2.5
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.67
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:MalOb-MD [Trj] | 20191009 | 18.4.3895.0 |
| Baidu | None | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20191009 | 2013.8.14.323 |
| McAfee | GenericRXGJ-CB!2A37F88596E8 | 20191009 | 6.0.6.653 |
| Tencent | None | 20191009 | 1.0.0.1 |
静态指标
查询计算机名称
(2 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545310.468 GetComputerNameW |
computer_name:
TU-PC
|
success | 1 | 0 |
|
1727545310.859875 GetComputerNameW |
computer_name:
TU-PC
|
success | 1 | 0 |
检查进程是否被调试器调试
(2 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545310.39 IsDebuggerPresent |
failed | 0 | 0 | |
|
1727545310.812875 IsDebuggerPresent |
failed | 0 | 0 |
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(1 个事件)
| section | coderpub |
动态指标
分配可读-可写-可执行内存（通常用于自解压）
(2 个事件)
在 PE 资源中识别到外语
(4 个事件)
| name | RT_ICON | language | LANG_ARABIC | filetype | None | sublanguage | SUBLANG_ARABIC_SAUDI_ARABIA | offset | 0x000032cc | size | 0x000025a8 | ||||||||||||||||||
| name | RT_GROUP_ICON | language | LANG_ARABIC | filetype | None | sublanguage | SUBLANG_ARABIC_SAUDI_ARABIA | offset | 0x00005884 | size | 0x00000014 | ||||||||||||||||||
| name | RT_VERSION | language | LANG_ARABIC | filetype | None | sublanguage | SUBLANG_ARABIC_SAUDI_ARABIA | offset | 0x000058a8 | size | 0x00000230 | ||||||||||||||||||
| name | RT_MANIFEST | language | LANG_ARABIC | filetype | None | sublanguage | SUBLANG_ARABIC_SAUDI_ARABIA | offset | 0x00005ae8 | size | 0x000001e8 | ||||||||||||||||||
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\zbhnd.exe |
投放一个二进制文件并执行它
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\zbhnd.exe |
一个进程创建了一个隐藏窗口
(1 个事件)
网络通信
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
在用户文件夹中创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\zbhnd.exe |
文件已被 VirusTotal 上 48 个反病毒引擎识别为恶意
(48 个事件)
| ALYac | Trojan.Ppatre.Gen.1 |
| APEX | Malicious |
| AVG | Win32:MalOb-MD [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.Ppatre.Gen.1 |
| AhnLab-V3 | Malware/Win32.Generic.C1860828 |
| Antiy-AVL | Trojan/Win32.Unknown |
| Arcabit | Trojan.Ppatre.Gen.1 |
| Avast | Win32:MalOb-MD [Trj] |
| Avira | TR/Crypt.XPACK.Gen |
| BitDefender | Trojan.Ppatre.Gen.1 |
| ClamAV | Win.Malware.Upatre-6804153-0 |
| Comodo | TrojWare.Win32.Flooder.Agent.NAS@74ax2y |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.286bcf |
| Cylance | Unsafe |
| Cyren | W32/S-86d393ab!Eldorado |
| DrWeb | Trojan.Dyre.5 |
| ESET-NOD32 | Win32/TrojanDownloader.Waski.A |
| Emsisoft | Trojan.Ppatre.Gen.1 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/S-86d393ab!Eldorado |
| F-Secure | Trojan.TR/Crypt.XPACK.Gen |
| FireEye | Generic.mg.2256b69286bcff57 |
| Fortinet | W32/Pliskal.B!tr |
| GData | Trojan.Ppatre.Gen.1 |
| Ikarus | Trojan.Win32.VB |
| Invincea | heuristic |
| Jiangmin | Trojan.Generic.btmde |
| K7AntiVirus | Trojan-Downloader ( 0048f6391 ) |
| K7GW | Trojan-Downloader ( 0048f6391 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| MAX | malware (ai score=86) |
| McAfee | GenericRXGJ-CB!2A37F88596E8 |
| McAfee-GW-Edition | BehavesLike.Win32.Virut.pm |
| MicroWorld-eScan | Trojan.Ppatre.Gen.1 |
| Microsoft | TrojanDownloader:Win32/Upatre.AA |
| Qihoo-360 | HEUR/QVM19.1.6F35.Malware.Gen |
| Rising | Trojan.Agent!1.A4D8 (CLASSIC) |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/Agent-AVZX |
| Symantec | ML.Attribute.HighConfidence |
| VBA32 | BScope.Trojan.Meterpreter |
| VIPRE | Trojan.Win32.Generic.i (v) |
| Webroot | W32.Malware.Gen |
| Yandex | Trojan.Agent!1rjIPL5WQZc |
| ZoneAlarm | HEUR:Trojan.Win32.Generic |
| Zoner | Trojan.Win32.26811 |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2014-08-29 06:51:35
PE Imphash
87bed5a7cba00c7e1f4015f1bdae2183
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .rsrc | 0x00001000 | 0x00007000 | 0x00004e00 | 5.986031647068954 |
| coderpub | 0x00008000 | 0x00000c00 | 0x00000a32 | 5.803637642098208 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x000032cc | 0x000025a8 | LANG_ARABIC | SUBLANG_ARABIC_SAUDI_ARABIA | None |
| RT_GROUP_ICON | 0x00005884 | 0x00000014 | LANG_ARABIC | SUBLANG_ARABIC_SAUDI_ARABIA | None |
| RT_VERSION | 0x000058a8 | 0x00000230 | LANG_ARABIC | SUBLANG_ARABIC_SAUDI_ARABIA | None |
| RT_MANIFEST | 0x00005ae8 | 0x000001e8 | LANG_ARABIC | SUBLANG_ARABIC_SAUDI_ARABIA | None |
Imports
coderpub
.rdata
]E4")o;i
C*uv?}
c.gS^H
avX'Qm2j
va&tp1}
zzamsh2
c/{A&j
Okzc084f?FGR#
VX4pQF-1
/Ff-]KQk
5<(\"r
r0#4"e#
P ?BH^vqJ
Y&SNiI
`/j/m#
E`j|7Luj/k
>70_}q7
B9TwR?
/@i=EO
5iE\i!D
^*:5fY
%Z">?.
CeCSZ/
)K%(&]%A
cRr>[w%
e%a*tU
?D*_N'
'QDGFR
^(YG'^i
Z8$lENoW1#
#(&Yk1
6;VX'W]\!Y6
2n;orbo
BAyqUQy>^
"2kP\gK"gk
x!P}Q6
&?j/sZH
0jhj0E0h
EQEEE@
@uHjh@hhQE@
0EE@h00E@
@@EhEQ@
CA:uj0j0E^Q0E
YG+G%ENjj
Eh0F BY0
hSVWe3
h$gyda;
0u>"u:F@
XPVSSE
@PXG E@tH
gB#@(M
hIg@h$eZ0(
N%L@L4a<WEh
.1baK?=c7
U.jNUG}
!?T@ !?UD-
%Er)AjE
AQRxV@
c!"B|!!!1!
!*&C!2x!'c"2y! !%(
FG3@_^f%
E)hMPX
F DX%hX
.E@5H@CA
e@@XlG
`X! 5Q
QI$A>$B
0[RhhA{
Z6C10Hfi
Ah0wFy$`&MFa
r%}d# je
# 9$!cPl+
`0AQp<
! Q"'TD@gS9E@
%@n,Ih
]A@"'U
D=`aHq>C
l!'J<fhD4!"YgMeEZ5ED
@qWGU!!Q
@HZQENCqh
%%L!",
_^[AOQN)QLA@
A-Ah0B@G
fZuSDC)A
yC5seEQ
EcmjIE
!2X!("(mF
QzAU$@
X@Ih>E@P
Ejk$")
0]H]^^3
]]<]]]]]t]d]Z]R\`
]]]t]h]Z]F]8]*]
Arial@
Riched32.dl`8<
LA|@M*
XcptFilter
_getmainargs
_init@m
nus@2at
commode
Otyp@Eb^ce
_handlerB
MSVCRTv
ntrolfp
DispatchMessageA
TranslateP!6
LoadStringA
RegisCEC
CursorA
UpdAiW
cAm@EsC
PostQui
USERwG
l@cpy@^<
@VitNize
bCinCGQ
OMCTL(
ougHf}t
jordly
on RossO
] ]8](],]
] ^0QB]%(
=(|dLAT^%0
{nD2/
zn!LF,
X xpBl
eV\Q
F< %*l O
LCTJ@
L@ fWl`\c ;
L` 5 '
L\c` wi;
`Lb`OiY'
a/=$ P
Abz|n[
&\eO P
~ $N00$%&<!x
6embly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
RId!Oity'
1.2.5")
name="Kindess(
requCGedP
vileges,
l`V="
Invoker"/
uiAccC
="false"/-
a@yB5a@5eoB
uA-k/@
@]r@Ug@dk
E B.].)
c=tnBl)
@L@]gcupC\bg
b@= AL`o
DV@mr1
+"T@tes@}a+
kernel32.dll
LoadLibraryA
GetProcAddress
3 3 3 3 3 3 3 3 3 fW3 3 2
3 3 3 3 3 3 3 3 0
6 6 6 6 6 6 6 G06 6 5 6 6 wi6 6 6 6 6 6 6 2
3 7!7!7!7!7!7!7!7!WG7!7!iY7!7!7!7!7!7!7!7!7!7!7!7!3
6 8"8"8"8"8"8"8"VH8"VH8"8"6 6 7"8"8"8"8"8"8"8"6
8";";";";";";";";"n`;";"zn;";";";";";";"8"
;"=$=$=$=$=$=$=$=$=$=$=$=$=$=$=$=$=$=$=$=$=$=$=$=$=$=$=$=$=$;"
=%B(=$=$B(B(B(B(B(B(B(B(B(B(B(B(B(B(B(B(B(=$=$=$=$=$=$B(B(B(=%
=%eOeOeOeOeOeOeOeOeOeOeOeOeOeOeOeOeOeOeOeOeOeOeOeOeOeOeOeOeOD,
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity
version="1.1.2.5"
name="Kindess"
/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel
level="asInvoker"
uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
H@A4H@E8
d.dllh
dlloch
\Pu8@jMHEP
EEE@<MD
EE+PPj
Ek(PuUf
u@E@<MD
u8@ 3@t$
E3@t-8
Ek(PuU
^#[]UM
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
8 B 4 C 3 2 B 1
C o m p a n y N a m e
F i l e D e s c r i p t i o n
B u i k p r o g e d
F i l e V e r s i o n
V e r s i o n 2 . 1 . 1
I n t e r n a l N a m e
L e g a l C o p y r i g h t
C o p y r i g h t b y N e g o
O r i g i n a l F i l e n a m e
V a r F i l e I n f o
T r a n s l a t i o n
C : \ 5 3 a a 3 a 5 a 8 3 1 d 6 6 b a e 5 b 3 9 f d e f 8 7 e 9 2 4 3 e d c d 6 d 5 f b 5 0 d 8 4 a 7 0 b 6 f 4 0 3 e f 9 c 5 a d e 1
C : \ A 8 L Q M 6 Z g . e x e
C : \ V O t V P w 3 8 . e x e
C : \ X I P i Q M Z n . e x e
C : \ 4 f g 5 M z m p . e x e
C : \ k q t 7 j S K K . e x e
C : \ d L L 4 Q e 3 j . e x e
C : \ i B J O 5 3 q 3 . e x e
C : \ r h j q c K Z h . e x e
C : \ q n T 6 n S o t . e x e
C : \ q a R S 0 N y j . e x e
C : \ v V T o W a C n . e x e
C : \ h Z N E I G 3 Z . e x e
C : \ S x o V J a T 7 . e x e
C : \ T C I 4 8 3 h 0 . e x e
C : \ x X 8 p s _ b G . e x e
C : \ U s e r s \ l u s e r \ D e s k t o p \ f s r v h o g r . e x e
C : \ J 0 o D s M e A . e x e
C : \ z 3 m 7 e P a a . e x e
C : \ n n 9 g 8 r 1 3 . e x e
C : \ D W 8 Q t U S 5 . e x e
C : \ K H s L Z g v C . e x e
C : \ U s e r s \ l u s e r \ D e s k t o p \ v i h O C u O w . e x e
C : \ O _ Q D M t X K . e x e
C : \ 3 6 t e 1 T y k . e x e
C : \ y 8 H B A J 0 p . e x e
C : \ e A k e w o B 1 . e x e
C : \ U u y R T k V i . e x e
C : \ Y y k X b q O v . e x e
C : \ 0 8 3 b e d 9 0 9 2 e 0 5 8 3 c e b 0 2 a c 6 f a d 4 b c 5 3 a 0 7 9 5 f 0 c 8 1 1 f 7 1 a 6 7 3 e 4 3 0 3 0 3 4 1 3 b 1 c c 3
C : \ U s e r s \ l u s e r \ D e s k t o p \ X L A p d S Y e . e x e
C : \ a i 3 2 0 s E 5 . e x e
C : \ P m F 0 B v z K . e x e
C : \ f f 7 8 e a c b 0 7 5 4 4 f 6 3 3 6 1 b c 1 1 3 6 c 1 0 8 f a d 3 d b 4 e 5 6 7 6 b 8 5 6 d 4 d 6 d c f 9 1 a d 1 0 8 f 2 4 8 4
C : \ U s e r s \ l u s e r \ D e s k t o p \ S m Y v F w h c . e x e
C : \ G L K 4 n Q S y . e x e
C : \ U s e r s \ l u s e r \ D e s k t o p \ R b e y t T 3 A . e x e
C : \ B z h E i 4 l j . e x e
C : \ U s e r s \ l u s e r \ D e s k t o p \ A c y I 1 Z g k . e x e
C : \ a 6 K y d W Q v . e x e
C : \ U s e r s \ l u s e r \ D e s k t o p \ 5 6 A o q r L V . e x e
C : \ 0 S u 2 0 F s 1 . e x e
C : \ U s e r s \ l u s e r \ D e s k t o p \ J 6 C t n m c z . e x e
C : \ l T i A 5 g m G . e x e
C : \ U s e r s \ l u s e r \ D e s k t o p \ o 6 T 2 y g n f . e x e
C : \ h K t b v R t 7 . e x e
C : \ U s e r s \ l u s e r \ D e s k t o p \ Q D y 4 a E 3 j . e x e
C : \ T h f 3 Z b z N . e x e
C : \ U s e r s \ l u s e r \ D e s k t o p \ l w g I z a H s . e x e
C : \ R a i d e n \ G o a t \ F T P \ S a m p l e \ 0 6 C 4 D C 6 A 6 3 D C 8 1 2 0 1 B B F B 0 4 1 6 9 3 2 C B 4 7 . b i n . e x e
C : \ P 8 f A W U X g . e x e
C : \ U s e r s \ l u s e r \ D e s k t o p \ k 8 j 8 N O k 9 . e x e
C : \ r w v w l d s J . e x e
C : \ u J s J V Q R v . e x e
C : \ U s e r s \ l u s e r \ D e s k t o p \ q I 7 Q i L N C . e x e
C : \ 8 a f 6 6 c 9 2 c 3 0 8 9 c 9 8 f 8 1 a 1 3 e 4 0 4 7 3 8 6 2 c 9 5 5 1 4 9 0 8 9 3 4 4 c 7 4 a 3 7 8 c f 4 b 7 f 6 b c b 8 2 2
C : \ a 1 8 4 a 1 e 5 a 8 8 b d 7 b 2 f c 2 0 7 e 8 7 0 a 3 9 6 4 c 6 1 4 d a e 2 5 6 d 1 6 b 3 c b f 5 0 7 e 3 2 7 0 d e 4 8 8 9 3 5
C : \ d e e 4 0 a 0 d e 2 0 9 f 3 7 4 1 b a e 6 3 5 a 7 a c 7 4 3 5 a 3 8 0 2 d 8 4 2 a c d 4 1 e 9 1 9 a c c 5 a 2 8 1 d e d 6 3 9 9
C : \ m i k d o n j w . e x e
C : \ 2 f a 7 d c 5 9 d b a f 3 2 a 1 5 8 7 4 d 5 e 1 2 6 a 6 0 8 0 c b b 4 8 6 5 8 0 9 2 3 0 5 a 1 7 7 e 6 2 3 b a 4 4 1 b 1 0 7 d 1
C : \ 6 5 c 4 4 e 3 5 7 5 2 1 9 0 d 5 8 f 8 4 1 4 4 d a e a 9 9 3 e 1 6 4 5 1 5 4 5 7 e b 8 3 c e d c a 8 a e 0 1 e 7 b c 6 6 8 a 1 9
C : \ 1 b 3 9 c c 4 0 3 b 5 9 5 a 5 e c 2 a c b 4 b 7 f b c 9 d a a e c e 3 2 2 0 4 1 0 3 b 5 6 2 7 c 7 f 7 3 2 f 9 b 3 9 f b 6 4 0 9
C : \ U s e r s \ l u s e r \ D e s k t o p \ b w D w L x h o . e x e
C : \ w O P v h 2 d W . e x e
C : \ a 6 a a 7 3 3 f b e 6 9 f b 0 b 3 8 a b 3 f 1 7 1 c 0 6 1 f 2 2 3 0 a a 9 3 6 d 4 5 e d d c 6 8 6 3 a c 4 8 e 0 1 a c 3 b a b 5
C : \ 0 7 d 9 7 d 3 2 3 7 d 6 b 1 7 7 a 4 8 0 8 1 3 6 f 0 9 1 7 f 6 5 9 c 5 3 3 d 6 7 f 6 a 5 b 6 f 4 5 b b 7 2 5 c 4 c 9 4 8 6 d 8 f
C : \ U s e r s \ l u s e r \ D e s k t o p \ Y 3 5 9 i h n 9 . e x e
C : \ Y l 9 h l x x J . e x e
C : \ 0 7 8 f b 8 b e 8 5 b f 2 f 0 9 a c 0 a b 5 e 3 4 0 d 5 6 a b 5 2 4 c 5 4 7 b 3 b 4 5 2 8 4 b 7 7 9 c 4 e 9 3 5 e e 4 1 9 8 8 c
C : \ f a 5 7 d 3 5 9 e b e 5 a 3 3 a 3 1 8 4 2 9 b 1 0 1 7 d 6 0 f 6 7 b 1 4 6 e 2 8 f 5 d 2 2 c e 5 a 4 d 6 8 5 7 8 8 5 b c 7 9 a 1
C : \ 2 f b 5 a 6 2 2 a d b c 8 0 b 0 4 0 e 0 b e 0 5 d a 6 1 3 2 c 2 f 8 4 6 f f 5 a 0 8 7 d f 5 8 2 6 d 6 f a a 9 0 4 6 c b 3 f 4 d
C : \ U s e r s \ l u s e r \ D e s k t o p \ n v k S H 7 b J . e x e
C : \ J d v F _ y 5 1 . e x e
C : \ U s e r s \ l u s e r \ D e s k t o p \ G V l y 3 9 t a . e x e
C : \ s z 1 T o j k A . e x e
C : \ 9 a a 4 8 7 4 5 1 6 6 f 5 3 8 1 8 5 3 3 e 8 2 2 a e 7 1 f 8 b c e 2 0 6 a d d 4 4 6 4 1 d d 9 9 b 3 a 2 2 5 6 d e 6 5 e 3 7 9 d
C : \ 9 0 f 5 e 6 3 2 4 d 8 2 c 9 5 c 2 b 3 5 1 e c a c b 3 8 0 4 f 6 5 9 3 9 8 8 b 8 2 5 1 a e 1 4 1 5 e 0 9 7 d 6 5 2 f b c f 8 7 e
C : \ a 7 d 4 8 9 0 5 f 3 9 b 0 d 0 8 3 2 d 7 4 d b 5 0 8 4 e 6 0 4 4 7 8 6 7 5 a a 8 3 1 0 d 1 2 a 9 9 d f 7 3 0 8 4 c b 0 5 8 6 7 d
C : \ U s e r s \ l u s e r \ D e s k t o p \ i B j 0 B Z b U . e x e
C : \ 2 w 7 Y q L y 6 . e x e
C : \ 1 3 d 2 e 8 f 8 7 2 2 f e 1 d 8 b 6 d 6 d a 4 d e 3 2 9 e f 6 0 7 6 7 6 c 6 0 2 6 e 9 a b c 5 c 6 2 e d 3 a b 1 c d b 4 5 f 0 0
C : \ 1 a 4 5 a 8 c 9 f d 9 2 9 4 8 3 2 7 4 f 1 4 3 3 7 a c 8 6 0 9 8 7 6 4 5 d 9 5 5 e f 9 2 4 d e a 8 6 0 5 e e 6 e 3 1 b a b 4 3 a
C : \ U s e r s \ L i s a \ D e s k t o p \ l e E f a N M m . e x e
C : \ t 2 5 N E e A X . e x e
C : \ 6 3 9 b 0 c f 8 b d f 7 2 9 f 0 5 e c 2 4 9 1 7 a 8 b b 7 3 2 c 5 4 5 e 5 d 9 4 f b 1 0 2 a b d 1 c 5 5 4 f 8 b 0 c 6 3 5 f e 5
C : \ 5 5 b 0 e 6 0 6 6 a d 6 5 d b 8 1 1 d 6 8 8 6 7 e 9 5 0 5 9 3 a 1 a 9 3 0 5 f e 4 a d e 6 c 9 c 6 8 a c b 9 b 1 9 a 3 a 4 f 3 3
C : \ y p h L z _ N 5 . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ j H C s 1 Y 5 o . e x e
C : \ 8 5 b 6 e e 2 1 5 6 1 8 4 d b e 2 6 3 5 e 8 f c 0 0 c 3 2 0 e 0 f 1 c 4 0 1 e 8 4 2 3 5 b a 6 2 3 6 6 a d 4 4 d 9 0 4 e a f d 0
C : \ U s e r s \ L i s a \ D e s k t o p \ r d k z j F v y . e x e
c : \ t a s k \ B 2 8 3 4 7 4 B A 0 5 7 2 9 C D 8 C A 8 3 0 7 B C E 9 E 8 B 3 9 . e x e
C : \ f e 5 5 4 4 d 4 d 1 9 4 5 1 b 4 d 2 5 c 2 6 3 5 b 6 a a 7 f d 5 7 1 9 d 9 d 8 d 7 3 9 c 9 7 a f 2 7 f 4 5 3 3 b e 3 8 0 a a 3 3
C : \ 7 4 2 b 7 a 6 b 2 c d 5 d b a 5 b 2 3 2 d 3 d e b 0 6 b b 7 2 5 1 e f f 8 9 4 d e 3 1 1 e 5 4 9 e 9 d 3 f 3 7 3 4 f 3 c 2 c 6 4
C : \ 6 f 3 e d c d 0 8 c e f 6 d e e 7 9 c 6 a b a 0 3 c 0 5 3 6 c 3 f 6 c e 1 6 b 5 e a 0 b 6 b c c e b 8 4 9 8 e e 9 4 e 8 c a 8 0
C : \ c 9 9 8 7 8 7 e 4 b a c 9 8 5 0 a 3 e 5 9 f 6 9 d d 9 4 5 3 9 c 7 7 b d 8 8 c a 0 4 d 6 2 3 9 4 2 d 5 c 7 c e c 6 1 c 9 6 5 4 7
C : \ U s e r s \ L i s a \ D e s k t o p \ H n p 0 2 l C F . e x e
C : \ q r n u l H A 1 . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ Y I n 4 R 7 F 9 . e x e
C : \ 9 7 9 d 0 0 6 6 f 3 e 1 6 8 d 5 a 1 a 0 d 1 f c 7 2 d 9 5 a 8 6 f 1 7 2 5 7 6 9 2 9 b f 9 6 e 9 5 c c 9 4 6 4 c 9 a d c 1 3 c e
C : \ 2 4 3 0 8 8 3 6 5 5 4 1 5 9 1 b f 2 5 2 e d b f a 6 3 2 6 b 6 3 6 7 7 0 8 7 7 3 0 9 6 8 9 1 d 7 2 1 6 0 5 7 7 3 d 3 8 4 5 f 9 6
C : \ U s e r s \ L i s a \ D e s k t o p \ X S O a J 7 I 7 . e x e
C : \ 5 I o z i M 7 j . e x e
C : \ 8 3 5 0 0 3 a 9 8 2 8 8 8 0 0 3 6 e 5 2 b e 9 d e 2 f 0 1 1 1 e 0 3 7 2 1 e 0 6 0 7 7 2 a 5 8 0 6 0 e 6 f e 1 e f f 2 5 8 c d c
C : \ U s e r s \ L i s a \ D e s k t o p \ F C z 4 w 3 5 0 . e x e
C : \ 1 9 2 a 7 f c 0 5 6 d f 7 d 2 8 9 3 6 1 9 7 f 2 1 7 2 f 7 1 5 d a 8 f 3 5 6 3 7 e 2 3 2 1 2 d 6 5 b 5 d a 4 0 d 6 a f a 6 b 1 c
C : \ d 0 a b 7 8 b a f b e 1 3 9 7 1 9 1 1 0 2 8 c 0 7 a 1 9 b c 4 0 6 a d c 1 5 1 a d 8 6 0 8 4 4 f d d e 1 5 1 7 5 7 0 4 0 4 f 9 7
C : \ U s e r s \ L i s a \ D e s k t o p \ 9 b A 4 d 4 8 T . e x e
C : \ C P 9 u h C x 4 . e x e
C : \ 9 8 a a 4 1 1 d c 3 3 6 6 6 7 5 2 c 9 c 3 4 1 b 2 9 c a 8 6 a b 3 e c 0 a 7 7 1 c 1 f 0 c 4 8 5 0 0 c 9 7 2 1 9 1 3 2 8 d 8 0 5
C : \ X D S l v s f m . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 2 E G e W M L B . e x e
C : \ e G F 2 F d 7 u . e x e
C : \ f 3 b 8 d 7 6 5 5 3 b 6 2 d 0 5 c 5 4 f 6 6 1 5 4 9 9 6 c 0 2 7 b 8 9 5 f c 6 e 7 0 0 a f 3 3 3 f 1 7 1 1 7 f a 7 c 2 c 3 5 3 b
C : \ a f 7 3 2 a e 8 d 6 c a 6 9 8 8 7 5 8 f f 3 6 8 1 5 2 d 0 c a f e c 0 a a 4 9 8 a a 3 b 5 d a 6 7 8 c 5 b 2 2 d 5 4 d 1 d 1 4 6
C : \ 6 5 e 3 b c 6 e a e a a 3 9 0 1 0 8 b a 7 d d d e a 5 3 7 4 7 2 f 4 0 3 9 8 1 d 8 6 d d 9 b 8 3 5 4 c f 8 0 a 6 e 2 d f c d 2 1
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ n D y V d j K M . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f i l e . p e 3 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ e M 4 9 9 E R B . e x e
C : \ f 2 2 f 4 c 7 3 d a a 3 4 c 1 0 3 7 9 b 5 5 4 f c f 9 3 3 b d a f a 1 d f c d 5 3 f d 7 7 2 3 b b e 2 8 5 8 3 b e b 9 2 c 2 3 8
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ o j K D U z X T . e x e
C : \ c a 3 0 c b 3 6 8 8 4 d 2 7 3 9 5 1 4 1 e 3 f b a 1 8 1 3 3 6 3 4 d 2 9 c 1 9 a 4 1 6 3 6 1 9 0 2 2 e f d 9 d 1 e a 8 7 2 6 4 d
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 9 c g e u M n h . e x e
C : \ 1 b c 1 6 5 9 e e 3 7 7 c 7 7 1 9 5 7 2 d 0 f e f e e 7 a f f 4 2 e 2 8 f 1 d a 8 0 d f 2 e c a b 4 3 2 c 5 1 2 e 6 c 8 9 0 7 2
C : \ U s e r s \ L i s a \ D e s k t o p \ 3 d t 9 F P O I . e x e
C : \ 1 6 d 7 f 3 c 4 9 b f a 9 1 3 5 9 f 4 4 b 7 6 a 5 8 b 0 1 4 a d 2 4 0 0 b 4 a 6 6 e 1 d b d 1 d 5 0 a 3 6 a a 5 9 7 4 a a 5 7 d
C : \ 6 7 4 4 b 7 1 7 7 3 e c d 1 8 c 6 3 3 4 0 e 7 e 2 c 5 a a e 9 3 1 2 1 1 0 5 6 b e 7 0 0 2 a a 8 6 c 8 7 3 6 6 d 2 9 0 5 0 3 5 a
C : \ f 9 b f e 5 b f 3 0 d d 3 7 0 d f f 9 2 0 e b e a d b c 5 6 5 9 e c 3 8 8 3 3 f 5 3 f 2 1 9 4 6 9 d 4 2 8 f b 8 7 a 9 c 9 7 c e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ B I H C S K 9 d . e x e
C : \ q R s 4 3 7 S L . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ G 0 o 5 k 2 u 1 . e x e
C : \ n v 6 P L v w l . e x e
C : \ 5 c 6 5 8 4 b 3 7 9 0 c b 7 c 9 7 b d b 9 e 3 a c 0 d a 2 a e a 0 4 f d 4 a c 6 a 5 a b 0 6 6 d d 3 7 e a 2 e d 6 4 5 3 b f 0 2
C : \ c 4 5 9 2 c 6 c 1 2 c 5 3 d 5 c 3 7 b 8 f 5 8 9 2 e 3 f 0 e 2 8 d 3 0 6 4 1 b 7 2 8 c 6 0 2 7 e f f d 1 1 6 5 c b 6 d c f f c e
C : \ U s e r s \ L i s a \ D e s k t o p \ M R T o E E 8 c . e x e
C : \ T t Z 9 6 C w G . e x e
C : \ e 4 8 0 e 8 e 5 d 7 3 8 b 3 7 e f 6 8 7 9 1 4 4 8 f 2 8 3 5 a a a 0 7 6 0 2 d 3 e 1 8 8 c 2 c a d a 3 b 5 c f 3 0 a 3 3 7 1 5 e
C : \ U s e r s \ L i s a \ D e s k t o p \ E j I i 5 u L W . e x e
C : \ 1 9 6 6 d b e 4 5 5 a 6 c 0 a 4 b b f 0 f a 0 5 8 e d 2 a 3 4 b 1 1 5 e 7 b 4 3 c 6 8 9 f 3 0 a a d e b 3 6 2 4 5 c 8 8 4 4 9 3
C : \ 9 2 4 c d 9 6 9 e c 6 a 5 e a 6 3 5 c 4 d f f 7 b 3 3 3 e e 9 b 3 3 c 2 9 f 9 a d a 6 b 0 f c 2 c b e 5 c a 0 f 7 4 9 a d 5 9 6
C : \ U s e r s \ L i s a \ D e s k t o p \ f j 7 e d 8 C U . e x e
C : \ u R v 5 2 O O A . e x e
C : \ e 5 0 d 6 e 9 c 8 4 f a 5 e c 6 1 d b f 7 9 9 a 8 1 a 1 e e 9 1 e 3 f 2 4 b e a 7 5 9 7 e 1 2 3 0 3 e d d d 1 1 7 e 4 9 f f c f
C : \ D h J 6 4 h L o . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ 5 b 2 8 3 d e e 2 0 d b 1 e f c 8 9 e 5 2 5 3 9 b 2 6 9 b 5 5 0 9 8 d 6 6 b 2 6 e d e b 0 4 d e f 3 b 4 1 b 6 9 8 4 e 1 1 8 e d
C : \ a d b 6 f 7 d f 0 4 c 0 2 4 9 7 4 1 b 3 9 7 b 8 a d 5 4 0 7 a b 6 6 b a 4 4 1 8 c 3 c 7 8 b 1 e 4 9 4 a d 4 3 c d 5 4 0 3 c 7 7
C : \ d 6 b d 9 0 7 6 1 7 d 4 1 d 0 5 1 c 6 2 8 f 0 8 2 e a b 1 5 3 9 b d a 9 4 8 c a a 1 f 4 7 a c 9 6 9 3 2 8 4 0 e d 0 2 c c b 7 c
C : \ U s e r s \ L i s a \ D e s k t o p \ Z t 5 f z m f A . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ 2 b 2 b b 7 e 4 1 9 9 7 a e 2 d f 1 c e 3 1 f 2 c 1 8 3 8 1 2 a c 2 7 5 5 3 a 9 5 d e 5 f 0 e 6 f 3 0 3 7 2 1 b c 0 9 a 1 7 4 8
C : \ U s e r s \ L i s a \ D e s k t o p \ Y r P u Y V u P . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 0 3 8 f d 2 d d d b 1 d 2 7 8 8 8 a a 6 e c 7 b 3 7 2 f 9 8 5 6 9 1 e 5 a 9 e a 3 c 9 6 2 9 d e 2 a 4 4 3 b b 2 3 4 2 7 4 7 0 3 . e x e
C : \ a 7 1 c a c 3 b c 2 8 5 c b 5 b 6 7 6 c c 6 9 3 1 2 2 b 2 1 9 e 2 0 7 0 a 0 b 5 d 7 5 9 b e 3 4 6 c c f 6 6 e c 5 3 8 0 d c 0 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ 7 k Z t V U z x . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ 6 b 9 b 8 4 0 c c e 7 b 9 7 4 a 6 6 e 7 d 8 2 a 8 7 7 1 8 4 c d 5 a 8 0 7 5 4 5 a 9 6 e 6 b 5 8 6 c 8 5 b 7 e 7 f 2 9 d 8 5 0 d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ a b 4 5 9 0 6 c c 5 7 c 8 3 f 6 9 7 e 0 e 0 c 0 8 d 5 2 7 8 d 3 3 f 1 2 7 f e 1 3 d d 2 8 b 7 5 b 4 1 c 4 2 b 3 0 3 b 8 5 7 e e
C : \ 6 e d c 6 7 3 0 f e b e 0 8 1 0 a f 1 a 2 0 0 7 9 f 5 3 0 a 8 4 b e f a 3 9 a 5 9 7 7 7 6 7 e 0 6 2 0 c 0 a 7 1 8 b 4 8 5 f e 9
C : \ U s e r s \ L i s a \ D e s k t o p \ w d 9 Q w s y 8 . e x e
C : \ S d r 0 b c c G . e x e
C : \ 5 9 3 1 e d 3 d 2 4 e 3 c a 5 4 b 4 f c 0 a 2 8 9 1 4 8 9 9 e 6 8 3 7 9 6 e 6 a 7 4 f 3 0 e 0 9 3 7 b 8 5 b 9 7 9 8 2 7 6 8 7 0
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ b 3 6 3 4 5 2 5 d c 5 c 8 7 8 8 1 a 6 4 3 1 f a 8 c 4 3 9 c 3 3 9 e 4 0 9 7 2 7 9 a f 1 e b f f b d 8 2 c 6 2 1 9 0 5 c 8 7 5 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ d a 4 a 4 a b b 2 0 6 b 3 c 6 2 a c d a b 7 9 6 a f 6 2 a f b 6 3 b f 8 c 1 f c 9 5 6 5 8 5 a 3 1 c 8 b f b 9 e 8 2 9 9 1 f 4 8
C : \ b b 7 a b 4 a e 8 e 3 7 1 b 6 f 6 b 4 9 9 d b 3 1 1 0 e 7 2 e 7 e 1 6 8 d 9 4 6 1 7 1 5 1 a 8 0 b 3 9 f 7 8 9 8 7 f b 6 1 5 d 1
C : \ d 8 9 c 5 1 f 6 d 0 e 0 7 b c 7 7 c 5 b a 3 a 4 f b 0 5 7 c 3 9 7 c 6 c d b d 5 4 e 9 8 a 2 2 1 e b 4 d 3 b 0 3 1 5 9 1 7 c 3 9
C : \ a 2 3 6 d 7 9 b 4 7 1 b d d e 1 2 7 9 5 6 4 a e 5 7 b 9 c c 4 f 9 a 7 c e 3 e b 5 d d b 5 7 e c 3 0 2 4 d 9 6 6 d 9 5 0 4 c 0 8
C : \ b 3 3 e 7 b f e 6 e 6 3 c 7 a d 3 4 1 e 8 c 5 7 4 7 d 1 f c 5 e 8 7 0 9 1 6 3 8 2 e d 4 7 7 0 a a 2 9 a 5 5 2 1 b 5 7 0 2 2 4 d
C : \ U s e r s \ L i s a \ D e s k t o p \ J m F n 9 e u m . e x e
C : \ k S y r P i Y 6 . e x e
C : \ e 4 a c a e e 3 4 d 0 e 5 0 8 1 9 0 f c 7 b 7 f 4 4 c b 8 3 7 d a 6 7 b 9 0 3 2 b 0 8 5 f 2 2 a 0 7 1 d 1 e e f 4 c 1 8 3 6 4 a
C : \ 1 d c 7 2 d 1 7 7 a 8 1 7 9 8 0 1 e a 3 e 8 1 5 b a b c f e b 2 3 c 4 0 0 e 5 3 6 f f a f 5 e 5 3 5 f 9 4 a 5 1 6 0 1 1 6 4 6 e
C : \ 6 E g t e i C b . e x e
C : \ 6 f 8 e 4 8 5 8 4 8 5 3 4 a 2 d 8 e 6 0 e f 3 c 8 4 d 6 f 0 a 8 9 6 6 6 b 6 e 3 9 b b 7 7 4 1 e b 9 2 8 9 d 2 3 9 2 d 8 b 3 5 e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ a 3 9 7 7 0 1 b 2 e b 4 f 8 6 d 6 e 9 2 4 e 5 b 2 7 e 9 8 b 6 1 e 9 b 9 d d 6 e 2 9 1 6 e 2 6 9 a c 1 0 3 b f 8 f c d 4 7 6 1 e
C : \ 6 a f 9 7 c 9 b b 3 9 7 0 d 3 7 0 3 d a e 9 a 9 8 b 1 5 c d b b 9 d 1 f 9 e f 2 b 2 0 0 a a 7 e 0 e f 7 b 0 c b c 8 3 7 e b 9 3
C : \ w e A 5 g t t K . e x e
C : \ 9 1 0 9 a e 2 c 3 7 5 4 2 0 0 2 c a a c e 8 7 3 c f b c 6 4 c 6 0 1 5 b e 4 8 5 d 8 8 3 1 6 b c f a 6 e 4 d 4 4 3 9 7 0 2 8 f 3
C : \ U s e r s \ L i s a \ D e s k t o p \ W T j i i f g 9 . e x e
C : \ Q y j r k H 7 b . e x e
C : \ 4 2 f 1 a 6 8 6 1 1 c 6 4 7 3 1 6 7 7 4 8 8 e 5 d 5 f 8 c d 9 5 f a 7 0 f e e 0 3 8 b f 4 c c 5 1 a 8 8 4 9 d 9 e 8 3 a 3 c 3 0
C : \ 6 3 5 1 2 f 6 b 5 0 8 a a e b 9 b 3 9 7 f 0 1 c 8 8 e a 6 e 4 a d f 8 e 9 0 9 3 a 1 f 9 6 3 a c 4 d c 6 3 b a 1 c 5 d 0 9 0 7 b
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ z b h n d . p e 3 2
C : \ Z C m A F F w E . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ p N t t S J M t . e x e
C : \ 1 6 b 7 0 5 3 e 3 f 2 6 b 8 6 0 0 a d 5 f 2 6 e c f f 3 5 9 b 2 0 8 1 1 c c 5 5 8 1 a 5 5 d a 7 7 5 2 6 d f a 4 b f 6 a 6 1 c c
C : \ f f 1 a 6 3 8 e 4 f 5 1 e e 7 6 4 2 5 8 4 1 f f 1 b 6 a 6 6 a b c 5 0 1 3 4 6 2 a a b c 6 b f b 0 d 6 d 4 7 d 6 2 4 b 8 b 1 8 3
C : \ U s e r s \ L i s a \ D e s k t o p \ I w e x e r 5 y . e x e
C : \ c d 4 c 7 f 6 7 9 f e f 5 7 8 b 5 f a a 6 d 9 3 a 3 8 6 c 8 5 8 1 b 9 6 2 7 7 6 f d 0 2 e 7 e 4 6 2 4 1 3 5 5 7 6 8 5 5 7 9 0 6
C : \ c 1 4 d 5 b b 8 5 1 1 b 3 a b b 9 5 a 6 1 d 7 d 1 5 1 c 4 b b d 4 f f f 8 e 0 b 3 d d 7 e b 1 b a 0 0 8 2 1 e b 9 c a c 1 5 b b
C : \ U s e r s \ L i s a \ D e s k t o p \ W U D K o 4 a y . e x e
C : \ 0 2 2 8 b c c f c 4 6 7 8 c a 4 d 8 3 0 a 4 4 8 c 6 a c e 5 3 7 9 b 9 3 9 1 e 7 8 4 b 0 d 1 0 3 2 b 0 e 9 b 2 2 6 7 f 0 0 6 4 3
C : \ p P y E K 2 L n . e x e
C : \ 4 3 e 0 8 2 f f f c 3 a 0 b 7 6 5 5 a 7 0 a b 9 7 3 2 7 4 0 0 8 3 8 b 3 6 0 1 8 d 4 c b e 7 c d 4 3 e 0 6 7 3 e 2 5 d 7 9 e 9 b
C : \ S r 3 U 5 F D t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ Q L 6 C s K m l . e x e
C : \ 3 a d 7 b b d 4 4 e e 5 9 b 8 0 7 a 6 c d 5 c c 7 7 4 e 0 e 8 3 1 a 9 1 0 3 d 2 4 b 2 8 c d 3 5 9 5 4 0 b 3 7 4 c f 2 9 f 1 e 1
C : \ 9 5 8 9 f f 0 c 4 f 0 c a 5 7 f 5 3 8 8 8 7 e 3 7 9 7 2 3 f e 1 7 a a 4 a 1 4 6 3 9 d e a 3 8 6 b d e f 6 5 d 2 d 8 0 d 2 b 7 c
C : \ U s e r s \ L i s a \ D e s k t o p \ Z F i b E I W t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ p o F q S o N J . e x e
C : \ c 3 7 9 8 6 6 0 c 3 6 0 b 4 3 4 c 9 7 6 4 3 3 a e 6 0 5 0 f 2 9 9 f 4 b 3 2 5 a 9 3 a e b c d 4 0 7 f 3 0 2 1 2 0 9 9 1 3 9 0 a
C : \ f 8 1 9 f 7 d e b 9 7 9 8 4 7 3 f 5 9 5 c 3 b c 4 9 4 d d d 2 b 1 5 b c b b 9 7 c 1 2 4 f f 7 5 a 5 7 2 2 9 a 8 6 f c e 2 8 9 0
C : \ 1 1 1 d 2 1 b e b 2 a e 3 3 c 5 a 9 8 f c e 7 6 4 5 5 7 1 8 4 f 2 3 e 1 8 a 1 f 3 f 7 4 4 2 b 8 6 c f e c 3 a 1 3 7 b c 9 6 6 b
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 9 4 8 0 5 6 3 7 0 8 1 0 0 0 0 4 9 1 4 0 1 4 7 c 5 8 8 b 1 d 3 4 7 6 b 3 5 d b 6 4 e 2 e 0 2 1 d 0 b 9 1 e f e 6 d 9 5 7 3 4 9 8 . e x e
C : \ e e 1 c 5 6 4 8 d 3 0 b 3 2 1 8 8 7 f f 1 4 1 3 1 b f b a a 5 b b 3 5 d f 1 3 0 4 b a 9 7 e 9 3 2 5 2 8 4 3 5 a 9 f f e 3 1 b 3
C : \ 5 4 9 8 6 4 6 6 5 9 7 2 d b 1 9 7 1 2 e 1 2 8 8 1 5 d 5 9 c 4 3 3 c 1 e 1 0 8 f 7 a e 5 6 6 a 5 1 3 f 5 2 a 0 1 a 2 2 8 2 2 f a
C : \ U s e r s \ L i s a \ D e s k t o p \ E h z 3 J D y q . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ . . e x e
C : \ 1 a 7 1 9 7 6 3 0 9 a 7 b 1 f 4 b 2 9 1 3 b d f 2 a 3 5 4 2 4 a c 3 c 1 4 e 1 9 7 a 4 c 4 f 6 9 d 8 a 5 c b 7 1 f f 7 8 b c 5 3
C : \ U s e r s \ L i s a \ D e s k t o p \ N e V S q H W W . e x e
C : \ 0 2 d a 6 8 a 3 6 1 2 5 5 7 1 2 c 9 4 e 3 0 3 0 7 7 e 4 2 e 0 2 1 0 f 2 7 1 8 c 4 8 5 f 5 6 9 d a e d 9 4 0 b 2 f d f 1 f 1 f 0
C : \ 7 3 e 9 6 2 6 f c 2 e f 2 0 f a 8 8 7 4 d a 6 6 9 1 1 4 2 e c c 1 2 a 9 5 5 8 e 5 b 8 9 b c 0 9 2 6 e b c 5 b c 1 7 2 c 6 d 7 c
C : \ U s e r s \ L i s a \ D e s k t o p \ 4 V x D L d j x . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c c f 5 f 8 2 f 2 a c 2 e 6 c f 8 d 7 1 5 6 c f f 3 0 1 f c 2 5 6 b 0 c 7 3 1 c f 3 3 c 6 0 a 3 9 4 f 9 4 c c 8 5 2 1 5 1 9 e 0 . e x e
C : \ c d d 8 b 1 1 f 4 d f 3 8 0 6 b a 7 c 9 3 c c 6 b 7 9 f b 6 a b 9 1 1 4 7 6 7 c 4 1 4 3 5 0 d 1 f a 7 5 3 4 8 5 0 8 0 7 7 0 0 d
C : \ c f d a a e 2 6 4 a 6 2 8 9 f d 1 7 0 7 9 b 7 7 e d b 9 e 3 3 7 c 4 c 2 3 9 5 1 9 b 2 e 8 1 0 9 8 7 0 d d 7 7 8 d f b 4 c 4 0 4
C : \ U s e r s \ L i s a \ D e s k t o p \ Y Z Z u V 1 v l . e x e
C : \ 0 d 4 0 c c 7 f c 7 8 0 8 a a e 0 c 1 7 d 6 e 6 5 6 6 a 1 1 5 f 4 3 7 c c b 3 a 6 a 8 7 d 9 5 c 5 4 0 d 8 9 2 7 6 2 e 5 5 f 4 8
C : \ U s e r s \ L i s a \ D e s k t o p \ c N G G P l v 1 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d e c 0 5 c a 2 d e 6 5 2 7 6 f 6 b 1 2 8 5 3 f 6 c 0 6 b 3 7 c 0 c 1 8 3 b f b 5 3 1 3 c d 1 e f 0 4 2 3 8 0 8 3 b b 4 a 3 0 0 . e x e
C : \ e 0 5 2 a e 9 5 e e d c 2 1 9 1 3 8 5 4 b e 0 8 6 6 5 6 1 4 e c e 5 c 6 0 4 8 9 b d d 2 c 1 c 6 d 6 5 2 1 1 7 8 5 7 2 d 2 8 a 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ z b h n d . e x e
C : \ 7 9 0 6 4 b 1 3 d b 6 3 6 a 6 9 b 4 f 8 0 c 7 5 b 1 5 5 f d 0 c 8 d 9 4 0 3 c e 1 a 4 6 f f e e 7 8 a c b c 6 a c a c 4 6 0 a 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ z b h n d . e x e
C : \ 8 a 6 c 9 6 2 4 9 3 9 b 4 f 0 a 2 5 3 0 5 f 3 4 2 a e c 8 d 8 8 6 a b 5 d 0 e a 5 7 3 2 4 c 1 e 6 f a 1 8 8 e 5 e a e d 0 d f 6
C : \ b 5 a 4 f 4 e 9 3 3 7 b 4 1 4 2 8 9 d 5 8 f 9 0 3 9 4 8 5 3 7 9 b c 5 4 b 0 f 1 f d 8 4 2 d b e c c 8 7 d b b 6 1 e b b 7 3 9 5
C : \ 9 3 3 d 4 6 4 9 3 a 2 c 0 c 5 c c 6 a 3 c 5 9 e 9 b 4 4 e 1 4 7 8 c 8 7 c 9 b 6 6 3 a 1 e f 4 6 5 a 3 3 9 a 8 f c 9 2 1 6 8 5 d
C : \ U s e r s \ L i s a \ D e s k t o p \ A X a V V v a I . e x e
C : \ f 9 c 7 c f 1 a a 3 d 0 c 9 4 1 6 4 d b e 9 3 b 4 4 f 6 5 8 1 4 1 7 7 4 e e c 0 1 7 e 7 4 f 1 4 a b c 0 7 7 e 0 2 f c f 4 b 1 d
C : \ U s e r s \ L i s a \ D e s k t o p \ l b t z E W J Z . e x e
Process Tree
-
075d4220782e6e32f2fe472d4972928e9c938795f0026f9e5df59e860d4a50fe.exe (844)
"C:\Users\Administrator\AppData\Local\Temp\075d4220782e6e32f2fe472d4972928e9c938795f0026f9e5df59e860d4a50fe.exe"
- zbhnd.exe (2996) "C:\Users\ADMINI~1\AppData\Local\Temp\zbhnd.exe"
Hosts
| IP |
|---|
| 114.114.114.114 |
| 8.8.8.8 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | |
| dns.msftncsi.com |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 61714 | 8.8.8.8 | 53 |
| 192.168.56.101 | 56933 | 8.8.8.8 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 8.8.8.8 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | aced6cecf38e712e_zbhnd.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\zbhnd.exe |
| Size | 44.2KB |
| Processes | 844 (075d4220782e6e32f2fe472d4972928e9c938795f0026f9e5df59e860d4a50fe.exe) |
| Type | MS-DOS executable PE32 executable (GUI) Intel 80386, for MS Windows, MZ for MS-DOS |
| MD5 | 311195365172a5aae66274199511da47 |
| SHA1 | 13e10b020f0fd3dfa00617aaf8ea15784015a2dd |
| SHA256 | aced6cecf38e712e9262971fb05a3241257df5588fd936f13aba3e2122e3e999 |
| CRC32 | 1DBBBEAA |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.