Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 05:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
af2a27c3d5efcaf8942cbb19b0fb4f90_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
af2a27c3d5efcaf8942cbb19b0fb4f90_NeikiAnalytics.exe
-
Size
95KB
-
MD5
af2a27c3d5efcaf8942cbb19b0fb4f90
-
SHA1
5cc2bbbeb2e266560faf74ae092ef1e3d7b94d3a
-
SHA256
9947a477fa2ccf4083670bf169b974debcdaf2b15af5a97f893517a049cfd167
-
SHA512
fc32aa175892388881d2d29395df96ff6ac3fdabedc88b8dacae02900db22798cd4cae8975ea4d519582d689b736510b9ae071165ccd5ae4ee6cc6e660fef8b5
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxS1rj/2C8:ymb3NkkiQ3mdBjFo73PYP1lri3K8GwyX
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/2960-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2172-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2508-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/608-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1936-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1956-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1508-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1040-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1312-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1636-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1048-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
btbhbb.exevjvvv.exerxxlfrf.exenhtbhh.exevpdvj.exelxfxfff.exerfrxfff.exenhbbnn.exejdvdd.exefrxffxf.exe5flfffl.exenhntnh.exepvjjd.exe5djdd.exe7xxxxrx.exehthhnt.exebnhnnt.exedddpj.exe3rxxrrr.exetnbbtt.exettnnbn.exe5pvpj.exejvvdd.exe9lxrffl.exehbbhtn.exe1nhhtt.exe1pjjp.exe9lffllr.exexrlfflf.exebhbbbn.exettntht.exevpjvp.exexrllrrx.exelfrfllr.exe7hbnbh.exebnttnn.exedpddd.exe7vddd.exefxxfxrl.exerffxxxf.exetnbhnt.exepdjdd.exedvvvd.exefrxxxrr.exelfllxrx.exetnttbb.exennbntb.exe7pjjp.exevvjjv.exe1frfxfl.exefxrffff.exehhhthh.exe5bhtbh.exe7vdvv.exejvvpv.exelxxxflf.exe1lxffxl.exenbttbt.exe9bntnb.exejvddj.exedpjpj.exefrxxxrf.exexlxxfff.exehtbbbh.exepid process 3028 btbhbb.exe 2172 vjvvv.exe 2996 rxxlfrf.exe 2636 nhtbhh.exe 2812 vpdvj.exe 2620 lxfxfff.exe 2680 rfrxfff.exe 2452 nhbbnn.exe 2896 jdvdd.exe 1800 frxffxf.exe 2508 5flfffl.exe 2716 nhntnh.exe 608 pvjjd.exe 1936 5djdd.exe 1956 7xxxxrx.exe 1508 hthhnt.exe 1040 bnhnnt.exe 1312 dddpj.exe 2912 3rxxrrr.exe 1900 tnbbtt.exe 2752 ttnnbn.exe 664 5pvpj.exe 1636 jvvdd.exe 628 9lxrffl.exe 1048 hbbhtn.exe 1292 1nhhtt.exe 748 1pjjp.exe 2092 9lffllr.exe 2176 xrlfflf.exe 984 bhbbbn.exe 1912 ttntht.exe 3056 vpjvp.exe 2132 xrllrrx.exe 2884 lfrfllr.exe 2324 7hbnbh.exe 2528 bnttnn.exe 2704 dpddd.exe 2636 7vddd.exe 2544 fxxfxrl.exe 2444 rffxxxf.exe 2468 tnbhnt.exe 2760 pdjdd.exe 2976 dvvvd.exe 2112 frxxxrr.exe 2892 lfllxrx.exe 2488 tnttbb.exe 1428 nnbntb.exe 2604 7pjjp.exe 1816 vvjjv.exe 1904 1frfxfl.exe 1848 fxrffff.exe 2348 hhhthh.exe 1956 5bhtbh.exe 2336 7vdvv.exe 1256 jvvpv.exe 2904 lxxxflf.exe 2020 1lxffxl.exe 2284 nbttbt.exe 2056 9bntnb.exe 2752 jvddj.exe 268 dpjpj.exe 832 frxxxrf.exe 556 xlxxfff.exe 780 htbbbh.exe -
Processes:
resource yara_rule behavioral1/memory/2960-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2172-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/608-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1936-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1956-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1508-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1040-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1312-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1636-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1048-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-283-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
af2a27c3d5efcaf8942cbb19b0fb4f90_NeikiAnalytics.exebtbhbb.exevjvvv.exerxxlfrf.exenhtbhh.exevpdvj.exelxfxfff.exerfrxfff.exenhbbnn.exejdvdd.exefrxffxf.exe5flfffl.exenhntnh.exepvjjd.exe5djdd.exe7xxxxrx.exedescription pid process target process PID 2960 wrote to memory of 3028 2960 af2a27c3d5efcaf8942cbb19b0fb4f90_NeikiAnalytics.exe btbhbb.exe PID 2960 wrote to memory of 3028 2960 af2a27c3d5efcaf8942cbb19b0fb4f90_NeikiAnalytics.exe btbhbb.exe PID 2960 wrote to memory of 3028 2960 af2a27c3d5efcaf8942cbb19b0fb4f90_NeikiAnalytics.exe btbhbb.exe PID 2960 wrote to memory of 3028 2960 af2a27c3d5efcaf8942cbb19b0fb4f90_NeikiAnalytics.exe btbhbb.exe PID 3028 wrote to memory of 2172 3028 btbhbb.exe vjvvv.exe PID 3028 wrote to memory of 2172 3028 btbhbb.exe vjvvv.exe PID 3028 wrote to memory of 2172 3028 btbhbb.exe vjvvv.exe PID 3028 wrote to memory of 2172 3028 btbhbb.exe vjvvv.exe PID 2172 wrote to memory of 2996 2172 vjvvv.exe rxxlfrf.exe PID 2172 wrote to memory of 2996 2172 vjvvv.exe rxxlfrf.exe PID 2172 wrote to memory of 2996 2172 vjvvv.exe rxxlfrf.exe PID 2172 wrote to memory of 2996 2172 vjvvv.exe rxxlfrf.exe PID 2996 wrote to memory of 2636 2996 rxxlfrf.exe nhtbhh.exe PID 2996 wrote to memory of 2636 2996 rxxlfrf.exe nhtbhh.exe PID 2996 wrote to memory of 2636 2996 rxxlfrf.exe nhtbhh.exe PID 2996 wrote to memory of 2636 2996 rxxlfrf.exe nhtbhh.exe PID 2636 wrote to memory of 2812 2636 nhtbhh.exe vpdvj.exe PID 2636 wrote to memory of 2812 2636 nhtbhh.exe vpdvj.exe PID 2636 wrote to memory of 2812 2636 nhtbhh.exe vpdvj.exe PID 2636 wrote to memory of 2812 2636 nhtbhh.exe vpdvj.exe PID 2812 wrote to memory of 2620 2812 vpdvj.exe lxfxfff.exe PID 2812 wrote to memory of 2620 2812 vpdvj.exe lxfxfff.exe PID 2812 wrote to memory of 2620 2812 vpdvj.exe lxfxfff.exe PID 2812 wrote to memory of 2620 2812 vpdvj.exe lxfxfff.exe PID 2620 wrote to memory of 2680 2620 lxfxfff.exe rfrxfff.exe PID 2620 wrote to memory of 2680 2620 lxfxfff.exe rfrxfff.exe PID 2620 wrote to memory of 2680 2620 lxfxfff.exe rfrxfff.exe PID 2620 wrote to memory of 2680 2620 lxfxfff.exe rfrxfff.exe PID 2680 wrote to memory of 2452 2680 rfrxfff.exe nhbbnn.exe PID 2680 wrote to memory of 2452 2680 rfrxfff.exe nhbbnn.exe PID 2680 wrote to memory of 2452 2680 rfrxfff.exe nhbbnn.exe PID 2680 wrote to memory of 2452 2680 rfrxfff.exe nhbbnn.exe PID 2452 wrote to memory of 2896 2452 nhbbnn.exe jdvdd.exe PID 2452 wrote to memory of 2896 2452 nhbbnn.exe jdvdd.exe PID 2452 wrote to memory of 2896 2452 nhbbnn.exe jdvdd.exe PID 2452 wrote to memory of 2896 2452 nhbbnn.exe jdvdd.exe PID 2896 wrote to memory of 1800 2896 jdvdd.exe frxffxf.exe PID 2896 wrote to memory of 1800 2896 jdvdd.exe frxffxf.exe PID 2896 wrote to memory of 1800 2896 jdvdd.exe frxffxf.exe PID 2896 wrote to memory of 1800 2896 jdvdd.exe frxffxf.exe PID 1800 wrote to memory of 2508 1800 frxffxf.exe 5flfffl.exe PID 1800 wrote to memory of 2508 1800 frxffxf.exe 5flfffl.exe PID 1800 wrote to memory of 2508 1800 frxffxf.exe 5flfffl.exe PID 1800 wrote to memory of 2508 1800 frxffxf.exe 5flfffl.exe PID 2508 wrote to memory of 2716 2508 5flfffl.exe nhntnh.exe PID 2508 wrote to memory of 2716 2508 5flfffl.exe nhntnh.exe PID 2508 wrote to memory of 2716 2508 5flfffl.exe nhntnh.exe PID 2508 wrote to memory of 2716 2508 5flfffl.exe nhntnh.exe PID 2716 wrote to memory of 608 2716 nhntnh.exe pvjjd.exe PID 2716 wrote to memory of 608 2716 nhntnh.exe pvjjd.exe PID 2716 wrote to memory of 608 2716 nhntnh.exe pvjjd.exe PID 2716 wrote to memory of 608 2716 nhntnh.exe pvjjd.exe PID 608 wrote to memory of 1936 608 pvjjd.exe 5djdd.exe PID 608 wrote to memory of 1936 608 pvjjd.exe 5djdd.exe PID 608 wrote to memory of 1936 608 pvjjd.exe 5djdd.exe PID 608 wrote to memory of 1936 608 pvjjd.exe 5djdd.exe PID 1936 wrote to memory of 1956 1936 5djdd.exe 7xxxxrx.exe PID 1936 wrote to memory of 1956 1936 5djdd.exe 7xxxxrx.exe PID 1936 wrote to memory of 1956 1936 5djdd.exe 7xxxxrx.exe PID 1936 wrote to memory of 1956 1936 5djdd.exe 7xxxxrx.exe PID 1956 wrote to memory of 1508 1956 7xxxxrx.exe hthhnt.exe PID 1956 wrote to memory of 1508 1956 7xxxxrx.exe hthhnt.exe PID 1956 wrote to memory of 1508 1956 7xxxxrx.exe hthhnt.exe PID 1956 wrote to memory of 1508 1956 7xxxxrx.exe hthhnt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\af2a27c3d5efcaf8942cbb19b0fb4f90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\af2a27c3d5efcaf8942cbb19b0fb4f90_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\btbhbb.exec:\btbhbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjvvv.exec:\vjvvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rxxlfrf.exec:\rxxlfrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhtbhh.exec:\nhtbhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpdvj.exec:\vpdvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxfxfff.exec:\lxfxfff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rfrxfff.exec:\rfrxfff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhbbnn.exec:\nhbbnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdvdd.exec:\jdvdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frxffxf.exec:\frxffxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5flfffl.exec:\5flfffl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhntnh.exec:\nhntnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvjjd.exec:\pvjjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5djdd.exec:\5djdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7xxxxrx.exec:\7xxxxrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hthhnt.exec:\hthhnt.exe17⤵
- Executes dropped EXE
-
\??\c:\bnhnnt.exec:\bnhnnt.exe18⤵
- Executes dropped EXE
-
\??\c:\dddpj.exec:\dddpj.exe19⤵
- Executes dropped EXE
-
\??\c:\3rxxrrr.exec:\3rxxrrr.exe20⤵
- Executes dropped EXE
-
\??\c:\tnbbtt.exec:\tnbbtt.exe21⤵
- Executes dropped EXE
-
\??\c:\ttnnbn.exec:\ttnnbn.exe22⤵
- Executes dropped EXE
-
\??\c:\5pvpj.exec:\5pvpj.exe23⤵
- Executes dropped EXE
-
\??\c:\jvvdd.exec:\jvvdd.exe24⤵
- Executes dropped EXE
-
\??\c:\9lxrffl.exec:\9lxrffl.exe25⤵
- Executes dropped EXE
-
\??\c:\hbbhtn.exec:\hbbhtn.exe26⤵
- Executes dropped EXE
-
\??\c:\1nhhtt.exec:\1nhhtt.exe27⤵
- Executes dropped EXE
-
\??\c:\1pjjp.exec:\1pjjp.exe28⤵
- Executes dropped EXE
-
\??\c:\9lffllr.exec:\9lffllr.exe29⤵
- Executes dropped EXE
-
\??\c:\xrlfflf.exec:\xrlfflf.exe30⤵
- Executes dropped EXE
-
\??\c:\bhbbbn.exec:\bhbbbn.exe31⤵
- Executes dropped EXE
-
\??\c:\ttntht.exec:\ttntht.exe32⤵
- Executes dropped EXE
-
\??\c:\vpjvp.exec:\vpjvp.exe33⤵
- Executes dropped EXE
-
\??\c:\xrllrrx.exec:\xrllrrx.exe34⤵
- Executes dropped EXE
-
\??\c:\lfrfllr.exec:\lfrfllr.exe35⤵
- Executes dropped EXE
-
\??\c:\7hbnbh.exec:\7hbnbh.exe36⤵
- Executes dropped EXE
-
\??\c:\bnttnn.exec:\bnttnn.exe37⤵
- Executes dropped EXE
-
\??\c:\dpddd.exec:\dpddd.exe38⤵
- Executes dropped EXE
-
\??\c:\7vddd.exec:\7vddd.exe39⤵
- Executes dropped EXE
-
\??\c:\fxxfxrl.exec:\fxxfxrl.exe40⤵
- Executes dropped EXE
-
\??\c:\rffxxxf.exec:\rffxxxf.exe41⤵
- Executes dropped EXE
-
\??\c:\tnbhnt.exec:\tnbhnt.exe42⤵
- Executes dropped EXE
-
\??\c:\pdjdd.exec:\pdjdd.exe43⤵
- Executes dropped EXE
-
\??\c:\dvvvd.exec:\dvvvd.exe44⤵
- Executes dropped EXE
-
\??\c:\frxxxrr.exec:\frxxxrr.exe45⤵
- Executes dropped EXE
-
\??\c:\lfllxrx.exec:\lfllxrx.exe46⤵
- Executes dropped EXE
-
\??\c:\tnttbb.exec:\tnttbb.exe47⤵
- Executes dropped EXE
-
\??\c:\nnbntb.exec:\nnbntb.exe48⤵
- Executes dropped EXE
-
\??\c:\7pjjp.exec:\7pjjp.exe49⤵
- Executes dropped EXE
-
\??\c:\vvjjv.exec:\vvjjv.exe50⤵
- Executes dropped EXE
-
\??\c:\1frfxfl.exec:\1frfxfl.exe51⤵
- Executes dropped EXE
-
\??\c:\fxrffff.exec:\fxrffff.exe52⤵
- Executes dropped EXE
-
\??\c:\hhhthh.exec:\hhhthh.exe53⤵
- Executes dropped EXE
-
\??\c:\5bhtbh.exec:\5bhtbh.exe54⤵
- Executes dropped EXE
-
\??\c:\7vdvv.exec:\7vdvv.exe55⤵
- Executes dropped EXE
-
\??\c:\jvvpv.exec:\jvvpv.exe56⤵
- Executes dropped EXE
-
\??\c:\lxxxflf.exec:\lxxxflf.exe57⤵
- Executes dropped EXE
-
\??\c:\1lxffxl.exec:\1lxffxl.exe58⤵
- Executes dropped EXE
-
\??\c:\nbttbt.exec:\nbttbt.exe59⤵
- Executes dropped EXE
-
\??\c:\9bntnb.exec:\9bntnb.exe60⤵
- Executes dropped EXE
-
\??\c:\jvddj.exec:\jvddj.exe61⤵
- Executes dropped EXE
-
\??\c:\dpjpj.exec:\dpjpj.exe62⤵
- Executes dropped EXE
-
\??\c:\frxxxrf.exec:\frxxxrf.exe63⤵
- Executes dropped EXE
-
\??\c:\xlxxfff.exec:\xlxxfff.exe64⤵
- Executes dropped EXE
-
\??\c:\htbbbh.exec:\htbbbh.exe65⤵
- Executes dropped EXE
-
\??\c:\nthbnh.exec:\nthbnh.exe66⤵
-
\??\c:\5vvjp.exec:\5vvjp.exe67⤵
-
\??\c:\rlrrrlf.exec:\rlrrrlf.exe68⤵
-
\??\c:\1lxfffr.exec:\1lxfffr.exe69⤵
-
\??\c:\nhnbhb.exec:\nhnbhb.exe70⤵
-
\??\c:\7bbhhh.exec:\7bbhhh.exe71⤵
-
\??\c:\dpvpd.exec:\dpvpd.exe72⤵
-
\??\c:\pdjdd.exec:\pdjdd.exe73⤵
-
\??\c:\3lxrllr.exec:\3lxrllr.exe74⤵
-
\??\c:\lffrflx.exec:\lffrflx.exe75⤵
-
\??\c:\bhtbbn.exec:\bhtbbn.exe76⤵
-
\??\c:\7nbbbt.exec:\7nbbbt.exe77⤵
-
\??\c:\dpdjj.exec:\dpdjj.exe78⤵
-
\??\c:\pvjjv.exec:\pvjjv.exe79⤵
-
\??\c:\7lxxffl.exec:\7lxxffl.exe80⤵
-
\??\c:\rfrxxxf.exec:\rfrxxxf.exe81⤵
-
\??\c:\nbhnnt.exec:\nbhnnt.exe82⤵
-
\??\c:\nhtbbh.exec:\nhtbbh.exe83⤵
-
\??\c:\jvddd.exec:\jvddd.exe84⤵
-
\??\c:\pjvvj.exec:\pjvvj.exe85⤵
-
\??\c:\rllllrf.exec:\rllllrf.exe86⤵
-
\??\c:\nhtnhn.exec:\nhtnhn.exe87⤵
-
\??\c:\hthtbb.exec:\hthtbb.exe88⤵
-
\??\c:\jvppd.exec:\jvppd.exe89⤵
-
\??\c:\vvpvj.exec:\vvpvj.exe90⤵
-
\??\c:\frrrffl.exec:\frrrffl.exe91⤵
-
\??\c:\fxrxffr.exec:\fxrxffr.exe92⤵
-
\??\c:\httnnb.exec:\httnnb.exe93⤵
-
\??\c:\thhhnn.exec:\thhhnn.exe94⤵
-
\??\c:\ppvdv.exec:\ppvdv.exe95⤵
-
\??\c:\pdpdp.exec:\pdpdp.exe96⤵
-
\??\c:\frflllr.exec:\frflllr.exe97⤵
-
\??\c:\xlfxfrr.exec:\xlfxfrr.exe98⤵
-
\??\c:\rlxflll.exec:\rlxflll.exe99⤵
-
\??\c:\thhbnn.exec:\thhbnn.exe100⤵
-
\??\c:\5nnhnt.exec:\5nnhnt.exe101⤵
-
\??\c:\1vjpp.exec:\1vjpp.exe102⤵
-
\??\c:\pvdjv.exec:\pvdjv.exe103⤵
-
\??\c:\1frlrrr.exec:\1frlrrr.exe104⤵
-
\??\c:\rlrxlrf.exec:\rlrxlrf.exe105⤵
-
\??\c:\rrrxlrl.exec:\rrrxlrl.exe106⤵
-
\??\c:\1ntttn.exec:\1ntttn.exe107⤵
-
\??\c:\bhnbhb.exec:\bhnbhb.exe108⤵
-
\??\c:\dpvdj.exec:\dpvdj.exe109⤵
-
\??\c:\dpppv.exec:\dpppv.exe110⤵
-
\??\c:\xrfrxxf.exec:\xrfrxxf.exe111⤵
-
\??\c:\fxlrffl.exec:\fxlrffl.exe112⤵
-
\??\c:\bthntb.exec:\bthntb.exe113⤵
-
\??\c:\nbhhhb.exec:\nbhhhb.exe114⤵
-
\??\c:\3jdvd.exec:\3jdvd.exe115⤵
-
\??\c:\pjjdj.exec:\pjjdj.exe116⤵
-
\??\c:\fxlxfll.exec:\fxlxfll.exe117⤵
-
\??\c:\lfxfrrx.exec:\lfxfrrx.exe118⤵
-
\??\c:\7llxffl.exec:\7llxffl.exe119⤵
-
\??\c:\3nhhbh.exec:\3nhhbh.exe120⤵
-
\??\c:\vjpjp.exec:\vjpjp.exe121⤵
-
\??\c:\vpppp.exec:\vpppp.exe122⤵
-
\??\c:\lrlxxfx.exec:\lrlxxfx.exe123⤵
-
\??\c:\xlrlxfl.exec:\xlrlxfl.exe124⤵
-
\??\c:\bnntbh.exec:\bnntbh.exe125⤵
-
\??\c:\1bnhnn.exec:\1bnhnn.exe126⤵
-
\??\c:\thhnbb.exec:\thhnbb.exe127⤵
-
\??\c:\vdjpj.exec:\vdjpj.exe128⤵
-
\??\c:\djvdp.exec:\djvdp.exe129⤵
-
\??\c:\xlfflrr.exec:\xlfflrr.exe130⤵
-
\??\c:\3xlflfr.exec:\3xlflfr.exe131⤵
-
\??\c:\bthhtt.exec:\bthhtt.exe132⤵
-
\??\c:\thnnnn.exec:\thnnnn.exe133⤵
-
\??\c:\vpddp.exec:\vpddp.exe134⤵
-
\??\c:\thntnn.exec:\thntnn.exe135⤵
-
\??\c:\hhttbn.exec:\hhttbn.exe136⤵
-
\??\c:\jdjpd.exec:\jdjpd.exe137⤵
-
\??\c:\vjvdj.exec:\vjvdj.exe138⤵
-
\??\c:\1rrrxfr.exec:\1rrrxfr.exe139⤵
-
\??\c:\llxflrf.exec:\llxflrf.exe140⤵
-
\??\c:\thbbnn.exec:\thbbnn.exe141⤵
-
\??\c:\pdvdd.exec:\pdvdd.exe142⤵
-
\??\c:\3dpvp.exec:\3dpvp.exe143⤵
-
\??\c:\xrfrrxx.exec:\xrfrrxx.exe144⤵
-
\??\c:\rlfxlrf.exec:\rlfxlrf.exe145⤵
-
\??\c:\1htthn.exec:\1htthn.exe146⤵
-
\??\c:\tnhntb.exec:\tnhntb.exe147⤵
-
\??\c:\jdjjj.exec:\jdjjj.exe148⤵
-
\??\c:\dvddj.exec:\dvddj.exe149⤵
-
\??\c:\lxfxfff.exec:\lxfxfff.exe150⤵
-
\??\c:\7lxrxfr.exec:\7lxrxfr.exe151⤵
-
\??\c:\bbhtbn.exec:\bbhtbn.exe152⤵
-
\??\c:\3tbbbb.exec:\3tbbbb.exe153⤵
-
\??\c:\dppvj.exec:\dppvj.exe154⤵
-
\??\c:\jdjjp.exec:\jdjjp.exe155⤵
-
\??\c:\fflrxlx.exec:\fflrxlx.exe156⤵
-
\??\c:\rlxxflr.exec:\rlxxflr.exe157⤵
-
\??\c:\hthbnn.exec:\hthbnn.exe158⤵
-
\??\c:\hbnthn.exec:\hbnthn.exe159⤵
-
\??\c:\dpdvd.exec:\dpdvd.exe160⤵
-
\??\c:\5jddj.exec:\5jddj.exe161⤵
-
\??\c:\xxllllx.exec:\xxllllx.exe162⤵
-
\??\c:\fxllxrr.exec:\fxllxrr.exe163⤵
-
\??\c:\fxxxffl.exec:\fxxxffl.exe164⤵
-
\??\c:\tntthh.exec:\tntthh.exe165⤵
-
\??\c:\hbhhnn.exec:\hbhhnn.exe166⤵
-
\??\c:\jdvjp.exec:\jdvjp.exe167⤵
-
\??\c:\3dvvd.exec:\3dvvd.exe168⤵
-
\??\c:\1rxlxxf.exec:\1rxlxxf.exe169⤵
-
\??\c:\frxlrxx.exec:\frxlrxx.exe170⤵
-
\??\c:\hbtbbb.exec:\hbtbbb.exe171⤵
-
\??\c:\thhhbb.exec:\thhhbb.exe172⤵
-
\??\c:\5pjdp.exec:\5pjdp.exe173⤵
-
\??\c:\ddpjd.exec:\ddpjd.exe174⤵
-
\??\c:\ffrfxfr.exec:\ffrfxfr.exe175⤵
-
\??\c:\xxxflrf.exec:\xxxflrf.exe176⤵
-
\??\c:\1bthtb.exec:\1bthtb.exe177⤵
-
\??\c:\ttbtth.exec:\ttbtth.exe178⤵
-
\??\c:\pjdvd.exec:\pjdvd.exe179⤵
-
\??\c:\ddjvj.exec:\ddjvj.exe180⤵
-
\??\c:\frflllr.exec:\frflllr.exe181⤵
-
\??\c:\7lfrlxf.exec:\7lfrlxf.exe182⤵
-
\??\c:\thbbht.exec:\thbbht.exe183⤵
-
\??\c:\3tnbhh.exec:\3tnbhh.exe184⤵
-
\??\c:\vjdvj.exec:\vjdvj.exe185⤵
-
\??\c:\3djpp.exec:\3djpp.exe186⤵
-
\??\c:\xlrflfr.exec:\xlrflfr.exe187⤵
-
\??\c:\flllrxl.exec:\flllrxl.exe188⤵
-
\??\c:\thbbbb.exec:\thbbbb.exe189⤵
-
\??\c:\bnbbht.exec:\bnbbht.exe190⤵
-
\??\c:\nbhbbb.exec:\nbhbbb.exe191⤵
-
\??\c:\ddjjv.exec:\ddjjv.exe192⤵
-
\??\c:\vpjjp.exec:\vpjjp.exe193⤵
-
\??\c:\lxfflrr.exec:\lxfflrr.exe194⤵
-
\??\c:\hbhhnn.exec:\hbhhnn.exe195⤵
-
\??\c:\htttnh.exec:\htttnh.exe196⤵
-
\??\c:\bntbtn.exec:\bntbtn.exe197⤵
-
\??\c:\9pdpp.exec:\9pdpp.exe198⤵
-
\??\c:\pjjpj.exec:\pjjpj.exe199⤵
-
\??\c:\fxfrlff.exec:\fxfrlff.exe200⤵
-
\??\c:\frfrlff.exec:\frfrlff.exe201⤵
-
\??\c:\5tnthb.exec:\5tnthb.exe202⤵
-
\??\c:\9btnbt.exec:\9btnbt.exe203⤵
-
\??\c:\vpjjv.exec:\vpjjv.exe204⤵
-
\??\c:\xxrflfr.exec:\xxrflfr.exe205⤵
-
\??\c:\5tbbhh.exec:\5tbbhh.exe206⤵
-
\??\c:\5hbtbh.exec:\5hbtbh.exe207⤵
-
\??\c:\bbthht.exec:\bbthht.exe208⤵
-
\??\c:\dvjpj.exec:\dvjpj.exe209⤵
-
\??\c:\rrrrlxx.exec:\rrrrlxx.exe210⤵
-
\??\c:\5flxfxf.exec:\5flxfxf.exe211⤵
-
\??\c:\1btbhn.exec:\1btbhn.exe212⤵
-
\??\c:\lxlrxlf.exec:\lxlrxlf.exe213⤵
-
\??\c:\fxlllfl.exec:\fxlllfl.exe214⤵
-
\??\c:\bthttt.exec:\bthttt.exe215⤵
-
\??\c:\tbnhnn.exec:\tbnhnn.exe216⤵
-
\??\c:\vvjvj.exec:\vvjvj.exe217⤵
-
\??\c:\vjvdj.exec:\vjvdj.exe218⤵
-
\??\c:\lflrxfx.exec:\lflrxfx.exe219⤵
-
\??\c:\fxfflrx.exec:\fxfflrx.exe220⤵
-
\??\c:\xrffflr.exec:\xrffflr.exe221⤵
-
\??\c:\tbhntn.exec:\tbhntn.exe222⤵
-
\??\c:\vpdvd.exec:\vpdvd.exe223⤵
-
\??\c:\dvjvj.exec:\dvjvj.exe224⤵
-
\??\c:\lflrffx.exec:\lflrffx.exe225⤵
-
\??\c:\fxffrrf.exec:\fxffrrf.exe226⤵
-
\??\c:\9hntnt.exec:\9hntnt.exe227⤵
-
\??\c:\tnntbt.exec:\tnntbt.exe228⤵
-
\??\c:\pjpvj.exec:\pjpvj.exe229⤵
-
\??\c:\ppdjv.exec:\ppdjv.exe230⤵
-
\??\c:\fxffxxx.exec:\fxffxxx.exe231⤵
-
\??\c:\btnbnt.exec:\btnbnt.exe232⤵
-
\??\c:\tnbhhb.exec:\tnbhhb.exe233⤵
-
\??\c:\pdvjj.exec:\pdvjj.exe234⤵
-
\??\c:\jvpjd.exec:\jvpjd.exe235⤵
-
\??\c:\7xlllrx.exec:\7xlllrx.exe236⤵
-
\??\c:\7lxlrrx.exec:\7lxlrrx.exe237⤵
-
\??\c:\bnbnnn.exec:\bnbnnn.exe238⤵
-
\??\c:\pvvjp.exec:\pvvjp.exe239⤵
-
\??\c:\3pvvp.exec:\3pvvp.exe240⤵
-
\??\c:\3xfrrxl.exec:\3xfrrxl.exe241⤵