Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 15:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3cd43ac82865884c3e59bb54c2154530_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
3cd43ac82865884c3e59bb54c2154530_NeikiAnalytics.exe
-
Size
93KB
-
MD5
3cd43ac82865884c3e59bb54c2154530
-
SHA1
1bbc984be40698874b1cbc55ca306d08b785640f
-
SHA256
4bda68002c9075f361ca43a1080687dfef55351991fdebf2106ba68a2f5e1fa7
-
SHA512
5516145cde16344bd2cf816813d9dbfc017c68b57cdcc7fbcbb1be57f69b8fa797c602f00c48f5823d224c61d1a5f34f2c272ddb021558e587cd3f7edaf85023
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo7NANTBuQG1np24+2OXs:ymb3NkkiQ3mdBjFo7NguQG1n0USs
Malware Config
Signatures
-
Detect Blackmoon payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/1704-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1808-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1808-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1164-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/812-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2044-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/320-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1180-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vpbrrt.exedtjbvl.exerphlr.exehpvvph.exennhblpd.exejxhtn.exexdfrp.exerdxvtj.exenxpdbrf.exelrfhnjp.exepjxppfd.exelxvpd.exedhlxv.exelbdhd.exefjrhvb.exerddbhjv.exerjtjdl.exelrbljf.exedtvlb.exejrhlrv.exelhfjjth.exejrndff.exefvfpv.exenpjnhb.exevjrnjpn.exebvddfxf.exenlfpln.exefpxrv.exeprjxx.exerfdvfn.exefhtvlxh.exebnxlnnx.exenntbl.exeltvntb.exebffxvj.exevjxxdtx.exebdfhptp.exerttvt.exepxntt.exeddlrr.exellltfn.exexvhnnv.exedxjprl.exetdrdhf.exedrhrfht.exebpvlh.exetjvnttv.exevhbtj.exexxvlffv.exenvtxj.exevjhvpn.exebbfrrl.exehfdrrrn.exehvjlfl.exelxrlnp.exeppnrv.exefvljh.exetbbhh.exeplfxxl.exedhxjrbb.exebbnlxrn.exehjxddl.exepdhlnh.exeprdflf.exepid process 2612 vpbrrt.exe 2552 dtjbvl.exe 2864 rphlr.exe 2604 hpvvph.exe 2712 nnhblpd.exe 1808 jxhtn.exe 2496 xdfrp.exe 1164 rdxvtj.exe 1396 nxpdbrf.exe 2404 lrfhnjp.exe 2736 pjxppfd.exe 2812 lxvpd.exe 2144 dhlxv.exe 2672 lbdhd.exe 812 fjrhvb.exe 2524 rddbhjv.exe 1744 rjtjdl.exe 1784 lrbljf.exe 2288 dtvlb.exe 2872 jrhlrv.exe 2364 lhfjjth.exe 2044 jrndff.exe 2072 fvfpv.exe 1444 npjnhb.exe 2036 vjrnjpn.exe 2088 bvddfxf.exe 2176 nlfpln.exe 320 fpxrv.exe 2892 prjxx.exe 2196 rfdvfn.exe 1180 fhtvlxh.exe 1632 bnxlnnx.exe 2956 nntbl.exe 2980 ltvntb.exe 3024 bffxvj.exe 2692 vjxxdtx.exe 2688 bdfhptp.exe 2548 rttvt.exe 2848 pxntt.exe 2664 ddlrr.exe 2028 llltfn.exe 2480 xvhnnv.exe 2376 dxjprl.exe 2924 tdrdhf.exe 1172 drhrfht.exe 2932 bpvlh.exe 636 tjvnttv.exe 308 vhbtj.exe 2792 xxvlffv.exe 2820 nvtxj.exe 2812 vjhvpn.exe 1048 bbfrrl.exe 952 hfdrrrn.exe 1536 hvjlfl.exe 812 lxrlnp.exe 1520 ppnrv.exe 1660 fvljh.exe 1260 tbbhh.exe 3012 plfxxl.exe 2316 dhxjrbb.exe 780 bbnlxrn.exe 2240 hjxddl.exe 400 pdhlnh.exe 856 prdflf.exe -
Processes:
resource yara_rule behavioral1/memory/1704-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1808-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1808-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1164-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1164-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1164-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1164-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/812-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/320-275-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1180-302-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3cd43ac82865884c3e59bb54c2154530_NeikiAnalytics.exevpbrrt.exedtjbvl.exerphlr.exehpvvph.exennhblpd.exejxhtn.exexdfrp.exerdxvtj.exenxpdbrf.exelrfhnjp.exepjxppfd.exelxvpd.exedhlxv.exelbdhd.exefjrhvb.exedescription pid process target process PID 1704 wrote to memory of 2612 1704 3cd43ac82865884c3e59bb54c2154530_NeikiAnalytics.exe vpbrrt.exe PID 1704 wrote to memory of 2612 1704 3cd43ac82865884c3e59bb54c2154530_NeikiAnalytics.exe vpbrrt.exe PID 1704 wrote to memory of 2612 1704 3cd43ac82865884c3e59bb54c2154530_NeikiAnalytics.exe vpbrrt.exe PID 1704 wrote to memory of 2612 1704 3cd43ac82865884c3e59bb54c2154530_NeikiAnalytics.exe vpbrrt.exe PID 2612 wrote to memory of 2552 2612 vpbrrt.exe dtjbvl.exe PID 2612 wrote to memory of 2552 2612 vpbrrt.exe dtjbvl.exe PID 2612 wrote to memory of 2552 2612 vpbrrt.exe dtjbvl.exe PID 2612 wrote to memory of 2552 2612 vpbrrt.exe dtjbvl.exe PID 2552 wrote to memory of 2864 2552 dtjbvl.exe rphlr.exe PID 2552 wrote to memory of 2864 2552 dtjbvl.exe rphlr.exe PID 2552 wrote to memory of 2864 2552 dtjbvl.exe rphlr.exe PID 2552 wrote to memory of 2864 2552 dtjbvl.exe rphlr.exe PID 2864 wrote to memory of 2604 2864 rphlr.exe hpvvph.exe PID 2864 wrote to memory of 2604 2864 rphlr.exe hpvvph.exe PID 2864 wrote to memory of 2604 2864 rphlr.exe hpvvph.exe PID 2864 wrote to memory of 2604 2864 rphlr.exe hpvvph.exe PID 2604 wrote to memory of 2712 2604 hpvvph.exe nnhblpd.exe PID 2604 wrote to memory of 2712 2604 hpvvph.exe nnhblpd.exe PID 2604 wrote to memory of 2712 2604 hpvvph.exe nnhblpd.exe PID 2604 wrote to memory of 2712 2604 hpvvph.exe nnhblpd.exe PID 2712 wrote to memory of 1808 2712 nnhblpd.exe jxhtn.exe PID 2712 wrote to memory of 1808 2712 nnhblpd.exe jxhtn.exe PID 2712 wrote to memory of 1808 2712 nnhblpd.exe jxhtn.exe PID 2712 wrote to memory of 1808 2712 nnhblpd.exe jxhtn.exe PID 1808 wrote to memory of 2496 1808 jxhtn.exe xdfrp.exe PID 1808 wrote to memory of 2496 1808 jxhtn.exe xdfrp.exe PID 1808 wrote to memory of 2496 1808 jxhtn.exe xdfrp.exe PID 1808 wrote to memory of 2496 1808 jxhtn.exe xdfrp.exe PID 2496 wrote to memory of 1164 2496 xdfrp.exe rdxvtj.exe PID 2496 wrote to memory of 1164 2496 xdfrp.exe rdxvtj.exe PID 2496 wrote to memory of 1164 2496 xdfrp.exe rdxvtj.exe PID 2496 wrote to memory of 1164 2496 xdfrp.exe rdxvtj.exe PID 1164 wrote to memory of 1396 1164 rdxvtj.exe nxpdbrf.exe PID 1164 wrote to memory of 1396 1164 rdxvtj.exe nxpdbrf.exe PID 1164 wrote to memory of 1396 1164 rdxvtj.exe nxpdbrf.exe PID 1164 wrote to memory of 1396 1164 rdxvtj.exe nxpdbrf.exe PID 1396 wrote to memory of 2404 1396 nxpdbrf.exe lrfhnjp.exe PID 1396 wrote to memory of 2404 1396 nxpdbrf.exe lrfhnjp.exe PID 1396 wrote to memory of 2404 1396 nxpdbrf.exe lrfhnjp.exe PID 1396 wrote to memory of 2404 1396 nxpdbrf.exe lrfhnjp.exe PID 2404 wrote to memory of 2736 2404 lrfhnjp.exe pjxppfd.exe PID 2404 wrote to memory of 2736 2404 lrfhnjp.exe pjxppfd.exe PID 2404 wrote to memory of 2736 2404 lrfhnjp.exe pjxppfd.exe PID 2404 wrote to memory of 2736 2404 lrfhnjp.exe pjxppfd.exe PID 2736 wrote to memory of 2812 2736 pjxppfd.exe lxvpd.exe PID 2736 wrote to memory of 2812 2736 pjxppfd.exe lxvpd.exe PID 2736 wrote to memory of 2812 2736 pjxppfd.exe lxvpd.exe PID 2736 wrote to memory of 2812 2736 pjxppfd.exe lxvpd.exe PID 2812 wrote to memory of 2144 2812 lxvpd.exe dhlxv.exe PID 2812 wrote to memory of 2144 2812 lxvpd.exe dhlxv.exe PID 2812 wrote to memory of 2144 2812 lxvpd.exe dhlxv.exe PID 2812 wrote to memory of 2144 2812 lxvpd.exe dhlxv.exe PID 2144 wrote to memory of 2672 2144 dhlxv.exe lbdhd.exe PID 2144 wrote to memory of 2672 2144 dhlxv.exe lbdhd.exe PID 2144 wrote to memory of 2672 2144 dhlxv.exe lbdhd.exe PID 2144 wrote to memory of 2672 2144 dhlxv.exe lbdhd.exe PID 2672 wrote to memory of 812 2672 lbdhd.exe fjrhvb.exe PID 2672 wrote to memory of 812 2672 lbdhd.exe fjrhvb.exe PID 2672 wrote to memory of 812 2672 lbdhd.exe fjrhvb.exe PID 2672 wrote to memory of 812 2672 lbdhd.exe fjrhvb.exe PID 812 wrote to memory of 2524 812 fjrhvb.exe rddbhjv.exe PID 812 wrote to memory of 2524 812 fjrhvb.exe rddbhjv.exe PID 812 wrote to memory of 2524 812 fjrhvb.exe rddbhjv.exe PID 812 wrote to memory of 2524 812 fjrhvb.exe rddbhjv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3cd43ac82865884c3e59bb54c2154530_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3cd43ac82865884c3e59bb54c2154530_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\vpbrrt.exec:\vpbrrt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dtjbvl.exec:\dtjbvl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rphlr.exec:\rphlr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hpvvph.exec:\hpvvph.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnhblpd.exec:\nnhblpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jxhtn.exec:\jxhtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xdfrp.exec:\xdfrp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rdxvtj.exec:\rdxvtj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nxpdbrf.exec:\nxpdbrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrfhnjp.exec:\lrfhnjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjxppfd.exec:\pjxppfd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxvpd.exec:\lxvpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dhlxv.exec:\dhlxv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lbdhd.exec:\lbdhd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fjrhvb.exec:\fjrhvb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rddbhjv.exec:\rddbhjv.exe17⤵
- Executes dropped EXE
-
\??\c:\rjtjdl.exec:\rjtjdl.exe18⤵
- Executes dropped EXE
-
\??\c:\lrbljf.exec:\lrbljf.exe19⤵
- Executes dropped EXE
-
\??\c:\dtvlb.exec:\dtvlb.exe20⤵
- Executes dropped EXE
-
\??\c:\jrhlrv.exec:\jrhlrv.exe21⤵
- Executes dropped EXE
-
\??\c:\lhfjjth.exec:\lhfjjth.exe22⤵
- Executes dropped EXE
-
\??\c:\jrndff.exec:\jrndff.exe23⤵
- Executes dropped EXE
-
\??\c:\fvfpv.exec:\fvfpv.exe24⤵
- Executes dropped EXE
-
\??\c:\npjnhb.exec:\npjnhb.exe25⤵
- Executes dropped EXE
-
\??\c:\vjrnjpn.exec:\vjrnjpn.exe26⤵
- Executes dropped EXE
-
\??\c:\bvddfxf.exec:\bvddfxf.exe27⤵
- Executes dropped EXE
-
\??\c:\nlfpln.exec:\nlfpln.exe28⤵
- Executes dropped EXE
-
\??\c:\fpxrv.exec:\fpxrv.exe29⤵
- Executes dropped EXE
-
\??\c:\prjxx.exec:\prjxx.exe30⤵
- Executes dropped EXE
-
\??\c:\rfdvfn.exec:\rfdvfn.exe31⤵
- Executes dropped EXE
-
\??\c:\fhtvlxh.exec:\fhtvlxh.exe32⤵
- Executes dropped EXE
-
\??\c:\bnxlnnx.exec:\bnxlnnx.exe33⤵
- Executes dropped EXE
-
\??\c:\nntbl.exec:\nntbl.exe34⤵
- Executes dropped EXE
-
\??\c:\ltvntb.exec:\ltvntb.exe35⤵
- Executes dropped EXE
-
\??\c:\bffxvj.exec:\bffxvj.exe36⤵
- Executes dropped EXE
-
\??\c:\vjxxdtx.exec:\vjxxdtx.exe37⤵
- Executes dropped EXE
-
\??\c:\bdfhptp.exec:\bdfhptp.exe38⤵
- Executes dropped EXE
-
\??\c:\rttvt.exec:\rttvt.exe39⤵
- Executes dropped EXE
-
\??\c:\pxntt.exec:\pxntt.exe40⤵
- Executes dropped EXE
-
\??\c:\ddlrr.exec:\ddlrr.exe41⤵
- Executes dropped EXE
-
\??\c:\llltfn.exec:\llltfn.exe42⤵
- Executes dropped EXE
-
\??\c:\xvhnnv.exec:\xvhnnv.exe43⤵
- Executes dropped EXE
-
\??\c:\dxjprl.exec:\dxjprl.exe44⤵
- Executes dropped EXE
-
\??\c:\tdrdhf.exec:\tdrdhf.exe45⤵
- Executes dropped EXE
-
\??\c:\drhrfht.exec:\drhrfht.exe46⤵
- Executes dropped EXE
-
\??\c:\bpvlh.exec:\bpvlh.exe47⤵
- Executes dropped EXE
-
\??\c:\tjvnttv.exec:\tjvnttv.exe48⤵
- Executes dropped EXE
-
\??\c:\vhbtj.exec:\vhbtj.exe49⤵
- Executes dropped EXE
-
\??\c:\xxvlffv.exec:\xxvlffv.exe50⤵
- Executes dropped EXE
-
\??\c:\nvtxj.exec:\nvtxj.exe51⤵
- Executes dropped EXE
-
\??\c:\vjhvpn.exec:\vjhvpn.exe52⤵
- Executes dropped EXE
-
\??\c:\bbfrrl.exec:\bbfrrl.exe53⤵
- Executes dropped EXE
-
\??\c:\hfdrrrn.exec:\hfdrrrn.exe54⤵
- Executes dropped EXE
-
\??\c:\hvjlfl.exec:\hvjlfl.exe55⤵
- Executes dropped EXE
-
\??\c:\lxrlnp.exec:\lxrlnp.exe56⤵
- Executes dropped EXE
-
\??\c:\ppnrv.exec:\ppnrv.exe57⤵
- Executes dropped EXE
-
\??\c:\fvljh.exec:\fvljh.exe58⤵
- Executes dropped EXE
-
\??\c:\tbbhh.exec:\tbbhh.exe59⤵
- Executes dropped EXE
-
\??\c:\plfxxl.exec:\plfxxl.exe60⤵
- Executes dropped EXE
-
\??\c:\dhxjrbb.exec:\dhxjrbb.exe61⤵
- Executes dropped EXE
-
\??\c:\bbnlxrn.exec:\bbnlxrn.exe62⤵
- Executes dropped EXE
-
\??\c:\hjxddl.exec:\hjxddl.exe63⤵
- Executes dropped EXE
-
\??\c:\pdhlnh.exec:\pdhlnh.exe64⤵
- Executes dropped EXE
-
\??\c:\prdflf.exec:\prdflf.exe65⤵
- Executes dropped EXE
-
\??\c:\fphdjpl.exec:\fphdjpl.exe66⤵
-
\??\c:\bxhvbd.exec:\bxhvbd.exe67⤵
-
\??\c:\nfbjbxj.exec:\nfbjbxj.exe68⤵
-
\??\c:\txhtd.exec:\txhtd.exe69⤵
-
\??\c:\rpnxn.exec:\rpnxn.exe70⤵
-
\??\c:\rddtp.exec:\rddtp.exe71⤵
-
\??\c:\lnrjnd.exec:\lnrjnd.exe72⤵
-
\??\c:\bvlpl.exec:\bvlpl.exe73⤵
-
\??\c:\pjfhhd.exec:\pjfhhd.exe74⤵
-
\??\c:\hvltbtb.exec:\hvltbtb.exe75⤵
-
\??\c:\ftjllnf.exec:\ftjllnf.exe76⤵
-
\??\c:\bpxxl.exec:\bpxxl.exe77⤵
-
\??\c:\pnjvfh.exec:\pnjvfh.exe78⤵
-
\??\c:\lplpxbh.exec:\lplpxbh.exe79⤵
-
\??\c:\xtpptld.exec:\xtpptld.exe80⤵
-
\??\c:\jtxdfxr.exec:\jtxdfxr.exe81⤵
-
\??\c:\hffvp.exec:\hffvp.exe82⤵
-
\??\c:\jlbljlx.exec:\jlbljlx.exe83⤵
-
\??\c:\jbdrv.exec:\jbdrv.exe84⤵
-
\??\c:\xfrnvl.exec:\xfrnvl.exe85⤵
-
\??\c:\pnfvlh.exec:\pnfvlh.exe86⤵
-
\??\c:\rltlb.exec:\rltlb.exe87⤵
-
\??\c:\jjfjbjd.exec:\jjfjbjd.exe88⤵
-
\??\c:\prhjhh.exec:\prhjhh.exe89⤵
-
\??\c:\nbtdb.exec:\nbtdb.exe90⤵
-
\??\c:\bjbjj.exec:\bjbjj.exe91⤵
-
\??\c:\rdjjj.exec:\rdjjj.exe92⤵
-
\??\c:\rjrlhd.exec:\rjrlhd.exe93⤵
-
\??\c:\rhbfd.exec:\rhbfd.exe94⤵
-
\??\c:\lxvvtt.exec:\lxvvtt.exe95⤵
-
\??\c:\lbndjjj.exec:\lbndjjj.exe96⤵
-
\??\c:\nxdxtt.exec:\nxdxtt.exe97⤵
-
\??\c:\vnxnf.exec:\vnxnf.exe98⤵
-
\??\c:\fdttrp.exec:\fdttrp.exe99⤵
-
\??\c:\fpfjbrj.exec:\fpfjbrj.exe100⤵
-
\??\c:\jvjbl.exec:\jvjbl.exe101⤵
-
\??\c:\dhdvp.exec:\dhdvp.exe102⤵
-
\??\c:\drlbdp.exec:\drlbdp.exe103⤵
-
\??\c:\njrnn.exec:\njrnn.exe104⤵
-
\??\c:\fnrlnd.exec:\fnrlnd.exe105⤵
-
\??\c:\fhnrxlt.exec:\fhnrxlt.exe106⤵
-
\??\c:\ftfhp.exec:\ftfhp.exe107⤵
-
\??\c:\jrrthh.exec:\jrrthh.exe108⤵
-
\??\c:\jlxdfn.exec:\jlxdfn.exe109⤵
-
\??\c:\tnxtd.exec:\tnxtd.exe110⤵
-
\??\c:\jhdvpf.exec:\jhdvpf.exe111⤵
-
\??\c:\xbrlb.exec:\xbrlb.exe112⤵
-
\??\c:\rpnvt.exec:\rpnvt.exe113⤵
-
\??\c:\fjjxr.exec:\fjjxr.exe114⤵
-
\??\c:\drdtrb.exec:\drdtrb.exe115⤵
-
\??\c:\nvhdp.exec:\nvhdp.exe116⤵
-
\??\c:\rxlvf.exec:\rxlvf.exe117⤵
-
\??\c:\hhxdb.exec:\hhxdb.exe118⤵
-
\??\c:\dvbtl.exec:\dvbtl.exe119⤵
-
\??\c:\vnjlhhr.exec:\vnjlhhr.exe120⤵
-
\??\c:\brjjf.exec:\brjjf.exe121⤵
-
\??\c:\rpvjxl.exec:\rpvjxl.exe122⤵
-
\??\c:\ftrxprh.exec:\ftrxprh.exe123⤵
-
\??\c:\xfvht.exec:\xfvht.exe124⤵
-
\??\c:\nnbnjb.exec:\nnbnjb.exe125⤵
-
\??\c:\nhxtrdx.exec:\nhxtrdx.exe126⤵
-
\??\c:\nfhjp.exec:\nfhjp.exe127⤵
-
\??\c:\djdbh.exec:\djdbh.exe128⤵
-
\??\c:\frnhrjb.exec:\frnhrjb.exe129⤵
-
\??\c:\nnlxj.exec:\nnlxj.exe130⤵
-
\??\c:\hrldhxf.exec:\hrldhxf.exe131⤵
-
\??\c:\drfblj.exec:\drfblj.exe132⤵
-
\??\c:\tjjbdr.exec:\tjjbdr.exe133⤵
-
\??\c:\dpndrfp.exec:\dpndrfp.exe134⤵
-
\??\c:\nvjrpb.exec:\nvjrpb.exe135⤵
-
\??\c:\jnvfhn.exec:\jnvfhn.exe136⤵
-
\??\c:\jhvffvn.exec:\jhvffvn.exe137⤵
-
\??\c:\nbnhr.exec:\nbnhr.exe138⤵
-
\??\c:\brptpvd.exec:\brptpvd.exe139⤵
-
\??\c:\dphhdr.exec:\dphhdr.exe140⤵
-
\??\c:\vjbhj.exec:\vjbhj.exe141⤵
-
\??\c:\hrjvppx.exec:\hrjvppx.exe142⤵
-
\??\c:\bjjdpj.exec:\bjjdpj.exe143⤵
-
\??\c:\ltnptl.exec:\ltnptl.exe144⤵
-
\??\c:\ppvpfvl.exec:\ppvpfvl.exe145⤵
-
\??\c:\rrltfrr.exec:\rrltfrr.exe146⤵
-
\??\c:\lljlb.exec:\lljlb.exe147⤵
-
\??\c:\vpdfxnj.exec:\vpdfxnj.exe148⤵
-
\??\c:\jbltrf.exec:\jbltrf.exe149⤵
-
\??\c:\lxvtrjp.exec:\lxvtrjp.exe150⤵
-
\??\c:\vpnbtb.exec:\vpnbtb.exe151⤵
-
\??\c:\frtjp.exec:\frtjp.exe152⤵
-
\??\c:\ltplx.exec:\ltplx.exe153⤵
-
\??\c:\rbtbj.exec:\rbtbj.exe154⤵
-
\??\c:\lphvvnd.exec:\lphvvnd.exe155⤵
-
\??\c:\rvprl.exec:\rvprl.exe156⤵
-
\??\c:\vbndbl.exec:\vbndbl.exe157⤵
-
\??\c:\jfxbvnl.exec:\jfxbvnl.exe158⤵
-
\??\c:\bxjdb.exec:\bxjdb.exe159⤵
-
\??\c:\lnhnfdh.exec:\lnhnfdh.exe160⤵
-
\??\c:\hhxvvrd.exec:\hhxvvrd.exe161⤵
-
\??\c:\ntfpdj.exec:\ntfpdj.exe162⤵
-
\??\c:\pldvpv.exec:\pldvpv.exe163⤵
-
\??\c:\dhhvflf.exec:\dhhvflf.exe164⤵
-
\??\c:\ddjjxtl.exec:\ddjjxtl.exe165⤵
-
\??\c:\jddhl.exec:\jddhl.exe166⤵
-
\??\c:\vtvnl.exec:\vtvnl.exe167⤵
-
\??\c:\jvhfjjj.exec:\jvhfjjj.exe168⤵
-
\??\c:\llhphlt.exec:\llhphlt.exe169⤵
-
\??\c:\plltp.exec:\plltp.exe170⤵
-
\??\c:\jpjvd.exec:\jpjvd.exe171⤵
-
\??\c:\pxfrvp.exec:\pxfrvp.exe172⤵
-
\??\c:\dfhpl.exec:\dfhpl.exe173⤵
-
\??\c:\lhldvxh.exec:\lhldvxh.exe174⤵
-
\??\c:\bnxpfn.exec:\bnxpfn.exe175⤵
-
\??\c:\ldjxxtj.exec:\ldjxxtj.exe176⤵
-
\??\c:\njtnr.exec:\njtnr.exe177⤵
-
\??\c:\jlvpnfv.exec:\jlvpnfv.exe178⤵
-
\??\c:\txdfhv.exec:\txdfhv.exe179⤵
-
\??\c:\xxjnx.exec:\xxjnx.exe180⤵
-
\??\c:\vtpjrb.exec:\vtpjrb.exe181⤵
-
\??\c:\dnlpdlb.exec:\dnlpdlb.exe182⤵
-
\??\c:\dvdndt.exec:\dvdndt.exe183⤵
-
\??\c:\vhpnxp.exec:\vhpnxp.exe184⤵
-
\??\c:\xtxdj.exec:\xtxdj.exe185⤵
-
\??\c:\vllbr.exec:\vllbr.exe186⤵
-
\??\c:\hxxhfb.exec:\hxxhfb.exe187⤵
-
\??\c:\tphrfxh.exec:\tphrfxh.exe188⤵
-
\??\c:\lvbppb.exec:\lvbppb.exe189⤵
-
\??\c:\tbldtj.exec:\tbldtj.exe190⤵
-
\??\c:\pdhxtxt.exec:\pdhxtxt.exe191⤵
-
\??\c:\jvdfvv.exec:\jvdfvv.exe192⤵
-
\??\c:\rtxfx.exec:\rtxfx.exe193⤵
-
\??\c:\fjvvrjt.exec:\fjvvrjt.exe194⤵
-
\??\c:\nnjvb.exec:\nnjvb.exe195⤵
-
\??\c:\jnfvb.exec:\jnfvb.exe196⤵
-
\??\c:\jrblvpn.exec:\jrblvpn.exe197⤵
-
\??\c:\fbdtv.exec:\fbdtv.exe198⤵
-
\??\c:\vtftrl.exec:\vtftrl.exe199⤵
-
\??\c:\xrhrnhd.exec:\xrhrnhd.exe200⤵
-
\??\c:\ddprlft.exec:\ddprlft.exe201⤵
-
\??\c:\nhhdjpv.exec:\nhhdjpv.exe202⤵
-
\??\c:\dpxfddv.exec:\dpxfddv.exe203⤵
-
\??\c:\ftxrdl.exec:\ftxrdl.exe204⤵
-
\??\c:\flthrdh.exec:\flthrdh.exe205⤵
-
\??\c:\htbbrr.exec:\htbbrr.exe206⤵
-
\??\c:\dtdjtj.exec:\dtdjtj.exe207⤵
-
\??\c:\vhhjt.exec:\vhhjt.exe208⤵
-
\??\c:\hrjrlf.exec:\hrjrlf.exe209⤵
-
\??\c:\nppfv.exec:\nppfv.exe210⤵
-
\??\c:\blnbllj.exec:\blnbllj.exe211⤵
-
\??\c:\ldjlrhd.exec:\ldjlrhd.exe212⤵
-
\??\c:\vnphbxt.exec:\vnphbxt.exe213⤵
-
\??\c:\vrrlxfx.exec:\vrrlxfx.exe214⤵
-
\??\c:\dfjxv.exec:\dfjxv.exe215⤵
-
\??\c:\bthrrrf.exec:\bthrrrf.exe216⤵
-
\??\c:\jhdpd.exec:\jhdpd.exe217⤵
-
\??\c:\blrbfxl.exec:\blrbfxl.exe218⤵
-
\??\c:\xbfpfv.exec:\xbfpfv.exe219⤵
-
\??\c:\lppjnx.exec:\lppjnx.exe220⤵
-
\??\c:\xbdppvd.exec:\xbdppvd.exe221⤵
-
\??\c:\hdtjfv.exec:\hdtjfv.exe222⤵
-
\??\c:\ntjfjhn.exec:\ntjfjhn.exe223⤵
-
\??\c:\nlpvj.exec:\nlpvj.exe224⤵
-
\??\c:\rblvr.exec:\rblvr.exe225⤵
-
\??\c:\vvbxltl.exec:\vvbxltl.exe226⤵
-
\??\c:\rtvlx.exec:\rtvlx.exe227⤵
-
\??\c:\dpjfll.exec:\dpjfll.exe228⤵
-
\??\c:\fhvnvl.exec:\fhvnvl.exe229⤵
-
\??\c:\bjfjj.exec:\bjfjj.exe230⤵
-
\??\c:\vpbphh.exec:\vpbphh.exe231⤵
-
\??\c:\lxvvdn.exec:\lxvvdn.exe232⤵
-
\??\c:\bjffd.exec:\bjffd.exe233⤵
-
\??\c:\hdfpjjt.exec:\hdfpjjt.exe234⤵
-
\??\c:\fxjnv.exec:\fxjnv.exe235⤵
-
\??\c:\dphbhh.exec:\dphbhh.exe236⤵
-
\??\c:\txbfp.exec:\txbfp.exe237⤵
-
\??\c:\jhhfn.exec:\jhhfn.exe238⤵
-
\??\c:\xtlln.exec:\xtlln.exe239⤵
-
\??\c:\jtnfjhf.exec:\jtnfjhf.exe240⤵
-
\??\c:\xffxv.exec:\xffxv.exe241⤵