Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 03:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1614baf5d631dc31a7244c693bdeeee0_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
1614baf5d631dc31a7244c693bdeeee0_NeikiAnalytics.exe
-
Size
72KB
-
MD5
1614baf5d631dc31a7244c693bdeeee0
-
SHA1
fd1fc3e17e6d6f1e4d06ea724fa9831b64b26938
-
SHA256
c0491f22c5cea33513e4e3c5f7ace1fe948aeee444b6b5abdfee2cba3ca9cbe1
-
SHA512
9fe4715205076c1f6fdcce91cb7c1680dacda874b77e374bf86413988a2e841526b458db5ce0c2bc2c1f5111799999c33c7f64f42685e30af4ec82612930f2a0
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIrmCeRMKwU:ymb3NkkiQ3mdBjFIjeKU
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/3664-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3844-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3476-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3540-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1536-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4616-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2152-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2424-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1924-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4404-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1724-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3772-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1016-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1580-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/764-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2420-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2980-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1372-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3868-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/988-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1448-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/528-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
08482.exec000240.exetnttbh.exe840244.exe2060448.exe24200.exe224400.exe0268040.exe0626600.exebnnhbt.exe6060800.exew84826.exe026224.exedvvpd.exedvvpd.exejjvvp.exejddvd.exe848682.exepvdvp.exenttnhh.exe226624.exebbnnnh.exe0660882.exe82404.exeppppd.exenbbnhh.exejddpp.exe4426048.exe4280448.exexrxxlfl.exe02682.exe284824.exe202600.exec222226.exec604486.exetttnhb.exe62486.exe484860.exe5jvpj.exejjpjd.exe00648.exe8060048.exedpvvv.exe4224260.exe20888.exeddvjv.exe60606.exeppvjj.exe4400444.exe68208.exem6226.exexrlfrrr.exeppjpp.exerxxrfff.exem6444.exe9ffxllx.exe080060.exei204444.exethbthh.exe7rxxrrl.exebttnhb.exe7rlllrl.exenbhbtt.exeu882266.exepid process 3844 08482.exe 3476 c000240.exe 3540 tnttbh.exe 528 840244.exe 1448 2060448.exe 1536 24200.exe 988 224400.exe 3868 0268040.exe 4616 0626600.exe 2152 bnnhbt.exe 4692 6060800.exe 5088 w84826.exe 1372 026224.exe 2424 dvvpd.exe 4508 dvvpd.exe 2980 jjvvp.exe 1924 jddvd.exe 4404 848682.exe 3092 pvdvp.exe 2420 nttnhh.exe 1272 226624.exe 1724 bbnnnh.exe 764 0660882.exe 5004 82404.exe 1580 ppppd.exe 4468 nbbnhh.exe 972 jddpp.exe 3772 4426048.exe 2292 4280448.exe 1016 xrxxlfl.exe 4572 02682.exe 3816 284824.exe 4732 202600.exe 852 c222226.exe 3688 c604486.exe 4800 tttnhb.exe 4512 62486.exe 4740 484860.exe 1260 5jvpj.exe 1280 jjpjd.exe 4328 00648.exe 1388 8060048.exe 2200 dpvvv.exe 2652 4224260.exe 2972 20888.exe 4844 ddvjv.exe 4980 60606.exe 4932 ppvjj.exe 628 4400444.exe 968 68208.exe 3968 m6226.exe 3064 xrlfrrr.exe 3660 ppjpp.exe 1120 rxxrfff.exe 4960 m6444.exe 3912 9ffxllx.exe 4928 080060.exe 2300 i204444.exe 2224 thbthh.exe 4528 7rxxrrl.exe 3976 bttnhb.exe 2572 7rlllrl.exe 1592 nbhbtt.exe 1636 u882266.exe -
Processes:
resource yara_rule behavioral2/memory/3664-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3664-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3844-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3476-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3540-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/528-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/528-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/528-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1536-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2152-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2424-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4404-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1724-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3772-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1016-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1580-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/764-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2420-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2980-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4508-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1372-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3868-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/988-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1448-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/528-39-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1614baf5d631dc31a7244c693bdeeee0_NeikiAnalytics.exe08482.exec000240.exetnttbh.exe840244.exe2060448.exe24200.exe224400.exe0268040.exe0626600.exebnnhbt.exe6060800.exew84826.exe026224.exedvvpd.exedvvpd.exejjvvp.exejddvd.exe848682.exepvdvp.exenttnhh.exe226624.exedescription pid process target process PID 3664 wrote to memory of 3844 3664 1614baf5d631dc31a7244c693bdeeee0_NeikiAnalytics.exe 08482.exe PID 3664 wrote to memory of 3844 3664 1614baf5d631dc31a7244c693bdeeee0_NeikiAnalytics.exe 08482.exe PID 3664 wrote to memory of 3844 3664 1614baf5d631dc31a7244c693bdeeee0_NeikiAnalytics.exe 08482.exe PID 3844 wrote to memory of 3476 3844 08482.exe c000240.exe PID 3844 wrote to memory of 3476 3844 08482.exe c000240.exe PID 3844 wrote to memory of 3476 3844 08482.exe c000240.exe PID 3476 wrote to memory of 3540 3476 c000240.exe tnttbh.exe PID 3476 wrote to memory of 3540 3476 c000240.exe tnttbh.exe PID 3476 wrote to memory of 3540 3476 c000240.exe tnttbh.exe PID 3540 wrote to memory of 528 3540 tnttbh.exe 840244.exe PID 3540 wrote to memory of 528 3540 tnttbh.exe 840244.exe PID 3540 wrote to memory of 528 3540 tnttbh.exe 840244.exe PID 528 wrote to memory of 1448 528 840244.exe 2060448.exe PID 528 wrote to memory of 1448 528 840244.exe 2060448.exe PID 528 wrote to memory of 1448 528 840244.exe 2060448.exe PID 1448 wrote to memory of 1536 1448 2060448.exe 24200.exe PID 1448 wrote to memory of 1536 1448 2060448.exe 24200.exe PID 1448 wrote to memory of 1536 1448 2060448.exe 24200.exe PID 1536 wrote to memory of 988 1536 24200.exe 224400.exe PID 1536 wrote to memory of 988 1536 24200.exe 224400.exe PID 1536 wrote to memory of 988 1536 24200.exe 224400.exe PID 988 wrote to memory of 3868 988 224400.exe 0268040.exe PID 988 wrote to memory of 3868 988 224400.exe 0268040.exe PID 988 wrote to memory of 3868 988 224400.exe 0268040.exe PID 3868 wrote to memory of 4616 3868 0268040.exe 0626600.exe PID 3868 wrote to memory of 4616 3868 0268040.exe 0626600.exe PID 3868 wrote to memory of 4616 3868 0268040.exe 0626600.exe PID 4616 wrote to memory of 2152 4616 0626600.exe bnnhbt.exe PID 4616 wrote to memory of 2152 4616 0626600.exe bnnhbt.exe PID 4616 wrote to memory of 2152 4616 0626600.exe bnnhbt.exe PID 2152 wrote to memory of 4692 2152 bnnhbt.exe 6060800.exe PID 2152 wrote to memory of 4692 2152 bnnhbt.exe 6060800.exe PID 2152 wrote to memory of 4692 2152 bnnhbt.exe 6060800.exe PID 4692 wrote to memory of 5088 4692 6060800.exe 1jdpj.exe PID 4692 wrote to memory of 5088 4692 6060800.exe 1jdpj.exe PID 4692 wrote to memory of 5088 4692 6060800.exe 1jdpj.exe PID 5088 wrote to memory of 1372 5088 w84826.exe 026224.exe PID 5088 wrote to memory of 1372 5088 w84826.exe 026224.exe PID 5088 wrote to memory of 1372 5088 w84826.exe 026224.exe PID 1372 wrote to memory of 2424 1372 026224.exe dvvpd.exe PID 1372 wrote to memory of 2424 1372 026224.exe dvvpd.exe PID 1372 wrote to memory of 2424 1372 026224.exe dvvpd.exe PID 2424 wrote to memory of 4508 2424 dvvpd.exe 5frllll.exe PID 2424 wrote to memory of 4508 2424 dvvpd.exe 5frllll.exe PID 2424 wrote to memory of 4508 2424 dvvpd.exe 5frllll.exe PID 4508 wrote to memory of 2980 4508 dvvpd.exe jjvvp.exe PID 4508 wrote to memory of 2980 4508 dvvpd.exe jjvvp.exe PID 4508 wrote to memory of 2980 4508 dvvpd.exe jjvvp.exe PID 2980 wrote to memory of 1924 2980 jjvvp.exe jddvd.exe PID 2980 wrote to memory of 1924 2980 jjvvp.exe jddvd.exe PID 2980 wrote to memory of 1924 2980 jjvvp.exe jddvd.exe PID 1924 wrote to memory of 4404 1924 jddvd.exe lxlfxll.exe PID 1924 wrote to memory of 4404 1924 jddvd.exe lxlfxll.exe PID 1924 wrote to memory of 4404 1924 jddvd.exe lxlfxll.exe PID 4404 wrote to memory of 3092 4404 848682.exe pvdvp.exe PID 4404 wrote to memory of 3092 4404 848682.exe pvdvp.exe PID 4404 wrote to memory of 3092 4404 848682.exe pvdvp.exe PID 3092 wrote to memory of 2420 3092 pvdvp.exe nttnhh.exe PID 3092 wrote to memory of 2420 3092 pvdvp.exe nttnhh.exe PID 3092 wrote to memory of 2420 3092 pvdvp.exe nttnhh.exe PID 2420 wrote to memory of 1272 2420 nttnhh.exe 226624.exe PID 2420 wrote to memory of 1272 2420 nttnhh.exe 226624.exe PID 2420 wrote to memory of 1272 2420 nttnhh.exe 226624.exe PID 1272 wrote to memory of 1724 1272 226624.exe bbnnnh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1614baf5d631dc31a7244c693bdeeee0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1614baf5d631dc31a7244c693bdeeee0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\08482.exec:\08482.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\c000240.exec:\c000240.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnttbh.exec:\tnttbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\840244.exec:\840244.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\2060448.exec:\2060448.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\24200.exec:\24200.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\224400.exec:\224400.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\0268040.exec:\0268040.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\0626600.exec:\0626600.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnnhbt.exec:\bnnhbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\6060800.exec:\6060800.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\w84826.exec:\w84826.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\026224.exec:\026224.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvvpd.exec:\dvvpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvvpd.exec:\dvvpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjvvp.exec:\jjvvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jddvd.exec:\jddvd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\848682.exec:\848682.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvdvp.exec:\pvdvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nttnhh.exec:\nttnhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\226624.exec:\226624.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbnnnh.exec:\bbnnnh.exe23⤵
- Executes dropped EXE
-
\??\c:\0660882.exec:\0660882.exe24⤵
- Executes dropped EXE
-
\??\c:\82404.exec:\82404.exe25⤵
- Executes dropped EXE
-
\??\c:\ppppd.exec:\ppppd.exe26⤵
- Executes dropped EXE
-
\??\c:\nbbnhh.exec:\nbbnhh.exe27⤵
- Executes dropped EXE
-
\??\c:\jddpp.exec:\jddpp.exe28⤵
- Executes dropped EXE
-
\??\c:\4426048.exec:\4426048.exe29⤵
- Executes dropped EXE
-
\??\c:\4280448.exec:\4280448.exe30⤵
- Executes dropped EXE
-
\??\c:\xrxxlfl.exec:\xrxxlfl.exe31⤵
- Executes dropped EXE
-
\??\c:\02682.exec:\02682.exe32⤵
- Executes dropped EXE
-
\??\c:\284824.exec:\284824.exe33⤵
- Executes dropped EXE
-
\??\c:\202600.exec:\202600.exe34⤵
- Executes dropped EXE
-
\??\c:\c222226.exec:\c222226.exe35⤵
- Executes dropped EXE
-
\??\c:\c604486.exec:\c604486.exe36⤵
- Executes dropped EXE
-
\??\c:\tttnhb.exec:\tttnhb.exe37⤵
- Executes dropped EXE
-
\??\c:\62486.exec:\62486.exe38⤵
- Executes dropped EXE
-
\??\c:\484860.exec:\484860.exe39⤵
- Executes dropped EXE
-
\??\c:\5jvpj.exec:\5jvpj.exe40⤵
- Executes dropped EXE
-
\??\c:\jjpjd.exec:\jjpjd.exe41⤵
- Executes dropped EXE
-
\??\c:\00648.exec:\00648.exe42⤵
- Executes dropped EXE
-
\??\c:\8060048.exec:\8060048.exe43⤵
- Executes dropped EXE
-
\??\c:\dpvvv.exec:\dpvvv.exe44⤵
- Executes dropped EXE
-
\??\c:\4224260.exec:\4224260.exe45⤵
- Executes dropped EXE
-
\??\c:\20888.exec:\20888.exe46⤵
- Executes dropped EXE
-
\??\c:\ddvjv.exec:\ddvjv.exe47⤵
- Executes dropped EXE
-
\??\c:\60606.exec:\60606.exe48⤵
- Executes dropped EXE
-
\??\c:\ppvjj.exec:\ppvjj.exe49⤵
- Executes dropped EXE
-
\??\c:\4400444.exec:\4400444.exe50⤵
- Executes dropped EXE
-
\??\c:\68208.exec:\68208.exe51⤵
- Executes dropped EXE
-
\??\c:\m6226.exec:\m6226.exe52⤵
- Executes dropped EXE
-
\??\c:\xrlfrrr.exec:\xrlfrrr.exe53⤵
- Executes dropped EXE
-
\??\c:\ppjpp.exec:\ppjpp.exe54⤵
- Executes dropped EXE
-
\??\c:\rxxrfff.exec:\rxxrfff.exe55⤵
- Executes dropped EXE
-
\??\c:\m6444.exec:\m6444.exe56⤵
- Executes dropped EXE
-
\??\c:\9ffxllx.exec:\9ffxllx.exe57⤵
- Executes dropped EXE
-
\??\c:\080060.exec:\080060.exe58⤵
- Executes dropped EXE
-
\??\c:\i204444.exec:\i204444.exe59⤵
- Executes dropped EXE
-
\??\c:\thbthh.exec:\thbthh.exe60⤵
- Executes dropped EXE
-
\??\c:\7rxxrrl.exec:\7rxxrrl.exe61⤵
- Executes dropped EXE
-
\??\c:\bttnhb.exec:\bttnhb.exe62⤵
- Executes dropped EXE
-
\??\c:\7rlllrl.exec:\7rlllrl.exe63⤵
- Executes dropped EXE
-
\??\c:\nbhbtt.exec:\nbhbtt.exe64⤵
- Executes dropped EXE
-
\??\c:\u882266.exec:\u882266.exe65⤵
- Executes dropped EXE
-
\??\c:\nbbtnh.exec:\nbbtnh.exe66⤵
-
\??\c:\pjvpj.exec:\pjvpj.exe67⤵
-
\??\c:\0608260.exec:\0608260.exe68⤵
-
\??\c:\fllxrrr.exec:\fllxrrr.exe69⤵
-
\??\c:\lfxxxrl.exec:\lfxxxrl.exe70⤵
-
\??\c:\7ttnhn.exec:\7ttnhn.exe71⤵
-
\??\c:\628488.exec:\628488.exe72⤵
-
\??\c:\0028606.exec:\0028606.exe73⤵
-
\??\c:\6422288.exec:\6422288.exe74⤵
-
\??\c:\86804.exec:\86804.exe75⤵
-
\??\c:\nbbnbb.exec:\nbbnbb.exe76⤵
-
\??\c:\w44860.exec:\w44860.exe77⤵
-
\??\c:\7pddp.exec:\7pddp.exe78⤵
-
\??\c:\866626.exec:\866626.exe79⤵
-
\??\c:\ffffffl.exec:\ffffffl.exe80⤵
-
\??\c:\tbnnht.exec:\tbnnht.exe81⤵
-
\??\c:\nntnbb.exec:\nntnbb.exe82⤵
-
\??\c:\q20000.exec:\q20000.exe83⤵
-
\??\c:\8068468.exec:\8068468.exe84⤵
-
\??\c:\1hthth.exec:\1hthth.exe85⤵
-
\??\c:\28060.exec:\28060.exe86⤵
-
\??\c:\200044.exec:\200044.exe87⤵
-
\??\c:\s0482.exec:\s0482.exe88⤵
-
\??\c:\0244444.exec:\0244444.exe89⤵
-
\??\c:\pjdvj.exec:\pjdvj.exe90⤵
-
\??\c:\m4208.exec:\m4208.exe91⤵
-
\??\c:\vppjd.exec:\vppjd.exe92⤵
-
\??\c:\06648.exec:\06648.exe93⤵
-
\??\c:\ppvdp.exec:\ppvdp.exe94⤵
-
\??\c:\1jdpj.exec:\1jdpj.exe95⤵
-
\??\c:\9lrlffx.exec:\9lrlffx.exe96⤵
-
\??\c:\5xfxxxx.exec:\5xfxxxx.exe97⤵
-
\??\c:\nhhbbt.exec:\nhhbbt.exe98⤵
-
\??\c:\jjvpd.exec:\jjvpd.exe99⤵
-
\??\c:\g2222.exec:\g2222.exe100⤵
-
\??\c:\26808.exec:\26808.exe101⤵
-
\??\c:\60482.exec:\60482.exe102⤵
-
\??\c:\lxlfxll.exec:\lxlfxll.exe103⤵
-
\??\c:\xfrlffx.exec:\xfrlffx.exe104⤵
-
\??\c:\nbbhhb.exec:\nbbhhb.exe105⤵
-
\??\c:\djjjd.exec:\djjjd.exe106⤵
-
\??\c:\8242608.exec:\8242608.exe107⤵
-
\??\c:\pjjpj.exec:\pjjpj.exe108⤵
-
\??\c:\m2408.exec:\m2408.exe109⤵
-
\??\c:\pdvpj.exec:\pdvpj.exe110⤵
-
\??\c:\bnthbn.exec:\bnthbn.exe111⤵
-
\??\c:\7ppvp.exec:\7ppvp.exe112⤵
-
\??\c:\ffxlfxr.exec:\ffxlfxr.exe113⤵
-
\??\c:\2688484.exec:\2688484.exe114⤵
-
\??\c:\1tthtn.exec:\1tthtn.exe115⤵
-
\??\c:\htnbnh.exec:\htnbnh.exe116⤵
-
\??\c:\thbhbb.exec:\thbhbb.exe117⤵
-
\??\c:\8686048.exec:\8686048.exe118⤵
-
\??\c:\hnthhb.exec:\hnthhb.exe119⤵
-
\??\c:\u882260.exec:\u882260.exe120⤵
-
\??\c:\02206.exec:\02206.exe121⤵
-
\??\c:\dvpvp.exec:\dvpvp.exe122⤵
-
\??\c:\frlxrlx.exec:\frlxrlx.exe123⤵
-
\??\c:\022604.exec:\022604.exe124⤵
-
\??\c:\808068.exec:\808068.exe125⤵
-
\??\c:\9rllllr.exec:\9rllllr.exe126⤵
-
\??\c:\44064.exec:\44064.exe127⤵
-
\??\c:\0860620.exec:\0860620.exe128⤵
-
\??\c:\k62628.exec:\k62628.exe129⤵
-
\??\c:\8248604.exec:\8248604.exe130⤵
-
\??\c:\4608286.exec:\4608286.exe131⤵
-
\??\c:\btbhht.exec:\btbhht.exe132⤵
-
\??\c:\fo88660.exec:\fo88660.exe133⤵
-
\??\c:\hbbtnn.exec:\hbbtnn.exe134⤵
-
\??\c:\pvjdv.exec:\pvjdv.exe135⤵
-
\??\c:\9llfxfx.exec:\9llfxfx.exe136⤵
-
\??\c:\6848226.exec:\6848226.exe137⤵
-
\??\c:\6400882.exec:\6400882.exe138⤵
-
\??\c:\bbhhtt.exec:\bbhhtt.exe139⤵
-
\??\c:\5frllll.exec:\5frllll.exe140⤵
-
\??\c:\w68266.exec:\w68266.exe141⤵
-
\??\c:\nhbbhh.exec:\nhbbhh.exe142⤵
-
\??\c:\m4604.exec:\m4604.exe143⤵
-
\??\c:\206606.exec:\206606.exe144⤵
-
\??\c:\rlfxxxx.exec:\rlfxxxx.exe145⤵
-
\??\c:\00884.exec:\00884.exe146⤵
-
\??\c:\6244882.exec:\6244882.exe147⤵
-
\??\c:\000426.exec:\000426.exe148⤵
-
\??\c:\nhhnbt.exec:\nhhnbt.exe149⤵
-
\??\c:\42404.exec:\42404.exe150⤵
-
\??\c:\btnnhn.exec:\btnnhn.exe151⤵
-
\??\c:\jdvpv.exec:\jdvpv.exe152⤵
-
\??\c:\pjjvp.exec:\pjjvp.exe153⤵
-
\??\c:\thhtnh.exec:\thhtnh.exe154⤵
-
\??\c:\hbttbt.exec:\hbttbt.exe155⤵
-
\??\c:\402284.exec:\402284.exe156⤵
-
\??\c:\djdvd.exec:\djdvd.exe157⤵
-
\??\c:\2846004.exec:\2846004.exe158⤵
-
\??\c:\vvddd.exec:\vvddd.exe159⤵
-
\??\c:\llrrrrx.exec:\llrrrrx.exe160⤵
-
\??\c:\804242.exec:\804242.exe161⤵
-
\??\c:\828844.exec:\828844.exe162⤵
-
\??\c:\24604.exec:\24604.exe163⤵
-
\??\c:\6004400.exec:\6004400.exe164⤵
-
\??\c:\pjvvv.exec:\pjvvv.exe165⤵
-
\??\c:\0806026.exec:\0806026.exe166⤵
-
\??\c:\vvvjd.exec:\vvvjd.exe167⤵
-
\??\c:\3dvpd.exec:\3dvpd.exe168⤵
-
\??\c:\822600.exec:\822600.exe169⤵
-
\??\c:\224044.exec:\224044.exe170⤵
-
\??\c:\xrfllll.exec:\xrfllll.exe171⤵
-
\??\c:\u004824.exec:\u004824.exe172⤵
-
\??\c:\4066222.exec:\4066222.exe173⤵
-
\??\c:\82222.exec:\82222.exe174⤵
-
\??\c:\dpddv.exec:\dpddv.exe175⤵
-
\??\c:\80886.exec:\80886.exe176⤵
-
\??\c:\jjjdv.exec:\jjjdv.exe177⤵
-
\??\c:\4288440.exec:\4288440.exe178⤵
-
\??\c:\xlxrrrr.exec:\xlxrrrr.exe179⤵
-
\??\c:\djjdv.exec:\djjdv.exe180⤵
-
\??\c:\pdjdv.exec:\pdjdv.exe181⤵
-
\??\c:\6800444.exec:\6800444.exe182⤵
-
\??\c:\thhhhh.exec:\thhhhh.exe183⤵
-
\??\c:\pjvdj.exec:\pjvdj.exe184⤵
-
\??\c:\dppvv.exec:\dppvv.exe185⤵
-
\??\c:\0200448.exec:\0200448.exe186⤵
-
\??\c:\rrlfxff.exec:\rrlfxff.exe187⤵
-
\??\c:\1xrllxf.exec:\1xrllxf.exe188⤵
-
\??\c:\ffxxxxr.exec:\ffxxxxr.exe189⤵
-
\??\c:\dvjjj.exec:\dvjjj.exe190⤵
-
\??\c:\0440406.exec:\0440406.exe191⤵
-
\??\c:\g0226.exec:\g0226.exe192⤵
-
\??\c:\604042.exec:\604042.exe193⤵
-
\??\c:\fffxrrl.exec:\fffxrrl.exe194⤵
-
\??\c:\ddvdv.exec:\ddvdv.exe195⤵
-
\??\c:\2640688.exec:\2640688.exe196⤵
-
\??\c:\06488.exec:\06488.exe197⤵
-
\??\c:\w06664.exec:\w06664.exe198⤵
-
\??\c:\482660.exec:\482660.exe199⤵
-
\??\c:\xfffflf.exec:\xfffflf.exe200⤵
-
\??\c:\nthhbt.exec:\nthhbt.exe201⤵
-
\??\c:\pvvdp.exec:\pvvdp.exe202⤵
-
\??\c:\2606228.exec:\2606228.exe203⤵
-
\??\c:\hbbttn.exec:\hbbttn.exe204⤵
-
\??\c:\6804888.exec:\6804888.exe205⤵
-
\??\c:\402884.exec:\402884.exe206⤵
-
\??\c:\4648244.exec:\4648244.exe207⤵
-
\??\c:\frffxxf.exec:\frffxxf.exe208⤵
-
\??\c:\24604.exec:\24604.exe209⤵
-
\??\c:\llfxrrr.exec:\llfxrrr.exe210⤵
-
\??\c:\nhbttt.exec:\nhbttt.exe211⤵
-
\??\c:\hnnhhh.exec:\hnnhhh.exe212⤵
-
\??\c:\3nnnnn.exec:\3nnnnn.exe213⤵
-
\??\c:\8846288.exec:\8846288.exe214⤵
-
\??\c:\28604.exec:\28604.exe215⤵
-
\??\c:\2026660.exec:\2026660.exe216⤵
-
\??\c:\thhbtt.exec:\thhbtt.exe217⤵
-
\??\c:\82404.exec:\82404.exe218⤵
-
\??\c:\2624882.exec:\2624882.exe219⤵
-
\??\c:\jdjjj.exec:\jdjjj.exe220⤵
-
\??\c:\pppvv.exec:\pppvv.exe221⤵
-
\??\c:\bbhbnn.exec:\bbhbnn.exe222⤵
-
\??\c:\xxfffrr.exec:\xxfffrr.exe223⤵
-
\??\c:\2666004.exec:\2666004.exe224⤵
-
\??\c:\q84260.exec:\q84260.exe225⤵
-
\??\c:\vddvp.exec:\vddvp.exe226⤵
-
\??\c:\tbhbtt.exec:\tbhbtt.exe227⤵
-
\??\c:\tnntnn.exec:\tnntnn.exe228⤵
-
\??\c:\lllrrrf.exec:\lllrrrf.exe229⤵
-
\??\c:\vjpjd.exec:\vjpjd.exe230⤵
-
\??\c:\frfffff.exec:\frfffff.exe231⤵
-
\??\c:\64884.exec:\64884.exe232⤵
-
\??\c:\266660.exec:\266660.exe233⤵
-
\??\c:\4026600.exec:\4026600.exe234⤵
-
\??\c:\rxrrllx.exec:\rxrrllx.exe235⤵
-
\??\c:\c088888.exec:\c088888.exe236⤵
-
\??\c:\5nnntt.exec:\5nnntt.exe237⤵
-
\??\c:\4800448.exec:\4800448.exe238⤵
-
\??\c:\88404.exec:\88404.exe239⤵
-
\??\c:\djjjd.exec:\djjjd.exe240⤵
-
\??\c:\1ddvv.exec:\1ddvv.exe241⤵