Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 03:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
151487201dabf999054a286ed6fefee0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
151487201dabf999054a286ed6fefee0_NeikiAnalytics.exe
-
Size
56KB
-
MD5
151487201dabf999054a286ed6fefee0
-
SHA1
ab91b4995894fbace69d29bdcef5306a96bac34d
-
SHA256
62ce00dac153b24eb50aea3a7a52aa4e281c2b02b61ecd2c568d28b8d02fba5e
-
SHA512
fffa579d5ed996dd0c6cd315a7b06798587022f4189f85e7d82024890f08c5134d9a9075d3b05061a61194400c6a6ac3f59d0172d94c4ca53b69d8ec9817fede
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0chVnE:ymb3NkkiQ3mdBjF0crE
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
Processes:
resource yara_rule behavioral1/memory/1932-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2296-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1932-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2612-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2612-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-39-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2288-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-91-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2608-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1360-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1800-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1236-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2244-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1832-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/272-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1792-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1260-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1540-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1988-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/112-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-3866-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bthhtt.exepdpjd.exefrrrrrl.exefllffrl.exehbhhhb.exehtnhnn.exedvdjj.exetnbhtt.exevpddj.exejdjjp.exerlffllr.exe3tnbbn.exettnntt.exejjddj.exerlxxrfl.exe9llxllr.exe5bntth.exenhbbtt.exejvjpv.exelfxxxfl.exe7rrfxfl.exe5bnbhh.exe1ttnht.exedvpjj.exejdvpd.exe3rxrrrx.exe3hbhnt.exejdvdd.exevpjjv.exerlxxffl.exelfrrxxl.exetnntbb.exeppdjp.exevpppp.exexrrxfxl.exexrxxffl.exenhbbnt.exe7nntbb.exevpvvj.exe7vpdd.exepjpvv.exe9fflxxl.exe1xrxllr.exe3hbbhh.exe5htbnh.exehtnntn.exedvppd.exejddjv.exerlxxfxl.exerrlxflx.exehhtbbb.exe7hhhnt.exeddvdj.exe1ppjj.exefxrrxxl.exe1fxrxfr.exebtbbnn.exennhthn.exebbtbth.exevpdjj.exe5jjpd.exe7fflrxf.exe7xxfrfr.exenhbntb.exepid process 2296 bthhtt.exe 2612 pdpjd.exe 2764 frrrrrl.exe 2288 fllffrl.exe 2856 hbhhhb.exe 2680 htnhnn.exe 2524 dvdjj.exe 2560 tnbhtt.exe 1272 vpddj.exe 2608 jdjjp.exe 2844 rlffllr.exe 1360 3tnbbn.exe 1800 ttnntt.exe 1236 jjddj.exe 2244 rlxxrfl.exe 1832 9llxllr.exe 824 5bntth.exe 272 nhbbtt.exe 780 jvjpv.exe 2604 lfxxxfl.exe 1792 7rrfxfl.exe 2924 5bnbhh.exe 1260 1ttnht.exe 1540 dvpjj.exe 404 jdvpd.exe 1604 3rxrrrx.exe 1988 3hbhnt.exe 648 jdvdd.exe 112 vpjjv.exe 3024 rlxxffl.exe 1748 lfrrxxl.exe 1932 tnntbb.exe 3060 ppdjp.exe 2716 vpppp.exe 1572 xrrxfxl.exe 2756 xrxxffl.exe 2664 nhbbnt.exe 2796 7nntbb.exe 2752 vpvvj.exe 2556 7vpdd.exe 2676 pjpvv.exe 2520 9fflxxl.exe 2384 1xrxllr.exe 2992 3hbbhh.exe 288 5htbnh.exe 2684 htnntn.exe 2848 dvppd.exe 2824 jddjv.exe 1652 rlxxfxl.exe 1956 rrlxflx.exe 1872 hhtbbb.exe 2880 7hhhnt.exe 600 ddvdj.exe 804 1ppjj.exe 1636 fxrrxxl.exe 280 1fxrxfr.exe 892 btbbnn.exe 2548 nnhthn.exe 2964 bbtbth.exe 2488 vpdjj.exe 2352 5jjpd.exe 1856 7fflrxf.exe 2260 7xxfrfr.exe 2388 nhbntb.exe -
Processes:
resource yara_rule behavioral1/memory/1932-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1360-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1800-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1236-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2244-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1832-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/272-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1792-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1260-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1540-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1988-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/112-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-3866-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
151487201dabf999054a286ed6fefee0_NeikiAnalytics.exebthhtt.exepdpjd.exefrrrrrl.exefllffrl.exehbhhhb.exehtnhnn.exedvdjj.exetnbhtt.exevpddj.exejdjjp.exerlffllr.exe3tnbbn.exettnntt.exejjddj.exerlxxrfl.exedescription pid process target process PID 1932 wrote to memory of 2296 1932 151487201dabf999054a286ed6fefee0_NeikiAnalytics.exe bthhtt.exe PID 1932 wrote to memory of 2296 1932 151487201dabf999054a286ed6fefee0_NeikiAnalytics.exe bthhtt.exe PID 1932 wrote to memory of 2296 1932 151487201dabf999054a286ed6fefee0_NeikiAnalytics.exe bthhtt.exe PID 1932 wrote to memory of 2296 1932 151487201dabf999054a286ed6fefee0_NeikiAnalytics.exe bthhtt.exe PID 2296 wrote to memory of 2612 2296 bthhtt.exe pdpjd.exe PID 2296 wrote to memory of 2612 2296 bthhtt.exe pdpjd.exe PID 2296 wrote to memory of 2612 2296 bthhtt.exe pdpjd.exe PID 2296 wrote to memory of 2612 2296 bthhtt.exe pdpjd.exe PID 2612 wrote to memory of 2764 2612 pdpjd.exe frrrrrl.exe PID 2612 wrote to memory of 2764 2612 pdpjd.exe frrrrrl.exe PID 2612 wrote to memory of 2764 2612 pdpjd.exe frrrrrl.exe PID 2612 wrote to memory of 2764 2612 pdpjd.exe frrrrrl.exe PID 2764 wrote to memory of 2288 2764 frrrrrl.exe fllffrl.exe PID 2764 wrote to memory of 2288 2764 frrrrrl.exe fllffrl.exe PID 2764 wrote to memory of 2288 2764 frrrrrl.exe fllffrl.exe PID 2764 wrote to memory of 2288 2764 frrrrrl.exe fllffrl.exe PID 2288 wrote to memory of 2856 2288 fllffrl.exe hbhhhb.exe PID 2288 wrote to memory of 2856 2288 fllffrl.exe hbhhhb.exe PID 2288 wrote to memory of 2856 2288 fllffrl.exe hbhhhb.exe PID 2288 wrote to memory of 2856 2288 fllffrl.exe hbhhhb.exe PID 2856 wrote to memory of 2680 2856 hbhhhb.exe htnhnn.exe PID 2856 wrote to memory of 2680 2856 hbhhhb.exe htnhnn.exe PID 2856 wrote to memory of 2680 2856 hbhhhb.exe htnhnn.exe PID 2856 wrote to memory of 2680 2856 hbhhhb.exe htnhnn.exe PID 2680 wrote to memory of 2524 2680 htnhnn.exe dvdjj.exe PID 2680 wrote to memory of 2524 2680 htnhnn.exe dvdjj.exe PID 2680 wrote to memory of 2524 2680 htnhnn.exe dvdjj.exe PID 2680 wrote to memory of 2524 2680 htnhnn.exe dvdjj.exe PID 2524 wrote to memory of 2560 2524 dvdjj.exe tnbhtt.exe PID 2524 wrote to memory of 2560 2524 dvdjj.exe tnbhtt.exe PID 2524 wrote to memory of 2560 2524 dvdjj.exe tnbhtt.exe PID 2524 wrote to memory of 2560 2524 dvdjj.exe tnbhtt.exe PID 2560 wrote to memory of 1272 2560 tnbhtt.exe vpddj.exe PID 2560 wrote to memory of 1272 2560 tnbhtt.exe vpddj.exe PID 2560 wrote to memory of 1272 2560 tnbhtt.exe vpddj.exe PID 2560 wrote to memory of 1272 2560 tnbhtt.exe vpddj.exe PID 1272 wrote to memory of 2608 1272 vpddj.exe jdjjp.exe PID 1272 wrote to memory of 2608 1272 vpddj.exe jdjjp.exe PID 1272 wrote to memory of 2608 1272 vpddj.exe jdjjp.exe PID 1272 wrote to memory of 2608 1272 vpddj.exe jdjjp.exe PID 2608 wrote to memory of 2844 2608 jdjjp.exe rlffllr.exe PID 2608 wrote to memory of 2844 2608 jdjjp.exe rlffllr.exe PID 2608 wrote to memory of 2844 2608 jdjjp.exe rlffllr.exe PID 2608 wrote to memory of 2844 2608 jdjjp.exe rlffllr.exe PID 2844 wrote to memory of 1360 2844 rlffllr.exe 3tnbbn.exe PID 2844 wrote to memory of 1360 2844 rlffllr.exe 3tnbbn.exe PID 2844 wrote to memory of 1360 2844 rlffllr.exe 3tnbbn.exe PID 2844 wrote to memory of 1360 2844 rlffllr.exe 3tnbbn.exe PID 1360 wrote to memory of 1800 1360 3tnbbn.exe ttnntt.exe PID 1360 wrote to memory of 1800 1360 3tnbbn.exe ttnntt.exe PID 1360 wrote to memory of 1800 1360 3tnbbn.exe ttnntt.exe PID 1360 wrote to memory of 1800 1360 3tnbbn.exe ttnntt.exe PID 1800 wrote to memory of 1236 1800 ttnntt.exe jjddj.exe PID 1800 wrote to memory of 1236 1800 ttnntt.exe jjddj.exe PID 1800 wrote to memory of 1236 1800 ttnntt.exe jjddj.exe PID 1800 wrote to memory of 1236 1800 ttnntt.exe jjddj.exe PID 1236 wrote to memory of 2244 1236 jjddj.exe rlxxrfl.exe PID 1236 wrote to memory of 2244 1236 jjddj.exe rlxxrfl.exe PID 1236 wrote to memory of 2244 1236 jjddj.exe rlxxrfl.exe PID 1236 wrote to memory of 2244 1236 jjddj.exe rlxxrfl.exe PID 2244 wrote to memory of 1832 2244 rlxxrfl.exe 9llxllr.exe PID 2244 wrote to memory of 1832 2244 rlxxrfl.exe 9llxllr.exe PID 2244 wrote to memory of 1832 2244 rlxxrfl.exe 9llxllr.exe PID 2244 wrote to memory of 1832 2244 rlxxrfl.exe 9llxllr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\151487201dabf999054a286ed6fefee0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\151487201dabf999054a286ed6fefee0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\bthhtt.exec:\bthhtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdpjd.exec:\pdpjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frrrrrl.exec:\frrrrrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fllffrl.exec:\fllffrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbhhhb.exec:\hbhhhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\htnhnn.exec:\htnhnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvdjj.exec:\dvdjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnbhtt.exec:\tnbhtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpddj.exec:\vpddj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdjjp.exec:\jdjjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlffllr.exec:\rlffllr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3tnbbn.exec:\3tnbbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ttnntt.exec:\ttnntt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjddj.exec:\jjddj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlxxrfl.exec:\rlxxrfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9llxllr.exec:\9llxllr.exe17⤵
- Executes dropped EXE
-
\??\c:\5bntth.exec:\5bntth.exe18⤵
- Executes dropped EXE
-
\??\c:\nhbbtt.exec:\nhbbtt.exe19⤵
- Executes dropped EXE
-
\??\c:\jvjpv.exec:\jvjpv.exe20⤵
- Executes dropped EXE
-
\??\c:\lfxxxfl.exec:\lfxxxfl.exe21⤵
- Executes dropped EXE
-
\??\c:\7rrfxfl.exec:\7rrfxfl.exe22⤵
- Executes dropped EXE
-
\??\c:\5bnbhh.exec:\5bnbhh.exe23⤵
- Executes dropped EXE
-
\??\c:\1ttnht.exec:\1ttnht.exe24⤵
- Executes dropped EXE
-
\??\c:\dvpjj.exec:\dvpjj.exe25⤵
- Executes dropped EXE
-
\??\c:\jdvpd.exec:\jdvpd.exe26⤵
- Executes dropped EXE
-
\??\c:\3rxrrrx.exec:\3rxrrrx.exe27⤵
- Executes dropped EXE
-
\??\c:\3hbhnt.exec:\3hbhnt.exe28⤵
- Executes dropped EXE
-
\??\c:\jdvdd.exec:\jdvdd.exe29⤵
- Executes dropped EXE
-
\??\c:\vpjjv.exec:\vpjjv.exe30⤵
- Executes dropped EXE
-
\??\c:\rlxxffl.exec:\rlxxffl.exe31⤵
- Executes dropped EXE
-
\??\c:\lfrrxxl.exec:\lfrrxxl.exe32⤵
- Executes dropped EXE
-
\??\c:\tnntbb.exec:\tnntbb.exe33⤵
- Executes dropped EXE
-
\??\c:\ppdjp.exec:\ppdjp.exe34⤵
- Executes dropped EXE
-
\??\c:\vpppp.exec:\vpppp.exe35⤵
- Executes dropped EXE
-
\??\c:\xrrxfxl.exec:\xrrxfxl.exe36⤵
- Executes dropped EXE
-
\??\c:\xrxxffl.exec:\xrxxffl.exe37⤵
- Executes dropped EXE
-
\??\c:\nhbbnt.exec:\nhbbnt.exe38⤵
- Executes dropped EXE
-
\??\c:\7nntbb.exec:\7nntbb.exe39⤵
- Executes dropped EXE
-
\??\c:\vpvvj.exec:\vpvvj.exe40⤵
- Executes dropped EXE
-
\??\c:\7vpdd.exec:\7vpdd.exe41⤵
- Executes dropped EXE
-
\??\c:\pjpvv.exec:\pjpvv.exe42⤵
- Executes dropped EXE
-
\??\c:\9fflxxl.exec:\9fflxxl.exe43⤵
- Executes dropped EXE
-
\??\c:\1xrxllr.exec:\1xrxllr.exe44⤵
- Executes dropped EXE
-
\??\c:\3hbbhh.exec:\3hbbhh.exe45⤵
- Executes dropped EXE
-
\??\c:\5htbnh.exec:\5htbnh.exe46⤵
- Executes dropped EXE
-
\??\c:\htnntn.exec:\htnntn.exe47⤵
- Executes dropped EXE
-
\??\c:\dvppd.exec:\dvppd.exe48⤵
- Executes dropped EXE
-
\??\c:\jddjv.exec:\jddjv.exe49⤵
- Executes dropped EXE
-
\??\c:\rlxxfxl.exec:\rlxxfxl.exe50⤵
- Executes dropped EXE
-
\??\c:\rrlxflx.exec:\rrlxflx.exe51⤵
- Executes dropped EXE
-
\??\c:\hhtbbb.exec:\hhtbbb.exe52⤵
- Executes dropped EXE
-
\??\c:\7hhhnt.exec:\7hhhnt.exe53⤵
- Executes dropped EXE
-
\??\c:\ddvdj.exec:\ddvdj.exe54⤵
- Executes dropped EXE
-
\??\c:\1ppjj.exec:\1ppjj.exe55⤵
- Executes dropped EXE
-
\??\c:\fxrrxxl.exec:\fxrrxxl.exe56⤵
- Executes dropped EXE
-
\??\c:\1fxrxfr.exec:\1fxrxfr.exe57⤵
- Executes dropped EXE
-
\??\c:\btbbnn.exec:\btbbnn.exe58⤵
- Executes dropped EXE
-
\??\c:\nnhthn.exec:\nnhthn.exe59⤵
- Executes dropped EXE
-
\??\c:\bbtbth.exec:\bbtbth.exe60⤵
- Executes dropped EXE
-
\??\c:\vpdjj.exec:\vpdjj.exe61⤵
- Executes dropped EXE
-
\??\c:\5jjpd.exec:\5jjpd.exe62⤵
- Executes dropped EXE
-
\??\c:\7fflrxf.exec:\7fflrxf.exe63⤵
- Executes dropped EXE
-
\??\c:\7xxfrfr.exec:\7xxfrfr.exe64⤵
- Executes dropped EXE
-
\??\c:\nhbntb.exec:\nhbntb.exe65⤵
- Executes dropped EXE
-
\??\c:\7btttt.exec:\7btttt.exe66⤵
-
\??\c:\vpvjv.exec:\vpvjv.exe67⤵
-
\??\c:\jvppd.exec:\jvppd.exe68⤵
-
\??\c:\1xrxlrl.exec:\1xrxlrl.exe69⤵
-
\??\c:\xrffrrx.exec:\xrffrrx.exe70⤵
-
\??\c:\hthhtt.exec:\hthhtt.exe71⤵
-
\??\c:\tnbbnn.exec:\tnbbnn.exe72⤵
-
\??\c:\5dvdj.exec:\5dvdj.exe73⤵
-
\??\c:\7dvdd.exec:\7dvdd.exe74⤵
-
\??\c:\xxxfffl.exec:\xxxfffl.exe75⤵
-
\??\c:\xrfrfrr.exec:\xrfrfrr.exe76⤵
-
\??\c:\thttbb.exec:\thttbb.exe77⤵
-
\??\c:\ttnthh.exec:\ttnthh.exe78⤵
-
\??\c:\9nhhht.exec:\9nhhht.exe79⤵
-
\??\c:\7vjjp.exec:\7vjjp.exe80⤵
-
\??\c:\vpdpd.exec:\vpdpd.exe81⤵
-
\??\c:\1frlrrf.exec:\1frlrrf.exe82⤵
-
\??\c:\xxrxllx.exec:\xxrxllx.exe83⤵
-
\??\c:\nhbtbn.exec:\nhbtbn.exe84⤵
-
\??\c:\nhttbb.exec:\nhttbb.exe85⤵
-
\??\c:\3vddj.exec:\3vddj.exe86⤵
-
\??\c:\1jvvd.exec:\1jvvd.exe87⤵
-
\??\c:\1lxffrx.exec:\1lxffrx.exe88⤵
-
\??\c:\fllxxlr.exec:\fllxxlr.exe89⤵
-
\??\c:\nhhhnt.exec:\nhhhnt.exe90⤵
-
\??\c:\nbhhnt.exec:\nbhhnt.exe91⤵
-
\??\c:\nhttnh.exec:\nhttnh.exe92⤵
-
\??\c:\dvddd.exec:\dvddd.exe93⤵
-
\??\c:\vpddv.exec:\vpddv.exe94⤵
-
\??\c:\3frxflx.exec:\3frxflx.exe95⤵
-
\??\c:\rlflfxl.exec:\rlflfxl.exe96⤵
-
\??\c:\ttnbhn.exec:\ttnbhn.exe97⤵
-
\??\c:\tnnnnn.exec:\tnnnnn.exe98⤵
-
\??\c:\ddppv.exec:\ddppv.exe99⤵
-
\??\c:\dpdjj.exec:\dpdjj.exe100⤵
-
\??\c:\jjddd.exec:\jjddd.exe101⤵
-
\??\c:\fxrrfxx.exec:\fxrrfxx.exe102⤵
-
\??\c:\llfrffr.exec:\llfrffr.exe103⤵
-
\??\c:\bthhhb.exec:\bthhhb.exe104⤵
-
\??\c:\1bnnnn.exec:\1bnnnn.exe105⤵
-
\??\c:\1vppj.exec:\1vppj.exe106⤵
-
\??\c:\1vjdp.exec:\1vjdp.exe107⤵
-
\??\c:\lxlflxx.exec:\lxlflxx.exe108⤵
-
\??\c:\rlrflrf.exec:\rlrflrf.exe109⤵
-
\??\c:\lxlllll.exec:\lxlllll.exe110⤵
-
\??\c:\hbbhbb.exec:\hbbhbb.exe111⤵
-
\??\c:\hbhhhh.exec:\hbhhhh.exe112⤵
-
\??\c:\1vjjv.exec:\1vjjv.exe113⤵
-
\??\c:\ppvvj.exec:\ppvvj.exe114⤵
-
\??\c:\dvpvv.exec:\dvpvv.exe115⤵
-
\??\c:\rlxfffl.exec:\rlxfffl.exe116⤵
-
\??\c:\rlllrxf.exec:\rlllrxf.exe117⤵
-
\??\c:\9tnbnt.exec:\9tnbnt.exe118⤵
-
\??\c:\hbnntb.exec:\hbnntb.exe119⤵
-
\??\c:\vjvvd.exec:\vjvvd.exe120⤵
-
\??\c:\vpvdp.exec:\vpvdp.exe121⤵
-
\??\c:\dvddd.exec:\dvddd.exe122⤵
-
\??\c:\9rrxllx.exec:\9rrxllx.exe123⤵
-
\??\c:\1rlxflr.exec:\1rlxflr.exe124⤵
-
\??\c:\hbntnn.exec:\hbntnn.exe125⤵
-
\??\c:\tnbntt.exec:\tnbntt.exe126⤵
-
\??\c:\5pvvj.exec:\5pvvj.exe127⤵
-
\??\c:\5ppdj.exec:\5ppdj.exe128⤵
-
\??\c:\frlfxxx.exec:\frlfxxx.exe129⤵
-
\??\c:\lxlrrrf.exec:\lxlrrrf.exe130⤵
-
\??\c:\hbbhnn.exec:\hbbhnn.exe131⤵
-
\??\c:\thnhhh.exec:\thnhhh.exe132⤵
-
\??\c:\thbbht.exec:\thbbht.exe133⤵
-
\??\c:\1jvpp.exec:\1jvpp.exe134⤵
-
\??\c:\9jvvj.exec:\9jvvj.exe135⤵
-
\??\c:\xlxxfxf.exec:\xlxxfxf.exe136⤵
-
\??\c:\xlxlrrl.exec:\xlxlrrl.exe137⤵
-
\??\c:\nbhhhb.exec:\nbhhhb.exe138⤵
-
\??\c:\ttbnnt.exec:\ttbnnt.exe139⤵
-
\??\c:\5pjjp.exec:\5pjjp.exe140⤵
-
\??\c:\ddddj.exec:\ddddj.exe141⤵
-
\??\c:\vvvvd.exec:\vvvvd.exe142⤵
-
\??\c:\1rrrxxl.exec:\1rrrxxl.exe143⤵
-
\??\c:\rllxffr.exec:\rllxffr.exe144⤵
-
\??\c:\nhbntt.exec:\nhbntt.exe145⤵
-
\??\c:\3nhnbb.exec:\3nhnbb.exe146⤵
-
\??\c:\5jjpv.exec:\5jjpv.exe147⤵
-
\??\c:\dpvpp.exec:\dpvpp.exe148⤵
-
\??\c:\pvddj.exec:\pvddj.exe149⤵
-
\??\c:\lfxfrrx.exec:\lfxfrrx.exe150⤵
-
\??\c:\3rllrrf.exec:\3rllrrf.exe151⤵
-
\??\c:\bhnntt.exec:\bhnntt.exe152⤵
-
\??\c:\tnbhnn.exec:\tnbhnn.exe153⤵
-
\??\c:\pdvpv.exec:\pdvpv.exe154⤵
-
\??\c:\9lxlrrf.exec:\9lxlrrf.exe155⤵
-
\??\c:\rlflrxx.exec:\rlflrxx.exe156⤵
-
\??\c:\7rlrffl.exec:\7rlrffl.exe157⤵
-
\??\c:\hbnntt.exec:\hbnntt.exe158⤵
-
\??\c:\1bhhhb.exec:\1bhhhb.exe159⤵
-
\??\c:\1pdjj.exec:\1pdjj.exe160⤵
-
\??\c:\dvvvv.exec:\dvvvv.exe161⤵
-
\??\c:\3lfxxxf.exec:\3lfxxxf.exe162⤵
-
\??\c:\llxlrfr.exec:\llxlrfr.exe163⤵
-
\??\c:\1nbnnt.exec:\1nbnnt.exe164⤵
-
\??\c:\nnhnhn.exec:\nnhnhn.exe165⤵
-
\??\c:\7pjvd.exec:\7pjvd.exe166⤵
-
\??\c:\pppdp.exec:\pppdp.exe167⤵
-
\??\c:\lxlrffl.exec:\lxlrffl.exe168⤵
-
\??\c:\lfxflfr.exec:\lfxflfr.exe169⤵
-
\??\c:\xllrfff.exec:\xllrfff.exe170⤵
-
\??\c:\hhbthh.exec:\hhbthh.exe171⤵
-
\??\c:\9bbntb.exec:\9bbntb.exe172⤵
-
\??\c:\pdvvj.exec:\pdvvj.exe173⤵
-
\??\c:\pjjpp.exec:\pjjpp.exe174⤵
-
\??\c:\fxrxllx.exec:\fxrxllx.exe175⤵
-
\??\c:\lfrrxfr.exec:\lfrrxfr.exe176⤵
-
\??\c:\tnbbht.exec:\tnbbht.exe177⤵
-
\??\c:\hthbhh.exec:\hthbhh.exe178⤵
-
\??\c:\3tnnbb.exec:\3tnnbb.exe179⤵
-
\??\c:\vpppv.exec:\vpppv.exe180⤵
-
\??\c:\ddpvj.exec:\ddpvj.exe181⤵
-
\??\c:\xrlrxfl.exec:\xrlrxfl.exe182⤵
-
\??\c:\fxlxfxf.exec:\fxlxfxf.exe183⤵
-
\??\c:\1bnthb.exec:\1bnthb.exe184⤵
-
\??\c:\9hbbhn.exec:\9hbbhn.exe185⤵
-
\??\c:\3dpjj.exec:\3dpjj.exe186⤵
-
\??\c:\9vppd.exec:\9vppd.exe187⤵
-
\??\c:\frxfllr.exec:\frxfllr.exe188⤵
-
\??\c:\xrffllr.exec:\xrffllr.exe189⤵
-
\??\c:\frfxfff.exec:\frfxfff.exe190⤵
-
\??\c:\7nhhnn.exec:\7nhhnn.exe191⤵
-
\??\c:\hbnhtn.exec:\hbnhtn.exe192⤵
-
\??\c:\pdppd.exec:\pdppd.exe193⤵
-
\??\c:\vjvdj.exec:\vjvdj.exe194⤵
-
\??\c:\fxllrlr.exec:\fxllrlr.exe195⤵
-
\??\c:\7lflrxf.exec:\7lflrxf.exe196⤵
-
\??\c:\httbhh.exec:\httbhh.exe197⤵
-
\??\c:\thnntt.exec:\thnntt.exe198⤵
-
\??\c:\jvjjj.exec:\jvjjj.exe199⤵
-
\??\c:\3ppdp.exec:\3ppdp.exe200⤵
-
\??\c:\5pjjj.exec:\5pjjj.exe201⤵
-
\??\c:\rlxflrf.exec:\rlxflrf.exe202⤵
-
\??\c:\rlffflr.exec:\rlffflr.exe203⤵
-
\??\c:\1nthhh.exec:\1nthhh.exe204⤵
-
\??\c:\7hhtnn.exec:\7hhtnn.exe205⤵
-
\??\c:\vpjdj.exec:\vpjdj.exe206⤵
-
\??\c:\9vjjj.exec:\9vjjj.exe207⤵
-
\??\c:\dppjj.exec:\dppjj.exe208⤵
-
\??\c:\rlxrffr.exec:\rlxrffr.exe209⤵
-
\??\c:\1flfrxx.exec:\1flfrxx.exe210⤵
-
\??\c:\tnbntt.exec:\tnbntt.exe211⤵
-
\??\c:\htbbnt.exec:\htbbnt.exe212⤵
-
\??\c:\3ppdd.exec:\3ppdd.exe213⤵
-
\??\c:\vjdvd.exec:\vjdvd.exe214⤵
-
\??\c:\rrlrxrx.exec:\rrlrxrx.exe215⤵
-
\??\c:\frfllff.exec:\frfllff.exe216⤵
-
\??\c:\xxlrxxl.exec:\xxlrxxl.exe217⤵
-
\??\c:\tnbhtt.exec:\tnbhtt.exe218⤵
-
\??\c:\bbntbb.exec:\bbntbb.exe219⤵
-
\??\c:\jdpjj.exec:\jdpjj.exe220⤵
-
\??\c:\vpvvv.exec:\vpvvv.exe221⤵
-
\??\c:\fxlfxxf.exec:\fxlfxxf.exe222⤵
-
\??\c:\fxlllll.exec:\fxlllll.exe223⤵
-
\??\c:\lfrfffl.exec:\lfrfffl.exe224⤵
-
\??\c:\hbbhnt.exec:\hbbhnt.exe225⤵
-
\??\c:\bnntbb.exec:\bnntbb.exe226⤵
-
\??\c:\jdjjv.exec:\jdjjv.exe227⤵
-
\??\c:\1dpvd.exec:\1dpvd.exe228⤵
-
\??\c:\rlfxxxf.exec:\rlfxxxf.exe229⤵
-
\??\c:\hbbthn.exec:\hbbthn.exe230⤵
-
\??\c:\7nhhhn.exec:\7nhhhn.exe231⤵
-
\??\c:\vpvpv.exec:\vpvpv.exe232⤵
-
\??\c:\jvjjj.exec:\jvjjj.exe233⤵
-
\??\c:\dpdvp.exec:\dpdvp.exe234⤵
-
\??\c:\xrxrrxl.exec:\xrxrrxl.exe235⤵
-
\??\c:\rfllxrr.exec:\rfllxrr.exe236⤵
-
\??\c:\nhhhhb.exec:\nhhhhb.exe237⤵
-
\??\c:\9bhhhb.exec:\9bhhhb.exe238⤵
-
\??\c:\nbnhhh.exec:\nbnhhh.exe239⤵
-
\??\c:\jdpvd.exec:\jdpvd.exe240⤵
-
\??\c:\vjppj.exec:\vjppj.exe241⤵