Analysis
-
max time kernel
144s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 22:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
989f6c32514881accc24966214b88280_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
989f6c32514881accc24966214b88280_NeikiAnalytics.exe
-
Size
70KB
-
MD5
989f6c32514881accc24966214b88280
-
SHA1
ff89154ed280ea487295859e38603e62d9bf03ca
-
SHA256
dae4e8a264a50e0c86c65abdc71e56d3b31a2c24097975474c630f849b515789
-
SHA512
147e3c9eeb31b07f905dfa884f01004bcd99cd6adb579e1615eb4eee971db4ca41586cd726599bc1f4a808f11ff939ba790750c9263087ff6278af04c543e103
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIgUVyiAnfb:ymb3NkkiQ3mdBjFIgUEBb
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/1664-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2108-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1492-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1348-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1168-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1936-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1204-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1284-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/964-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1972-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1076-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bbtjlbh.exeptbjh.exentdvjf.exebtrdjlv.exepbvfp.exertjjtp.exetjbnd.exedlljf.exebjdtd.exevxvttlt.exeblpfrj.exexltlnhp.exefnprtl.exetjftx.exexxjxxdb.exelxbnbr.exeptlhxtl.exelvddt.exehpptl.exetxlnl.exedthtpx.exedbnnvt.exerblfrbt.exerxrhrvt.exevtrhntt.exenvnjtvh.exevrlxhb.exexddddhd.exejprnxl.exelptjh.exebtbxdfv.exejntff.exexppbn.exejhbvl.exerpbrtpn.exedjjtpf.exehjttnj.exedftfr.exeffdxrh.exebrdvrdl.exedflnhrx.exeftpbr.exejjxvbbd.exephphp.exenbnvpn.exelbxxph.exetvxhtrj.exerdnhrrp.exebbvvdv.exeptpbx.exehndnxn.exeflhpj.exebltdt.exethffdpx.exebnxtv.exelldxnvf.exelxlnbh.exebnddrhv.exejdptrdl.exevjdjfv.exelhdhxfl.exeddddvd.exedddntxp.exetljdhlj.exepid process 2632 bbtjlbh.exe 2108 ptbjh.exe 2580 ntdvjf.exe 2484 btrdjlv.exe 2704 pbvfp.exe 2524 rtjjtp.exe 2368 tjbnd.exe 2988 dlljf.exe 1492 bjdtd.exe 2640 vxvttlt.exe 2692 blpfrj.exe 1348 xltlnhp.exe 1996 fnprtl.exe 1196 tjftx.exe 1168 xxjxxdb.exe 1776 lxbnbr.exe 1936 ptlhxtl.exe 916 lvddt.exe 1204 hpptl.exe 2728 txlnl.exe 2872 dthtpx.exe 644 dbnnvt.exe 3008 rblfrbt.exe 1284 rxrhrvt.exe 964 vtrhntt.exe 2996 nvnjtvh.exe 1972 vrlxhb.exe 600 xddddhd.exe 2912 jprnxl.exe 1076 lptjh.exe 2088 btbxdfv.exe 864 jntff.exe 2432 xppbn.exe 2532 jhbvl.exe 2480 rpbrtpn.exe 2688 djjtpf.exe 2560 hjttnj.exe 3064 dftfr.exe 2636 ffdxrh.exe 2572 brdvrdl.exe 2372 dflnhrx.exe 2616 ftpbr.exe 2352 jjxvbbd.exe 2472 phphp.exe 2952 nbnvpn.exe 628 lbxxph.exe 1608 tvxhtrj.exe 2648 rdnhrrp.exe 2792 bbvvdv.exe 1716 ptpbx.exe 2308 hndnxn.exe 1192 flhpj.exe 824 bltdt.exe 1968 thffdpx.exe 1620 bnxtv.exe 880 lldxnvf.exe 1704 lxlnbh.exe 2076 bnddrhv.exe 1256 jdptrdl.exe 1204 vjdjfv.exe 2860 lhdhxfl.exe 2848 ddddvd.exe 2208 dddntxp.exe 2136 tljdhlj.exe -
Processes:
resource yara_rule behavioral1/memory/1664-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2108-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1492-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1348-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1168-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1936-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1204-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1284-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/964-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1972-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1076-298-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
989f6c32514881accc24966214b88280_NeikiAnalytics.exebbtjlbh.exeptbjh.exentdvjf.exebtrdjlv.exepbvfp.exertjjtp.exetjbnd.exedlljf.exebjdtd.exevxvttlt.exeblpfrj.exexltlnhp.exefnprtl.exetjftx.exexxjxxdb.exedescription pid process target process PID 1664 wrote to memory of 2632 1664 989f6c32514881accc24966214b88280_NeikiAnalytics.exe bbtjlbh.exe PID 1664 wrote to memory of 2632 1664 989f6c32514881accc24966214b88280_NeikiAnalytics.exe bbtjlbh.exe PID 1664 wrote to memory of 2632 1664 989f6c32514881accc24966214b88280_NeikiAnalytics.exe bbtjlbh.exe PID 1664 wrote to memory of 2632 1664 989f6c32514881accc24966214b88280_NeikiAnalytics.exe bbtjlbh.exe PID 2632 wrote to memory of 2108 2632 bbtjlbh.exe ptbjh.exe PID 2632 wrote to memory of 2108 2632 bbtjlbh.exe ptbjh.exe PID 2632 wrote to memory of 2108 2632 bbtjlbh.exe ptbjh.exe PID 2632 wrote to memory of 2108 2632 bbtjlbh.exe ptbjh.exe PID 2108 wrote to memory of 2580 2108 ptbjh.exe ntdvjf.exe PID 2108 wrote to memory of 2580 2108 ptbjh.exe ntdvjf.exe PID 2108 wrote to memory of 2580 2108 ptbjh.exe ntdvjf.exe PID 2108 wrote to memory of 2580 2108 ptbjh.exe ntdvjf.exe PID 2580 wrote to memory of 2484 2580 ntdvjf.exe btrdjlv.exe PID 2580 wrote to memory of 2484 2580 ntdvjf.exe btrdjlv.exe PID 2580 wrote to memory of 2484 2580 ntdvjf.exe btrdjlv.exe PID 2580 wrote to memory of 2484 2580 ntdvjf.exe btrdjlv.exe PID 2484 wrote to memory of 2704 2484 btrdjlv.exe pbvfp.exe PID 2484 wrote to memory of 2704 2484 btrdjlv.exe pbvfp.exe PID 2484 wrote to memory of 2704 2484 btrdjlv.exe pbvfp.exe PID 2484 wrote to memory of 2704 2484 btrdjlv.exe pbvfp.exe PID 2704 wrote to memory of 2524 2704 pbvfp.exe rtjjtp.exe PID 2704 wrote to memory of 2524 2704 pbvfp.exe rtjjtp.exe PID 2704 wrote to memory of 2524 2704 pbvfp.exe rtjjtp.exe PID 2704 wrote to memory of 2524 2704 pbvfp.exe rtjjtp.exe PID 2524 wrote to memory of 2368 2524 rtjjtp.exe tjbnd.exe PID 2524 wrote to memory of 2368 2524 rtjjtp.exe tjbnd.exe PID 2524 wrote to memory of 2368 2524 rtjjtp.exe tjbnd.exe PID 2524 wrote to memory of 2368 2524 rtjjtp.exe tjbnd.exe PID 2368 wrote to memory of 2988 2368 tjbnd.exe dlljf.exe PID 2368 wrote to memory of 2988 2368 tjbnd.exe dlljf.exe PID 2368 wrote to memory of 2988 2368 tjbnd.exe dlljf.exe PID 2368 wrote to memory of 2988 2368 tjbnd.exe dlljf.exe PID 2988 wrote to memory of 1492 2988 dlljf.exe bjdtd.exe PID 2988 wrote to memory of 1492 2988 dlljf.exe bjdtd.exe PID 2988 wrote to memory of 1492 2988 dlljf.exe bjdtd.exe PID 2988 wrote to memory of 1492 2988 dlljf.exe bjdtd.exe PID 1492 wrote to memory of 2640 1492 bjdtd.exe vxvttlt.exe PID 1492 wrote to memory of 2640 1492 bjdtd.exe vxvttlt.exe PID 1492 wrote to memory of 2640 1492 bjdtd.exe vxvttlt.exe PID 1492 wrote to memory of 2640 1492 bjdtd.exe vxvttlt.exe PID 2640 wrote to memory of 2692 2640 vxvttlt.exe blpfrj.exe PID 2640 wrote to memory of 2692 2640 vxvttlt.exe blpfrj.exe PID 2640 wrote to memory of 2692 2640 vxvttlt.exe blpfrj.exe PID 2640 wrote to memory of 2692 2640 vxvttlt.exe blpfrj.exe PID 2692 wrote to memory of 1348 2692 blpfrj.exe xltlnhp.exe PID 2692 wrote to memory of 1348 2692 blpfrj.exe xltlnhp.exe PID 2692 wrote to memory of 1348 2692 blpfrj.exe xltlnhp.exe PID 2692 wrote to memory of 1348 2692 blpfrj.exe xltlnhp.exe PID 1348 wrote to memory of 1996 1348 xltlnhp.exe fnprtl.exe PID 1348 wrote to memory of 1996 1348 xltlnhp.exe fnprtl.exe PID 1348 wrote to memory of 1996 1348 xltlnhp.exe fnprtl.exe PID 1348 wrote to memory of 1996 1348 xltlnhp.exe fnprtl.exe PID 1996 wrote to memory of 1196 1996 fnprtl.exe tjftx.exe PID 1996 wrote to memory of 1196 1996 fnprtl.exe tjftx.exe PID 1996 wrote to memory of 1196 1996 fnprtl.exe tjftx.exe PID 1996 wrote to memory of 1196 1996 fnprtl.exe tjftx.exe PID 1196 wrote to memory of 1168 1196 tjftx.exe xxjxxdb.exe PID 1196 wrote to memory of 1168 1196 tjftx.exe xxjxxdb.exe PID 1196 wrote to memory of 1168 1196 tjftx.exe xxjxxdb.exe PID 1196 wrote to memory of 1168 1196 tjftx.exe xxjxxdb.exe PID 1168 wrote to memory of 1776 1168 xxjxxdb.exe lxbnbr.exe PID 1168 wrote to memory of 1776 1168 xxjxxdb.exe lxbnbr.exe PID 1168 wrote to memory of 1776 1168 xxjxxdb.exe lxbnbr.exe PID 1168 wrote to memory of 1776 1168 xxjxxdb.exe lxbnbr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\989f6c32514881accc24966214b88280_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\989f6c32514881accc24966214b88280_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\bbtjlbh.exec:\bbtjlbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ptbjh.exec:\ptbjh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ntdvjf.exec:\ntdvjf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btrdjlv.exec:\btrdjlv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pbvfp.exec:\pbvfp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rtjjtp.exec:\rtjjtp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tjbnd.exec:\tjbnd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dlljf.exec:\dlljf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bjdtd.exec:\bjdtd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vxvttlt.exec:\vxvttlt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\blpfrj.exec:\blpfrj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xltlnhp.exec:\xltlnhp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fnprtl.exec:\fnprtl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tjftx.exec:\tjftx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxjxxdb.exec:\xxjxxdb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxbnbr.exec:\lxbnbr.exe17⤵
- Executes dropped EXE
-
\??\c:\ptlhxtl.exec:\ptlhxtl.exe18⤵
- Executes dropped EXE
-
\??\c:\lvddt.exec:\lvddt.exe19⤵
- Executes dropped EXE
-
\??\c:\hpptl.exec:\hpptl.exe20⤵
- Executes dropped EXE
-
\??\c:\txlnl.exec:\txlnl.exe21⤵
- Executes dropped EXE
-
\??\c:\dthtpx.exec:\dthtpx.exe22⤵
- Executes dropped EXE
-
\??\c:\dbnnvt.exec:\dbnnvt.exe23⤵
- Executes dropped EXE
-
\??\c:\rblfrbt.exec:\rblfrbt.exe24⤵
- Executes dropped EXE
-
\??\c:\rxrhrvt.exec:\rxrhrvt.exe25⤵
- Executes dropped EXE
-
\??\c:\vtrhntt.exec:\vtrhntt.exe26⤵
- Executes dropped EXE
-
\??\c:\nvnjtvh.exec:\nvnjtvh.exe27⤵
- Executes dropped EXE
-
\??\c:\vrlxhb.exec:\vrlxhb.exe28⤵
- Executes dropped EXE
-
\??\c:\xddddhd.exec:\xddddhd.exe29⤵
- Executes dropped EXE
-
\??\c:\jprnxl.exec:\jprnxl.exe30⤵
- Executes dropped EXE
-
\??\c:\lptjh.exec:\lptjh.exe31⤵
- Executes dropped EXE
-
\??\c:\btbxdfv.exec:\btbxdfv.exe32⤵
- Executes dropped EXE
-
\??\c:\jntff.exec:\jntff.exe33⤵
- Executes dropped EXE
-
\??\c:\xppbn.exec:\xppbn.exe34⤵
- Executes dropped EXE
-
\??\c:\jhbvl.exec:\jhbvl.exe35⤵
- Executes dropped EXE
-
\??\c:\rpbrtpn.exec:\rpbrtpn.exe36⤵
- Executes dropped EXE
-
\??\c:\djjtpf.exec:\djjtpf.exe37⤵
- Executes dropped EXE
-
\??\c:\hjttnj.exec:\hjttnj.exe38⤵
- Executes dropped EXE
-
\??\c:\dftfr.exec:\dftfr.exe39⤵
- Executes dropped EXE
-
\??\c:\ffdxrh.exec:\ffdxrh.exe40⤵
- Executes dropped EXE
-
\??\c:\brdvrdl.exec:\brdvrdl.exe41⤵
- Executes dropped EXE
-
\??\c:\dflnhrx.exec:\dflnhrx.exe42⤵
- Executes dropped EXE
-
\??\c:\ftpbr.exec:\ftpbr.exe43⤵
- Executes dropped EXE
-
\??\c:\jjxvbbd.exec:\jjxvbbd.exe44⤵
- Executes dropped EXE
-
\??\c:\phphp.exec:\phphp.exe45⤵
- Executes dropped EXE
-
\??\c:\nbnvpn.exec:\nbnvpn.exe46⤵
- Executes dropped EXE
-
\??\c:\lbxxph.exec:\lbxxph.exe47⤵
- Executes dropped EXE
-
\??\c:\tvxhtrj.exec:\tvxhtrj.exe48⤵
- Executes dropped EXE
-
\??\c:\rdnhrrp.exec:\rdnhrrp.exe49⤵
- Executes dropped EXE
-
\??\c:\bbvvdv.exec:\bbvvdv.exe50⤵
- Executes dropped EXE
-
\??\c:\ptpbx.exec:\ptpbx.exe51⤵
- Executes dropped EXE
-
\??\c:\hndnxn.exec:\hndnxn.exe52⤵
- Executes dropped EXE
-
\??\c:\flhpj.exec:\flhpj.exe53⤵
- Executes dropped EXE
-
\??\c:\bltdt.exec:\bltdt.exe54⤵
- Executes dropped EXE
-
\??\c:\thffdpx.exec:\thffdpx.exe55⤵
- Executes dropped EXE
-
\??\c:\bnxtv.exec:\bnxtv.exe56⤵
- Executes dropped EXE
-
\??\c:\lldxnvf.exec:\lldxnvf.exe57⤵
- Executes dropped EXE
-
\??\c:\lxlnbh.exec:\lxlnbh.exe58⤵
- Executes dropped EXE
-
\??\c:\bnddrhv.exec:\bnddrhv.exe59⤵
- Executes dropped EXE
-
\??\c:\jdptrdl.exec:\jdptrdl.exe60⤵
- Executes dropped EXE
-
\??\c:\vjdjfv.exec:\vjdjfv.exe61⤵
- Executes dropped EXE
-
\??\c:\lhdhxfl.exec:\lhdhxfl.exe62⤵
- Executes dropped EXE
-
\??\c:\ddddvd.exec:\ddddvd.exe63⤵
- Executes dropped EXE
-
\??\c:\dddntxp.exec:\dddntxp.exe64⤵
- Executes dropped EXE
-
\??\c:\tljdhlj.exec:\tljdhlj.exe65⤵
- Executes dropped EXE
-
\??\c:\rllvd.exec:\rllvd.exe66⤵
-
\??\c:\vfbbddt.exec:\vfbbddt.exe67⤵
-
\??\c:\pbvpnfx.exec:\pbvpnfx.exe68⤵
-
\??\c:\jxnvt.exec:\jxnvt.exe69⤵
-
\??\c:\jxrnrhf.exec:\jxrnrhf.exe70⤵
-
\??\c:\ppxtvvl.exec:\ppxtvvl.exe71⤵
-
\??\c:\hnbpfv.exec:\hnbpfv.exe72⤵
-
\??\c:\tlfln.exec:\tlfln.exe73⤵
-
\??\c:\lxtnhvt.exec:\lxtnhvt.exe74⤵
-
\??\c:\ndtnb.exec:\ndtnb.exe75⤵
-
\??\c:\fdhfj.exec:\fdhfj.exe76⤵
-
\??\c:\rxlhh.exec:\rxlhh.exe77⤵
-
\??\c:\hntbth.exec:\hntbth.exe78⤵
-
\??\c:\xxnjj.exec:\xxnjj.exe79⤵
-
\??\c:\xdlvn.exec:\xdlvn.exe80⤵
-
\??\c:\lldpf.exec:\lldpf.exe81⤵
-
\??\c:\brjxnj.exec:\brjxnj.exe82⤵
-
\??\c:\jfnlxd.exec:\jfnlxd.exe83⤵
-
\??\c:\vbfvflt.exec:\vbfvflt.exe84⤵
-
\??\c:\ldvpfh.exec:\ldvpfh.exe85⤵
-
\??\c:\xrxpd.exec:\xrxpd.exe86⤵
-
\??\c:\jxjjt.exec:\jxjjt.exe87⤵
-
\??\c:\dpnpp.exec:\dpnpp.exe88⤵
-
\??\c:\ppjftx.exec:\ppjftx.exe89⤵
-
\??\c:\txfrdpd.exec:\txfrdpd.exe90⤵
-
\??\c:\xfppvf.exec:\xfppvf.exe91⤵
-
\??\c:\lxhpb.exec:\lxhpb.exe92⤵
-
\??\c:\ppnbpx.exec:\ppnbpx.exe93⤵
-
\??\c:\jvfvhfl.exec:\jvfvhfl.exe94⤵
-
\??\c:\llplrh.exec:\llplrh.exe95⤵
-
\??\c:\jhlttlv.exec:\jhlttlv.exe96⤵
-
\??\c:\dtndvh.exec:\dtndvh.exe97⤵
-
\??\c:\frtxr.exec:\frtxr.exe98⤵
-
\??\c:\vthll.exec:\vthll.exe99⤵
-
\??\c:\fdljlp.exec:\fdljlp.exe100⤵
-
\??\c:\hrhxrlv.exec:\hrhxrlv.exe101⤵
-
\??\c:\fpvhd.exec:\fpvhd.exe102⤵
-
\??\c:\nbrlj.exec:\nbrlj.exe103⤵
-
\??\c:\pjvbf.exec:\pjvbf.exe104⤵
-
\??\c:\vffvr.exec:\vffvr.exe105⤵
-
\??\c:\ntnlvfb.exec:\ntnlvfb.exe106⤵
-
\??\c:\pfhbvjh.exec:\pfhbvjh.exe107⤵
-
\??\c:\djhtjxf.exec:\djhtjxf.exe108⤵
-
\??\c:\rdjdn.exec:\rdjdn.exe109⤵
-
\??\c:\jtjlxj.exec:\jtjlxj.exe110⤵
-
\??\c:\blpxblr.exec:\blpxblr.exe111⤵
-
\??\c:\lbtdxvn.exec:\lbtdxvn.exe112⤵
-
\??\c:\rvjlllf.exec:\rvjlllf.exe113⤵
-
\??\c:\frbhntd.exec:\frbhntd.exe114⤵
-
\??\c:\jpttn.exec:\jpttn.exe115⤵
-
\??\c:\jdhvxp.exec:\jdhvxp.exe116⤵
-
\??\c:\prvrdjx.exec:\prvrdjx.exe117⤵
-
\??\c:\vrpxdx.exec:\vrpxdx.exe118⤵
-
\??\c:\thjpt.exec:\thjpt.exe119⤵
-
\??\c:\lhjnbth.exec:\lhjnbth.exe120⤵
-
\??\c:\dhbfff.exec:\dhbfff.exe121⤵
-
\??\c:\fjfln.exec:\fjfln.exe122⤵
-
\??\c:\jdlllvr.exec:\jdlllvr.exe123⤵
-
\??\c:\vnxbhvb.exec:\vnxbhvb.exe124⤵
-
\??\c:\ljfnf.exec:\ljfnf.exe125⤵
-
\??\c:\hxdtnpn.exec:\hxdtnpn.exe126⤵
-
\??\c:\vdxpnvh.exec:\vdxpnvh.exe127⤵
-
\??\c:\xprbd.exec:\xprbd.exe128⤵
-
\??\c:\dttbhr.exec:\dttbhr.exe129⤵
-
\??\c:\xrdxp.exec:\xrdxp.exe130⤵
-
\??\c:\rlndl.exec:\rlndl.exe131⤵
-
\??\c:\fhxdrhj.exec:\fhxdrhj.exe132⤵
-
\??\c:\dvhflx.exec:\dvhflx.exe133⤵
-
\??\c:\hlpdn.exec:\hlpdn.exe134⤵
-
\??\c:\ntdjhd.exec:\ntdjhd.exe135⤵
-
\??\c:\vtvthdj.exec:\vtvthdj.exe136⤵
-
\??\c:\nrlhlt.exec:\nrlhlt.exe137⤵
-
\??\c:\frhlh.exec:\frhlh.exe138⤵
-
\??\c:\lvlrlbr.exec:\lvlrlbr.exe139⤵
-
\??\c:\htnbx.exec:\htnbx.exe140⤵
-
\??\c:\jvxdhn.exec:\jvxdhn.exe141⤵
-
\??\c:\nlppbbn.exec:\nlppbbn.exe142⤵
-
\??\c:\ltpvdjh.exec:\ltpvdjh.exe143⤵
-
\??\c:\xndhdfv.exec:\xndhdfv.exe144⤵
-
\??\c:\jjdntlh.exec:\jjdntlh.exe145⤵
-
\??\c:\lfdphn.exec:\lfdphn.exe146⤵
-
\??\c:\bldtll.exec:\bldtll.exe147⤵
-
\??\c:\blvntl.exec:\blvntl.exe148⤵
-
\??\c:\txjxd.exec:\txjxd.exe149⤵
-
\??\c:\lhrpljl.exec:\lhrpljl.exe150⤵
-
\??\c:\rvxnv.exec:\rvxnv.exe151⤵
-
\??\c:\dthbxt.exec:\dthbxt.exe152⤵
-
\??\c:\rpdnhx.exec:\rpdnhx.exe153⤵
-
\??\c:\vdvtt.exec:\vdvtt.exe154⤵
-
\??\c:\lhvnjd.exec:\lhvnjd.exe155⤵
-
\??\c:\ldndf.exec:\ldndf.exe156⤵
-
\??\c:\hdpvvfr.exec:\hdpvvfr.exe157⤵
-
\??\c:\dfhbld.exec:\dfhbld.exe158⤵
-
\??\c:\rltdlp.exec:\rltdlp.exe159⤵
-
\??\c:\xlxpb.exec:\xlxpb.exe160⤵
-
\??\c:\dvbbrrp.exec:\dvbbrrp.exe161⤵
-
\??\c:\plxflpv.exec:\plxflpv.exe162⤵
-
\??\c:\ppxpd.exec:\ppxpd.exe163⤵
-
\??\c:\rhxfrp.exec:\rhxfrp.exe164⤵
-
\??\c:\xtljvfd.exec:\xtljvfd.exe165⤵
-
\??\c:\htbdbnd.exec:\htbdbnd.exe166⤵
-
\??\c:\jplbtv.exec:\jplbtv.exe167⤵
-
\??\c:\ldpld.exec:\ldpld.exe168⤵
-
\??\c:\dfjrfdj.exec:\dfjrfdj.exe169⤵
-
\??\c:\njhxl.exec:\njhxl.exe170⤵
-
\??\c:\xxtrb.exec:\xxtrb.exe171⤵
-
\??\c:\jnpfxfj.exec:\jnpfxfj.exe172⤵
-
\??\c:\jltxljn.exec:\jltxljn.exe173⤵
-
\??\c:\pjjbvvv.exec:\pjjbvvv.exe174⤵
-
\??\c:\jnbvt.exec:\jnbvt.exe175⤵
-
\??\c:\nllrllr.exec:\nllrllr.exe176⤵
-
\??\c:\plntl.exec:\plntl.exe177⤵
-
\??\c:\jvnnxr.exec:\jvnnxr.exe178⤵
-
\??\c:\txrpt.exec:\txrpt.exe179⤵
-
\??\c:\tfjnv.exec:\tfjnv.exe180⤵
-
\??\c:\dprhdnd.exec:\dprhdnd.exe181⤵
-
\??\c:\xxrnx.exec:\xxrnx.exe182⤵
-
\??\c:\bhljr.exec:\bhljr.exe183⤵
-
\??\c:\bnjxd.exec:\bnjxd.exe184⤵
-
\??\c:\bvdnfdp.exec:\bvdnfdp.exe185⤵
-
\??\c:\ptjfvr.exec:\ptjfvr.exe186⤵
-
\??\c:\xhffnv.exec:\xhffnv.exe187⤵
-
\??\c:\vrxxjx.exec:\vrxxjx.exe188⤵
-
\??\c:\tnlhvt.exec:\tnlhvt.exe189⤵
-
\??\c:\rnjbf.exec:\rnjbf.exe190⤵
-
\??\c:\thdntjb.exec:\thdntjb.exe191⤵
-
\??\c:\xlhhhxl.exec:\xlhhhxl.exe192⤵
-
\??\c:\bjtbb.exec:\bjtbb.exe193⤵
-
\??\c:\hbbbht.exec:\hbbbht.exe194⤵
-
\??\c:\phlpjph.exec:\phlpjph.exe195⤵
-
\??\c:\lhdftdb.exec:\lhdftdb.exe196⤵
-
\??\c:\pdjlld.exec:\pdjlld.exe197⤵
-
\??\c:\prxbd.exec:\prxbd.exe198⤵
-
\??\c:\xltlf.exec:\xltlf.exe199⤵
-
\??\c:\fdthxf.exec:\fdthxf.exe200⤵
-
\??\c:\hnjfb.exec:\hnjfb.exe201⤵
-
\??\c:\jhrjdl.exec:\jhrjdl.exe202⤵
-
\??\c:\fpvrhn.exec:\fpvrhn.exe203⤵
-
\??\c:\plhdj.exec:\plhdj.exe204⤵
-
\??\c:\xlhlv.exec:\xlhlv.exe205⤵
-
\??\c:\vfvlf.exec:\vfvlf.exe206⤵
-
\??\c:\xjtffv.exec:\xjtffv.exe207⤵
-
\??\c:\drfrpxv.exec:\drfrpxv.exe208⤵
-
\??\c:\ldtljlr.exec:\ldtljlr.exe209⤵
-
\??\c:\nlxfjpx.exec:\nlxfjpx.exe210⤵
-
\??\c:\ndhtnv.exec:\ndhtnv.exe211⤵
-
\??\c:\nffplj.exec:\nffplj.exe212⤵
-
\??\c:\hvhbrnj.exec:\hvhbrnj.exe213⤵
-
\??\c:\lfnxtf.exec:\lfnxtf.exe214⤵
-
\??\c:\lnvdrj.exec:\lnvdrj.exe215⤵
-
\??\c:\jdtlxnp.exec:\jdtlxnp.exe216⤵
-
\??\c:\fdrtfxj.exec:\fdrtfxj.exe217⤵
-
\??\c:\xjvhndh.exec:\xjvhndh.exe218⤵
-
\??\c:\vjvjrdb.exec:\vjvjrdb.exe219⤵
-
\??\c:\rrbnb.exec:\rrbnb.exe220⤵
-
\??\c:\fljnx.exec:\fljnx.exe221⤵
-
\??\c:\tlvjhnl.exec:\tlvjhnl.exe222⤵
-
\??\c:\dlrxdt.exec:\dlrxdt.exe223⤵
-
\??\c:\hrbvn.exec:\hrbvn.exe224⤵
-
\??\c:\ffbhflr.exec:\ffbhflr.exe225⤵
-
\??\c:\vltnhhv.exec:\vltnhhv.exe226⤵
-
\??\c:\tbddl.exec:\tbddl.exe227⤵
-
\??\c:\fvpbh.exec:\fvpbh.exe228⤵
-
\??\c:\tjpbpxh.exec:\tjpbpxh.exe229⤵
-
\??\c:\dnhnjn.exec:\dnhnjn.exe230⤵
-
\??\c:\ljnnbx.exec:\ljnnbx.exe231⤵
-
\??\c:\hdhftnf.exec:\hdhftnf.exe232⤵
-
\??\c:\pdhtvx.exec:\pdhtvx.exe233⤵
-
\??\c:\lbpbdj.exec:\lbpbdj.exe234⤵
-
\??\c:\jlpxxn.exec:\jlpxxn.exe235⤵
-
\??\c:\xbjlbjn.exec:\xbjlbjn.exe236⤵
-
\??\c:\fjttxf.exec:\fjttxf.exe237⤵
-
\??\c:\llnbv.exec:\llnbv.exe238⤵
-
\??\c:\hjvnb.exec:\hjvnb.exe239⤵
-
\??\c:\hfvnjt.exec:\hfvnjt.exe240⤵
-
\??\c:\dpbbhr.exec:\dpbbhr.exe241⤵