Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 03:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
15d1775c23c7f30ecbc07f68ae880070_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
15d1775c23c7f30ecbc07f68ae880070_NeikiAnalytics.exe
-
Size
59KB
-
MD5
15d1775c23c7f30ecbc07f68ae880070
-
SHA1
eaf40127ad377ef7cfaf39ece814355639309273
-
SHA256
da2d197e7c7f378541aa9a0d3634ac49e1ce4d09cbabba0367820c2f26de0b67
-
SHA512
22d1af4954dca8c1881887538f29bec3365d6dee17e81a3e7081d85df018f77252f1a0b6085fba2cc1c94b6295d175f64cd46266ee129277ca264283307da5ac
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzkzk:ymb3NkkiQ3mdBjFIvlA
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/2244-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3068-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2096-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2376-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1088-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2028-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2332-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1220-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2080-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3048-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1244-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
drxvn.exefbfblt.exerltvh.exedlnpttv.exejlrddxh.exefvfxvpx.exejxbhpb.exepxvbh.exerhjtfp.exenxhtp.exedflflf.exefrfnv.exedhrbhpd.exexxjph.exertbrrh.exebpxrllb.exextxbp.exebnnbbpd.exehbljxtn.exelhnbp.exenlxhtt.exejblfhll.exenjblj.exedfvpflf.exetrhbb.exexfxpvb.exepfdlh.exexhhxhjj.exerdrnv.exebdltvpd.exefrxrtd.exerfhrr.exexvxdj.exelddvlrv.exefffhnjf.exettvvx.exexdxxd.exehjbptvt.exepxvpxpp.exejtfvhjv.exeldpdfx.exepvrtlnf.exebflhtvf.exexrjrrfr.exejthbfpt.exejrxbhrv.exerdnxxfr.exenfpdp.exejbxhjt.exebxnfbnx.exerhtxh.exeddbbr.exednvrl.exexfvrvt.exetvfrv.exedlfvjh.exebllrd.exenldpvr.exexrjtfl.exedvtdrxn.exejflhnh.exetlfxdx.exedhrfbx.exedhnjbp.exepid process 2096 drxvn.exe 3068 fbfblt.exe 2680 rltvh.exe 2732 dlnpttv.exe 2428 jlrddxh.exe 2532 fvfxvpx.exe 2388 jxbhpb.exe 2812 pxvbh.exe 2376 rhjtfp.exe 1856 nxhtp.exe 1088 dflflf.exe 2672 frfnv.exe 2348 dhrbhpd.exe 2028 xxjph.exe 2332 rtbrrh.exe 1220 bpxrllb.exe 2168 xtxbp.exe 1664 bnnbbpd.exe 2080 hbljxtn.exe 2176 lhnbp.exe 2960 nlxhtt.exe 520 jblfhll.exe 1424 njblj.exe 3048 dfvpflf.exe 1804 trhbb.exe 1460 xfxpvb.exe 1244 pfdlh.exe 1288 xhhxhjj.exe 2344 rdrnv.exe 788 bdltvpd.exe 1680 frxrtd.exe 692 rfhrr.exe 752 xvxdj.exe 1052 lddvlrv.exe 2480 fffhnjf.exe 1596 ttvvx.exe 2924 xdxxd.exe 3068 hjbptvt.exe 2504 pxvpxpp.exe 2112 jtfvhjv.exe 2580 ldpdfx.exe 2592 pvrtlnf.exe 2428 bflhtvf.exe 2408 xrjrrfr.exe 2444 jthbfpt.exe 2996 jrxbhrv.exe 1724 rdnxxfr.exe 1092 nfpdp.exe 2364 jbxhjt.exe 1800 bxnfbnx.exe 2664 rhtxh.exe 852 ddbbr.exe 1996 dnvrl.exe 1560 xfvrvt.exe 2028 tvfrv.exe 1808 dlfvjh.exe 2336 bllrd.exe 1792 nldpvr.exe 240 xrjtfl.exe 2120 dvtdrxn.exe 2144 jflhnh.exe 2948 tlfxdx.exe 1712 dhrfbx.exe 3032 dhnjbp.exe -
Processes:
resource yara_rule behavioral1/memory/2244-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2244-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1088-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2028-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1220-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1244-270-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
15d1775c23c7f30ecbc07f68ae880070_NeikiAnalytics.exedrxvn.exefbfblt.exerltvh.exedlnpttv.exejlrddxh.exefvfxvpx.exejxbhpb.exepxvbh.exerhjtfp.exenxhtp.exedflflf.exefrfnv.exedhrbhpd.exexxjph.exertbrrh.exedescription pid process target process PID 2244 wrote to memory of 2096 2244 15d1775c23c7f30ecbc07f68ae880070_NeikiAnalytics.exe drxvn.exe PID 2244 wrote to memory of 2096 2244 15d1775c23c7f30ecbc07f68ae880070_NeikiAnalytics.exe drxvn.exe PID 2244 wrote to memory of 2096 2244 15d1775c23c7f30ecbc07f68ae880070_NeikiAnalytics.exe drxvn.exe PID 2244 wrote to memory of 2096 2244 15d1775c23c7f30ecbc07f68ae880070_NeikiAnalytics.exe drxvn.exe PID 2096 wrote to memory of 3068 2096 drxvn.exe fbfblt.exe PID 2096 wrote to memory of 3068 2096 drxvn.exe fbfblt.exe PID 2096 wrote to memory of 3068 2096 drxvn.exe fbfblt.exe PID 2096 wrote to memory of 3068 2096 drxvn.exe fbfblt.exe PID 3068 wrote to memory of 2680 3068 fbfblt.exe rltvh.exe PID 3068 wrote to memory of 2680 3068 fbfblt.exe rltvh.exe PID 3068 wrote to memory of 2680 3068 fbfblt.exe rltvh.exe PID 3068 wrote to memory of 2680 3068 fbfblt.exe rltvh.exe PID 2680 wrote to memory of 2732 2680 rltvh.exe dlnpttv.exe PID 2680 wrote to memory of 2732 2680 rltvh.exe dlnpttv.exe PID 2680 wrote to memory of 2732 2680 rltvh.exe dlnpttv.exe PID 2680 wrote to memory of 2732 2680 rltvh.exe dlnpttv.exe PID 2732 wrote to memory of 2428 2732 dlnpttv.exe jlrddxh.exe PID 2732 wrote to memory of 2428 2732 dlnpttv.exe jlrddxh.exe PID 2732 wrote to memory of 2428 2732 dlnpttv.exe jlrddxh.exe PID 2732 wrote to memory of 2428 2732 dlnpttv.exe jlrddxh.exe PID 2428 wrote to memory of 2532 2428 jlrddxh.exe fvfxvpx.exe PID 2428 wrote to memory of 2532 2428 jlrddxh.exe fvfxvpx.exe PID 2428 wrote to memory of 2532 2428 jlrddxh.exe fvfxvpx.exe PID 2428 wrote to memory of 2532 2428 jlrddxh.exe fvfxvpx.exe PID 2532 wrote to memory of 2388 2532 fvfxvpx.exe jxbhpb.exe PID 2532 wrote to memory of 2388 2532 fvfxvpx.exe jxbhpb.exe PID 2532 wrote to memory of 2388 2532 fvfxvpx.exe jxbhpb.exe PID 2532 wrote to memory of 2388 2532 fvfxvpx.exe jxbhpb.exe PID 2388 wrote to memory of 2812 2388 jxbhpb.exe pxvbh.exe PID 2388 wrote to memory of 2812 2388 jxbhpb.exe pxvbh.exe PID 2388 wrote to memory of 2812 2388 jxbhpb.exe pxvbh.exe PID 2388 wrote to memory of 2812 2388 jxbhpb.exe pxvbh.exe PID 2812 wrote to memory of 2376 2812 pxvbh.exe rhjtfp.exe PID 2812 wrote to memory of 2376 2812 pxvbh.exe rhjtfp.exe PID 2812 wrote to memory of 2376 2812 pxvbh.exe rhjtfp.exe PID 2812 wrote to memory of 2376 2812 pxvbh.exe rhjtfp.exe PID 2376 wrote to memory of 1856 2376 rhjtfp.exe nxhtp.exe PID 2376 wrote to memory of 1856 2376 rhjtfp.exe nxhtp.exe PID 2376 wrote to memory of 1856 2376 rhjtfp.exe nxhtp.exe PID 2376 wrote to memory of 1856 2376 rhjtfp.exe nxhtp.exe PID 1856 wrote to memory of 1088 1856 nxhtp.exe dflflf.exe PID 1856 wrote to memory of 1088 1856 nxhtp.exe dflflf.exe PID 1856 wrote to memory of 1088 1856 nxhtp.exe dflflf.exe PID 1856 wrote to memory of 1088 1856 nxhtp.exe dflflf.exe PID 1088 wrote to memory of 2672 1088 dflflf.exe frfnv.exe PID 1088 wrote to memory of 2672 1088 dflflf.exe frfnv.exe PID 1088 wrote to memory of 2672 1088 dflflf.exe frfnv.exe PID 1088 wrote to memory of 2672 1088 dflflf.exe frfnv.exe PID 2672 wrote to memory of 2348 2672 frfnv.exe dhrbhpd.exe PID 2672 wrote to memory of 2348 2672 frfnv.exe dhrbhpd.exe PID 2672 wrote to memory of 2348 2672 frfnv.exe dhrbhpd.exe PID 2672 wrote to memory of 2348 2672 frfnv.exe dhrbhpd.exe PID 2348 wrote to memory of 2028 2348 dhrbhpd.exe xxjph.exe PID 2348 wrote to memory of 2028 2348 dhrbhpd.exe xxjph.exe PID 2348 wrote to memory of 2028 2348 dhrbhpd.exe xxjph.exe PID 2348 wrote to memory of 2028 2348 dhrbhpd.exe xxjph.exe PID 2028 wrote to memory of 2332 2028 xxjph.exe rtbrrh.exe PID 2028 wrote to memory of 2332 2028 xxjph.exe rtbrrh.exe PID 2028 wrote to memory of 2332 2028 xxjph.exe rtbrrh.exe PID 2028 wrote to memory of 2332 2028 xxjph.exe rtbrrh.exe PID 2332 wrote to memory of 1220 2332 rtbrrh.exe bpxrllb.exe PID 2332 wrote to memory of 1220 2332 rtbrrh.exe bpxrllb.exe PID 2332 wrote to memory of 1220 2332 rtbrrh.exe bpxrllb.exe PID 2332 wrote to memory of 1220 2332 rtbrrh.exe bpxrllb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\15d1775c23c7f30ecbc07f68ae880070_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\15d1775c23c7f30ecbc07f68ae880070_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\drxvn.exec:\drxvn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fbfblt.exec:\fbfblt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rltvh.exec:\rltvh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dlnpttv.exec:\dlnpttv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jlrddxh.exec:\jlrddxh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fvfxvpx.exec:\fvfxvpx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jxbhpb.exec:\jxbhpb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pxvbh.exec:\pxvbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rhjtfp.exec:\rhjtfp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nxhtp.exec:\nxhtp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dflflf.exec:\dflflf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frfnv.exec:\frfnv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dhrbhpd.exec:\dhrbhpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxjph.exec:\xxjph.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rtbrrh.exec:\rtbrrh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bpxrllb.exec:\bpxrllb.exe17⤵
- Executes dropped EXE
-
\??\c:\xtxbp.exec:\xtxbp.exe18⤵
- Executes dropped EXE
-
\??\c:\bnnbbpd.exec:\bnnbbpd.exe19⤵
- Executes dropped EXE
-
\??\c:\hbljxtn.exec:\hbljxtn.exe20⤵
- Executes dropped EXE
-
\??\c:\lhnbp.exec:\lhnbp.exe21⤵
- Executes dropped EXE
-
\??\c:\nlxhtt.exec:\nlxhtt.exe22⤵
- Executes dropped EXE
-
\??\c:\jblfhll.exec:\jblfhll.exe23⤵
- Executes dropped EXE
-
\??\c:\njblj.exec:\njblj.exe24⤵
- Executes dropped EXE
-
\??\c:\dfvpflf.exec:\dfvpflf.exe25⤵
- Executes dropped EXE
-
\??\c:\trhbb.exec:\trhbb.exe26⤵
- Executes dropped EXE
-
\??\c:\xfxpvb.exec:\xfxpvb.exe27⤵
- Executes dropped EXE
-
\??\c:\pfdlh.exec:\pfdlh.exe28⤵
- Executes dropped EXE
-
\??\c:\xhhxhjj.exec:\xhhxhjj.exe29⤵
- Executes dropped EXE
-
\??\c:\rdrnv.exec:\rdrnv.exe30⤵
- Executes dropped EXE
-
\??\c:\bdltvpd.exec:\bdltvpd.exe31⤵
- Executes dropped EXE
-
\??\c:\frxrtd.exec:\frxrtd.exe32⤵
- Executes dropped EXE
-
\??\c:\rfhrr.exec:\rfhrr.exe33⤵
- Executes dropped EXE
-
\??\c:\xvxdj.exec:\xvxdj.exe34⤵
- Executes dropped EXE
-
\??\c:\lddvlrv.exec:\lddvlrv.exe35⤵
- Executes dropped EXE
-
\??\c:\fffhnjf.exec:\fffhnjf.exe36⤵
- Executes dropped EXE
-
\??\c:\ttvvx.exec:\ttvvx.exe37⤵
- Executes dropped EXE
-
\??\c:\xdxxd.exec:\xdxxd.exe38⤵
- Executes dropped EXE
-
\??\c:\hjbptvt.exec:\hjbptvt.exe39⤵
- Executes dropped EXE
-
\??\c:\pxvpxpp.exec:\pxvpxpp.exe40⤵
- Executes dropped EXE
-
\??\c:\jtfvhjv.exec:\jtfvhjv.exe41⤵
- Executes dropped EXE
-
\??\c:\ldpdfx.exec:\ldpdfx.exe42⤵
- Executes dropped EXE
-
\??\c:\pvrtlnf.exec:\pvrtlnf.exe43⤵
- Executes dropped EXE
-
\??\c:\bflhtvf.exec:\bflhtvf.exe44⤵
- Executes dropped EXE
-
\??\c:\xrjrrfr.exec:\xrjrrfr.exe45⤵
- Executes dropped EXE
-
\??\c:\jthbfpt.exec:\jthbfpt.exe46⤵
- Executes dropped EXE
-
\??\c:\jrxbhrv.exec:\jrxbhrv.exe47⤵
- Executes dropped EXE
-
\??\c:\rdnxxfr.exec:\rdnxxfr.exe48⤵
- Executes dropped EXE
-
\??\c:\nfpdp.exec:\nfpdp.exe49⤵
- Executes dropped EXE
-
\??\c:\jbxhjt.exec:\jbxhjt.exe50⤵
- Executes dropped EXE
-
\??\c:\bxnfbnx.exec:\bxnfbnx.exe51⤵
- Executes dropped EXE
-
\??\c:\rhtxh.exec:\rhtxh.exe52⤵
- Executes dropped EXE
-
\??\c:\ddbbr.exec:\ddbbr.exe53⤵
- Executes dropped EXE
-
\??\c:\dnvrl.exec:\dnvrl.exe54⤵
- Executes dropped EXE
-
\??\c:\xfvrvt.exec:\xfvrvt.exe55⤵
- Executes dropped EXE
-
\??\c:\tvfrv.exec:\tvfrv.exe56⤵
- Executes dropped EXE
-
\??\c:\dlfvjh.exec:\dlfvjh.exe57⤵
- Executes dropped EXE
-
\??\c:\bllrd.exec:\bllrd.exe58⤵
- Executes dropped EXE
-
\??\c:\nldpvr.exec:\nldpvr.exe59⤵
- Executes dropped EXE
-
\??\c:\xrjtfl.exec:\xrjtfl.exe60⤵
- Executes dropped EXE
-
\??\c:\dvtdrxn.exec:\dvtdrxn.exe61⤵
- Executes dropped EXE
-
\??\c:\jflhnh.exec:\jflhnh.exe62⤵
- Executes dropped EXE
-
\??\c:\tlfxdx.exec:\tlfxdx.exe63⤵
- Executes dropped EXE
-
\??\c:\dhrfbx.exec:\dhrfbx.exe64⤵
- Executes dropped EXE
-
\??\c:\dhnjbp.exec:\dhnjbp.exe65⤵
- Executes dropped EXE
-
\??\c:\hlvhr.exec:\hlvhr.exe66⤵
-
\??\c:\hdvdj.exec:\hdvdj.exe67⤵
-
\??\c:\xvbbfh.exec:\xvbbfh.exe68⤵
-
\??\c:\lfhtxdl.exec:\lfhtxdl.exe69⤵
-
\??\c:\ptxbxxd.exec:\ptxbxxd.exe70⤵
-
\??\c:\hxpjnl.exec:\hxpjnl.exe71⤵
-
\??\c:\ltxhv.exec:\ltxhv.exe72⤵
-
\??\c:\vnpbnf.exec:\vnpbnf.exe73⤵
-
\??\c:\hbjhpht.exec:\hbjhpht.exe74⤵
-
\??\c:\vtfxbph.exec:\vtfxbph.exe75⤵
-
\??\c:\drjjv.exec:\drjjv.exe76⤵
-
\??\c:\lxbtvrt.exec:\lxbtvrt.exe77⤵
-
\??\c:\nndlpdn.exec:\nndlpdn.exe78⤵
-
\??\c:\jfvddf.exec:\jfvddf.exe79⤵
-
\??\c:\brpdph.exec:\brpdph.exe80⤵
-
\??\c:\vxbrpfp.exec:\vxbrpfp.exe81⤵
-
\??\c:\tpvpln.exec:\tpvpln.exe82⤵
-
\??\c:\phpvp.exec:\phpvp.exe83⤵
-
\??\c:\pvfjv.exec:\pvfjv.exe84⤵
-
\??\c:\ttptxv.exec:\ttptxv.exe85⤵
-
\??\c:\ntnthnp.exec:\ntnthnp.exe86⤵
-
\??\c:\xlldpp.exec:\xlldpp.exe87⤵
-
\??\c:\fjbnjjh.exec:\fjbnjjh.exe88⤵
-
\??\c:\htjtdtl.exec:\htjtdtl.exe89⤵
-
\??\c:\pdxlnxd.exec:\pdxlnxd.exe90⤵
-
\??\c:\jxpnr.exec:\jxpnr.exe91⤵
-
\??\c:\fvfhtr.exec:\fvfhtr.exe92⤵
-
\??\c:\nlvjj.exec:\nlvjj.exe93⤵
-
\??\c:\bvblpnh.exec:\bvblpnh.exe94⤵
-
\??\c:\pbbrhx.exec:\pbbrhx.exe95⤵
-
\??\c:\dpxxx.exec:\dpxxx.exe96⤵
-
\??\c:\btfxvvj.exec:\btfxvvj.exe97⤵
-
\??\c:\plvjll.exec:\plvjll.exe98⤵
-
\??\c:\xbnjjpj.exec:\xbnjjpj.exe99⤵
-
\??\c:\ljrhf.exec:\ljrhf.exe100⤵
-
\??\c:\lbxvjx.exec:\lbxvjx.exe101⤵
-
\??\c:\vrrjp.exec:\vrrjp.exe102⤵
-
\??\c:\vdtfnvb.exec:\vdtfnvb.exe103⤵
-
\??\c:\bntbtjv.exec:\bntbtjv.exe104⤵
-
\??\c:\rrhrxj.exec:\rrhrxj.exe105⤵
-
\??\c:\xtntj.exec:\xtntj.exe106⤵
-
\??\c:\hpbfphp.exec:\hpbfphp.exe107⤵
-
\??\c:\tlxdj.exec:\tlxdj.exe108⤵
-
\??\c:\pbpvrh.exec:\pbpvrh.exe109⤵
-
\??\c:\jnflp.exec:\jnflp.exe110⤵
-
\??\c:\xhdnvtv.exec:\xhdnvtv.exe111⤵
-
\??\c:\lpfrn.exec:\lpfrn.exe112⤵
-
\??\c:\ppphtdp.exec:\ppphtdp.exe113⤵
-
\??\c:\dxjpdpv.exec:\dxjpdpv.exe114⤵
-
\??\c:\nnrdnxb.exec:\nnrdnxb.exe115⤵
-
\??\c:\tnvpbxf.exec:\tnvpbxf.exe116⤵
-
\??\c:\prfhdhh.exec:\prfhdhh.exe117⤵
-
\??\c:\jvntvd.exec:\jvntvd.exe118⤵
-
\??\c:\nrdnbr.exec:\nrdnbr.exe119⤵
-
\??\c:\trjxpr.exec:\trjxpr.exe120⤵
-
\??\c:\jbtjnlv.exec:\jbtjnlv.exe121⤵
-
\??\c:\xvldvhj.exec:\xvldvhj.exe122⤵
-
\??\c:\vhjrjh.exec:\vhjrjh.exe123⤵
-
\??\c:\tfxppn.exec:\tfxppn.exe124⤵
-
\??\c:\tjtln.exec:\tjtln.exe125⤵
-
\??\c:\drnvn.exec:\drnvn.exe126⤵
-
\??\c:\ljnlpx.exec:\ljnlpx.exe127⤵
-
\??\c:\vndjd.exec:\vndjd.exe128⤵
-
\??\c:\nbxdp.exec:\nbxdp.exe129⤵
-
\??\c:\dhllr.exec:\dhllr.exe130⤵
-
\??\c:\rlrbvdh.exec:\rlrbvdh.exe131⤵
-
\??\c:\hxpdtn.exec:\hxpdtn.exe132⤵
-
\??\c:\fthjjj.exec:\fthjjj.exe133⤵
-
\??\c:\dvhxvjn.exec:\dvhxvjn.exe134⤵
-
\??\c:\fllrj.exec:\fllrj.exe135⤵
-
\??\c:\rdffd.exec:\rdffd.exe136⤵
-
\??\c:\jhhpvjp.exec:\jhhpvjp.exe137⤵
-
\??\c:\pfhdfrv.exec:\pfhdfrv.exe138⤵
-
\??\c:\vlvbxjv.exec:\vlvbxjv.exe139⤵
-
\??\c:\vftrh.exec:\vftrh.exe140⤵
-
\??\c:\hfbpvlb.exec:\hfbpvlb.exe141⤵
-
\??\c:\blbrtfp.exec:\blbrtfp.exe142⤵
-
\??\c:\jrpxx.exec:\jrpxx.exe143⤵
-
\??\c:\hndrpxb.exec:\hndrpxb.exe144⤵
-
\??\c:\vhnxp.exec:\vhnxp.exe145⤵
-
\??\c:\fbxnd.exec:\fbxnd.exe146⤵
-
\??\c:\ttxbp.exec:\ttxbp.exe147⤵
-
\??\c:\lvvfh.exec:\lvvfh.exe148⤵
-
\??\c:\rfdlvd.exec:\rfdlvd.exe149⤵
-
\??\c:\rrbflvb.exec:\rrbflvb.exe150⤵
-
\??\c:\vnfhpl.exec:\vnfhpl.exe151⤵
-
\??\c:\ljdxj.exec:\ljdxj.exe152⤵
-
\??\c:\fjtjhnb.exec:\fjtjhnb.exe153⤵
-
\??\c:\tvhjr.exec:\tvhjr.exe154⤵
-
\??\c:\rvjxvv.exec:\rvjxvv.exe155⤵
-
\??\c:\bvfdnrh.exec:\bvfdnrh.exe156⤵
-
\??\c:\nrpnrn.exec:\nrpnrn.exe157⤵
-
\??\c:\rhljf.exec:\rhljf.exe158⤵
-
\??\c:\hnttr.exec:\hnttr.exe159⤵
-
\??\c:\txrjpxv.exec:\txrjpxv.exe160⤵
-
\??\c:\pxxxj.exec:\pxxxj.exe161⤵
-
\??\c:\xbnjjxn.exec:\xbnjjxn.exe162⤵
-
\??\c:\jbfrx.exec:\jbfrx.exe163⤵
-
\??\c:\hpbdpj.exec:\hpbdpj.exe164⤵
-
\??\c:\hlnfrpr.exec:\hlnfrpr.exe165⤵
-
\??\c:\bxxnvxn.exec:\bxxnvxn.exe166⤵
-
\??\c:\ntvfhp.exec:\ntvfhp.exe167⤵
-
\??\c:\lnrdxjd.exec:\lnrdxjd.exe168⤵
-
\??\c:\brrrvl.exec:\brrrvl.exe169⤵
-
\??\c:\txfxd.exec:\txfxd.exe170⤵
-
\??\c:\hfbhx.exec:\hfbhx.exe171⤵
-
\??\c:\nvtnjv.exec:\nvtnjv.exe172⤵
-
\??\c:\trpnxvv.exec:\trpnxvv.exe173⤵
-
\??\c:\rdtnllb.exec:\rdtnllb.exe174⤵
-
\??\c:\bvvtrxb.exec:\bvvtrxb.exe175⤵
-
\??\c:\tffvph.exec:\tffvph.exe176⤵
-
\??\c:\xtblrlt.exec:\xtblrlt.exe177⤵
-
\??\c:\jjhxv.exec:\jjhxv.exe178⤵
-
\??\c:\vvnbjr.exec:\vvnbjr.exe179⤵
-
\??\c:\bpfvvpf.exec:\bpfvvpf.exe180⤵
-
\??\c:\nfndl.exec:\nfndl.exe181⤵
-
\??\c:\phrthr.exec:\phrthr.exe182⤵
-
\??\c:\xxrnhvf.exec:\xxrnhvf.exe183⤵
-
\??\c:\lffrtt.exec:\lffrtt.exe184⤵
-
\??\c:\bdjnnd.exec:\bdjnnd.exe185⤵
-
\??\c:\bdthv.exec:\bdthv.exe186⤵
-
\??\c:\vxdxpp.exec:\vxdxpp.exe187⤵
-
\??\c:\npxtpx.exec:\npxtpx.exe188⤵
-
\??\c:\tnlbdfl.exec:\tnlbdfl.exe189⤵
-
\??\c:\rbnlph.exec:\rbnlph.exe190⤵
-
\??\c:\rbthrxl.exec:\rbthrxl.exe191⤵
-
\??\c:\xrddt.exec:\xrddt.exe192⤵
-
\??\c:\tpbvpp.exec:\tpbvpp.exe193⤵
-
\??\c:\djbfrf.exec:\djbfrf.exe194⤵
-
\??\c:\ddbdr.exec:\ddbdr.exe195⤵
-
\??\c:\bhbvd.exec:\bhbvd.exe196⤵
-
\??\c:\pxdjtnp.exec:\pxdjtnp.exe197⤵
-
\??\c:\dfphj.exec:\dfphj.exe198⤵
-
\??\c:\bphjrld.exec:\bphjrld.exe199⤵
-
\??\c:\fvrthph.exec:\fvrthph.exe200⤵
-
\??\c:\dxrbv.exec:\dxrbv.exe201⤵
-
\??\c:\rppbjv.exec:\rppbjv.exe202⤵
-
\??\c:\httht.exec:\httht.exe203⤵
-
\??\c:\bttjxrp.exec:\bttjxrp.exe204⤵
-
\??\c:\rbjlr.exec:\rbjlr.exe205⤵
-
\??\c:\xhddhr.exec:\xhddhr.exe206⤵
-
\??\c:\ppppv.exec:\ppppv.exe207⤵
-
\??\c:\xrbtlnn.exec:\xrbtlnn.exe208⤵
-
\??\c:\frdxh.exec:\frdxh.exe209⤵
-
\??\c:\jpdpf.exec:\jpdpf.exe210⤵
-
\??\c:\dllrplt.exec:\dllrplt.exe211⤵
-
\??\c:\pfjvxd.exec:\pfjvxd.exe212⤵
-
\??\c:\dhbbhnp.exec:\dhbbhnp.exe213⤵
-
\??\c:\rnfvlv.exec:\rnfvlv.exe214⤵
-
\??\c:\jnllrxn.exec:\jnllrxn.exe215⤵
-
\??\c:\blhdltv.exec:\blhdltv.exe216⤵
-
\??\c:\bnvtphh.exec:\bnvtphh.exe217⤵
-
\??\c:\drptplx.exec:\drptplx.exe218⤵
-
\??\c:\tljpdhv.exec:\tljpdhv.exe219⤵
-
\??\c:\hxxxbpr.exec:\hxxxbpr.exe220⤵
-
\??\c:\xldbthl.exec:\xldbthl.exe221⤵
-
\??\c:\tpxrl.exec:\tpxrl.exe222⤵
-
\??\c:\ftlhp.exec:\ftlhp.exe223⤵
-
\??\c:\tpxbdhr.exec:\tpxbdhr.exe224⤵
-
\??\c:\bjxvrtd.exec:\bjxvrtd.exe225⤵
-
\??\c:\lxvbldr.exec:\lxvbldr.exe226⤵
-
\??\c:\llddh.exec:\llddh.exe227⤵
-
\??\c:\vbpfhbx.exec:\vbpfhbx.exe228⤵
-
\??\c:\fdnjp.exec:\fdnjp.exe229⤵
-
\??\c:\xrxdrb.exec:\xrxdrb.exe230⤵
-
\??\c:\bpblb.exec:\bpblb.exe231⤵
-
\??\c:\bdvvhx.exec:\bdvvhx.exe232⤵
-
\??\c:\lxlph.exec:\lxlph.exe233⤵
-
\??\c:\lftrh.exec:\lftrh.exe234⤵
-
\??\c:\xbjxvt.exec:\xbjxvt.exe235⤵
-
\??\c:\tbhldbd.exec:\tbhldbd.exe236⤵
-
\??\c:\ljtrjxj.exec:\ljtrjxj.exe237⤵
-
\??\c:\njrbrxv.exec:\njrbrxv.exe238⤵
-
\??\c:\vlvpxb.exec:\vlvpxb.exe239⤵
-
\??\c:\dndlhnt.exec:\dndlhnt.exe240⤵
-
\??\c:\pbpxhtt.exec:\pbpxhtt.exe241⤵