Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 10:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
491fc6143d8987ce5f395429657954f5a4655b202a7e3a7672430c1fa44007c3_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
491fc6143d8987ce5f395429657954f5a4655b202a7e3a7672430c1fa44007c3_NeikiAnalytics.exe
-
Size
58KB
-
MD5
5a2e422c5a90318ed7b69b7310d1d950
-
SHA1
9001acba197208c9b0597f15358c87d206bf922b
-
SHA256
491fc6143d8987ce5f395429657954f5a4655b202a7e3a7672430c1fa44007c3
-
SHA512
ec06b1ca389864fee7ffa2ee33ad690098b806b7aa1bbffb5ebc31b2f14da86a7f380cd0e2d43d39534e9eee6bd987e070add58e71002d227780be013f9753bf
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIF+AV:ymb3NkkiQ3mdBjFIF+AV
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/2368-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1608-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1508-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1800-25-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2420-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3292-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1800-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4300-50-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4616-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4300-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3940-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2040-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2424-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/632-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/776-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2112-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2644-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1996-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1464-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4600-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5084-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3980-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2808-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1264-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
7hnhbb.exevpvvp.exedvdvv.exerffrflx.exenbbbbh.exebttnht.exepvdvv.exerxfffff.exenhnnnn.exevpddj.exelfrxflr.exettbhtb.exe7jvpj.exerlffxll.exe9nbnhh.exeddddv.exedvdvp.exerlrlfff.exe5hnnnt.exe3bbbhn.exerlfxrlf.exefxxrrrl.exennbnnt.exe5dpvp.exefxfxxxx.exejdppj.exefflrxlx.exetbhbht.exedddvd.exelfrrflf.exethbtnt.exedjpjd.exellfxlxf.exettnttt.exebthnbb.exevpvvp.exelxxlxrl.exebbbhbn.exetnhbtn.exejjdjv.exe5ffxlll.exethbtnt.exe9jppd.exepppdd.exe7fllfff.exe5hhbtt.exejjddp.exetbhbhh.exenbbbbh.exepvjvp.exebtnbbb.exettnhtb.exefxxrllf.exennntbh.exethhbtt.exeppjjj.exefxrlffx.exebhtbbb.exenntnhh.exevdddd.exebtntbb.exenbbhhh.exedpjdd.exelfrlllf.exepid process 1608 7hnhbb.exe 1800 vpvvp.exe 1508 dvdvv.exe 3292 rffrflx.exe 2420 nbbbbh.exe 4300 bttnht.exe 4616 pvdvv.exe 3940 rxfffff.exe 2040 nhnnnn.exe 4992 vpddj.exe 2424 lfrxflr.exe 3160 ttbhtb.exe 632 7jvpj.exe 776 rlffxll.exe 2112 9nbnhh.exe 1548 ddddv.exe 2644 dvdvp.exe 4724 rlrlfff.exe 1996 5hnnnt.exe 1464 3bbbhn.exe 4608 rlfxrlf.exe 4600 fxxrrrl.exe 5084 nnbnnt.exe 1004 5dpvp.exe 3980 fxfxxxx.exe 5016 jdppj.exe 2140 fflrxlx.exe 2624 tbhbht.exe 2808 dddvd.exe 3992 lfrrflf.exe 1264 thbtnt.exe 1976 djpjd.exe 936 llfxlxf.exe 956 ttnttt.exe 2932 bthnbb.exe 2076 vpvvp.exe 4464 lxxlxrl.exe 3728 bbbhbn.exe 2792 tnhbtn.exe 1952 jjdjv.exe 2752 5ffxlll.exe 1524 thbtnt.exe 516 9jppd.exe 1476 pppdd.exe 100 7fllfff.exe 2200 5hhbtt.exe 1928 jjddp.exe 4376 tbhbhh.exe 1948 nbbbbh.exe 2444 pvjvp.exe 1608 btnbbb.exe 3976 ttnhtb.exe 4904 fxxrllf.exe 1204 nnntbh.exe 1540 thhbtt.exe 2864 ppjjj.exe 2992 fxrlffx.exe 3288 bhtbbb.exe 5036 nntnhh.exe 3224 vdddd.exe 3268 btntbb.exe 2040 nbbhhh.exe 1412 dpjdd.exe 2968 lfrlllf.exe -
Processes:
resource yara_rule behavioral2/memory/2368-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1508-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2420-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3292-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1800-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4300-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3940-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2040-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2424-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/632-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/776-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2112-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2644-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1464-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4600-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3980-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2808-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1264-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
491fc6143d8987ce5f395429657954f5a4655b202a7e3a7672430c1fa44007c3_NeikiAnalytics.exe7hnhbb.exevpvvp.exedvdvv.exerffrflx.exenbbbbh.exebttnht.exepvdvv.exerxfffff.exenhnnnn.exevpddj.exelfrxflr.exettbhtb.exe7jvpj.exerlffxll.exe9nbnhh.exeddddv.exedvdvp.exerlrlfff.exe5hnnnt.exe3bbbhn.exerlfxrlf.exedescription pid process target process PID 2368 wrote to memory of 1608 2368 491fc6143d8987ce5f395429657954f5a4655b202a7e3a7672430c1fa44007c3_NeikiAnalytics.exe 7hnhbb.exe PID 2368 wrote to memory of 1608 2368 491fc6143d8987ce5f395429657954f5a4655b202a7e3a7672430c1fa44007c3_NeikiAnalytics.exe 7hnhbb.exe PID 2368 wrote to memory of 1608 2368 491fc6143d8987ce5f395429657954f5a4655b202a7e3a7672430c1fa44007c3_NeikiAnalytics.exe 7hnhbb.exe PID 1608 wrote to memory of 1800 1608 7hnhbb.exe vpvvp.exe PID 1608 wrote to memory of 1800 1608 7hnhbb.exe vpvvp.exe PID 1608 wrote to memory of 1800 1608 7hnhbb.exe vpvvp.exe PID 1800 wrote to memory of 1508 1800 vpvvp.exe dvdvv.exe PID 1800 wrote to memory of 1508 1800 vpvvp.exe dvdvv.exe PID 1800 wrote to memory of 1508 1800 vpvvp.exe dvdvv.exe PID 1508 wrote to memory of 3292 1508 dvdvv.exe rffrflx.exe PID 1508 wrote to memory of 3292 1508 dvdvv.exe rffrflx.exe PID 1508 wrote to memory of 3292 1508 dvdvv.exe rffrflx.exe PID 3292 wrote to memory of 2420 3292 rffrflx.exe nbbbbh.exe PID 3292 wrote to memory of 2420 3292 rffrflx.exe nbbbbh.exe PID 3292 wrote to memory of 2420 3292 rffrflx.exe nbbbbh.exe PID 2420 wrote to memory of 4300 2420 nbbbbh.exe bttnht.exe PID 2420 wrote to memory of 4300 2420 nbbbbh.exe bttnht.exe PID 2420 wrote to memory of 4300 2420 nbbbbh.exe bttnht.exe PID 4300 wrote to memory of 4616 4300 bttnht.exe pvdvv.exe PID 4300 wrote to memory of 4616 4300 bttnht.exe pvdvv.exe PID 4300 wrote to memory of 4616 4300 bttnht.exe pvdvv.exe PID 4616 wrote to memory of 3940 4616 pvdvv.exe rxfffff.exe PID 4616 wrote to memory of 3940 4616 pvdvv.exe rxfffff.exe PID 4616 wrote to memory of 3940 4616 pvdvv.exe rxfffff.exe PID 3940 wrote to memory of 2040 3940 rxfffff.exe nhnnnn.exe PID 3940 wrote to memory of 2040 3940 rxfffff.exe nhnnnn.exe PID 3940 wrote to memory of 2040 3940 rxfffff.exe nhnnnn.exe PID 2040 wrote to memory of 4992 2040 nhnnnn.exe vpddj.exe PID 2040 wrote to memory of 4992 2040 nhnnnn.exe vpddj.exe PID 2040 wrote to memory of 4992 2040 nhnnnn.exe vpddj.exe PID 4992 wrote to memory of 2424 4992 vpddj.exe lfrxflr.exe PID 4992 wrote to memory of 2424 4992 vpddj.exe lfrxflr.exe PID 4992 wrote to memory of 2424 4992 vpddj.exe lfrxflr.exe PID 2424 wrote to memory of 3160 2424 lfrxflr.exe ttbhtb.exe PID 2424 wrote to memory of 3160 2424 lfrxflr.exe ttbhtb.exe PID 2424 wrote to memory of 3160 2424 lfrxflr.exe ttbhtb.exe PID 3160 wrote to memory of 632 3160 ttbhtb.exe 7jvpj.exe PID 3160 wrote to memory of 632 3160 ttbhtb.exe 7jvpj.exe PID 3160 wrote to memory of 632 3160 ttbhtb.exe 7jvpj.exe PID 632 wrote to memory of 776 632 7jvpj.exe rlffxll.exe PID 632 wrote to memory of 776 632 7jvpj.exe rlffxll.exe PID 632 wrote to memory of 776 632 7jvpj.exe rlffxll.exe PID 776 wrote to memory of 2112 776 rlffxll.exe 9nbnhh.exe PID 776 wrote to memory of 2112 776 rlffxll.exe 9nbnhh.exe PID 776 wrote to memory of 2112 776 rlffxll.exe 9nbnhh.exe PID 2112 wrote to memory of 1548 2112 9nbnhh.exe ddddv.exe PID 2112 wrote to memory of 1548 2112 9nbnhh.exe ddddv.exe PID 2112 wrote to memory of 1548 2112 9nbnhh.exe ddddv.exe PID 1548 wrote to memory of 2644 1548 ddddv.exe dvdvp.exe PID 1548 wrote to memory of 2644 1548 ddddv.exe dvdvp.exe PID 1548 wrote to memory of 2644 1548 ddddv.exe dvdvp.exe PID 2644 wrote to memory of 4724 2644 dvdvp.exe rlrlfff.exe PID 2644 wrote to memory of 4724 2644 dvdvp.exe rlrlfff.exe PID 2644 wrote to memory of 4724 2644 dvdvp.exe rlrlfff.exe PID 4724 wrote to memory of 1996 4724 rlrlfff.exe 5hnnnt.exe PID 4724 wrote to memory of 1996 4724 rlrlfff.exe 5hnnnt.exe PID 4724 wrote to memory of 1996 4724 rlrlfff.exe 5hnnnt.exe PID 1996 wrote to memory of 1464 1996 5hnnnt.exe 3bbbhn.exe PID 1996 wrote to memory of 1464 1996 5hnnnt.exe 3bbbhn.exe PID 1996 wrote to memory of 1464 1996 5hnnnt.exe 3bbbhn.exe PID 1464 wrote to memory of 4608 1464 3bbbhn.exe rlfxrlf.exe PID 1464 wrote to memory of 4608 1464 3bbbhn.exe rlfxrlf.exe PID 1464 wrote to memory of 4608 1464 3bbbhn.exe rlfxrlf.exe PID 4608 wrote to memory of 4600 4608 rlfxrlf.exe fxxrrrl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\491fc6143d8987ce5f395429657954f5a4655b202a7e3a7672430c1fa44007c3_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\491fc6143d8987ce5f395429657954f5a4655b202a7e3a7672430c1fa44007c3_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\7hnhbb.exec:\7hnhbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpvvp.exec:\vpvvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvdvv.exec:\dvdvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rffrflx.exec:\rffrflx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbbbbh.exec:\nbbbbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bttnht.exec:\bttnht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvdvv.exec:\pvdvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rxfffff.exec:\rxfffff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhnnnn.exec:\nhnnnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpddj.exec:\vpddj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfrxflr.exec:\lfrxflr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ttbhtb.exec:\ttbhtb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7jvpj.exec:\7jvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlffxll.exec:\rlffxll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9nbnhh.exec:\9nbnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddddv.exec:\ddddv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvdvp.exec:\dvdvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlrlfff.exec:\rlrlfff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5hnnnt.exec:\5hnnnt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3bbbhn.exec:\3bbbhn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlfxrlf.exec:\rlfxrlf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxxrrrl.exec:\fxxrrrl.exe23⤵
- Executes dropped EXE
-
\??\c:\nnbnnt.exec:\nnbnnt.exe24⤵
- Executes dropped EXE
-
\??\c:\5dpvp.exec:\5dpvp.exe25⤵
- Executes dropped EXE
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe26⤵
- Executes dropped EXE
-
\??\c:\jdppj.exec:\jdppj.exe27⤵
- Executes dropped EXE
-
\??\c:\fflrxlx.exec:\fflrxlx.exe28⤵
- Executes dropped EXE
-
\??\c:\tbhbht.exec:\tbhbht.exe29⤵
- Executes dropped EXE
-
\??\c:\dddvd.exec:\dddvd.exe30⤵
- Executes dropped EXE
-
\??\c:\lfrrflf.exec:\lfrrflf.exe31⤵
- Executes dropped EXE
-
\??\c:\thbtnt.exec:\thbtnt.exe32⤵
- Executes dropped EXE
-
\??\c:\djpjd.exec:\djpjd.exe33⤵
- Executes dropped EXE
-
\??\c:\llfxlxf.exec:\llfxlxf.exe34⤵
- Executes dropped EXE
-
\??\c:\ttnttt.exec:\ttnttt.exe35⤵
- Executes dropped EXE
-
\??\c:\bthnbb.exec:\bthnbb.exe36⤵
- Executes dropped EXE
-
\??\c:\vpvvp.exec:\vpvvp.exe37⤵
- Executes dropped EXE
-
\??\c:\lxxlxrl.exec:\lxxlxrl.exe38⤵
- Executes dropped EXE
-
\??\c:\bbbhbn.exec:\bbbhbn.exe39⤵
- Executes dropped EXE
-
\??\c:\tnhbtn.exec:\tnhbtn.exe40⤵
- Executes dropped EXE
-
\??\c:\jjdjv.exec:\jjdjv.exe41⤵
- Executes dropped EXE
-
\??\c:\5ffxlll.exec:\5ffxlll.exe42⤵
- Executes dropped EXE
-
\??\c:\thbtnt.exec:\thbtnt.exe43⤵
- Executes dropped EXE
-
\??\c:\9jppd.exec:\9jppd.exe44⤵
- Executes dropped EXE
-
\??\c:\pppdd.exec:\pppdd.exe45⤵
- Executes dropped EXE
-
\??\c:\7fllfff.exec:\7fllfff.exe46⤵
- Executes dropped EXE
-
\??\c:\5hhbtt.exec:\5hhbtt.exe47⤵
- Executes dropped EXE
-
\??\c:\jjddp.exec:\jjddp.exe48⤵
- Executes dropped EXE
-
\??\c:\tbhbhh.exec:\tbhbhh.exe49⤵
- Executes dropped EXE
-
\??\c:\nbbbbh.exec:\nbbbbh.exe50⤵
- Executes dropped EXE
-
\??\c:\pvjvp.exec:\pvjvp.exe51⤵
- Executes dropped EXE
-
\??\c:\btnbbb.exec:\btnbbb.exe52⤵
- Executes dropped EXE
-
\??\c:\ttnhtb.exec:\ttnhtb.exe53⤵
- Executes dropped EXE
-
\??\c:\fxxrllf.exec:\fxxrllf.exe54⤵
- Executes dropped EXE
-
\??\c:\nnntbh.exec:\nnntbh.exe55⤵
- Executes dropped EXE
-
\??\c:\thhbtt.exec:\thhbtt.exe56⤵
- Executes dropped EXE
-
\??\c:\ppjjj.exec:\ppjjj.exe57⤵
- Executes dropped EXE
-
\??\c:\fxrlffx.exec:\fxrlffx.exe58⤵
- Executes dropped EXE
-
\??\c:\bhtbbb.exec:\bhtbbb.exe59⤵
- Executes dropped EXE
-
\??\c:\nntnhh.exec:\nntnhh.exe60⤵
- Executes dropped EXE
-
\??\c:\vdddd.exec:\vdddd.exe61⤵
- Executes dropped EXE
-
\??\c:\btntbb.exec:\btntbb.exe62⤵
- Executes dropped EXE
-
\??\c:\nbbhhh.exec:\nbbhhh.exe63⤵
- Executes dropped EXE
-
\??\c:\dpjdd.exec:\dpjdd.exe64⤵
- Executes dropped EXE
-
\??\c:\lfrlllf.exec:\lfrlllf.exe65⤵
- Executes dropped EXE
-
\??\c:\bbnhnn.exec:\bbnhnn.exe66⤵
-
\??\c:\nhhttn.exec:\nhhttn.exe67⤵
-
\??\c:\pdpdp.exec:\pdpdp.exe68⤵
-
\??\c:\rxrfxfx.exec:\rxrfxfx.exe69⤵
-
\??\c:\9nbbhh.exec:\9nbbhh.exe70⤵
-
\??\c:\pvdvp.exec:\pvdvp.exe71⤵
-
\??\c:\dddpj.exec:\dddpj.exe72⤵
-
\??\c:\rfllfff.exec:\rfllfff.exe73⤵
-
\??\c:\hnhthh.exec:\hnhthh.exe74⤵
-
\??\c:\bbtnhh.exec:\bbtnhh.exe75⤵
-
\??\c:\vppvv.exec:\vppvv.exe76⤵
-
\??\c:\1xrlfxr.exec:\1xrlfxr.exe77⤵
-
\??\c:\bnnnbb.exec:\bnnnbb.exe78⤵
-
\??\c:\nhnbth.exec:\nhnbth.exe79⤵
-
\??\c:\pjdvd.exec:\pjdvd.exe80⤵
-
\??\c:\7rrlffx.exec:\7rrlffx.exe81⤵
-
\??\c:\lfrlrrl.exec:\lfrlrrl.exe82⤵
-
\??\c:\9hhhhh.exec:\9hhhhh.exe83⤵
-
\??\c:\hbtnhh.exec:\hbtnhh.exe84⤵
-
\??\c:\pjvvd.exec:\pjvvd.exe85⤵
-
\??\c:\ffffxfx.exec:\ffffxfx.exe86⤵
-
\??\c:\frrxrxx.exec:\frrxrxx.exe87⤵
-
\??\c:\httthh.exec:\httthh.exe88⤵
-
\??\c:\tnbnhb.exec:\tnbnhb.exe89⤵
-
\??\c:\vvddp.exec:\vvddp.exe90⤵
-
\??\c:\xrlfxrr.exec:\xrlfxrr.exe91⤵
-
\??\c:\hhhhbh.exec:\hhhhbh.exe92⤵
-
\??\c:\1hnhbh.exec:\1hnhbh.exe93⤵
-
\??\c:\dvvpv.exec:\dvvpv.exe94⤵
-
\??\c:\lxrrxlr.exec:\lxrrxlr.exe95⤵
-
\??\c:\htthht.exec:\htthht.exe96⤵
-
\??\c:\bnnhbt.exec:\bnnhbt.exe97⤵
-
\??\c:\pvddv.exec:\pvddv.exe98⤵
-
\??\c:\djvvp.exec:\djvvp.exe99⤵
-
\??\c:\xxfxrll.exec:\xxfxrll.exe100⤵
-
\??\c:\fxxrlll.exec:\fxxrlll.exe101⤵
-
\??\c:\9nttnn.exec:\9nttnn.exe102⤵
-
\??\c:\tbbbtt.exec:\tbbbtt.exe103⤵
-
\??\c:\3djpd.exec:\3djpd.exe104⤵
-
\??\c:\hhtnbb.exec:\hhtnbb.exe105⤵
-
\??\c:\thttnn.exec:\thttnn.exe106⤵
-
\??\c:\jpvvv.exec:\jpvvv.exe107⤵
-
\??\c:\xxrffxr.exec:\xxrffxr.exe108⤵
-
\??\c:\rlxflfr.exec:\rlxflfr.exe109⤵
-
\??\c:\1hbbbh.exec:\1hbbbh.exe110⤵
-
\??\c:\dvdvv.exec:\dvdvv.exe111⤵
-
\??\c:\7pdvp.exec:\7pdvp.exe112⤵
-
\??\c:\flrlffx.exec:\flrlffx.exe113⤵
-
\??\c:\9ttnnn.exec:\9ttnnn.exe114⤵
-
\??\c:\hnnnht.exec:\hnnnht.exe115⤵
-
\??\c:\jddvj.exec:\jddvj.exe116⤵
-
\??\c:\xlxrrrx.exec:\xlxrrrx.exe117⤵
-
\??\c:\3lllfxl.exec:\3lllfxl.exe118⤵
-
\??\c:\nbhbhb.exec:\nbhbhb.exe119⤵
-
\??\c:\tnnbnt.exec:\tnnbnt.exe120⤵
-
\??\c:\1vvvd.exec:\1vvvd.exe121⤵
-
\??\c:\pvppj.exec:\pvppj.exe122⤵
-
\??\c:\1xrrfxr.exec:\1xrrfxr.exe123⤵
-
\??\c:\tnnthb.exec:\tnnthb.exe124⤵
-
\??\c:\nbbnbb.exec:\nbbnbb.exe125⤵
-
\??\c:\9vddd.exec:\9vddd.exe126⤵
-
\??\c:\vdpdp.exec:\vdpdp.exe127⤵
-
\??\c:\rllfxxl.exec:\rllfxxl.exe128⤵
-
\??\c:\thhbht.exec:\thhbht.exe129⤵
-
\??\c:\9bhbtn.exec:\9bhbtn.exe130⤵
-
\??\c:\vvvpj.exec:\vvvpj.exe131⤵
-
\??\c:\vvjvp.exec:\vvjvp.exe132⤵
-
\??\c:\rxfxxrl.exec:\rxfxxrl.exe133⤵
-
\??\c:\hnhhbh.exec:\hnhhbh.exe134⤵
-
\??\c:\hbnnnn.exec:\hbnnnn.exe135⤵
-
\??\c:\pvvjj.exec:\pvvjj.exe136⤵
-
\??\c:\pvpdd.exec:\pvpdd.exe137⤵
-
\??\c:\dpddv.exec:\dpddv.exe138⤵
-
\??\c:\tbhbtt.exec:\tbhbtt.exe139⤵
-
\??\c:\bnhhtn.exec:\bnhhtn.exe140⤵
-
\??\c:\pjvpd.exec:\pjvpd.exe141⤵
-
\??\c:\djpdd.exec:\djpdd.exe142⤵
-
\??\c:\xrlxlxl.exec:\xrlxlxl.exe143⤵
-
\??\c:\nhnhbt.exec:\nhnhbt.exe144⤵
-
\??\c:\dpvpd.exec:\dpvpd.exe145⤵
-
\??\c:\3fxrffx.exec:\3fxrffx.exe146⤵
-
\??\c:\3tttbh.exec:\3tttbh.exe147⤵
-
\??\c:\bbbtnh.exec:\bbbtnh.exe148⤵
-
\??\c:\pvdpd.exec:\pvdpd.exe149⤵
-
\??\c:\djvpj.exec:\djvpj.exe150⤵
-
\??\c:\frxrflf.exec:\frxrflf.exe151⤵
-
\??\c:\7rrrrfx.exec:\7rrrrfx.exe152⤵
-
\??\c:\hbnhnn.exec:\hbnhnn.exe153⤵
-
\??\c:\ddddp.exec:\ddddp.exe154⤵
-
\??\c:\7vdvp.exec:\7vdvp.exe155⤵
-
\??\c:\lflxfxf.exec:\lflxfxf.exe156⤵
-
\??\c:\ntbbbb.exec:\ntbbbb.exe157⤵
-
\??\c:\nhtnbb.exec:\nhtnbb.exe158⤵
-
\??\c:\pjvpv.exec:\pjvpv.exe159⤵
-
\??\c:\vpvvp.exec:\vpvvp.exe160⤵
-
\??\c:\fxlrrxx.exec:\fxlrrxx.exe161⤵
-
\??\c:\nhbbtb.exec:\nhbbtb.exe162⤵
-
\??\c:\hthhtt.exec:\hthhtt.exe163⤵
-
\??\c:\pvppj.exec:\pvppj.exe164⤵
-
\??\c:\9vpjv.exec:\9vpjv.exe165⤵
-
\??\c:\fxxlfrr.exec:\fxxlfrr.exe166⤵
-
\??\c:\nbtntn.exec:\nbtntn.exe167⤵
-
\??\c:\pjdvp.exec:\pjdvp.exe168⤵
-
\??\c:\dpvpj.exec:\dpvpj.exe169⤵
-
\??\c:\dvjdv.exec:\dvjdv.exe170⤵
-
\??\c:\7lfxxrl.exec:\7lfxxrl.exe171⤵
-
\??\c:\xxrrlrr.exec:\xxrrlrr.exe172⤵
-
\??\c:\nbtbbb.exec:\nbtbbb.exe173⤵
-
\??\c:\nbttnn.exec:\nbttnn.exe174⤵
-
\??\c:\1thhnn.exec:\1thhnn.exe175⤵
-
\??\c:\1djdj.exec:\1djdj.exe176⤵
-
\??\c:\jvpjd.exec:\jvpjd.exe177⤵
-
\??\c:\xlrlffx.exec:\xlrlffx.exe178⤵
-
\??\c:\9llfrlx.exec:\9llfrlx.exe179⤵
-
\??\c:\lrffxxr.exec:\lrffxxr.exe180⤵
-
\??\c:\tnhhhh.exec:\tnhhhh.exe181⤵
-
\??\c:\hthntt.exec:\hthntt.exe182⤵
-
\??\c:\vvddv.exec:\vvddv.exe183⤵
-
\??\c:\1vddp.exec:\1vddp.exe184⤵
-
\??\c:\7xxrrrx.exec:\7xxrrrx.exe185⤵
-
\??\c:\7rlxxff.exec:\7rlxxff.exe186⤵
-
\??\c:\tntnnn.exec:\tntnnn.exe187⤵
-
\??\c:\btthbb.exec:\btthbb.exe188⤵
-
\??\c:\htthbb.exec:\htthbb.exe189⤵
-
\??\c:\5vjjd.exec:\5vjjd.exe190⤵
-
\??\c:\9jdvp.exec:\9jdvp.exe191⤵
-
\??\c:\xllfrrr.exec:\xllfrrr.exe192⤵
-
\??\c:\llrlllf.exec:\llrlllf.exe193⤵
-
\??\c:\9dvdj.exec:\9dvdj.exe194⤵
-
\??\c:\jdvpd.exec:\jdvpd.exe195⤵
-
\??\c:\jppdp.exec:\jppdp.exe196⤵
-
\??\c:\rrlllfr.exec:\rrlllfr.exe197⤵
-
\??\c:\vvdvd.exec:\vvdvd.exe198⤵
-
\??\c:\xrrlfff.exec:\xrrlfff.exe199⤵
-
\??\c:\xflrlll.exec:\xflrlll.exe200⤵
-
\??\c:\btbtnh.exec:\btbtnh.exe201⤵
-
\??\c:\jjvdj.exec:\jjvdj.exe202⤵
-
\??\c:\rrlfxrl.exec:\rrlfxrl.exe203⤵
-
\??\c:\hbhhhh.exec:\hbhhhh.exe204⤵
-
\??\c:\xxlxllf.exec:\xxlxllf.exe205⤵
-
\??\c:\pjjpj.exec:\pjjpj.exe206⤵
-
\??\c:\xfllrxx.exec:\xfllrxx.exe207⤵
-
\??\c:\9ffllll.exec:\9ffllll.exe208⤵
-
\??\c:\nhnnhh.exec:\nhnnhh.exe209⤵
-
\??\c:\nbnhbb.exec:\nbnhbb.exe210⤵
-
\??\c:\jvvpj.exec:\jvvpj.exe211⤵
-
\??\c:\rxxxrrr.exec:\rxxxrrr.exe212⤵
-
\??\c:\hbtnhh.exec:\hbtnhh.exe213⤵
-
\??\c:\tntbht.exec:\tntbht.exe214⤵
-
\??\c:\vjvjj.exec:\vjvjj.exe215⤵
-
\??\c:\ffllrrf.exec:\ffllrrf.exe216⤵
-
\??\c:\fxllrrf.exec:\fxllrrf.exe217⤵
-
\??\c:\9bhhnn.exec:\9bhhnn.exe218⤵
-
\??\c:\vvjjj.exec:\vvjjj.exe219⤵
-
\??\c:\pjppj.exec:\pjppj.exe220⤵
-
\??\c:\rrlxrfr.exec:\rrlxrfr.exe221⤵
-
\??\c:\hntnbt.exec:\hntnbt.exe222⤵
-
\??\c:\ppppp.exec:\ppppp.exe223⤵
-
\??\c:\5lxfrxl.exec:\5lxfrxl.exe224⤵
-
\??\c:\rfrrlrr.exec:\rfrrlrr.exe225⤵
-
\??\c:\tnbbbb.exec:\tnbbbb.exe226⤵
-
\??\c:\jdpjj.exec:\jdpjj.exe227⤵
-
\??\c:\ddpvj.exec:\ddpvj.exe228⤵
-
\??\c:\lflfrrx.exec:\lflfrrx.exe229⤵
-
\??\c:\3ntntb.exec:\3ntntb.exe230⤵
-
\??\c:\btthtn.exec:\btthtn.exe231⤵
-
\??\c:\5vpdj.exec:\5vpdj.exe232⤵
-
\??\c:\dvvpj.exec:\dvvpj.exe233⤵
-
\??\c:\3rfrllr.exec:\3rfrllr.exe234⤵
-
\??\c:\bbbbtt.exec:\bbbbtt.exe235⤵
-
\??\c:\thnnhh.exec:\thnnhh.exe236⤵
-
\??\c:\ntnttn.exec:\ntnttn.exe237⤵
-
\??\c:\jvpjd.exec:\jvpjd.exe238⤵
-
\??\c:\ddjjj.exec:\ddjjj.exe239⤵
-
\??\c:\bntnhb.exec:\bntnhb.exe240⤵
-
\??\c:\dpppj.exec:\dpppj.exe241⤵