1.2
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.61
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Trojan-gen | 20200217 | 18.4.3895.0 |
| Baidu | None | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200217 | 2013.8.14.323 |
| McAfee | PWSZbot-FMO!B13C218F92CC | 20200217 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b07b8e | 20200217 | 1.0.0.1 |
静态指标
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(2 个事件)
| section | |
| section | petite |
动态指标
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(2 个事件)
| section | {'name': '', 'virtual_address': '0x00001000', 'virtual_size': '0x00005000', 'size_of_data': '0x00001800', 'entropy': 7.8891943617683} | entropy | 7.8891943617683 | description | 发现高熵的节 | |||||||||
| entropy | 0.4293801104200154 | description | 此PE文件的整体熵值较高 | |||||||||||
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 57 个反病毒引擎识别为恶意
(50 out of 57 个事件)
| ALYac | Trojan.Ppatre.Gen.1 |
| APEX | Malicious |
| AVG | Win32:Trojan-gen |
| Acronis | suspicious |
| Ad-Aware | Trojan.Ppatre.Gen.1 |
| AhnLab-V3 | Trojan/Win32.Zbot.R88085 |
| Antiy-AVL | Trojan[Downloader]/Win32.Upatre |
| Arcabit | Trojan.Ppatre.Gen.1 |
| Avast | Win32:Trojan-gen |
| Avira | TR/Crypt.XPACK.Gen |
| BitDefender | Trojan.Ppatre.Gen.1 |
| BitDefenderTheta | Gen:NN.ZexaF.34090.dm3@aWn!1Jg |
| CAT-QuickHeal | Trojan.GenericCS.S9476200 |
| ClamAV | Win.Trojan.Agent-1344461 |
| Comodo | TrojWare.Win32.Kryptik.BPRE@54vpga |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.133b77 |
| Cylance | Unsafe |
| Cyren | W32/S-bcd3fc6e!Eldorado |
| DrWeb | Trojan.DownLoad3.28161 |
| ESET-NOD32 | a variant of Win32/Packed.Petite.G |
| Emsisoft | Trojan.Ppatre.Gen.1 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/S-bcd3fc6e!Eldorado |
| F-Secure | Trojan.TR/Crypt.XPACK.Gen |
| FireEye | Generic.mg.31bc7e8133b7764f |
| Fortinet | W32/Zbot.HFQ!tr |
| GData | Trojan.Ppatre.Gen.1 |
| Ikarus | Trojan.Crypt |
| Invincea | heuristic |
| Jiangmin | TrojanDownloader.Upatre.ajyh |
| K7AntiVirus | Trojan ( 00547ee11 ) |
| K7GW | Trojan ( 00547ee11 ) |
| Kaspersky | Trojan-Downloader.Win32.Agent.hdsz |
| MAX | malware (ai score=88) |
| Malwarebytes | Trojan.Upatre |
| MaxSecure | Trojan.Upatre.Gen |
| McAfee | PWSZbot-FMO!B13C218F92CC |
| McAfee-GW-Edition | BehavesLike.Win32.Backdoor.km |
| MicroWorld-eScan | Trojan.Ppatre.Gen.1 |
| Microsoft | TrojanDownloader:Win32/Upatre.A |
| NANO-Antivirus | Trojan.Win32.Agent.cqixup |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM19.1.4D57.Malware.Gen |
| Rising | Malware.FakePDF@CV!1.9C28 (RDMK:cmRtazo2L4g7m4Ea+lJsrJVXL3a1) |
| Sangfor | Malware |
| SentinelOne | DFI - Suspicious PE |
| Sophos | Mal/DwnLdr-AK |
| Tencent | Malware.Win32.Gencirc.10b07b8e |
| Trapmine | malicious.high.ml.score |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2004-09-07 11:34:34
PE Imphash
87d7d4c05cdecb10042741285457c05f
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| 0x00001000 | 0x00005000 | 0x00001800 | 7.8891943617683 | |
| .rsrc | 0x00006000 | 0x00002000 | 0x00001e00 | 5.5312952766878585 |
| petite | 0x00008000 | 0x000001e5 | 0x000001e5 | 3.8463805683526124 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x00006130 | 0x00000ea8 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_GROUP_ICON | 0x00006fd8 | 0x00000014 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_VERSION | 0x00006fec | 0x00000328 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_MANIFEST | 0x00007314 | 0x00000193 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
Imports
Library kernel32.dll:
• 0x408160 ExitProcess
• 0x408164 GetModuleHandleA
• 0x408168 GetProcAddress
• 0x40816c VirtualProtect
• 0x408170 VirtualAlloc
• 0x408174 VirtualFree
• 0x408178 LoadLibraryA
Library GDI32.dll:
• 0x408180 TextOutA
Library Msacm32.dll:
• 0x408188 acmStreamOpen
Library ADVAPI32.dll:
• 0x408190 CopySid
Library IMM32.dll:
• 0x408198 ImmGetContext
L!This program cannot be run in DOS mode.
`.rsrc
@petite
]vpQ%>%E$9
bZo1-pK
ce$Vz"~Fs
Z"1Lp+*y
^9L.*H
xb{'`x:
3)[@e4
S+ygN@
e'FvtA
sjBzY`dD
,~;sIST
7"MlDw@
bv@.jr
&TVQ8_
(/Js(e
`RE6<Swhw{M
PWW:R?^XZDi.
5i`t1&
@$$q{b!J
7]VVZl0M\E@
A.B$c5S
P0Qp2s?
$@.^.'
hjACtB
rAUPO$S`0x
qA9>h9H
lC+O) ia
<>f1nBAI$-+O
EzH sy+
$<P"3hhnLpAKrJ$
X"$`0c
$Y1w1\
LSA&<6$
Dv6C{$FP
,H.C@GU
k[TXIW,H|$x
p9yf0Z0AE4
0W?Cf/
=j9&v+;"fo
#U'36f
~XR'_URD8
qxsJrFTQ*`aw`nTkhIHJ
-wE$IO"l0J,
JGI+CR
2XSk$IeiX
$7N0Q%
A7Ib\!
A4IZ7tA$o|
BC4dAZ
N)X/]K'
GI[mQ C
Jx|! k[\I0N
]xox"`qng@
!p3>Kma<o@~Ad!
g$CBEN
%Nbx@e
!PAw#Y"x
NY n{v
M<Uyn^
&QdLrptps
%n<mO^!&j;Kg|
/$B{vt
ODP$ZMy`+^ G:pm2
Q _JJ^|+R
L#5301j)D|+
$d}~q=h
zAfEPYi
@b&Ym0p0)P'89@h
/m0p'"
(SYa4h'|
70AD9@s75Ae KDMn
zAcW/'
R0c}ZzG
mQKBmA
=KIS`3
g4\,(=8pP#
0UpZPz:#&o8
+^|@%+
C2#/ >
r%&L@5$~>6a
+KKf5Tuf
WAOuA0
zcXH"5c-`}
MQ^}_^K]DEf
2yUN^nK]M.
DzcImapr$|wAyiL
C7,*M
"+kWPWDW|ZL^A
iKFhCppir
v`~I.InM
4M$yEi$15Iae
MU{1=h'!.xt
E4gj"[4
{<JM0B1
W7*U+W)
sMxJIyN
\9\cBM{0r
DMj@>g
:}~yF/
UX1!&Y
T/>0@;
7WpXom-n*nc-]KW
.EzCeZ9G<`a
R;%8p4+
41d/%n&
`TiU]+P
G `=>x
UNH KBN
UQ+F;/z^`vqmst-M
Qz&X&*Z
5v-l"Q
V48^XXXX]
#######
###>LLJ
47>4,##########
#########
#####,EZM
,######,
#####2
######2#
PD]}JC44KxXMt7
#######2#J}J{F|
sDDPJ4
########2,rR
2U{DY]]FsX####
########2#CzzC2#6RCKj#
2222222222,R R
##,,,,######
2222222222#C%Uv,22#2222######
22222222222,
#2#############
22222222222<KK#2#2###########
22222222222<,222##2#########
22222222<+d
,42222##2#######
224<i,42222222#######
i<22222222#######
4,ii42222222222####
$4,K<22222222222##
$$$$$$$$$$<<4222222222#
$$$$$$
dk<4222222222
++$$2222222
888888888&8&&
9=======))))))))))))))))pp)))<$$$$$
9:::::::3>333W>>>33W>33333333>
******
m-------M7-7Mo77on7-------E
*T11II11
:(((((-MtxJJEn
7-(-((-EN&1.;;;G1
L((((((Z}lX
#S+DkX((((((EN1G;?????
-555555ZxC
DSlZF5555F5XN.;?VVV
(555555Z}2+4DPKDP#4F05550qN
5000000u~4YK~4YSKrRK~0000060
6u4wjjC0+ Dzbg;T
0%%%%%%a
2`%%%%%ubg^T
%%%%%%%%`ad%Had%%H@%%%%%%`bg^T#
%%%%%%%%%BB%%%BB%HH%BB%HHHHH%Hbg^
H///////'''''''''''''''''''''/
.................f.*1
&&&&$$$&
$$$$$$$
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
MessageBoxA
wsprintfA
ExitProcess
GetModuleHandleA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
LoadLibraryA
TextOutA
acmStreamOpen
CopySid
ImmGetContext
user32.dll
kernel32.dll
GDI32.dll
Msacm32.dll
ADVAPI32.dll
IMM32.dll
ppppppppx
ppppppppppppppppppppppppppppppppppppppppppppppppppppxpppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp
ppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppxpxppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppxppppppppppptoo
i555557E
iii5St
pxppxpppppppxppppppHp
{2@7u6uuuu
aEuetr
{4$%MM
pppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp
pppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN^[@x
KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK
89::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::g:
M3u5@NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNC
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 8 0 0 0 0 2 5
C o m m e n t s
C o m p a n y N a m e
H P C o r p
F i l e D e s c r s i p t i o n
c a l c . e x e
F i l e V e r s i o n
6 . 3 . 3 . 1
I n t e r n a l N a m e
c a l c . e x e
L e g a l C o p y r i g h t
C o p y r i g h t ( C ) 2 0 1 1
L e g a l T r a d e m a r k s
O r i g i n a l F i l e n a m e
c a l c . e x e
P r i v a t e B u i l d
P r o d u c t N a m e
c a l c . e x e
P r o d u c t V e r s i o n
6 . 3 . 3 . 1
S p e c i a l B u i l d
V a r F i l e I n f o
T r a n s l a t i o n
l C : \ 4 0 6 8 8 2 7 0 3 8 7 3 e a 7 c 9 0 4 9 6 9 7 8 a 5 6 a 2 0 2 0 d c a 9 0 8 0 2 c 1 4 c 9 8 7 1 5 7 1 7 4 2 6 6 b 4 3 5 d 4 b e
C : \ U s e r s \ L i s a \ D e s k t o p \ N F B 8 C d m y . e x e
C : \ J 1 v p 7 3 E B . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ M o p m 2 U I 3 . e x e
C : \ 2 1 6 4 8 f 0 8 0 7 4 1 8 c 4 3 6 d 6 8 c d e 3 6 4 f c f f 2 9 6 f 2 4 c a 4 7 9 1 b 6 0 d 1 d c 0 0 1 3 7 2 4 a 1 3 b 6 2 4 a
C : \ 3 a 2 c c 7 0 b a 8 d 6 2 7 0 0 1 4 8 b 6 3 2 5 7 3 5 f e 6 3 f a e f 3 e 0 e d 8 3 f a e 1 a 4 5 5 8 9 8 1 3 e 2 6 3 2 4 4 f 3
C : \ 1 a c 5 3 1 1 d 6 8 7 a 9 3 3 7 d 5 2 4 f 3 c a e 0 3 4 f 3 7 0 6 4 3 a 2 8 a b 3 c b 9 7 0 f c 8 7 3 a e 8 7 5 3 5 9 1 5 2 8 e
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 2 7 7 9 3 0 2 6 2 e f 7 1 3 0 a 4 3 2 3 6 c 4 d d 6 5 4 7 3 6 6 1 e 7 4 7 1 8 f 9 6 b 5 c 5 e d b 0 7 d 7 5 7 5 6 2 0 5 e a a c . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ J S W n c p G p . e x e
C : \ 2 f b 9 0 d 8 6 5 2 f 9 9 0 0 c b 4 9 e 3 1 a b 7 f e 4 d 6 8 e 8 9 8 d a 6 5 3 a c f a 2 0 7 3 8 f 3 c 1 8 c f 3 3 1 6 5 4 2 7
C : \ 0 6 2 e 1 8 2 2 b 3 5 3 5 7 6 3 6 d 3 1 9 f 9 f 8 9 e 1 b 0 6 5 0 5 b b 0 d 4 c 7 5 6 7 d 5 5 a f e 2 2 c 0 3 7 2 2 7 4 0 3 8 c
C : \ 5 4 a 9 0 f 4 5 c a 9 e d e 9 7 5 0 2 f 8 9 d e d a f 0 9 d 8 7 2 e 0 8 1 1 7 0 0 3 4 1 c 0 c b 1 6 2 9 2 0 9 b 1 3 8 8 e b 8 f
C : \ 4 c 9 e a a f 1 f 9 8 8 9 1 e 5 2 1 2 5 e b f 0 2 5 d e e 1 f a 7 c e 4 e 2 f e b 1 0 1 0 b 4 9 8 4 5 1 d 2 3 4 3 7 6 4 5 a b 2
C : \ b 7 e 0 5 d 3 0 d b 4 b 8 3 1 c 5 1 4 3 8 5 d 7 8 c 2 a b a 5 7 8 9 d f c 0 e 2 1 2 d 8 6 2 b d c 4 3 a c 7 0 d d 0 b 6 3 1 8 9
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 6 a 9 4 8 0 8 e 3 3 5 c d e 3 2 9 9 a 3 c 5 1 2 9 6 a 6 d 1 9 9 9 2 6 b 3 3 5 4 7 9 2 5 8 1 1 f b 7 1 c 9 0 8 d b 3 3 0 5 7 5 e . e x e
C : \ 8 4 0 e b f 3 f b 9 e 5 e c 8 2 d 1 9 d 4 8 a 7 3 1 e a 4 5 f b 1 4 8 e d 1 3 b b 6 6 5 1 8 7 0 b 7 5 4 1 a c f 7 8 c a 9 b f 1
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ k i a k G 6 S 7 . e x e
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 7 e b d 8 6 1 b 6 c 5 2 d e b 1 1 4 b 6 3 0 a b 0 8 b 2 8 5 0 4 a 2 1 1 9 b e a d b 5 1 5 4 4 7 b c 0 0 4 7 a f 9 b 5 f 8 d 6 d . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ O 1 R N e R v H . e x e
C : \ 3 0 9 9 3 b 9 e 4 a b b b 0 1 d c d 2 5 a 2 a d 0 6 9 1 9 f 3 a d 1 d 6 f d 5 e 8 2 f 0 3 5 1 7 9 1 5 c 4 7 8 c d 6 6 0 1 7 d f
C : \ c 4 4 d 8 1 9 1 3 8 a 4 5 4 9 b f 4 1 1 8 e 8 9 9 6 b d 3 6 a f 1 9 7 f 3 4 4 7 7 c 7 8 8 1 f a e 5 7 f 9 1 3 e 5 2 c 0 d 3 4 6
C : \ U s e r s \ L i s a \ D e s k t o p \ C q X F M q c b . e x e
C : \ 8 6 8 8 f 9 e 9 c f a 6 d 5 4 4 a 7 e b 8 6 6 e 4 9 6 7 7 0 0 a f 9 f a 8 7 6 7 1 5 2 5 d 4 e 7 3 3 a d f a e b 2 f 8 8 4 4 d 1
C : \ f b 7 e d 5 9 a 5 1 d 4 3 4 e c 6 2 6 0 6 6 1 f e 8 1 7 9 5 d 7 f f b 3 9 d 5 7 9 2 4 d d 9 5 2 5 9 f a 7 8 d 3 8 7 7 a c 3 d c
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ Q P v t D X Q C . e x e
C : \ 0 2 2 6 7 e d 7 1 4 d b 7 9 1 b 1 d a d 3 6 e 9 c 8 9 7 4 d 4 1 0 0 6 f f c 9 7 f e 7 a 7 f 6 5 b d 8 f 8 0 8 8 7 3 c 7 0 b 2 8
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 1 k j U I h v v . e x e
C : \ a q C G v t 6 r . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ W 2 h n R t r A . e x e
C : \ U s e r s \ J o h n n y C a g e \ D e s k t o p \ c 0 h Q O p 9 N d c . e x e
C : \ U a U B Y u r a . e x e
C : \ U s e r s \ J o e C a g e \ D e s k t o p \ d L D 4 m 0 4 y X e . e x e
C : \ 3 c 1 f 7 7 2 4 d e 7 f 8 5 d f 9 5 d c 2 9 c c 7 f 7 0 c 8 8 e e a 5 e b e a 9 2 d e e 9 1 1 d b 6 f d d 4 b 4 6 8 0 2 6 2 8 b
C : \ 0 7 0 e d 4 e 9 3 2 b 4 1 2 9 7 7 8 1 3 6 5 5 0 b d 1 4 d c b 0 0 e c 4 3 c 1 1 7 2 0 7 8 a d f 8 b f a 8 3 a 2 5 a f 3 8 5 5 7
C : \ Q S 3 h u V K U . e x e
C : \ 5 0 4 9 4 7 f b 4 d 1 c 1 f 2 2 0 d 6 3 2 4 8 8 e 0 5 2 c 6 1 e 8 a a c 9 8 2 b 1 6 6 f 4 6 f e 5 d 3 2 1 0 d 2 8 4 c 3 c 2 7 2
C : \ z g 6 B N 4 P s . e x e
C : \ d 0 5 0 4 0 0 9 3 5 d f e e 3 6 0 3 5 1 f a 1 6 0 8 b c 7 a f 3 b 9 a 5 e 8 2 1 f a 4 a b 6 4 f 0 7 0 d 5 5 8 9 8 3 6 2 6 9 f 1
C : \ e 8 8 d 5 4 d d e 3 c b 1 5 f c 7 1 e c f e 5 9 0 2 0 4 5 3 b f 0 4 5 5 c 9 4 2 6 b 8 0 e 7 0 d 7 6 7 2 4 9 e 9 b d a e b 3 1 4
v v v v v v
C : \ a 7 5 f 0 d 0 9 8 f 2 c 5 8 0 2 d d a 7 0 2 7 c 2 c f 5 a 2 0 1 6 5 8 0 f d d 6 6 a 2 a 4 2 c 0 9 e 1 4 a a 5 0 e e 1 2 7 d 0 4
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ F 2 k V I 8 U 6 . e x e
C : \ 8 9 e 1 6 3 e 6 5 9 8 0 a 8 7 e 0 6 8 b 5 5 e f 4 a b 1 e e 6 2 0 4 4 8 d f 9 4 7 9 9 d c e d 1 4 7 e 6 d f 3 d c 1 d d 0 c a 3
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ w d c A N u u J . e x e
C : \ 2 5 b 7 7 0 9 8 c 5 e 6 e 9 2 8 c a b d f 8 0 e 8 8 c a 6 5 6 a 1 9 8 8 5 c 6 7 4 3 1 8 d 8 3 7 5 2 f 9 f 9 8 3 5 5 a 2 a b 9 3
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ r D G R d f 2 p . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 0 5 0 6 c f 4 c 7 f 1 f 3 6 2 0 5 b 2 0 9 f 5 3 c b 5 c d 4 1 a 2 4 f 0 f e 0 a e 5 3 b 9 1 2 e 2 a 5 2 a 1 8 1 9 3 d 7 3 7 9 1 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 3 5 e 4 7 0 c f a 5 8 4 c 9 5 6 _ b u d h a . e x e
C : \ f 9 f 4 d 7 0 f b 9 9 9 9 4 e 8 6 9 7 d 1 9 b 1 8 f d 1 8 d 9 e 3 c 8 5 e 6 8 e 1 c 5 6 c e 0 a e f 1 e a 9 4 d d e 4 0 8 0 4 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 0 e 7 1 f 5 9 a c 4 c 6 6 0 2 0 f 9 c 5 9 0 a f 3 2 5 3 d 9 8 7 3 c d 5 e 6 d 5 4 c b 4 7 9 a d d 7 c a a a a 5 9 f 9 a 2 c a 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f 7 a 7 2 2 4 f f 4 d 7 7 0 5 e _ b u d h a . e x e
C : \ 3 d d e 8 0 1 4 6 4 6 6 c 6 d 3 3 9 5 0 5 a c 0 2 7 3 1 e 2 4 1 e 4 4 a 7 6 b e d 2 7 f 9 8 c 9 5 8 5 a 8 7 b 0 2 8 6 4 5 d 9 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ y D W I w W L D . e x e
C : \ b c 1 3 a 4 4 e f 5 4 5 a 7 d a 3 2 9 f 2 a 7 0 b a 7 4 6 b e 3 7 9 9 3 d d 5 c d f 4 2 b a d 1 b c 4 a d e 6 5 7 9 8 2 9 d d 0
C : \ b 8 2 1 c 1 c 9 1 4 5 5 8 0 0 3 b 4 8 6 e a 7 f d a c 5 9 7 3 d 7 b e 7 f c 1 1 0 c 3 8 3 4 9 b 2 1 a e 4 4 6 9 b 3 b c d 2 c 1
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 1 0 c b 4 3 9 6 9 2 a 3 9 6 3 8 _ b u d h a . e x e
C : \ 3 1 c 9 c e 2 4 0 7 5 2 b 2 4 c b 6 5 b b 7 b e 5 2 6 d 9 9 8 b 5 6 3 2 7 5 8 b 0 e 8 8 8 d 3 a 6 4 0 f 8 a a d 3 7 a 6 7 7 b d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ B n D 4 h f H s . e x e
C : \ f b 0 c 6 f 3 0 f 5 e e 5 9 0 1 a 0 b 8 3 d 4 1 8 6 d 0 b 4 e 6 c a b a 1 f 6 6 4 7 4 c 5 f 9 3 b 4 4 8 b c 0 4 3 8 e 1 b d a d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ c 8 f f c 0 4 7 3 4 9 d c 6 9 3 f 3 3 6 b a 2 0 c 8 f 3 f f 5 3 9 9 a d e 9 f c 8 5 c 3 e e 2 3 6 0 b 1 3 f 7 7 9 5 3 7 d 5 8 0
C : \ d 3 a 0 d 3 e 2 c e 2 3 e a c d e 8 b 8 5 7 5 5 b f 0 c 5 d c 0 f c 7 f b e 6 a 1 4 c 1 7 b a 7 9 f 2 2 4 b 9 7 2 2 4 c 5 b d b
C : \ 7 5 6 c c e b a f b d 1 7 6 0 8 c c 9 3 8 3 9 7 7 b 8 2 5 c b d 7 c b 3 c c b 5 1 d d 3 e a 5 3 d 0 e 7 3 a e e 8 2 2 6 4 d d d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 4 6 5 4 2 a d c e b 2 5 8 c 4 c f 6 f 1 c 0 9 f 7 1 3 e f 3 b 8 3 a 8 a e a 6 b 0 a 9 b 0 2 3 f c 7 4 a c 0 c 2 c a 0 6 b b 3 c
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ d 5 c d 2 a 9 1 1 8 5 1 c 6 1 a a f a d 9 5 4 c 7 3 6 0 0 f f e 8 c f 6 8 0 7 3 3 1 7 1 1 8 3 3 0 0 f 1 5 b a a 0 f c a c 9 a 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 7 d f f 7 8 3 5 b f 5 4 f 0 1 e 2 e b 4 1 c c 4 7 5 e 4 7 f 1 d b f 9 2 e 2 f 3 0 a 8 9 8 1 8 4 f 0 8 d 8 9 5 6 0 7 2 1 8 c f 0
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 2 3 b 0 2 b 2 4 9 4 1 9 1 3 c 4 _ b u d h a . e x e
C : \ d c 4 6 8 3 c 7 2 8 4 5 6 2 5 3 0 d e 8 7 b b 4 e 7 2 9 1 c a 5 6 5 d 0 0 c 3 c 5 1 9 7 0 b f c 7 f 4 3 2 4 c 2 e 8 1 f 1 5 f 0
C : \ e 8 4 0 6 a b 5 2 f 5 e f 5 7 5 e 7 2 4 1 8 c 1 6 1 e d 0 0 a 5 2 1 0 1 2 a 9 d f c b 7 f 7 c 0 d 7 4 6 3 3 c 9 0 d a e 7 8 b 7
C : \ 8 6 0 b 4 4 7 7 6 5 e 7 d 1 3 1 6 c 2 6 a d f 9 4 3 f e 6 3 d 0 1 8 b 2 6 1 3 8 7 7 6 7 3 8 4 2 0 a 3 f 0 2 9 9 f 2 b 7 c 7 3 7
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ c 2 o t E 0 M j . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ 6 4 3 4 c 4 1 9 8 1 9 1 e e 2 4 4 d 1 a 1 4 b 6 8 0 e 2 6 9 a 4 a 2 e b c 7 1 f 1 5 5 9 8 9 4 1 b 9 3 5 2 b 9 7 b c e 5 8 f 2 8
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ B B I 1 g 3 5 r . e x e
C : \ 5 1 4 e 5 7 5 8 b a 3 e 9 6 e d 3 1 3 0 2 5 1 f c 6 7 8 7 3 e 7 1 2 1 2 f a 1 d 2 8 7 9 3 d 9 8 e 1 5 f 4 b 6 2 5 e d 9 5 5 4 9
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ 2 9 5 e 3 c a 4 8 b d 6 f 7 4 3 5 f 5 8 a 2 f 7 6 1 2 1 1 a f 1 d 1 a 5 6 a 7 5 5 a 3 c c 7 c 6 1 9 8 c e 9 5 1 c f 6 1 a e 2 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ 6 1 c 8 3 9 3 5 9 5 9 d 7 6 8 d 7 e c 7 2 b 5 8 3 c 8 0 f 1 4 1 c 9 4 6 7 8 b a c 7 e c 9 2 9 a b 5 b 0 a 1 a 3 2 8 4 1 c c 8 d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ U s e r s \ L i s a \ D e s k t o p \ D 7 C 8 c k A T . e x e
C : \ 1 e a 8 d a 9 c 5 e d 9 2 1 2 0 6 f e 5 6 f 6 3 4 e b a 8 3 1 9 2 1 0 8 1 9 c 6 1 5 4 6 a 6 3 9 b f b f 4 b 5 7 4 9 c a c b b 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ d 0 3 6 8 5 4 c c 8 4 a 1 5 4 2 7 5 e 9 8 8 f 4 8 7 b b 8 8 f 4 6 d e f d 9 6 5 2 4 1 4 b 9 c 5 2 3 d a 4 c 3 9 c 3 7 5 c c 9 d
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ m m x D C Q W y . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ B 7 h K w d J 7 . e x e
C : \ 7 1 f c 4 7 1 6 4 7 d 3 4 a 2 d 9 9 7 c c a c 1 9 9 1 c c 1 2 7 1 6 f 9 6 9 f f 8 d 8 9 5 a f 0 7 a 1 c 0 c 3 3 3 a f 8 e b 8 9
C : \ 1 a f a e 0 9 4 8 1 8 f b f 5 b c f b 0 9 f f c 5 e 9 b 3 6 3 b 5 e 6 4 7 e e 8 d 9 e e 9 5 0 d d b c 5 8 9 2 f 9 3 e 1 9 8 2 a
C : \ 4 a 5 d 4 a 1 e d 0 9 7 7 2 0 b f 3 0 e 0 b 3 9 3 1 c a 4 f 0 b 9 a a 3 b d 8 1 4 d 4 3 d c 5 7 e d 2 3 4 2 f 4 6 7 1 7 4 9 9 9
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ Y j c y x I e L . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 2 7 0 6 1 6 5 c 2 8 9 3 7 5 6 0 4 5 2 1 3 9 2 0 1 7 f 1 1 1 1 c b 5 f d 5 7 f 4 e 9 1 6 8 6 9 5 5 1 2 7 c 6 6 7 9 b 6 a 8 0 2 f . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ g L d 3 p g 8 0 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a 4 e 4 0 8 4 f d 1 c 4 a d 0 3 _ b u d h a . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ 8 6 a c 4 8 a 6 1 4 c d f b 0 3 f 4 8 f c a c f 2 b a 3 d 6 b d 0 d 8 3 c 3 2 8 c d d 8 9 3 a 3 4 0 f 3 4 a 6 2 5 b 6 7 f c b c
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ X O F R 0 k H 6 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f 9 6 2 5 a c 1 c 0 6 6 4 5 c d e b 4 b c b 3 7 6 a a 2 0 a 1 9 a 2 3 f e 2 9 1 f 8 f a c e 0 0 c d 8 f f 0 a 2 8 2 0 e 0 6 5 2 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ D V K G J 4 n 1 . e x e
C : \ 0 c f 5 5 2 5 c 3 5 8 6 d 3 a f 5 1 1 5 c 3 7 1 5 8 2 d 6 9 b 9 6 7 0 a 7 d b 8 c 6 a c 9 2 d e e 3 f 2 1 3 e 7 f 7 a 4 1 d 7 c
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ a e 4 c d d 1 c e d 8 9 d 3 1 b 2 c a a c 5 4 3 0 f 9 2 9 0 6 f e 5 b 5 a 0 1 e 0 2 c 2 e 3 b 7 5 1 e 9 9 9 d 4 a b 7 6 5 1 9 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ U s e r s \ R A 4 9 1 ~ 1 . V U L \ A p p D a t a \ L o c a l \ T e m p \ c 6 3 d 3 7 5 0 2 5 b f c f 8 c 4 3 e e 6 8 5 e d f c 5 7 6 5 e . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ k n s Q B a Z l . e x e
C : \ 2 1 1 a 4 a 9 9 9 2 5 3 e 9 5 a 0 b 9 c 5 d 8 f 5 7 7 8 7 3 5 b e 7 8 f 8 b e 5 7 b 9 4 1 f 6 e 3 a 6 5 2 f c f 6 e 4 7 0 2 9 8
C : \ b 7 4 e 1 6 1 a e 7 d 6 4 9 1 2 5 3 d 9 d 2 8 8 8 6 2 d 5 e b e d 9 7 1 2 7 6 6 6 e 2 3 3 7 8 6 b a 8 8 2 4 7 3 2 2 b a c 3 f f
C : \ U s e r s \ L i s a \ D e s k t o p \ x Q P G t i 4 3 . e x e
C : \ 3 9 8 0 5 7 f 4 d 2 5 0 b 4 3 8 8 c 0 5 c 9 8 1 a 8 0 a 2 0 9 f 7 b 2 6 2 2 d a 4 6 d 4 8 0 f 2 9 2 3 5 1 2 e 5 6 2 5 a 5 7 d d
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ k r A 2 p w I 8 . e x e
C : \ d 4 b 3 8 6 6 c 2 a 7 1 2 e 7 c 3 0 e f f 3 e b 1 a 2 2 4 5 6 6 9 3 1 4 5 6 a a 4 c d c 3 2 5 0 6 5 3 e f 8 b c 8 f b f 4 7 a 0
C : \ e 1 2 c 1 6 4 6 b 1 d a 4 e c 9 8 0 c b 3 4 1 f e 2 d 1 3 8 2 8 9 a f 8 7 b 3 1 e e 3 c 9 9 8 a 1 e 2 e b e d 6 9 f 4 8 e 6 5 3
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ e U x S Q B T j . e x e
C : \ c b c e e f e 0 4 7 3 5 0 2 b 0 3 c f 9 0 e 4 f 1 f 2 8 b 4 e 1 b e 6 5 2 2 0 c b 9 b 3 f 8 a 2 b 6 1 a 4 0 8 f 4 a f 5 a 2 1 1
C : \ d b 1 b 7 1 e 3 d b e 3 a 4 c d b 8 4 8 b 9 1 c 8 0 2 6 8 2 0 f 5 4 7 5 4 9 7 c 0 0 3 3 8 e d d 2 e 2 5 a 8 2 c 9 4 d c f 6 e 3
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ l r i i l m 6 8 . e x e
C : \ 1 5 b 8 3 5 a 8 1 4 3 5 0 6 a b 9 6 7 5 e 2 1 7 6 4 3 0 5 0 6 2 a 7 9 c c 0 e c 4 2 6 8 e 3 c 0 9 d 4 8 b 8 7 d 5 5 9 4 f f 0 f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 6 5 v 3 q T c 0 . e x e
C : \ f f 7 6 3 8 f 1 b a 2 1 8 3 a 1 b 3 a 6 f 3 f 1 b 6 4 3 7 b e 1 d 1 1 9 7 c a 9 f 3 f 3 3 1 a 0 5 d 6 8 4 3 9 d 3 4 1 1 8 9 9 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ e 6 a f d 1 f 7 2 5 a e 1 0 8 d 2 c b d 7 e b 2 4 0 7 0 d 0 a a 6 7 5 8 6 0 5 a 5 c 4 3 8 e 7 7 8 3 3 d 2 0 7 9 c 4 e d a 7 8 0
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ Y f 6 v j y J n . e x e
C : \ b 7 1 6 2 c c 7 f c 7 4 f 8 b 1 d c d 9 3 6 a 5 9 7 1 d c c 4 b 2 4 b e b 1 9 6 d f 0 b 0 2 1 b d e c 7 e 9 9 e 2 5 b 8 e c a 6
C : \ 6 9 4 b 7 5 1 e c 2 4 4 a 4 4 b 2 d b f 6 9 3 b 1 2 6 9 9 f 3 3 f 0 0 a 3 9 d e f 7 1 6 6 2 a a b 7 e 6 5 8 0 e f f d d 3 8 4 c
C : \ 8 3 8 a 9 3 e 9 6 4 5 5 3 6 7 1 b 4 6 2 1 f a 4 d 1 3 7 a e 2 4 f 1 f e 5 9 f 1 1 0 2 c 4 b 6 7 d a e 1 a 3 1 3 5 b 7 a 2 d 4 5
C : \ e 6 8 e 4 5 9 a a a 6 c d 5 2 b 9 5 6 b 1 9 d e 1 e 7 b 2 2 1 5 6 a 8 3 a 6 d 8 5 1 8 0 d d f f b 2 0 6 6 9 7 c e 6 d 5 2 9 a 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 4 2 0 c 7 8 f 7 3 9 b 7 e d 2 f e a 9 b 4 8 e 5 4 d 0 2 6 6 4 2 3 3 d c 6 0 0 a f e a 3 7 4 3 4 7 f 0 0 c 6 b 8 0 c 4 3 b 3 d 0
C : \ 1 c e 2 0 c 0 b 1 2 2 7 9 a 7 f 7 1 f c 8 3 3 9 a e f 9 6 9 0 e a f 0 1 7 d e 3 b 1 0 b 5 4 e d b 7 5 e 8 7 e f 8 4 9 9 1 a c b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 6 d 6 c 1 c b b d d e 6 1 4 9 d 4 7 f 3 7 5 e 1 0 e 5 d 1 d 1 2 c a 0 a f 5 7 e 2 1 f 5 5 a a 1 b 7 e 9 4 1 9 a e b 9 2 3 9 e b
C : \ c 1 a f f a 8 2 5 4 2 c 5 c 2 b e e 6 3 8 e c 8 f 9 b c 7 d 2 f 0 6 8 4 4 b 3 0 0 f 6 9 a 6 7 b e 0 9 1 4 b 3 a 2 0 e 5 7 6 1 5
C : \ c 6 2 4 7 1 6 c 7 1 f 6 9 5 c 9 4 6 1 3 1 7 a f d f e e 0 9 6 1 6 1 a 7 3 9 9 e b c 1 b a b 8 2 2 1 1 e c c 8 a c 5 d 1 7 6 8 e
C : \ b e b 6 a 9 b f 4 7 a 9 c 2 1 f c 3 c 4 5 9 c 7 9 e 8 5 a 6 a 8 c e 5 4 e b d f c 7 1 0 b 9 6 c 8 6 f d 6 d a 8 f 5 c a 4 f f 4
C : \ 9 3 3 2 0 b 5 1 1 d b 8 2 2 f b 0 a 7 f f 2 0 9 7 e 7 0 c f c 7 d d 8 c 6 e 7 e 5 7 b 1 5 a 5 e 9 9 5 a b f 6 5 6 3 4 5 a 8 6 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 9 e b d d 1 d 2 4 8 e 0 f 8 e 7 d 0 8 e d 0 f 2 8 6 a b a f 2 3 f 9 3 2 0 6 4 6 2 9 b 8 b f c c c e e 5 7 2 b 2 8 d 6 b 5 9 3 1
C : \ 8 b 9 d 1 a 9 5 0 0 c e 3 3 3 a 5 6 8 a b 8 f d 5 2 9 4 c 9 f 1 6 0 8 b a 6 8 a f 3 4 1 3 8 5 8 a 3 6 d d 9 d 2 e 1 f 5 3 a 5 2
C : \ a e 5 1 6 5 c f 9 9 0 8 a b a a 3 3 a 8 e 1 0 7 7 4 3 e c 4 e 5 6 1 e d 6 e 8 f 2 c 7 c b b b c 5 8 c 8 1 a 4 3 2 e f e 1 d d 6
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ o 0 H m N i m P . e x e
C : \ d 9 7 d 2 2 2 c 4 4 7 0 3 f 4 a 1 b 1 9 e b 6 2 1 7 0 e f e 5 d 5 e 1 f f 7 d e 3 c c c 2 5 b 4 9 0 d 8 7 d f 7 5 7 1 0 c 0 9 f
C : \ b a a d 8 7 0 7 7 6 3 7 b 7 f 4 7 4 3 8 4 1 1 a 5 1 f 5 2 0 2 8 2 b 6 0 8 b c b 0 1 4 6 c a a 9 4 2 7 9 d 6 b b e a 7 1 1 3 9 d
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.