Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 02:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
74d38a19512bb52aabec58d437595be0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
74d38a19512bb52aabec58d437595be0_NeikiAnalytics.exe
-
Size
89KB
-
MD5
74d38a19512bb52aabec58d437595be0
-
SHA1
d67724f15ab00ee5fce41a725a6fdca9b2a427d3
-
SHA256
6074548346ab0e8ac394553459b35e5676d54b39213748c92de8d375c48da86e
-
SHA512
35a90f2ff237eea08bf3015b920a0adb0e16483bc1b85ad7972425dbf3973def6b9c67c330e08f2d37630d6b481a4acf86b44ea3b897afc4a8100a18d81578c2
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDISoFGDvPGB1haZJOzU:ymb3NkkiQ3mdBjFIk7+czl
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/2180-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/548-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1608-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1608-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1488-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/588-72-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1596-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1528-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2356-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2364-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1832-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1520-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/908-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bjbhhl.exenllph.exenxftt.exenplbpp.exexhhdp.exepthjrr.exetrxtbr.exefvjpr.exehfpvl.exehbfvpn.exebfdlvhx.exepblpfj.exevnbbdv.exevbxhj.exexhjhb.exehdxpp.exejdfrhjb.exebftrj.exenxdlnh.exelvjrh.exeffdbtff.exeblvxr.exenxdrn.exeddtbnr.exettbxnpv.exehhhjtb.exehhnfv.exextxhn.exehfxbdt.exeljjvnj.exejhtpjf.exepxbpvh.exentrbpv.exefbhbhjx.exehfdbd.exejtltt.exebjrtt.exevnxfjrj.exejfxtnb.exedjvlflf.exeffjnl.exelhxtt.exejlnpjl.exeldxxvv.exebntnnfl.exefvlplfb.exefjbbr.exethfbtl.exethptr.exentnlf.exejlbflhp.exedlvjvbx.exelpvjtr.exehrrjxpt.exebxpdrxh.exethptpp.exetbdldx.exexxfrx.exeblvlxjx.exeflvpt.exejxjljl.exerfxttln.exebjtbx.exettdvbr.exepid process 548 bjbhhl.exe 2716 nllph.exe 1608 nxftt.exe 2896 nplbpp.exe 1488 xhhdp.exe 588 pthjrr.exe 2600 trxtbr.exe 2640 fvjpr.exe 2560 hfpvl.exe 2752 hbfvpn.exe 2624 bfdlvhx.exe 2460 pblpfj.exe 2432 vnbbdv.exe 2832 vbxhj.exe 1496 xhjhb.exe 2208 hdxpp.exe 1596 jdfrhjb.exe 1528 bftrj.exe 2356 nxdlnh.exe 932 lvjrh.exe 2364 ffdbtff.exe 1832 blvxr.exe 2124 nxdrn.exe 1520 ddtbnr.exe 2724 ttbxnpv.exe 1968 hhhjtb.exe 908 hhnfv.exe 760 xtxhn.exe 1768 hfxbdt.exe 564 ljjvnj.exe 876 jhtpjf.exe 2096 pxbpvh.exe 2604 ntrbpv.exe 3032 fbhbhjx.exe 2396 hfdbd.exe 1736 jtltt.exe 1108 bjrtt.exe 2876 vnxfjrj.exe 364 jfxtnb.exe 1824 djvlflf.exe 1352 ffjnl.exe 2880 lhxtt.exe 2652 jlnpjl.exe 2556 ldxxvv.exe 2756 bntnnfl.exe 2904 fvlplfb.exe 2532 fjbbr.exe 2688 thfbtl.exe 2848 thptr.exe 2280 ntnlf.exe 2444 jlbflhp.exe 2964 dlvjvbx.exe 2256 lpvjtr.exe 1636 hrrjxpt.exe 2208 bxpdrxh.exe 1596 thptpp.exe 1656 tbdldx.exe 1604 xxfrx.exe 1428 blvlxjx.exe 1804 flvpt.exe 2332 jxjljl.exe 1800 rfxttln.exe 1324 bjtbx.exe 768 ttdvbr.exe -
Processes:
resource yara_rule behavioral1/memory/2180-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/548-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1608-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1608-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1608-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1608-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1488-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1596-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1528-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2356-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2364-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1832-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1520-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/908-265-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
74d38a19512bb52aabec58d437595be0_NeikiAnalytics.exebjbhhl.exenllph.exenxftt.exenplbpp.exexhhdp.exepthjrr.exetrxtbr.exefvjpr.exehfpvl.exehbfvpn.exebfdlvhx.exepblpfj.exevnbbdv.exevbxhj.exexhjhb.exedescription pid process target process PID 2180 wrote to memory of 548 2180 74d38a19512bb52aabec58d437595be0_NeikiAnalytics.exe bjbhhl.exe PID 2180 wrote to memory of 548 2180 74d38a19512bb52aabec58d437595be0_NeikiAnalytics.exe bjbhhl.exe PID 2180 wrote to memory of 548 2180 74d38a19512bb52aabec58d437595be0_NeikiAnalytics.exe bjbhhl.exe PID 2180 wrote to memory of 548 2180 74d38a19512bb52aabec58d437595be0_NeikiAnalytics.exe bjbhhl.exe PID 548 wrote to memory of 2716 548 bjbhhl.exe nllph.exe PID 548 wrote to memory of 2716 548 bjbhhl.exe nllph.exe PID 548 wrote to memory of 2716 548 bjbhhl.exe nllph.exe PID 548 wrote to memory of 2716 548 bjbhhl.exe nllph.exe PID 2716 wrote to memory of 1608 2716 nllph.exe nxftt.exe PID 2716 wrote to memory of 1608 2716 nllph.exe nxftt.exe PID 2716 wrote to memory of 1608 2716 nllph.exe nxftt.exe PID 2716 wrote to memory of 1608 2716 nllph.exe nxftt.exe PID 1608 wrote to memory of 2896 1608 nxftt.exe nplbpp.exe PID 1608 wrote to memory of 2896 1608 nxftt.exe nplbpp.exe PID 1608 wrote to memory of 2896 1608 nxftt.exe nplbpp.exe PID 1608 wrote to memory of 2896 1608 nxftt.exe nplbpp.exe PID 2896 wrote to memory of 1488 2896 nplbpp.exe xhhdp.exe PID 2896 wrote to memory of 1488 2896 nplbpp.exe xhhdp.exe PID 2896 wrote to memory of 1488 2896 nplbpp.exe xhhdp.exe PID 2896 wrote to memory of 1488 2896 nplbpp.exe xhhdp.exe PID 1488 wrote to memory of 588 1488 xhhdp.exe pthjrr.exe PID 1488 wrote to memory of 588 1488 xhhdp.exe pthjrr.exe PID 1488 wrote to memory of 588 1488 xhhdp.exe pthjrr.exe PID 1488 wrote to memory of 588 1488 xhhdp.exe pthjrr.exe PID 588 wrote to memory of 2600 588 pthjrr.exe trxtbr.exe PID 588 wrote to memory of 2600 588 pthjrr.exe trxtbr.exe PID 588 wrote to memory of 2600 588 pthjrr.exe trxtbr.exe PID 588 wrote to memory of 2600 588 pthjrr.exe trxtbr.exe PID 2600 wrote to memory of 2640 2600 trxtbr.exe fvjpr.exe PID 2600 wrote to memory of 2640 2600 trxtbr.exe fvjpr.exe PID 2600 wrote to memory of 2640 2600 trxtbr.exe fvjpr.exe PID 2600 wrote to memory of 2640 2600 trxtbr.exe fvjpr.exe PID 2640 wrote to memory of 2560 2640 fvjpr.exe hfpvl.exe PID 2640 wrote to memory of 2560 2640 fvjpr.exe hfpvl.exe PID 2640 wrote to memory of 2560 2640 fvjpr.exe hfpvl.exe PID 2640 wrote to memory of 2560 2640 fvjpr.exe hfpvl.exe PID 2560 wrote to memory of 2752 2560 hfpvl.exe hbfvpn.exe PID 2560 wrote to memory of 2752 2560 hfpvl.exe hbfvpn.exe PID 2560 wrote to memory of 2752 2560 hfpvl.exe hbfvpn.exe PID 2560 wrote to memory of 2752 2560 hfpvl.exe hbfvpn.exe PID 2752 wrote to memory of 2624 2752 hbfvpn.exe bfdlvhx.exe PID 2752 wrote to memory of 2624 2752 hbfvpn.exe bfdlvhx.exe PID 2752 wrote to memory of 2624 2752 hbfvpn.exe bfdlvhx.exe PID 2752 wrote to memory of 2624 2752 hbfvpn.exe bfdlvhx.exe PID 2624 wrote to memory of 2460 2624 bfdlvhx.exe pblpfj.exe PID 2624 wrote to memory of 2460 2624 bfdlvhx.exe pblpfj.exe PID 2624 wrote to memory of 2460 2624 bfdlvhx.exe pblpfj.exe PID 2624 wrote to memory of 2460 2624 bfdlvhx.exe pblpfj.exe PID 2460 wrote to memory of 2432 2460 pblpfj.exe vnbbdv.exe PID 2460 wrote to memory of 2432 2460 pblpfj.exe vnbbdv.exe PID 2460 wrote to memory of 2432 2460 pblpfj.exe vnbbdv.exe PID 2460 wrote to memory of 2432 2460 pblpfj.exe vnbbdv.exe PID 2432 wrote to memory of 2832 2432 vnbbdv.exe vbxhj.exe PID 2432 wrote to memory of 2832 2432 vnbbdv.exe vbxhj.exe PID 2432 wrote to memory of 2832 2432 vnbbdv.exe vbxhj.exe PID 2432 wrote to memory of 2832 2432 vnbbdv.exe vbxhj.exe PID 2832 wrote to memory of 1496 2832 vbxhj.exe xhjhb.exe PID 2832 wrote to memory of 1496 2832 vbxhj.exe xhjhb.exe PID 2832 wrote to memory of 1496 2832 vbxhj.exe xhjhb.exe PID 2832 wrote to memory of 1496 2832 vbxhj.exe xhjhb.exe PID 1496 wrote to memory of 2208 1496 xhjhb.exe hdxpp.exe PID 1496 wrote to memory of 2208 1496 xhjhb.exe hdxpp.exe PID 1496 wrote to memory of 2208 1496 xhjhb.exe hdxpp.exe PID 1496 wrote to memory of 2208 1496 xhjhb.exe hdxpp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\74d38a19512bb52aabec58d437595be0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\74d38a19512bb52aabec58d437595be0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\bjbhhl.exec:\bjbhhl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nllph.exec:\nllph.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nxftt.exec:\nxftt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nplbpp.exec:\nplbpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xhhdp.exec:\xhhdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pthjrr.exec:\pthjrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\trxtbr.exec:\trxtbr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fvjpr.exec:\fvjpr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hfpvl.exec:\hfpvl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbfvpn.exec:\hbfvpn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bfdlvhx.exec:\bfdlvhx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pblpfj.exec:\pblpfj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vnbbdv.exec:\vnbbdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vbxhj.exec:\vbxhj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xhjhb.exec:\xhjhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hdxpp.exec:\hdxpp.exe17⤵
- Executes dropped EXE
-
\??\c:\jdfrhjb.exec:\jdfrhjb.exe18⤵
- Executes dropped EXE
-
\??\c:\bftrj.exec:\bftrj.exe19⤵
- Executes dropped EXE
-
\??\c:\nxdlnh.exec:\nxdlnh.exe20⤵
- Executes dropped EXE
-
\??\c:\lvjrh.exec:\lvjrh.exe21⤵
- Executes dropped EXE
-
\??\c:\ffdbtff.exec:\ffdbtff.exe22⤵
- Executes dropped EXE
-
\??\c:\blvxr.exec:\blvxr.exe23⤵
- Executes dropped EXE
-
\??\c:\nxdrn.exec:\nxdrn.exe24⤵
- Executes dropped EXE
-
\??\c:\ddtbnr.exec:\ddtbnr.exe25⤵
- Executes dropped EXE
-
\??\c:\ttbxnpv.exec:\ttbxnpv.exe26⤵
- Executes dropped EXE
-
\??\c:\hhhjtb.exec:\hhhjtb.exe27⤵
- Executes dropped EXE
-
\??\c:\hhnfv.exec:\hhnfv.exe28⤵
- Executes dropped EXE
-
\??\c:\xtxhn.exec:\xtxhn.exe29⤵
- Executes dropped EXE
-
\??\c:\hfxbdt.exec:\hfxbdt.exe30⤵
- Executes dropped EXE
-
\??\c:\ljjvnj.exec:\ljjvnj.exe31⤵
- Executes dropped EXE
-
\??\c:\jhtpjf.exec:\jhtpjf.exe32⤵
- Executes dropped EXE
-
\??\c:\pxbpvh.exec:\pxbpvh.exe33⤵
- Executes dropped EXE
-
\??\c:\ntrbpv.exec:\ntrbpv.exe34⤵
- Executes dropped EXE
-
\??\c:\fbhbhjx.exec:\fbhbhjx.exe35⤵
- Executes dropped EXE
-
\??\c:\hfdbd.exec:\hfdbd.exe36⤵
- Executes dropped EXE
-
\??\c:\jtltt.exec:\jtltt.exe37⤵
- Executes dropped EXE
-
\??\c:\bjrtt.exec:\bjrtt.exe38⤵
- Executes dropped EXE
-
\??\c:\vnxfjrj.exec:\vnxfjrj.exe39⤵
- Executes dropped EXE
-
\??\c:\jfxtnb.exec:\jfxtnb.exe40⤵
- Executes dropped EXE
-
\??\c:\djvlflf.exec:\djvlflf.exe41⤵
- Executes dropped EXE
-
\??\c:\ffjnl.exec:\ffjnl.exe42⤵
- Executes dropped EXE
-
\??\c:\lhxtt.exec:\lhxtt.exe43⤵
- Executes dropped EXE
-
\??\c:\jlnpjl.exec:\jlnpjl.exe44⤵
- Executes dropped EXE
-
\??\c:\ldxxvv.exec:\ldxxvv.exe45⤵
- Executes dropped EXE
-
\??\c:\bntnnfl.exec:\bntnnfl.exe46⤵
- Executes dropped EXE
-
\??\c:\fvlplfb.exec:\fvlplfb.exe47⤵
- Executes dropped EXE
-
\??\c:\fjbbr.exec:\fjbbr.exe48⤵
- Executes dropped EXE
-
\??\c:\thfbtl.exec:\thfbtl.exe49⤵
- Executes dropped EXE
-
\??\c:\thptr.exec:\thptr.exe50⤵
- Executes dropped EXE
-
\??\c:\ntnlf.exec:\ntnlf.exe51⤵
- Executes dropped EXE
-
\??\c:\jlbflhp.exec:\jlbflhp.exe52⤵
- Executes dropped EXE
-
\??\c:\dlvjvbx.exec:\dlvjvbx.exe53⤵
- Executes dropped EXE
-
\??\c:\lpvjtr.exec:\lpvjtr.exe54⤵
- Executes dropped EXE
-
\??\c:\hrrjxpt.exec:\hrrjxpt.exe55⤵
- Executes dropped EXE
-
\??\c:\bxpdrxh.exec:\bxpdrxh.exe56⤵
- Executes dropped EXE
-
\??\c:\thptpp.exec:\thptpp.exe57⤵
- Executes dropped EXE
-
\??\c:\tbdldx.exec:\tbdldx.exe58⤵
- Executes dropped EXE
-
\??\c:\xxfrx.exec:\xxfrx.exe59⤵
- Executes dropped EXE
-
\??\c:\blvlxjx.exec:\blvlxjx.exe60⤵
- Executes dropped EXE
-
\??\c:\flvpt.exec:\flvpt.exe61⤵
- Executes dropped EXE
-
\??\c:\jxjljl.exec:\jxjljl.exe62⤵
- Executes dropped EXE
-
\??\c:\rfxttln.exec:\rfxttln.exe63⤵
- Executes dropped EXE
-
\??\c:\bjtbx.exec:\bjtbx.exe64⤵
- Executes dropped EXE
-
\??\c:\ttdvbr.exec:\ttdvbr.exe65⤵
- Executes dropped EXE
-
\??\c:\njjvxld.exec:\njjvxld.exe66⤵
-
\??\c:\fbfxl.exec:\fbfxl.exe67⤵
-
\??\c:\lrlpdv.exec:\lrlpdv.exe68⤵
-
\??\c:\prpxx.exec:\prpxx.exe69⤵
-
\??\c:\lndxx.exec:\lndxx.exe70⤵
-
\??\c:\lnhtvrh.exec:\lnhtvrh.exe71⤵
-
\??\c:\pdplr.exec:\pdplr.exe72⤵
-
\??\c:\dtplr.exec:\dtplr.exe73⤵
-
\??\c:\tfdrdxx.exec:\tfdrdxx.exe74⤵
-
\??\c:\jrjjfbj.exec:\jrjjfbj.exe75⤵
-
\??\c:\bbtpt.exec:\bbtpt.exe76⤵
-
\??\c:\nppjlhv.exec:\nppjlhv.exe77⤵
-
\??\c:\hflhhh.exec:\hflhhh.exe78⤵
-
\??\c:\dtrjn.exec:\dtrjn.exe79⤵
-
\??\c:\vvxtbt.exec:\vvxtbt.exe80⤵
-
\??\c:\tpxxhfn.exec:\tpxxhfn.exe81⤵
-
\??\c:\rhjrxtd.exec:\rhjrxtd.exe82⤵
-
\??\c:\vvrpfxj.exec:\vvrpfxj.exe83⤵
-
\??\c:\djxhdtb.exec:\djxhdtb.exe84⤵
-
\??\c:\pbhpd.exec:\pbhpd.exe85⤵
-
\??\c:\bxvxh.exec:\bxvxh.exe86⤵
-
\??\c:\bvltt.exec:\bvltt.exe87⤵
-
\??\c:\hrhrbl.exec:\hrhrbl.exe88⤵
-
\??\c:\vlnrfl.exec:\vlnrfl.exe89⤵
-
\??\c:\fthrr.exec:\fthrr.exe90⤵
-
\??\c:\xdhjp.exec:\xdhjp.exe91⤵
-
\??\c:\nrlffbv.exec:\nrlffbv.exe92⤵
-
\??\c:\txjnp.exec:\txjnp.exe93⤵
-
\??\c:\lxnjl.exec:\lxnjl.exe94⤵
-
\??\c:\vhvhvb.exec:\vhvhvb.exe95⤵
-
\??\c:\bhlbtbr.exec:\bhlbtbr.exe96⤵
-
\??\c:\rbldvht.exec:\rbldvht.exe97⤵
-
\??\c:\nlddv.exec:\nlddv.exe98⤵
-
\??\c:\dthxbnx.exec:\dthxbnx.exe99⤵
-
\??\c:\vlllbft.exec:\vlllbft.exe100⤵
-
\??\c:\tlpxfl.exec:\tlpxfl.exe101⤵
-
\??\c:\vtftj.exec:\vtftj.exe102⤵
-
\??\c:\bxbjpxn.exec:\bxbjpxn.exe103⤵
-
\??\c:\bhvjpf.exec:\bhvjpf.exe104⤵
-
\??\c:\jhlxhf.exec:\jhlxhf.exe105⤵
-
\??\c:\fndrjx.exec:\fndrjx.exe106⤵
-
\??\c:\jdxjv.exec:\jdxjv.exe107⤵
-
\??\c:\pdflln.exec:\pdflln.exe108⤵
-
\??\c:\pvtrr.exec:\pvtrr.exe109⤵
-
\??\c:\dnvtfrr.exec:\dnvtfrr.exe110⤵
-
\??\c:\vljjtp.exec:\vljjtp.exe111⤵
-
\??\c:\nvrnnrh.exec:\nvrnnrh.exe112⤵
-
\??\c:\dnfdvl.exec:\dnfdvl.exe113⤵
-
\??\c:\fjlpv.exec:\fjlpv.exe114⤵
-
\??\c:\rjvtx.exec:\rjvtx.exe115⤵
-
\??\c:\hptnhrf.exec:\hptnhrf.exe116⤵
-
\??\c:\xlvxt.exec:\xlvxt.exe117⤵
-
\??\c:\jjrvnnv.exec:\jjrvnnv.exe118⤵
-
\??\c:\xtllrjp.exec:\xtllrjp.exe119⤵
-
\??\c:\dlptnrj.exec:\dlptnrj.exe120⤵
-
\??\c:\jxfdv.exec:\jxfdv.exe121⤵
-
\??\c:\xrxfd.exec:\xrxfd.exe122⤵
-
\??\c:\dhdnndr.exec:\dhdnndr.exe123⤵
-
\??\c:\hvbhdnj.exec:\hvbhdnj.exe124⤵
-
\??\c:\dnrfh.exec:\dnrfh.exe125⤵
-
\??\c:\hdrbxl.exec:\hdrbxl.exe126⤵
-
\??\c:\vtlnf.exec:\vtlnf.exe127⤵
-
\??\c:\vfxpdh.exec:\vfxpdh.exe128⤵
-
\??\c:\pttxh.exec:\pttxh.exe129⤵
-
\??\c:\lhtxx.exec:\lhtxx.exe130⤵
-
\??\c:\ntxhxt.exec:\ntxhxt.exe131⤵
-
\??\c:\bjvtxbb.exec:\bjvtxbb.exe132⤵
-
\??\c:\rlhlltr.exec:\rlhlltr.exe133⤵
-
\??\c:\xplrdhd.exec:\xplrdhd.exe134⤵
-
\??\c:\tjhjf.exec:\tjhjf.exe135⤵
-
\??\c:\btllj.exec:\btllj.exe136⤵
-
\??\c:\bjnnvv.exec:\bjnnvv.exe137⤵
-
\??\c:\rvtth.exec:\rvtth.exe138⤵
-
\??\c:\hjptlxf.exec:\hjptlxf.exe139⤵
-
\??\c:\jlldph.exec:\jlldph.exe140⤵
-
\??\c:\hlhbrvt.exec:\hlhbrvt.exe141⤵
-
\??\c:\rjhrp.exec:\rjhrp.exe142⤵
-
\??\c:\lxbrhnh.exec:\lxbrhnh.exe143⤵
-
\??\c:\jxthhh.exec:\jxthhh.exe144⤵
-
\??\c:\frdpfjd.exec:\frdpfjd.exe145⤵
-
\??\c:\rvpvp.exec:\rvpvp.exe146⤵
-
\??\c:\nrvlb.exec:\nrvlb.exe147⤵
-
\??\c:\hlnvp.exec:\hlnvp.exe148⤵
-
\??\c:\lfhnpvt.exec:\lfhnpvt.exe149⤵
-
\??\c:\vlxffh.exec:\vlxffh.exe150⤵
-
\??\c:\pltphnb.exec:\pltphnb.exe151⤵
-
\??\c:\fvdbrnp.exec:\fvdbrnp.exe152⤵
-
\??\c:\ttxtp.exec:\ttxtp.exe153⤵
-
\??\c:\tdvtr.exec:\tdvtr.exe154⤵
-
\??\c:\nhfhx.exec:\nhfhx.exe155⤵
-
\??\c:\xhfdlpr.exec:\xhfdlpr.exe156⤵
-
\??\c:\fvrjbv.exec:\fvrjbv.exe157⤵
-
\??\c:\trhnv.exec:\trhnv.exe158⤵
-
\??\c:\fdfvt.exec:\fdfvt.exe159⤵
-
\??\c:\dlhflx.exec:\dlhflx.exe160⤵
-
\??\c:\bfbrpj.exec:\bfbrpj.exe161⤵
-
\??\c:\fvrjbv.exec:\fvrjbv.exe162⤵
-
\??\c:\ddnjx.exec:\ddnjx.exe163⤵
-
\??\c:\pbhtth.exec:\pbhtth.exe164⤵
-
\??\c:\vjfttpp.exec:\vjfttpp.exe165⤵
-
\??\c:\hbjfl.exec:\hbjfl.exe166⤵
-
\??\c:\xtppld.exec:\xtppld.exe167⤵
-
\??\c:\ndpbftx.exec:\ndpbftx.exe168⤵
-
\??\c:\dfjxfd.exec:\dfjxfd.exe169⤵
-
\??\c:\vxlvdd.exec:\vxlvdd.exe170⤵
-
\??\c:\hdvpptx.exec:\hdvpptx.exe171⤵
-
\??\c:\rdrlpfv.exec:\rdrlpfv.exe172⤵
-
\??\c:\vphbdtt.exec:\vphbdtt.exe173⤵
-
\??\c:\ppbhr.exec:\ppbhr.exe174⤵
-
\??\c:\jhxxt.exec:\jhxxt.exe175⤵
-
\??\c:\pbnjhtn.exec:\pbnjhtn.exe176⤵
-
\??\c:\vrbtdt.exec:\vrbtdt.exe177⤵
-
\??\c:\fvdfdfl.exec:\fvdfdfl.exe178⤵
-
\??\c:\bldfb.exec:\bldfb.exe179⤵
-
\??\c:\dvvbjvv.exec:\dvvbjvv.exe180⤵
-
\??\c:\fjxlnth.exec:\fjxlnth.exe181⤵
-
\??\c:\jndxj.exec:\jndxj.exe182⤵
-
\??\c:\dbxnf.exec:\dbxnf.exe183⤵
-
\??\c:\vxvxrdr.exec:\vxvxrdr.exe184⤵
-
\??\c:\fdxbbrv.exec:\fdxbbrv.exe185⤵
-
\??\c:\dlrrjx.exec:\dlrrjx.exe186⤵
-
\??\c:\bbpxd.exec:\bbpxd.exe187⤵
-
\??\c:\hvjdv.exec:\hvjdv.exe188⤵
-
\??\c:\nxthf.exec:\nxthf.exe189⤵
-
\??\c:\rtjxrv.exec:\rtjxrv.exe190⤵
-
\??\c:\jprjvlr.exec:\jprjvlr.exe191⤵
-
\??\c:\dntbr.exec:\dntbr.exe192⤵
-
\??\c:\rhphhf.exec:\rhphhf.exe193⤵
-
\??\c:\vdhdv.exec:\vdhdv.exe194⤵
-
\??\c:\tvjjbb.exec:\tvjjbb.exe195⤵
-
\??\c:\llddbh.exec:\llddbh.exe196⤵
-
\??\c:\lnvrtpp.exec:\lnvrtpp.exe197⤵
-
\??\c:\jxrvbjl.exec:\jxrvbjl.exe198⤵
-
\??\c:\btvjb.exec:\btvjb.exe199⤵
-
\??\c:\thnxd.exec:\thnxd.exe200⤵
-
\??\c:\tdvxvp.exec:\tdvxvp.exe201⤵
-
\??\c:\llhhphn.exec:\llhhphn.exe202⤵
-
\??\c:\rdvjnxf.exec:\rdvjnxf.exe203⤵
-
\??\c:\jhnlbhr.exec:\jhnlbhr.exe204⤵
-
\??\c:\prhxlfd.exec:\prhxlfd.exe205⤵
-
\??\c:\jlxntvh.exec:\jlxntvh.exe206⤵
-
\??\c:\tdlfr.exec:\tdlfr.exe207⤵
-
\??\c:\jbptbj.exec:\jbptbj.exe208⤵
-
\??\c:\tpjvvr.exec:\tpjvvr.exe209⤵
-
\??\c:\tdfbt.exec:\tdfbt.exe210⤵
-
\??\c:\rlnlllv.exec:\rlnlllv.exe211⤵
-
\??\c:\jhfljft.exec:\jhfljft.exe212⤵
-
\??\c:\flhdltb.exec:\flhdltb.exe213⤵
-
\??\c:\bpnphpx.exec:\bpnphpx.exe214⤵
-
\??\c:\blfbr.exec:\blfbr.exe215⤵
-
\??\c:\bdbtv.exec:\bdbtv.exe216⤵
-
\??\c:\jbbphh.exec:\jbbphh.exe217⤵
-
\??\c:\phxlxv.exec:\phxlxv.exe218⤵
-
\??\c:\rpjvnv.exec:\rpjvnv.exe219⤵
-
\??\c:\ltvvx.exec:\ltvvx.exe220⤵
-
\??\c:\nbpnvbn.exec:\nbpnvbn.exe221⤵
-
\??\c:\vrhbjf.exec:\vrhbjf.exe222⤵
-
\??\c:\fhlvl.exec:\fhlvl.exe223⤵
-
\??\c:\xjtbpb.exec:\xjtbpb.exe224⤵
-
\??\c:\prnvj.exec:\prnvj.exe225⤵
-
\??\c:\bdtjvxh.exec:\bdtjvxh.exe226⤵
-
\??\c:\bpdjtbt.exec:\bpdjtbt.exe227⤵
-
\??\c:\fvjjnnt.exec:\fvjjnnt.exe228⤵
-
\??\c:\bfpxtld.exec:\bfpxtld.exe229⤵
-
\??\c:\lvllpht.exec:\lvllpht.exe230⤵
-
\??\c:\bhbxxbr.exec:\bhbxxbr.exe231⤵
-
\??\c:\njprt.exec:\njprt.exe232⤵
-
\??\c:\drhjbn.exec:\drhjbn.exe233⤵
-
\??\c:\tpnjpvj.exec:\tpnjpvj.exe234⤵
-
\??\c:\vrrbtt.exec:\vrrbtt.exe235⤵
-
\??\c:\bvhjtjf.exec:\bvhjtjf.exe236⤵
-
\??\c:\flllpt.exec:\flllpt.exe237⤵
-
\??\c:\vnnnpxp.exec:\vnnnpxp.exe238⤵
-
\??\c:\nrhxppt.exec:\nrhxppt.exe239⤵
-
\??\c:\xlrxd.exec:\xlrxd.exe240⤵
-
\??\c:\xxtjxjl.exec:\xxtjxjl.exe241⤵