Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 10:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
33f1414965f652cfa7c31dcfcd9be8bdb29170d7172140d80047121cc256be98_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
33f1414965f652cfa7c31dcfcd9be8bdb29170d7172140d80047121cc256be98_NeikiAnalytics.exe
-
Size
92KB
-
MD5
5e170ac75f84eefe4200bbdd450571a0
-
SHA1
3675d96f33f18202dab5ceea5b698f453828bcf9
-
SHA256
33f1414965f652cfa7c31dcfcd9be8bdb29170d7172140d80047121cc256be98
-
SHA512
fe2a4bbcbe95ef1caf8cd3472523d31473cd3d27ee074d540c435d3491a5b253c615d19247fbea167539bb5acf90bcde585b0fe0436602b2d6faac3c380f8bf2
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxS1rj/21O:ymb3NkkiQ3mdBjFo73PYP1lri3K8GI
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral1/memory/2768-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1752-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1752-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2396-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1032-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1244-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1344-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2132-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1008-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2024-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1968-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/336-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1028-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2340-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2236-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2272-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1424-295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vpjdj.exepjpvd.exerfrxxrf.exebthbhh.exejvpjd.exedpddd.exe5frxxxf.exebnnhbt.exe9jddd.exe9vjpj.exexxfflff.exerfxlfff.exetnbbhn.exe7nbttt.exevpjpv.exe7xxxxfl.exefxflrfl.exebnthnh.exebttthh.exe5jpjp.exellxxflx.exexrfffll.exettnntb.exeppvjj.exepjvdj.exexrfxxrr.exenhbhtt.exedjvvd.exepjvdj.exexxrlxrf.exe7bnnbh.exehbhhhb.exejdvdp.exefxflrxf.exelfrfllr.exenbhbbt.exennbhnn.exedppjd.exeppddj.exefxlflrx.exerrlrrxl.exethnhtt.exebtnnnt.exevjvpv.exedvdvd.exejdpdv.exexllrfrl.exefxrflrf.exetnhhhh.exetnnhbn.exevvvjp.exe1lxxlrr.exelfrlrrx.exetbhbhn.exedvvvj.exe3flrllr.exelrrxxfx.exenhtttt.exe9hnhnb.exe5pvdd.exedjvpp.exedpjjd.exelrxxfrx.exe1xffxrl.exepid process 1752 vpjdj.exe 3000 pjpvd.exe 2596 rfrxxrf.exe 2396 bthbhh.exe 2416 jvpjd.exe 2444 dpddd.exe 2460 5frxxxf.exe 1032 bnnhbt.exe 1244 9jddd.exe 1344 9vjpj.exe 2568 xxfflff.exe 2132 rfxlfff.exe 1008 tnbbhn.exe 356 7nbttt.exe 2656 vpjpv.exe 2296 7xxxxfl.exe 2024 fxflrfl.exe 2744 bnthnh.exe 1968 bttthh.exe 1904 5jpjp.exe 336 llxxflx.exe 1404 xrfffll.exe 1028 ttnntb.exe 2340 ppvjj.exe 2992 pjvdj.exe 852 xrfxxrr.exe 2236 nhbhtt.exe 2272 djvvd.exe 2096 pjvdj.exe 1424 xxrlxrf.exe 1868 7bnnbh.exe 1636 hbhhhb.exe 1744 jdvdp.exe 2220 fxflrxf.exe 2216 lfrfllr.exe 2636 nbhbbt.exe 2524 nnbhnn.exe 344 dppjd.exe 2700 ppddj.exe 2392 fxlflrx.exe 2432 rrlrrxl.exe 2944 thnhtt.exe 2880 btnnnt.exe 2560 vjvpv.exe 1656 dvdvd.exe 2476 jdpdv.exe 2640 xllrfrl.exe 1444 fxrflrf.exe 1516 tnhhhh.exe 1608 tnnhbn.exe 2280 vvvjp.exe 812 1lxxlrr.exe 2656 lfrlrrx.exe 2740 tbhbhn.exe 2024 dvvvj.exe 1908 3flrllr.exe 1916 lrrxxfx.exe 1884 nhtttt.exe 880 9hnhnb.exe 600 5pvdd.exe 1100 djvpp.exe 560 dpjjd.exe 1172 lrxxfrx.exe 296 1xffxrl.exe -
Processes:
resource yara_rule behavioral1/memory/2768-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1032-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1244-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1344-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2132-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1008-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1968-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/336-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1028-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1424-295-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
33f1414965f652cfa7c31dcfcd9be8bdb29170d7172140d80047121cc256be98_NeikiAnalytics.exevpjdj.exepjpvd.exerfrxxrf.exebthbhh.exejvpjd.exedpddd.exe5frxxxf.exebnnhbt.exe9jddd.exe9vjpj.exexxfflff.exerfxlfff.exetnbbhn.exe7nbttt.exevpjpv.exedescription pid process target process PID 2768 wrote to memory of 1752 2768 33f1414965f652cfa7c31dcfcd9be8bdb29170d7172140d80047121cc256be98_NeikiAnalytics.exe vpjdj.exe PID 2768 wrote to memory of 1752 2768 33f1414965f652cfa7c31dcfcd9be8bdb29170d7172140d80047121cc256be98_NeikiAnalytics.exe vpjdj.exe PID 2768 wrote to memory of 1752 2768 33f1414965f652cfa7c31dcfcd9be8bdb29170d7172140d80047121cc256be98_NeikiAnalytics.exe vpjdj.exe PID 2768 wrote to memory of 1752 2768 33f1414965f652cfa7c31dcfcd9be8bdb29170d7172140d80047121cc256be98_NeikiAnalytics.exe vpjdj.exe PID 1752 wrote to memory of 3000 1752 vpjdj.exe pjpvd.exe PID 1752 wrote to memory of 3000 1752 vpjdj.exe pjpvd.exe PID 1752 wrote to memory of 3000 1752 vpjdj.exe pjpvd.exe PID 1752 wrote to memory of 3000 1752 vpjdj.exe pjpvd.exe PID 3000 wrote to memory of 2596 3000 pjpvd.exe rfrxxrf.exe PID 3000 wrote to memory of 2596 3000 pjpvd.exe rfrxxrf.exe PID 3000 wrote to memory of 2596 3000 pjpvd.exe rfrxxrf.exe PID 3000 wrote to memory of 2596 3000 pjpvd.exe rfrxxrf.exe PID 2596 wrote to memory of 2396 2596 rfrxxrf.exe bthbhh.exe PID 2596 wrote to memory of 2396 2596 rfrxxrf.exe bthbhh.exe PID 2596 wrote to memory of 2396 2596 rfrxxrf.exe bthbhh.exe PID 2596 wrote to memory of 2396 2596 rfrxxrf.exe bthbhh.exe PID 2396 wrote to memory of 2416 2396 bthbhh.exe jvpjd.exe PID 2396 wrote to memory of 2416 2396 bthbhh.exe jvpjd.exe PID 2396 wrote to memory of 2416 2396 bthbhh.exe jvpjd.exe PID 2396 wrote to memory of 2416 2396 bthbhh.exe jvpjd.exe PID 2416 wrote to memory of 2444 2416 jvpjd.exe dpddd.exe PID 2416 wrote to memory of 2444 2416 jvpjd.exe dpddd.exe PID 2416 wrote to memory of 2444 2416 jvpjd.exe dpddd.exe PID 2416 wrote to memory of 2444 2416 jvpjd.exe dpddd.exe PID 2444 wrote to memory of 2460 2444 dpddd.exe 5frxxxf.exe PID 2444 wrote to memory of 2460 2444 dpddd.exe 5frxxxf.exe PID 2444 wrote to memory of 2460 2444 dpddd.exe 5frxxxf.exe PID 2444 wrote to memory of 2460 2444 dpddd.exe 5frxxxf.exe PID 2460 wrote to memory of 1032 2460 5frxxxf.exe bnnhbt.exe PID 2460 wrote to memory of 1032 2460 5frxxxf.exe bnnhbt.exe PID 2460 wrote to memory of 1032 2460 5frxxxf.exe bnnhbt.exe PID 2460 wrote to memory of 1032 2460 5frxxxf.exe bnnhbt.exe PID 1032 wrote to memory of 1244 1032 bnnhbt.exe 9jddd.exe PID 1032 wrote to memory of 1244 1032 bnnhbt.exe 9jddd.exe PID 1032 wrote to memory of 1244 1032 bnnhbt.exe 9jddd.exe PID 1032 wrote to memory of 1244 1032 bnnhbt.exe 9jddd.exe PID 1244 wrote to memory of 1344 1244 9jddd.exe 9vjpj.exe PID 1244 wrote to memory of 1344 1244 9jddd.exe 9vjpj.exe PID 1244 wrote to memory of 1344 1244 9jddd.exe 9vjpj.exe PID 1244 wrote to memory of 1344 1244 9jddd.exe 9vjpj.exe PID 1344 wrote to memory of 2568 1344 9vjpj.exe xxfflff.exe PID 1344 wrote to memory of 2568 1344 9vjpj.exe xxfflff.exe PID 1344 wrote to memory of 2568 1344 9vjpj.exe xxfflff.exe PID 1344 wrote to memory of 2568 1344 9vjpj.exe xxfflff.exe PID 2568 wrote to memory of 2132 2568 xxfflff.exe rfxlfff.exe PID 2568 wrote to memory of 2132 2568 xxfflff.exe rfxlfff.exe PID 2568 wrote to memory of 2132 2568 xxfflff.exe rfxlfff.exe PID 2568 wrote to memory of 2132 2568 xxfflff.exe rfxlfff.exe PID 2132 wrote to memory of 1008 2132 rfxlfff.exe tnbbhn.exe PID 2132 wrote to memory of 1008 2132 rfxlfff.exe tnbbhn.exe PID 2132 wrote to memory of 1008 2132 rfxlfff.exe tnbbhn.exe PID 2132 wrote to memory of 1008 2132 rfxlfff.exe tnbbhn.exe PID 1008 wrote to memory of 356 1008 tnbbhn.exe 7nbttt.exe PID 1008 wrote to memory of 356 1008 tnbbhn.exe 7nbttt.exe PID 1008 wrote to memory of 356 1008 tnbbhn.exe 7nbttt.exe PID 1008 wrote to memory of 356 1008 tnbbhn.exe 7nbttt.exe PID 356 wrote to memory of 2656 356 7nbttt.exe vpjpv.exe PID 356 wrote to memory of 2656 356 7nbttt.exe vpjpv.exe PID 356 wrote to memory of 2656 356 7nbttt.exe vpjpv.exe PID 356 wrote to memory of 2656 356 7nbttt.exe vpjpv.exe PID 2656 wrote to memory of 2296 2656 vpjpv.exe 7xxxxfl.exe PID 2656 wrote to memory of 2296 2656 vpjpv.exe 7xxxxfl.exe PID 2656 wrote to memory of 2296 2656 vpjpv.exe 7xxxxfl.exe PID 2656 wrote to memory of 2296 2656 vpjpv.exe 7xxxxfl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\33f1414965f652cfa7c31dcfcd9be8bdb29170d7172140d80047121cc256be98_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\33f1414965f652cfa7c31dcfcd9be8bdb29170d7172140d80047121cc256be98_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\vpjdj.exec:\vpjdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjpvd.exec:\pjpvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rfrxxrf.exec:\rfrxxrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bthbhh.exec:\bthbhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvpjd.exec:\jvpjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dpddd.exec:\dpddd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5frxxxf.exec:\5frxxxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnnhbt.exec:\bnnhbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9jddd.exec:\9jddd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9vjpj.exec:\9vjpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxfflff.exec:\xxfflff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rfxlfff.exec:\rfxlfff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnbbhn.exec:\tnbbhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7nbttt.exec:\7nbttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpjpv.exec:\vpjpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7xxxxfl.exec:\7xxxxfl.exe17⤵
- Executes dropped EXE
-
\??\c:\fxflrfl.exec:\fxflrfl.exe18⤵
- Executes dropped EXE
-
\??\c:\bnthnh.exec:\bnthnh.exe19⤵
- Executes dropped EXE
-
\??\c:\bttthh.exec:\bttthh.exe20⤵
- Executes dropped EXE
-
\??\c:\5jpjp.exec:\5jpjp.exe21⤵
- Executes dropped EXE
-
\??\c:\llxxflx.exec:\llxxflx.exe22⤵
- Executes dropped EXE
-
\??\c:\xrfffll.exec:\xrfffll.exe23⤵
- Executes dropped EXE
-
\??\c:\ttnntb.exec:\ttnntb.exe24⤵
- Executes dropped EXE
-
\??\c:\ppvjj.exec:\ppvjj.exe25⤵
- Executes dropped EXE
-
\??\c:\pjvdj.exec:\pjvdj.exe26⤵
- Executes dropped EXE
-
\??\c:\xrfxxrr.exec:\xrfxxrr.exe27⤵
- Executes dropped EXE
-
\??\c:\nhbhtt.exec:\nhbhtt.exe28⤵
- Executes dropped EXE
-
\??\c:\djvvd.exec:\djvvd.exe29⤵
- Executes dropped EXE
-
\??\c:\pjvdj.exec:\pjvdj.exe30⤵
- Executes dropped EXE
-
\??\c:\xxrlxrf.exec:\xxrlxrf.exe31⤵
- Executes dropped EXE
-
\??\c:\7bnnbh.exec:\7bnnbh.exe32⤵
- Executes dropped EXE
-
\??\c:\hbhhhb.exec:\hbhhhb.exe33⤵
- Executes dropped EXE
-
\??\c:\jdvdp.exec:\jdvdp.exe34⤵
- Executes dropped EXE
-
\??\c:\fxflrxf.exec:\fxflrxf.exe35⤵
- Executes dropped EXE
-
\??\c:\lfrfllr.exec:\lfrfllr.exe36⤵
- Executes dropped EXE
-
\??\c:\nbhbbt.exec:\nbhbbt.exe37⤵
- Executes dropped EXE
-
\??\c:\nnbhnn.exec:\nnbhnn.exe38⤵
- Executes dropped EXE
-
\??\c:\dppjd.exec:\dppjd.exe39⤵
- Executes dropped EXE
-
\??\c:\ppddj.exec:\ppddj.exe40⤵
- Executes dropped EXE
-
\??\c:\fxlflrx.exec:\fxlflrx.exe41⤵
- Executes dropped EXE
-
\??\c:\rrlrrxl.exec:\rrlrrxl.exe42⤵
- Executes dropped EXE
-
\??\c:\thnhtt.exec:\thnhtt.exe43⤵
- Executes dropped EXE
-
\??\c:\btnnnt.exec:\btnnnt.exe44⤵
- Executes dropped EXE
-
\??\c:\vjvpv.exec:\vjvpv.exe45⤵
- Executes dropped EXE
-
\??\c:\dvdvd.exec:\dvdvd.exe46⤵
- Executes dropped EXE
-
\??\c:\jdpdv.exec:\jdpdv.exe47⤵
- Executes dropped EXE
-
\??\c:\xllrfrl.exec:\xllrfrl.exe48⤵
- Executes dropped EXE
-
\??\c:\fxrflrf.exec:\fxrflrf.exe49⤵
- Executes dropped EXE
-
\??\c:\tnhhhh.exec:\tnhhhh.exe50⤵
- Executes dropped EXE
-
\??\c:\tnnhbn.exec:\tnnhbn.exe51⤵
- Executes dropped EXE
-
\??\c:\vvvjp.exec:\vvvjp.exe52⤵
- Executes dropped EXE
-
\??\c:\1lxxlrr.exec:\1lxxlrr.exe53⤵
- Executes dropped EXE
-
\??\c:\lfrlrrx.exec:\lfrlrrx.exe54⤵
- Executes dropped EXE
-
\??\c:\tbhbhn.exec:\tbhbhn.exe55⤵
- Executes dropped EXE
-
\??\c:\dvvvj.exec:\dvvvj.exe56⤵
- Executes dropped EXE
-
\??\c:\3flrllr.exec:\3flrllr.exe57⤵
- Executes dropped EXE
-
\??\c:\lrrxxfx.exec:\lrrxxfx.exe58⤵
- Executes dropped EXE
-
\??\c:\nhtttt.exec:\nhtttt.exe59⤵
- Executes dropped EXE
-
\??\c:\9hnhnb.exec:\9hnhnb.exe60⤵
- Executes dropped EXE
-
\??\c:\5pvdd.exec:\5pvdd.exe61⤵
- Executes dropped EXE
-
\??\c:\djvpp.exec:\djvpp.exe62⤵
- Executes dropped EXE
-
\??\c:\dpjjd.exec:\dpjjd.exe63⤵
- Executes dropped EXE
-
\??\c:\lrxxfrx.exec:\lrxxfrx.exe64⤵
- Executes dropped EXE
-
\??\c:\1xffxrl.exec:\1xffxrl.exe65⤵
- Executes dropped EXE
-
\??\c:\nbnhnh.exec:\nbnhnh.exe66⤵
-
\??\c:\nbbbbt.exec:\nbbbbt.exe67⤵
-
\??\c:\ttnbbb.exec:\ttnbbb.exe68⤵
-
\??\c:\pddvv.exec:\pddvv.exe69⤵
-
\??\c:\jvjdv.exec:\jvjdv.exe70⤵
-
\??\c:\jdjjj.exec:\jdjjj.exe71⤵
-
\??\c:\rflllrx.exec:\rflllrx.exe72⤵
-
\??\c:\rfrrrrx.exec:\rfrrrrx.exe73⤵
-
\??\c:\9tbhhh.exec:\9tbhhh.exe74⤵
-
\??\c:\bttnnn.exec:\bttnnn.exe75⤵
-
\??\c:\dvjjj.exec:\dvjjj.exe76⤵
-
\??\c:\pjjjj.exec:\pjjjj.exe77⤵
-
\??\c:\xlxfffl.exec:\xlxfffl.exe78⤵
-
\??\c:\9lrrrfl.exec:\9lrrrfl.exe79⤵
-
\??\c:\tnbttn.exec:\tnbttn.exe80⤵
-
\??\c:\3hhhhb.exec:\3hhhhb.exe81⤵
-
\??\c:\jvjjj.exec:\jvjjj.exe82⤵
-
\??\c:\9vjjj.exec:\9vjjj.exe83⤵
-
\??\c:\rrlflfl.exec:\rrlflfl.exe84⤵
-
\??\c:\9frrxxx.exec:\9frrxxx.exe85⤵
-
\??\c:\xrlxflr.exec:\xrlxflr.exe86⤵
-
\??\c:\9htbbb.exec:\9htbbb.exe87⤵
-
\??\c:\3nhtbh.exec:\3nhtbh.exe88⤵
-
\??\c:\dvjdv.exec:\dvjdv.exe89⤵
-
\??\c:\pddvd.exec:\pddvd.exe90⤵
-
\??\c:\frrlffl.exec:\frrlffl.exe91⤵
-
\??\c:\llxrrlf.exec:\llxrrlf.exe92⤵
-
\??\c:\1hbbht.exec:\1hbbht.exe93⤵
-
\??\c:\bnbbbb.exec:\bnbbbb.exe94⤵
-
\??\c:\jvddp.exec:\jvddp.exe95⤵
-
\??\c:\9pdvp.exec:\9pdvp.exe96⤵
-
\??\c:\jpppj.exec:\jpppj.exe97⤵
-
\??\c:\1fxxfll.exec:\1fxxfll.exe98⤵
-
\??\c:\xffxfxx.exec:\xffxfxx.exe99⤵
-
\??\c:\hhbhnn.exec:\hhbhnn.exe100⤵
-
\??\c:\hbnthh.exec:\hbnthh.exe101⤵
-
\??\c:\btnntb.exec:\btnntb.exe102⤵
-
\??\c:\vpdjv.exec:\vpdjv.exe103⤵
-
\??\c:\vvvdv.exec:\vvvdv.exe104⤵
-
\??\c:\5xfxxrx.exec:\5xfxxrx.exe105⤵
-
\??\c:\lfflrrx.exec:\lfflrrx.exe106⤵
-
\??\c:\nhtthh.exec:\nhtthh.exe107⤵
-
\??\c:\9pvjj.exec:\9pvjj.exe108⤵
-
\??\c:\dvjdp.exec:\dvjdp.exe109⤵
-
\??\c:\5lxxrrl.exec:\5lxxrrl.exe110⤵
-
\??\c:\3xlllrf.exec:\3xlllrf.exe111⤵
-
\??\c:\5nbbhb.exec:\5nbbhb.exe112⤵
-
\??\c:\3nnntb.exec:\3nnntb.exe113⤵
-
\??\c:\7pddd.exec:\7pddd.exe114⤵
-
\??\c:\pdddp.exec:\pdddp.exe115⤵
-
\??\c:\rlllfll.exec:\rlllfll.exe116⤵
-
\??\c:\xrlrlxr.exec:\xrlrlxr.exe117⤵
-
\??\c:\btntnt.exec:\btntnt.exe118⤵
-
\??\c:\7nhbbh.exec:\7nhbbh.exe119⤵
-
\??\c:\vjjjd.exec:\vjjjd.exe120⤵
-
\??\c:\9dppp.exec:\9dppp.exe121⤵
-
\??\c:\frrxxxr.exec:\frrxxxr.exe122⤵
-
\??\c:\lxxxxrr.exec:\lxxxxrr.exe123⤵
-
\??\c:\1bhnnn.exec:\1bhnnn.exe124⤵
-
\??\c:\tnbtbt.exec:\tnbtbt.exe125⤵
-
\??\c:\3dvjp.exec:\3dvjp.exe126⤵
-
\??\c:\jdppd.exec:\jdppd.exe127⤵
-
\??\c:\jvjjj.exec:\jvjjj.exe128⤵
-
\??\c:\9rxxxrx.exec:\9rxxxrx.exe129⤵
-
\??\c:\5lfrrxf.exec:\5lfrrxf.exe130⤵
-
\??\c:\tnbhhb.exec:\tnbhhb.exe131⤵
-
\??\c:\btnnnn.exec:\btnnnn.exe132⤵
-
\??\c:\vjjjp.exec:\vjjjp.exe133⤵
-
\??\c:\1dppp.exec:\1dppp.exe134⤵
-
\??\c:\xrrrxxf.exec:\xrrrxxf.exe135⤵
-
\??\c:\fxxxfff.exec:\fxxxfff.exe136⤵
-
\??\c:\lffrffl.exec:\lffrffl.exe137⤵
-
\??\c:\nhnntn.exec:\nhnntn.exe138⤵
-
\??\c:\9bnttn.exec:\9bnttn.exe139⤵
-
\??\c:\3bnnbb.exec:\3bnnbb.exe140⤵
-
\??\c:\vjjdd.exec:\vjjdd.exe141⤵
-
\??\c:\jdjdp.exec:\jdjdp.exe142⤵
-
\??\c:\llfrfrf.exec:\llfrfrf.exe143⤵
-
\??\c:\5rlfffr.exec:\5rlfffr.exe144⤵
-
\??\c:\7nhnbb.exec:\7nhnbb.exe145⤵
-
\??\c:\1hnnnb.exec:\1hnnnb.exe146⤵
-
\??\c:\7jvdd.exec:\7jvdd.exe147⤵
-
\??\c:\dpdvp.exec:\dpdvp.exe148⤵
-
\??\c:\jppjd.exec:\jppjd.exe149⤵
-
\??\c:\xrlffxr.exec:\xrlffxr.exe150⤵
-
\??\c:\9frrlll.exec:\9frrlll.exe151⤵
-
\??\c:\nbhbbb.exec:\nbhbbb.exe152⤵
-
\??\c:\dpdjp.exec:\dpdjp.exe153⤵
-
\??\c:\7vjvd.exec:\7vjvd.exe154⤵
-
\??\c:\ffxrfff.exec:\ffxrfff.exe155⤵
-
\??\c:\rfrrffl.exec:\rfrrffl.exe156⤵
-
\??\c:\lfrxxrl.exec:\lfrxxrl.exe157⤵
-
\??\c:\hthbhb.exec:\hthbhb.exe158⤵
-
\??\c:\7bbbhh.exec:\7bbbhh.exe159⤵
-
\??\c:\jjjpv.exec:\jjjpv.exe160⤵
-
\??\c:\7jjjj.exec:\7jjjj.exe161⤵
-
\??\c:\5lllffl.exec:\5lllffl.exe162⤵
-
\??\c:\rfflrlr.exec:\rfflrlr.exe163⤵
-
\??\c:\xllrrxx.exec:\xllrrxx.exe164⤵
-
\??\c:\thhbht.exec:\thhbht.exe165⤵
-
\??\c:\nhbhbt.exec:\nhbhbt.exe166⤵
-
\??\c:\vpjdd.exec:\vpjdd.exe167⤵
-
\??\c:\jdjdv.exec:\jdjdv.exe168⤵
-
\??\c:\fxflxrx.exec:\fxflxrx.exe169⤵
-
\??\c:\flrfflr.exec:\flrfflr.exe170⤵
-
\??\c:\1nbnhh.exec:\1nbnhh.exe171⤵
-
\??\c:\1bhbtt.exec:\1bhbtt.exe172⤵
-
\??\c:\9vjpp.exec:\9vjpp.exe173⤵
-
\??\c:\vjvpd.exec:\vjvpd.exe174⤵
-
\??\c:\xrrrffl.exec:\xrrrffl.exe175⤵
-
\??\c:\5xrrxfl.exec:\5xrrxfl.exe176⤵
-
\??\c:\9tbtbb.exec:\9tbtbb.exe177⤵
-
\??\c:\hnttbn.exec:\hnttbn.exe178⤵
-
\??\c:\vjjpp.exec:\vjjpp.exe179⤵
-
\??\c:\lfrrxxx.exec:\lfrrxxx.exe180⤵
-
\??\c:\rflfxxf.exec:\rflfxxf.exe181⤵
-
\??\c:\httnhh.exec:\httnhh.exe182⤵
-
\??\c:\nnnbnb.exec:\nnnbnb.exe183⤵
-
\??\c:\dpdvp.exec:\dpdvp.exe184⤵
-
\??\c:\3jvjj.exec:\3jvjj.exe185⤵
-
\??\c:\rfrlrfl.exec:\rfrlrfl.exe186⤵
-
\??\c:\rlrrxxf.exec:\rlrrxxf.exe187⤵
-
\??\c:\bththt.exec:\bththt.exe188⤵
-
\??\c:\thnnnn.exec:\thnnnn.exe189⤵
-
\??\c:\pjdjv.exec:\pjdjv.exe190⤵
-
\??\c:\jdjpd.exec:\jdjpd.exe191⤵
-
\??\c:\frxfrrr.exec:\frxfrrr.exe192⤵
-
\??\c:\rxlffxx.exec:\rxlffxx.exe193⤵
-
\??\c:\thttnh.exec:\thttnh.exe194⤵
-
\??\c:\nhnbbb.exec:\nhnbbb.exe195⤵
-
\??\c:\dvvpv.exec:\dvvpv.exe196⤵
-
\??\c:\5vjjd.exec:\5vjjd.exe197⤵
-
\??\c:\fxrffff.exec:\fxrffff.exe198⤵
-
\??\c:\3flrxrf.exec:\3flrxrf.exe199⤵
-
\??\c:\nnntht.exec:\nnntht.exe200⤵
-
\??\c:\thnhhn.exec:\thnhhn.exe201⤵
-
\??\c:\9pvpp.exec:\9pvpp.exe202⤵
-
\??\c:\dvpvd.exec:\dvpvd.exe203⤵
-
\??\c:\lxrrlll.exec:\lxrrlll.exe204⤵
-
\??\c:\lfllrlr.exec:\lfllrlr.exe205⤵
-
\??\c:\lfrrrlr.exec:\lfrrrlr.exe206⤵
-
\??\c:\ntbttt.exec:\ntbttt.exe207⤵
-
\??\c:\jpppv.exec:\jpppv.exe208⤵
-
\??\c:\vjddd.exec:\vjddd.exe209⤵
-
\??\c:\rflfxxx.exec:\rflfxxx.exe210⤵
-
\??\c:\lrrrrlr.exec:\lrrrrlr.exe211⤵
-
\??\c:\hthhhh.exec:\hthhhh.exe212⤵
-
\??\c:\jvvpd.exec:\jvvpd.exe213⤵
-
\??\c:\5pjdd.exec:\5pjdd.exe214⤵
-
\??\c:\9ffxfxf.exec:\9ffxfxf.exe215⤵
-
\??\c:\5xfflff.exec:\5xfflff.exe216⤵
-
\??\c:\tttttn.exec:\tttttn.exe217⤵
-
\??\c:\tnthnt.exec:\tnthnt.exe218⤵
-
\??\c:\pdvpv.exec:\pdvpv.exe219⤵
-
\??\c:\pdjjv.exec:\pdjjv.exe220⤵
-
\??\c:\rlxrxfl.exec:\rlxrxfl.exe221⤵
-
\??\c:\rffffxf.exec:\rffffxf.exe222⤵
-
\??\c:\3thnbh.exec:\3thnbh.exe223⤵
-
\??\c:\vjvdd.exec:\vjvdd.exe224⤵
-
\??\c:\7dvpp.exec:\7dvpp.exe225⤵
-
\??\c:\5xxxrrr.exec:\5xxxrrr.exe226⤵
-
\??\c:\frfflrr.exec:\frfflrr.exe227⤵
-
\??\c:\bttbtt.exec:\bttbtt.exe228⤵
-
\??\c:\7hbbtn.exec:\7hbbtn.exe229⤵
-
\??\c:\jvddj.exec:\jvddj.exe230⤵
-
\??\c:\dpvdd.exec:\dpvdd.exe231⤵
-
\??\c:\3lxxrrr.exec:\3lxxrrr.exe232⤵
-
\??\c:\1rfrxxf.exec:\1rfrxxf.exe233⤵
-
\??\c:\thhhhb.exec:\thhhhb.exe234⤵
-
\??\c:\bnhhth.exec:\bnhhth.exe235⤵
-
\??\c:\nhhhhb.exec:\nhhhhb.exe236⤵
-
\??\c:\9jvvv.exec:\9jvvv.exe237⤵
-
\??\c:\jdpdd.exec:\jdpdd.exe238⤵
-
\??\c:\lxfxfff.exec:\lxfxfff.exe239⤵
-
\??\c:\9xlxxxx.exec:\9xlxxxx.exe240⤵
-
\??\c:\hbbhhn.exec:\hbbhhn.exe241⤵