Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 04:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a6ade6dc8d60af01e49f8e5aa8032480_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
a6ade6dc8d60af01e49f8e5aa8032480_NeikiAnalytics.exe
-
Size
149KB
-
MD5
a6ade6dc8d60af01e49f8e5aa8032480
-
SHA1
da2e5769e4b8e17afd827d0dd467fcb03036e6bb
-
SHA256
890efe9cf98a0d06c12bbecae7733f8a9ad512a2adf5c83229b0ecdc38df1989
-
SHA512
5f906ab068ea062ded0cac31652e78c605ac34a4bade8e4db2468012fb848c037b9493743834610a2efe2e08ed4b1a2245e353d167c260953f98eff03029fcb8
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo7LAIRUohDmRG08fKkZEU5hkVaqaK6qa50iKVb:n3C9BRo/AIuuOmfDZEU5OVFiQ
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/2744-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2180-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/280-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1456-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2332-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1040-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1996-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1232-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1952-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1872-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1220-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/992-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1280-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vpdpd.exe5rxfxfl.exe9tnnhb.exevpdvd.exefxlrllf.exenhbbbb.exebhbntb.exeddvjv.exe7frrfrf.exe5nhntt.exepjdpv.exerfrxrrx.exerrlrxfl.exeflrrffl.exentntbh.exejdvdp.exe1xrrlxf.exenbtbth.exettnbnn.exepvdjd.exefxxxlxl.exebbntbb.exetnhhnt.exepvppv.exe1pvjp.exelflrxfl.exetnnnbh.exenbnnhb.exe9djjp.exerlxffff.exehthntn.exe9bhbbb.exe9vpvd.exerrfrfrf.exennttbn.exenbnhbb.exe3vdjj.exedjvdv.exerffflff.exe1lrxxxx.exenbthbh.exehnbtbh.exedvvpv.exedvpvv.exexlrffxr.exelxlrffl.exetntbnh.exenbnhbb.exedvddp.exe7dvvv.exexlxxrrf.exe1hnnnn.exehbnbhh.exe3jvdj.exe1pdjp.exe3rllrrx.exexrlflff.exe1hhntn.exenbhbnb.exevpvjp.exelfrrfxf.exelxxxxrr.exe7bnhnh.exenhtbbn.exepid process 2524 vpdpd.exe 2628 5rxfxfl.exe 2576 9tnnhb.exe 2708 vpdvd.exe 2596 fxlrllf.exe 2440 nhbbbb.exe 2840 bhbntb.exe 2180 ddvjv.exe 280 7frrfrf.exe 1456 5nhntt.exe 1140 pjdpv.exe 2332 rfrxrrx.exe 636 rrlrxfl.exe 1040 flrrffl.exe 1996 ntntbh.exe 1232 jdvdp.exe 2736 1xrrlxf.exe 1952 nbtbth.exe 1872 ttnbnn.exe 2848 pvdjd.exe 360 fxxxlxl.exe 1220 bbntbb.exe 992 tnhhnt.exe 1692 pvppv.exe 452 1pvjp.exe 320 lflrxfl.exe 1956 tnnnbh.exe 1720 nbnnhb.exe 2924 9djjp.exe 1148 rlxffff.exe 1280 hthntn.exe 1992 9bhbbb.exe 1536 9vpvd.exe 2540 rrfrfrf.exe 2536 nnttbn.exe 2588 nbnhbb.exe 2732 3vdjj.exe 2720 djvdv.exe 2484 rffflff.exe 2488 1lrxxxx.exe 2480 nbthbh.exe 3060 hnbtbh.exe 2444 dvvpv.exe 1468 dvpvv.exe 1500 xlrffxr.exe 1032 lxlrffl.exe 2176 tntbnh.exe 1576 nbnhbb.exe 240 dvddp.exe 1364 7dvvv.exe 1548 xlxxrrf.exe 1368 1hnnnn.exe 896 hbnbhh.exe 2728 3jvdj.exe 1960 1pdjp.exe 1928 3rllrrx.exe 324 xrlflff.exe 3048 1hhntn.exe 1064 nbhbnb.exe 1352 vpvjp.exe 2316 lfrrfxf.exe 1736 lxxxxrr.exe 2220 7bnhnh.exe 2900 nhtbbn.exe -
Processes:
resource yara_rule behavioral1/memory/2744-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2180-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/280-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1456-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1040-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1996-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1232-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1872-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1220-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/992-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1280-301-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a6ade6dc8d60af01e49f8e5aa8032480_NeikiAnalytics.exevpdpd.exe5rxfxfl.exe9tnnhb.exevpdvd.exefxlrllf.exenhbbbb.exebhbntb.exeddvjv.exe7frrfrf.exe5nhntt.exepjdpv.exerfrxrrx.exerrlrxfl.exeflrrffl.exentntbh.exedescription pid process target process PID 2744 wrote to memory of 2524 2744 a6ade6dc8d60af01e49f8e5aa8032480_NeikiAnalytics.exe vpdpd.exe PID 2744 wrote to memory of 2524 2744 a6ade6dc8d60af01e49f8e5aa8032480_NeikiAnalytics.exe vpdpd.exe PID 2744 wrote to memory of 2524 2744 a6ade6dc8d60af01e49f8e5aa8032480_NeikiAnalytics.exe vpdpd.exe PID 2744 wrote to memory of 2524 2744 a6ade6dc8d60af01e49f8e5aa8032480_NeikiAnalytics.exe vpdpd.exe PID 2524 wrote to memory of 2628 2524 vpdpd.exe 5rxfxfl.exe PID 2524 wrote to memory of 2628 2524 vpdpd.exe 5rxfxfl.exe PID 2524 wrote to memory of 2628 2524 vpdpd.exe 5rxfxfl.exe PID 2524 wrote to memory of 2628 2524 vpdpd.exe 5rxfxfl.exe PID 2628 wrote to memory of 2576 2628 5rxfxfl.exe 9tnnhb.exe PID 2628 wrote to memory of 2576 2628 5rxfxfl.exe 9tnnhb.exe PID 2628 wrote to memory of 2576 2628 5rxfxfl.exe 9tnnhb.exe PID 2628 wrote to memory of 2576 2628 5rxfxfl.exe 9tnnhb.exe PID 2576 wrote to memory of 2708 2576 9tnnhb.exe vpdvd.exe PID 2576 wrote to memory of 2708 2576 9tnnhb.exe vpdvd.exe PID 2576 wrote to memory of 2708 2576 9tnnhb.exe vpdvd.exe PID 2576 wrote to memory of 2708 2576 9tnnhb.exe vpdvd.exe PID 2708 wrote to memory of 2596 2708 vpdvd.exe fxlrllf.exe PID 2708 wrote to memory of 2596 2708 vpdvd.exe fxlrllf.exe PID 2708 wrote to memory of 2596 2708 vpdvd.exe fxlrllf.exe PID 2708 wrote to memory of 2596 2708 vpdvd.exe fxlrllf.exe PID 2596 wrote to memory of 2440 2596 fxlrllf.exe nhbbbb.exe PID 2596 wrote to memory of 2440 2596 fxlrllf.exe nhbbbb.exe PID 2596 wrote to memory of 2440 2596 fxlrllf.exe nhbbbb.exe PID 2596 wrote to memory of 2440 2596 fxlrllf.exe nhbbbb.exe PID 2440 wrote to memory of 2840 2440 nhbbbb.exe bhbntb.exe PID 2440 wrote to memory of 2840 2440 nhbbbb.exe bhbntb.exe PID 2440 wrote to memory of 2840 2440 nhbbbb.exe bhbntb.exe PID 2440 wrote to memory of 2840 2440 nhbbbb.exe bhbntb.exe PID 2840 wrote to memory of 2180 2840 bhbntb.exe ddvjv.exe PID 2840 wrote to memory of 2180 2840 bhbntb.exe ddvjv.exe PID 2840 wrote to memory of 2180 2840 bhbntb.exe ddvjv.exe PID 2840 wrote to memory of 2180 2840 bhbntb.exe ddvjv.exe PID 2180 wrote to memory of 280 2180 ddvjv.exe 7frrfrf.exe PID 2180 wrote to memory of 280 2180 ddvjv.exe 7frrfrf.exe PID 2180 wrote to memory of 280 2180 ddvjv.exe 7frrfrf.exe PID 2180 wrote to memory of 280 2180 ddvjv.exe 7frrfrf.exe PID 280 wrote to memory of 1456 280 7frrfrf.exe 5nhntt.exe PID 280 wrote to memory of 1456 280 7frrfrf.exe 5nhntt.exe PID 280 wrote to memory of 1456 280 7frrfrf.exe 5nhntt.exe PID 280 wrote to memory of 1456 280 7frrfrf.exe 5nhntt.exe PID 1456 wrote to memory of 1140 1456 5nhntt.exe pjdpv.exe PID 1456 wrote to memory of 1140 1456 5nhntt.exe pjdpv.exe PID 1456 wrote to memory of 1140 1456 5nhntt.exe pjdpv.exe PID 1456 wrote to memory of 1140 1456 5nhntt.exe pjdpv.exe PID 1140 wrote to memory of 2332 1140 pjdpv.exe rfrxrrx.exe PID 1140 wrote to memory of 2332 1140 pjdpv.exe rfrxrrx.exe PID 1140 wrote to memory of 2332 1140 pjdpv.exe rfrxrrx.exe PID 1140 wrote to memory of 2332 1140 pjdpv.exe rfrxrrx.exe PID 2332 wrote to memory of 636 2332 rfrxrrx.exe rrlrxfl.exe PID 2332 wrote to memory of 636 2332 rfrxrrx.exe rrlrxfl.exe PID 2332 wrote to memory of 636 2332 rfrxrrx.exe rrlrxfl.exe PID 2332 wrote to memory of 636 2332 rfrxrrx.exe rrlrxfl.exe PID 636 wrote to memory of 1040 636 rrlrxfl.exe flrrffl.exe PID 636 wrote to memory of 1040 636 rrlrxfl.exe flrrffl.exe PID 636 wrote to memory of 1040 636 rrlrxfl.exe flrrffl.exe PID 636 wrote to memory of 1040 636 rrlrxfl.exe flrrffl.exe PID 1040 wrote to memory of 1996 1040 flrrffl.exe ntntbh.exe PID 1040 wrote to memory of 1996 1040 flrrffl.exe ntntbh.exe PID 1040 wrote to memory of 1996 1040 flrrffl.exe ntntbh.exe PID 1040 wrote to memory of 1996 1040 flrrffl.exe ntntbh.exe PID 1996 wrote to memory of 1232 1996 ntntbh.exe jdvdp.exe PID 1996 wrote to memory of 1232 1996 ntntbh.exe jdvdp.exe PID 1996 wrote to memory of 1232 1996 ntntbh.exe jdvdp.exe PID 1996 wrote to memory of 1232 1996 ntntbh.exe jdvdp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6ade6dc8d60af01e49f8e5aa8032480_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a6ade6dc8d60af01e49f8e5aa8032480_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\vpdpd.exec:\vpdpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5rxfxfl.exec:\5rxfxfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9tnnhb.exec:\9tnnhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpdvd.exec:\vpdvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxlrllf.exec:\fxlrllf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhbbbb.exec:\nhbbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhbntb.exec:\bhbntb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddvjv.exec:\ddvjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7frrfrf.exec:\7frrfrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5nhntt.exec:\5nhntt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjdpv.exec:\pjdpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rfrxrrx.exec:\rfrxrrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrlrxfl.exec:\rrlrxfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\flrrffl.exec:\flrrffl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ntntbh.exec:\ntntbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdvdp.exec:\jdvdp.exe17⤵
- Executes dropped EXE
-
\??\c:\1xrrlxf.exec:\1xrrlxf.exe18⤵
- Executes dropped EXE
-
\??\c:\nbtbth.exec:\nbtbth.exe19⤵
- Executes dropped EXE
-
\??\c:\ttnbnn.exec:\ttnbnn.exe20⤵
- Executes dropped EXE
-
\??\c:\pvdjd.exec:\pvdjd.exe21⤵
- Executes dropped EXE
-
\??\c:\fxxxlxl.exec:\fxxxlxl.exe22⤵
- Executes dropped EXE
-
\??\c:\bbntbb.exec:\bbntbb.exe23⤵
- Executes dropped EXE
-
\??\c:\tnhhnt.exec:\tnhhnt.exe24⤵
- Executes dropped EXE
-
\??\c:\pvppv.exec:\pvppv.exe25⤵
- Executes dropped EXE
-
\??\c:\1pvjp.exec:\1pvjp.exe26⤵
- Executes dropped EXE
-
\??\c:\lflrxfl.exec:\lflrxfl.exe27⤵
- Executes dropped EXE
-
\??\c:\tnnnbh.exec:\tnnnbh.exe28⤵
- Executes dropped EXE
-
\??\c:\nbnnhb.exec:\nbnnhb.exe29⤵
- Executes dropped EXE
-
\??\c:\9djjp.exec:\9djjp.exe30⤵
- Executes dropped EXE
-
\??\c:\rlxffff.exec:\rlxffff.exe31⤵
- Executes dropped EXE
-
\??\c:\hthntn.exec:\hthntn.exe32⤵
- Executes dropped EXE
-
\??\c:\9bhbbb.exec:\9bhbbb.exe33⤵
- Executes dropped EXE
-
\??\c:\dvddj.exec:\dvddj.exe34⤵
-
\??\c:\9vpvd.exec:\9vpvd.exe35⤵
- Executes dropped EXE
-
\??\c:\rrfrfrf.exec:\rrfrfrf.exe36⤵
- Executes dropped EXE
-
\??\c:\nnttbn.exec:\nnttbn.exe37⤵
- Executes dropped EXE
-
\??\c:\nbnhbb.exec:\nbnhbb.exe38⤵
- Executes dropped EXE
-
\??\c:\3vdjj.exec:\3vdjj.exe39⤵
- Executes dropped EXE
-
\??\c:\djvdv.exec:\djvdv.exe40⤵
- Executes dropped EXE
-
\??\c:\rffflff.exec:\rffflff.exe41⤵
- Executes dropped EXE
-
\??\c:\1lrxxxx.exec:\1lrxxxx.exe42⤵
- Executes dropped EXE
-
\??\c:\nbthbh.exec:\nbthbh.exe43⤵
- Executes dropped EXE
-
\??\c:\hnbtbh.exec:\hnbtbh.exe44⤵
- Executes dropped EXE
-
\??\c:\dvvpv.exec:\dvvpv.exe45⤵
- Executes dropped EXE
-
\??\c:\dvpvv.exec:\dvpvv.exe46⤵
- Executes dropped EXE
-
\??\c:\xlrffxr.exec:\xlrffxr.exe47⤵
- Executes dropped EXE
-
\??\c:\lxlrffl.exec:\lxlrffl.exe48⤵
- Executes dropped EXE
-
\??\c:\tntbnh.exec:\tntbnh.exe49⤵
- Executes dropped EXE
-
\??\c:\nbnhbb.exec:\nbnhbb.exe50⤵
- Executes dropped EXE
-
\??\c:\dvddp.exec:\dvddp.exe51⤵
- Executes dropped EXE
-
\??\c:\7dvvv.exec:\7dvvv.exe52⤵
- Executes dropped EXE
-
\??\c:\xlxxrrf.exec:\xlxxrrf.exe53⤵
- Executes dropped EXE
-
\??\c:\1hnnnn.exec:\1hnnnn.exe54⤵
- Executes dropped EXE
-
\??\c:\hbnbhh.exec:\hbnbhh.exe55⤵
- Executes dropped EXE
-
\??\c:\3jvdj.exec:\3jvdj.exe56⤵
- Executes dropped EXE
-
\??\c:\1pdjp.exec:\1pdjp.exe57⤵
- Executes dropped EXE
-
\??\c:\3rllrrx.exec:\3rllrrx.exe58⤵
- Executes dropped EXE
-
\??\c:\xrlflff.exec:\xrlflff.exe59⤵
- Executes dropped EXE
-
\??\c:\1hhntn.exec:\1hhntn.exe60⤵
- Executes dropped EXE
-
\??\c:\nbhbnb.exec:\nbhbnb.exe61⤵
- Executes dropped EXE
-
\??\c:\vpvjp.exec:\vpvjp.exe62⤵
- Executes dropped EXE
-
\??\c:\lfrrfxf.exec:\lfrrfxf.exe63⤵
- Executes dropped EXE
-
\??\c:\lxxxxrr.exec:\lxxxxrr.exe64⤵
- Executes dropped EXE
-
\??\c:\7bnhnh.exec:\7bnhnh.exe65⤵
- Executes dropped EXE
-
\??\c:\nhtbbn.exec:\nhtbbn.exe66⤵
- Executes dropped EXE
-
\??\c:\dvjjj.exec:\dvjjj.exe67⤵
-
\??\c:\dpdjd.exec:\dpdjd.exe68⤵
-
\??\c:\rlrllfl.exec:\rlrllfl.exe69⤵
-
\??\c:\bthhht.exec:\bthhht.exe70⤵
-
\??\c:\thhbbb.exec:\thhbbb.exe71⤵
-
\??\c:\dpppv.exec:\dpppv.exe72⤵
-
\??\c:\vpdpp.exec:\vpdpp.exe73⤵
-
\??\c:\5lfffff.exec:\5lfffff.exe74⤵
-
\??\c:\ttthbn.exec:\ttthbn.exe75⤵
-
\??\c:\9tbbbt.exec:\9tbbbt.exe76⤵
-
\??\c:\dpddp.exec:\dpddp.exe77⤵
-
\??\c:\vdjpp.exec:\vdjpp.exe78⤵
-
\??\c:\3xfxxrx.exec:\3xfxxrx.exe79⤵
-
\??\c:\bnhbhb.exec:\bnhbhb.exe80⤵
-
\??\c:\7thntt.exec:\7thntt.exe81⤵
-
\??\c:\dpdvd.exec:\dpdvd.exe82⤵
-
\??\c:\pdjdv.exec:\pdjdv.exe83⤵
-
\??\c:\rxxxlll.exec:\rxxxlll.exe84⤵
-
\??\c:\9xxfllr.exec:\9xxfllr.exe85⤵
-
\??\c:\hnhbbt.exec:\hnhbbt.exe86⤵
-
\??\c:\3bnnhh.exec:\3bnnhh.exe87⤵
-
\??\c:\dpvvd.exec:\dpvvd.exe88⤵
-
\??\c:\rflrrxx.exec:\rflrrxx.exe89⤵
-
\??\c:\1xffxxx.exec:\1xffxxx.exe90⤵
-
\??\c:\nttbbb.exec:\nttbbb.exe91⤵
-
\??\c:\jvvdv.exec:\jvvdv.exe92⤵
-
\??\c:\1xlxlfl.exec:\1xlxlfl.exe93⤵
-
\??\c:\7fxxlfr.exec:\7fxxlfr.exe94⤵
-
\??\c:\bhnntt.exec:\bhnntt.exe95⤵
-
\??\c:\5pddv.exec:\5pddv.exe96⤵
-
\??\c:\pjdjd.exec:\pjdjd.exe97⤵
-
\??\c:\frffffr.exec:\frffffr.exe98⤵
-
\??\c:\lffflll.exec:\lffflll.exe99⤵
-
\??\c:\bhtbbn.exec:\bhtbbn.exe100⤵
-
\??\c:\9tnhnh.exec:\9tnhnh.exe101⤵
-
\??\c:\jdvvj.exec:\jdvvj.exe102⤵
-
\??\c:\5flflfx.exec:\5flflfx.exe103⤵
-
\??\c:\9llfxrr.exec:\9llfxrr.exe104⤵
-
\??\c:\thhbhb.exec:\thhbhb.exe105⤵
-
\??\c:\bntnnn.exec:\bntnnn.exe106⤵
-
\??\c:\dppjp.exec:\dppjp.exe107⤵
-
\??\c:\1vdvj.exec:\1vdvj.exe108⤵
-
\??\c:\frrlrll.exec:\frrlrll.exe109⤵
-
\??\c:\frxflrr.exec:\frxflrr.exe110⤵
-
\??\c:\tnthhn.exec:\tnthhn.exe111⤵
-
\??\c:\bnnhhh.exec:\bnnhhh.exe112⤵
-
\??\c:\jdppv.exec:\jdppv.exe113⤵
-
\??\c:\jvjjd.exec:\jvjjd.exe114⤵
-
\??\c:\9vvvd.exec:\9vvvd.exe115⤵
-
\??\c:\1ttntt.exec:\1ttntt.exe116⤵
-
\??\c:\3htnnn.exec:\3htnnn.exe117⤵
-
\??\c:\jvjjp.exec:\jvjjp.exe118⤵
-
\??\c:\vvdpj.exec:\vvdpj.exe119⤵
-
\??\c:\lxxflrx.exec:\lxxflrx.exe120⤵
-
\??\c:\1flrfxf.exec:\1flrfxf.exe121⤵
-
\??\c:\htbbht.exec:\htbbht.exe122⤵
-
\??\c:\1tbnbh.exec:\1tbnbh.exe123⤵
-
\??\c:\pjvpv.exec:\pjvpv.exe124⤵
-
\??\c:\pdjdv.exec:\pdjdv.exe125⤵
-
\??\c:\1fllllx.exec:\1fllllx.exe126⤵
-
\??\c:\rfflffx.exec:\rfflffx.exe127⤵
-
\??\c:\3nhhtn.exec:\3nhhtn.exe128⤵
-
\??\c:\bnbbbb.exec:\bnbbbb.exe129⤵
-
\??\c:\1tbbhb.exec:\1tbbhb.exe130⤵
-
\??\c:\jvddj.exec:\jvddj.exe131⤵
-
\??\c:\jvddj.exec:\jvddj.exe132⤵
-
\??\c:\rlxxfxf.exec:\rlxxfxf.exe133⤵
-
\??\c:\3frrrll.exec:\3frrrll.exe134⤵
-
\??\c:\nbntbh.exec:\nbntbh.exe135⤵
-
\??\c:\1bnthb.exec:\1bnthb.exe136⤵
-
\??\c:\3vdpp.exec:\3vdpp.exe137⤵
-
\??\c:\vjvvv.exec:\vjvvv.exe138⤵
-
\??\c:\5xfrrxf.exec:\5xfrrxf.exe139⤵
-
\??\c:\rlflrrl.exec:\rlflrrl.exe140⤵
-
\??\c:\1bbbbb.exec:\1bbbbb.exe141⤵
-
\??\c:\pjjdp.exec:\pjjdp.exe142⤵
-
\??\c:\dpvdv.exec:\dpvdv.exe143⤵
-
\??\c:\5lrrxxf.exec:\5lrrxxf.exe144⤵
-
\??\c:\xllxfff.exec:\xllxfff.exe145⤵
-
\??\c:\hbbbnh.exec:\hbbbnh.exe146⤵
-
\??\c:\bnthbb.exec:\bnthbb.exe147⤵
-
\??\c:\nbhbbt.exec:\nbhbbt.exe148⤵
-
\??\c:\pdvvv.exec:\pdvvv.exe149⤵
-
\??\c:\jvdvp.exec:\jvdvp.exe150⤵
-
\??\c:\xlxflll.exec:\xlxflll.exe151⤵
-
\??\c:\fxxfxrf.exec:\fxxfxrf.exe152⤵
-
\??\c:\thnhhh.exec:\thnhhh.exe153⤵
-
\??\c:\hntnbh.exec:\hntnbh.exe154⤵
-
\??\c:\dvvdj.exec:\dvvdj.exe155⤵
-
\??\c:\1pvdd.exec:\1pvdd.exe156⤵
-
\??\c:\xlrllrx.exec:\xlrllrx.exe157⤵
-
\??\c:\rfrllll.exec:\rfrllll.exe158⤵
-
\??\c:\nbnnnn.exec:\nbnnnn.exe159⤵
-
\??\c:\9bhhhb.exec:\9bhhhb.exe160⤵
-
\??\c:\jvdvp.exec:\jvdvp.exe161⤵
-
\??\c:\vpppp.exec:\vpppp.exe162⤵
-
\??\c:\lflflrr.exec:\lflflrr.exe163⤵
-
\??\c:\llxrfrf.exec:\llxrfrf.exe164⤵
-
\??\c:\7nbntn.exec:\7nbntn.exe165⤵
-
\??\c:\3tbnnt.exec:\3tbnnt.exe166⤵
-
\??\c:\vjvpv.exec:\vjvpv.exe167⤵
-
\??\c:\5jjjj.exec:\5jjjj.exe168⤵
-
\??\c:\flrffff.exec:\flrffff.exe169⤵
-
\??\c:\1xflrrr.exec:\1xflrrr.exe170⤵
-
\??\c:\9bnnbt.exec:\9bnnbt.exe171⤵
-
\??\c:\bttbnt.exec:\bttbnt.exe172⤵
-
\??\c:\vpddj.exec:\vpddj.exe173⤵
-
\??\c:\dpvjp.exec:\dpvjp.exe174⤵
-
\??\c:\rlxxfxx.exec:\rlxxfxx.exe175⤵
-
\??\c:\5xlxfxf.exec:\5xlxfxf.exe176⤵
-
\??\c:\hbnhhn.exec:\hbnhhn.exe177⤵
-
\??\c:\nbttbb.exec:\nbttbb.exe178⤵
-
\??\c:\7vpjj.exec:\7vpjj.exe179⤵
-
\??\c:\lfrrrrl.exec:\lfrrrrl.exe180⤵
-
\??\c:\frxfllr.exec:\frxfllr.exe181⤵
-
\??\c:\flllxxx.exec:\flllxxx.exe182⤵
-
\??\c:\nbttbb.exec:\nbttbb.exe183⤵
-
\??\c:\bhnthb.exec:\bhnthb.exe184⤵
-
\??\c:\djpdd.exec:\djpdd.exe185⤵
-
\??\c:\fxlflrx.exec:\fxlflrx.exe186⤵
-
\??\c:\rlxxfll.exec:\rlxxfll.exe187⤵
-
\??\c:\xlfrxrx.exec:\xlfrxrx.exe188⤵
-
\??\c:\nhnnnb.exec:\nhnnnb.exe189⤵
-
\??\c:\jdjjp.exec:\jdjjp.exe190⤵
-
\??\c:\vdpjj.exec:\vdpjj.exe191⤵
-
\??\c:\3hnhbh.exec:\3hnhbh.exe192⤵
-
\??\c:\7htnnn.exec:\7htnnn.exe193⤵
-
\??\c:\ppvdv.exec:\ppvdv.exe194⤵
-
\??\c:\9pvpv.exec:\9pvpv.exe195⤵
-
\??\c:\lfrrfxf.exec:\lfrrfxf.exe196⤵
-
\??\c:\fxfrrfl.exec:\fxfrrfl.exe197⤵
-
\??\c:\tnbnhb.exec:\tnbnhb.exe198⤵
-
\??\c:\hbnhtt.exec:\hbnhtt.exe199⤵
-
\??\c:\pjvdp.exec:\pjvdp.exe200⤵
-
\??\c:\pvjjv.exec:\pvjjv.exe201⤵
-
\??\c:\frxxffl.exec:\frxxffl.exe202⤵
-
\??\c:\fxllrlr.exec:\fxllrlr.exe203⤵
-
\??\c:\nnnnhh.exec:\nnnnhh.exe204⤵
-
\??\c:\thbbnh.exec:\thbbnh.exe205⤵
-
\??\c:\jpvvd.exec:\jpvvd.exe206⤵
-
\??\c:\jdjpv.exec:\jdjpv.exe207⤵
-
\??\c:\lxxrxrr.exec:\lxxrxrr.exe208⤵
-
\??\c:\1rflrlr.exec:\1rflrlr.exe209⤵
-
\??\c:\thbbhb.exec:\thbbhb.exe210⤵
-
\??\c:\hbhhbb.exec:\hbhhbb.exe211⤵
-
\??\c:\jvdvp.exec:\jvdvp.exe212⤵
-
\??\c:\9jvvv.exec:\9jvvv.exe213⤵
-
\??\c:\rlrxlff.exec:\rlrxlff.exe214⤵
-
\??\c:\xllrxxx.exec:\xllrxxx.exe215⤵
-
\??\c:\7tntbt.exec:\7tntbt.exe216⤵
-
\??\c:\httttt.exec:\httttt.exe217⤵
-
\??\c:\7djdd.exec:\7djdd.exe218⤵
-
\??\c:\5vdjj.exec:\5vdjj.exe219⤵
-
\??\c:\xlrffxf.exec:\xlrffxf.exe220⤵
-
\??\c:\lxlflfl.exec:\lxlflfl.exe221⤵
-
\??\c:\9nnthh.exec:\9nnthh.exe222⤵
-
\??\c:\hnttnh.exec:\hnttnh.exe223⤵
-
\??\c:\pdpvp.exec:\pdpvp.exe224⤵
-
\??\c:\vdjvp.exec:\vdjvp.exe225⤵
-
\??\c:\7xlrrxf.exec:\7xlrrxf.exe226⤵
-
\??\c:\lxfflfr.exec:\lxfflfr.exe227⤵
-
\??\c:\nhtthh.exec:\nhtthh.exe228⤵
-
\??\c:\7nbbhh.exec:\7nbbhh.exe229⤵
-
\??\c:\vpjjj.exec:\vpjjj.exe230⤵
-
\??\c:\3djdv.exec:\3djdv.exe231⤵
-
\??\c:\lfrlllr.exec:\lfrlllr.exe232⤵
-
\??\c:\7rlfllr.exec:\7rlfllr.exe233⤵
-
\??\c:\5tbbhn.exec:\5tbbhn.exe234⤵
-
\??\c:\9nnttb.exec:\9nnttb.exe235⤵
-
\??\c:\vjvpv.exec:\vjvpv.exe236⤵
-
\??\c:\3vjjj.exec:\3vjjj.exe237⤵
-
\??\c:\fllflrx.exec:\fllflrx.exe238⤵
-
\??\c:\xlrrxxx.exec:\xlrrxxx.exe239⤵
-
\??\c:\hbnntt.exec:\hbnntt.exe240⤵
-
\??\c:\httbbb.exec:\httbbb.exe241⤵