Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
15-05-2024 22:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
43edfb5af6e4d7e3e10cdc05716d4c00_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
43edfb5af6e4d7e3e10cdc05716d4c00_NeikiAnalytics.exe
-
Size
69KB
-
MD5
43edfb5af6e4d7e3e10cdc05716d4c00
-
SHA1
371bdd02db9aa2fb9912be898da519f3e2a5ac27
-
SHA256
7aecb222779a2c868de925fb88d24363cd6b5e6165c372948cc8d9f8634eb478
-
SHA512
d1e2c04e70e3b8346a1ef0f454147bd6fbb24a03de8824cb7b94e02187252343fb818e47bc8d764b7dde4ba57a7ce466d9a5b87294d258720247ea537e7e2ad4
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIgUVyiAnm9:ymb3NkkiQ3mdBjFIgUEa
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/3040-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1920-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3040-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1744-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1580-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2052-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/588-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/752-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3048-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1148-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1568-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bthbnb.exe7hbhtb.exeffrxrfx.exehbhnnt.exe9hnttb.exepdpvd.exexrrlrrx.exefflfrxl.exetnhntt.exeppvjj.exevppvd.exelrlrxll.exe3tnbbh.exebtntnb.exevvppv.exepdvjp.exelxlrlxx.exehthbtn.exehhthth.exeddppp.exe9rllflx.exe9flxrff.exebthhtn.exejdpvd.exelflrrrf.exe5flflxl.exebnttbb.exetnbhbh.exejdppv.exellflxxl.exe5lfflll.exetnhhhh.exe3ttbnt.exeppppd.exedvppp.exefxrrxrf.exexrfflfr.exe3tbhhh.exetntbtb.exe9djdd.exe5jdjp.exerrfrlxx.exehnbbhn.exehthhbb.exe1ddvv.exe1jdjd.exerlfrrxf.exefxlxrxx.exehbhhbb.exe7bntbh.exejdvjp.exexrlxlrr.exefxffrlr.exebnnnbt.exebhnhhh.exepjdvj.exe7jdjp.exexfxxfxf.exenbtttn.exehtbttt.exepjppd.exejvjpd.exefxxfllx.exehnbbth.exepid process 3040 bthbnb.exe 2616 7hbhtb.exe 2536 ffrxrfx.exe 2648 hbhnnt.exe 1740 9hnttb.exe 2412 pdpvd.exe 2532 xrrlrrx.exe 1744 fflfrxl.exe 1580 tnhntt.exe 2388 ppvjj.exe 2712 vppvd.exe 1620 lrlrxll.exe 1016 3tnbbh.exe 1664 btntnb.exe 2688 vvppv.exe 1592 pdvjp.exe 1236 lxlrlxx.exe 2120 hthbtn.exe 2052 hhthth.exe 2684 ddppp.exe 588 9rllflx.exe 752 9flxrff.exe 3048 bthhtn.exe 1148 jdpvd.exe 2224 lflrrrf.exe 1720 5flflxl.exe 1248 bnttbb.exe 908 tnbhbh.exe 2220 jdppv.exe 1568 llflxxl.exe 2952 5lfflll.exe 2700 tnhhhh.exe 2204 3ttbnt.exe 1920 ppppd.exe 1520 dvppp.exe 3040 fxrrxrf.exe 2560 xrfflfr.exe 2664 3tbhhh.exe 2604 tntbtb.exe 2876 9djdd.exe 1588 5jdjp.exe 1740 rrfrlxx.exe 2840 hnbbhn.exe 2180 hthhbb.exe 2836 1ddvv.exe 1536 1jdjd.exe 2400 rlfrrxf.exe 2656 fxlxrxx.exe 2308 hbhhbb.exe 2320 7bntbh.exe 856 jdvjp.exe 1944 xrlxlrr.exe 1664 fxffrlr.exe 1260 bnnnbt.exe 852 bhnhhh.exe 2356 pjdvj.exe 2240 7jdjp.exe 2120 xfxxfxf.exe 1940 nbtttn.exe 596 htbttt.exe 532 pjppd.exe 476 jvjpd.exe 752 fxxfllx.exe 1724 hnbbth.exe -
Processes:
resource yara_rule behavioral1/memory/3040-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1920-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1744-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1580-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/588-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/752-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1148-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1568-286-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-295-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
43edfb5af6e4d7e3e10cdc05716d4c00_NeikiAnalytics.exebthbnb.exe7hbhtb.exeffrxrfx.exehbhnnt.exe9hnttb.exepdpvd.exexrrlrrx.exefflfrxl.exetnhntt.exeppvjj.exevppvd.exelrlrxll.exe3tnbbh.exebtntnb.exevvppv.exedescription pid process target process PID 1920 wrote to memory of 3040 1920 43edfb5af6e4d7e3e10cdc05716d4c00_NeikiAnalytics.exe bthbnb.exe PID 1920 wrote to memory of 3040 1920 43edfb5af6e4d7e3e10cdc05716d4c00_NeikiAnalytics.exe bthbnb.exe PID 1920 wrote to memory of 3040 1920 43edfb5af6e4d7e3e10cdc05716d4c00_NeikiAnalytics.exe bthbnb.exe PID 1920 wrote to memory of 3040 1920 43edfb5af6e4d7e3e10cdc05716d4c00_NeikiAnalytics.exe bthbnb.exe PID 3040 wrote to memory of 2616 3040 bthbnb.exe 7hbhtb.exe PID 3040 wrote to memory of 2616 3040 bthbnb.exe 7hbhtb.exe PID 3040 wrote to memory of 2616 3040 bthbnb.exe 7hbhtb.exe PID 3040 wrote to memory of 2616 3040 bthbnb.exe 7hbhtb.exe PID 2616 wrote to memory of 2536 2616 7hbhtb.exe ffrxrfx.exe PID 2616 wrote to memory of 2536 2616 7hbhtb.exe ffrxrfx.exe PID 2616 wrote to memory of 2536 2616 7hbhtb.exe ffrxrfx.exe PID 2616 wrote to memory of 2536 2616 7hbhtb.exe ffrxrfx.exe PID 2536 wrote to memory of 2648 2536 ffrxrfx.exe hbhnnt.exe PID 2536 wrote to memory of 2648 2536 ffrxrfx.exe hbhnnt.exe PID 2536 wrote to memory of 2648 2536 ffrxrfx.exe hbhnnt.exe PID 2536 wrote to memory of 2648 2536 ffrxrfx.exe hbhnnt.exe PID 2648 wrote to memory of 1740 2648 hbhnnt.exe 9hnttb.exe PID 2648 wrote to memory of 1740 2648 hbhnnt.exe 9hnttb.exe PID 2648 wrote to memory of 1740 2648 hbhnnt.exe 9hnttb.exe PID 2648 wrote to memory of 1740 2648 hbhnnt.exe 9hnttb.exe PID 1740 wrote to memory of 2412 1740 9hnttb.exe pdpvd.exe PID 1740 wrote to memory of 2412 1740 9hnttb.exe pdpvd.exe PID 1740 wrote to memory of 2412 1740 9hnttb.exe pdpvd.exe PID 1740 wrote to memory of 2412 1740 9hnttb.exe pdpvd.exe PID 2412 wrote to memory of 2532 2412 pdpvd.exe xrrlrrx.exe PID 2412 wrote to memory of 2532 2412 pdpvd.exe xrrlrrx.exe PID 2412 wrote to memory of 2532 2412 pdpvd.exe xrrlrrx.exe PID 2412 wrote to memory of 2532 2412 pdpvd.exe xrrlrrx.exe PID 2532 wrote to memory of 1744 2532 xrrlrrx.exe fflfrxl.exe PID 2532 wrote to memory of 1744 2532 xrrlrrx.exe fflfrxl.exe PID 2532 wrote to memory of 1744 2532 xrrlrrx.exe fflfrxl.exe PID 2532 wrote to memory of 1744 2532 xrrlrrx.exe fflfrxl.exe PID 1744 wrote to memory of 1580 1744 fflfrxl.exe tnhntt.exe PID 1744 wrote to memory of 1580 1744 fflfrxl.exe tnhntt.exe PID 1744 wrote to memory of 1580 1744 fflfrxl.exe tnhntt.exe PID 1744 wrote to memory of 1580 1744 fflfrxl.exe tnhntt.exe PID 1580 wrote to memory of 2388 1580 tnhntt.exe ppvjj.exe PID 1580 wrote to memory of 2388 1580 tnhntt.exe ppvjj.exe PID 1580 wrote to memory of 2388 1580 tnhntt.exe ppvjj.exe PID 1580 wrote to memory of 2388 1580 tnhntt.exe ppvjj.exe PID 2388 wrote to memory of 2712 2388 ppvjj.exe vppvd.exe PID 2388 wrote to memory of 2712 2388 ppvjj.exe vppvd.exe PID 2388 wrote to memory of 2712 2388 ppvjj.exe vppvd.exe PID 2388 wrote to memory of 2712 2388 ppvjj.exe vppvd.exe PID 2712 wrote to memory of 1620 2712 vppvd.exe lrlrxll.exe PID 2712 wrote to memory of 1620 2712 vppvd.exe lrlrxll.exe PID 2712 wrote to memory of 1620 2712 vppvd.exe lrlrxll.exe PID 2712 wrote to memory of 1620 2712 vppvd.exe lrlrxll.exe PID 1620 wrote to memory of 1016 1620 lrlrxll.exe 3tnbbh.exe PID 1620 wrote to memory of 1016 1620 lrlrxll.exe 3tnbbh.exe PID 1620 wrote to memory of 1016 1620 lrlrxll.exe 3tnbbh.exe PID 1620 wrote to memory of 1016 1620 lrlrxll.exe 3tnbbh.exe PID 1016 wrote to memory of 1664 1016 3tnbbh.exe btntnb.exe PID 1016 wrote to memory of 1664 1016 3tnbbh.exe btntnb.exe PID 1016 wrote to memory of 1664 1016 3tnbbh.exe btntnb.exe PID 1016 wrote to memory of 1664 1016 3tnbbh.exe btntnb.exe PID 1664 wrote to memory of 2688 1664 btntnb.exe vvppv.exe PID 1664 wrote to memory of 2688 1664 btntnb.exe vvppv.exe PID 1664 wrote to memory of 2688 1664 btntnb.exe vvppv.exe PID 1664 wrote to memory of 2688 1664 btntnb.exe vvppv.exe PID 2688 wrote to memory of 1592 2688 vvppv.exe pdvjp.exe PID 2688 wrote to memory of 1592 2688 vvppv.exe pdvjp.exe PID 2688 wrote to memory of 1592 2688 vvppv.exe pdvjp.exe PID 2688 wrote to memory of 1592 2688 vvppv.exe pdvjp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\43edfb5af6e4d7e3e10cdc05716d4c00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\43edfb5af6e4d7e3e10cdc05716d4c00_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\bthbnb.exec:\bthbnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\7hbhtb.exec:\7hbhtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\ffrxrfx.exec:\ffrxrfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\hbhnnt.exec:\hbhnnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\9hnttb.exec:\9hnttb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\pdpvd.exec:\pdpvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\xrrlrrx.exec:\xrrlrrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\fflfrxl.exec:\fflfrxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\tnhntt.exec:\tnhntt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\ppvjj.exec:\ppvjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\vppvd.exec:\vppvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\lrlrxll.exec:\lrlrxll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\3tnbbh.exec:\3tnbbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\btntnb.exec:\btntnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\vvppv.exec:\vvppv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\pdvjp.exec:\pdvjp.exe17⤵
- Executes dropped EXE
PID:1592 -
\??\c:\lxlrlxx.exec:\lxlrlxx.exe18⤵
- Executes dropped EXE
PID:1236 -
\??\c:\hthbtn.exec:\hthbtn.exe19⤵
- Executes dropped EXE
PID:2120 -
\??\c:\hhthth.exec:\hhthth.exe20⤵
- Executes dropped EXE
PID:2052 -
\??\c:\ddppp.exec:\ddppp.exe21⤵
- Executes dropped EXE
PID:2684 -
\??\c:\9rllflx.exec:\9rllflx.exe22⤵
- Executes dropped EXE
PID:588 -
\??\c:\9flxrff.exec:\9flxrff.exe23⤵
- Executes dropped EXE
PID:752 -
\??\c:\bthhtn.exec:\bthhtn.exe24⤵
- Executes dropped EXE
PID:3048 -
\??\c:\jdpvd.exec:\jdpvd.exe25⤵
- Executes dropped EXE
PID:1148 -
\??\c:\lflrrrf.exec:\lflrrrf.exe26⤵
- Executes dropped EXE
PID:2224 -
\??\c:\5flflxl.exec:\5flflxl.exe27⤵
- Executes dropped EXE
PID:1720 -
\??\c:\bnttbb.exec:\bnttbb.exe28⤵
- Executes dropped EXE
PID:1248 -
\??\c:\tnbhbh.exec:\tnbhbh.exe29⤵
- Executes dropped EXE
PID:908 -
\??\c:\jdppv.exec:\jdppv.exe30⤵
- Executes dropped EXE
PID:2220 -
\??\c:\llflxxl.exec:\llflxxl.exe31⤵
- Executes dropped EXE
PID:1568 -
\??\c:\5lfflll.exec:\5lfflll.exe32⤵
- Executes dropped EXE
PID:2952 -
\??\c:\tnhhhh.exec:\tnhhhh.exe33⤵
- Executes dropped EXE
PID:2700 -
\??\c:\3ttbnt.exec:\3ttbnt.exe34⤵
- Executes dropped EXE
PID:2204 -
\??\c:\ppppd.exec:\ppppd.exe35⤵
- Executes dropped EXE
PID:1920 -
\??\c:\dvppp.exec:\dvppp.exe36⤵
- Executes dropped EXE
PID:1520 -
\??\c:\fxrrxrf.exec:\fxrrxrf.exe37⤵
- Executes dropped EXE
PID:3040 -
\??\c:\xrfflfr.exec:\xrfflfr.exe38⤵
- Executes dropped EXE
PID:2560 -
\??\c:\3tbhhh.exec:\3tbhhh.exe39⤵
- Executes dropped EXE
PID:2664 -
\??\c:\tntbtb.exec:\tntbtb.exe40⤵
- Executes dropped EXE
PID:2604 -
\??\c:\9djdd.exec:\9djdd.exe41⤵
- Executes dropped EXE
PID:2876 -
\??\c:\5jdjp.exec:\5jdjp.exe42⤵
- Executes dropped EXE
PID:1588 -
\??\c:\rrfrlxx.exec:\rrfrlxx.exe43⤵
- Executes dropped EXE
PID:1740 -
\??\c:\hnbbhn.exec:\hnbbhn.exe44⤵
- Executes dropped EXE
PID:2840 -
\??\c:\hthhbb.exec:\hthhbb.exe45⤵
- Executes dropped EXE
PID:2180 -
\??\c:\1ddvv.exec:\1ddvv.exe46⤵
- Executes dropped EXE
PID:2836 -
\??\c:\1jdjd.exec:\1jdjd.exe47⤵
- Executes dropped EXE
PID:1536 -
\??\c:\rlfrrxf.exec:\rlfrrxf.exe48⤵
- Executes dropped EXE
PID:2400 -
\??\c:\fxlxrxx.exec:\fxlxrxx.exe49⤵
- Executes dropped EXE
PID:2656 -
\??\c:\hbhhbb.exec:\hbhhbb.exe50⤵
- Executes dropped EXE
PID:2308 -
\??\c:\7bntbh.exec:\7bntbh.exe51⤵
- Executes dropped EXE
PID:2320 -
\??\c:\jdvjp.exec:\jdvjp.exe52⤵
- Executes dropped EXE
PID:856 -
\??\c:\xrlxlrr.exec:\xrlxlrr.exe53⤵
- Executes dropped EXE
PID:1944 -
\??\c:\fxffrlr.exec:\fxffrlr.exe54⤵
- Executes dropped EXE
PID:1664 -
\??\c:\bnnnbt.exec:\bnnnbt.exe55⤵
- Executes dropped EXE
PID:1260 -
\??\c:\bhnhhh.exec:\bhnhhh.exe56⤵
- Executes dropped EXE
PID:852 -
\??\c:\pjdvj.exec:\pjdvj.exe57⤵
- Executes dropped EXE
PID:2356 -
\??\c:\7jdjp.exec:\7jdjp.exe58⤵
- Executes dropped EXE
PID:2240 -
\??\c:\xfxxfxf.exec:\xfxxfxf.exe59⤵
- Executes dropped EXE
PID:2120 -
\??\c:\nbtttn.exec:\nbtttn.exe60⤵
- Executes dropped EXE
PID:1940 -
\??\c:\htbttt.exec:\htbttt.exe61⤵
- Executes dropped EXE
PID:596 -
\??\c:\pjppd.exec:\pjppd.exe62⤵
- Executes dropped EXE
PID:532 -
\??\c:\jvjpd.exec:\jvjpd.exe63⤵
- Executes dropped EXE
PID:476 -
\??\c:\fxxfllx.exec:\fxxfllx.exe64⤵
- Executes dropped EXE
PID:752 -
\??\c:\hnbbth.exec:\hnbbth.exe65⤵
- Executes dropped EXE
PID:1724 -
\??\c:\nbhtnt.exec:\nbhtnt.exe66⤵PID:3028
-
\??\c:\jjpjj.exec:\jjpjj.exe67⤵PID:1988
-
\??\c:\fxllfll.exec:\fxllfll.exe68⤵PID:1932
-
\??\c:\ffrlxxl.exec:\ffrlxxl.exe69⤵PID:1300
-
\??\c:\3bnbbt.exec:\3bnbbt.exe70⤵PID:2980
-
\??\c:\9bhbnn.exec:\9bhbnn.exe71⤵PID:2196
-
\??\c:\vpjpv.exec:\vpjpv.exe72⤵PID:696
-
\??\c:\vpppp.exec:\vpppp.exe73⤵PID:2280
-
\??\c:\ffrllxf.exec:\ffrllxf.exe74⤵PID:2260
-
\??\c:\rrlxllr.exec:\rrlxllr.exe75⤵PID:1452
-
\??\c:\nbhtbn.exec:\nbhtbn.exe76⤵PID:1192
-
\??\c:\btnbhn.exec:\btnbhn.exe77⤵PID:2868
-
\??\c:\vpjdd.exec:\vpjdd.exe78⤵PID:2824
-
\??\c:\pppdd.exec:\pppdd.exe79⤵PID:2552
-
\??\c:\xfrrlrx.exec:\xfrrlrx.exe80⤵PID:2556
-
\??\c:\fxrrxfl.exec:\fxrrxfl.exe81⤵PID:328
-
\??\c:\fxlllll.exec:\fxlllll.exe82⤵PID:2644
-
\??\c:\3tnthb.exec:\3tnthb.exe83⤵PID:2436
-
\??\c:\hbnhhh.exec:\hbnhhh.exe84⤵PID:2460
-
\??\c:\dvpdv.exec:\dvpdv.exe85⤵PID:2424
-
\??\c:\lflrxxx.exec:\lflrxxx.exe86⤵PID:2412
-
\??\c:\lxlfffx.exec:\lxlfffx.exe87⤵PID:2488
-
\??\c:\5llrxxr.exec:\5llrxxr.exe88⤵PID:1652
-
\??\c:\tttnhb.exec:\tttnhb.exe89⤵PID:1744
-
\??\c:\btnntb.exec:\btnntb.exe90⤵PID:1580
-
\??\c:\vjjdj.exec:\vjjdj.exe91⤵PID:1556
-
\??\c:\9dpjp.exec:\9dpjp.exe92⤵PID:2360
-
\??\c:\lxllllr.exec:\lxllllr.exe93⤵PID:280
-
\??\c:\1rrxlll.exec:\1rrxlll.exe94⤵PID:1084
-
\??\c:\htbtnn.exec:\htbtnn.exe95⤵PID:1576
-
\??\c:\nnhhht.exec:\nnhhht.exe96⤵PID:1696
-
\??\c:\dddpd.exec:\dddpd.exe97⤵PID:1340
-
\??\c:\jdppv.exec:\jdppv.exe98⤵PID:1360
-
\??\c:\jjvdj.exec:\jjvdj.exe99⤵PID:3036
-
\??\c:\frrrrrx.exec:\frrrrrx.exe100⤵PID:3044
-
\??\c:\ffffxlf.exec:\ffffxlf.exe101⤵PID:1208
-
\??\c:\5bbbnt.exec:\5bbbnt.exe102⤵PID:2112
-
\??\c:\hthhbb.exec:\hthhbb.exe103⤵PID:1992
-
\??\c:\hthhnt.exec:\hthhnt.exe104⤵PID:1048
-
\??\c:\jvjpp.exec:\jvjpp.exe105⤵PID:1428
-
\??\c:\pjjjj.exec:\pjjjj.exe106⤵PID:656
-
\??\c:\lxlfrxf.exec:\lxlfrxf.exe107⤵PID:2012
-
\??\c:\lxlxlfr.exec:\lxlxlfr.exe108⤵PID:1760
-
\??\c:\nhtthh.exec:\nhtthh.exe109⤵PID:2248
-
\??\c:\1hthhb.exec:\1hthhb.exe110⤵PID:1504
-
\??\c:\3pdpp.exec:\3pdpp.exe111⤵PID:2752
-
\??\c:\pdvvv.exec:\pdvvv.exe112⤵PID:1248
-
\??\c:\pdjdd.exec:\pdjdd.exe113⤵PID:764
-
\??\c:\xrxxlll.exec:\xrxxlll.exe114⤵PID:3012
-
\??\c:\fxfflfx.exec:\fxfflfx.exe115⤵PID:2004
-
\??\c:\bhtthb.exec:\bhtthb.exe116⤵PID:2696
-
\??\c:\tnthnh.exec:\tnthnh.exe117⤵PID:880
-
\??\c:\djjvd.exec:\djjvd.exe118⤵PID:2748
-
\??\c:\9ppjp.exec:\9ppjp.exe119⤵PID:2872
-
\??\c:\7lxrrxx.exec:\7lxrrxx.exe120⤵PID:1672
-
\??\c:\7xxrrrr.exec:\7xxrrrr.exe121⤵PID:2900
-
\??\c:\xllxxfr.exec:\xllxxfr.exe122⤵PID:2056
-
\??\c:\ntbbnn.exec:\ntbbnn.exe123⤵PID:2540
-
\??\c:\bthtbb.exec:\bthtbb.exe124⤵PID:2572
-
\??\c:\vppjv.exec:\vppjv.exe125⤵PID:2736
-
\??\c:\9dvdv.exec:\9dvdv.exe126⤵PID:2648
-
\??\c:\lrrflxf.exec:\lrrflxf.exe127⤵PID:2428
-
\??\c:\rfrrffr.exec:\rfrrffr.exe128⤵PID:2484
-
\??\c:\thnhnh.exec:\thnhnh.exe129⤵PID:2680
-
\??\c:\bnnbhh.exec:\bnnbhh.exe130⤵PID:292
-
\??\c:\dpvvp.exec:\dpvvp.exe131⤵PID:2136
-
\??\c:\dpddj.exec:\dpddj.exe132⤵PID:1656
-
\??\c:\xffrrxr.exec:\xffrrxr.exe133⤵PID:1472
-
\??\c:\xxrfrlx.exec:\xxrfrlx.exe134⤵PID:2144
-
\??\c:\thnntn.exec:\thnntn.exe135⤵PID:2176
-
\??\c:\bbbtnn.exec:\bbbtnn.exe136⤵PID:1620
-
\??\c:\hhbhtt.exec:\hhbhtt.exe137⤵PID:1016
-
\??\c:\ppvjp.exec:\ppvjp.exe138⤵PID:2288
-
\??\c:\ppppp.exec:\ppppp.exe139⤵PID:108
-
\??\c:\lrxxlrl.exec:\lrxxlrl.exe140⤵PID:1268
-
\??\c:\frxfflx.exec:\frxfflx.exe141⤵PID:2740
-
\??\c:\htntbn.exec:\htntbn.exe142⤵PID:1284
-
\??\c:\thhbht.exec:\thhbht.exe143⤵PID:2008
-
\??\c:\vvjjj.exec:\vvjjj.exe144⤵PID:2780
-
\??\c:\9jdvp.exec:\9jdvp.exe145⤵PID:2392
-
\??\c:\3frrxxx.exec:\3frrxxx.exe146⤵PID:268
-
\??\c:\xxllxfl.exec:\xxllxfl.exe147⤵PID:588
-
\??\c:\llrxlrl.exec:\llrxlrl.exe148⤵PID:1972
-
\??\c:\1bnnnn.exec:\1bnnnn.exe149⤵PID:1584
-
\??\c:\hbnbhn.exec:\hbnbhn.exe150⤵PID:2152
-
\??\c:\ddpvv.exec:\ddpvv.exe151⤵PID:848
-
\??\c:\jdvdd.exec:\jdvdd.exe152⤵PID:1612
-
\??\c:\xrflrxx.exec:\xrflrxx.exe153⤵PID:1480
-
\??\c:\rlffrrx.exec:\rlffrrx.exe154⤵PID:896
-
\??\c:\nhtbbb.exec:\nhtbbb.exe155⤵PID:376
-
\??\c:\7bnhhh.exec:\7bnhhh.exe156⤵PID:2236
-
\??\c:\vjjjd.exec:\vjjjd.exe157⤵PID:2220
-
\??\c:\jjdpd.exec:\jjdpd.exe158⤵PID:1272
-
\??\c:\rrlxrfx.exec:\rrlxrfx.exe159⤵PID:1524
-
\??\c:\fffrlxx.exec:\fffrlxx.exe160⤵PID:2920
-
\??\c:\rrfrlxr.exec:\rrfrlxr.exe161⤵PID:2988
-
\??\c:\tnbnbh.exec:\tnbnbh.exe162⤵PID:2204
-
\??\c:\nthhnt.exec:\nthhnt.exe163⤵PID:2608
-
\??\c:\vdjvv.exec:\vdjvv.exe164⤵PID:2640
-
\??\c:\1pddd.exec:\1pddd.exe165⤵PID:2636
-
\??\c:\7vvvd.exec:\7vvvd.exe166⤵PID:2760
-
\??\c:\5rrxxrf.exec:\5rrxxrf.exe167⤵PID:2624
-
\??\c:\fxxxflr.exec:\fxxxflr.exe168⤵PID:2708
-
\??\c:\bbnhnb.exec:\bbnhnb.exe169⤵PID:2116
-
\??\c:\3nbhtt.exec:\3nbhtt.exe170⤵PID:1588
-
\??\c:\tbttnt.exec:\tbttnt.exe171⤵PID:2456
-
\??\c:\5djvp.exec:\5djvp.exe172⤵PID:2300
-
\??\c:\pdvvp.exec:\pdvvp.exe173⤵PID:1668
-
\??\c:\lxrrxxf.exec:\lxrrxxf.exe174⤵PID:1388
-
\??\c:\rfrlrlx.exec:\rfrlrlx.exe175⤵PID:2600
-
\??\c:\3thtbt.exec:\3thtbt.exe176⤵PID:2400
-
\??\c:\thnnbh.exec:\thnnbh.exe177⤵PID:2656
-
\??\c:\ppjvd.exec:\ppjvd.exe178⤵PID:1460
-
\??\c:\jvjpp.exec:\jvjpp.exe179⤵PID:1764
-
\??\c:\xxfxffr.exec:\xxfxffr.exe180⤵PID:380
-
\??\c:\lxrrrxx.exec:\lxrrrxx.exe181⤵PID:1688
-
\??\c:\tthntb.exec:\tthntb.exe182⤵PID:1264
-
\??\c:\5ntntn.exec:\5ntntn.exe183⤵PID:1260
-
\??\c:\tnhntb.exec:\tnhntb.exe184⤵PID:3000
-
\??\c:\pdjdj.exec:\pdjdj.exe185⤵PID:1872
-
\??\c:\jjpvd.exec:\jjpvd.exe186⤵PID:2776
-
\??\c:\frflrlr.exec:\frflrlr.exe187⤵PID:2784
-
\??\c:\3lffrrf.exec:\3lffrrf.exe188⤵PID:2148
-
\??\c:\btntht.exec:\btntht.exe189⤵PID:572
-
\??\c:\hbbbhn.exec:\hbbbhn.exe190⤵PID:2908
-
\??\c:\pjvvd.exec:\pjvvd.exe191⤵PID:1456
-
\??\c:\ddvdj.exec:\ddvdj.exe192⤵PID:1808
-
\??\c:\djvpd.exec:\djvpd.exe193⤵PID:1724
-
\??\c:\fxrrlrx.exec:\fxrrlrx.exe194⤵PID:1496
-
\??\c:\fxlxxrx.exec:\fxlxxrx.exe195⤵PID:1636
-
\??\c:\bbbnbn.exec:\bbbnbn.exe196⤵PID:1244
-
\??\c:\1nbhbh.exec:\1nbhbh.exe197⤵PID:912
-
\??\c:\7vdjv.exec:\7vdjv.exe198⤵PID:908
-
\??\c:\ffxllrf.exec:\ffxllrf.exe199⤵PID:2196
-
\??\c:\5rrrxfr.exec:\5rrrxfr.exe200⤵PID:2972
-
\??\c:\hbhtth.exec:\hbhtth.exe201⤵PID:2984
-
\??\c:\nhhtbh.exec:\nhhtbh.exe202⤵PID:1028
-
\??\c:\dvdjv.exec:\dvdjv.exe203⤵PID:1452
-
\??\c:\djvvj.exec:\djvvj.exe204⤵PID:1192
-
\??\c:\rrflxfr.exec:\rrflxfr.exe205⤵PID:2620
-
\??\c:\xrfffll.exec:\xrfffll.exe206⤵PID:1544
-
\??\c:\tnhntb.exec:\tnhntb.exe207⤵PID:3040
-
\??\c:\htbbbh.exec:\htbbbh.exe208⤵PID:2924
-
\??\c:\lfrxffl.exec:\lfrxffl.exe209⤵PID:328
-
\??\c:\ffffrff.exec:\ffffrff.exe210⤵PID:2548
-
\??\c:\btnthb.exec:\btnthb.exe211⤵PID:2584
-
\??\c:\5bttbb.exec:\5bttbb.exe212⤵PID:2440
-
\??\c:\vpvdv.exec:\vpvdv.exe213⤵PID:1740
-
\??\c:\dpdvd.exec:\dpdvd.exe214⤵PID:2340
-
\??\c:\lxlrxff.exec:\lxlrxff.exe215⤵PID:2180
-
\??\c:\rxlxllf.exec:\rxlxllf.exe216⤵PID:2296
-
\??\c:\3ntbhh.exec:\3ntbhh.exe217⤵PID:1744
-
\??\c:\hbnntt.exec:\hbnntt.exe218⤵PID:2388
-
\??\c:\ppdvd.exec:\ppdvd.exe219⤵PID:1472
-
\??\c:\jvjdj.exec:\jvjdj.exe220⤵PID:2360
-
\??\c:\pppdd.exec:\pppdd.exe221⤵PID:1640
-
\??\c:\fxlfllr.exec:\fxlfllr.exe222⤵PID:1820
-
\??\c:\xrfrrrr.exec:\xrfrrrr.exe223⤵PID:1676
-
\??\c:\bntbht.exec:\bntbht.exe224⤵PID:2688
-
\??\c:\btbnhn.exec:\btbnhn.exe225⤵PID:1340
-
\??\c:\vjvdj.exec:\vjvdj.exe226⤵PID:1376
-
\??\c:\3jppp.exec:\3jppp.exe227⤵PID:2132
-
\??\c:\jdppd.exec:\jdppd.exe228⤵PID:3044
-
\??\c:\3lxflrl.exec:\3lxflrl.exe229⤵PID:1960
-
\??\c:\rlxrffl.exec:\rlxrffl.exe230⤵PID:580
-
\??\c:\btbntt.exec:\btbntt.exe231⤵PID:676
-
\??\c:\bnbbbh.exec:\bnbbbh.exe232⤵PID:1424
-
\??\c:\ppvdp.exec:\ppvdp.exe233⤵PID:1428
-
\??\c:\jjddd.exec:\jjddd.exe234⤵PID:3048
-
\??\c:\jddvd.exec:\jddvd.exe235⤵PID:1812
-
\??\c:\lfxfrxl.exec:\lfxfrxl.exe236⤵PID:1908
-
\??\c:\fflrrff.exec:\fflrrff.exe237⤵PID:2248
-
\??\c:\nhttnn.exec:\nhttnn.exe238⤵PID:968
-
\??\c:\jdpvp.exec:\jdpvp.exe239⤵PID:2796
-
\??\c:\dvpdv.exec:\dvpdv.exe240⤵PID:920
-
\??\c:\xrxfllx.exec:\xrxfllx.exe241⤵PID:1964
-
\??\c:\xxxlrfr.exec:\xxxlrfr.exe242⤵PID:3012