Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 23:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
11ea4d9a0c850ab178dc451be48295f0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
11ea4d9a0c850ab178dc451be48295f0_NeikiAnalytics.exe
-
Size
51KB
-
MD5
11ea4d9a0c850ab178dc451be48295f0
-
SHA1
b197bd3d6096180d2c7fa9550caf68b849cdc36c
-
SHA256
365fa78a418f1c9b9da2d3e82763d86d51f68868c7c508a6750d9cc58a8c918f
-
SHA512
da6e14988cd1f969095b0361397188fbc45fad548de433f8baebc9b9c5031a05c6d678fda099c82dcf885c0c70f9ed87d87d620a08ccc3839057626d8f7f5d84
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoYi:ymb3NkkiQ3mdBjFop
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/2172-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2172-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2220-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1988-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2452-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1668-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/760-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1432-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1644-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1496-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1720-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3068-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-306-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2220-1235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bpdrdp.exenrnbhb.exexjptj.exepjrbtl.exejpnht.exevrdnr.exexrnldf.exeffbvrtl.exejtxtpd.exehrvrnxn.exebxfnflt.exejrvlv.exelxhvrlx.exejhvdd.exejtxhp.exerpnnt.exefxrvdb.exexvhnxv.exeflbbprd.exepbndb.exenpfdf.exenjfdfh.exexntlbdb.exebbxxtv.exenvhtl.exelftrrhp.exerrjhlrt.exeplxrr.exedltbtn.exerlpvhn.exejjfnj.exetlvfvb.exepddrbn.exernjnlh.exeppfpx.exetnjdth.exejfjxb.exehxxxxb.exehdjxnb.exetvnhbpr.exeftbtdt.exetvnhjp.exevnffn.exenxpnrp.exexbhvnhx.exenbxfppj.exebnjhfr.exejfppx.exethpdvr.exehvbbv.exehhtdvnp.exebjddnpb.exepbnxp.exejlbjr.exeptplr.exedbjbxbj.exetvrnhnf.exeplxtffr.exetxvdnxh.exedljpv.exexnflpj.exejxnlt.exertltll.exenvdrdxp.exepid process 2172 bpdrdp.exe 1988 nrnbhb.exe 2880 xjptj.exe 1648 pjrbtl.exe 2568 jpnht.exe 2996 vrdnr.exe 2580 xrnldf.exe 2724 ffbvrtl.exe 2492 jtxtpd.exe 2452 hrvrnxn.exe 3016 bxfnflt.exe 1668 jrvlv.exe 760 lxhvrlx.exe 1432 jhvdd.exe 1644 jtxhp.exe 1532 rpnnt.exe 1212 fxrvdb.exe 1528 xvhnxv.exe 2684 flbbprd.exe 612 pbndb.exe 2128 npfdf.exe 2716 njfdfh.exe 440 xntlbdb.exe 1224 bbxxtv.exe 1496 nvhtl.exe 1840 lftrrhp.exe 1720 rrjhlrt.exe 900 plxrr.exe 3068 dltbtn.exe 3024 rlpvhn.exe 2120 jjfnj.exe 880 tlvfvb.exe 2136 pddrbn.exe 1912 rnjnlh.exe 2316 ppfpx.exe 2824 tnjdth.exe 2884 jfjxb.exe 1608 hxxxxb.exe 1704 hdjxnb.exe 2464 tvnhbpr.exe 3040 ftbtdt.exe 2576 tvnhjp.exe 2588 vnffn.exe 2528 nxpnrp.exe 2580 xbhvnhx.exe 1996 nbxfppj.exe 2380 bnjhfr.exe 2500 jfppx.exe 2852 thpdvr.exe 2360 hvbbv.exe 640 hhtdvnp.exe 1668 bjddnpb.exe 760 pbnxp.exe 2180 jlbjr.exe 752 ptplr.exe 1752 dbjbxbj.exe 1488 tvrnhnf.exe 1212 plxtffr.exe 2364 txvdnxh.exe 2556 dljpv.exe 2732 xnflpj.exe 1928 jxnlt.exe 2096 rtltll.exe 2468 nvdrdxp.exe -
Processes:
resource yara_rule behavioral1/memory/2172-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2172-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1988-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1668-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/760-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1432-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1644-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1496-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-306-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-1235-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
11ea4d9a0c850ab178dc451be48295f0_NeikiAnalytics.exebpdrdp.exenrnbhb.exexjptj.exepjrbtl.exejpnht.exevrdnr.exexrnldf.exeffbvrtl.exejtxtpd.exehrvrnxn.exebxfnflt.exejrvlv.exelxhvrlx.exejhvdd.exejtxhp.exedescription pid process target process PID 2220 wrote to memory of 2172 2220 11ea4d9a0c850ab178dc451be48295f0_NeikiAnalytics.exe bpdrdp.exe PID 2220 wrote to memory of 2172 2220 11ea4d9a0c850ab178dc451be48295f0_NeikiAnalytics.exe bpdrdp.exe PID 2220 wrote to memory of 2172 2220 11ea4d9a0c850ab178dc451be48295f0_NeikiAnalytics.exe bpdrdp.exe PID 2220 wrote to memory of 2172 2220 11ea4d9a0c850ab178dc451be48295f0_NeikiAnalytics.exe bpdrdp.exe PID 2172 wrote to memory of 1988 2172 bpdrdp.exe nrnbhb.exe PID 2172 wrote to memory of 1988 2172 bpdrdp.exe nrnbhb.exe PID 2172 wrote to memory of 1988 2172 bpdrdp.exe nrnbhb.exe PID 2172 wrote to memory of 1988 2172 bpdrdp.exe nrnbhb.exe PID 1988 wrote to memory of 2880 1988 nrnbhb.exe xjptj.exe PID 1988 wrote to memory of 2880 1988 nrnbhb.exe xjptj.exe PID 1988 wrote to memory of 2880 1988 nrnbhb.exe xjptj.exe PID 1988 wrote to memory of 2880 1988 nrnbhb.exe xjptj.exe PID 2880 wrote to memory of 1648 2880 xjptj.exe pjrbtl.exe PID 2880 wrote to memory of 1648 2880 xjptj.exe pjrbtl.exe PID 2880 wrote to memory of 1648 2880 xjptj.exe pjrbtl.exe PID 2880 wrote to memory of 1648 2880 xjptj.exe pjrbtl.exe PID 1648 wrote to memory of 2568 1648 pjrbtl.exe jpnht.exe PID 1648 wrote to memory of 2568 1648 pjrbtl.exe jpnht.exe PID 1648 wrote to memory of 2568 1648 pjrbtl.exe jpnht.exe PID 1648 wrote to memory of 2568 1648 pjrbtl.exe jpnht.exe PID 2568 wrote to memory of 2996 2568 jpnht.exe vrdnr.exe PID 2568 wrote to memory of 2996 2568 jpnht.exe vrdnr.exe PID 2568 wrote to memory of 2996 2568 jpnht.exe vrdnr.exe PID 2568 wrote to memory of 2996 2568 jpnht.exe vrdnr.exe PID 2996 wrote to memory of 2580 2996 vrdnr.exe xrnldf.exe PID 2996 wrote to memory of 2580 2996 vrdnr.exe xrnldf.exe PID 2996 wrote to memory of 2580 2996 vrdnr.exe xrnldf.exe PID 2996 wrote to memory of 2580 2996 vrdnr.exe xrnldf.exe PID 2580 wrote to memory of 2724 2580 xrnldf.exe ffbvrtl.exe PID 2580 wrote to memory of 2724 2580 xrnldf.exe ffbvrtl.exe PID 2580 wrote to memory of 2724 2580 xrnldf.exe ffbvrtl.exe PID 2580 wrote to memory of 2724 2580 xrnldf.exe ffbvrtl.exe PID 2724 wrote to memory of 2492 2724 ffbvrtl.exe jtxtpd.exe PID 2724 wrote to memory of 2492 2724 ffbvrtl.exe jtxtpd.exe PID 2724 wrote to memory of 2492 2724 ffbvrtl.exe jtxtpd.exe PID 2724 wrote to memory of 2492 2724 ffbvrtl.exe jtxtpd.exe PID 2492 wrote to memory of 2452 2492 jtxtpd.exe hrvrnxn.exe PID 2492 wrote to memory of 2452 2492 jtxtpd.exe hrvrnxn.exe PID 2492 wrote to memory of 2452 2492 jtxtpd.exe hrvrnxn.exe PID 2492 wrote to memory of 2452 2492 jtxtpd.exe hrvrnxn.exe PID 2452 wrote to memory of 3016 2452 hrvrnxn.exe bxfnflt.exe PID 2452 wrote to memory of 3016 2452 hrvrnxn.exe bxfnflt.exe PID 2452 wrote to memory of 3016 2452 hrvrnxn.exe bxfnflt.exe PID 2452 wrote to memory of 3016 2452 hrvrnxn.exe bxfnflt.exe PID 3016 wrote to memory of 1668 3016 bxfnflt.exe jrvlv.exe PID 3016 wrote to memory of 1668 3016 bxfnflt.exe jrvlv.exe PID 3016 wrote to memory of 1668 3016 bxfnflt.exe jrvlv.exe PID 3016 wrote to memory of 1668 3016 bxfnflt.exe jrvlv.exe PID 1668 wrote to memory of 760 1668 jrvlv.exe lxhvrlx.exe PID 1668 wrote to memory of 760 1668 jrvlv.exe lxhvrlx.exe PID 1668 wrote to memory of 760 1668 jrvlv.exe lxhvrlx.exe PID 1668 wrote to memory of 760 1668 jrvlv.exe lxhvrlx.exe PID 760 wrote to memory of 1432 760 lxhvrlx.exe jhvdd.exe PID 760 wrote to memory of 1432 760 lxhvrlx.exe jhvdd.exe PID 760 wrote to memory of 1432 760 lxhvrlx.exe jhvdd.exe PID 760 wrote to memory of 1432 760 lxhvrlx.exe jhvdd.exe PID 1432 wrote to memory of 1644 1432 jhvdd.exe jtxhp.exe PID 1432 wrote to memory of 1644 1432 jhvdd.exe jtxhp.exe PID 1432 wrote to memory of 1644 1432 jhvdd.exe jtxhp.exe PID 1432 wrote to memory of 1644 1432 jhvdd.exe jtxhp.exe PID 1644 wrote to memory of 1532 1644 jtxhp.exe rpnnt.exe PID 1644 wrote to memory of 1532 1644 jtxhp.exe rpnnt.exe PID 1644 wrote to memory of 1532 1644 jtxhp.exe rpnnt.exe PID 1644 wrote to memory of 1532 1644 jtxhp.exe rpnnt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\11ea4d9a0c850ab178dc451be48295f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\11ea4d9a0c850ab178dc451be48295f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\bpdrdp.exec:\bpdrdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nrnbhb.exec:\nrnbhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xjptj.exec:\xjptj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjrbtl.exec:\pjrbtl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpnht.exec:\jpnht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vrdnr.exec:\vrdnr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrnldf.exec:\xrnldf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffbvrtl.exec:\ffbvrtl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jtxtpd.exec:\jtxtpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hrvrnxn.exec:\hrvrnxn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bxfnflt.exec:\bxfnflt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jrvlv.exec:\jrvlv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxhvrlx.exec:\lxhvrlx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jhvdd.exec:\jhvdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jtxhp.exec:\jtxhp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rpnnt.exec:\rpnnt.exe17⤵
- Executes dropped EXE
-
\??\c:\fxrvdb.exec:\fxrvdb.exe18⤵
- Executes dropped EXE
-
\??\c:\xvhnxv.exec:\xvhnxv.exe19⤵
- Executes dropped EXE
-
\??\c:\flbbprd.exec:\flbbprd.exe20⤵
- Executes dropped EXE
-
\??\c:\pbndb.exec:\pbndb.exe21⤵
- Executes dropped EXE
-
\??\c:\npfdf.exec:\npfdf.exe22⤵
- Executes dropped EXE
-
\??\c:\njfdfh.exec:\njfdfh.exe23⤵
- Executes dropped EXE
-
\??\c:\xntlbdb.exec:\xntlbdb.exe24⤵
- Executes dropped EXE
-
\??\c:\bbxxtv.exec:\bbxxtv.exe25⤵
- Executes dropped EXE
-
\??\c:\nvhtl.exec:\nvhtl.exe26⤵
- Executes dropped EXE
-
\??\c:\lftrrhp.exec:\lftrrhp.exe27⤵
- Executes dropped EXE
-
\??\c:\rrjhlrt.exec:\rrjhlrt.exe28⤵
- Executes dropped EXE
-
\??\c:\plxrr.exec:\plxrr.exe29⤵
- Executes dropped EXE
-
\??\c:\dltbtn.exec:\dltbtn.exe30⤵
- Executes dropped EXE
-
\??\c:\rlpvhn.exec:\rlpvhn.exe31⤵
- Executes dropped EXE
-
\??\c:\jjfnj.exec:\jjfnj.exe32⤵
- Executes dropped EXE
-
\??\c:\tlvfvb.exec:\tlvfvb.exe33⤵
- Executes dropped EXE
-
\??\c:\pddrbn.exec:\pddrbn.exe34⤵
- Executes dropped EXE
-
\??\c:\rnjnlh.exec:\rnjnlh.exe35⤵
- Executes dropped EXE
-
\??\c:\ppfpx.exec:\ppfpx.exe36⤵
- Executes dropped EXE
-
\??\c:\tnjdth.exec:\tnjdth.exe37⤵
- Executes dropped EXE
-
\??\c:\jfjxb.exec:\jfjxb.exe38⤵
- Executes dropped EXE
-
\??\c:\hxxxxb.exec:\hxxxxb.exe39⤵
- Executes dropped EXE
-
\??\c:\hdjxnb.exec:\hdjxnb.exe40⤵
- Executes dropped EXE
-
\??\c:\tvnhbpr.exec:\tvnhbpr.exe41⤵
- Executes dropped EXE
-
\??\c:\ftbtdt.exec:\ftbtdt.exe42⤵
- Executes dropped EXE
-
\??\c:\tvnhjp.exec:\tvnhjp.exe43⤵
- Executes dropped EXE
-
\??\c:\vnffn.exec:\vnffn.exe44⤵
- Executes dropped EXE
-
\??\c:\nxpnrp.exec:\nxpnrp.exe45⤵
- Executes dropped EXE
-
\??\c:\xbhvnhx.exec:\xbhvnhx.exe46⤵
- Executes dropped EXE
-
\??\c:\nbxfppj.exec:\nbxfppj.exe47⤵
- Executes dropped EXE
-
\??\c:\bnjhfr.exec:\bnjhfr.exe48⤵
- Executes dropped EXE
-
\??\c:\jfppx.exec:\jfppx.exe49⤵
- Executes dropped EXE
-
\??\c:\thpdvr.exec:\thpdvr.exe50⤵
- Executes dropped EXE
-
\??\c:\hvbbv.exec:\hvbbv.exe51⤵
- Executes dropped EXE
-
\??\c:\hhtdvnp.exec:\hhtdvnp.exe52⤵
- Executes dropped EXE
-
\??\c:\bjddnpb.exec:\bjddnpb.exe53⤵
- Executes dropped EXE
-
\??\c:\pbnxp.exec:\pbnxp.exe54⤵
- Executes dropped EXE
-
\??\c:\jlbjr.exec:\jlbjr.exe55⤵
- Executes dropped EXE
-
\??\c:\ptplr.exec:\ptplr.exe56⤵
- Executes dropped EXE
-
\??\c:\dbjbxbj.exec:\dbjbxbj.exe57⤵
- Executes dropped EXE
-
\??\c:\tvrnhnf.exec:\tvrnhnf.exe58⤵
- Executes dropped EXE
-
\??\c:\plxtffr.exec:\plxtffr.exe59⤵
- Executes dropped EXE
-
\??\c:\txvdnxh.exec:\txvdnxh.exe60⤵
- Executes dropped EXE
-
\??\c:\dljpv.exec:\dljpv.exe61⤵
- Executes dropped EXE
-
\??\c:\xnflpj.exec:\xnflpj.exe62⤵
- Executes dropped EXE
-
\??\c:\jxnlt.exec:\jxnlt.exe63⤵
- Executes dropped EXE
-
\??\c:\rtltll.exec:\rtltll.exe64⤵
- Executes dropped EXE
-
\??\c:\nvdrdxp.exec:\nvdrdxp.exe65⤵
- Executes dropped EXE
-
\??\c:\bxvdv.exec:\bxvdv.exe66⤵
-
\??\c:\tphpt.exec:\tphpt.exe67⤵
-
\??\c:\xvprbt.exec:\xvprbt.exe68⤵
-
\??\c:\jrbnnr.exec:\jrbnnr.exe69⤵
-
\??\c:\ptjnhv.exec:\ptjnhv.exe70⤵
-
\??\c:\hbvljjj.exec:\hbvljjj.exe71⤵
-
\??\c:\fjxrjf.exec:\fjxrjf.exe72⤵
-
\??\c:\hnrdhvj.exec:\hnrdhvj.exe73⤵
-
\??\c:\phtxtdx.exec:\phtxtdx.exe74⤵
-
\??\c:\fvfltd.exec:\fvfltd.exe75⤵
-
\??\c:\xhbnvlv.exec:\xhbnvlv.exe76⤵
-
\??\c:\fjttr.exec:\fjttr.exe77⤵
-
\??\c:\vjjbhjt.exec:\vjjbhjt.exe78⤵
-
\??\c:\jrdlnpv.exec:\jrdlnpv.exe79⤵
-
\??\c:\jbrlpbf.exec:\jbrlpbf.exe80⤵
-
\??\c:\dvxtjl.exec:\dvxtjl.exe81⤵
-
\??\c:\rbjfrnf.exec:\rbjfrnf.exe82⤵
-
\??\c:\prpvr.exec:\prpvr.exe83⤵
-
\??\c:\xfpxxb.exec:\xfpxxb.exe84⤵
-
\??\c:\vrbbtxf.exec:\vrbbtxf.exe85⤵
-
\??\c:\rndxd.exec:\rndxd.exe86⤵
-
\??\c:\hjxbj.exec:\hjxbj.exe87⤵
-
\??\c:\vftpvt.exec:\vftpvt.exe88⤵
-
\??\c:\tbpjjd.exec:\tbpjjd.exe89⤵
-
\??\c:\xlrxbnr.exec:\xlrxbnr.exe90⤵
-
\??\c:\ddhjb.exec:\ddhjb.exe91⤵
-
\??\c:\nxddljb.exec:\nxddljb.exe92⤵
-
\??\c:\nfnbb.exec:\nfnbb.exe93⤵
-
\??\c:\hdxbd.exec:\hdxbd.exe94⤵
-
\??\c:\xlvhd.exec:\xlvhd.exe95⤵
-
\??\c:\jxxrl.exec:\jxxrl.exe96⤵
-
\??\c:\ptvvfnr.exec:\ptvvfnr.exe97⤵
-
\??\c:\rphxlt.exec:\rphxlt.exe98⤵
-
\??\c:\pxbdtnt.exec:\pxbdtnt.exe99⤵
-
\??\c:\nrjttxl.exec:\nrjttxl.exe100⤵
-
\??\c:\rtflrl.exec:\rtflrl.exe101⤵
-
\??\c:\prjpbl.exec:\prjpbl.exe102⤵
-
\??\c:\xbjld.exec:\xbjld.exe103⤵
-
\??\c:\btbth.exec:\btbth.exe104⤵
-
\??\c:\hrhrpfv.exec:\hrhrpfv.exe105⤵
-
\??\c:\lrlfjjb.exec:\lrlfjjb.exe106⤵
-
\??\c:\bvxdr.exec:\bvxdr.exe107⤵
-
\??\c:\hpbfj.exec:\hpbfj.exe108⤵
-
\??\c:\lxhxvx.exec:\lxhxvx.exe109⤵
-
\??\c:\llxfr.exec:\llxfr.exe110⤵
-
\??\c:\nnnjftr.exec:\nnnjftr.exe111⤵
-
\??\c:\xtdfx.exec:\xtdfx.exe112⤵
-
\??\c:\fhxrbp.exec:\fhxrbp.exe113⤵
-
\??\c:\jxjljnb.exec:\jxjljnb.exe114⤵
-
\??\c:\rxdjv.exec:\rxdjv.exe115⤵
-
\??\c:\xjnrnl.exec:\xjnrnl.exe116⤵
-
\??\c:\bftdl.exec:\bftdl.exe117⤵
-
\??\c:\rhxvjvj.exec:\rhxvjvj.exe118⤵
-
\??\c:\hdtrtjn.exec:\hdtrtjn.exe119⤵
-
\??\c:\hpjnpb.exec:\hpjnpb.exe120⤵
-
\??\c:\vrbtpph.exec:\vrbtpph.exe121⤵
-
\??\c:\jvnxjjx.exec:\jvnxjjx.exe122⤵
-
\??\c:\vfhvb.exec:\vfhvb.exe123⤵
-
\??\c:\fxxfhrp.exec:\fxxfhrp.exe124⤵
-
\??\c:\ndrbdd.exec:\ndrbdd.exe125⤵
-
\??\c:\nlftxfh.exec:\nlftxfh.exe126⤵
-
\??\c:\vtfdn.exec:\vtfdn.exe127⤵
-
\??\c:\nlrvpb.exec:\nlrvpb.exe128⤵
-
\??\c:\npfxxv.exec:\npfxxv.exe129⤵
-
\??\c:\rlxhnhx.exec:\rlxhnhx.exe130⤵
-
\??\c:\bvhrbn.exec:\bvhrbn.exe131⤵
-
\??\c:\hjjtlld.exec:\hjjtlld.exe132⤵
-
\??\c:\xpxbrhx.exec:\xpxbrhx.exe133⤵
-
\??\c:\xhjrtxv.exec:\xhjrtxv.exe134⤵
-
\??\c:\nxfnvtv.exec:\nxfnvtv.exe135⤵
-
\??\c:\vfrhd.exec:\vfrhd.exe136⤵
-
\??\c:\jpxln.exec:\jpxln.exe137⤵
-
\??\c:\vxfrnjf.exec:\vxfrnjf.exe138⤵
-
\??\c:\nvfpvtx.exec:\nvfpvtx.exe139⤵
-
\??\c:\xxlrp.exec:\xxlrp.exe140⤵
-
\??\c:\djtlr.exec:\djtlr.exe141⤵
-
\??\c:\jbjbx.exec:\jbjbx.exe142⤵
-
\??\c:\bfbdx.exec:\bfbdx.exe143⤵
-
\??\c:\npplpdp.exec:\npplpdp.exe144⤵
-
\??\c:\dhxvb.exec:\dhxvb.exe145⤵
-
\??\c:\vxjxlnv.exec:\vxjxlnv.exe146⤵
-
\??\c:\xjdfn.exec:\xjdfn.exe147⤵
-
\??\c:\hjlvppf.exec:\hjlvppf.exe148⤵
-
\??\c:\rlvhbj.exec:\rlvhbj.exe149⤵
-
\??\c:\btjjr.exec:\btjjr.exe150⤵
-
\??\c:\nnhvn.exec:\nnhvn.exe151⤵
-
\??\c:\hjxflfn.exec:\hjxflfn.exe152⤵
-
\??\c:\vxjrr.exec:\vxjrr.exe153⤵
-
\??\c:\fjrhlxh.exec:\fjrhlxh.exe154⤵
-
\??\c:\ltrxdb.exec:\ltrxdb.exe155⤵
-
\??\c:\lxbjp.exec:\lxbjp.exe156⤵
-
\??\c:\ltnbl.exec:\ltnbl.exe157⤵
-
\??\c:\jbtfnfh.exec:\jbtfnfh.exe158⤵
-
\??\c:\nxrdj.exec:\nxrdj.exe159⤵
-
\??\c:\llrdv.exec:\llrdv.exe160⤵
-
\??\c:\pbnvfbj.exec:\pbnvfbj.exe161⤵
-
\??\c:\nfrvb.exec:\nfrvb.exe162⤵
-
\??\c:\hnvndf.exec:\hnvndf.exe163⤵
-
\??\c:\vvbhx.exec:\vvbhx.exe164⤵
-
\??\c:\tljvn.exec:\tljvn.exe165⤵
-
\??\c:\rhvpnf.exec:\rhvpnf.exe166⤵
-
\??\c:\xrbrtr.exec:\xrbrtr.exe167⤵
-
\??\c:\vtplvdj.exec:\vtplvdj.exe168⤵
-
\??\c:\hfjrfrl.exec:\hfjrfrl.exe169⤵
-
\??\c:\vtfjjt.exec:\vtfjjt.exe170⤵
-
\??\c:\djpjf.exec:\djpjf.exe171⤵
-
\??\c:\xbfjb.exec:\xbfjb.exe172⤵
-
\??\c:\xhbbhh.exec:\xhbbhh.exe173⤵
-
\??\c:\frbhdb.exec:\frbhdb.exe174⤵
-
\??\c:\xvrjb.exec:\xvrjb.exe175⤵
-
\??\c:\txtxhj.exec:\txtxhj.exe176⤵
-
\??\c:\vjtjl.exec:\vjtjl.exe177⤵
-
\??\c:\hndpdjh.exec:\hndpdjh.exe178⤵
-
\??\c:\drljlht.exec:\drljlht.exe179⤵
-
\??\c:\rdxlljl.exec:\rdxlljl.exe180⤵
-
\??\c:\jdfrj.exec:\jdfrj.exe181⤵
-
\??\c:\vrpjhr.exec:\vrpjhr.exe182⤵
-
\??\c:\txxpprr.exec:\txxpprr.exe183⤵
-
\??\c:\rtbnv.exec:\rtbnv.exe184⤵
-
\??\c:\hvtltj.exec:\hvtltj.exe185⤵
-
\??\c:\tlhrdj.exec:\tlhrdj.exe186⤵
-
\??\c:\pnrxvlj.exec:\pnrxvlj.exe187⤵
-
\??\c:\lxnhdnb.exec:\lxnhdnb.exe188⤵
-
\??\c:\thvvfrv.exec:\thvvfrv.exe189⤵
-
\??\c:\bnjtv.exec:\bnjtv.exe190⤵
-
\??\c:\hvbhjrv.exec:\hvbhjrv.exe191⤵
-
\??\c:\vhpnlh.exec:\vhpnlh.exe192⤵
-
\??\c:\jppnvh.exec:\jppnvh.exe193⤵
-
\??\c:\nrlpfh.exec:\nrlpfh.exe194⤵
-
\??\c:\tvnhdr.exec:\tvnhdr.exe195⤵
-
\??\c:\hdxvnp.exec:\hdxvnp.exe196⤵
-
\??\c:\lvlrv.exec:\lvlrv.exe197⤵
-
\??\c:\vdrldv.exec:\vdrldv.exe198⤵
-
\??\c:\jhnhhf.exec:\jhnhhf.exe199⤵
-
\??\c:\hjdpj.exec:\hjdpj.exe200⤵
-
\??\c:\lbltht.exec:\lbltht.exe201⤵
-
\??\c:\vxhlh.exec:\vxhlh.exe202⤵
-
\??\c:\fvdrx.exec:\fvdrx.exe203⤵
-
\??\c:\hjvlfrb.exec:\hjvlfrb.exe204⤵
-
\??\c:\bdxxpfd.exec:\bdxxpfd.exe205⤵
-
\??\c:\nrlbbnj.exec:\nrlbbnj.exe206⤵
-
\??\c:\tbplf.exec:\tbplf.exe207⤵
-
\??\c:\fnpbr.exec:\fnpbr.exe208⤵
-
\??\c:\jjrvhx.exec:\jjrvhx.exe209⤵
-
\??\c:\vndddnn.exec:\vndddnn.exe210⤵
-
\??\c:\jbxvfrv.exec:\jbxvfrv.exe211⤵
-
\??\c:\nnvfrn.exec:\nnvfrn.exe212⤵
-
\??\c:\pnvfr.exec:\pnvfr.exe213⤵
-
\??\c:\vdvfxt.exec:\vdvfxt.exe214⤵
-
\??\c:\rhlbj.exec:\rhlbj.exe215⤵
-
\??\c:\dpvjvp.exec:\dpvjvp.exe216⤵
-
\??\c:\tpxxpnp.exec:\tpxxpnp.exe217⤵
-
\??\c:\trttxl.exec:\trttxl.exe218⤵
-
\??\c:\ftthhpf.exec:\ftthhpf.exe219⤵
-
\??\c:\thndjj.exec:\thndjj.exe220⤵
-
\??\c:\lnhvxl.exec:\lnhvxl.exe221⤵
-
\??\c:\ffhtr.exec:\ffhtr.exe222⤵
-
\??\c:\ptnvjfx.exec:\ptnvjfx.exe223⤵
-
\??\c:\hrdxr.exec:\hrdxr.exe224⤵
-
\??\c:\hlbnlxn.exec:\hlbnlxn.exe225⤵
-
\??\c:\txtrp.exec:\txtrp.exe226⤵
-
\??\c:\vhpdlbt.exec:\vhpdlbt.exe227⤵
-
\??\c:\brjxd.exec:\brjxd.exe228⤵
-
\??\c:\rvbrlj.exec:\rvbrlj.exe229⤵
-
\??\c:\hjtrdbf.exec:\hjtrdbf.exe230⤵
-
\??\c:\htxjjfr.exec:\htxjjfr.exe231⤵
-
\??\c:\jpxfrd.exec:\jpxfrd.exe232⤵
-
\??\c:\vfvfhbx.exec:\vfvfhbx.exe233⤵
-
\??\c:\jnxppp.exec:\jnxppp.exe234⤵
-
\??\c:\ndxrbl.exec:\ndxrbl.exe235⤵
-
\??\c:\pfjljf.exec:\pfjljf.exe236⤵
-
\??\c:\xntthtv.exec:\xntthtv.exe237⤵
-
\??\c:\xntnxf.exec:\xntnxf.exe238⤵
-
\??\c:\bnpltp.exec:\bnpltp.exe239⤵
-
\??\c:\jfvrdb.exec:\jfvrdb.exe240⤵
-
\??\c:\pdlrff.exec:\pdlrff.exe241⤵