Analysis
-
max time kernel
149s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 03:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
151487201dabf999054a286ed6fefee0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
151487201dabf999054a286ed6fefee0_NeikiAnalytics.exe
-
Size
56KB
-
MD5
151487201dabf999054a286ed6fefee0
-
SHA1
ab91b4995894fbace69d29bdcef5306a96bac34d
-
SHA256
62ce00dac153b24eb50aea3a7a52aa4e281c2b02b61ecd2c568d28b8d02fba5e
-
SHA512
fffa579d5ed996dd0c6cd315a7b06798587022f4189f85e7d82024890f08c5134d9a9075d3b05061a61194400c6a6ac3f59d0172d94c4ca53b69d8ec9817fede
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0chVnE:ymb3NkkiQ3mdBjF0crE
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/4320-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2712-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3384-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2876-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3524-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3512-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3512-42-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1844-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3248-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2152-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2212-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/980-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4932-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2268-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5076-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4928-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4080-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3616-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1256-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2468-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4892-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2576-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2256-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
fxrlffx.exetntnnn.exenbthnn.exevpjdp.exejvpdd.exerfxrffr.exehthbnn.exe3pvpj.exejpjdj.exexrlxllf.exenbbnhh.exepdjdj.exevddvj.exeflllfxr.exehhnnbt.exe9tnhtt.exevvdvp.exexllflfl.exenhbnhh.exebtnbht.exe9pdvj.exefllfxrl.exetbbtnh.exe5nnbnh.exevppjv.exexxfrxlf.exerfxxxfl.exetttthb.exebhhbtb.exejdvpj.exepvvdd.exe5rlxrrl.exe9hhbnh.exe1bnhtn.exedpjdv.exe1jjjd.exelrrrflr.exenhbtbt.exe1bbtnh.exevppdv.exefrrffxx.exetttnbt.exevpjvv.exelfrrxxr.exelxxrllf.exennnhbn.exehhhhnn.exedppjv.exerrrlrff.exexfrrffx.exetnhbbt.exedppjd.exedvjvv.exepvjdj.exe3lfrfrf.exehhhhnt.exehttnhh.exejdvjv.exejjdvp.exexrfxxff.exeffllffr.exehtnthn.exennntnh.exe9nhbnh.exepid process 2712 fxrlffx.exe 3384 tntnnn.exe 2876 nbthnn.exe 3524 vpjdp.exe 3512 jvpdd.exe 1844 rfxrffr.exe 4180 hthbnn.exe 3248 3pvpj.exe 2152 jpjdj.exe 2212 xrlxllf.exe 1872 nbbnhh.exe 980 pdjdj.exe 2668 vddvj.exe 4932 flllfxr.exe 2268 hhnnbt.exe 5076 9tnhtt.exe 4928 vvdvp.exe 4080 xllflfl.exe 3616 nhbnhh.exe 1256 btnbht.exe 4776 9pdvj.exe 2468 fllfxrl.exe 4856 tbbtnh.exe 4892 5nnbnh.exe 3684 vppjv.exe 3200 xxfrxlf.exe 3984 rfxxxfl.exe 3972 tttthb.exe 2576 bhhbtb.exe 2256 jdvpj.exe 4160 pvvdd.exe 3696 5rlxrrl.exe 1644 9hhbnh.exe 1068 1bnhtn.exe 2880 dpjdv.exe 4460 1jjjd.exe 820 lrrrflr.exe 4084 nhbtbt.exe 4248 1bbtnh.exe 4520 vppdv.exe 2092 frrffxx.exe 3612 tttnbt.exe 4172 vpjvv.exe 2640 lfrrxxr.exe 3236 lxxrllf.exe 1064 nnnhbn.exe 2980 hhhhnn.exe 1556 dppjv.exe 1572 rrrlrff.exe 3624 xfrrffx.exe 4180 tnhbbt.exe 1516 dppjd.exe 456 dvjvv.exe 4972 pvjdj.exe 3560 3lfrfrf.exe 3000 hhhhnt.exe 4920 httnhh.exe 2068 jdvjv.exe 3828 jjdvp.exe 544 xrfxxff.exe 4608 ffllffr.exe 5076 htnthn.exe 2396 nnntnh.exe 4672 9nhbnh.exe -
Processes:
resource yara_rule behavioral2/memory/4320-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2712-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3384-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2876-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3524-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3512-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1844-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4180-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3248-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2152-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2212-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/980-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4932-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2268-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5076-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4928-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4080-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3616-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1256-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2468-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2576-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2256-197-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
151487201dabf999054a286ed6fefee0_NeikiAnalytics.exefxrlffx.exetntnnn.exenbthnn.exevpjdp.exejvpdd.exerfxrffr.exehthbnn.exe3pvpj.exejpjdj.exexrlxllf.exenbbnhh.exepdjdj.exevddvj.exeflllfxr.exehhnnbt.exe9tnhtt.exevvdvp.exexllflfl.exenhbnhh.exebtnbht.exe9pdvj.exedescription pid process target process PID 4320 wrote to memory of 2712 4320 151487201dabf999054a286ed6fefee0_NeikiAnalytics.exe fxrlffx.exe PID 4320 wrote to memory of 2712 4320 151487201dabf999054a286ed6fefee0_NeikiAnalytics.exe fxrlffx.exe PID 4320 wrote to memory of 2712 4320 151487201dabf999054a286ed6fefee0_NeikiAnalytics.exe fxrlffx.exe PID 2712 wrote to memory of 3384 2712 fxrlffx.exe tntnnn.exe PID 2712 wrote to memory of 3384 2712 fxrlffx.exe tntnnn.exe PID 2712 wrote to memory of 3384 2712 fxrlffx.exe tntnnn.exe PID 3384 wrote to memory of 2876 3384 tntnnn.exe nbthnn.exe PID 3384 wrote to memory of 2876 3384 tntnnn.exe nbthnn.exe PID 3384 wrote to memory of 2876 3384 tntnnn.exe nbthnn.exe PID 2876 wrote to memory of 3524 2876 nbthnn.exe vpjdp.exe PID 2876 wrote to memory of 3524 2876 nbthnn.exe vpjdp.exe PID 2876 wrote to memory of 3524 2876 nbthnn.exe vpjdp.exe PID 3524 wrote to memory of 3512 3524 vpjdp.exe jvpdd.exe PID 3524 wrote to memory of 3512 3524 vpjdp.exe jvpdd.exe PID 3524 wrote to memory of 3512 3524 vpjdp.exe jvpdd.exe PID 3512 wrote to memory of 1844 3512 jvpdd.exe rfxrffr.exe PID 3512 wrote to memory of 1844 3512 jvpdd.exe rfxrffr.exe PID 3512 wrote to memory of 1844 3512 jvpdd.exe rfxrffr.exe PID 1844 wrote to memory of 4180 1844 rfxrffr.exe hthbnn.exe PID 1844 wrote to memory of 4180 1844 rfxrffr.exe hthbnn.exe PID 1844 wrote to memory of 4180 1844 rfxrffr.exe hthbnn.exe PID 4180 wrote to memory of 3248 4180 hthbnn.exe 3pvpj.exe PID 4180 wrote to memory of 3248 4180 hthbnn.exe 3pvpj.exe PID 4180 wrote to memory of 3248 4180 hthbnn.exe 3pvpj.exe PID 3248 wrote to memory of 2152 3248 3pvpj.exe jpjdj.exe PID 3248 wrote to memory of 2152 3248 3pvpj.exe jpjdj.exe PID 3248 wrote to memory of 2152 3248 3pvpj.exe jpjdj.exe PID 2152 wrote to memory of 2212 2152 jpjdj.exe xrlxllf.exe PID 2152 wrote to memory of 2212 2152 jpjdj.exe xrlxllf.exe PID 2152 wrote to memory of 2212 2152 jpjdj.exe xrlxllf.exe PID 2212 wrote to memory of 1872 2212 xrlxllf.exe nbbnhh.exe PID 2212 wrote to memory of 1872 2212 xrlxllf.exe nbbnhh.exe PID 2212 wrote to memory of 1872 2212 xrlxllf.exe nbbnhh.exe PID 1872 wrote to memory of 980 1872 nbbnhh.exe pdjdj.exe PID 1872 wrote to memory of 980 1872 nbbnhh.exe pdjdj.exe PID 1872 wrote to memory of 980 1872 nbbnhh.exe pdjdj.exe PID 980 wrote to memory of 2668 980 pdjdj.exe vddvj.exe PID 980 wrote to memory of 2668 980 pdjdj.exe vddvj.exe PID 980 wrote to memory of 2668 980 pdjdj.exe vddvj.exe PID 2668 wrote to memory of 4932 2668 vddvj.exe flllfxr.exe PID 2668 wrote to memory of 4932 2668 vddvj.exe flllfxr.exe PID 2668 wrote to memory of 4932 2668 vddvj.exe flllfxr.exe PID 4932 wrote to memory of 2268 4932 flllfxr.exe hhnnbt.exe PID 4932 wrote to memory of 2268 4932 flllfxr.exe hhnnbt.exe PID 4932 wrote to memory of 2268 4932 flllfxr.exe hhnnbt.exe PID 2268 wrote to memory of 5076 2268 hhnnbt.exe 9tnhtt.exe PID 2268 wrote to memory of 5076 2268 hhnnbt.exe 9tnhtt.exe PID 2268 wrote to memory of 5076 2268 hhnnbt.exe 9tnhtt.exe PID 5076 wrote to memory of 4928 5076 9tnhtt.exe vvdvp.exe PID 5076 wrote to memory of 4928 5076 9tnhtt.exe vvdvp.exe PID 5076 wrote to memory of 4928 5076 9tnhtt.exe vvdvp.exe PID 4928 wrote to memory of 4080 4928 vvdvp.exe xllflfl.exe PID 4928 wrote to memory of 4080 4928 vvdvp.exe xllflfl.exe PID 4928 wrote to memory of 4080 4928 vvdvp.exe xllflfl.exe PID 4080 wrote to memory of 3616 4080 xllflfl.exe nhbnhh.exe PID 4080 wrote to memory of 3616 4080 xllflfl.exe nhbnhh.exe PID 4080 wrote to memory of 3616 4080 xllflfl.exe nhbnhh.exe PID 3616 wrote to memory of 1256 3616 nhbnhh.exe btnbht.exe PID 3616 wrote to memory of 1256 3616 nhbnhh.exe btnbht.exe PID 3616 wrote to memory of 1256 3616 nhbnhh.exe btnbht.exe PID 1256 wrote to memory of 4776 1256 btnbht.exe 9pdvj.exe PID 1256 wrote to memory of 4776 1256 btnbht.exe 9pdvj.exe PID 1256 wrote to memory of 4776 1256 btnbht.exe 9pdvj.exe PID 4776 wrote to memory of 2468 4776 9pdvj.exe fllfxrl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\151487201dabf999054a286ed6fefee0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\151487201dabf999054a286ed6fefee0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\fxrlffx.exec:\fxrlffx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tntnnn.exec:\tntnnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbthnn.exec:\nbthnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpjdp.exec:\vpjdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvpdd.exec:\jvpdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rfxrffr.exec:\rfxrffr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hthbnn.exec:\hthbnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3pvpj.exec:\3pvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpjdj.exec:\jpjdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrlxllf.exec:\xrlxllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbbnhh.exec:\nbbnhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdjdj.exec:\pdjdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vddvj.exec:\vddvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\flllfxr.exec:\flllfxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhnnbt.exec:\hhnnbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9tnhtt.exec:\9tnhtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvdvp.exec:\vvdvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xllflfl.exec:\xllflfl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhbnhh.exec:\nhbnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btnbht.exec:\btnbht.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9pdvj.exec:\9pdvj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fllfxrl.exec:\fllfxrl.exe23⤵
- Executes dropped EXE
-
\??\c:\tbbtnh.exec:\tbbtnh.exe24⤵
- Executes dropped EXE
-
\??\c:\5nnbnh.exec:\5nnbnh.exe25⤵
- Executes dropped EXE
-
\??\c:\vppjv.exec:\vppjv.exe26⤵
- Executes dropped EXE
-
\??\c:\xxfrxlf.exec:\xxfrxlf.exe27⤵
- Executes dropped EXE
-
\??\c:\rfxxxfl.exec:\rfxxxfl.exe28⤵
- Executes dropped EXE
-
\??\c:\tttthb.exec:\tttthb.exe29⤵
- Executes dropped EXE
-
\??\c:\bhhbtb.exec:\bhhbtb.exe30⤵
- Executes dropped EXE
-
\??\c:\jdvpj.exec:\jdvpj.exe31⤵
- Executes dropped EXE
-
\??\c:\pvvdd.exec:\pvvdd.exe32⤵
- Executes dropped EXE
-
\??\c:\5rlxrrl.exec:\5rlxrrl.exe33⤵
- Executes dropped EXE
-
\??\c:\9hhbnh.exec:\9hhbnh.exe34⤵
- Executes dropped EXE
-
\??\c:\1bnhtn.exec:\1bnhtn.exe35⤵
- Executes dropped EXE
-
\??\c:\dpjdv.exec:\dpjdv.exe36⤵
- Executes dropped EXE
-
\??\c:\1jjjd.exec:\1jjjd.exe37⤵
- Executes dropped EXE
-
\??\c:\lrrrflr.exec:\lrrrflr.exe38⤵
- Executes dropped EXE
-
\??\c:\nhbtbt.exec:\nhbtbt.exe39⤵
- Executes dropped EXE
-
\??\c:\1bbtnh.exec:\1bbtnh.exe40⤵
- Executes dropped EXE
-
\??\c:\vppdv.exec:\vppdv.exe41⤵
- Executes dropped EXE
-
\??\c:\frrffxx.exec:\frrffxx.exe42⤵
- Executes dropped EXE
-
\??\c:\tttnbt.exec:\tttnbt.exe43⤵
- Executes dropped EXE
-
\??\c:\vjppj.exec:\vjppj.exe44⤵
-
\??\c:\vpjvv.exec:\vpjvv.exe45⤵
- Executes dropped EXE
-
\??\c:\lfrrxxr.exec:\lfrrxxr.exe46⤵
- Executes dropped EXE
-
\??\c:\lxxrllf.exec:\lxxrllf.exe47⤵
- Executes dropped EXE
-
\??\c:\nnnhbn.exec:\nnnhbn.exe48⤵
- Executes dropped EXE
-
\??\c:\hhhhnn.exec:\hhhhnn.exe49⤵
- Executes dropped EXE
-
\??\c:\dppjv.exec:\dppjv.exe50⤵
- Executes dropped EXE
-
\??\c:\rrrlrff.exec:\rrrlrff.exe51⤵
- Executes dropped EXE
-
\??\c:\xfrrffx.exec:\xfrrffx.exe52⤵
- Executes dropped EXE
-
\??\c:\tnhbbt.exec:\tnhbbt.exe53⤵
- Executes dropped EXE
-
\??\c:\dppjd.exec:\dppjd.exe54⤵
- Executes dropped EXE
-
\??\c:\dvjvv.exec:\dvjvv.exe55⤵
- Executes dropped EXE
-
\??\c:\pvjdj.exec:\pvjdj.exe56⤵
- Executes dropped EXE
-
\??\c:\3lfrfrf.exec:\3lfrfrf.exe57⤵
- Executes dropped EXE
-
\??\c:\hhhhnt.exec:\hhhhnt.exe58⤵
- Executes dropped EXE
-
\??\c:\httnhh.exec:\httnhh.exe59⤵
- Executes dropped EXE
-
\??\c:\jdvjv.exec:\jdvjv.exe60⤵
- Executes dropped EXE
-
\??\c:\jjdvp.exec:\jjdvp.exe61⤵
- Executes dropped EXE
-
\??\c:\xrfxxff.exec:\xrfxxff.exe62⤵
- Executes dropped EXE
-
\??\c:\ffllffr.exec:\ffllffr.exe63⤵
- Executes dropped EXE
-
\??\c:\htnthn.exec:\htnthn.exe64⤵
- Executes dropped EXE
-
\??\c:\nnntnh.exec:\nnntnh.exe65⤵
- Executes dropped EXE
-
\??\c:\9nhbnh.exec:\9nhbnh.exe66⤵
- Executes dropped EXE
-
\??\c:\vjjdp.exec:\vjjdp.exe67⤵
-
\??\c:\jjpdd.exec:\jjpdd.exe68⤵
-
\??\c:\rlfrlfx.exec:\rlfrlfx.exe69⤵
-
\??\c:\xrrrlfx.exec:\xrrrlfx.exe70⤵
-
\??\c:\1ttntn.exec:\1ttntn.exe71⤵
-
\??\c:\bnbnnt.exec:\bnbnnt.exe72⤵
-
\??\c:\vvvpv.exec:\vvvpv.exe73⤵
-
\??\c:\pddvj.exec:\pddvj.exe74⤵
-
\??\c:\frxlxrf.exec:\frxlxrf.exe75⤵
-
\??\c:\hnnnbt.exec:\hnnnbt.exe76⤵
-
\??\c:\nbtnbt.exec:\nbtnbt.exe77⤵
-
\??\c:\jvvvv.exec:\jvvvv.exe78⤵
-
\??\c:\pjjdd.exec:\pjjdd.exe79⤵
-
\??\c:\frxllll.exec:\frxllll.exe80⤵
-
\??\c:\lxrrrll.exec:\lxrrrll.exe81⤵
-
\??\c:\ttnhhb.exec:\ttnhhb.exe82⤵
-
\??\c:\btttnn.exec:\btttnn.exe83⤵
-
\??\c:\thhhtt.exec:\thhhtt.exe84⤵
-
\??\c:\9ddvj.exec:\9ddvj.exe85⤵
-
\??\c:\ppvpp.exec:\ppvpp.exe86⤵
-
\??\c:\7ffxrff.exec:\7ffxrff.exe87⤵
-
\??\c:\rffflrr.exec:\rffflrr.exe88⤵
-
\??\c:\1hnhnt.exec:\1hnhnt.exe89⤵
-
\??\c:\vpvpv.exec:\vpvpv.exe90⤵
-
\??\c:\lxxrffx.exec:\lxxrffx.exe91⤵
-
\??\c:\thbtnn.exec:\thbtnn.exe92⤵
-
\??\c:\tnhbhh.exec:\tnhbhh.exe93⤵
-
\??\c:\vpdjd.exec:\vpdjd.exe94⤵
-
\??\c:\3vdvj.exec:\3vdvj.exe95⤵
-
\??\c:\1xxxrrl.exec:\1xxxrrl.exe96⤵
-
\??\c:\httbnh.exec:\httbnh.exe97⤵
-
\??\c:\pdjdp.exec:\pdjdp.exe98⤵
-
\??\c:\jpvjv.exec:\jpvjv.exe99⤵
-
\??\c:\rxllxxl.exec:\rxllxxl.exe100⤵
-
\??\c:\lxllxxx.exec:\lxllxxx.exe101⤵
-
\??\c:\nhhnhb.exec:\nhhnhb.exe102⤵
-
\??\c:\tbbthh.exec:\tbbthh.exe103⤵
-
\??\c:\jppjj.exec:\jppjj.exe104⤵
-
\??\c:\rlxrllf.exec:\rlxrllf.exe105⤵
-
\??\c:\rxffxrl.exec:\rxffxrl.exe106⤵
-
\??\c:\thnnbn.exec:\thnnbn.exe107⤵
-
\??\c:\btttnn.exec:\btttnn.exe108⤵
-
\??\c:\ppjdd.exec:\ppjdd.exe109⤵
-
\??\c:\ddvpd.exec:\ddvpd.exe110⤵
-
\??\c:\lfrlfrl.exec:\lfrlfrl.exe111⤵
-
\??\c:\hnnhtt.exec:\hnnhtt.exe112⤵
-
\??\c:\3dddd.exec:\3dddd.exe113⤵
-
\??\c:\3xlfllx.exec:\3xlfllx.exe114⤵
-
\??\c:\tthttt.exec:\tthttt.exe115⤵
-
\??\c:\7bhbhh.exec:\7bhbhh.exe116⤵
-
\??\c:\pjpjj.exec:\pjpjj.exe117⤵
-
\??\c:\frxxrxr.exec:\frxxrxr.exe118⤵
-
\??\c:\1xxxrlf.exec:\1xxxrlf.exe119⤵
-
\??\c:\nntntt.exec:\nntntt.exe120⤵
-
\??\c:\nhhbtt.exec:\nhhbtt.exe121⤵
-
\??\c:\vdjdd.exec:\vdjdd.exe122⤵
-
\??\c:\3vpdp.exec:\3vpdp.exe123⤵
-
\??\c:\lxxxllf.exec:\lxxxllf.exe124⤵
-
\??\c:\3xxrllf.exec:\3xxrllf.exe125⤵
-
\??\c:\nhtnbb.exec:\nhtnbb.exe126⤵
-
\??\c:\hntnbt.exec:\hntnbt.exe127⤵
-
\??\c:\ntnbnn.exec:\ntnbnn.exe128⤵
-
\??\c:\dddpd.exec:\dddpd.exe129⤵
-
\??\c:\jjjdv.exec:\jjjdv.exe130⤵
-
\??\c:\lllfrlf.exec:\lllfrlf.exe131⤵
-
\??\c:\3rxrxxx.exec:\3rxrxxx.exe132⤵
-
\??\c:\hnttnn.exec:\hnttnn.exe133⤵
-
\??\c:\tthhnt.exec:\tthhnt.exe134⤵
-
\??\c:\dvpjv.exec:\dvpjv.exe135⤵
-
\??\c:\3ddvp.exec:\3ddvp.exe136⤵
-
\??\c:\xfxxrrf.exec:\xfxxrrf.exe137⤵
-
\??\c:\ffffxxr.exec:\ffffxxr.exe138⤵
-
\??\c:\lffxlfx.exec:\lffxlfx.exe139⤵
-
\??\c:\nbbtnt.exec:\nbbtnt.exe140⤵
-
\??\c:\nbtnnh.exec:\nbtnnh.exe141⤵
-
\??\c:\vpvpp.exec:\vpvpp.exe142⤵
-
\??\c:\pvpjd.exec:\pvpjd.exe143⤵
-
\??\c:\lfxlffx.exec:\lfxlffx.exe144⤵
-
\??\c:\rxxxxxr.exec:\rxxxxxr.exe145⤵
-
\??\c:\nbhbbt.exec:\nbhbbt.exe146⤵
-
\??\c:\bnhnhb.exec:\bnhnhb.exe147⤵
-
\??\c:\bnthbt.exec:\bnthbt.exe148⤵
-
\??\c:\vdjpp.exec:\vdjpp.exe149⤵
-
\??\c:\7jppj.exec:\7jppj.exe150⤵
-
\??\c:\ffrfxrl.exec:\ffrfxrl.exe151⤵
-
\??\c:\frllfxr.exec:\frllfxr.exe152⤵
-
\??\c:\nhhttt.exec:\nhhttt.exe153⤵
-
\??\c:\vdvpp.exec:\vdvpp.exe154⤵
-
\??\c:\pdvdv.exec:\pdvdv.exe155⤵
-
\??\c:\fxrlffx.exec:\fxrlffx.exe156⤵
-
\??\c:\fxxxlfr.exec:\fxxxlfr.exe157⤵
-
\??\c:\1fxrffr.exec:\1fxrffr.exe158⤵
-
\??\c:\9nbbbh.exec:\9nbbbh.exe159⤵
-
\??\c:\hbnhbt.exec:\hbnhbt.exe160⤵
-
\??\c:\pvvjj.exec:\pvvjj.exe161⤵
-
\??\c:\jjvvd.exec:\jjvvd.exe162⤵
-
\??\c:\rxxrlfx.exec:\rxxrlfx.exe163⤵
-
\??\c:\5rfflrx.exec:\5rfflrx.exe164⤵
-
\??\c:\fxxrllf.exec:\fxxrllf.exe165⤵
-
\??\c:\7tnbtn.exec:\7tnbtn.exe166⤵
-
\??\c:\nbnnbb.exec:\nbnnbb.exe167⤵
-
\??\c:\jvvjv.exec:\jvvjv.exe168⤵
-
\??\c:\dpdpd.exec:\dpdpd.exe169⤵
-
\??\c:\pjjpp.exec:\pjjpp.exe170⤵
-
\??\c:\frrxflf.exec:\frrxflf.exe171⤵
-
\??\c:\llxfrxr.exec:\llxfrxr.exe172⤵
-
\??\c:\nhtnht.exec:\nhtnht.exe173⤵
-
\??\c:\vjvvv.exec:\vjvvv.exe174⤵
-
\??\c:\rrxrrrr.exec:\rrxrrrr.exe175⤵
-
\??\c:\1xlfxrl.exec:\1xlfxrl.exe176⤵
-
\??\c:\lxxrfrl.exec:\lxxrfrl.exe177⤵
-
\??\c:\thhbnn.exec:\thhbnn.exe178⤵
-
\??\c:\1hnbnb.exec:\1hnbnb.exe179⤵
-
\??\c:\vpdjp.exec:\vpdjp.exe180⤵
-
\??\c:\xxrrrrx.exec:\xxrrrrx.exe181⤵
-
\??\c:\hbhhhh.exec:\hbhhhh.exe182⤵
-
\??\c:\thnnhh.exec:\thnnhh.exe183⤵
-
\??\c:\vppjv.exec:\vppjv.exe184⤵
-
\??\c:\dpjvv.exec:\dpjvv.exe185⤵
-
\??\c:\fxxxllf.exec:\fxxxllf.exe186⤵
-
\??\c:\nhnhtn.exec:\nhnhtn.exe187⤵
-
\??\c:\vpvpj.exec:\vpvpj.exe188⤵
-
\??\c:\xxrlflf.exec:\xxrlflf.exe189⤵
-
\??\c:\rfrrlff.exec:\rfrrlff.exe190⤵
-
\??\c:\7dvvv.exec:\7dvvv.exe191⤵
-
\??\c:\pdjdd.exec:\pdjdd.exe192⤵
-
\??\c:\xlfxlfx.exec:\xlfxlfx.exe193⤵
-
\??\c:\tbbbbb.exec:\tbbbbb.exe194⤵
-
\??\c:\hnnttn.exec:\hnnttn.exe195⤵
-
\??\c:\1xxxfll.exec:\1xxxfll.exe196⤵
-
\??\c:\7bhnnt.exec:\7bhnnt.exe197⤵
-
\??\c:\dvppj.exec:\dvppj.exe198⤵
-
\??\c:\rlxrxrr.exec:\rlxrxrr.exe199⤵
-
\??\c:\1ntnnn.exec:\1ntnnn.exe200⤵
-
\??\c:\pjjdp.exec:\pjjdp.exe201⤵
-
\??\c:\lrxrfff.exec:\lrxrfff.exe202⤵
-
\??\c:\flfxrrr.exec:\flfxrrr.exe203⤵
-
\??\c:\bhbnbt.exec:\bhbnbt.exe204⤵
-
\??\c:\hnhhbb.exec:\hnhhbb.exe205⤵
-
\??\c:\nttttt.exec:\nttttt.exe206⤵
-
\??\c:\pjppp.exec:\pjppp.exe207⤵
-
\??\c:\jvdpj.exec:\jvdpj.exe208⤵
-
\??\c:\xffrlfx.exec:\xffrlfx.exe209⤵
-
\??\c:\rrlfrll.exec:\rrlfrll.exe210⤵
-
\??\c:\3bhhht.exec:\3bhhht.exe211⤵
-
\??\c:\bnnbnh.exec:\bnnbnh.exe212⤵
-
\??\c:\3vjdv.exec:\3vjdv.exe213⤵
-
\??\c:\vjppd.exec:\vjppd.exe214⤵
-
\??\c:\xfrlxxf.exec:\xfrlxxf.exe215⤵
-
\??\c:\xrfxrrl.exec:\xrfxrrl.exe216⤵
-
\??\c:\xlfxrll.exec:\xlfxrll.exe217⤵
-
\??\c:\nhnhnh.exec:\nhnhnh.exe218⤵
-
\??\c:\7bbhtt.exec:\7bbhtt.exe219⤵
-
\??\c:\jjvjd.exec:\jjvjd.exe220⤵
-
\??\c:\vppdv.exec:\vppdv.exe221⤵
-
\??\c:\xfrlfff.exec:\xfrlfff.exe222⤵
-
\??\c:\7rrrlfx.exec:\7rrrlfx.exe223⤵
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe224⤵
-
\??\c:\btbtbt.exec:\btbtbt.exe225⤵
-
\??\c:\bnhbhb.exec:\bnhbhb.exe226⤵
-
\??\c:\vdvpp.exec:\vdvpp.exe227⤵
-
\??\c:\dvpdv.exec:\dvpdv.exe228⤵
-
\??\c:\xrrffxr.exec:\xrrffxr.exe229⤵
-
\??\c:\frrfrlf.exec:\frrfrlf.exe230⤵
-
\??\c:\3tnbtt.exec:\3tnbtt.exe231⤵
-
\??\c:\nhhtht.exec:\nhhtht.exe232⤵
-
\??\c:\1pvpd.exec:\1pvpd.exe233⤵
-
\??\c:\pdjdj.exec:\pdjdj.exe234⤵
-
\??\c:\ffrfxrl.exec:\ffrfxrl.exe235⤵
-
\??\c:\lfffllr.exec:\lfffllr.exe236⤵
-
\??\c:\hbbttt.exec:\hbbttt.exe237⤵
-
\??\c:\htnhtn.exec:\htnhtn.exe238⤵
-
\??\c:\ttbbtn.exec:\ttbbtn.exe239⤵
-
\??\c:\vpjvj.exec:\vpjvj.exe240⤵
-
\??\c:\jjpjd.exec:\jjpjd.exe241⤵