropped EXE
-
\??\c:\htttnh.exec:\htttnh.exe54⤵
- Executes dropped EXE
-
\??\c:\pjvpp.exec:\pjvpp.exe55⤵
- Executes dropped EXE
-
\??\c:\frrlffx.exec:\frrlffx.exe56⤵
- Executes dropped EXE
-
\??\c:\hbhtnn.exec:\hbhtnn.exe57⤵
- Executes dropped EXE
-
\??\c:\btnhtt.exec:\btnhtt.exe58⤵
- Executes dropped EXE
-
\??\c:\pdjdp.exec:\pdjdp.exe59⤵
- Executes dropped EXE
-
\??\c:\9pvdp.exec:\9pvdp.exe60⤵
- Executes dropped EXE
-
\??\c:\frlllrl.exec:\frlllrl.exe61⤵
- Executes dropped EXE
-
\??\c:\lfffxxr.exec:\lfffxxr.exe62⤵
- Executes dropped EXE
-
\??\c:\httbtb.exec:\httbtb.exe63⤵
- Executes dropped EXE
-
\??\c:\tbbhhb.exec:\tbbhhb.exe64⤵
- Executes dropped EXE
-
\??\c:\jpvpj.exec:\jpvpj.exe65⤵
- Executes dropped EXE
-
\??\c:\1djjd.exec:\1djjd.exe66⤵
-
\??\c:\7fxlfxr.exec:\7fxlfxr.exe67⤵
-
\??\c:\llffrrl.exec:\llffrrl.exe68⤵
-
\??\c:\httnnn.exec:\httnnn.exe69⤵
-
\??\c:\vddvv.exec:\vddvv.exe70⤵
-
\??\c:\vjjjd.exec:\vjjjd.exe71⤵
-
\??\c:\rfxxllx.exec:\rfxxllx.exe72⤵
-
\??\c:\lflffff.exec:\lflffff.exe73⤵
-
\??\c:\7hnhbb.exec:\7hnhbb.exe74⤵
-
\??\c:\pjjdd.exec:\pjjdd.exe75⤵
-
\??\c:\dpvvv.exec:\dpvvv.exe76⤵
-
\??\c:\3rrlflx.exec:\3rrlflx.exe77⤵
-
\??\c:\1rlffrl.exec:\1rlffrl.exe78⤵
-
\??\c:\tnnnbb.exec:\tnnnbb.exe79⤵
-
\??\c:\vjjjd.exec:\vjjjd.exe80⤵
-
\??\c:\5dddp.exec:\5dddp.exe81⤵
-
\??\c:\xrrlllf.exec:\xrrlllf.exe82⤵
-
\??\c:\5fxrrrl.exec:\5fxrrrl.exe83⤵
-
\??\c:\9tbhhb.exec:\9tbhhb.exe84⤵
-
\??\c:\pvvpp.exec:\pvvpp.exe85⤵
-
\??\c:\xxxxllf.exec:\xxxxllf.exe86⤵
-
\??\c:\nhbbbb.exec:\nhbbbb.exe87⤵
-
\??\c:\tbnnnn.exec:\tbnnnn.exe88⤵
-
\??\c:\dvjpd.exec:\dvjpd.exe89⤵
-
\??\c:\ppjdp.exec:\ppjdp.exe90⤵
-
\??\c:\hthttn.exec:\hthttn.exe91⤵
-
\??\c:\btbbnn.exec:\btbbnn.exe92⤵
-
\??\c:\dvjdv.exec:\dvjdv.exe93⤵
-
\??\c:\pppjv.exec:\pppjv.exe94⤵
-
\??\c:\hbbbtt.exec:\hbbbtt.exe95⤵
-
\??\c:\hnbtbb.exec:\hnbtbb.exe96⤵
-
\??\c:\3ppdd.exec:\3ppdd.exe97⤵
-
\??\c:\rxlrlll.exec:\rxlrlll.exe98⤵
-
\??\c:\1nnhhh.exec:\1nnhhh.exe99⤵
-
\??\c:\hbhbbb.exec:\hbhbbb.exe100⤵
-
\??\c:\9jppd.exec:\9jppd.exe101⤵
-
\??\c:\rlrlrrl.exec:\rlrlrrl.exe102⤵
-
\??\c:\xlrrrrr.exec:\xlrrrrr.exe103⤵
-
\??\c:\bhhhbh.exec:\bhhhbh.exe104⤵
-
\??\c:\dvdvd.exec:\dvdvd.exe105⤵
-
\??\c:\lffrxrr.exec:\lffrxrr.exe106⤵
-
\??\c:\xxlfxxr.exec:\xxlfxxr.exe107⤵
-
\??\c:\pvppj.exec:\pvppj.exe108⤵
-
\??\c:\lfllxrf.exec:\lfllxrf.exe109⤵
-
\??\c:\frrlrrl.exec:\frrlrrl.exe110⤵
-
\??\c:\tntnnt.exec:\tntnnt.exe111⤵
-
\??\c:\jddvp.exec:\jddvp.exe112⤵
-
\??\c:\9pjjv.exec:\9pjjv.exe113⤵
-
\??\c:\3xrxlfr.exec:\3xrxlfr.exe114⤵
-
\??\c:\xllflfl.exec:\xllflfl.exe115⤵
-
\??\c:\nnnhbb.exec:\nnnhbb.exe116⤵
-
\??\c:\jvpjv.exec:\jvpjv.exe117⤵
-
\??\c:\vdvpd.exec:\vdvpd.exe118⤵
-
\??\c:\flxxfrr.exec:\flxxfrr.exe119⤵
-
\??\c:\xxflrrx.exec:\xxflrrx.exe120⤵
-
\??\c:\btnhhb.exec:\btnhhb.exe121⤵
-
\??\c:\7jvpd.exec:\7jvpd.exe122⤵
-
\??\c:\fxxlrll.exec:\fxxlrll.exe123⤵
-
\??\c:\3xfffff.exec:\3xfffff.exe124⤵
-
\??\c:\nhnbtn.exec:\nhnbtn.exe125⤵
-
\??\c:\btttnn.exec:\btttnn.exe126⤵
-
\??\c:\xrfllxr.exec:\xrfllxr.exe127⤵
-
\??\c:\xffxlrl.exec:\xffxlrl.exe128⤵
-
\??\c:\1thtbn.exec:\1thtbn.exe129⤵
-
\??\c:\jjddv.exec:\jjddv.exe130⤵
-
\??\c:\jdvvd.exec:\jdvvd.exe131⤵
-
\??\c:\fxffxfx.exec:\fxffxfx.exe132⤵
-
\??\c:\hbhbth.exec:\hbhbth.exe133⤵
-
\??\c:\nhnnbh.exec:\nhnnbh.exe134⤵
-
\??\c:\jpdvv.exec:\jpdvv.exe135⤵
-
\??\c:\1rrlllf.exec:\1rrlllf.exe136⤵
-
\??\c:\3rrfxxx.exec:\3rrfxxx.exe137⤵
-
\??\c:\btnnth.exec:\btnnth.exe138⤵
-
\??\c:\jvjvv.exec:\jvjvv.exe139⤵
-
\??\c:\xxxxrxx.exec:\xxxxrxx.exe140⤵
-
\??\c:\fxffxxx.exec:\fxffxxx.exe141⤵
-
\??\c:\bnnnhh.exec:\bnnnhh.exe142⤵
-
\??\c:\hhnnnn.exec:\hhnnnn.exe143⤵
-
\??\c:\vppjv.exec:\vppjv.exe144⤵
-
\??\c:\xlxrrll.exec:\xlxrrll.exe145⤵
-
\??\c:\fxffrxx.exec:\fxffrxx.exe146⤵
-
\??\c:\hbnhnh.exec:\hbnhnh.exe147⤵
-
\??\c:\dvpjd.exec:\dvpjd.exe148⤵
-
\??\c:\jdjdj.exec:\jdjdj.exe149⤵
-
\??\c:\rrrxlrr.exec:\rrrxlrr.exe150⤵
-
\??\c:\5flxlff.exec:\5flxlff.exe151⤵
-
\??\c:\hbbnbn.exec:\hbbnbn.exe152⤵
-
\??\c:\tnhbbb.exec:\tnhbbb.exe153⤵
-
\??\c:\dpvvp.exec:\dpvvp.exe154⤵
-
\??\c:\rflflll.exec:\rflflll.exe155⤵
-
\??\c:\rlrxllf.exec:\rlrxllf.exe156⤵
-
\??\c:\nnnhtb.exec:\nnnhtb.exe157⤵
-
\??\c:\vpjvj.exec:\vpjvj.exe158⤵
-
\??\c:\5pdvv.exec:\5pdvv.exe159⤵
-
\??\c:\xrffrrx.exec:\xrffrrx.exe160⤵
-
\??\c:\7nnhbt.exec:\7nnhbt.exe161⤵
-
\??\c:\9vjjj.exec:\9vjjj.exe162⤵
-
\??\c:\dppdj.exec:\dppdj.exe163⤵
-
\??\c:\frffrlf.exec:\frffrlf.exe164⤵
-
\??\c:\jppjd.exec:\jppjd.exe165⤵
-
\??\c:\hbtnbb.exec:\hbtnbb.exe166⤵
-
\??\c:\1bbbbb.exec:\1bbbbb.exe167⤵
-
\??\c:\vpdpp.exec:\vpdpp.exe168⤵
-
\??\c:\lxfxxxr.exec:\lxfxxxr.exe169⤵
-
\??\c:\bttbtt.exec:\bttbtt.exe170⤵
-
\??\c:\ddjdv.exec:\ddjdv.exe171⤵
-
\??\c:\rrlfxrr.exec:\rrlfxrr.exe172⤵
-
\??\c:\nntnbb.exec:\nntnbb.exe173⤵
-
\??\c:\jdjvp.exec:\jdjvp.exe174⤵
-
\??\c:\fxxfxxf.exec:\fxxfxxf.exe175⤵
-
\??\c:\bhtnnh.exec:\bhtnnh.exe176⤵
-
\??\c:\tnhhtt.exec:\tnhhtt.exe177⤵
-
\??\c:\vppvj.exec:\vppvj.exe178⤵
-
\??\c:\1jppj.exec:\1jppj.exe179⤵
-
\??\c:\5llfffl.exec:\5llfffl.exe180⤵
-
\??\c:\frxffrr.exec:\frxffrr.exe181⤵
-
\??\c:\9hhhhh.exec:\9hhhhh.exe182⤵
-
\??\c:\bttnhh.exec:\bttnhh.exe183⤵
-
\??\c:\1vvvp.exec:\1vvvp.exe184⤵
-
\??\c:\xrxrrxl.exec:\xrxrrxl.exe185⤵
-
\??\c:\thhhbt.exec:\thhhbt.exe186⤵
-
\??\c:\nhhhtn.exec:\nhhhtn.exe187⤵
-
\??\c:\hbnhtb.exec:\hbnhtb.exe188⤵
-
\??\c:\1dvpj.exec:\1dvpj.exe189⤵
-
\??\c:\9rxrrxx.exec:\9rxrrxx.exe190⤵
-
\??\c:\rrrfrfx.exec:\rrrfrfx.exe191⤵
-
\??\c:\bbbtnh.exec:\bbbtnh.exe192⤵
-
\??\c:\jdjdj.exec:\jdjdj.exe193⤵
-
\??\c:\dvdvp.exec:\dvdvp.exe194⤵
-
\??\c:\rfllxxr.exec:\rfllxxr.exe195⤵
-
\??\c:\hbtnbt.exec:\hbtnbt.exe196⤵
-
\??\c:\nhnnnn.exec:\nhnnnn.exe197⤵
-
\??\c:\vvddv.exec:\vvddv.exe198⤵
-
\??\c:\3flfllx.exec:\3flfllx.exe199⤵
-
\??\c:\xflffll.exec:\xflffll.exe200⤵
-
\??\c:\nbhbbb.exec:\nbhbbb.exe201⤵
-
\??\c:\tttnbb.exec:\tttnbb.exe202⤵
-
\??\c:\dvjdv.exec:\dvjdv.exe203⤵
-
\??\c:\1jdvp.exec:\1jdvp.exe204⤵
-
\??\c:\fxxrfrr.exec:\fxxrfrr.exe205⤵
-
\??\c:\1ntnhb.exec:\1ntnhb.exe206⤵
-
\??\c:\nhbtbt.exec:\nhbtbt.exe207⤵
-
\??\c:\djdvj.exec:\djdvj.exe208⤵
-
\??\c:\jvpjp.exec:\jvpjp.exe209⤵
-
\??\c:\xxlxllf.exec:\xxlxllf.exe210⤵
-
\??\c:\nbtbth.exec:\nbtbth.exe211⤵
-
\??\c:\tntnbt.exec:\tntnbt.exe212⤵
-
\??\c:\9ppvv.exec:\9ppvv.exe213⤵
-
\??\c:\djppp.exec:\djppp.exe214⤵
-
\??\c:\7xxrrrr.exec:\7xxrrrr.exe215⤵
-
\??\c:\3nhhbb.exec:\3nhhbb.exe216⤵
-
\??\c:\1htbtt.exec:\1htbtt.exe217⤵
-
\??\c:\pdjpp.exec:\pdjpp.exe218⤵
-
\??\c:\jjdvv.exec:\jjdvv.exe219⤵
-
\??\c:\lrfxrrl.exec:\lrfxrrl.exe220⤵
-
\??\c:\llrfrrf.exec:\llrfrrf.exe221⤵
-
\??\c:\9ttnhh.exec:\9ttnhh.exe222⤵
-
\??\c:\btbthh.exec:\btbthh.exe223⤵
-
\??\c:\dvvpj.exec:\dvvpj.exe224⤵
-
\??\c:\lxxrlfx.exec:\lxxrlfx.exe225⤵
-
\??\c:\3xffxff.exec:\3xffxff.exe226⤵
-
\??\c:\nbhhnn.exec:\nbhhnn.exe227⤵
-
\??\c:\thtnnh.exec:\thtnnh.exe228⤵
-
\??\c:\5djdj.exec:\5djdj.exe229⤵
-
\??\c:\pjvpp.exec:\pjvpp.exe230⤵
-
\??\c:\llxrxff.exec:\llxrxff.exe231⤵
-
\??\c:\xlxxffx.exec:\xlxxffx.exe232⤵
-
\??\c:\tnbttt.exec:\tnbttt.exe233⤵
-
\??\c:\djpjv.exec:\djpjv.exe234⤵
-
\??\c:\ddjdd.exec:\ddjdd.exe235⤵
-
\??\c:\rrxrxrf.exec:\rrxrxrf.exe236⤵
-
\??\c:\nthhhn.exec:\nthhhn.exe237⤵
-
\??\c:\nhntnn.exec:\nhntnn.exe238⤵
-
\??\c:\vjvpp.exec:\vjvpp.exe239⤵
-
\??\c:\5pvpp.exec:\5pvpp.exe240⤵
-
\??\c:\rlxxxxl.exec:\rlxxxxl.exe241⤵