Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 08:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
41da08306350f58a411eff210ef87b386e1f84917d36cd46007e7d1d57b40671_NeikiAnalytics.exe
Resource
win7-20240611-en
5 signatures
150 seconds
General
-
Target
41da08306350f58a411eff210ef87b386e1f84917d36cd46007e7d1d57b40671_NeikiAnalytics.exe
-
Size
78KB
-
MD5
cb468ec90e9450f7029bc6c2604bd000
-
SHA1
49085eb3284dce0e27ada29335ec84b71b68b59d
-
SHA256
41da08306350f58a411eff210ef87b386e1f84917d36cd46007e7d1d57b40671
-
SHA512
eb852828294ebb247133b5c473df60c212d4b0c8c48018faeec35ea04c2d9a0a82b061de000057f73e1e3fed171ce98d3c1c137017546f1ffad25bb5b603b25c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5Zzh:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCl
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/2424-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-40-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2704-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2884-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-60-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2508-83-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2508-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1952-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1584-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1788-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/276-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1616-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1312-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1664-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2156-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vjddj.exe3lxlllr.exe3htntt.exehthnnn.exepvjdp.exejjjjp.exehtttbh.exebbtbnt.exejdpdj.exedvpvp.exeffrxffx.exehhnnbb.exebbthnt.exevppvd.exepjdpv.exefxxfrxl.exehbhhnt.exennbtbt.exejdpdv.exefxfllrx.exenbhntn.exebnhttn.exehthhhn.exevpddj.exelxlrrrr.exefxllxxx.exe9bbbht.exentnnhn.exe9pdvj.exerxrfflx.exexffrrlf.exebbtnnt.exe1tntbh.exedpddj.exedvjjd.exexrllffl.exe1fxllff.exentbntn.exe5hbnbb.exe9dvdd.exevvdpj.exelfflxxl.exehththn.exe7nnnnn.exedvpjj.exedvjpj.exerlrxfrx.exennnhnb.exehbntbb.exevjjdd.exeddpvv.exe9jjpp.exelllrxxl.exe5hnhhh.exebbthnn.exeddjvj.exepjpjp.exe5rlrlll.exefxlrllx.exenbhntb.exe7bthtt.exe3nhnbb.exepddpj.exepdvvd.exepid process 2812 vjddj.exe 2148 3lxlllr.exe 2704 3htntt.exe 2884 hthnnn.exe 2652 pvjdp.exe 2520 jjjjp.exe 2508 htttbh.exe 2960 bbtbnt.exe 1952 jdpdj.exe 2820 dvpvp.exe 2776 ffrxffx.exe 1608 hhnnbb.exe 1584 bbthnt.exe 1788 vppvd.exe 276 pjdpv.exe 2564 fxxfrxl.exe 1616 hbhhnt.exe 1312 nnbtbt.exe 2592 jdpdv.exe 2900 fxfllrx.exe 2276 nbhntn.exe 392 bnhttn.exe 592 hthhhn.exe 984 vpddj.exe 2136 lxlrrrr.exe 1148 fxllxxx.exe 852 9bbbht.exe 912 ntnnhn.exe 1664 9pdvj.exe 2932 rxrfflx.exe 2156 xffrrlf.exe 1256 bbtnnt.exe 1292 1tntbh.exe 1680 dpddj.exe 2264 dvjjd.exe 2632 xrllffl.exe 2148 1fxllff.exe 2504 ntbntn.exe 2880 5hbnbb.exe 2800 9dvdd.exe 2628 vvdpj.exe 2664 lfflxxl.exe 2560 hththn.exe 3032 7nnnnn.exe 1964 dvpjj.exe 2824 dvjpj.exe 2852 rlrxfrx.exe 2996 nnnhnb.exe 2776 hbntbb.exe 2052 vjjdd.exe 1780 ddpvv.exe 1596 9jjpp.exe 2472 lllrxxl.exe 1632 5hnhhh.exe 1532 bbthnn.exe 1432 ddjvj.exe 2076 pjpjp.exe 2272 5rlrlll.exe 2100 fxlrllx.exe 2900 nbhntb.exe 676 7bthtt.exe 2104 3nhnbb.exe 1852 pddpj.exe 816 pdvvd.exe -
Processes:
resource yara_rule behavioral1/memory/2424-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1584-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1788-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/276-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1616-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1312-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-300-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
41da08306350f58a411eff210ef87b386e1f84917d36cd46007e7d1d57b40671_NeikiAnalytics.exevjddj.exe3lxlllr.exe3htntt.exehthnnn.exepvjdp.exejjjjp.exehtttbh.exebbtbnt.exejdpdj.exedvpvp.exeffrxffx.exehhnnbb.exebbthnt.exevppvd.exepjdpv.exedescription pid process target process PID 2424 wrote to memory of 2812 2424 41da08306350f58a411eff210ef87b386e1f84917d36cd46007e7d1d57b40671_NeikiAnalytics.exe vjddj.exe PID 2424 wrote to memory of 2812 2424 41da08306350f58a411eff210ef87b386e1f84917d36cd46007e7d1d57b40671_NeikiAnalytics.exe vjddj.exe PID 2424 wrote to memory of 2812 2424 41da08306350f58a411eff210ef87b386e1f84917d36cd46007e7d1d57b40671_NeikiAnalytics.exe vjddj.exe PID 2424 wrote to memory of 2812 2424 41da08306350f58a411eff210ef87b386e1f84917d36cd46007e7d1d57b40671_NeikiAnalytics.exe vjddj.exe PID 2812 wrote to memory of 2148 2812 vjddj.exe 3lxlllr.exe PID 2812 wrote to memory of 2148 2812 vjddj.exe 3lxlllr.exe PID 2812 wrote to memory of 2148 2812 vjddj.exe 3lxlllr.exe PID 2812 wrote to memory of 2148 2812 vjddj.exe 3lxlllr.exe PID 2148 wrote to memory of 2704 2148 3lxlllr.exe 3htntt.exe PID 2148 wrote to memory of 2704 2148 3lxlllr.exe 3htntt.exe PID 2148 wrote to memory of 2704 2148 3lxlllr.exe 3htntt.exe PID 2148 wrote to memory of 2704 2148 3lxlllr.exe 3htntt.exe PID 2704 wrote to memory of 2884 2704 3htntt.exe hthnnn.exe PID 2704 wrote to memory of 2884 2704 3htntt.exe hthnnn.exe PID 2704 wrote to memory of 2884 2704 3htntt.exe hthnnn.exe PID 2704 wrote to memory of 2884 2704 3htntt.exe hthnnn.exe PID 2884 wrote to memory of 2652 2884 hthnnn.exe pvjdp.exe PID 2884 wrote to memory of 2652 2884 hthnnn.exe pvjdp.exe PID 2884 wrote to memory of 2652 2884 hthnnn.exe pvjdp.exe PID 2884 wrote to memory of 2652 2884 hthnnn.exe pvjdp.exe PID 2652 wrote to memory of 2520 2652 pvjdp.exe jjjjp.exe PID 2652 wrote to memory of 2520 2652 pvjdp.exe jjjjp.exe PID 2652 wrote to memory of 2520 2652 pvjdp.exe jjjjp.exe PID 2652 wrote to memory of 2520 2652 pvjdp.exe jjjjp.exe PID 2520 wrote to memory of 2508 2520 jjjjp.exe htttbh.exe PID 2520 wrote to memory of 2508 2520 jjjjp.exe htttbh.exe PID 2520 wrote to memory of 2508 2520 jjjjp.exe htttbh.exe PID 2520 wrote to memory of 2508 2520 jjjjp.exe htttbh.exe PID 2508 wrote to memory of 2960 2508 htttbh.exe bbtbnt.exe PID 2508 wrote to memory of 2960 2508 htttbh.exe bbtbnt.exe PID 2508 wrote to memory of 2960 2508 htttbh.exe bbtbnt.exe PID 2508 wrote to memory of 2960 2508 htttbh.exe bbtbnt.exe PID 2960 wrote to memory of 1952 2960 bbtbnt.exe jdpdj.exe PID 2960 wrote to memory of 1952 2960 bbtbnt.exe jdpdj.exe PID 2960 wrote to memory of 1952 2960 bbtbnt.exe jdpdj.exe PID 2960 wrote to memory of 1952 2960 bbtbnt.exe jdpdj.exe PID 1952 wrote to memory of 2820 1952 jdpdj.exe dvpvp.exe PID 1952 wrote to memory of 2820 1952 jdpdj.exe dvpvp.exe PID 1952 wrote to memory of 2820 1952 jdpdj.exe dvpvp.exe PID 1952 wrote to memory of 2820 1952 jdpdj.exe dvpvp.exe PID 2820 wrote to memory of 2776 2820 dvpvp.exe ffrxffx.exe PID 2820 wrote to memory of 2776 2820 dvpvp.exe ffrxffx.exe PID 2820 wrote to memory of 2776 2820 dvpvp.exe ffrxffx.exe PID 2820 wrote to memory of 2776 2820 dvpvp.exe ffrxffx.exe PID 2776 wrote to memory of 1608 2776 ffrxffx.exe hhnnbb.exe PID 2776 wrote to memory of 1608 2776 ffrxffx.exe hhnnbb.exe PID 2776 wrote to memory of 1608 2776 ffrxffx.exe hhnnbb.exe PID 2776 wrote to memory of 1608 2776 ffrxffx.exe hhnnbb.exe PID 1608 wrote to memory of 1584 1608 hhnnbb.exe bbthnt.exe PID 1608 wrote to memory of 1584 1608 hhnnbb.exe bbthnt.exe PID 1608 wrote to memory of 1584 1608 hhnnbb.exe bbthnt.exe PID 1608 wrote to memory of 1584 1608 hhnnbb.exe bbthnt.exe PID 1584 wrote to memory of 1788 1584 bbthnt.exe vppvd.exe PID 1584 wrote to memory of 1788 1584 bbthnt.exe vppvd.exe PID 1584 wrote to memory of 1788 1584 bbthnt.exe vppvd.exe PID 1584 wrote to memory of 1788 1584 bbthnt.exe vppvd.exe PID 1788 wrote to memory of 276 1788 vppvd.exe pjdpv.exe PID 1788 wrote to memory of 276 1788 vppvd.exe pjdpv.exe PID 1788 wrote to memory of 276 1788 vppvd.exe pjdpv.exe PID 1788 wrote to memory of 276 1788 vppvd.exe pjdpv.exe PID 276 wrote to memory of 2564 276 pjdpv.exe fxxfrxl.exe PID 276 wrote to memory of 2564 276 pjdpv.exe fxxfrxl.exe PID 276 wrote to memory of 2564 276 pjdpv.exe fxxfrxl.exe PID 276 wrote to memory of 2564 276 pjdpv.exe fxxfrxl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\41da08306350f58a411eff210ef87b386e1f84917d36cd46007e7d1d57b40671_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\41da08306350f58a411eff210ef87b386e1f84917d36cd46007e7d1d57b40671_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\vjddj.exec:\vjddj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3lxlllr.exec:\3lxlllr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3htntt.exec:\3htntt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hthnnn.exec:\hthnnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvjdp.exec:\pvjdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjjjp.exec:\jjjjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\htttbh.exec:\htttbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbtbnt.exec:\bbtbnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdpdj.exec:\jdpdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvpvp.exec:\dvpvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffrxffx.exec:\ffrxffx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhnnbb.exec:\hhnnbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbthnt.exec:\bbthnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vppvd.exec:\vppvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjdpv.exec:\pjdpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxxfrxl.exec:\fxxfrxl.exe17⤵
- Executes dropped EXE
-
\??\c:\hbhhnt.exec:\hbhhnt.exe18⤵
- Executes dropped EXE
-
\??\c:\nnbtbt.exec:\nnbtbt.exe19⤵
- Executes dropped EXE
-
\??\c:\jdpdv.exec:\jdpdv.exe20⤵
- Executes dropped EXE
-
\??\c:\fxfllrx.exec:\fxfllrx.exe21⤵
- Executes dropped EXE
-
\??\c:\nbhntn.exec:\nbhntn.exe22⤵
- Executes dropped EXE
-
\??\c:\bnhttn.exec:\bnhttn.exe23⤵
- Executes dropped EXE
-
\??\c:\hthhhn.exec:\hthhhn.exe24⤵
- Executes dropped EXE
-
\??\c:\vpddj.exec:\vpddj.exe25⤵
- Executes dropped EXE
-
\??\c:\lxlrrrr.exec:\lxlrrrr.exe26⤵
- Executes dropped EXE
-
\??\c:\fxllxxx.exec:\fxllxxx.exe27⤵
- Executes dropped EXE
-
\??\c:\9bbbht.exec:\9bbbht.exe28⤵
- Executes dropped EXE
-
\??\c:\ntnnhn.exec:\ntnnhn.exe29⤵
- Executes dropped EXE
-
\??\c:\9pdvj.exec:\9pdvj.exe30⤵
- Executes dropped EXE
-
\??\c:\rxrfflx.exec:\rxrfflx.exe31⤵
- Executes dropped EXE
-
\??\c:\xffrrlf.exec:\xffrrlf.exe32⤵
- Executes dropped EXE
-
\??\c:\bbtnnt.exec:\bbtnnt.exe33⤵
- Executes dropped EXE
-
\??\c:\1tntbh.exec:\1tntbh.exe34⤵
- Executes dropped EXE
-
\??\c:\dpddj.exec:\dpddj.exe35⤵
- Executes dropped EXE
-
\??\c:\dvjjd.exec:\dvjjd.exe36⤵
- Executes dropped EXE
-
\??\c:\xrllffl.exec:\xrllffl.exe37⤵
- Executes dropped EXE
-
\??\c:\1fxllff.exec:\1fxllff.exe38⤵
- Executes dropped EXE
-
\??\c:\ntbntn.exec:\ntbntn.exe39⤵
- Executes dropped EXE
-
\??\c:\5hbnbb.exec:\5hbnbb.exe40⤵
- Executes dropped EXE
-
\??\c:\9dvdd.exec:\9dvdd.exe41⤵
- Executes dropped EXE
-
\??\c:\vvdpj.exec:\vvdpj.exe42⤵
- Executes dropped EXE
-
\??\c:\lfflxxl.exec:\lfflxxl.exe43⤵
- Executes dropped EXE
-
\??\c:\hththn.exec:\hththn.exe44⤵
- Executes dropped EXE
-
\??\c:\7nnnnn.exec:\7nnnnn.exe45⤵
- Executes dropped EXE
-
\??\c:\dvpjj.exec:\dvpjj.exe46⤵
- Executes dropped EXE
-
\??\c:\dvjpj.exec:\dvjpj.exe47⤵
- Executes dropped EXE
-
\??\c:\rlrxfrx.exec:\rlrxfrx.exe48⤵
- Executes dropped EXE
-
\??\c:\nnnhnb.exec:\nnnhnb.exe49⤵
- Executes dropped EXE
-
\??\c:\hbntbb.exec:\hbntbb.exe50⤵
- Executes dropped EXE
-
\??\c:\vjjdd.exec:\vjjdd.exe51⤵
- Executes dropped EXE
-
\??\c:\ddpvv.exec:\ddpvv.exe52⤵
- Executes dropped EXE
-
\??\c:\9jjpp.exec:\9jjpp.exe53⤵
- Executes dropped EXE
-
\??\c:\lllrxxl.exec:\lllrxxl.exe54⤵
- Executes dropped EXE
-
\??\c:\5hnhhh.exec:\5hnhhh.exe55⤵
- Executes dropped EXE
-
\??\c:\bbthnn.exec:\bbthnn.exe56⤵
- Executes dropped EXE
-
\??\c:\ddjvj.exec:\ddjvj.exe57⤵
- Executes dropped EXE
-
\??\c:\pjpjp.exec:\pjpjp.exe58⤵
- Executes dropped EXE
-
\??\c:\5rlrlll.exec:\5rlrlll.exe59⤵
- Executes dropped EXE
-
\??\c:\fxlrllx.exec:\fxlrllx.exe60⤵
- Executes dropped EXE
-
\??\c:\nbhntb.exec:\nbhntb.exe61⤵
- Executes dropped EXE
-
\??\c:\7bthtt.exec:\7bthtt.exe62⤵
- Executes dropped EXE
-
\??\c:\3nhnbb.exec:\3nhnbb.exe63⤵
- Executes dropped EXE
-
\??\c:\pddpj.exec:\pddpj.exe64⤵
- Executes dropped EXE
-
\??\c:\pdvvd.exec:\pdvvd.exe65⤵
- Executes dropped EXE
-
\??\c:\lxfxxrr.exec:\lxfxxrr.exe66⤵
-
\??\c:\lxfxllf.exec:\lxfxllf.exe67⤵
-
\??\c:\thnhhh.exec:\thnhhh.exe68⤵
-
\??\c:\vpppv.exec:\vpppv.exe69⤵
-
\??\c:\jjvjd.exec:\jjvjd.exe70⤵
-
\??\c:\9xxxrrx.exec:\9xxxrrx.exe71⤵
-
\??\c:\xlrxffl.exec:\xlrxffl.exe72⤵
-
\??\c:\thbhhh.exec:\thbhhh.exe73⤵
-
\??\c:\7hbntn.exec:\7hbntn.exe74⤵
-
\??\c:\vjppj.exec:\vjppj.exe75⤵
-
\??\c:\djdjv.exec:\djdjv.exe76⤵
-
\??\c:\frflfxx.exec:\frflfxx.exe77⤵
-
\??\c:\fxllrll.exec:\fxllrll.exe78⤵
-
\??\c:\ntntnt.exec:\ntntnt.exe79⤵
-
\??\c:\btnhtt.exec:\btnhtt.exe80⤵
-
\??\c:\pjvjv.exec:\pjvjv.exe81⤵
-
\??\c:\3xrrxrr.exec:\3xrrxrr.exe82⤵
-
\??\c:\fxfxfrx.exec:\fxfxfrx.exe83⤵
-
\??\c:\nhhhht.exec:\nhhhht.exe84⤵
-
\??\c:\tbnhhb.exec:\tbnhhb.exe85⤵
-
\??\c:\9jjpp.exec:\9jjpp.exe86⤵
-
\??\c:\vjpvj.exec:\vjpvj.exe87⤵
-
\??\c:\3rlrfff.exec:\3rlrfff.exe88⤵
-
\??\c:\1rlxxrx.exec:\1rlxxrx.exe89⤵
-
\??\c:\bbntbb.exec:\bbntbb.exe90⤵
-
\??\c:\nntthn.exec:\nntthn.exe91⤵
-
\??\c:\pdvdp.exec:\pdvdp.exe92⤵
-
\??\c:\lfxlxxl.exec:\lfxlxxl.exe93⤵
-
\??\c:\5ffxxxf.exec:\5ffxxxf.exe94⤵
-
\??\c:\bththh.exec:\bththh.exe95⤵
-
\??\c:\btnbhn.exec:\btnbhn.exe96⤵
-
\??\c:\jpvdp.exec:\jpvdp.exe97⤵
-
\??\c:\1ppvj.exec:\1ppvj.exe98⤵
-
\??\c:\1xffflx.exec:\1xffflx.exe99⤵
-
\??\c:\lflrffl.exec:\lflrffl.exe100⤵
-
\??\c:\btnnnb.exec:\btnnnb.exe101⤵
-
\??\c:\nbhhtt.exec:\nbhhtt.exe102⤵
-
\??\c:\vpjjp.exec:\vpjjp.exe103⤵
-
\??\c:\jjvjv.exec:\jjvjv.exe104⤵
-
\??\c:\llfxflx.exec:\llfxflx.exe105⤵
-
\??\c:\llfrxfl.exec:\llfrxfl.exe106⤵
-
\??\c:\xflxxlr.exec:\xflxxlr.exe107⤵
-
\??\c:\btbntb.exec:\btbntb.exe108⤵
-
\??\c:\hnnbbn.exec:\hnnbbn.exe109⤵
-
\??\c:\5pvdj.exec:\5pvdj.exe110⤵
-
\??\c:\1jvdp.exec:\1jvdp.exe111⤵
-
\??\c:\xlxlrlx.exec:\xlxlrlx.exe112⤵
-
\??\c:\9flrrlr.exec:\9flrrlr.exe113⤵
-
\??\c:\hbtbnn.exec:\hbtbnn.exe114⤵
-
\??\c:\7hhhbn.exec:\7hhhbn.exe115⤵
-
\??\c:\tnbhtt.exec:\tnbhtt.exe116⤵
-
\??\c:\1jppp.exec:\1jppp.exe117⤵
-
\??\c:\5xrrrxx.exec:\5xrrrxx.exe118⤵
-
\??\c:\rfrfllx.exec:\rfrfllx.exe119⤵
-
\??\c:\rrfflrx.exec:\rrfflrx.exe120⤵
-
\??\c:\tntbnt.exec:\tntbnt.exe121⤵
-
\??\c:\nbnnnn.exec:\nbnnnn.exe122⤵
-
\??\c:\vdjdj.exec:\vdjdj.exe123⤵
-
\??\c:\pjdjj.exec:\pjdjj.exe124⤵
-
\??\c:\1llxrlr.exec:\1llxrlr.exe125⤵
-
\??\c:\xllxflx.exec:\xllxflx.exe126⤵
-
\??\c:\bbntht.exec:\bbntht.exe127⤵
-
\??\c:\9thnnb.exec:\9thnnb.exe128⤵
-
\??\c:\9pdjp.exec:\9pdjp.exe129⤵
-
\??\c:\5dvpv.exec:\5dvpv.exe130⤵
-
\??\c:\7xrrrlx.exec:\7xrrrlx.exe131⤵
-
\??\c:\3frrrrr.exec:\3frrrrr.exe132⤵
-
\??\c:\hbnbtn.exec:\hbnbtn.exe133⤵
-
\??\c:\tnnnbb.exec:\tnnnbb.exe134⤵
-
\??\c:\dddpv.exec:\dddpv.exe135⤵
-
\??\c:\vdpvd.exec:\vdpvd.exe136⤵
-
\??\c:\xrxfllx.exec:\xrxfllx.exe137⤵
-
\??\c:\hbbnhh.exec:\hbbnhh.exe138⤵
-
\??\c:\3bhbtt.exec:\3bhbtt.exe139⤵
-
\??\c:\djvpp.exec:\djvpp.exe140⤵
-
\??\c:\ppjvj.exec:\ppjvj.exe141⤵
-
\??\c:\pjdvv.exec:\pjdvv.exe142⤵
-
\??\c:\xlxxffr.exec:\xlxxffr.exe143⤵
-
\??\c:\lrxlfxr.exec:\lrxlfxr.exe144⤵
-
\??\c:\nhtbnn.exec:\nhtbnn.exe145⤵
-
\??\c:\tnbntt.exec:\tnbntt.exe146⤵
-
\??\c:\5djjj.exec:\5djjj.exe147⤵
-
\??\c:\ppvvp.exec:\ppvvp.exe148⤵
-
\??\c:\lxfxflx.exec:\lxfxflx.exe149⤵
-
\??\c:\9rlrxxl.exec:\9rlrxxl.exe150⤵
-
\??\c:\frxfffl.exec:\frxfffl.exe151⤵
-
\??\c:\bthhbb.exec:\bthhbb.exe152⤵
-
\??\c:\thbbbb.exec:\thbbbb.exe153⤵
-
\??\c:\9jpvv.exec:\9jpvv.exe154⤵
-
\??\c:\pjvvv.exec:\pjvvv.exe155⤵
-
\??\c:\llllfff.exec:\llllfff.exe156⤵
-
\??\c:\rfrxxfl.exec:\rfrxxfl.exe157⤵
-
\??\c:\hthntn.exec:\hthntn.exe158⤵
-
\??\c:\5pppv.exec:\5pppv.exe159⤵
-
\??\c:\vjjdj.exec:\vjjdj.exe160⤵
-
\??\c:\xxrflxx.exec:\xxrflxx.exe161⤵
-
\??\c:\bbttbn.exec:\bbttbn.exe162⤵
-
\??\c:\hnhtnb.exec:\hnhtnb.exe163⤵
-
\??\c:\dvjvj.exec:\dvjvj.exe164⤵
-
\??\c:\vvpvd.exec:\vvpvd.exe165⤵
-
\??\c:\7xlrxxl.exec:\7xlrxxl.exe166⤵
-
\??\c:\xxfflrf.exec:\xxfflrf.exe167⤵
-
\??\c:\5bbhnn.exec:\5bbhnn.exe168⤵
-
\??\c:\5nbbhn.exec:\5nbbhn.exe169⤵
-
\??\c:\5vvjv.exec:\5vvjv.exe170⤵
-
\??\c:\dvdvj.exec:\dvdvj.exe171⤵
-
\??\c:\lfrxrrx.exec:\lfrxrrx.exe172⤵
-
\??\c:\xrffrrr.exec:\xrffrrr.exe173⤵
-
\??\c:\tthnnb.exec:\tthnnb.exe174⤵
-
\??\c:\tbttnt.exec:\tbttnt.exe175⤵
-
\??\c:\vpdjj.exec:\vpdjj.exe176⤵
-
\??\c:\1rxfrxl.exec:\1rxfrxl.exe177⤵
-
\??\c:\xlffrrl.exec:\xlffrrl.exe178⤵
-
\??\c:\nhbhnn.exec:\nhbhnn.exe179⤵
-
\??\c:\7nhbnb.exec:\7nhbnb.exe180⤵
-
\??\c:\jdvjv.exec:\jdvjv.exe181⤵
-
\??\c:\5vvdj.exec:\5vvdj.exe182⤵
-
\??\c:\jvdvj.exec:\jvdvj.exe183⤵
-
\??\c:\7lfrxxl.exec:\7lfrxxl.exe184⤵
-
\??\c:\tnbhnh.exec:\tnbhnh.exe185⤵
-
\??\c:\btbhhn.exec:\btbhhn.exe186⤵
-
\??\c:\jddvj.exec:\jddvj.exe187⤵
-
\??\c:\hbntbt.exec:\hbntbt.exe188⤵
-
\??\c:\jddjp.exec:\jddjp.exe189⤵
-
\??\c:\dpdpj.exec:\dpdpj.exe190⤵
-
\??\c:\pdpvd.exec:\pdpvd.exe191⤵
-
\??\c:\7rrxffl.exec:\7rrxffl.exe192⤵
-
\??\c:\nhhhtn.exec:\nhhhtn.exe193⤵
-
\??\c:\hbntbb.exec:\hbntbb.exe194⤵
-
\??\c:\tnbbbb.exec:\tnbbbb.exe195⤵
-
\??\c:\vpdjp.exec:\vpdjp.exe196⤵
-
\??\c:\dvvvv.exec:\dvvvv.exe197⤵
-
\??\c:\rfxrxfl.exec:\rfxrxfl.exe198⤵
-
\??\c:\xrxrxrx.exec:\xrxrxrx.exe199⤵
-
\??\c:\9nnhhh.exec:\9nnhhh.exe200⤵
-
\??\c:\btbnbb.exec:\btbnbb.exe201⤵
-
\??\c:\pdjpv.exec:\pdjpv.exe202⤵
-
\??\c:\7rfllfr.exec:\7rfllfr.exe203⤵
-
\??\c:\bttnth.exec:\bttnth.exe204⤵
-
\??\c:\bnhttt.exec:\bnhttt.exe205⤵
-
\??\c:\pdjjp.exec:\pdjjp.exe206⤵
-
\??\c:\xrffllr.exec:\xrffllr.exe207⤵
-
\??\c:\fxllrrr.exec:\fxllrrr.exe208⤵
-
\??\c:\3vpdj.exec:\3vpdj.exe209⤵
-
\??\c:\dpvvv.exec:\dpvvv.exe210⤵
-
\??\c:\rfrffrx.exec:\rfrffrx.exe211⤵
-
\??\c:\lfrlrlr.exec:\lfrlrlr.exe212⤵
-
\??\c:\bnbtht.exec:\bnbtht.exe213⤵
-
\??\c:\nbnhbn.exec:\nbnhbn.exe214⤵
-
\??\c:\tbhtnt.exec:\tbhtnt.exe215⤵
-
\??\c:\1pddd.exec:\1pddd.exe216⤵
-
\??\c:\5jjvd.exec:\5jjvd.exe217⤵
-
\??\c:\1frrrll.exec:\1frrrll.exe218⤵
-
\??\c:\9rlrflr.exec:\9rlrflr.exe219⤵
-
\??\c:\bthhnt.exec:\bthhnt.exe220⤵
-
\??\c:\9pjjv.exec:\9pjjv.exe221⤵
-
\??\c:\pdvvp.exec:\pdvvp.exe222⤵
-
\??\c:\9dpvd.exec:\9dpvd.exe223⤵
-
\??\c:\lflrxxx.exec:\lflrxxx.exe224⤵
-
\??\c:\9bthnh.exec:\9bthnh.exe225⤵
-
\??\c:\btnnbt.exec:\btnnbt.exe226⤵
-
\??\c:\jvjjj.exec:\jvjjj.exe227⤵
-
\??\c:\dpppp.exec:\dpppp.exe228⤵
-
\??\c:\xxrxlxf.exec:\xxrxlxf.exe229⤵
-
\??\c:\xlrfrxl.exec:\xlrfrxl.exe230⤵
-
\??\c:\thnbbt.exec:\thnbbt.exe231⤵
-
\??\c:\hnnhhb.exec:\hnnhhb.exe232⤵
-
\??\c:\5ppjp.exec:\5ppjp.exe233⤵
-
\??\c:\dddpd.exec:\dddpd.exe234⤵
-
\??\c:\7fxffxl.exec:\7fxffxl.exe235⤵
-
\??\c:\llrffxr.exec:\llrffxr.exe236⤵
-
\??\c:\thnnhn.exec:\thnnhn.exe237⤵
-
\??\c:\btthbh.exec:\btthbh.exe238⤵
-
\??\c:\pjvvj.exec:\pjvvj.exe239⤵
-
\??\c:\jjdjv.exec:\jjdjv.exe240⤵
-
\??\c:\lxxrxxr.exec:\lxxrxxr.exe241⤵