2.5
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.75
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Malware-gen | 20200220 | 18.4.3895.0 |
| Baidu | Win32.Trojan.Kryptik.ks | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200220 | 2013.8.14.323 |
| McAfee | GenericRXFL-UV!41D96C358399 | 20200220 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b77c15 | 20200220 | 1.0.0.1 |
静态指标
查询计算机名称
(2 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545282.328 GetComputerNameW |
computer_name:
TU-PC
|
success | 1 | 0 |
|
1727545290.250625 GetComputerNameW |
computer_name:
TU-PC
|
success | 1 | 0 |
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(2 个事件)
| section | . |
| section | .imports |
一个或多个进程崩溃
(22 个事件)
动态指标
分配可读-可写-可执行内存（通常用于自解压）
(2 个事件)
在 PE 资源中识别到外语
(12 个事件)
| name | RT_BITMAP | language | LANG_RUSSIAN | filetype | None | sublanguage | SUBLANG_RUSSIAN | offset | 0x000dc2e0 | size | 0x00000b28 | ||||||||||||||||||
| name | RT_ICON | language | LANG_RUSSIAN | filetype | None | sublanguage | SUBLANG_RUSSIAN | offset | 0x000e6e18 | size | 0x000010a8 | ||||||||||||||||||
| name | RT_ICON | language | LANG_RUSSIAN | filetype | None | sublanguage | SUBLANG_RUSSIAN | offset | 0x000e6e18 | size | 0x000010a8 | ||||||||||||||||||
| name | RT_ICON | language | LANG_RUSSIAN | filetype | None | sublanguage | SUBLANG_RUSSIAN | offset | 0x000e6e18 | size | 0x000010a8 | ||||||||||||||||||
| name | RT_ICON | language | LANG_RUSSIAN | filetype | None | sublanguage | SUBLANG_RUSSIAN | offset | 0x000e6e18 | size | 0x000010a8 | ||||||||||||||||||
| name | RT_ICON | language | LANG_RUSSIAN | filetype | None | sublanguage | SUBLANG_RUSSIAN | offset | 0x000e6e18 | size | 0x000010a8 | ||||||||||||||||||
| name | RT_ICON | language | LANG_RUSSIAN | filetype | None | sublanguage | SUBLANG_RUSSIAN | offset | 0x000e6e18 | size | 0x000010a8 | ||||||||||||||||||
| name | RT_DIALOG | language | LANG_RUSSIAN | filetype | None | sublanguage | SUBLANG_RUSSIAN | offset | 0x000e1cc8 | size | 0x00000096 | ||||||||||||||||||
| name | RT_GROUP_ICON | language | LANG_RUSSIAN | filetype | None | sublanguage | SUBLANG_RUSSIAN | offset | 0x000e7fbc | size | 0x00000014 | ||||||||||||||||||
| name | RT_GROUP_ICON | language | LANG_RUSSIAN | filetype | None | sublanguage | SUBLANG_RUSSIAN | offset | 0x000e7fbc | size | 0x00000014 | ||||||||||||||||||
| name | RT_VERSION | language | LANG_RUSSIAN | filetype | None | sublanguage | SUBLANG_RUSSIAN | offset | 0x000e8010 | size | 0x0000011c | ||||||||||||||||||
| name | RT_HTML | language | LANG_RUSSIAN | filetype | None | sublanguage | SUBLANG_RUSSIAN | offset | 0x000e1ca0 | size | 0x00000022 | ||||||||||||||||||
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\ahyguys.exe |
投放一个二进制文件并执行它
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\ahyguys.exe |
一个进程创建了一个隐藏窗口
(1 个事件)
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
在用户文件夹中创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\ahyguys.exe |
文件已被 VirusTotal 上 57 个反病毒引擎识别为恶意
(50 out of 57 个事件)
| ALYac | Trojan.Upatre.ET |
| APEX | Malicious |
| AVG | Win32:Malware-gen |
| Acronis | suspicious |
| Ad-Aware | Trojan.Upatre.ET |
| AhnLab-V3 | Downloader/Win32.Upatre.R228621 |
| Antiy-AVL | Trojan[Downloader]/Win32.Upatre.dmid |
| Arcabit | Trojan.Upatre.ET |
| Avast | Win32:Malware-gen |
| Avira | TR/Dldr.Upatre.MX |
| Baidu | Win32.Trojan.Kryptik.ks |
| BitDefender | Trojan.Upatre.ET |
| BitDefenderTheta | Gen:NN.ZexaF.34090.6qY@a0UJHypc |
| Bkav | W32.AIDetectVM.malware |
| ClamAV | Win.Malware.Upatre-6789238-0 |
| Comodo | TrojWare.Win32.TrojanDownloader.Upatre.DLF@5t0aja |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.583995 |
| Cylance | Unsafe |
| Cyren | W32/S-caa586f0!Eldorado |
| DrWeb | Trojan.Upatre.5834 |
| ESET-NOD32 | a variant of Win32/Kryptik.DQFN |
| Emsisoft | Trojan.Upatre.ET (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/S-caa586f0!Eldorado |
| F-Secure | Trojan.TR/Dldr.Upatre.MX |
| FireEye | Generic.mg.41d96c3583995099 |
| Fortinet | W32/Kryptik.DQBA!tr |
| GData | Trojan.Upatre.ET |
| Ikarus | Trojan-Ransom.CryptoWall3 |
| Invincea | heuristic |
| Jiangmin | TrojanDownloader.Upatre.rnk |
| K7AntiVirus | Trojan-Downloader ( 005087911 ) |
| K7GW | Trojan ( 004c8a641 ) |
| Kaspersky | Trojan-Downloader.Win32.Upatre.dmid |
| MAX | malware (ai score=83) |
| Malwarebytes | Trojan.Agent.MBF |
| McAfee | GenericRXFL-UV!41D96C358399 |
| McAfee-GW-Edition | BehavesLike.Win32.Downloader.dz |
| MicroWorld-eScan | Trojan.Upatre.ET |
| Microsoft | TrojanDownloader:Win32/Upatre |
| NANO-Antivirus | Trojan.Win32.Upatre.duciqm |
| Qihoo-360 | HEUR/QVM07.1.5E41.Malware.Gen |
| Rising | Worm.ServStart!8.10D (TFE:dGZlOgXif9ckj9ge1w) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Tencent | Malware.Win32.Gencirc.10b77c15 |
| Trapmine | malicious.high.ml.score |
| TrendMicro | TROJ_UPATRE.SMXC |
| TrendMicro-HouseCall | TROJ_UPATRE.SMXC |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2015-07-16 19:57:30
PE Imphash
3f3efadaafd87b9d1ee5fbe5b81cc9a1
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| . | 0x00001000 | 0x000e1000 | 0x000e0e00 | 0.392493706990175 |
| . | 0x000e2000 | 0x00001000 | 0x00000e00 | 5.853818316952162 |
| . | 0x000e3000 | 0x00006000 | 0x00005200 | 5.648636338499537 |
| .imports | 0x000e9000 | 0x00001000 | 0x00000600 | 3.684023497043773 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_BITMAP | 0x000dc2e0 | 0x00000b28 | LANG_RUSSIAN | SUBLANG_RUSSIAN | None |
| RT_ICON | 0x000e6e18 | 0x000010a8 | LANG_RUSSIAN | SUBLANG_RUSSIAN | None |
| RT_ICON | 0x000e6e18 | 0x000010a8 | LANG_RUSSIAN | SUBLANG_RUSSIAN | None |
| RT_ICON | 0x000e6e18 | 0x000010a8 | LANG_RUSSIAN | SUBLANG_RUSSIAN | None |
| RT_ICON | 0x000e6e18 | 0x000010a8 | LANG_RUSSIAN | SUBLANG_RUSSIAN | None |
| RT_ICON | 0x000e6e18 | 0x000010a8 | LANG_RUSSIAN | SUBLANG_RUSSIAN | None |
| RT_ICON | 0x000e6e18 | 0x000010a8 | LANG_RUSSIAN | SUBLANG_RUSSIAN | None |
| RT_DIALOG | 0x000e1cc8 | 0x00000096 | LANG_RUSSIAN | SUBLANG_RUSSIAN | None |
| RT_GROUP_ICON | 0x000e7fbc | 0x00000014 | LANG_RUSSIAN | SUBLANG_RUSSIAN | None |
| RT_GROUP_ICON | 0x000e7fbc | 0x00000014 | LANG_RUSSIAN | SUBLANG_RUSSIAN | None |
| RT_VERSION | 0x000e8010 | 0x0000011c | LANG_RUSSIAN | SUBLANG_RUSSIAN | None |
| RT_HTML | 0x000e1ca0 | 0x00000022 | LANG_RUSSIAN | SUBLANG_RUSSIAN | None |
Imports
Library KERNEL32.dll:
• 0x40500c GetModuleHandleW
• 0x405010 InterlockedExchange
• 0x405014 GetFileAttributesA
• 0x405018 GetLastError
• 0x40501c GetCurrentThread
• 0x405020 VirtualFree
• 0x405024 GetModuleHandleA
• 0x405028 TerminateProcess
• 0x40502c GetProcAddress
• 0x405030 OpenEventW
• 0x405034 OpenEventA
• 0x405038 OpenSemaphoreW
• 0x40503c FindClose
• 0x405040 GetStringTypeA
• 0x405044 LCMapStringW
• 0x405048 LCMapStringA
• 0x40504c MultiByteToWideChar
• 0x405050 Sleep
• 0x405054 VirtualAlloc
• 0x405058 RemoveDirectoryA
• 0x40505c LoadLibraryA
• 0x405060 GetOEMCP
• 0x405064 GetACP
• 0x405068 GetCPInfo
• 0x40506c WriteFile
• 0x405070 GetStartupInfoA
• 0x405074 GetCommandLineA
• 0x405078 GetVersion
• 0x40507c ExitProcess
• 0x405080 HeapReAlloc
• 0x405084 HeapAlloc
• 0x405088 GetCurrentProcess
• 0x40508c HeapSize
• 0x405090 UnhandledExceptionFilter
• 0x405094 GetModuleFileNameA
• 0x405098 FreeEnvironmentStringsA
• 0x40509c FreeEnvironmentStringsW
• 0x4050a0 WideCharToMultiByte
• 0x4050a4 GetEnvironmentStrings
• 0x4050a8 GetEnvironmentStringsW
• 0x4050ac SetHandleCount
• 0x4050b0 GetStdHandle
• 0x4050b4 GetFileType
• 0x4050b8 HeapDestroy
• 0x4050bc HeapCreate
• 0x4050c0 HeapFree
• 0x4050c4 RtlUnwind
• 0x4050c8 GetStringTypeW
Library ole32.dll:
• 0x4050f0 CoUninitialize
Library WinSCard.dll:
• 0x4050e8 SCardForgetReaderW
Library WS2_32.dll:
• 0x4050e0 select
L!Win32 .EXE.
.imports
rtualAllocEx
7uygfhjgh4jg6h54j345874jhg
U,SVWE
_^[]U SVWE
MEiURh
EE_^[]UtSVWE
uu_^[]U
]U]%P@
DDDDDDDDDDDDDD
Yt$CH;r
PSWLSU
tACH;r
s^h p@
YYh(p@
Yu3Vt$
YtF>"u
< v^S39
PqY;5pM
8 t9UW
YE?=t"U<;Y
8 u]5<M
[UQQS39
EPEPSSWM
YEPEPE
@"t)t%
F8"uF@C
@C8"u,
VW333;u3
SS@SSPVSSD$4
t#SSUPt$$VSS
;t<8 t
u+@UY;u
3_^][YY
DSUVWh
_^][D3j
XUSVWUj
t.;t$$t(4v
VC20XC00U
]_^[]UL$
YY\WP\R
@Y<v)\P?
j?UIZ;
r;]uy;
;uY;]s
pD#U#ue
j #M_|
]#\D\D
VW3;u0DP
X_^[Vt$
t$VYVt
90tr0B= zA
@;vAA9
t7SWU
BBBu_[j
VPVPV5
@AA;rI3
tAt2t$
VWuBhi@
;tg5,P@
GIt%t)
Gt/KuD$
GKu[^D$
[^_UWVu
DDDDDDDDDDDDDD
^_Ujhi@
SVWe39=
"WWShi@
M]9}tfSuu
tMWWSuu
Mu;tVSuuu
3;u>EPj
EPVhi@
E;tc]<
e33M;t)uVu
KERNEL32.dll
GetModuleHandleW
InterlockedExchange
GetFileAttributesA
GetLastError
GetCurrentThread
VirtualFree
GetModuleHandleA
TerminateProcess
GetProcAddress
OpenEventW
OpenEventA
OpenSemaphoreW
FindClose
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
VirtualAlloc
RemoveDirectoryA
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
WriteFile
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapReAlloc
HeapAlloc
GetCurrentProcess
HeapSize
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
HeapFree
RtlUnwind
GetStringTypeW
USER32.dll
LoadIconA
SetWindowPos
EnableWindow
$GDI32.dll
CreateBitmap
SelectObject
ole32.dll
CoUninitialize
WinSCard.dll
SCardForgetReaderW
WS2_32.dll
8Muex<
KERNEL32
VirtualProtect
G(XPTPjxWXt=
runtime error
TLOSS error
SING error
DOMAIN error
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
abnormal program termination
- not enough space for environment
- not enough space for arguments
- floating point not loaded
Microsoft Visual C++ Runtime Library
Runtime Error!
Program:
<program name unknown>
GetLastActivePopup
GetActiveWindow
MessageBoxA
user32.dll
IZDS>L#E'>
~}|Awvu:~pon3xihg,rba`%l[ZY
N876H10/B*)((""!s
fz]sYlTe@^GW@P
{zy>tsr7mlk0fed)_^]"XWV
W<;:Q543K.-,E'&%q?
pF<i@Hb:J[4ET.?M($F"(?
vwwv;pppo4jiih-dbba&^\[Z XUTS
@987:2100}+*)nw$#"q
S[{MVtG]mAVf;
k}}|Aevvu:_oon3Yhhg,Saa`%MZZY
/776)00//r}njfba^Z
@ey:br4Mk.)d(;]"AV
Xyyx=Rrrq6Lkkj/Fddc(@]]\!:VVU
,,++njfb^ZAVsRwNsJ
h<]0ukM=dGG]A?V;-O53H/%A)|:#
Q?"ssrrqpoY|
_100.q
.$#"su
M>GJ|w}zy
8q:56hcf]#]
"TO=RY
2-K0''
qpodidUV[VTTS
BGB@@?
::9|.3.u
1+:)(s
yg5rak[
OCH=A7
|:1u3+on*e ["_
*W,)3ggffedca^]\]XWVUP
NKI8FED
5110++*z(&#
Dca_G4r+gj%i*
5.+7b{12,U'nN#
xxwwvut:aponmWtP(fJL
VUTS;ONM;KXFED>>==K987
>A/.-x
TO@IC|>9
dg"f a\B]
^|_]RMF
ssrdr&ggf-Pcba`
RRQYMe
B~G@vrk}1tc
ZSH\]g
Cd7q%96.+(
Sponejihx
GGFU@@?
z5mhiZ]`O|7V8ENt?7|y
:$+_fedcba`_^]\
~}|B]xwvu;Zqpon4gjihg-<ba`e:7\V
303A/.-p&u/)mDo
=B~G+@
`.ng\"p)m.j3[b-a
?97T41
fnml) `
m5sgYUvl[u#l+kQ
F<}3E<n
C)g"3k!#e
QeTM?}6ru0t5!2Vl52f
xwvvuts9onml2hgfe+a`_^$ZYXW
J54w0/.-p)('&i"! b
F?8q3?3
]'5oS!
{zyyxwv
{<6elkji^
A3%ICRA@
z w)0/.-p"
$#""]k
>C?wy<xAmp;
8W;0m3n
rWKV+*)(
mEiL@ua)g[)4
;R?N3f
*L<5u.p+o0j-i2d/c
rDczyxwa~Z2pTeNlR`C [XB7
5<;:9|
qspa#je
>-@nozCW
t-qqh+g0Da
vcevyx;^rqpbP,hgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-,+*)('&%$#"!
cU@oYN85b
U@oYN45b
^b3#-.y?Vk
9EWjySAYs9
`0P45b]h
-uAoYN45b
u@oqN45bE
W@oN4i5b4
UAoYN5b
@oYNT5b[
UPoyN45
U@oYN45b
U@oYN45b
U@oYN45b
U@oYN45b
U@oYN45b
U@oYN45b
U@orA{5{
@o]N45b
U@YN45b
U@oYN45b
U@oYN45b
U@oYN45b
uu&K[*
*Q*!YQybe&s
&d=)C5
(w*b^
W~yUI# ae&s
N@!u+i43>WN
5=j~S>1=@yAiyA#
j2n:1N
EWkQU4*5
*%Q@"9
A#uNW~H
z!i47{
[wQA>74{
[WQ#:#N
i8dz!aZG
WC|7@7t0DyzO
sS)N4_
GkK@oe"47
n7Xn&Cqy\16Fge
I>lk(V?n~J|3]
=R{SRE=
s0n_AM3G
3]bN4CE"
fx.M~S+
bl .77!>
p\%S~'^a`
2GW:P4
fwn5q~
JzO;j$G
.@:X!UbW
yd;jpz
[Hl%3_
mEyrOM
/_oYn5b
U@nWM\|5aS
U3xh4j.
'TYNd4aMU<U
b@sYM;aS
M<jc"D
ut ~N{A4l}qfw'
;jfj^#
T]FZaG
EU~T7hUgH
o^Cb>5].
AFeK'4
j[y0vUc
D e1Cd4EN
~eSl@YU
='eyo2??
wXa=aG'
r|7rM!0
Y+~)K!
W@@?.e
RuaG}A0I\p\W@
D5]ZN4
B7~O p
_pYN8Fs94
}_n_QM3F
SATuXB
nWr0{6k4'/i
2AoYM9
4UMyFz_E
YNR"?aG'/1ss
LXkEp6K
?nYM|Ic
k7U {SNBFnO
E_K!RaZ
|E]?|/
'M]=6c9n.[7${Y1
-yb$F:UaQ
=|+9DJ
)6%DaT+4
V^61eo4W3
Y]FcbK
7|-y&D@
y}# N;|-
Y}qNi++
=6a$gJ
}qNi++
9va$gJ
IfTkV55RF
M&YcYJ
aJv9}1Ni++
kT74\YD&
y}# NGV|=9VZ&Q
V1%DaT+4y?,
QIa-3F|n41i
}q36ycy
/Vj&Qi
L@k$5!F&
}Y]FcbK
qY]FcbK
eT14\YD&
kVy?5RF
?[okj)
?5b^rD
ookjQGV#t
?okjyV#e
? okjV#
%4A^:y
;5b^c&
U@oYN45b
U@oYN45b
U@oYN45b
U@oYN45b
U@oYN45b
U@oYN45b
U@oYN45b
U@oYN45b
U@oYN45b
ret2wer3t1wer3twer42342X{V
GetModuleHandleA
GetProcAddress
KERNEL32.DLL
USER32.dll
LoadIconA
GDI32.dll
CreateBitmap
ole32.dll
CoUninitialize
WinSCard.dll
SCardForgetReaderW
WS2_32.dll
lQ+QQQf
UWVS|$
t$dD$\
T$L3;\$L
t$t#t$lD$`T$x
D$t#D$hl$x
D$t+D$\$
D$@d$@L$@
;s#D$H
t".)D$H+r
)D$H+r
L$H+t$`+
T$8L$PL$xf
D$\l$TD$X3|$`
D$`L$D
;s`)L$4|$4
t$4D$H|$t
D$`D$t+D$\
l$8f++
D$T&++f
T$TD$PT$PL$XL$Tl$\D$\l$X3|$`
;s/D$H
;s;D$H
)D$H+f
t$(Nt$(uL$0
T$,|$`
)D$H+f
l$$Ml$$uP
)D$H+f
$L$ d$
p4$Ft$\tZL$
9l$\w`$
BD$tIt
Fvlhhup"F~
*$dhik|
SSTRT[TNQT\A
Y_^LM`A
?w{&cm!
y<t@Df
b#23650441354003/]
xxy1q599
xSSy17
Fvlhhup"F~
*$dhik|
SSTRT[TNQT\A
Y_^LM`A
?w{&cm!
y<t@Df
b#23650441354003/]
$flEP}^e
sq * /
*8 0 / 1
ss"-#.
/"2#0 0
:D:D=KESCP8DAN@N7D?KDQ?L:G:F<H7B
0@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@mnf
@H9Cos@
z%.w}@
XaLTUd@
CQBU\chp?JAQFP@
+ZaOT~!,+:R`@
KX]hy]mRaYjyu,9
0<N+80?2D2D5C5CQ[@
CSZk#:Yh@
'>)>ly@
WkVi 9k{@
88HTh@
6$@Vc@
$@$,@
-@ 0@ 0@
"@U]Za[eZa[a[`Z_XcXbZ`[`Z^ZbZbZbZb[bZbZbZbZb[`[`
rss@+2@ #"0!-
&NTinn@+2@ $"-
$QXhp1>
)AItwlr=D
*gkU[%2
& .V^;88@.3@ #"( , (
#IR -#2 .}.9
'5>".!0 . -!.#3 .!-#0
~}rv}rusz}{
.3@ # *!0"1#0 -
bk)4 ."/
$3B#1&5#1"-$.!0!/#0#0
nsonso|} .3@ # '#5#5%9&4
&am?P -ek/?$6#5$8#5"2$8$6 -RZ
+0@ #'5%5"3#4!2
,S`cq#1#17?"/$5"1#4!2#4$5!0S_
+0@ #&2$6%9$8#4!1M\q~es#2"4bnKW(<#3&:'9&6%9$8&7!0U_
+0@ #(5&4*6'<#5
(MZo{clYc
23>'8)?+A%;':&7'=*@&:"1U_
.4@ #'4'4(.'9(;"1HUP]
+cq&8';';'<+0'9)>#1T_
/4@ $+:*<+:,?%9$5wXc(9gtXb&;#3Tc':(;(;+@,A*=*?(>\j
29@ $(8)?)?*@*?(>2F:J;K0@*=-B3G:J8K1B)?+A+<<Q9I8M:N2F+<*=->*;*=->+?$3\j
$*9"-!+*=(9'9
5M.EOaWbPZU`\nZkYgR^Q]TbZgZk\hXeUbXeVcXeVe[hZfVeQ[~
EgkcgkcflaenaemcikefkbenaenaenaenaenaenaenaenaenaenaenaenaenaenaenaenaE
:E/9qwj
BXntswj
9KjtxFX8Fouh
"7$4UhYmWiNXouj
@U'>mrh
F]":mrh
@XL`mrh
9V%;lsf
PVO78E (
4@zAN~BO~FR
CN~@N~BM~DO~BO~ETDR
ETCPBN
49/ ( '
()5QZ7D
#zvovnnviE!(
)r~4A\i4F
&"( /!6
/r|^q^n5C
-ES!4"7 4"8"8 4
!("+"+"7 3r}bp
/ 5#9$4#9
#,#,#:$:%=-ACR4C"60EAR:K!6#6DVCUAS$8$8$7#6%9 1
!3/J_q|}y{|
KERNEL32.dll
GetModuleHandleW
InterlockedExchange
GetFileAttributesA
GetLastError
GetCurrentThread
VirtualFree
GetModuleHandleA
TerminateProcess
GetProcAddress
OpenEventW
OpenEventA
OpenSemaphoreW
FindClose
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
VirtualAlloc
RemoveDirectoryA
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
WriteFile
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapReAlloc
HeapAlloc
GetCurrentProcess
HeapSize
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
HeapFree
RtlUnwind
GetStringTypeW
USER32.dll
LoadIconA
SetWindowPos
EnableWindow
GDI32.dll
CreateBitmap
SelectObject
ole32.dll
CoUninitialize
WinSCard.dll
SCardForgetReaderW
WS2_32.dll
C
k e r n e l 3 2 . d l l
@ j j j j j
( ( ( ( ( H
D i a l o g
C a n c e l
s i a l o g
C a n c e l
, / K P i p
/ - P ? p R
, / K P i p
/ - P ? p R
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 4 1 9 2 4 b 2
B u i l d V e r s i o n
7 , 1 5 , 2 2 , 1 2 9
V a r F i l e I n f o
T r a n s l a t i o n
C : \ R a i d e n \ G o a t \ F T P \ S a m p l e \ 5 1 A 7 4 F D F 5 3 A 4 E B E A 7 B 0 D 1 D F 5 F 8 E 9 E 9 D 6 . b i n . e x e
C : \ 4 b f 0 3 c e 2 8 6 f e d b 4 b 1 6 8 e f 0 a 5 4 8 3 f b c f 0 b 1 4 5 b 8 7 6 5 c 5 f 4 2 0 5 c 7 b 1 1 d 4 2 8 2 f 0 e c 1 4
C : \ U s e r s \ D o n a l d \ A p p D a t a \ L o c a l \ T e m p \ 8 0 0 1 b 5 8 1 2 f 3 8 2 d 8 7 2 1 3 0 5 8 1 a 9 0 8 d 9 6 3 b 6 2 3 d 3 9 a e . e x e
C : \ 3 f b 5 2 2 2 8 1 9 4 4 6 0 0 f 7 f d 8 8 d a 5 9 6 2 9 e d d e 0 f 2 2 3 2 8 9 f 8 0 5 8 d 8 d 0 4 d 3 9 d 5 4 4 f 4 2 c 4 4 3
C : \ e 4 f 9 9 f 5 f 1 e d e 1 2 4 0 e 5 2 0 f f a 3 1 c 4 4 d d 5 1 d b f 7 4 7 b 4 d 8 4 2 f 8 1 f 7 8 f 2 6 5 5 0 e 1 5 4 f a 8 2
C : \ H F V S L 0 V E . e x e
C : \ z 4 i r L u H H . e x e
C : \ 9 4 8 8 6 d 8 c 9 5 e 4 a 0 b 4 7 3 a a 2 7 c 2 d 6 6 1 b d b 8 7 8 8 3 1 4 e 7 e 2 b 3 8 b c 5 6 0 3 8 e d 0 f 4 a e e e 0 7 1
C : \ a b b 1 1 1 0 0 2 c b c 6 d 7 1 9 4 8 d 8 2 8 6 3 b 7 1 6 4 f 2 5 7 6 c 3 2 3 6 9 5 b 6 a c 8 1 6 2 b 6 e 3 a 8 2 f d e 3 c 9 a
C : \ a 0 3 8 c 0 9 e e 3 d 3 6 5 2 5 1 9 2 d 0 9 c 7 7 3 1 f 5 9 8 8 e 4 3 1 7 d b 7 3 1 3 c 2 1 b 8 8 e a 3 6 c b f 9 7 3 c b f 0 d
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 7 p Q G 4 m r X . e x e
C : \ 1 9 e 2 1 7 4 a 0 b 7 5 6 a e e 2 9 6 b 3 4 6 f 6 d 6 0 c 3 c f 0 e a 5 b 8 8 9 b 3 d 5 a 1 7 5 7 3 6 1 6 f c e b 5 4 5 a 3 2 8
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 4 t r z C R D 7 . e x e
C : \ o 3 2 B D P p Z . e x e
C : \ 0 a 8 d 7 b 0 1 2 0 4 4 0 7 c e 5 0 7 1 b 5 6 e 9 b f e c 3 8 2 e 4 f d d 5 2 b c 2 7 7 7 9 f 2 9 e b a b b 8 c 1 d b f 2 b 2 1
C : \ 3 f f a 9 7 7 1 4 7 e 3 e d a b d e d 7 1 2 3 f 5 8 2 c e e 1 6 8 6 8 0 7 5 6 9 0 2 5 4 3 8 6 2 5 d a 5 1 6 d 1 6 9 e 0 c 0 2 c
C : \ 5 f 6 e 1 0 6 6 9 a b 6 c a a 9 3 5 9 9 3 1 2 b a 3 3 7 4 f d e 7 1 d 5 3 c 8 f e 3 d 3 5 d e b d a 9 a 5 3 7 3 5 3 9 0 3 8 e 7
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ z B 9 4 d E m X . e x e
C : \ 6 6 e 6 1 c 3 5 9 a 0 6 1 1 7 0 a 8 9 f 3 6 b f f f 4 2 6 d e 6 7 d 5 f 9 6 3 d d 2 1 1 b 0 4 9 0 9 c 6 f 2 1 6 b 8 e 4 3 f 3 9
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ n D 8 G 3 j i V . e x e
C : \ 3 a 3 d 1 1 e a 5 4 6 b 8 1 2 4 d e b f 7 6 c f b 9 5 e d b 6 c c e 0 a 3 c 6 2 d f 1 0 7 e d 7 a 1 1 5 3 c 7 4 b b 1 a 1 2 f f
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ m q y K i R u A . e x e
C : \ c m a d R Y s L . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ o Z e K m M W X . e x e
C : \ 0 l 8 h O x J X . e x e
C : \ b 8 3 a c 9 3 1 a f 2 1 6 b 8 7 d 8 1 f 9 7 6 1 d 5 b 3 e 7 8 6 7 c b 5 f c 1 1 9 f 8 a 0 c d b e 1 c b 8 4 3 d 9 4 d 3 e b 5 3
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 4 M d a O G C k . e x e
C : \ 3 S V z 6 z A D . e x e
C : \ 7 2 7 5 b 5 5 7 1 4 3 3 8 d 9 1 f 8 d a 6 3 c e 7 3 5 a 3 c 6 7 1 e 1 3 4 9 b 0 e c b f c 5 4 2 2 7 9 2 3 d a b 1 c 3 e e d b 3
C : \ 8 0 0 f 2 1 e a 4 4 6 b d 5 0 a 0 a f c 3 d f f 9 8 3 c 4 e 8 8 3 b b 9 1 5 8 f 5 b 2 b c 3 9 7 c 0 6 e 2 2 5 6 2 9 2 0 0 c 5 8
C : \ b 2 5 7 4 c b 7 c d 2 8 5 a f 6 1 b d 2 1 b 0 0 f c 5 d e d 4 8 3 0 8 d 7 e 8 e 1 6 e 5 a a 2 7 0 3 2 3 4 c b 8 c 6 4 2 6 f 0 6
C : \ 3 g T I 9 _ w f . e x e
C : \ e 9 d a 1 e 6 0 e b c 8 f 3 d e 5 3 0 b 8 e 0 6 9 1 8 7 d 8 8 d 4 b e b 2 7 d b 8 0 2 7 0 c 5 6 4 0 e e 2 4 e 1 6 9 c b e 3 1 6
C : \ x 9 3 V r b m c . e x e
C : \ 6 4 7 f 9 7 2 8 7 6 2 4 e d 5 d 4 1 8 9 c 6 4 3 f 8 f 2 0 9 7 2 9 7 0 6 f 2 1 9 f 0 b 3 6 9 e 5 1 f b d 7 a 5 b 7 3 5 4 e e 2 2
C : \ 6 2 3 4 9 c 1 a 7 8 e 9 d 5 8 c 1 8 0 7 8 0 b e c f d 8 5 5 5 e 5 b 0 6 b 5 d 1 2 5 6 4 1 a f 4 e 7 b e 1 a 7 2 c 7 a 5 8 f 2 2
C : \ J y q P j h M o . e x e
C : \ d d 4 d b 2 e c 2 b 9 9 8 d f d a a 5 5 6 5 8 e 3 a 8 1 9 6 c 2 9 f 2 c b 8 f 2 d 7 d 5 5 b 3 5 4 3 8 6 f 9 a 7 0 6 b a b 7 e 0
C : \ 0 a e 4 1 6 5 1 d 6 1 7 d 0 e a 8 4 a e c f 6 9 0 c b a 7 0 e b f 9 3 f 9 7 b e a 0 e c c a b d 1 9 9 7 e 7 1 a 9 a d b b 8 9 d
C : \ o o F R O g y 3 . e x e
C : \ 9 4 1 5 3 f 5 d 2 c 9 5 8 5 6 2 d 1 9 0 5 d 5 9 b 2 8 2 f 7 0 3 6 8 7 4 2 e 3 b f f 4 3 1 7 5 b a e e d 9 0 b c 2 2 c 4 3 1 5 3
C : \ 8 d 0 8 6 7 9 f 7 d 5 3 6 4 c 3 5 2 3 2 4 c 4 a f 2 6 1 8 e 9 b 4 7 f 6 b d 1 1 f 6 5 a 8 9 4 8 9 f 5 5 2 e b d d 8 2 3 b 7 f 0
C : \ f d c e 1 3 a d 8 f 4 c 0 d a 2 b 7 0 1 e a a f 5 3 2 2 2 4 8 b 4 b c a 9 0 2 4 6 9 3 d e 4 7 c 4 a d 1 b 4 8 b b d 9 9 5 5 d 9
C : \ 7 1 3 c 5 0 b 3 c f 8 6 5 c 8 5 0 c 9 d c 0 c 3 c a e b 0 9 e 0 f 4 d 5 6 f 6 9 e d a 5 a 9 6 9 6 3 6 e f 5 0 8 5 3 6 1 a 5 a c
C : \ d 6 7 b 7 e 0 1 f 9 4 4 c a a c 3 5 6 0 9 8 9 1 f 0 1 5 9 a e 9 c f 6 8 9 3 e b 7 e d 9 4 c a 2 7 a 8 4 a f 6 d e d 6 3 5 b 1 7
C : \ 8 c 1 4 4 8 0 4 a 9 b e 2 5 1 c 4 e d e c 1 b 5 d 2 9 0 2 f d d a c 1 3 1 4 a 0 9 f 4 4 e c f 6 4 4 6 d 1 a c 0 3 f c a b 9 f 1
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 5 4 A M A W J 0 . e x e
C : \ o z T C J v k A . e x e
C : \ b e e 5 7 e c d 1 b f 8 5 a c f 4 c 1 7 6 f 6 b c f 5 d 4 4 1 a f 4 3 c e 6 f 2 b e 5 b 9 8 3 7 9 8 3 6 7 6 0 3 a d 6 f 5 9 f 3
C : \ 1 b 3 1 a f 6 d 3 6 9 3 7 d 6 7 5 b d 8 a e b b a 3 c b 1 f d d f 1 1 c c e 8 1 0 2 a 2 3 c 7 8 9 0 c 7 8 1 5 4 0 f c 8 6 3 e 3
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ g 1 E Q G p 3 t . e x e
C : \ Z Z Z s 6 t e u . e x e
C : \ e 0 f 4 a b 2 1 a 4 a f 3 4 c 1 b e 9 b f 7 6 3 c c b e 4 4 f 7 3 e 1 4 6 4 3 a a c f 5 3 a 1 8 3 d 0 8 5 3 e f b 9 8 b 1 9 2 2
C : \ 8 5 f 1 a 4 f 8 a 7 5 f c 4 4 f c 3 c a 6 8 3 8 c b e 2 e b 8 f 0 5 e 7 6 b e 4 5 c 0 f 6 2 f 0 a 9 1 4 a 1 e d 7 a d b 7 4 b 2
C : \ l L r W i 1 e l . e x e
C : \ 6 8 f a e 5 d 1 0 6 c 2 7 1 7 c 5 7 a c 4 c 8 3 1 a 4 0 6 c 4 9 d 0 1 c 2 1 4 d 8 e 0 7 7 1 8 b 1 3 7 a 9 4 0 2 8 f 3 4 5 7 1 1
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ 6 s N t 4 D 3 t . e x e
C : \ 2 7 a a 6 1 5 a 7 3 1 1 6 e 5 1 6 8 6 b 8 1 6 8 d 7 5 e 2 4 0 0 d e c 3 7 7 8 c e a 4 c 2 3 e 1 2 8 4 0 1 e 1 b 5 e 7 a 2 3 b 9
C : \ 7 b 0 3 e 1 0 d 4 e e 2 8 6 8 4 9 d c b a e f 2 4 1 2 f 5 f e c 9 c 5 8 1 e 8 6 4 1 1 c d 5 f 6 4 c f 4 b 8 2 5 5 6 7 e 3 3 9 2
C : \ 4 9 9 e e 6 1 4 f a 5 0 6 7 e 7 d b a 2 c 0 0 b 1 1 5 e b 2 e a 7 e e e 1 4 e b e 5 d 4 f 8 f 8 0 b 6 5 5 5 f f 2 b 4 3 9 0 8 a
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ I l K b M 5 x p . e x e
C : \ 0 b e 0 8 1 9 d 0 3 d 2 4 e 2 0 8 c d c f b 3 4 d e 9 9 2 c a f 0 0 e 4 3 a 6 2 f a f a 4 b a 9 f f 5 1 c 3 7 2 9 c e 7 f 7 b 4
C : \ 6 4 4 1 3 2 b b e 2 3 3 7 2 8 5 d 3 0 0 c c a a 0 b 1 a 7 0 a 6 c f c 8 4 2 a f 7 e 8 d 4 e c c b b 7 f f d b 2 e f a 2 b 2 4 4
C : \ G M 8 M G v E z . e x e
C : \ M p 9 9 4 k x R . e x e
C : \ e 3 d 9 3 2 5 9 7 2 a f 1 0 b 8 6 8 9 2 7 4 7 8 4 5 6 7 6 7 2 7 3 f a 6 c 2 5 1 1 a 5 c a 8 e 6 6 0 b 0 5 b 7 c c c 3 2 d 6 3 d
C : \ 4 0 0 c 6 1 3 f 4 2 c 6 a d b 2 b 6 1 8 c 2 4 a 0 c 4 4 5 e a 2 9 0 f e 1 a 5 6 2 0 6 6 1 7 2 a 6 c 9 5 8 a 4 5 c 5 a 0 8 8 4 a
C : \ b 6 l 1 X p K h . e x e
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 8 f 8 6 1 f a b 7 9 5 2 f a a d 1 1 9 3 3 8 a a 9 d 6 3 6 4 b 2 b 2 1 c c 9 d 5 d 1 7 6 3 7 3 9 9 2 1 2 0 6 2 d a 4 5 0 6 a 5 7 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a h y g u y s . e x e
C : \ e 8 4 6 9 d 9 3 9 c a 9 7 0 f e 4 3 9 7 d 4 c d 1 a 3 0 1 a 1 3 6 e 5 4 9 8 1 b f f b 3 2 1 b 0 5 4 2 0 3 b f 0 4 b b f f a 7 d
C : \ 9 0 a f 7 4 c 4 8 5 4 c c e d 8 3 8 f 5 4 d 0 e 6 1 3 a c d c c 0 5 7 f 6 9 4 2 e b 8 1 1 b 0 7 e 5 0 8 2 6 6 f c 7 7 4 9 1 e 2
C : \ b 4 6 3 7 2 8 3 6 5 9 7 1 8 b 6 9 a c 3 1 0 6 3 3 2 0 a c b 1 b f a 3 0 1 f 9 e 2 5 6 1 1 8 1 9 c 2 a 3 8 1 4 8 0 a d 9 4 c a 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a h y g u y s . e x e
C : \ 1 1 f d 8 1 9 6 d 0 b 5 7 5 9 e 3 4 3 3 c c e d 8 3 f 2 2 c 4 5 0 d f 7 6 b 8 1 f 0 8 a 2 5 3 4 2 b 7 a 1 6 8 a a c b 6 0 8 d 7
C : \ 7 d 8 5 4 b e 5 f b 2 1 c 4 a 6 9 b e 8 5 5 7 f 7 b b 4 9 0 5 d 9 c 9 f c 5 1 5 8 4 7 f e 6 c 7 d 6 b 7 d 1 4 8 c 7 e 8 a 6 3 b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a h y g u y s . e x e
C : \ 0 1 f 3 9 9 7 4 3 c 4 e 1 3 c 1 a 5 6 8 5 2 a 5 3 9 9 9 6 2 7 0 9 3 b 8 a f 9 7 0 8 9 b 1 b 6 f 0 3 d 3 3 4 b 4 8 0 e d f 9 f 7
C : \ 5 6 c 7 c 8 2 0 f b 0 6 5 5 8 3 4 e 9 c 4 7 3 e c b 7 c 1 5 7 8 c c 1 b e a 4 0 c 7 e f 0 4 3 8 8 a 7 2 a 1 0 e 6 c d c f 7 f 1
C : \ 4 7 d 7 9 7 6 a 5 9 2 a 0 1 b b e a 5 5 3 2 b c 2 6 1 6 6 2 0 b b 6 6 a a 3 6 f c a 2 5 e 6 a f f 0 f c d c 7 0 2 9 5 1 e f f e
C : \ b d 7 a 8 f f 1 9 c b 1 2 b 9 2 4 c 1 6 1 d 7 4 0 f f 1 c 1 d e 1 3 b 6 0 0 7 0 2 d f 9 0 4 f e 4 2 f 8 4 c 0 f e d 6 7 d 8 2 d
C : \ d 4 5 2 e d b 0 3 c 6 1 5 3 6 b 0 4 7 3 8 a d 7 b 1 b a 5 e a 7 f 6 2 6 9 2 6 f 8 5 b 6 0 1 e b b f 6 b 0 c 4 c b c 2 9 f 9 6 3
C : \ e 5 e 3 3 2 c 2 6 c d e a 4 4 f 7 e 5 1 4 d 9 f d 1 f 3 b 5 5 8 b 0 9 5 9 b 8 5 0 9 3 2 5 0 9 4 d a 6 d 8 4 9 f 6 6 6 f 5 8 5 a
C : \ a c f 1 9 0 9 b c 2 1 e 0 7 7 9 5 7 2 1 c 7 9 e 6 1 6 b 5 8 7 6 7 7 1 a 3 5 2 7 b d 1 1 8 4 8 8 1 a 8 0 9 2 9 2 b f 3 a 7 8 e c
C : \ c a 5 d f 9 c 1 4 b 2 b c 8 d 0 d 6 d b b a 7 1 1 3 1 f a e c 2 9 8 4 4 2 5 b c 8 d 7 e f d a e a 9 f d 9 8 8 c d d 0 9 7 7 1 d
C : \ b a 6 8 a 2 2 f d b 9 f 2 e 6 1 d 8 d b 7 1 0 8 7 a 8 b 1 2 9 7 8 5 0 4 1 7 9 2 5 4 8 5 1 b 1 7 a f d 5 c e 6 5 a f 3 f 8 1 6 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a h y g u y s . e x e
C : \ c 4 1 7 3 a 0 1 8 c a 0 4 5 3 9 a 6 1 c 2 9 c 5 6 5 6 1 2 9 1 e e 8 4 3 e e e 4 0 3 e 9 c 2 6 c 8 a 6 b 6 e 9 a 0 a 1 3 c 2 c c
C : \ 0 0 f 9 0 d 2 f a 1 5 d c d 4 f f a f c a 7 3 d 2 3 b 0 6 e 1 8 7 3 5 f a c 5 1 a 0 4 a 8 6 f 7 c a f b 0 a 9 c b 5 a 9 6 b 6 b
C : \ 2 6 f 3 f e 7 0 9 b a 3 4 8 9 c f 4 5 2 6 c 3 a 7 d 9 5 c 9 c a c 5 b c 8 a 6 2 9 3 4 d 2 1 d 1 b 6 e e 1 5 1 1 b 3 0 d c c d 4
C : \ e 0 9 b f 0 8 b f 6 b 1 6 d f 5 4 0 3 7 3 c 8 0 1 a 4 2 1 b a d 6 0 1 8 3 c 6 e 8 1 c 4 7 f 6 a e 5 5 1 c 2 2 a 4 6 3 0 7 3 8 f
C : \ 9 8 5 8 1 3 8 5 0 8 8 6 7 e 4 8 3 c 7 a 4 0 8 0 4 d 4 a f a 6 a 2 4 d e 9 7 3 2 7 4 8 e a 0 7 3 d f c 7 e 5 c 9 2 b 1 c 1 f 6 d
C : \ b 8 1 1 5 f 4 e 5 b e b 8 3 6 4 5 9 9 5 a f 4 6 f 1 7 6 a 7 6 e f 1 c 9 9 f 8 1 3 6 f 7 d c a f 4 3 1 6 4 4 b 3 c e a 7 2 f 8 6
C : \ 2 1 9 b 0 7 7 3 1 5 4 8 e 3 e f 5 5 6 1 c 2 a 4 1 a 9 c a 3 3 5 b 6 0 1 8 f b 6 b 5 1 f 3 a a e c 9 c e e e 2 4 6 6 6 5 b d 9 e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a h y g u y s . e x e
C : \ 0 7 7 2 e a d 7 1 6 9 0 a 8 b f a a d 3 e 8 4 7 d 9 0 9 9 7 4 c f 8 3 6 d a 3 0 8 3 7 c b 3 0 5 3 2 2 a 6 9 6 0 9 9 3 a 1 1 9 5
C : \ d f 4 7 5 9 c 3 e f 5 c a 1 c 1 9 4 1 5 b 2 b 7 2 9 2 3 9 d 1 b 3 3 b 5 3 b e 5 a 4 0 5 0 9 f c e 4 4 8 3 0 2 2 8 8 8 3 7 3 e 8
C : \ c 9 3 f a f 1 9 3 0 a 7 3 e 5 3 b 2 5 3 7 6 0 6 0 4 6 0 9 0 7 e e f c 2 4 a 7 d c b 1 4 6 2 6 5 b 3 8 4 c b 3 c b 9 f c 5 9 0 4
Process Tree
-
0082b8277332114e947c4935ac454b2f6c52e7a58d5a98bdbc9b4db25269adeb.exe (2600)
"C:\Users\Administrator\AppData\Local\Temp\0082b8277332114e947c4935ac454b2f6c52e7a58d5a98bdbc9b4db25269adeb.exe"
- ahyguys.exe (616) "C:\Users\ADMINI~1\AppData\Local\Temp\ahyguys.exe"
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | fc10cfcb62381275_ahyguys.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\ahyguys.exe |
| Size | 936.7KB |
| Processes | 2600 (0082b8277332114e947c4935ac454b2f6c52e7a58d5a98bdbc9b4db25269adeb.exe) |
| Type | MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS |
| MD5 | 0a0992eb313195a19e2c2ee2758df9b5 |
| SHA1 | eeea1fa9c0e4bb080413f7c4a404ad382f6c8bd2 |
| SHA256 | fc10cfcb62381275d6200e8dd4efc607bed8b76541bbee83f253f0179c0c5d9e |
| CRC32 | DE858A2C |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.