Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
30-06-2024 00:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
12b4e17fbd17bddb1c2ab956cb8967b52dcb84a47b876b360feedef324e88603_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
12b4e17fbd17bddb1c2ab956cb8967b52dcb84a47b876b360feedef324e88603_NeikiAnalytics.exe
-
Size
228KB
-
MD5
c2ccf8e46a0bde91e93fb16e23804070
-
SHA1
161fb93ebde0bd3c3f68c50ae8ab32a2f6d0e5f7
-
SHA256
12b4e17fbd17bddb1c2ab956cb8967b52dcb84a47b876b360feedef324e88603
-
SHA512
f0a076e846ec5efa1da134ee69358ef6bac4ae699229ad4da2f04389f3634b6926b21dc0ddb0002fff4650e1916dfd599aafb3cee8bb74355f1f709b4b5770f8
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4xLjBeG1:n3C9BRo7MlrWKo+lxKb
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral1/memory/2096-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2508-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2208-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1700-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3020-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1628-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1280-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1752-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1516-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/568-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1500-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1540-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2304-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-2899-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
5fllrxl.exe5frrxfl.exehtbbtn.exerlflfff.exetnttbt.exehbhhnn.exejppjd.exexrlxfff.exe7hbthn.exepjvjd.exelxrrxlx.exelrrfxlf.exehbhhnn.exevpvdj.exeffrflrx.exelffxfxf.exebtbhnb.exedjpdd.exe5rfrxlr.exefffflxl.exethbbbh.exeppjdj.exe1xrrxxf.exenbhhnn.exedvdvd.exe9xllrxf.exenhtbnh.exebntbhh.exerlffrlr.exe3hbbhn.exe7flrxfr.exehbnhhh.exebtbbbb.exejdvpd.exerrxxfxf.exe5xlffff.exeththnb.exe1dppv.exejvppp.exelfffrrf.exerlfrfff.exebbnnbb.exe9thhbh.exejjjpd.exe1rffflx.exerfrlllx.exehbttbh.exejjvvj.exedvpjp.exerfxxfff.exe9xxxrxl.exehhttht.exevdpjp.exevpddd.exe5frllrx.exennbhtb.exe3pdpv.exevvvvj.exeffrfllx.exerlrrxfl.exe5hthnt.exejjdpd.exevpddj.exefrxrrrx.exepid process 2096 5fllrxl.exe 2908 5frrxfl.exe 2924 htbbtn.exe 2776 rlflfff.exe 2624 tnttbt.exe 2532 hbhhnn.exe 2508 jppjd.exe 2208 xrlxfff.exe 3020 7hbthn.exe 2720 pjvjd.exe 2840 lxrrxlx.exe 1700 lrrfxlf.exe 1856 hbhhnn.exe 1272 vpvdj.exe 880 ffrflrx.exe 1628 lffxfxf.exe 2708 btbhnb.exe 1280 djpdd.exe 1752 5rfrxlr.exe 624 fffflxl.exe 1748 thbbbh.exe 1516 ppjdj.exe 568 1xrrxxf.exe 1104 nbhhnn.exe 1500 dvdvd.exe 1540 9xllrxf.exe 2304 nhtbnh.exe 2440 bntbhh.exe 2092 rlffrlr.exe 2456 3hbbhn.exe 1728 7flrxfr.exe 1544 hbnhhh.exe 1580 btbbbb.exe 2332 jdvpd.exe 1656 rrxxfxf.exe 2824 5xlffff.exe 2924 ththnb.exe 2364 1dppv.exe 2820 jvppp.exe 2668 lfffrrf.exe 2800 rlfrfff.exe 2584 bbnnbb.exe 2512 9thhbh.exe 2556 jjjpd.exe 2628 1rffflx.exe 2852 rfrlllx.exe 2880 hbttbh.exe 2848 jjvvj.exe 1256 dvpjp.exe 1856 rfxxfff.exe 1952 9xxxrxl.exe 1440 hhttht.exe 1920 vdpjp.exe 2472 vpddd.exe 1776 5frllrx.exe 884 nnbhtb.exe 2604 3pdpv.exe 2396 vvvvj.exe 804 ffrfllx.exe 536 rlrrxfl.exe 112 5hthnt.exe 1312 jjdpd.exe 1036 vpddj.exe 2340 frxrrrx.exe -
Processes:
resource yara_rule behavioral1/memory/2436-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2208-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1700-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1628-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1280-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1516-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/568-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1500-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1540-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-286-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-2899-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
12b4e17fbd17bddb1c2ab956cb8967b52dcb84a47b876b360feedef324e88603_NeikiAnalytics.exe5fllrxl.exe5frrxfl.exehtbbtn.exerlflfff.exetnttbt.exehbhhnn.exejppjd.exexrlxfff.exe7hbthn.exepjvjd.exelxrrxlx.exelrrfxlf.exehbhhnn.exevpvdj.exeffrflrx.exedescription pid process target process PID 2436 wrote to memory of 2096 2436 12b4e17fbd17bddb1c2ab956cb8967b52dcb84a47b876b360feedef324e88603_NeikiAnalytics.exe 5fllrxl.exe PID 2436 wrote to memory of 2096 2436 12b4e17fbd17bddb1c2ab956cb8967b52dcb84a47b876b360feedef324e88603_NeikiAnalytics.exe 5fllrxl.exe PID 2436 wrote to memory of 2096 2436 12b4e17fbd17bddb1c2ab956cb8967b52dcb84a47b876b360feedef324e88603_NeikiAnalytics.exe 5fllrxl.exe PID 2436 wrote to memory of 2096 2436 12b4e17fbd17bddb1c2ab956cb8967b52dcb84a47b876b360feedef324e88603_NeikiAnalytics.exe 5fllrxl.exe PID 2096 wrote to memory of 2908 2096 5fllrxl.exe 5frrxfl.exe PID 2096 wrote to memory of 2908 2096 5fllrxl.exe 5frrxfl.exe PID 2096 wrote to memory of 2908 2096 5fllrxl.exe 5frrxfl.exe PID 2096 wrote to memory of 2908 2096 5fllrxl.exe 5frrxfl.exe PID 2908 wrote to memory of 2924 2908 5frrxfl.exe htbbtn.exe PID 2908 wrote to memory of 2924 2908 5frrxfl.exe htbbtn.exe PID 2908 wrote to memory of 2924 2908 5frrxfl.exe htbbtn.exe PID 2908 wrote to memory of 2924 2908 5frrxfl.exe htbbtn.exe PID 2924 wrote to memory of 2776 2924 htbbtn.exe rlflfff.exe PID 2924 wrote to memory of 2776 2924 htbbtn.exe rlflfff.exe PID 2924 wrote to memory of 2776 2924 htbbtn.exe rlflfff.exe PID 2924 wrote to memory of 2776 2924 htbbtn.exe rlflfff.exe PID 2776 wrote to memory of 2624 2776 rlflfff.exe tnttbt.exe PID 2776 wrote to memory of 2624 2776 rlflfff.exe tnttbt.exe PID 2776 wrote to memory of 2624 2776 rlflfff.exe tnttbt.exe PID 2776 wrote to memory of 2624 2776 rlflfff.exe tnttbt.exe PID 2624 wrote to memory of 2532 2624 tnttbt.exe hbhhnn.exe PID 2624 wrote to memory of 2532 2624 tnttbt.exe hbhhnn.exe PID 2624 wrote to memory of 2532 2624 tnttbt.exe hbhhnn.exe PID 2624 wrote to memory of 2532 2624 tnttbt.exe hbhhnn.exe PID 2532 wrote to memory of 2508 2532 hbhhnn.exe jppjd.exe PID 2532 wrote to memory of 2508 2532 hbhhnn.exe jppjd.exe PID 2532 wrote to memory of 2508 2532 hbhhnn.exe jppjd.exe PID 2532 wrote to memory of 2508 2532 hbhhnn.exe jppjd.exe PID 2508 wrote to memory of 2208 2508 jppjd.exe xrlxfff.exe PID 2508 wrote to memory of 2208 2508 jppjd.exe xrlxfff.exe PID 2508 wrote to memory of 2208 2508 jppjd.exe xrlxfff.exe PID 2508 wrote to memory of 2208 2508 jppjd.exe xrlxfff.exe PID 2208 wrote to memory of 3020 2208 xrlxfff.exe 7hbthn.exe PID 2208 wrote to memory of 3020 2208 xrlxfff.exe 7hbthn.exe PID 2208 wrote to memory of 3020 2208 xrlxfff.exe 7hbthn.exe PID 2208 wrote to memory of 3020 2208 xrlxfff.exe 7hbthn.exe PID 3020 wrote to memory of 2720 3020 7hbthn.exe pjvjd.exe PID 3020 wrote to memory of 2720 3020 7hbthn.exe pjvjd.exe PID 3020 wrote to memory of 2720 3020 7hbthn.exe pjvjd.exe PID 3020 wrote to memory of 2720 3020 7hbthn.exe pjvjd.exe PID 2720 wrote to memory of 2840 2720 pjvjd.exe lxrrxlx.exe PID 2720 wrote to memory of 2840 2720 pjvjd.exe lxrrxlx.exe PID 2720 wrote to memory of 2840 2720 pjvjd.exe lxrrxlx.exe PID 2720 wrote to memory of 2840 2720 pjvjd.exe lxrrxlx.exe PID 2840 wrote to memory of 1700 2840 lxrrxlx.exe lrrfxlf.exe PID 2840 wrote to memory of 1700 2840 lxrrxlx.exe lrrfxlf.exe PID 2840 wrote to memory of 1700 2840 lxrrxlx.exe lrrfxlf.exe PID 2840 wrote to memory of 1700 2840 lxrrxlx.exe lrrfxlf.exe PID 1700 wrote to memory of 1856 1700 lrrfxlf.exe hbhhnn.exe PID 1700 wrote to memory of 1856 1700 lrrfxlf.exe hbhhnn.exe PID 1700 wrote to memory of 1856 1700 lrrfxlf.exe hbhhnn.exe PID 1700 wrote to memory of 1856 1700 lrrfxlf.exe hbhhnn.exe PID 1856 wrote to memory of 1272 1856 hbhhnn.exe vpvdj.exe PID 1856 wrote to memory of 1272 1856 hbhhnn.exe vpvdj.exe PID 1856 wrote to memory of 1272 1856 hbhhnn.exe vpvdj.exe PID 1856 wrote to memory of 1272 1856 hbhhnn.exe vpvdj.exe PID 1272 wrote to memory of 880 1272 vpvdj.exe ffrflrx.exe PID 1272 wrote to memory of 880 1272 vpvdj.exe ffrflrx.exe PID 1272 wrote to memory of 880 1272 vpvdj.exe ffrflrx.exe PID 1272 wrote to memory of 880 1272 vpvdj.exe ffrflrx.exe PID 880 wrote to memory of 1628 880 ffrflrx.exe lffxfxf.exe PID 880 wrote to memory of 1628 880 ffrflrx.exe lffxfxf.exe PID 880 wrote to memory of 1628 880 ffrflrx.exe lffxfxf.exe PID 880 wrote to memory of 1628 880 ffrflrx.exe lffxfxf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\12b4e17fbd17bddb1c2ab956cb8967b52dcb84a47b876b360feedef324e88603_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\12b4e17fbd17bddb1c2ab956cb8967b52dcb84a47b876b360feedef324e88603_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\5fllrxl.exec:\5fllrxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5frrxfl.exec:\5frrxfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\htbbtn.exec:\htbbtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlflfff.exec:\rlflfff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnttbt.exec:\tnttbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbhhnn.exec:\hbhhnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jppjd.exec:\jppjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrlxfff.exec:\xrlxfff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7hbthn.exec:\7hbthn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjvjd.exec:\pjvjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxrrxlx.exec:\lxrrxlx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrrfxlf.exec:\lrrfxlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbhhnn.exec:\hbhhnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpvdj.exec:\vpvdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffrflrx.exec:\ffrflrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lffxfxf.exec:\lffxfxf.exe17⤵
- Executes dropped EXE
-
\??\c:\btbhnb.exec:\btbhnb.exe18⤵
- Executes dropped EXE
-
\??\c:\djpdd.exec:\djpdd.exe19⤵
- Executes dropped EXE
-
\??\c:\5rfrxlr.exec:\5rfrxlr.exe20⤵
- Executes dropped EXE
-
\??\c:\fffflxl.exec:\fffflxl.exe21⤵
- Executes dropped EXE
-
\??\c:\thbbbh.exec:\thbbbh.exe22⤵
- Executes dropped EXE
-
\??\c:\ppjdj.exec:\ppjdj.exe23⤵
- Executes dropped EXE
-
\??\c:\1xrrxxf.exec:\1xrrxxf.exe24⤵
- Executes dropped EXE
-
\??\c:\nbhhnn.exec:\nbhhnn.exe25⤵
- Executes dropped EXE
-
\??\c:\dvdvd.exec:\dvdvd.exe26⤵
- Executes dropped EXE
-
\??\c:\9xllrxf.exec:\9xllrxf.exe27⤵
- Executes dropped EXE
-
\??\c:\nhtbnh.exec:\nhtbnh.exe28⤵
- Executes dropped EXE
-
\??\c:\bntbhh.exec:\bntbhh.exe29⤵
- Executes dropped EXE
-
\??\c:\rlffrlr.exec:\rlffrlr.exe30⤵
- Executes dropped EXE
-
\??\c:\3hbbhn.exec:\3hbbhn.exe31⤵
- Executes dropped EXE
-
\??\c:\7flrxfr.exec:\7flrxfr.exe32⤵
- Executes dropped EXE
-
\??\c:\hbnhhh.exec:\hbnhhh.exe33⤵
- Executes dropped EXE
-
\??\c:\btbbbb.exec:\btbbbb.exe34⤵
- Executes dropped EXE
-
\??\c:\jdvpd.exec:\jdvpd.exe35⤵
- Executes dropped EXE
-
\??\c:\rrxxfxf.exec:\rrxxfxf.exe36⤵
- Executes dropped EXE
-
\??\c:\5xlffff.exec:\5xlffff.exe37⤵
- Executes dropped EXE
-
\??\c:\ththnb.exec:\ththnb.exe38⤵
- Executes dropped EXE
-
\??\c:\1dppv.exec:\1dppv.exe39⤵
- Executes dropped EXE
-
\??\c:\jvppp.exec:\jvppp.exe40⤵
- Executes dropped EXE
-
\??\c:\lfffrrf.exec:\lfffrrf.exe41⤵
- Executes dropped EXE
-
\??\c:\rlfrfff.exec:\rlfrfff.exe42⤵
- Executes dropped EXE
-
\??\c:\bbnnbb.exec:\bbnnbb.exe43⤵
- Executes dropped EXE
-
\??\c:\9thhbh.exec:\9thhbh.exe44⤵
- Executes dropped EXE
-
\??\c:\jjjpd.exec:\jjjpd.exe45⤵
- Executes dropped EXE
-
\??\c:\1rffflx.exec:\1rffflx.exe46⤵
- Executes dropped EXE
-
\??\c:\rfrlllx.exec:\rfrlllx.exe47⤵
- Executes dropped EXE
-
\??\c:\hbttbh.exec:\hbttbh.exe48⤵
- Executes dropped EXE
-
\??\c:\jjvvj.exec:\jjvvj.exe49⤵
- Executes dropped EXE
-
\??\c:\dvpjp.exec:\dvpjp.exe50⤵
- Executes dropped EXE
-
\??\c:\rfxxfff.exec:\rfxxfff.exe51⤵
- Executes dropped EXE
-
\??\c:\9xxxrxl.exec:\9xxxrxl.exe52⤵
- Executes dropped EXE
-
\??\c:\hhttht.exec:\hhttht.exe53⤵
- Executes dropped EXE
-
\??\c:\vdpjp.exec:\vdpjp.exe54⤵
- Executes dropped EXE
-
\??\c:\vpddd.exec:\vpddd.exe55⤵
- Executes dropped EXE
-
\??\c:\5frllrx.exec:\5frllrx.exe56⤵
- Executes dropped EXE
-
\??\c:\nnbhtb.exec:\nnbhtb.exe57⤵
- Executes dropped EXE
-
\??\c:\3pdpv.exec:\3pdpv.exe58⤵
- Executes dropped EXE
-
\??\c:\vvvvj.exec:\vvvvj.exe59⤵
- Executes dropped EXE
-
\??\c:\ffrfllx.exec:\ffrfllx.exe60⤵
- Executes dropped EXE
-
\??\c:\rlrrxfl.exec:\rlrrxfl.exe61⤵
- Executes dropped EXE
-
\??\c:\5hthnt.exec:\5hthnt.exe62⤵
- Executes dropped EXE
-
\??\c:\jjdpd.exec:\jjdpd.exe63⤵
- Executes dropped EXE
-
\??\c:\vpddj.exec:\vpddj.exe64⤵
- Executes dropped EXE
-
\??\c:\frxrrrx.exec:\frxrrrx.exe65⤵
- Executes dropped EXE
-
\??\c:\lfxlffl.exec:\lfxlffl.exe66⤵
-
\??\c:\hhtnnt.exec:\hhtnnt.exe67⤵
-
\??\c:\9ppdd.exec:\9ppdd.exe68⤵
-
\??\c:\jdppd.exec:\jdppd.exe69⤵
-
\??\c:\rlxfrxf.exec:\rlxfrxf.exe70⤵
-
\??\c:\tnnbnt.exec:\tnnbnt.exe71⤵
-
\??\c:\nhnntt.exec:\nhnntt.exe72⤵
-
\??\c:\dvjpj.exec:\dvjpj.exe73⤵
-
\??\c:\rrlrflr.exec:\rrlrflr.exe74⤵
-
\??\c:\xrlrxlr.exec:\xrlrxlr.exe75⤵
-
\??\c:\bnhtnt.exec:\bnhtnt.exe76⤵
-
\??\c:\bttthn.exec:\bttthn.exe77⤵
-
\??\c:\vpjpv.exec:\vpjpv.exe78⤵
-
\??\c:\5jvdp.exec:\5jvdp.exe79⤵
-
\??\c:\5fxrrrx.exec:\5fxrrrx.exe80⤵
-
\??\c:\9xrlrrr.exec:\9xrlrrr.exe81⤵
-
\??\c:\btbhtt.exec:\btbhtt.exe82⤵
-
\??\c:\5djpv.exec:\5djpv.exe83⤵
-
\??\c:\dvdpj.exec:\dvdpj.exe84⤵
-
\??\c:\lfffrlx.exec:\lfffrlx.exe85⤵
-
\??\c:\hbntbn.exec:\hbntbn.exe86⤵
-
\??\c:\hbnntt.exec:\hbnntt.exe87⤵
-
\??\c:\dvjpd.exec:\dvjpd.exe88⤵
-
\??\c:\jdppd.exec:\jdppd.exe89⤵
-
\??\c:\lxffxxr.exec:\lxffxxr.exe90⤵
-
\??\c:\fxlrflr.exec:\fxlrflr.exe91⤵
-
\??\c:\7bttbh.exec:\7bttbh.exe92⤵
-
\??\c:\9pvvp.exec:\9pvvp.exe93⤵
-
\??\c:\dpjjv.exec:\dpjjv.exe94⤵
-
\??\c:\1flrffl.exec:\1flrffl.exe95⤵
-
\??\c:\3xrrlxl.exec:\3xrrlxl.exe96⤵
-
\??\c:\1bttht.exec:\1bttht.exe97⤵
-
\??\c:\tnbbhn.exec:\tnbbhn.exe98⤵
-
\??\c:\9dvvv.exec:\9dvvv.exe99⤵
-
\??\c:\5pjjp.exec:\5pjjp.exe100⤵
-
\??\c:\9xrrrxf.exec:\9xrrrxf.exe101⤵
-
\??\c:\9bbnhb.exec:\9bbnhb.exe102⤵
-
\??\c:\hthhtn.exec:\hthhtn.exe103⤵
-
\??\c:\pdpvd.exec:\pdpvd.exe104⤵
-
\??\c:\pdjdj.exec:\pdjdj.exe105⤵
-
\??\c:\fxxxlll.exec:\fxxxlll.exe106⤵
-
\??\c:\1ththn.exec:\1ththn.exe107⤵
-
\??\c:\nhttbt.exec:\nhttbt.exe108⤵
-
\??\c:\9pvdj.exec:\9pvdj.exe109⤵
-
\??\c:\5fxflrx.exec:\5fxflrx.exe110⤵
-
\??\c:\3lrxxfr.exec:\3lrxxfr.exe111⤵
-
\??\c:\5bttbn.exec:\5bttbn.exe112⤵
-
\??\c:\nhbhbt.exec:\nhbhbt.exe113⤵
-
\??\c:\jppjj.exec:\jppjj.exe114⤵
-
\??\c:\vpjjp.exec:\vpjjp.exe115⤵
-
\??\c:\xrxxxxf.exec:\xrxxxxf.exe116⤵
-
\??\c:\rlllflx.exec:\rlllflx.exe117⤵
-
\??\c:\nhnntt.exec:\nhnntt.exe118⤵
-
\??\c:\jvjjj.exec:\jvjjj.exe119⤵
-
\??\c:\1jdpp.exec:\1jdpp.exe120⤵
-
\??\c:\frrrxrl.exec:\frrrxrl.exe121⤵
-
\??\c:\7nhhtt.exec:\7nhhtt.exe122⤵
-
\??\c:\tnttbb.exec:\tnttbb.exe123⤵
-
\??\c:\5jvdp.exec:\5jvdp.exe124⤵
-
\??\c:\jjppv.exec:\jjppv.exe125⤵
-
\??\c:\xrfxffr.exec:\xrfxffr.exe126⤵
-
\??\c:\5hbbnt.exec:\5hbbnt.exe127⤵
-
\??\c:\7nbbhh.exec:\7nbbhh.exe128⤵
-
\??\c:\vpdpd.exec:\vpdpd.exe129⤵
-
\??\c:\9jdjp.exec:\9jdjp.exe130⤵
-
\??\c:\1rffxxx.exec:\1rffxxx.exe131⤵
-
\??\c:\fxfflfx.exec:\fxfflfx.exe132⤵
-
\??\c:\1hbbtb.exec:\1hbbtb.exe133⤵
-
\??\c:\nhnhnn.exec:\nhnhnn.exe134⤵
-
\??\c:\7vjjp.exec:\7vjjp.exe135⤵
-
\??\c:\5frrrrf.exec:\5frrrrf.exe136⤵
-
\??\c:\1rxflfl.exec:\1rxflfl.exe137⤵
-
\??\c:\9nnntt.exec:\9nnntt.exe138⤵
-
\??\c:\vjdvv.exec:\vjdvv.exe139⤵
-
\??\c:\ddvjp.exec:\ddvjp.exe140⤵
-
\??\c:\rfrlrrx.exec:\rfrlrrx.exe141⤵
-
\??\c:\llfrlxl.exec:\llfrlxl.exe142⤵
-
\??\c:\nnhtnn.exec:\nnhtnn.exe143⤵
-
\??\c:\pjvvd.exec:\pjvvd.exe144⤵
-
\??\c:\9pjdd.exec:\9pjdd.exe145⤵
-
\??\c:\fxfflrx.exec:\fxfflrx.exe146⤵
-
\??\c:\httbnn.exec:\httbnn.exe147⤵
-
\??\c:\7nbbbh.exec:\7nbbbh.exe148⤵
-
\??\c:\5jdjj.exec:\5jdjj.exe149⤵
-
\??\c:\pjjvv.exec:\pjjvv.exe150⤵
-
\??\c:\rlflffl.exec:\rlflffl.exe151⤵
-
\??\c:\9bhhnt.exec:\9bhhnt.exe152⤵
-
\??\c:\nhnnnn.exec:\nhnnnn.exe153⤵
-
\??\c:\5pjvv.exec:\5pjvv.exe154⤵
-
\??\c:\jdjjv.exec:\jdjjv.exe155⤵
-
\??\c:\llxxffl.exec:\llxxffl.exe156⤵
-
\??\c:\3rllxfl.exec:\3rllxfl.exe157⤵
-
\??\c:\thtbhh.exec:\thtbhh.exe158⤵
-
\??\c:\vjppj.exec:\vjppj.exe159⤵
-
\??\c:\ppjpd.exec:\ppjpd.exe160⤵
-
\??\c:\ffrxrfl.exec:\ffrxrfl.exe161⤵
-
\??\c:\bbhbht.exec:\bbhbht.exe162⤵
-
\??\c:\btntnh.exec:\btntnh.exe163⤵
-
\??\c:\1pddj.exec:\1pddj.exe164⤵
-
\??\c:\5rlrrfl.exec:\5rlrrfl.exe165⤵
-
\??\c:\9lfffff.exec:\9lfffff.exe166⤵
-
\??\c:\tntbnt.exec:\tntbnt.exe167⤵
-
\??\c:\thbhnn.exec:\thbhnn.exe168⤵
-
\??\c:\ddddj.exec:\ddddj.exe169⤵
-
\??\c:\frffxxx.exec:\frffxxx.exe170⤵
-
\??\c:\rlrfxxr.exec:\rlrfxxr.exe171⤵
-
\??\c:\hbhthn.exec:\hbhthn.exe172⤵
-
\??\c:\hbhtbb.exec:\hbhtbb.exe173⤵
-
\??\c:\jdddd.exec:\jdddd.exe174⤵
-
\??\c:\3ppvd.exec:\3ppvd.exe175⤵
-
\??\c:\1xrxfxf.exec:\1xrxfxf.exe176⤵
-
\??\c:\fxxfllf.exec:\fxxfllf.exe177⤵
-
\??\c:\hbnhtn.exec:\hbnhtn.exe178⤵
-
\??\c:\9tbhnh.exec:\9tbhnh.exe179⤵
-
\??\c:\1vvpd.exec:\1vvpd.exe180⤵
-
\??\c:\ffrflrf.exec:\ffrflrf.exe181⤵
-
\??\c:\5xlfllr.exec:\5xlfllr.exe182⤵
-
\??\c:\3bnbnb.exec:\3bnbnb.exe183⤵
-
\??\c:\bnhnnn.exec:\bnhnnn.exe184⤵
-
\??\c:\9vpdj.exec:\9vpdj.exe185⤵
-
\??\c:\jvjdp.exec:\jvjdp.exe186⤵
-
\??\c:\ffrxffl.exec:\ffrxffl.exe187⤵
-
\??\c:\xrfxlfl.exec:\xrfxlfl.exe188⤵
-
\??\c:\nhbnhh.exec:\nhbnhh.exe189⤵
-
\??\c:\1ttbhh.exec:\1ttbhh.exe190⤵
-
\??\c:\5dvdj.exec:\5dvdj.exe191⤵
-
\??\c:\vpdjp.exec:\vpdjp.exe192⤵
-
\??\c:\frfxlff.exec:\frfxlff.exe193⤵
-
\??\c:\rfrlfxf.exec:\rfrlfxf.exe194⤵
-
\??\c:\9btbnb.exec:\9btbnb.exe195⤵
-
\??\c:\bbnntt.exec:\bbnntt.exe196⤵
-
\??\c:\pjpvp.exec:\pjpvp.exe197⤵
-
\??\c:\fxffrxf.exec:\fxffrxf.exe198⤵
-
\??\c:\lfllxxl.exec:\lfllxxl.exe199⤵
-
\??\c:\bbnbhn.exec:\bbnbhn.exe200⤵
-
\??\c:\btntht.exec:\btntht.exe201⤵
-
\??\c:\7jdjp.exec:\7jdjp.exe202⤵
-
\??\c:\9rfxrrf.exec:\9rfxrrf.exe203⤵
-
\??\c:\rrlxllr.exec:\rrlxllr.exe204⤵
-
\??\c:\nnhhtt.exec:\nnhhtt.exe205⤵
-
\??\c:\tnbhtt.exec:\tnbhtt.exe206⤵
-
\??\c:\jdvpv.exec:\jdvpv.exe207⤵
-
\??\c:\ppddp.exec:\ppddp.exe208⤵
-
\??\c:\5lxfxlx.exec:\5lxfxlx.exe209⤵
-
\??\c:\btnttn.exec:\btnttn.exe210⤵
-
\??\c:\nhtbnt.exec:\nhtbnt.exe211⤵
-
\??\c:\bthbhh.exec:\bthbhh.exe212⤵
-
\??\c:\5dpjp.exec:\5dpjp.exe213⤵
-
\??\c:\xxlxrrl.exec:\xxlxrrl.exe214⤵
-
\??\c:\fxlxlrf.exec:\fxlxlrf.exe215⤵
-
\??\c:\9hbttb.exec:\9hbttb.exe216⤵
-
\??\c:\bbtbtt.exec:\bbtbtt.exe217⤵
-
\??\c:\dvppv.exec:\dvppv.exe218⤵
-
\??\c:\5jvvj.exec:\5jvvj.exe219⤵
-
\??\c:\ffrflfr.exec:\ffrflfr.exe220⤵
-
\??\c:\lrfrflx.exec:\lrfrflx.exe221⤵
-
\??\c:\bhhnhh.exec:\bhhnhh.exe222⤵
-
\??\c:\1vvjd.exec:\1vvjd.exe223⤵
-
\??\c:\vpdjp.exec:\vpdjp.exe224⤵
-
\??\c:\fxlxlfr.exec:\fxlxlfr.exe225⤵
-
\??\c:\5rfrffr.exec:\5rfrffr.exe226⤵
-
\??\c:\tnhthh.exec:\tnhthh.exe227⤵
-
\??\c:\ppdjp.exec:\ppdjp.exe228⤵
-
\??\c:\jdpdd.exec:\jdpdd.exe229⤵
-
\??\c:\rrlrfxf.exec:\rrlrfxf.exe230⤵
-
\??\c:\5bntbh.exec:\5bntbh.exe231⤵
-
\??\c:\1nbbbb.exec:\1nbbbb.exe232⤵
-
\??\c:\hbthnh.exec:\hbthnh.exe233⤵
-
\??\c:\1vpvd.exec:\1vpvd.exe234⤵
-
\??\c:\rlffllr.exec:\rlffllr.exe235⤵
-
\??\c:\rlxfrlr.exec:\rlxfrlr.exe236⤵
-
\??\c:\tthhnb.exec:\tthhnb.exe237⤵
-
\??\c:\9hbtbb.exec:\9hbtbb.exe238⤵
-
\??\c:\pjddp.exec:\pjddp.exe239⤵
-
\??\c:\1dvvv.exec:\1dvvv.exe240⤵
-
\??\c:\1frrxxl.exec:\1frrxxl.exe241⤵