3.6
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.58
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Malware-gen | 20200315 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Downloader.Small.az | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200315 | 2013.8.14.323 |
| McAfee | BackDoor-FBKE!9B19DF03B8D1 | 20200314 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b7da6e | 20200315 | 1.0.0.1 |
静态指标
动态指标
提取了一个或多个潜在有趣的缓冲区，这些缓冲区通常包含注入的代码、配置数据等。
分配可读-可写-可执行内存（通常用于自解压）
(6 个事件)
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\hhcbrnaff.exe |
投放一个二进制文件并执行它
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\hhcbrnaff.exe |
将可执行文件投放到用户的 AppData 文件夹
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\hhcbrnaff.exe |
一个进程创建了一个隐藏窗口
(1 个事件)
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(2 个事件)
| section | {'name': 'UPX1', 'virtual_address': '0x00007000', 'virtual_size': '0x00003000', 'size_of_data': '0x00002200', 'entropy': 7.467579448103911} | entropy | 7.467579448103911 | description | 发现高熵的节 | |||||||||
| entropy | 0.5862068965517241 | description | 此PE文件的整体熵值较高 | |||||||||||
可执行文件使用UPX压缩
(2 个事件)
| section | UPX0 | description | 节名称指示UPX | ||||||
| section | UPX1 | description | 节名称指示UPX | ||||||
网络通信
一个或多个缓冲区包含嵌入的PE文件
(1 个事件)
| buffer | Buffer with sha1: 06a9ad9f438bc7042361e5bfecc26d3b0e70d13f |
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 56 个反病毒引擎识别为恶意
(50 out of 56 个事件)
| ALYac | Trojan.Downloader.JQDS |
| APEX | Malicious |
| AVG | Win32:Malware-gen |
| Acronis | suspicious |
| Ad-Aware | Trojan.Downloader.JQDS |
| AhnLab-V3 | Trojan/Win32.Agent.C3036099 |
| Antiy-AVL | Trojan/Win32.Agent |
| Arcabit | Trojan.Downloader.JQDS |
| Avast | Win32:Malware-gen |
| Avira | TR/PSW.ZBot.anmdc.1 |
| Baidu | Win32.Trojan-Downloader.Small.az |
| BitDefender | Trojan.Downloader.JQDS |
| BitDefenderTheta | Gen:NN.ZexaF.34100.cmMfamIZs1j |
| Bkav | W32.AIDetectVM.malware |
| Comodo | TrojWare.Win32.Fuerboos.VB@83tsk8 |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.c3d9fd |
| Cylance | Unsafe |
| Cyren | W32/S-107e7686!Eldorado |
| DrWeb | Trojan.Packed.24872 |
| ESET-NOD32 | Win32/TrojanDownloader.Small.AAB |
| Emsisoft | Trojan.Downloader.JQDS (B) |
| Endgame | malicious (moderate confidence) |
| F-Prot | W32/S-107e7686!Eldorado |
| F-Secure | Trojan.TR/PSW.ZBot.anmdc.1 |
| FireEye | Generic.mg.1ea46b4c3d9fdec4 |
| Fortinet | W32/Zbot.AAB!tr |
| GData | Trojan.Downloader.JQDS |
| Ikarus | Trojan-Downloader.Win32.Small |
| Invincea | heuristic |
| Jiangmin | TrojanSpy.Zbot.dxoc |
| K7AntiVirus | Trojan-Downloader ( 0055c6c71 ) |
| K7GW | Trojan-Downloader ( 0055c6c71 ) |
| Kaspersky | Trojan.Win32.Agent.ibas |
| MAX | malware (ai score=89) |
| Malwarebytes | Backdoor.Bot |
| MaxSecure | Trojan.Upatre.Gen |
| McAfee | BackDoor-FBKE!9B19DF03B8D1 |
| McAfee-GW-Edition | BehavesLike.Win32.Rontokbro.nm |
| MicroWorld-eScan | Trojan.Downloader.JQDS |
| Microsoft | Trojan:Win32/Wacatac.C!ml |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM11.1.E51D.Malware.Gen |
| Rising | Downloader.Small!8.B41 (TFE:dGZlOgV7zyh0MiLmRw) |
| SUPERAntiSpyware | Backdoor.Bot/Variant |
| SentinelOne | DFI - Malicious PE |
| Sophos | Mal/Agent-AUP |
| Tencent | Malware.Win32.Gencirc.10b7da6e |
| Trapmine | malicious.moderate.ml.score |
| VBA32 | BScope.P2P-Worm.Palevo |
连接到不再响应请求的 IP 地址（合法服务通常会保持运行）
(2 个事件)
| dead_host | 99.83.138.213:443 |
| dead_host | 13.248.252.114:443 |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2004-10-13 11:27:30
PE Imphash
bb658d7142f323da937efae241d256d0
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| UPX0 | 0x00001000 | 0x00006000 | 0x00000000 | 0.0 |
| UPX1 | 0x00007000 | 0x00003000 | 0x00002200 | 7.467579448103911 |
| .rsrc | 0x0000a000 | 0x00002000 | 0x00001800 | 4.701766952012845 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x0000a17c | 0x00000ea8 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_DIALOG | 0x00006020 | 0x000000e8 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_GROUP_ICON | 0x0000b028 | 0x00000014 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_VERSION | 0x0000b040 | 0x00000318 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_MANIFEST | 0x0000b35c | 0x00000193 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
Imports
Library GDI32.dll:
• 0x40b590 DeleteDC
Library IMM32.dll:
• 0x40b598 ImmGetContext
Library KERNEL32.DLL:
• 0x40b5a0 LoadLibraryA
• 0x40b5a4 ExitProcess
• 0x40b5a8 GetProcAddress
• 0x40b5ac VirtualProtect
Library Msacm32.dll:
• 0x40b5b4 acmStreamOpen
Library OLE32.dll:
• 0x40b5bc CoInitialize
Library user32.dll:
• 0x40b5c4 LoadIconA
Library Winmm.dll:
• 0x40b5cc mciSendStringA
L!This program cannot be run in DOS mode.
1upl)\
%wwV&Fk
{vwTWXOiE
g@N[vf
;QFvZVC?y
fl/%2g"I
2--GAk_;
WDgDDE
sz42(u
ka*cn@X_`a
Aa0iV=
LoadLibraryExA
save recsound a
nslateMes ge
use{r32.dllNLSS TPRU3t
*'$LUWsj1
l#&!O2
P`Sg$L2
EK$L6Y
dd@~dd@Fn@F
o,Yi05
N?7{}#5_;
R?'H7i
N"Y)/^
]7!od-
Gl-K57
iWG!*EaH
!?c}[cw
Yym9}/W# 2V
Kb/_+@
0ADiXjxA <l
0B4MBPdvM4MY6
,8FC E`G
D 4FV4M4bz4M
E":HXUajxE[
EQa+lE
le4FFVF
I/DlE\
1GetModul
meHand
Semapho
W#ProcAdd
Exi'#F eY
rsectClipR/
Cclude
Upd1Co[marUDe
DCText/
32b[%.mp
4ObjP5Out+`/
ol-GidBrushStkPSgCv^ct/FoB
~e"Mvic
sAWAa6
_5mnImm9osdi-
W>dowb
ac!tmOp
o$3Unin
1;ef,k
cRQui3?Fgfr*
z8nuh5yI
D*a|ATime
mci<AnhyPEL#l
XPTPSWXaD$j
#######
###;KK>
26;2+##########
#########
#####+bEXL
+######+
#####3
######3#
PD[>J22Ib|tLx63
#######3#>>
vDDP>2
########3+ug
DW[[FvV####
########3#J~~3#5gJIk#
3333333333+g +zT
##++++######
3333333333#J%Tz+33#3333######
33333333333+
#33############
33333333333@II#333###########
33333333333@+333333#########
33333333@?a
+233333#3#######
33@j+23333333#######
j@33333333#######
+jj23333333333####
+I@3333333333##
2+@2333333333#
al233333333
$$$2333
C&SCCCSCS&&&&
&&&&$$
7:::::::****************ss****@$$$$$
788888881;111n;;;11p;11111111;
))))))
o,,,,,,,L6,6Lr66rq6,,,,,,,E
)f/HHHH/
8(((((,Lx|>>Eq6,(,((,EM&/-999N/
K((((((XmV#R?DlV((((((EMC/N9<<<<<
,444444X|JJVT
DRmXF4444F4VMC-9<UUU
(444444X3?
DPIDP#F04440tM
4000000y2WIWRIuRI
0000050
5y{kkJ0? D~`f9f
0%%%%%%_
3^%%%%%y`f\f#
%%%%%%%%^_a%G_a%%G=%%%%%%^`f\f#
%%%%%%%%%BB%%%BB%GG%BB%GGGGG%G`f
G.......'''''''''''''''''''''.
-----------------d-)/
&&&&$$$&
$$$$$$$
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
GDI32.dll
IMM32.dll
KERNEL32.DLL
Msacm32.dll
OLE32.dll
user32.dll
Winmm.dll
DeleteDC
ImmGetContext
ExitProcess
GetProcAddress
LoadLibraryA
VirtualProtect
acmStreamOpen
CoInitialize
LoadIconA
mciSendStringA
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 8 0 0 0 0 2 5
C o m m e n t s
C o m p a n y N a m e
M S F T C o r p
F i l e D e s c r s i p t i o n
c a l c . e x e
F i l e V e r s i o n
2 . 1 . 1 . 2
I n t e r n a l N a m e
c a l c . e x e
L e g a l C o p y r i g h t
C o p y r i g h t ( C ) 2 0 1 1
L e g a l T r a d e m a r k s
O r i g i n a l F i l e n a m e
c a l c . e x e
P r i v a t e B u i l d
P r o d u c t N a m e
P r o d u c t V e r s i o n
3 . 1 . 1 . 3
S p e c i a l B u i l d
V a r F i l e I n f o
T r a n s l a t i o n
C : \ u n z i p p e d \ V o d a f o n e _ S t a t e m e n t _ 3 0 1 0 1 3 \ V o d a f o n e _ S t a t e m e n t _ 3 0 1 0 1 3 . e x e
C : \ g X v 2 h P q l . e x e
C : \ Y f C D _ 0 K e . e x e
C : \ h A Q y 8 V U v . e x e
C : \ M 2 s 0 D Y Q Y . e x e
C : \ R f n 6 Z i R I . e x e
C : \ i g 8 m c B w 9 . e x e
C : \ K u F g C x r s . e x e
C : \ 8 V 3 O S v j c . e x e
C : \ p M t T 8 X a x . e x e
C : \ Q 2 O c 2 j e t . e x e
C : \ F a 7 6 e T e X . e x e
C : \ x K w l g v c z . e x e
C : \ P 0 o P J Q y P . e x e
C : \ y y u h q I D T . e x e
C : \ S x 2 O T j N s . e x e
C : \ 0 7 o 6 w E u 8 . e x e
C : \ B g o r l g n Y . e x e
C : \ 4 Y d t s s Q 0 . e x e
C : \ W W Y C V l S g . e x e
C : \ C F 0 Q l x P E . e x e
C : \ t u 7 E Y U M m . e x e
C : \ M 7 y F O g h H . e x e
C : \ L T t w K C A l . e x e
C : \ 1 1 0 e 4 1 0 4 7 7 c d 8 7 4 1 1 3 2 a 9 2 7 d c 7 2 d 1 c 2 e 0 0 a e f 8 3 e f 2 a 2 7 8 5 1 0 1 1 e 8 e 1 d 7 d 7 b c c 7 4
C : \ G v x 4 J V y 1 . e x e
C : \ d a c 3 a 2 9 a d 0 a 4 e a 7 f 5 0 d 1 0 f e d 4 4 0 3 f c 9 b 0 8 7 9 3 7 c 2 0 2 f 5 1 9 2 a 9 1 5 6 2 b e 9 e d d 7 7 b 3 9
C : \ 8 2 5 6 3 7 1 3 4 8 d 5 d e 4 b 9 5 7 3 b 3 4 e c 9 0 6 0 b 3 8 5 b 4 f 1 e 4 4 e 6 8 a 7 8 c 0 a 6 8 d 7 2 a a 4 1 b 7 7 9 9 1
C : \ 9 2 a 4 9 f 6 1 8 4 f 8 3 3 5 f c d 4 e 2 e 6 a 3 3 6 5 6 2 0 3 5 0 9 2 f c d 3 d f 2 a 2 3 0 1 6 d c e 9 6 3 2 2 1 c 8 a 8 1 d
C : \ 3 a 9 9 8 5 2 8 b 6 a 3 1 7 d 5 3 e 7 5 e b c f a 7 9 8 3 3 2 9 9 c 7 b 3 f 0 f 3 c b b 2 5 d 3 2 3 7 0 8 0 4 1 5 2 7 c 0 5 a 0
C : \ U s e r s \ L i s a \ D e s k t o p \ v R t 6 S v M p . e x e
C : \ r z k 5 d b R W . e x e
C : \ 9 7 9 5 7 a 7 5 6 8 8 2 3 d b 3 6 9 b f 4 d 9 f e 8 6 e 7 5 4 5 7 a 1 d f 0 2 e 5 e b f 9 c d b 5 a 5 5 2 b 6 a b d 2 7 6 9 1 9
C : \ 6 b f 1 e 7 0 8 a e e f 4 c 7 5 c e 5 b a f b 6 5 d e a f 3 f a 4 2 4 5 a e 9 a 2 a 6 a c c c 7 c 6 3 e 7 9 4 6 0 6 5 5 a 3 3 9
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ X u P H X J S a . e x e
C : \ 1 4 5 9 1 6 d 7 2 5 e 1 a 9 9 7 3 1 f 3 1 b e 7 c 6 d 9 6 6 5 a 4 a c 1 0 b e 7 9 6 c c 1 2 5 1 e f 3 f 2 5 9 0 4 7 a 5 3 e 6 d
C : \ e c c d d f 5 5 0 f 5 7 3 e 0 a 5 2 3 a e e 6 5 6 0 e 5 2 3 c 1 2 1 3 e d 8 6 8 f a 3 4 3 d 9 2 d 4 1 b a b 4 9 f 1 7 2 8 8 6 9
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ J F H k u x x k . e x e
C : \ Q v 5 3 K A D c . e x e
C : \ U s e r s \ J o h n n y C a g e \ A p p D a t a \ L o c a l \ T e m p \ 1 f 4 b 7 2 5 2 f f a f e e e e f 3 0 8 e 2 2 a e 9 8 a a 4 2 a 4 f 6 7 0 1 4 2 4 1 7 9 4 3 8 e f b f 2 2 8 a b d 2 e 4 a a e 3 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 9 3 0 0 4 a d 5 c b 5 4 e 2 b 7 6 b b 5 2 3 3 3 a 5 6 b 1 3 c 0 . v i r u s . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ 5 9 f 8 b f 7 8 d 2 9 c e 2 8 8 1 b d a 1 3 a 5 1 3 f 7 c b f 3 0 6 5 b 2 4 a 5 8 f a 0 a 7 0 a 3 0 0 c b 1 b d 0 4 4 1 6 9 5 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f 6 c 4 3 6 4 9 6 0 5 8 5 1 2 9 _ h h c b r n a f f . e x e
C : \ 8 d 5 d 7 8 e c f 5 9 4 f 9 7 8 9 c 3 7 e e 5 4 d a 2 f 4 8 8 b e 9 e e 0 4 e a f 6 1 d d f 0 3 f d e 8 9 e 9 c 4 4 2 f 1 4 7 3
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ a 6 3 7 5 0 9 2 0 6 3 4 5 f 8 c 1 a b 4 2 7 b a b d e 0 4 d 9 5 a 4 a 9 4 5 3 3 6 2 e b 7 d c e 3 c 5 e 0 e f b 5 3 e e f 7 6 a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 8 5 1 a b e 8 3 6 9 5 7 b 7 6 1 0 e e b c 8 7 6 2 e 1 a c e c c 7 5 3 a 6 0 1 6 7 0 9 1 1 8 c 9 f 6 f 1 7 8 3 c 4 e 8 c a a 8 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 1 7 e 9 4 0 7 0 d 4 9 c c 8 9 a 0 5 a c 0 b 3 1 e 0 d 6 8 7 8 2 b 2 e 4 c e 2 7 f a 6 f d e 6 b 7 5 3 0 8 1 c b 8 9 c 2 3 2 a c
C : \ 5 7 4 1 1 4 9 6 5 6 4 e 2 c a d b e a d a 8 2 d 2 b a f 4 1 8 7 b a 4 a 2 3 c b c e 7 c 5 4 9 1 6 c c 5 d f e 9 b 3 3 b 9 f 6 f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ a 1 9 4 7 5 6 f 8 4 6 6 0 0 d c 6 9 3 b 0 6 c d e 2 e e 5 9 9 3 8 0 a a 9 f 5 5 2 1 8 6 2 3 1 9 3 b 3 c 5 1 3 3 2 a 8 5 d f 7 e
C : \ 8 1 7 7 3 5 1 1 e c e 2 4 d 3 b e f 0 c d 1 f e 1 d b e 8 2 9 d b 4 e 4 e 5 e 5 9 5 b 3 5 1 6 c 5 3 6 c c 6 c c d f d 8 6 9 4 f
C : \ c 2 6 6 3 e 6 d c 6 4 0 a f f 2 a f e 9 1 6 c c 6 6 2 2 8 a 1 8 5 0 8 9 f 7 8 9 7 4 d d 9 c 0 3 5 1 d 2 7 e a 2 9 6 2 c d c f b
C : \ 5 5 b 4 a 9 c 5 9 c 9 6 6 f 7 d 2 9 1 b f 3 8 f 6 3 7 b 6 9 5 6 f 0 2 2 c 0 9 9 9 4 5 2 4 f f 3 f a 0 1 0 3 c 7 6 2 a 0 3 5 3 f
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e c 3 3 5 9 3 8 7 d 0 3 5 c 9 3 _ h h c b r n a f f . e x e
C : \ f 3 5 c 7 4 3 7 4 1 8 6 5 a 3 8 e 7 1 c 6 b 1 4 6 1 e 1 0 e 7 b e 8 f b 4 9 0 e 8 a a e b 9 a 4 d 0 3 b e a b f 0 f 4 b 8 3 1 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ f 4 f 6 f c 8 0 5 6 a 0 5 c 9 8 c 9 4 4 5 f 5 6 b 3 2 6 a d 2 c 3 3 5 c 5 0 d 9 d 1 3 9 0 3 e 2 6 3 8 e 6 5 c d 7 c 0 7 c d f 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ d f 0 e 0 2 9 a 6 7 2 a a a d 5 8 4 9 2 c 4 7 b a 9 5 7 1 7 1 e b 8 2 a 2 d 2 6 e 5 9 e e 8 9 2 b a 7 8 d c a 2 6 1 c 0 e a 3 e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ 0 1 8 7 4 3 b 8 9 7 b 4 1 2 1 4 4 1 b 1 4 b f 9 7 6 1 0 c 1 5 2 8 5 d 0 4 b 8 d c a 6 c b 5 7 9 5 f a b 0 f 3 f 9 a 4 8 b b b 0
C : \ a 3 8 2 0 9 8 4 4 0 5 e 5 0 c 0 2 9 1 8 d 7 a 8 0 f 0 4 b 9 2 9 7 5 3 4 7 c 9 0 7 a e 6 3 2 9 9 b 4 2 7 d 7 a 7 3 8 3 8 2 9 e d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 7 f 5 c 3 9 e 1 a 9 d 6 c c 6 d e c e 4 e b 0 7 d b c c 7 9 5 3 c 8 0 8 4 a 3 7 5 9 a 4 e c b f 2 f 2 e d 9 7 1 9 c 4 f 1 7 a 9
C : \ 7 a d 6 5 2 8 d 7 5 1 c 9 2 0 c 6 1 f 3 c 0 4 b 4 1 6 c c 8 2 d c 2 2 b 6 5 2 8 a f 2 0 6 2 d 6 6 f 5 0 3 4 f 1 1 0 9 6 3 6 b 5
C : \ a d 7 e 6 f 2 0 e d 9 3 2 c 8 f f 6 1 f 3 5 7 9 a 0 9 a d 3 d 4 a 2 a 1 c 8 4 2 0 3 8 b e 8 c e 9 f 2 2 8 9 7 5 3 a 3 5 f 5 4 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ c 0 4 5 3 2 4 d b b b 5 c f 8 c 1 1 d 2 4 6 1 1 2 b 2 5 6 f 5 6 7 8 9 0 0 1 a 2 9 c 1 a 1 e 9 0 6 b f 4 1 1 f 8 6 e 2 b 0 4 7 1
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 1 5 5 9 a 6 f b 7 6 0 7 0 f e 8 _ h h c b r n a f f . e x e
C : \ 9 9 1 a 2 0 3 b 0 2 a 3 1 3 d 4 f b c 5 5 1 c 9 1 5 e 2 e e 6 a 0 2 1 2 7 f c c c 6 c 9 2 3 d 1 1 9 1 0 e 3 5 7 9 c 6 2 5 f 6 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 0 5 6 c 9 b 4 5 8 1 7 6 a c 3 c 4 f 6 4 2 f 5 0 9 0 a 9 d 4 a 6 3 4 e 1 5 e d b e 9 4 2 b 2 b d 0 d a 6 8 c d 9 f 3 e 8 4 1 a b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 5 8 6 5 3 6 a 7 7 f e 7 2 7 7 9 7 4 c 6 6 9 2 5 9 0 f d 9 3 2 d e 7 2 c 0 9 2 5 6 b 6 a 8 0 f f b a 7 3 1 4 3 f 7 5 6 3 8 d 8 6
C : \ 4 a 6 8 7 a c 0 a a f a b 9 6 2 0 3 a c 3 d 3 7 b c f 8 8 2 2 d 2 e f 4 a 3 f a c 0 f 6 b e 0 2 9 1 6 0 a d 4 c 1 4 b 1 f 7 e 0
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e f 8 b 4 c 2 3 6 d 9 7 e 4 7 6 _ h h c b r n a f f . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ a c 2 8 5 3 e b c b f a 7 a 9 8 0 1 6 c 2 e e 1 5 b 8 c f e 3 e 7 4 9 6 e a b 5 0 a c 9 d 2 1 5 9 b 3 4 a 9 7 4 1 b a d b b 4 4
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ 3 e 7 0 0 e 5 4 d 0 8 1 4 a 3 d 5 e b 4 e 0 5 b c 3 e 0 1 c f e f 9 d 1 0 d 4 8 0 e 3 4 6 6 7 e d d 1 5 4 0 5 7 b 4 e c 3 9 5 f
C : \ f 4 0 e e 0 8 1 3 4 4 c 9 2 5 8 a b f 1 e 1 8 9 3 d 6 9 5 1 7 4 8 0 d 4 a 4 1 0 d 4 9 a 7 d a 0 2 0 6 7 4 1 5 2 0 1 f 6 e 1 e f
C : \ U s e r s \ L i s a \ D e s k t o p \ 8 H 1 z a V p R . e x e
C : \ f e d 1 8 6 e 4 8 5 6 3 e a e 3 6 b e a 8 8 8 7 7 8 e 9 4 c c 9 5 4 7 d 2 7 5 8 4 d 0 a 6 d 2 3 0 5 3 e b b 1 7 b e e 0 b f c 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 4 e b 7 7 e c b 5 8 5 2 4 e 7 0 _ h h c b r n a f f . e x e
C : \ d 5 c d d a 1 c 7 e 5 2 8 4 a 6 8 d c 5 b c f 9 a b 0 d 5 a 8 8 e 8 d d 4 d 6 9 8 5 e 0 0 b 2 7 2 d 8 9 8 0 9 9 a 5 a 4 8 c 1 9
C : \ 7 6 5 c e d 3 3 e f 1 1 2 2 9 8 f 6 5 a 5 9 6 8 5 0 f c 0 7 2 0 2 5 c 1 c 7 3 0 e 1 b 3 5 1 3 a 2 8 5 a 0 7 b 9 f c 4 6 8 0 1 e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ b U L X s c 2 Q . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ 3 q Z v i t f 3 . e x e
C : \ c b a c 3 c 9 0 4 3 d a f a b c b 5 6 2 c e e 4 4 9 1 1 5 0 9 d a 9 9 0 0 e 8 5 7 0 5 7 4 6 4 0 9 b b a 9 0 c 0 e 0 6 b a a 0 b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ Z n a 4 f x z 4 . e x e
C : \ 8 d f e 6 6 e 0 4 1 a 2 4 6 8 0 2 7 6 4 c c a b a 6 9 1 9 b c a f 1 5 4 c a c 8 6 7 b 6 3 5 0 a b 6 9 0 e 2 f 9 8 6 9 b c c 3 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ J f r r I S G r . e x e
C : \ 0 5 0 6 a 8 4 6 5 d d d 7 a 1 b d 6 5 a 4 3 1 6 d 4 d f a f a b 6 1 6 d a 9 1 4 7 d 2 5 f d e b 3 8 8 d 6 0 8 0 c e 1 7 a a 7 d
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ O e j y O Y t x . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ 0 d c 3 4 4 2 c 0 e 8 8 4 7 c 4 e 1 b 2 c 6 1 7 8 1 e 8 4 e 8 f 9 2 0 3 8 d 2 5 c 7 1 7 a e 1 e 1 5 1 7 a 4 d 3 d 1 f 3 0 5 4 4
C : \ f d f 9 9 3 d d 1 2 f 0 1 2 3 8 d b 6 6 d 8 b b 1 b e 5 8 5 1 b e 0 e 1 5 c e a 5 0 d 4 a 5 6 a 6 e 4 d 8 f c c 5 2 3 2 0 7 7 8
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ 4 0 8 2 e 8 4 8 a c 0 3 b 1 7 7 1 9 e 5 f 5 1 b 4 f 9 9 1 6 b 7 f d 7 d c b 9 7 3 5 6 f f 1 2 c 4 7 7 4 3 2 c b 1 2 2 1 4 4 9 b
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ e 6 3 3 f 4 1 f 6 8 0 6 8 8 6 a 7 2 7 6 f f 7 1 b 7 c 5 a 0 9 8 d f f a 5 9 6 2 8 4 5 6 9 d a a 1 0 7 8 5 8 5 8 9 b e b e c 6 f
C : \ f e a 9 d d 6 0 f 5 9 9 e 1 9 f 8 9 0 0 2 d c 2 6 8 7 a c e 0 a b 1 5 2 c 9 4 a d 9 1 d c 1 5 0 d 3 d 2 6 6 b 2 a b 2 b 6 c 3 e
C : \ c 6 f c 0 5 5 9 0 b f a 2 a 3 2 2 4 d a 8 e 7 c 2 f 2 9 7 1 f 3 7 5 9 e 3 3 d 0 1 f 1 5 9 7 0 a 6 8 e 6 f 3 d 8 4 b 0 9 5 6 6 c
C : \ 7 a d 9 4 8 2 c c 8 b 5 d 5 9 2 2 2 3 f 4 1 5 b e d 9 d c a 7 1 8 a c e 1 e b 7 1 d f 3 e 5 8 7 d 6 6 9 d b b 7 7 f 6 b b 7 b 3
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b 8 4 c 4 e 6 a 5 4 4 5 8 f 6 c _ h h c b r n a f f . e x e
C : \ c 7 d 2 6 d 9 6 4 6 8 7 c a 5 f 3 4 3 b 0 a 2 3 3 1 a 5 f 0 3 5 2 8 d 2 c 8 7 9 e 6 6 6 7 b 3 c 1 b 5 b 7 0 c 4 0 9 e 3 e b e 4
C : \ 8 5 6 7 1 0 d 4 d f d e 3 1 a c a 9 0 a d a 8 c b f 4 f e c 0 7 f 6 2 5 e b 4 8 6 2 e 1 5 1 1 c 6 9 3 3 d 6 7 c 9 b a 9 9 a 8 5
C : \ 0 7 4 e 6 b 6 9 2 1 2 8 7 c 6 b 3 7 f f d e 4 6 6 6 1 7 f 6 b f 2 4 c d f e f 9 e 1 e 7 c d 5 9 e 4 9 b 8 b 1 1 c 9 6 7 b 0 c 0
C : \ 0 c c d 1 e 9 a 5 0 1 0 e 2 f 5 a 5 a 2 8 e e b 7 5 f 7 8 7 4 4 c 4 8 b 0 b 1 6 0 d 9 7 c d 6 9 9 d 8 0 a a 0 3 f f b 2 7 9 b 8
C : \ 2 d 4 5 0 3 7 c 4 4 5 3 f e 6 6 e 2 5 0 4 0 7 3 d 1 a e 1 b c a 9 f a 7 b f 1 e c 7 4 5 a 8 b c 6 3 0 a 3 c 2 b 9 b 1 9 4 5 8 6
C : \ c 3 9 5 7 0 0 4 b 8 5 0 1 c a 0 7 5 2 4 9 0 c 7 1 c a 6 7 7 1 a 0 7 2 6 8 a d b 3 0 a c 0 7 2 f 8 d 6 a 8 4 5 2 4 0 3 e 3 2 c 0
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 1 T Z H y a 0 D . e x e
C : \ c 9 1 e 5 2 c f a 0 4 c e 1 4 7 b 1 2 8 d 3 b e 4 c a 8 8 9 e 8 b 0 9 7 8 c d 6 b f b f 0 0 2 6 b 3 9 7 1 7 6 3 5 f d d 0 a 0 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ 7 k 7 l 7 Q F B . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 2 4 3 d 4 5 4 b b 4 c c 8 c 0 7 9 8 0 9 e f 3 f 9 7 9 6 b 4 2 e 4 b d 6 7 9 9 e a 7 1 9 5 1 f 3 9 f 1 9 5 6 c 5 f d 3 8 1 1 c a . e x e
C : \ 8 d b 3 f b 7 1 7 6 7 0 9 f b 4 5 3 9 a f 8 4 a 0 c 9 d a b e 7 d e 9 c 3 e d 8 6 4 7 4 5 1 9 2 d 0 9 9 9 0 6 8 7 f d a 0 f 3 8
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ l F h l v D n C . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d a d c 9 5 5 2 a 3 c c 4 2 3 1 e 9 9 c c a 6 7 a 7 0 9 3 f b 3 7 2 0 0 f 3 9 2 0 3 1 1 e 0 e 0 5 1 8 8 b b e 8 f 0 a d 5 8 c 3 . e x e
C : \ d c 0 4 9 1 4 d 1 a d a d 1 4 d 2 f d c 7 9 d b d b f c e 5 1 6 6 f a a d 5 7 a f b 3 1 c b 7 d 6 b 4 f 6 3 2 a 3 4 0 0 2 5 5 f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 9 f 2 7 8 2 c b 9 3 d 4 a 5 e c 9 c 1 a 1 a 3 3 5 d d 3 5 2 9 7 1 f b c 3 c f 8 b d 7 4 7 b d 2 1 8 7 0 d 1 c 9 8 e f d 0 e 7 1
C : \ 6 8 c 0 4 d 3 5 c 3 c 4 3 7 2 3 e 4 e 4 9 8 c 5 5 3 7 1 c b 0 5 c 4 6 5 8 4 4 5 c a 2 5 6 8 4 a e 8 9 b 0 c f b f 0 2 1 1 1 7 7
C : \ 6 2 6 a a d b 7 e 8 d 9 0 4 d d 6 c a 0 2 0 a c 9 a d c a 5 2 9 2 b 4 2 9 0 2 a 2 9 5 c 7 a b 2 3 4 6 f a 2 0 4 d 5 f e d 5 c 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 5 b b 4 b b 2 e c 5 8 d a c e 4 8 0 4 f c 4 2 6 9 b 2 8 6 b c 9 5 0 3 d f f 5 5 9 3 b 4 d 7 7 f c e f 9 f 6 0 3 d 7 c 4 0 b b 8
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 0 E R I y r i 1 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ v F 5 G G h 7 H . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ 0 7 5 0 e c 0 7 6 c d 0 c 1 d f b a f e f 7 5 1 a 7 f 5 3 f 3 2 e 2 6 9 e c 0 3 9 6 8 b 5 e e 0 1 0 1 4 3 a 5 3 2 5 d 2 8 3 7 2
C : \ 6 e b 0 6 5 0 2 c 8 0 b c 5 5 5 8 5 7 a 5 9 4 1 e b 0 d b 5 d 9 5 7 9 1 a c c 6 5 5 0 5 a 8 c 3 5 2 3 0 a e c 4 e a 3 f b 4 0 5
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ c 2 o p P b N Z . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e 2 7 d c 1 a 4 9 5 c 4 4 e 2 3 2 8 5 7 9 5 8 f 3 d c 8 6 a 6 6 4 6 5 2 e f 1 7 3 e a e c 1 e f 5 6 0 8 9 a c d 8 a 9 2 2 7 c f . e x e
C : \ 2 4 2 5 4 9 f 6 5 b 1 b 6 8 d 3 1 7 c 8 8 5 6 f 5 9 9 d 2 1 f f 2 1 7 0 c d 4 1 0 7 5 e 3 2 b 8 4 e 6 9 3 5 c 7 a 9 4 5 c 3 5 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ 3 9 5 d f 7 e 8 7 8 3 2 c a 3 6 f b b 5 4 f 4 a 6 2 8 d 8 1 e e 9 1 6 7 9 3 9 5 f 6 3 4 4 9 c b 4 5 b b 4 4 9 2 f d 5 f 4 6 5 8
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ D G Z x X z J t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 2 0 2 f b 6 2 6 9 6 b c 6 a 5 9 3 b 4 e 5 0 d c 7 6 7 4 0 7 b 7 4 7 9 c 0 8 d 2 6 2 8 d c 6 3 e f 1 d 4 3 4 8 2 3 f c 5 d 0 0 9 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ Y s v k g F s A . e x e
C : \ b e 9 8 e e c 0 9 8 8 d c 0 3 b 3 e 0 3 1 e 2 8 2 f 7 9 9 0 6 9 f c c c 5 9 1 3 8 6 f 1 c b a b 4 b 4 b a 9 4 4 e f e d c 6 0 d
C : \ 8 3 e 1 7 c 3 b f 0 1 5 a 9 2 d 7 3 1 2 e c c c 3 f 8 1 9 5 0 5 0 4 f a f e 4 7 d e 6 8 2 b 7 7 5 e 6 6 b 3 8 e 1 5 1 0 a 9 1 1
C : \ 6 2 b 6 3 5 2 6 4 c 0 a 1 4 8 6 0 1 e 6 4 1 a 7 1 3 0 f e b 1 d 6 f d 5 c c 3 b 2 7 d b 9 5 3 6 2 1 4 8 2 a c 5 c 2 3 a 5 7 f 0
C : \ 6 c b e a 6 f 0 3 f d a 8 c 1 d 0 2 3 c e 0 a 2 9 5 5 2 b 1 1 7 4 6 e 6 4 7 b c d b f e b 2 e b c 5 a 9 7 5 1 2 3 1 e 9 7 1 1 0
C : \ 1 4 3 0 e 5 9 4 5 0 f f c 1 5 2 6 7 d a 5 b 0 2 e 6 4 e 1 f 4 1 7 a 7 f f d c c 9 6 f 7 a 9 1 2 5 5 2 1 6 d 3 5 7 5 b 5 0 2 4 0
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 0 f 4 7 8 b 4 9 e c 3 c d 0 0 0 4 6 7 7 2 f e c 5 7 0 1 7 5 1 e a a 7 7 6 6 2 2 0 7 e 6 b 7 a 2 2 9 3 8 a 1 5 6 4 d 4 4 7 4 a 2
C : \ 2 c b 5 4 6 0 5 b a 3 7 4 0 f d 7 7 2 b 1 f 1 5 e e 6 d c 3 2 1 6 f f f e b 1 8 4 6 3 2 4 8 9 e d b 7 9 2 7 5 8 a e d f 8 0 a e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b 5 1 5 8 a c 4 5 c 3 3 4 a 2 b _ h h c b r n a f f . e x e
C : \ 2 5 d 8 a 2 a f c 2 6 6 a f c 0 e 1 1 c c 8 e 8 4 e 1 e 5 4 3 e 0 6 6 4 e b c 0 2 2 9 2 c 4 5 3 d e 6 2 f 3 f a 3 c 8 3 f b 0 e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 9 N M o C V M z . e x e
C : \ 0 6 0 d d 0 0 6 8 4 9 c 5 8 f e 8 e 2 f 8 9 2 9 e 8 a 9 6 6 3 8 6 4 d 7 6 a 2 8 1 b f 7 a 2 d 0 1 3 e 6 6 e 9 e b 7 3 2 c 1 2 3
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 6 1 a 9 8 1 8 a b e 9 9 0 2 6 b e 7 f e 1 0 d 4 e c 3 6 6 7 8 0 e f e 2 5 d 2 c 6 4 f 2 3 d f 0 c 4 f 2 1 e 3 6 7 f 9 3 c 9 c e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ c 7 9 9 0 1 d b a 4 d 0 7 a e 0 d 2 5 e 6 3 4 6 6 0 3 e 5 3 a 0 4 5 b 2 c b 1 4 a 6 2 c b c 2 9 2 6 f a 2 9 3 9 2 5 d 0 3 f 2 5
C : \ 7 f 1 a 4 d 6 8 e 9 7 1 b 2 c 9 a a 8 8 e a 6 0 9 f 8 f 9 3 4 4 9 a 9 9 1 8 9 3 6 5 6 c 4 3 d 4 0 8 3 a f 5 c d 6 9 2 3 6 0 9 a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ n N k B A Q F X . e x e
C : \ f 0 4 c 8 8 9 d 5 1 6 9 a 0 d 9 f a 1 6 e c 2 3 3 3 7 8 2 f c 6 a 2 8 6 2 2 e f 0 1 e 2 1 c 4 4 f 4 7 6 0 a a 3 d e 3 3 c 7 0 e
C : \ U s e r s \ R A 4 9 1 ~ 1 . V U L \ A p p D a t a \ L o c a l \ T e m p \ 4 2 e 5 b 9 3 a b 2 9 1 5 f 5 9 c b 4 8 6 7 2 a 2 8 d 2 6 9 8 2 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 0 d 8 5 7 d a 2 5 e 9 4 c f 5 d d b 4 3 2 e e 3 8 3 5 b 7 c 1 0 a f 9 2 f 1 9 6 b 5 b 7 f 6 c 9 a 8 0 2 0 d 2 b a 6 6 2 0 3 1 c
C : \ 3 b a c 6 1 9 3 c 9 b a 0 7 4 c e 5 f 7 0 e 1 c 2 2 4 6 4 4 d 4 d 6 7 4 c 1 1 5 d d 3 e 2 0 9 2 4 d 2 0 5 6 3 e d 7 2 e b f 0 4
C : \ d 3 7 f 9 9 4 b c a 1 4 a 7 2 9 6 c e 3 2 2 3 4 8 f 9 8 d 7 a 3 9 3 c 6 a 3 e 8 d 1 7 1 9 a 0 f 1 0 8 5 c 9 e a e 9 8 2 d c 0 b
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ Y r L v H p D V . e x e
C : \ 4 f 0 7 6 f 5 a 3 8 c f 2 2 6 1 a 5 8 e 6 6 f 3 2 d 5 e 6 2 d c d 8 d 0 9 b 3 9 2 0 7 9 9 f a 2 1 b 5 6 9 8 e 0 3 1 1 3 7 0 8 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ U s e r s \ R A 4 9 1 ~ 1 . V U L \ A p p D a t a \ L o c a l \ T e m p \ 4 2 e 5 b 9 3 a b 2 9 1 5 f 5 9 c b 4 8 6 7 2 a 2 8 d 2 6 9 8 2 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ L a r L 5 L V 4 . e x e
C : \ 3 2 e 0 f 3 1 a 6 7 9 0 8 a e c 3 6 1 0 4 4 b a c d 3 4 e f 4 b 7 d 9 8 6 5 6 2 8 7 7 3 5 e b 1 3 6 1 a 1 8 e 1 1 e c 9 4 b 0 d
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ k C x H 4 u Z 0 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 0 0 1 a a b e 0 c 6 e 2 4 9 4 c 5 3 9 2 7 4 0 a c 0 b 3 7 e 9 5 9 2 2 3 e 5 5 3 6 e e 6 5 8 5 8 2 0 f 5 c 2 e e e 7 9 0 d 0 d 0 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ V f 3 H 4 o d 4 . e x e
C : \ b 2 c 8 8 2 a d 5 0 f 9 a 7 a a e 8 9 7 e 4 3 5 8 7 a 0 a 4 f 0 4 d 4 5 5 2 7 2 c 1 4 4 1 6 d 4 c 6 1 f a 2 6 3 5 d 2 e a c c 4
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ B 4 n Z V P 1 e . e x e
C : \ 9 d 5 6 5 6 9 b f 9 3 e 1 7 0 9 2 e 6 7 4 8 b e 1 0 3 f 9 2 1 e d 1 2 7 2 3 4 9 c e a 0 c e 2 4 b 2 8 1 c c f a 9 f 3 d 0 2 e f
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ T D 5 h F 1 Z m . e x e
C : \ 1 3 7 c f 7 3 f 5 5 8 b 8 f 6 0 1 8 8 2 a 9 4 6 1 8 d 3 b b 4 0 b 2 4 2 1 2 6 7 0 a d 7 a 8 3 b d f 7 e 0 e 5 d e 8 b 8 1 9 8 1
C : \ d c 1 2 9 d 0 2 0 4 5 3 d a c 7 4 b f c 5 8 4 1 f c 2 6 b d 7 b 9 6 1 3 9 2 9 b 8 2 9 8 5 a 2 e 2 e a 7 d c e 6 f a 1 7 f 3 8 b
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 0 s 6 w u k v M . e x e
C : \ 0 1 4 f d 7 e 1 8 c 7 7 8 5 8 f 1 3 e 5 1 f a 4 5 9 5 f 2 c e a f b 0 6 a e 6 5 4 a 7 8 b 9 6 a 9 9 c 3 6 e f 4 f 4 b 0 f 4 5 6
C : \ 2 9 c 3 f 8 7 d 3 e b 8 6 a b d 8 4 4 f 2 f 4 a 2 6 8 4 2 f 4 6 c 5 2 2 a 7 4 2 c f a b d a 3 7 b f 9 d b c 1 c 0 9 5 1 c 7 d 0
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ n h 5 g K v R Z . e x e
C : \ 5 8 2 6 7 7 5 e 5 b 7 0 f 9 6 e b a c 6 5 1 2 d d d 6 2 a 0 b 3 6 d 5 f 3 f 0 2 4 3 9 1 f 1 8 2 e 3 6 d 5 c 5 b 1 b c c 9 0 9 b
C : \ 2 4 2 8 8 f b b 6 8 1 3 b 8 3 0 e 8 5 e 4 8 0 6 2 3 a 8 5 8 3 6 e 7 0 b 9 5 d b 0 0 2 6 a 5 6 2 b 4 d 3 a a b 9 5 a 6 6 1 0 1 5
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ c w d s n i 9 Z . e x e
C : \ f a a 8 9 0 2 a c a e 1 7 7 5 8 c 5 0 5 3 4 d e b 3 f 6 d 9 4 8 e 7 9 f 2 e c 0 c 1 6 d 2 d 6 3 9 0 6 f f 4 6 9 5 6 f c 8 c c 4
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ H M I Z 7 s R d . e x e
C : \ 9 4 d 7 2 0 d 8 7 5 9 b 8 3 6 1 5 b f a 7 5 2 1 2 7 b 2 c b 7 7 e 6 d c 8 6 c d d 2 8 9 4 8 4 9 2 1 e 8 9 b a 2 0 8 5 a e 5 e 1
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ V S U Q S l P R . e x e
C : \ d 9 e 4 7 4 5 8 c d 6 3 3 6 3 7 3 8 1 f f d b 8 0 2 b 2 4 4 7 c 8 7 8 4 0 b e 9 2 6 e 4 1 a 7 4 8 6 e 4 1 6 1 d 3 7 d 3 d e a b
C : \ 8 7 3 c 4 b b b 3 4 b a 7 2 7 6 b c 7 9 3 d e 7 a d c 9 5 8 6 6 4 3 7 6 5 e 6 b d 8 e 9 8 3 f 3 8 1 5 d 7 2 d e 2 8 6 9 c 6 a 4
C : \ a 3 7 1 f 2 6 2 e b 0 c 8 b 7 6 9 c a c 0 9 c 6 3 1 c a 9 1 e 8 6 6 8 b 6 5 5 5 a b b b c 0 7 b d 1 7 0 3 0 6 b 7 3 f e 2 3 c 8
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ V M f e m I x a . e x e
C : \ 1 f 5 6 b 2 e 1 1 6 d f b 8 7 1 8 1 0 f a 3 7 3 a f e f 5 a e c 0 5 c f 4 a 3 a 1 4 f a f 4 8 4 d 5 7 9 2 2 2 c e a d f c d 3 b
C : \ U s e r s \ R A 4 9 1 ~ 1 . V U L \ A p p D a t a \ L o c a l \ T e m p \ 4 2 e 5 b 9 3 a b 2 9 1 5 f 5 9 c b 4 8 6 7 2 a 2 8 d 2 6 9 8 2 . e x e
C : \ f b 5 c d f 2 b f b 3 e 2 8 2 e f 5 8 c 4 3 d 1 4 3 0 c 5 1 c b 4 4 c 8 d 3 7 3 4 3 f 7 a 4 c f b c 2 2 0 b b c 8 4 4 7 4 e b a
Process Tree
-
09b4fb8e080801f821a9e76c686d5f68a71ea4e79e47285b4bfcd2675657a8e5.exe (1848)
"C:\Users\Administrator\AppData\Local\Temp\09b4fb8e080801f821a9e76c686d5f68a71ea4e79e47285b4bfcd2675657a8e5.exe"
- hhcbrnaff.exe (2064) "C:\Users\ADMINI~1\AppData\Local\Temp\hhcbrnaff.exe"
Hosts
| IP |
|---|
| 114.114.114.114 |
| 99.83.138.213 |
| 13.248.252.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | |
| frontierforex.com |
A 99.83.138.213
A 13.248.252.114 |
13.248.252.114 |
TCP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 49164 | 99.83.138.213 frontierforex.com | 443 |
| 192.168.56.101 | 49165 | 99.83.138.213 frontierforex.com | 443 |
| 192.168.56.101 | 49166 | 99.83.138.213 frontierforex.com | 443 |
| 192.168.56.101 | 49168 | 99.83.138.213 frontierforex.com | 443 |
| 192.168.56.101 | 49169 | 99.83.138.213 frontierforex.com | 443 |
| 192.168.56.101 | 49170 | 99.83.138.213 frontierforex.com | 443 |
| 192.168.56.101 | 49172 | 99.83.138.213 frontierforex.com | 443 |
| 192.168.56.101 | 49173 | 99.83.138.213 frontierforex.com | 443 |
| 192.168.56.101 | 49174 | 99.83.138.213 frontierforex.com | 443 |
| 192.168.56.101 | 49176 | 99.83.138.213 frontierforex.com | 443 |
| 192.168.56.101 | 49177 | 99.83.138.213 frontierforex.com | 443 |
| 192.168.56.101 | 49178 | 99.83.138.213 frontierforex.com | 443 |
| 192.168.56.101 | 49180 | 99.83.138.213 frontierforex.com | 443 |
| 192.168.56.101 | 49181 | 99.83.138.213 frontierforex.com | 443 |
| 192.168.56.101 | 49182 | 99.83.138.213 frontierforex.com | 443 |
| 192.168.56.101 | 49184 | 99.83.138.213 frontierforex.com | 443 |
| 192.168.56.101 | 49185 | 99.83.138.213 frontierforex.com | 443 |
| 192.168.56.101 | 49186 | 99.83.138.213 frontierforex.com | 443 |
| 192.168.56.101 | 49188 | 99.83.138.213 frontierforex.com | 443 |
| 192.168.56.101 | 49189 | 99.83.138.213 frontierforex.com | 443 |
| 192.168.56.101 | 49190 | 99.83.138.213 frontierforex.com | 443 |
| 192.168.56.101 | 49192 | 99.83.138.213 frontierforex.com | 443 |
| 192.168.56.101 | 49193 | 99.83.138.213 frontierforex.com | 443 |
| 192.168.56.101 | 49194 | 99.83.138.213 frontierforex.com | 443 |
| 192.168.56.101 | 49196 | 99.83.138.213 frontierforex.com | 443 |
| 192.168.56.101 | 49197 | 99.83.138.213 frontierforex.com | 443 |
| 192.168.56.101 | 49198 | 99.83.138.213 frontierforex.com | 443 |
| 192.168.56.101 | 49200 | 99.83.138.213 frontierforex.com | 443 |
| 192.168.56.101 | 49201 | 99.83.138.213 frontierforex.com | 443 |
| 192.168.56.101 | 49202 | 99.83.138.213 frontierforex.com | 443 |
| 192.168.56.101 | 49205 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49206 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49207 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49209 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49210 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49211 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49213 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49214 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49215 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49217 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49218 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49219 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49221 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49222 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49223 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49225 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49226 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49227 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49229 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49230 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49231 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49233 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49234 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49235 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49237 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49238 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49239 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49241 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49242 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49243 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49245 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49246 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49247 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49249 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49250 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49251 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49253 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49254 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49255 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49257 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49258 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49259 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49261 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49262 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49263 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49265 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49266 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49267 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49269 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49270 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49271 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49273 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49274 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49275 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49277 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49278 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49279 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49281 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49282 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49283 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49285 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49286 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49287 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49289 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49290 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49291 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49293 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49294 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49295 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49297 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49298 | 13.248.252.114 frontierforex.com | 443 |
| 192.168.56.101 | 49299 | 13.248.252.114 frontierforex.com | 443 |
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | 2db3a058ed483cee_hhcbrnaff.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\hhcbrnaff.exe |
| Size | 39.8KB |
| Processes | 1848 (09b4fb8e080801f821a9e76c686d5f68a71ea4e79e47285b4bfcd2675657a8e5.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | 8416a3fdc9b83434a12344d675dc7d4f |
| SHA1 | 2fcaf78bfe447a30eeb4ed013903ba872a5dbefb |
| SHA256 | 2db3a058ed483ceea6b8e0c3afce66a88e79bfadf4cc66a8b6fac639297c66ca |
| CRC32 | 53649D69 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 06a9ad9f438bc7042361e5bfecc26d3b0e70d13f |
|---|---|
| Size | 4.5KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | 373ff9f9ae3aa84057dc941235b736b3 |
| SHA1 | 06a9ad9f438bc7042361e5bfecc26d3b0e70d13f |
| SHA256 | 88a084e2b02bd1c1e862284a1ebebdc1e6bcce2dacd72ec48d301b4ab8dc5b2d |
| CRC32 | 103485D7 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |