Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 08:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d02a4e7aa599765f28dfe866de403170_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
d02a4e7aa599765f28dfe866de403170_NeikiAnalytics.exe
-
Size
83KB
-
MD5
d02a4e7aa599765f28dfe866de403170
-
SHA1
05df13b01d986ef31b6f53c89ed7dff21e3e0f80
-
SHA256
291c369bb187aaa8fdc0a3472aec7b19544c660150ba0c98206b4507953bfa9a
-
SHA512
a1a9e1e1c1fc729239e0c8616866d023a067d31c7e68175483da0e24fd3329f77cb7b379853a3f27c96bef02952e85f31c03d63afb4a4933fee6e70ef8e5ce0a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73yqKH/KjvHo+WdN1:ymb3NkkiQ3mdBjFo73yX+vI+qb
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral1/memory/2380-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-60-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2508-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1624-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1480-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2420-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1140-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1596-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2052-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1752-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1292-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3064-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2004-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-1704-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lxlffxf.exe1tthtb.exe1frxffr.exefrxfrxx.exebhbbbb.exetbtttn.exepdppv.exelfrflxf.exebbthhn.exebbtttb.exepjjjj.exejvdjv.exe5lrrfrx.exethbtbb.exetnbnbb.exe3pddj.exeffrlrfr.exerfflxfl.exe3ntbbt.exebthbnn.exevjjdd.exexlffffl.exelfxfxfl.exenbnhnt.exenbbbnn.exedpjvj.exe9vvpd.exelxflllr.exe9tbtnh.exennnnnn.exeppdjp.exerlfxlrl.exexxllrrf.exethtthb.exenhntbt.exe9vddd.exepvjvd.exe7lrxlfl.exe5xllrrl.exethnhnh.exe7hthhh.exepdjdd.exedpppp.exe3lrlllr.exefrxxfxf.exe3bnhhh.exehtbttn.exevpdvv.exedpvvv.exerxxrrrx.exelxxrrrr.exe7bhhbb.exe3nnhbt.exedpdvp.exe5vppv.exejvddd.exerlxrrll.exexrxxfxx.exethhttn.exe7hhbbt.exe9jppp.exevppjj.exerlrlrll.exe9xflffl.exepid process 2380 lxlffxf.exe 3028 1tthtb.exe 2408 1frxffr.exe 2712 frxfrxx.exe 2600 bhbbbb.exe 2508 tbtttn.exe 1624 pdppv.exe 2492 lfrflxf.exe 2532 bbthhn.exe 2932 bbtttb.exe 2176 pjjjj.exe 1480 jvdjv.exe 2420 5lrrfrx.exe 1736 thbtbb.exe 2564 tnbnbb.exe 1140 3pddj.exe 1596 ffrlrfr.exe 1484 rfflxfl.exe 2052 3ntbbt.exe 1752 bthbnn.exe 592 vjjdd.exe 1292 xlffffl.exe 1496 lfxfxfl.exe 1716 nbnhnt.exe 1124 nbbbnn.exe 2024 dpjvj.exe 3064 9vvpd.exe 1540 lxflllr.exe 868 9tbtnh.exe 2360 nnnnnn.exe 2004 ppdjp.exe 2988 rlfxlrl.exe 2140 xxllrrf.exe 2960 thtthb.exe 2980 nhntbt.exe 2996 9vddd.exe 2744 pvjvd.exe 2104 7lrxlfl.exe 2608 5xllrrl.exe 2752 thnhnh.exe 2472 7hthhh.exe 2728 pdjdd.exe 2796 dpppp.exe 1644 3lrlllr.exe 2012 frxxfxf.exe 1984 3bnhhh.exe 1928 htbttn.exe 816 vpdvv.exe 1084 dpvvv.exe 1168 rxxrrrx.exe 2676 lxxrrrr.exe 2892 7bhhbb.exe 1636 3nnhbt.exe 1712 dpdvp.exe 1784 5vppv.exe 2904 jvddd.exe 2100 rlxrrll.exe 2240 xrxxfxx.exe 1204 thhttn.exe 700 7hhbbt.exe 1292 9jppp.exe 572 vppjj.exe 2372 rlrlrll.exe 844 9xflffl.exe -
Processes:
resource yara_rule behavioral1/memory/2380-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1624-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1480-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1140-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1596-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1292-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3064-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2004-299-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-1704-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d02a4e7aa599765f28dfe866de403170_NeikiAnalytics.exelxlffxf.exe1tthtb.exe1frxffr.exefrxfrxx.exebhbbbb.exetbtttn.exepdppv.exelfrflxf.exebbthhn.exebbtttb.exepjjjj.exejvdjv.exe5lrrfrx.exethbtbb.exetnbnbb.exedescription pid process target process PID 2880 wrote to memory of 2380 2880 d02a4e7aa599765f28dfe866de403170_NeikiAnalytics.exe lxlffxf.exe PID 2880 wrote to memory of 2380 2880 d02a4e7aa599765f28dfe866de403170_NeikiAnalytics.exe lxlffxf.exe PID 2880 wrote to memory of 2380 2880 d02a4e7aa599765f28dfe866de403170_NeikiAnalytics.exe lxlffxf.exe PID 2880 wrote to memory of 2380 2880 d02a4e7aa599765f28dfe866de403170_NeikiAnalytics.exe lxlffxf.exe PID 2380 wrote to memory of 3028 2380 lxlffxf.exe 1tthtb.exe PID 2380 wrote to memory of 3028 2380 lxlffxf.exe 1tthtb.exe PID 2380 wrote to memory of 3028 2380 lxlffxf.exe 1tthtb.exe PID 2380 wrote to memory of 3028 2380 lxlffxf.exe 1tthtb.exe PID 3028 wrote to memory of 2408 3028 1tthtb.exe 1frxffr.exe PID 3028 wrote to memory of 2408 3028 1tthtb.exe 1frxffr.exe PID 3028 wrote to memory of 2408 3028 1tthtb.exe 1frxffr.exe PID 3028 wrote to memory of 2408 3028 1tthtb.exe 1frxffr.exe PID 2408 wrote to memory of 2712 2408 1frxffr.exe frxfrxx.exe PID 2408 wrote to memory of 2712 2408 1frxffr.exe frxfrxx.exe PID 2408 wrote to memory of 2712 2408 1frxffr.exe frxfrxx.exe PID 2408 wrote to memory of 2712 2408 1frxffr.exe frxfrxx.exe PID 2712 wrote to memory of 2600 2712 frxfrxx.exe bhbbbb.exe PID 2712 wrote to memory of 2600 2712 frxfrxx.exe bhbbbb.exe PID 2712 wrote to memory of 2600 2712 frxfrxx.exe bhbbbb.exe PID 2712 wrote to memory of 2600 2712 frxfrxx.exe bhbbbb.exe PID 2600 wrote to memory of 2508 2600 bhbbbb.exe tbtttn.exe PID 2600 wrote to memory of 2508 2600 bhbbbb.exe tbtttn.exe PID 2600 wrote to memory of 2508 2600 bhbbbb.exe tbtttn.exe PID 2600 wrote to memory of 2508 2600 bhbbbb.exe tbtttn.exe PID 2508 wrote to memory of 1624 2508 tbtttn.exe pdppv.exe PID 2508 wrote to memory of 1624 2508 tbtttn.exe pdppv.exe PID 2508 wrote to memory of 1624 2508 tbtttn.exe pdppv.exe PID 2508 wrote to memory of 1624 2508 tbtttn.exe pdppv.exe PID 1624 wrote to memory of 2492 1624 pdppv.exe lfrflxf.exe PID 1624 wrote to memory of 2492 1624 pdppv.exe lfrflxf.exe PID 1624 wrote to memory of 2492 1624 pdppv.exe lfrflxf.exe PID 1624 wrote to memory of 2492 1624 pdppv.exe lfrflxf.exe PID 2492 wrote to memory of 2532 2492 lfrflxf.exe bbthhn.exe PID 2492 wrote to memory of 2532 2492 lfrflxf.exe bbthhn.exe PID 2492 wrote to memory of 2532 2492 lfrflxf.exe bbthhn.exe PID 2492 wrote to memory of 2532 2492 lfrflxf.exe bbthhn.exe PID 2532 wrote to memory of 2932 2532 bbthhn.exe bbtttb.exe PID 2532 wrote to memory of 2932 2532 bbthhn.exe bbtttb.exe PID 2532 wrote to memory of 2932 2532 bbthhn.exe bbtttb.exe PID 2532 wrote to memory of 2932 2532 bbthhn.exe bbtttb.exe PID 2932 wrote to memory of 2176 2932 bbtttb.exe pjjjj.exe PID 2932 wrote to memory of 2176 2932 bbtttb.exe pjjjj.exe PID 2932 wrote to memory of 2176 2932 bbtttb.exe pjjjj.exe PID 2932 wrote to memory of 2176 2932 bbtttb.exe pjjjj.exe PID 2176 wrote to memory of 1480 2176 pjjjj.exe jvdjv.exe PID 2176 wrote to memory of 1480 2176 pjjjj.exe jvdjv.exe PID 2176 wrote to memory of 1480 2176 pjjjj.exe jvdjv.exe PID 2176 wrote to memory of 1480 2176 pjjjj.exe jvdjv.exe PID 1480 wrote to memory of 2420 1480 jvdjv.exe 5lrrfrx.exe PID 1480 wrote to memory of 2420 1480 jvdjv.exe 5lrrfrx.exe PID 1480 wrote to memory of 2420 1480 jvdjv.exe 5lrrfrx.exe PID 1480 wrote to memory of 2420 1480 jvdjv.exe 5lrrfrx.exe PID 2420 wrote to memory of 1736 2420 5lrrfrx.exe thbtbb.exe PID 2420 wrote to memory of 1736 2420 5lrrfrx.exe thbtbb.exe PID 2420 wrote to memory of 1736 2420 5lrrfrx.exe thbtbb.exe PID 2420 wrote to memory of 1736 2420 5lrrfrx.exe thbtbb.exe PID 1736 wrote to memory of 2564 1736 thbtbb.exe tnbnbb.exe PID 1736 wrote to memory of 2564 1736 thbtbb.exe tnbnbb.exe PID 1736 wrote to memory of 2564 1736 thbtbb.exe tnbnbb.exe PID 1736 wrote to memory of 2564 1736 thbtbb.exe tnbnbb.exe PID 2564 wrote to memory of 1140 2564 tnbnbb.exe 3pddj.exe PID 2564 wrote to memory of 1140 2564 tnbnbb.exe 3pddj.exe PID 2564 wrote to memory of 1140 2564 tnbnbb.exe 3pddj.exe PID 2564 wrote to memory of 1140 2564 tnbnbb.exe 3pddj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d02a4e7aa599765f28dfe866de403170_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d02a4e7aa599765f28dfe866de403170_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\lxlffxf.exec:\lxlffxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1tthtb.exec:\1tthtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1frxffr.exec:\1frxffr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frxfrxx.exec:\frxfrxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhbbbb.exec:\bhbbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tbtttn.exec:\tbtttn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdppv.exec:\pdppv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfrflxf.exec:\lfrflxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbthhn.exec:\bbthhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbtttb.exec:\bbtttb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjjjj.exec:\pjjjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvdjv.exec:\jvdjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5lrrfrx.exec:\5lrrfrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thbtbb.exec:\thbtbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnbnbb.exec:\tnbnbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3pddj.exec:\3pddj.exe17⤵
- Executes dropped EXE
-
\??\c:\ffrlrfr.exec:\ffrlrfr.exe18⤵
- Executes dropped EXE
-
\??\c:\rfflxfl.exec:\rfflxfl.exe19⤵
- Executes dropped EXE
-
\??\c:\3ntbbt.exec:\3ntbbt.exe20⤵
- Executes dropped EXE
-
\??\c:\bthbnn.exec:\bthbnn.exe21⤵
- Executes dropped EXE
-
\??\c:\vjjdd.exec:\vjjdd.exe22⤵
- Executes dropped EXE
-
\??\c:\xlffffl.exec:\xlffffl.exe23⤵
- Executes dropped EXE
-
\??\c:\lfxfxfl.exec:\lfxfxfl.exe24⤵
- Executes dropped EXE
-
\??\c:\nbnhnt.exec:\nbnhnt.exe25⤵
- Executes dropped EXE
-
\??\c:\nbbbnn.exec:\nbbbnn.exe26⤵
- Executes dropped EXE
-
\??\c:\dpjvj.exec:\dpjvj.exe27⤵
- Executes dropped EXE
-
\??\c:\9vvpd.exec:\9vvpd.exe28⤵
- Executes dropped EXE
-
\??\c:\lxflllr.exec:\lxflllr.exe29⤵
- Executes dropped EXE
-
\??\c:\9tbtnh.exec:\9tbtnh.exe30⤵
- Executes dropped EXE
-
\??\c:\nnnnnn.exec:\nnnnnn.exe31⤵
- Executes dropped EXE
-
\??\c:\ppdjp.exec:\ppdjp.exe32⤵
- Executes dropped EXE
-
\??\c:\rlfxlrl.exec:\rlfxlrl.exe33⤵
- Executes dropped EXE
-
\??\c:\xxllrrf.exec:\xxllrrf.exe34⤵
- Executes dropped EXE
-
\??\c:\thtthb.exec:\thtthb.exe35⤵
- Executes dropped EXE
-
\??\c:\nhntbt.exec:\nhntbt.exe36⤵
- Executes dropped EXE
-
\??\c:\9vddd.exec:\9vddd.exe37⤵
- Executes dropped EXE
-
\??\c:\pvjvd.exec:\pvjvd.exe38⤵
- Executes dropped EXE
-
\??\c:\7lrxlfl.exec:\7lrxlfl.exe39⤵
- Executes dropped EXE
-
\??\c:\5xllrrl.exec:\5xllrrl.exe40⤵
- Executes dropped EXE
-
\??\c:\thnhnh.exec:\thnhnh.exe41⤵
- Executes dropped EXE
-
\??\c:\7hthhh.exec:\7hthhh.exe42⤵
- Executes dropped EXE
-
\??\c:\pdjdd.exec:\pdjdd.exe43⤵
- Executes dropped EXE
-
\??\c:\dpppp.exec:\dpppp.exe44⤵
- Executes dropped EXE
-
\??\c:\3lrlllr.exec:\3lrlllr.exe45⤵
- Executes dropped EXE
-
\??\c:\frxxfxf.exec:\frxxfxf.exe46⤵
- Executes dropped EXE
-
\??\c:\3bnhhh.exec:\3bnhhh.exe47⤵
- Executes dropped EXE
-
\??\c:\htbttn.exec:\htbttn.exe48⤵
- Executes dropped EXE
-
\??\c:\vpdvv.exec:\vpdvv.exe49⤵
- Executes dropped EXE
-
\??\c:\dpvvv.exec:\dpvvv.exe50⤵
- Executes dropped EXE
-
\??\c:\rxxrrrx.exec:\rxxrrrx.exe51⤵
- Executes dropped EXE
-
\??\c:\lxxrrrr.exec:\lxxrrrr.exe52⤵
- Executes dropped EXE
-
\??\c:\7bhhbb.exec:\7bhhbb.exe53⤵
- Executes dropped EXE
-
\??\c:\3nnhbt.exec:\3nnhbt.exe54⤵
- Executes dropped EXE
-
\??\c:\dpdvp.exec:\dpdvp.exe55⤵
- Executes dropped EXE
-
\??\c:\5vppv.exec:\5vppv.exe56⤵
- Executes dropped EXE
-
\??\c:\jvddd.exec:\jvddd.exe57⤵
- Executes dropped EXE
-
\??\c:\rlxrrll.exec:\rlxrrll.exe58⤵
- Executes dropped EXE
-
\??\c:\xrxxfxx.exec:\xrxxfxx.exe59⤵
- Executes dropped EXE
-
\??\c:\thhttn.exec:\thhttn.exe60⤵
- Executes dropped EXE
-
\??\c:\7hhbbt.exec:\7hhbbt.exe61⤵
- Executes dropped EXE
-
\??\c:\9jppp.exec:\9jppp.exe62⤵
- Executes dropped EXE
-
\??\c:\vppjj.exec:\vppjj.exe63⤵
- Executes dropped EXE
-
\??\c:\rlrlrll.exec:\rlrlrll.exe64⤵
- Executes dropped EXE
-
\??\c:\9xflffl.exec:\9xflffl.exe65⤵
- Executes dropped EXE
-
\??\c:\lxffrlr.exec:\lxffrlr.exe66⤵
-
\??\c:\7bbnnn.exec:\7bbnnn.exe67⤵
-
\??\c:\thnnbb.exec:\thnnbb.exe68⤵
-
\??\c:\5dppv.exec:\5dppv.exe69⤵
-
\??\c:\pvjvp.exec:\pvjvp.exe70⤵
-
\??\c:\pdvpp.exec:\pdvpp.exe71⤵
-
\??\c:\rfrlrfl.exec:\rfrlrfl.exe72⤵
-
\??\c:\9lxxrxx.exec:\9lxxrxx.exe73⤵
-
\??\c:\9bhbbb.exec:\9bhbbb.exe74⤵
-
\??\c:\hntnth.exec:\hntnth.exe75⤵
-
\??\c:\dpvvd.exec:\dpvvd.exe76⤵
-
\??\c:\jvjdv.exec:\jvjdv.exe77⤵
-
\??\c:\5xlfxxl.exec:\5xlfxxl.exe78⤵
-
\??\c:\1lfxfxf.exec:\1lfxfxf.exe79⤵
-
\??\c:\bbthbt.exec:\bbthbt.exe80⤵
-
\??\c:\bnbtbt.exec:\bnbtbt.exe81⤵
-
\??\c:\jdppp.exec:\jdppp.exe82⤵
-
\??\c:\7jdvd.exec:\7jdvd.exe83⤵
-
\??\c:\jvdvv.exec:\jvdvv.exe84⤵
-
\??\c:\lxxxxrf.exec:\lxxxxrf.exe85⤵
-
\??\c:\rlffrrr.exec:\rlffrrr.exe86⤵
-
\??\c:\hbbthb.exec:\hbbthb.exe87⤵
-
\??\c:\httbbt.exec:\httbbt.exe88⤵
-
\??\c:\jpdvp.exec:\jpdvp.exe89⤵
-
\??\c:\jvvjj.exec:\jvvjj.exe90⤵
-
\??\c:\pdvvv.exec:\pdvvv.exe91⤵
-
\??\c:\xrxffff.exec:\xrxffff.exe92⤵
-
\??\c:\9lfffff.exec:\9lfffff.exe93⤵
-
\??\c:\9ntbhh.exec:\9ntbhh.exe94⤵
-
\??\c:\tnbttt.exec:\tnbttt.exe95⤵
-
\??\c:\pdjdd.exec:\pdjdd.exe96⤵
-
\??\c:\pdjdd.exec:\pdjdd.exe97⤵
-
\??\c:\dvddj.exec:\dvddj.exe98⤵
-
\??\c:\7xffxxx.exec:\7xffxxx.exe99⤵
-
\??\c:\rlxxfxx.exec:\rlxxfxx.exe100⤵
-
\??\c:\7hhhhn.exec:\7hhhhn.exe101⤵
-
\??\c:\tbhhtt.exec:\tbhhtt.exe102⤵
-
\??\c:\thhbhh.exec:\thhbhh.exe103⤵
-
\??\c:\5jvvv.exec:\5jvvv.exe104⤵
-
\??\c:\vjjdd.exec:\vjjdd.exe105⤵
-
\??\c:\lrfxxrr.exec:\lrfxxrr.exe106⤵
-
\??\c:\xrffrxf.exec:\xrffrxf.exe107⤵
-
\??\c:\lfxxfxl.exec:\lfxxfxl.exe108⤵
-
\??\c:\nbttnn.exec:\nbttnn.exe109⤵
-
\??\c:\9hnhtt.exec:\9hnhtt.exe110⤵
-
\??\c:\bnhtbb.exec:\bnhtbb.exe111⤵
-
\??\c:\vjjpd.exec:\vjjpd.exe112⤵
-
\??\c:\jvjvp.exec:\jvjvp.exe113⤵
-
\??\c:\9lrrrrx.exec:\9lrrrrx.exe114⤵
-
\??\c:\7rlxfxx.exec:\7rlxfxx.exe115⤵
-
\??\c:\hbnttt.exec:\hbnttt.exe116⤵
-
\??\c:\ntbbhb.exec:\ntbbhb.exe117⤵
-
\??\c:\bntnnn.exec:\bntnnn.exe118⤵
-
\??\c:\vjjdj.exec:\vjjdj.exe119⤵
-
\??\c:\jvjjd.exec:\jvjjd.exe120⤵
-
\??\c:\llrrxrx.exec:\llrrxrx.exe121⤵
-
\??\c:\xlrrxxl.exec:\xlrrxxl.exe122⤵
-
\??\c:\7hntbb.exec:\7hntbb.exe123⤵
-
\??\c:\btnttn.exec:\btnttn.exe124⤵
-
\??\c:\nbhhnn.exec:\nbhhnn.exe125⤵
-
\??\c:\vjddd.exec:\vjddd.exe126⤵
-
\??\c:\vjppp.exec:\vjppp.exe127⤵
-
\??\c:\rfrlrfl.exec:\rfrlrfl.exe128⤵
-
\??\c:\xlllrlr.exec:\xlllrlr.exe129⤵
-
\??\c:\7thnnn.exec:\7thnnn.exe130⤵
-
\??\c:\3bnhhb.exec:\3bnhhb.exe131⤵
-
\??\c:\pjddj.exec:\pjddj.exe132⤵
-
\??\c:\vjppp.exec:\vjppp.exe133⤵
-
\??\c:\pdddj.exec:\pdddj.exe134⤵
-
\??\c:\rfrllxf.exec:\rfrllxf.exe135⤵
-
\??\c:\lfxrxrx.exec:\lfxrxrx.exe136⤵
-
\??\c:\thnttt.exec:\thnttt.exe137⤵
-
\??\c:\9httbt.exec:\9httbt.exe138⤵
-
\??\c:\thnttt.exec:\thnttt.exe139⤵
-
\??\c:\vjvvv.exec:\vjvvv.exe140⤵
-
\??\c:\jjdvv.exec:\jjdvv.exe141⤵
-
\??\c:\9fxxxxf.exec:\9fxxxxf.exe142⤵
-
\??\c:\xfrrrxx.exec:\xfrrrxx.exe143⤵
-
\??\c:\htbbhb.exec:\htbbhb.exe144⤵
-
\??\c:\nhnnnn.exec:\nhnnnn.exe145⤵
-
\??\c:\jvjvp.exec:\jvjvp.exe146⤵
-
\??\c:\pvddv.exec:\pvddv.exe147⤵
-
\??\c:\7frrllr.exec:\7frrllr.exe148⤵
-
\??\c:\rflrlrx.exec:\rflrlrx.exe149⤵
-
\??\c:\xrxfffr.exec:\xrxfffr.exe150⤵
-
\??\c:\hbttbt.exec:\hbttbt.exe151⤵
-
\??\c:\5hnhbb.exec:\5hnhbb.exe152⤵
-
\??\c:\5jppp.exec:\5jppp.exe153⤵
-
\??\c:\1jdpv.exec:\1jdpv.exe154⤵
-
\??\c:\xllllll.exec:\xllllll.exe155⤵
-
\??\c:\lxlfrlr.exec:\lxlfrlr.exe156⤵
-
\??\c:\7xlfllr.exec:\7xlfllr.exe157⤵
-
\??\c:\hbntbb.exec:\hbntbb.exe158⤵
-
\??\c:\7bhbbt.exec:\7bhbbt.exe159⤵
-
\??\c:\9btnnh.exec:\9btnnh.exe160⤵
-
\??\c:\jvddd.exec:\jvddd.exe161⤵
-
\??\c:\pdjdp.exec:\pdjdp.exe162⤵
-
\??\c:\9lxxxxr.exec:\9lxxxxr.exe163⤵
-
\??\c:\frrrrrr.exec:\frrrrrr.exe164⤵
-
\??\c:\tbbhbn.exec:\tbbhbn.exe165⤵
-
\??\c:\5nbnnt.exec:\5nbnnt.exe166⤵
-
\??\c:\vjpdj.exec:\vjpdj.exe167⤵
-
\??\c:\pjvpp.exec:\pjvpp.exe168⤵
-
\??\c:\xlrllll.exec:\xlrllll.exe169⤵
-
\??\c:\rfrlrll.exec:\rfrlrll.exe170⤵
-
\??\c:\frxxxlf.exec:\frxxxlf.exe171⤵
-
\??\c:\ntttnh.exec:\ntttnh.exe172⤵
-
\??\c:\3hnhhh.exec:\3hnhhh.exe173⤵
-
\??\c:\1ppvd.exec:\1ppvd.exe174⤵
-
\??\c:\9jvvp.exec:\9jvvp.exe175⤵
-
\??\c:\frxrxxx.exec:\frxrxxx.exe176⤵
-
\??\c:\xlrxllr.exec:\xlrxllr.exe177⤵
-
\??\c:\nbnnhh.exec:\nbnnhh.exe178⤵
-
\??\c:\thtttb.exec:\thtttb.exe179⤵
-
\??\c:\1vddj.exec:\1vddj.exe180⤵
-
\??\c:\vdjjj.exec:\vdjjj.exe181⤵
-
\??\c:\dpvpv.exec:\dpvpv.exe182⤵
-
\??\c:\fxxrlrx.exec:\fxxrlrx.exe183⤵
-
\??\c:\5rlrxxr.exec:\5rlrxxr.exe184⤵
-
\??\c:\7bnnhb.exec:\7bnnhb.exe185⤵
-
\??\c:\ntnhnb.exec:\ntnhnb.exe186⤵
-
\??\c:\jvjvv.exec:\jvjvv.exe187⤵
-
\??\c:\vppdd.exec:\vppdd.exe188⤵
-
\??\c:\1ddvp.exec:\1ddvp.exe189⤵
-
\??\c:\xffxlfl.exec:\xffxlfl.exe190⤵
-
\??\c:\lxfxlff.exec:\lxfxlff.exe191⤵
-
\??\c:\bthntn.exec:\bthntn.exe192⤵
-
\??\c:\ntbthb.exec:\ntbthb.exe193⤵
-
\??\c:\1dvdp.exec:\1dvdp.exe194⤵
-
\??\c:\1vpjj.exec:\1vpjj.exe195⤵
-
\??\c:\dvpdj.exec:\dvpdj.exe196⤵
-
\??\c:\fxllxlf.exec:\fxllxlf.exe197⤵
-
\??\c:\rlrxfrx.exec:\rlrxfrx.exe198⤵
-
\??\c:\tthhnn.exec:\tthhnn.exe199⤵
-
\??\c:\thtttb.exec:\thtttb.exe200⤵
-
\??\c:\bhnnhb.exec:\bhnnhb.exe201⤵
-
\??\c:\vpvvd.exec:\vpvvd.exe202⤵
-
\??\c:\pdjdj.exec:\pdjdj.exe203⤵
-
\??\c:\xlxrlll.exec:\xlxrlll.exe204⤵
-
\??\c:\rxxxfxf.exec:\rxxxfxf.exe205⤵
-
\??\c:\hnbbbt.exec:\hnbbbt.exe206⤵
-
\??\c:\thhhnh.exec:\thhhnh.exe207⤵
-
\??\c:\vdjdd.exec:\vdjdd.exe208⤵
-
\??\c:\9vjjj.exec:\9vjjj.exe209⤵
-
\??\c:\frffxxx.exec:\frffxxx.exe210⤵
-
\??\c:\5fxxffl.exec:\5fxxffl.exe211⤵
-
\??\c:\lxffffl.exec:\lxffffl.exe212⤵
-
\??\c:\3hnntn.exec:\3hnntn.exe213⤵
-
\??\c:\hthhhb.exec:\hthhhb.exe214⤵
-
\??\c:\jdjpv.exec:\jdjpv.exe215⤵
-
\??\c:\pdvvp.exec:\pdvvp.exe216⤵
-
\??\c:\rlxxfff.exec:\rlxxfff.exe217⤵
-
\??\c:\5rfffll.exec:\5rfffll.exe218⤵
-
\??\c:\fxllxfl.exec:\fxllxfl.exe219⤵
-
\??\c:\bbtnhh.exec:\bbtnhh.exe220⤵
-
\??\c:\hntbbb.exec:\hntbbb.exe221⤵
-
\??\c:\pjvdj.exec:\pjvdj.exe222⤵
-
\??\c:\jpvvd.exec:\jpvvd.exe223⤵
-
\??\c:\dvjpp.exec:\dvjpp.exe224⤵
-
\??\c:\flxrlll.exec:\flxrlll.exe225⤵
-
\??\c:\9xllrrr.exec:\9xllrrr.exe226⤵
-
\??\c:\thtnnn.exec:\thtnnn.exe227⤵
-
\??\c:\thhbtn.exec:\thhbtn.exe228⤵
-
\??\c:\9jpvp.exec:\9jpvp.exe229⤵
-
\??\c:\jdjdd.exec:\jdjdd.exe230⤵
-
\??\c:\pjvdv.exec:\pjvdv.exe231⤵
-
\??\c:\9xrlffl.exec:\9xrlffl.exe232⤵
-
\??\c:\rflxfxx.exec:\rflxfxx.exe233⤵
-
\??\c:\htbhtn.exec:\htbhtn.exe234⤵
-
\??\c:\dvddj.exec:\dvddj.exe235⤵
-
\??\c:\thbtnh.exec:\thbtnh.exe236⤵
-
\??\c:\5nhbhh.exec:\5nhbhh.exe237⤵
-
\??\c:\jdjdd.exec:\jdjdd.exe238⤵
-
\??\c:\dvdvv.exec:\dvdvv.exe239⤵
-
\??\c:\pdjdj.exec:\pdjdj.exe240⤵
-
\??\c:\lfllllr.exec:\lfllllr.exe241⤵