1.3
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.66
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Malware-gen | 20200106 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Spy.Zbot.a | 20190318 | 1.0.0.2 |
| Kingsoft | None | 20200106 | 2013.8.14.323 |
| McAfee | PWSZbot-FEV!42E531299014 | 20200106 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b07a57 | 20200106 | 1.0.0.1 |
静态指标
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(2 个事件)
| section | .MPRESS1 |
| section | .MPRESS2 |
文件包含未知的 PE 资源名称，可能指示打包器
(1 个事件)
| resource name | PNG |
动态指标
在 PE 资源中识别到外语
(2 个事件)
| name | RT_ICON | language | LANG_RUSSIAN | filetype | None | sublanguage | SUBLANG_RUSSIAN | offset | 0x000110b8 | size | 0x000025a8 | ||||||||||||||||||
| name | RT_GROUP_ICON | language | LANG_RUSSIAN | filetype | None | sublanguage | SUBLANG_RUSSIAN | offset | 0x000136a0 | size | 0x00000014 | ||||||||||||||||||
网络通信
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
文件已被 VirusTotal 上 54 个反病毒引擎识别为恶意
(50 out of 54 个事件)
| ALYac | Trojan.Downloader.JQAP |
| APEX | Malicious |
| AVG | Win32:Malware-gen |
| Acronis | suspicious |
| Ad-Aware | Trojan.Downloader.JQAP |
| AhnLab-V3 | Trojan/Win32.Upatre.R284255 |
| Antiy-AVL | Trojan/Win32.Buzus |
| Avast | Win32:Malware-gen |
| Avira | TR/Dropper.Gen |
| Baidu | Win32.Trojan-Spy.Zbot.a |
| BitDefender | Trojan.Downloader.JQAP |
| Bkav | W32.AIDetectVM.malware |
| CAT-QuickHeal | Trojan.GenericPMF.S6771081 |
| Comodo | TrojWare.Win32.TrojanDownloader.Small.PR@5276zr |
| Cylance | Unsafe |
| Cyren | W32/Upatre.IJ.gen!Eldorado |
| DrWeb | Trojan.DownLoad3.28161 |
| ESET-NOD32 | a variant of Win32/Kryptik.BIYN |
| Emsisoft | Trojan.Downloader.JQAP (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Upatre.IJ.gen!Eldorado |
| F-Secure | Trojan.TR/Dropper.Gen |
| FireEye | Generic.mg.42e53129901420de |
| Fortinet | W32/Kryptik.BIYN!tr |
| GData | Trojan.Downloader.JQAP |
| Invincea | heuristic |
| Jiangmin | Trojan/Buzus.bnwn |
| K7AntiVirus | Trojan ( 0052964f1 ) |
| K7GW | Trojan ( 0052964f1 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| MAX | malware (ai score=85) |
| Malwarebytes | Trojan.Upatre |
| MaxSecure | Trojan.Upatre.Gen |
| McAfee | PWSZbot-FEV!42E531299014 |
| McAfee-GW-Edition | BehavesLike.Win32.PWSZbot.ct |
| MicroWorld-eScan | Trojan.Downloader.JQAP |
| Microsoft | Trojan:Win32/Zbot.DSK!MTB |
| NANO-Antivirus | Trojan.Win32.DownLoad3.cjdyni |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM10.1.6125.Malware.Gen |
| Rising | Trojan.Waski!1.A489 (CLASSIC) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Symantec | SMG.Heur!gen |
| Tencent | Malware.Win32.Gencirc.10b07a57 |
| Trapmine | malicious.high.ml.score |
| VBA32 | Trojan.Fareit.2883 |
| VIPRE | Trojan.Win32.Generic.pak!cobra |
| ViRobot | Trojan.Win32.Upatre.51256 |
| Yandex | Trojan.Agent!d/6CB0IKwU8 |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2013-08-28 00:13:37
PE Imphash
5f259a07286d0de03289b72c296c1693
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .MPRESS1 | 0x00001000 | 0x0000f000 | 0x0000f000 | 4.199281949913939 |
| .MPRESS2 | 0x00010000 | 0x00001000 | 0x00001000 | 5.403997491840931 |
| .rsrc | 0x00011000 | 0x00004000 | 0x00004000 | 4.459709332491716 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| PNG | 0x0000c138 | 0x0000077c | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_ICON | 0x000110b8 | 0x000025a8 | LANG_RUSSIAN | SUBLANG_RUSSIAN | None |
| RT_GROUP_ICON | 0x000136a0 | 0x00000014 | LANG_RUSSIAN | SUBLANG_RUSSIAN | None |
| RT_MANIFEST | 0x000136f4 | 0x0000015a | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library gdiplus.dll:
• 0x407148 GdiplusShutdown
• 0x40714c GdiplusStartup
• 0x407150 GdipDrawImageI
• 0x407154 GdipBitmapGetPixel
• 0x407158 GdipGetImageHeight
• 0x40715c GdipGetImageWidth
• 0x407160 GdipDisposeImage
• 0x407164 GdipFree
• 0x407168 GdipCloneImage
• 0x40716c GdipAlloc
• 0x407170 GdipCreateBitmapFromStream
• 0x407174 GdipDeleteGraphics
• 0x407178 GdipCreateFromHDC
Library KERNEL32.dll:
• 0x407008 GetStringTypeW
• 0x40700c MultiByteToWideChar
• 0x407010 LCMapStringW
• 0x407014 HeapSize
• 0x407018 RtlUnwind
• 0x40701c Sleep
• 0x407020 IsValidCodePage
• 0x407024 GetOEMCP
• 0x407028 GetACP
• 0x40702c GetCPInfo
• 0x407030 TerminateProcess
• 0x407034 IsDebuggerPresent
• 0x407038 UnhandledExceptionFilter
• 0x40703c GetProcessHeap
• 0x407040 HeapAlloc
• 0x407044 ReadFile
• 0x407048 CloseHandle
• 0x40704c HeapFree
• 0x407050 WriteFile
• 0x407054 LoadLibraryW
• 0x407058 GetProcAddress
• 0x40705c HeapReAlloc
• 0x407060 FreeLibrary
• 0x407064 LoadLibraryA
• 0x407068 GetModuleFileNameW
• 0x40706c FindResourceW
• 0x407070 LoadResource
• 0x407074 SizeofResource
• 0x407078 LockResource
• 0x40707c GetModuleHandleW
• 0x407080 EnterCriticalSection
• 0x407084 LeaveCriticalSection
• 0x407088 GetSystemTimeAsFileTime
• 0x40708c GetCurrentProcessId
• 0x407090 GetTickCount
• 0x407094 QueryPerformanceCounter
• 0x407098 HeapCreate
• 0x40709c InterlockedDecrement
• 0x4070a0 GetLastError
• 0x4070a4 GetCurrentThreadId
• 0x4070a8 GetCurrentProcess
• 0x4070ac IsProcessorFeaturePresent
• 0x4070b0 GetCommandLineA
• 0x4070b4 HeapSetInformation
• 0x4070b8 GetStartupInfoW
• 0x4070bc SetUnhandledExceptionFilter
• 0x4070c0 ExitProcess
• 0x4070c4 DecodePointer
• 0x4070c8 GetStdHandle
• 0x4070cc GetModuleFileNameA
• 0x4070d0 FreeEnvironmentStringsW
• 0x4070d4 WideCharToMultiByte
• 0x4070d8 GetEnvironmentStringsW
• 0x4070dc SetHandleCount
• 0x4070e0 InitializeCriticalSectionAndSpinCount
• 0x4070e4 GetFileType
• 0x4070e8 DeleteCriticalSection
• 0x4070ec EncodePointer
• 0x4070f0 TlsAlloc
• 0x4070f4 TlsGetValue
• 0x4070f8 TlsSetValue
• 0x4070fc TlsFree
• 0x407100 InterlockedIncrement
• 0x407104 SetLastError
Library USER32.dll:
• 0x40710c DispatchMessageW
• 0x407110 TranslateMessage
• 0x407114 GetMessageW
• 0x407118 CreateWindowExW
• 0x40711c RegisterClassExW
• 0x407120 LoadCursorW
• 0x407124 DefWindowProcW
• 0x407128 FillRect
• 0x40712c GetClientRect
• 0x407130 BeginPaint
• 0x407134 InvalidateRect
• 0x407138 PostQuitMessage
• 0x40713c SendMessageW
• 0x407140 EndPaint
Library GDI32.dll:
• 0x407000 SetPixel
L!Win32 .EXE.
.MPRESS1
.MPRESS2
UQVEPF
MVR^_]3_]
UQEPQE
YY]jXh@
8csmu*x
YYuTVWh0"@
3]j h@
u hd{@
3PPPPP
@Y<v*Vb
^SSSSSyj
;tFtA3
M_^3[O
S^`N`H
j$Y~\d9
QY^`[_^]
VW39=,@
t.t$<"u
3Y[_^5\@
3PPPPP
FA>\t>"u&
uUEPSS}
=?sJMsB
Y;t)UEP
3wf93t
f90uW=p@
VVV+V@PSVVE
E;t8Pa
YE;t*VVuPuSVV
j@j ^VF
H3H/5 @
;rSWf9M
YYt:V5H@
YF\={@
~lt#WS
43_V5Xp@
YYt0V5H@
1E3PeuEEEEd
Y__^[]Q
E_^[]E
9csmu)=
E3E3;u
F$|3@_^
h3G}39
Y+t"+t
+tY+uC}
Uw\]Yp
u>OdMGd
u wdSUY
ffffffE
3PPPPP
UQSV5p@
;r>PuA
B(;r3_^[]
1E3PEd
tAt2t$
t?P5L@
3M_^3[
ft'Ou"+
jPfDJXdf
^06_^]
WPWPWv
j kYrj
whu;5@@
8]tEMap<u
TM_^3[j
QM^}_hu
YYu,9E
3W;to=@
fYY~PE
PAY9_t
t4V0;t(W8jYt
Fpt"~l
j mYtj
lVYYYEE
nYuSVWT$
URPQQhC@
t;T$4t
;v.4v\
UVWS33333[_^]
33333USVWj
_^[]Ul$
DDDDDDDDDDDDDD
S3VW;~ E
@;u+H;}
39](SSu
]9]tWuu
};~Bj3X
3;t?uWuuu
t"SS9] u
EWMYuDEYe_^[M3
Mu(Eu$u u
ES3VW]9]
39] SSu
EYe_^[M3x
Mru$Eu
woVW=@
Y3MW0u
v(v,v0v4v
v8v<@v@vDvHvLvPvTvXv\v`}vduvhmvlevp]vtUvxMv|E@
PYv4;5@
PYvL;5@
V~Y^]USVWUj
P(RP$R
t:|$,t
;t$,v-4v
UQPXY]Y[
FGIuX^_]
KuZUQL$
@;r[_^U0SVWEP
N<|1x\1xUR
WSVMEVirtEualAEllocE
EEPWSVMEVirtEualFEree
(MuMEt,
SU_^[]
vl39\$
V=T$ Vj
UdSVWD$
t$LD$PY@
t$Tt$XT$\t$`
D$\D$@Pt$dt$hD$l
VVVT$0R
VVVT$0R
:++;sNq
V33M9C
r_^3[]
EP_^[]
UQSVW=
@;rUQV
3+t8Ht
gdiplus.dll
GdiplusShutdown
GdiplusStartup
GdipDrawImageI
GdipBitmapGetPixel
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipFree
GdipCloneImage
GdipAlloc
GdipCreateBitmapFromStream
GdipDeleteGraphics
GdipCreateFromHDC
KERNEL32.dll
GetStringTypeW
MultiByteToWideChar
LCMapStringW
HeapSize
RtlUnwind
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
TerminateProcess
IsDebuggerPresent
UnhandledExceptionFilter
GetProcessHeap
HeapAlloc
ReadFile
CloseHandle
HeapFree
WriteFile
LoadLibraryW
GetProcAddress
HeapReAlloc
FreeLibrary
LoadLibraryA
GetModuleFileNameW
FindResourceW
LoadResource
SizeofResource
LockResource
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
HeapCreate
InterlockedDecrement
GetLastError
GetCurrentThreadId
GetCurrentProcess
IsProcessorFeaturePresent
GetCommandLineA
HeapSetInformation
GetStartupInfoW
SetUnhandledExceptionFilter
ExitProcess
DecodePointer
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
USER32.dll
DispatchMessageW
TranslateMessage
GetMessageW
CreateWindowExW
RegisterClassExW
LoadCursorW
DefWindowProcW
FillRect
GetClientRect
BeginPaint
InvalidateRect
PostQuitMessage
SendMessageW
EndPaint
GDI32.dll
SetPixel
8Muex<
KERNEL32
VirtualProtect
G(XPTPjxWXt=
CorExitProcess
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetProcessWindowStation
GetUserObjectInformationW
GetLastActivePopup
GetActiveWindow
MessageBoxW
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
!"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
NtQueryInformationProcess
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
IDATXGW
KeN='0gB
RBegrgw[(D
b/b(v<\L}:
UkbI<,O#D1!'
A1bkj1ZJRc6
7mP(Ct
U;_Bg@
%G&yIC^P
w@{d#$
{45!]5!
0b5[8}3#8>$b[ZuK
g'C{9d8(t
U<8}PJ
l/ob5`mg>
l/|@;p
HX9Ept?
~SSc'm,}Y
.Nw-fu
\TzYx*D.evx
pC,oDCf[
%d\J:GC
Tu<47@$;TE6w/H
u,Ya,+u{
x[<un|Nc #+|^
]s,%aEx
mPJ2cRY
;8paB9|
|AQ1^
w(>hYS
.YAM^mXgx
]ym~6~9[9|qox f?c
l[(Kd8y
IENDB`
PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD
GetModuleHandleA
GetProcAddress
KERNEL32.DLL
gdiplus.dll
GdipFree
USER32.dll
FillRect
GDI32.dll
SetPixel
lQ+QQQf
UWVS|$
t$dD$\
T$L3;\$L
t$t#t$lD$`T$x
D$t#D$hl$x
D$t+D$\$
D$@d$@L$@
;s#D$H
t".)D$H+r
)D$H+r
L$H+t$`+
T$8L$PL$xf
D$\l$TD$X3|$`
D$`L$D
;s`)L$4|$4
t$4D$H|$t
D$`D$t+D$\
l$8f++
D$T&++f
T$TD$PT$PL$XL$Tl$\D$\l$X3|$`
;s/D$H
;s;D$H
)D$H+f
t$(Nt$(uL$0
T$,|$`
)D$H+f
l$$Ml$$uP
)D$H+f
$L$ d$
p4$Ft$\tZL$
9l$\w`$
BD$tIt
|[^_]_
AAA'DDD)<<<*<<<*<<<*<<<*<<<*BBB*BBB*BBB*DDD)>>>)>>>)>>>)>>>)>>>)>>>)>>>)>>>)>>>)>>>)>>>)>>>)>>>)>>>)>>>)>>>)>>>)>>>)>>>)>>>)>>>)???$555
`mw\h[g{{
hst~eq`lJX1AN[{
hsIWHVt~{vxy{{
ep^jiu{
gs^jmx{
itju`l{
IV?Nx{
xyGM8?QVoqx
**rrNN
nntt,,""llYY
$$}I___
##DD}}
;;ff77..55gg33
ccvvdd
xxx$UUU
;;ww~~))ssooHH
::ww{{PPhh==
11DDDD++yy
//??88
((??77""
++@@??++
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
gdiplus.dll
GdiplusShutdown
GdiplusStartup
GdipDrawImageI
GdipBitmapGetPixel
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipFree
GdipCloneImage
GdipAlloc
GdipCreateBitmapFromStream
GdipDeleteGraphics
GdipCreateFromHDC
KERNEL32.dll
GetStringTypeW
MultiByteToWideChar
LCMapStringW
HeapSize
RtlUnwind
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
TerminateProcess
IsDebuggerPresent
UnhandledExceptionFilter
GetProcessHeap
HeapAlloc
ReadFile
CloseHandle
HeapFree
WriteFile
LoadLibraryW
GetProcAddress
HeapReAlloc
FreeLibrary
LoadLibraryA
GetModuleFileNameW
FindResourceW
LoadResource
SizeofResource
LockResource
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
HeapCreate
InterlockedDecrement
GetLastError
GetCurrentThreadId
GetCurrentProcess
IsProcessorFeaturePresent
GetCommandLineA
HeapSetInformation
GetStartupInfoW
SetUnhandledExceptionFilter
ExitProcess
DecodePointer
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
USER32.dll
DispatchMessageW
TranslateMessage
GetMessageW
CreateWindowExW
RegisterClassExW
LoadCursorW
DefWindowProcW
FillRect
GetClientRect
BeginPaint
InvalidateRect
PostQuitMessage
SendMessageW
EndPaint
GDI32.dll
SetPixel
m s c o r e e . d l l
r u n t i m e e r r o r
T L O S S e r r o r
S I N G e r r o r
D O M A I N e r r o r
- A t t e m p t t o u s e M S I L c o d e f r o m t h i s a s s e m b l y d u r i n g n a t i v e c o d e i n i t i a l i z a t i o n
T h i s i n d i c a t e s a b u g i n y o u r a p p l i c a t i o n . I t i s m o s t l i k e l y t h e r e s u l t o f c a l l i n g a n M S I L - c o m p i l e d ( / c l r ) f u n c t i o n f r o m a n a t i v e c o n s t r u c t o r o r f r o m D l l M a i n .
- n o t e n o u g h s p a c e f o r l o c a l e i n f o r m a t i o n
- A t t e m p t t o i n i t i a l i z e t h e C R T m o r e t h a n o n c e .
T h i s i n d i c a t e s a b u g i n y o u r a p p l i c a t i o n .
- C R T n o t i n i t i a l i z e d
- u n a b l e t o i n i t i a l i z e h e a p
- n o t e n o u g h s p a c e f o r l o w i o i n i t i a l i z a t i o n
- n o t e n o u g h s p a c e f o r s t d i o i n i t i a l i z a t i o n
- p u r e v i r t u a l f u n c t i o n c a l l
- n o t e n o u g h s p a c e f o r _ o n e x i t / a t e x i t t a b l e
- u n a b l e t o o p e n c o n s o l e d e v i c e
- u n e x p e c t e d h e a p e r r o r
- u n e x p e c t e d m u l t i t h r e a d l o c k e r r o r
- n o t e n o u g h s p a c e f o r t h r e a d d a t a
- a b o r t ( ) h a s b e e n c a l l e d
- n o t e n o u g h s p a c e f o r e n v i r o n m e n t
- n o t e n o u g h s p a c e f o r a r g u m e n t s
- f l o a t i n g p o i n t s u p p o r t n o t l o a d e d
@ M i c r o s o f t V i s u a l C + + R u n t i m e L i b r a r y
< p r o g r a m n a m e u n k n o w n >
R u n t i m e E r r o r !
P r o g r a m :
K E R N E L 3 2 . D L L
W U S E R 3 2 . D L L
H H : m m : s s
d d d d , M M M M d d , y y y y
M M / d d / y y
D e c e m b e r
N o v e m b e r
O c t o b e r
S e p t e m b e r
A u g u s t
F e b r u a r y
J a n u a r y
S a t u r d a y
F r i d a y
T h u r s d a y
W e d n e s d a y
T u e s d a y
M o n d a y
S u n d a y
( ( ( ( ( H
h ( ( ( ( H
H
@ n t d l l . d l l
K E R N E L 3 2 . d l l
M a i n W C l a s s
S a m p l e
@ @ @ @ @ @ @ @ @ @
@ @ @ @ @ @ @ @ @ @ @
s 1 c 1 t j l . e x e
C : \ E t y I 3 k 7 I . e x e
C : \ x Y p W D 3 F t . e x e
C : \ z r s u 2 j K Z . e x e
C : \ V 4 q o o V n J . e x e
C : \ Z L U T S a o F . e x e
C : \ r c v s e 5 c w . e x e
C : \ i 3 c A k 6 q d . e x e
C : \ t q z d J H V O . e x e
C : \ e C k t N D w 3 . e x e
C : \ j Y Z S w g h s . e x e
C : \ r C l u t 4 r P . e x e
C : \ 1 3 c 2 6 2 2 b 7 e 6 f a c 0 6 7 e b 6 8 4 b 2 0 c 6 7 6 4 e e 0 d 6 e 2 a 2 e b c 2 0 c 2 b e f 4 8 b 8 f 7 7 7 2 9 8 e 3 1 8
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ N E a B S m i W . e x e
C : \ 5 b c 0 f 0 f 5 e 2 e 7 b e 6 6 7 d 5 2 3 8 8 2 e 7 9 5 4 4 f e 1 f a c 0 7 6 7 1 1 b c e 4 0 2 7 3 6 e d 2 e f 1 d f e a b 7 4
C : \ U s e r s \ L i s a \ D e s k t o p \ T 5 J n R A E 5 . e x e
C : \ a 8 5 f 7 5 6 3 5 9 c 2 f b 8 6 5 c e 2 d f 4 7 9 5 5 7 1 d 8 7 8 8 6 a f e e d e 2 6 5 f 1 d f 0 6 9 2 9 f a 1 3 1 1 1 b c 4 8
C : \ 8 7 0 a f f 7 9 c f 5 1 f 7 6 7 3 a c 6 a 8 8 2 4 b a c e a 1 3 c 8 f 7 b f d 4 5 4 7 8 6 d 0 3 a 3 f 6 c 8 3 9 4 d d 9 3 c d a
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ l X F I 7 E m P . e x e
C : \ 7 0 f 2 f 1 0 e 6 0 3 0 2 3 4 b d e 7 b 8 d c b 2 c 6 8 2 2 c 1 4 c c 1 a 8 7 d 8 b b d 1 2 4 b f b e 0 3 f 0 1 a b b 6 a a f c
C : \ U s e r s \ L i s a \ D e s k t o p \ C K w h 2 V v B . e x e
C : \ U B i A p E W G . e x e
C : \ f 8 b b 3 f 8 3 c d 5 c a a f 2 2 e 6 d c e c 4 e 9 9 7 b a 8 5 0 f b 3 b 9 d 0 d 2 e 7 4 0 3 7 6 2 c f 1 7 a 9 6 a a 8 1 7 8 b
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 2 A L x x L t k . e x e
C : \ 1 3 5 e 7 8 b b b c 6 f b f 1 e 9 7 7 3 0 8 7 c 1 1 1 f e f 4 0 d 1 9 e 1 0 4 3 f 3 3 4 0 a 8 7 2 3 3 8 b 0 e b d f 5 6 d 9 1 7
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 3 F P a P x 0 A . e x e
C : \ 5 6 f 9 a 6 f a 6 5 f b 1 6 9 9 5 9 f 1 c 6 5 6 d 2 c c 5 f e e a 7 c d 5 b 1 6 5 0 6 f 5 f 7 1 2 9 6 6 6 5 f 2 0 b 3 0 3 5 4 2
C : \ 9 1 5 f 2 7 5 a 4 f c a 4 0 a 6 0 e 6 7 8 0 f 5 4 7 3 1 a e 5 a 1 7 e c 9 9 9 a d f f 9 3 3 e 3 0 4 7 0 e 1 e 1 b 9 4 2 6 7 2 5
C : \ a 2 0 e b 5 7 3 4 9 5 3 a 0 8 f 0 5 f 5 a 8 e 6 d 2 e f 9 2 b 6 7 5 1 3 6 4 0 f 5 b e 6 5 4 5 b e 8 c 0 1 5 6 9 f 4 d 3 e 1 e 4
C : \ 2 M n M c o Z x . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ Z s u f C 3 C d . e x e
C : \ 2 f 1 5 2 3 a e 5 6 6 b d 9 8 c a 8 5 f 6 2 5 0 8 9 6 9 0 5 1 7 4 0 c 1 0 5 d 8 6 3 b a b d 9 6 4 3 a 9 e f 5 d d 0 c 5 0 9 8 9
C : \ a b 3 d f 8 b f b a c b 2 0 d 5 e d 5 1 7 a f b f 2 8 f f 9 9 4 f d a b 9 c 1 b d 8 4 8 c 8 5 b 8 6 f f c a a 5 3 3 2 5 6 4 1 4
C : \ U s e r s \ L i s a \ D e s k t o p \ H H m s Z Q 7 U . e x e
C : \ 0 8 8 6 4 3 1 8 c c 3 a 4 5 f c 5 f 3 a 6 4 e d 9 f 2 a 3 d 8 d 5 4 3 a e f 4 f e d e d d 8 0 0 e c 2 6 9 a d a 2 0 5 1 8 a f 0
C : \ 7 4 4 2 2 7 6 d 5 6 c 1 d 8 b d 7 3 f a 3 7 4 0 3 c 3 3 e 4 d 9 b d e 3 8 e 4 5 7 0 a 9 0 6 4 1 e b 1 8 5 5 1 d 7 7 4 0 2 d e b
C : \ c 1 2 d 9 1 c d a c 8 9 3 e b 1 3 f d 8 8 7 5 1 7 7 6 c b 5 8 b 8 f 1 f f 7 4 2 6 3 d 0 4 8 1 e 9 0 4 9 8 c 2 3 e b 6 4 a 6 0 6
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ h I J O Q y G o . e x e
C : \ 4 5 5 1 d 2 b 5 a a a 4 0 8 d b f d 2 0 2 5 6 9 c 8 b c 1 a b f 4 e a 6 3 2 9 e 2 0 0 f 1 6 d 3 4 6 2 f b 6 2 4 2 a c 3 6 e 3 3
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ F 0 O b e R Y A . e x e
C : \ 5 7 f 2 b 9 4 b a 5 a 0 9 1 8 2 b 7 5 1 c 5 3 a d 9 8 1 5 a e 2 7 2 d b 4 6 8 7 5 6 0 d 7 d 1 6 b c 2 e 6 b 4 6 0 f a 6 f 9 4 2
C : \ U s e r s \ L i s a \ D e s k t o p \ W A 0 l 0 z p U . e x e
C : \ 7 6 7 2 6 c e 2 f b 1 8 9 4 f 7 a d a 6 c 5 a f d 4 a 8 e 0 4 f 2 e d 5 a e b 5 a 3 9 7 9 a d a d 3 9 c f 1 1 e f 9 5 8 0 4 2 d
C : \ 7 b 2 1 0 3 5 0 5 5 1 0 5 0 1 a 0 d 5 1 c 7 d 3 7 c 3 6 7 c d 4 7 b 5 e 4 7 a 0 2 8 f 3 f 1 a 2 4 0 5 7 1 4 4 a f 1 5 8 d 4 f 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ d r v u y 8 l d . e x e
C : \ w J z w _ n I S . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ E i s u P v o u . e x e
C : \ 3 e 3 d 2 f 0 4 6 3 f 7 1 c 8 d e 6 f 8 5 e 2 9 8 5 8 a 4 8 b c c 7 4 2 4 5 b 3 f 8 3 1 a 0 6 d d 6 3 1 c 5 0 b 3 7 f b 4 2 6 e
C : \ 7 2 f 0 c 4 d 9 d c f 1 0 a 2 1 c d b d c e 5 8 9 b e 9 8 e 7 b d 5 2 4 3 0 2 0 1 6 2 e c d e 4 c a c 5 5 5 b 9 a d 7 9 8 8 e 0
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ e X i B C o E r . e x e
C : \ 4 7 0 f 5 7 e e e 8 d a 0 b c 7 6 f 6 0 f 7 e 6 1 1 3 8 c c 9 7 5 b 8 0 7 6 1 b f a a a 9 4 f 2 1 c 1 5 7 3 b 4 5 4 a 0 0 7 4 9
C : \ 1 e e a 9 3 b f 6 1 f 7 3 3 c 1 d 2 7 e 5 7 7 6 d 7 3 8 6 9 b 5 2 4 4 6 d 1 1 b 8 0 7 b b 9 4 1 1 d 5 8 c 1 e 1 f 9 4 7 8 4 1 7
C : \ 8 3 3 6 0 e 2 6 4 e 3 3 7 4 5 2 7 6 d 3 a 3 a e 9 b c 9 c 1 9 3 3 7 9 0 f 9 f c 0 5 4 c d b d 5 d 0 1 3 a a 3 5 a b c 0 3 a d 1
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ I J Z R h a k 4 . e x e
C : \ 3 5 c 8 1 5 a f b 6 0 7 0 8 c e 8 9 2 6 1 6 c 7 b 1 5 6 4 a b 8 8 7 5 4 4 6 8 3 7 5 6 c 7 5 8 c 9 9 6 b b 4 5 5 4 2 2 4 b 1 2 c
C : \ U s e r s \ L i s a \ D e s k t o p \ g Z K t W t m f . e x e
C : \ a e k 1 N h k 0 . e x e
C : \ 2 1 9 3 1 7 7 d 0 2 a 9 3 8 f 1 4 a 9 5 0 e 5 d 7 a 4 f 9 9 3 8 b 8 f a d 3 c f 8 4 2 5 7 c b 4 5 6 0 f d b 1 0 0 b 1 f 3 8 0 8
C : \ U s e r s \ L i s a \ D e s k t o p \ Y z 8 J 5 y x i . e x e
C : \ 2 6 b 9 d d a 3 3 c b b a 2 3 9 2 6 9 e b 9 b a 4 5 6 6 8 d 7 c 2 5 6 f 3 8 d 6 0 f d 5 d 4 c 2 d c 8 f 2 b 8 a 3 6 c 4 c b 0 e
C : \ b b a a 7 4 8 b d e 4 f a a e 3 0 7 8 f 3 5 f 2 0 3 b 8 9 7 f d 4 c f 6 9 b 7 f d 3 4 1 5 e 5 7 c e a 7 c 1 c 2 1 a f 9 3 5 2 0
C : \ e 6 b 7 3 6 9 8 b 3 0 d 3 4 2 c 7 9 8 e b 1 c 0 b c 9 d 2 7 0 6 2 0 4 2 d 3 4 e 0 2 0 5 b 1 3 2 b f 4 a 0 f 6 5 1 e 1 0 5 3 1 9
C : \ U s e r s \ L i s a \ D e s k t o p \ n u T Q 8 g I C . e x e
C : \ 3 3 1 1 c c 5 c 8 1 3 9 7 8 5 a e 2 2 f e f 2 1 4 b a 0 0 4 0 a e 8 d 1 7 6 f 2 f c d a 9 c b b 0 7 2 0 a 7 0 9 f 8 4 9 3 4 c 1
C : \ U s e r s \ L i s a \ D e s k t o p \ p 1 1 P Z 5 Q h . e x e
C : \ C G x j h z _ y . e x e
C : \ a 0 a e b e 3 8 d c f 7 3 3 8 d 9 9 0 0 f b 2 3 a 8 2 5 1 d b 6 e 6 c b 9 2 f 0 2 d 9 c 5 a 2 3 e 3 7 3 3 7 b 8 e 0 d 1 0 4 a c
C : \ 5 4 c 1 a 8 c e 7 0 0 a 7 e 1 e d d 8 9 7 f 1 7 e 9 0 6 0 3 f 4 5 e 6 0 4 5 2 9 6 c 1 3 2 9 5 5 3 2 b f e 4 6 4 b 2 b b 0 7 0 5
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ O O g b L A g N . e x e
C : \ L y 7 g q s 9 l . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ Y b K 4 R f 8 n . e x e
C : \ k U l 7 8 B I a . e x e
C : \ 4 1 a 8 4 7 a f 6 e b a 3 e 7 d 1 0 d d 5 c c e 0 e f 5 2 e f 3 c 5 d e f b 8 7 b 7 2 c 0 d b d f a 9 9 c 7 8 7 0 9 f e f c 1 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ f R e p 9 g t P . e x e
C : \ S D U M G O f N . e x e
C : \ d 3 1 a e a c d a 4 7 7 1 6 7 b a 3 4 0 3 c a e 3 e b 6 b 1 2 3 7 d e 6 9 d 4 f 3 2 d 3 d b e d f 5 a b f b 4 9 b 7 9 0 4 0 c b
C : \ 8 2 f 5 f 0 2 4 f d 4 6 5 3 b 3 4 4 b 5 6 a d f 4 7 1 7 2 2 c 1 e 9 8 4 a 4 6 4 8 5 8 6 c a e a c 8 7 7 8 4 e a f b e 0 d 4 d 6
C : \ U s e r s \ L i s a \ D e s k t o p \ w j y r P 3 f m . e x e
C : \ 5 b Z s r o F C . e x e
C : \ 7 a d 4 e d 6 6 d b e 7 7 e b 3 9 4 9 3 0 f c 6 3 6 f f d 9 3 a 4 b e 6 2 7 e 4 b 4 6 f 6 8 3 6 8 c 5 c a 9 4 0 0 1 4 6 2 6 7 a
C : \ 7 e r z P E v W . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ R r 8 6 4 I b k . e x e
C : \ l O T W m z G r . e x e
C : \ f e 7 d 8 6 1 e 6 e f e 6 a 6 5 9 8 a 0 e 0 5 8 3 7 d 4 e b 0 9 5 7 d 6 3 6 f d 0 9 4 2 1 6 5 1 2 2 0 0 d a a 8 8 e 3 7 5 e 3 a
C : \ c 5 6 a 6 3 3 8 d 5 5 b 9 9 0 b 6 a 8 2 c 4 1 f e b 5 5 a 8 a f c c 2 5 3 5 b d 3 0 2 8 f e 4 c 3 a c a f 2 1 f d d a b a e f f
C : \ 2 b b 2 e 1 2 0 3 7 d 9 c f c 7 6 b 4 9 0 6 7 a 7 4 6 1 d 9 b f 7 7 3 0 1 b 1 a 9 d 9 d d 9 2 7 f 6 c b 8 7 0 d 4 2 4 5 8 f 9 2
C : \ p Z 3 l j J 2 N . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f i l e . p e 3 2
C : \ a d 6 b 0 a 2 a b 1 3 c f f 8 0 3 8 a 6 7 7 2 3 e 2 d 7 9 e b b 5 d 2 c 0 9 0 f c 8 b 0 e e f c 1 a 1 1 3 7 4 b a b b 2 a e d 8
C : \ 9 f 5 1 e d 7 0 b 4 a b 7 4 e 8 4 6 d c a 7 e 0 2 b b e b 3 8 1 5 9 b 7 8 8 8 1 2 e d 8 4 e 8 b 4 6 9 b 1 6 5 a 6 2 8 4 c 3 b 8
C : \ 4 1 5 6 1 4 5 a 7 0 3 f d a 9 2 4 f b 5 b 4 b 9 9 6 1 1 1 a 6 d 9 8 a f 1 7 b 0 d 6 3 b 9 4 f e 5 a c b 4 e a 7 1 6 5 7 9 6 f 2
C : \ d 6 d d 1 b 6 c 6 2 8 3 8 b 2 a 7 0 c d 0 d 9 d e d c e 9 2 c f 9 2 e d 4 9 4 e 8 c d a 9 c a e 9 8 c f 6 7 7 9 9 a c c d 0 b c
C : \ _ K B t u 1 F z . e x e
C : \ e e f 3 b b 6 5 c 8 2 6 c 7 1 0 3 f 4 d f 8 d f 0 3 0 4 4 8 6 3 b e 2 5 e d 9 e a 4 7 a d 9 f e 3 6 d 9 a 5 9 a 1 2 4 d b b 4 6
C : \ c 0 4 7 3 9 6 8 9 4 6 f b 6 0 7 7 7 7 4 b 5 a b 1 f 4 9 9 7 4 f 7 4 8 7 0 7 6 b b f b a e 3 a d e 9 a 6 0 6 8 4 5 c 2 c 2 9 4 e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ Q u s F S I o F . e x e
C : \ 8 1 9 e 8 e e e 2 d 4 1 5 8 e 7 1 9 5 e 8 b 5 7 8 8 0 f 8 e 1 1 6 3 f a e 4 4 6 1 5 0 e 3 0 1 6 d e 6 2 1 3 3 8 9 c 4 f e 7 0 6
C : \ U s e r s \ L i s a \ D e s k t o p \ X h y 9 V d 2 A . e x e
C : \ 0 f 0 5 8 3 1 0 b a 3 9 5 8 5 6 c 8 b 6 c a 3 e d f b e 2 a 7 7 3 3 c 2 8 3 a f 0 d 8 b 7 7 b 5 a 0 a d e d 5 6 a d 2 4 b f 1 4
C : \ a a f c 7 6 6 9 f 6 0 2 e b f f d f 2 7 9 b f 1 3 4 f 9 c 9 6 b 0 1 6 e e d b 9 a 1 e 2 2 1 1 a a a 3 8 9 b f 6 b 9 5 a 4 b 6 b
C : \ U s e r s \ L i s a \ D e s k t o p \ m F H u J b 1 O . e x e
C : \ 4 3 5 9 8 0 c 1 1 e 0 f 6 a 1 9 9 8 c f 5 9 b 4 0 f 0 b f 9 d 8 f e 6 6 e 7 e c 3 4 1 8 0 b 5 1 a 4 7 5 6 1 a 9 7 6 b 0 7 6 8 a
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ W Z 6 I 8 C Z W . e x e
C : \ 7 e f a 9 0 b c 2 c 3 e 1 d a 1 4 9 4 3 d 7 f b a 5 7 3 6 7 1 e 3 7 8 d c 1 5 3 c 5 6 3 e a 6 0 4 3 8 e 1 c 1 4 3 3 c c 3 f 7 e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ x q 1 z a q a F . e x e
C : \ c 2 c 3 9 b e e b d e b c e 4 0 e d 8 1 3 d d 0 0 8 0 e e 3 6 3 8 5 1 c 6 6 7 b e 6 0 1 7 9 4 f b 1 f c 0 1 7 f 2 1 2 a 1 d 0 0
C : \ 3 b e 2 d 3 9 5 d 3 9 7 d 7 c 5 c e f d 4 f 2 b 4 8 f f e c 5 4 f a 2 6 a 5 8 0 d f 6 e 8 7 f 9 a 8 d e 3 7 7 0 1 3 c 9 e f 0 9
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ P C V o 2 L 7 4 . e x e
C : \ O n F U P i 8 y . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ c b 5 1 5 a 9 5 a d 6 f 0 9 9 6 f 8 4 9 e 1 7 0 1 7 4 7 d 3 8 1 0 3 3 a 5 c 3 1 c a e 1 e 8 f d 8 5 1 5 e 3 b f 8 5 8 1 4 3 2 1
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ k 9 x V a w G W . e x e
C : \ c e 0 b e b 9 e 4 3 c 3 d f 7 c 2 1 8 a 2 a a f d 2 0 5 d 6 e 0 0 9 6 b 8 b 8 0 3 a c 1 0 c 0 4 2 0 1 3 1 8 c 4 1 a 3 8 9 b 6 0
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ 0 b 1 5 1 f 6 e 8 5 f d 6 e 1 a 3 7 a a 0 8 a d b f b b b 2 1 1 2 7 3 b 3 8 7 7 0 6 c 1 b 7 3 0 8 a a b a 0 c d d 1 1 7 4 0 8 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ e c 8 4 8 2 2 4 a e 8 a 3 b 7 9 c a 9 f f 0 8 7 1 b a d 3 2 a b 4 f b 4 b 0 0 3 8 6 2 0 c b 2 8 a 1 6 6 0 0 2 e 8 c 7 9 4 5 1 a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ 1 5 2 f a e 7 d a 6 f c 6 3 a 3 b 9 e 8 1 3 1 a a b c f 5 7 4 b 8 7 f f 0 a 2 1 8 4 3 8 2 9 d e 9 2 2 4 5 f c c 7 5 f f a 1 f f
C : \ 7 2 4 6 0 3 6 9 4 6 2 9 7 f 2 e e d 1 9 d 9 7 6 d 0 5 2 b c 2 f 4 f 0 b 6 c b e d 1 8 7 6 9 5 e c 0 d 6 4 6 3 0 8 8 d 8 4 3 1 e
C : \ 7 d 2 c 5 4 a 2 d 7 4 2 d 4 3 e 2 2 b b 7 3 9 1 d f e 1 8 b 2 7 7 9 7 2 4 0 2 a e b 5 2 f a 7 1 5 a b d 9 4 c f b c d b 6 4 a 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h c b n a f . p e 3 2
C : \ c 2 2 2 c 2 8 b b b b d 2 5 6 8 5 d b c 0 7 3 7 4 3 5 7 e 7 e 7 6 8 0 b a 5 5 f b 3 6 0 5 3 8 6 0 7 e 3 9 a 0 6 f b c b 6 b b b
C : \ 4 r I L g 9 a u . e x e
C : \ 0 6 a 1 0 e 0 f f b 0 9 9 b e 0 8 4 f d 7 1 8 d 0 1 e 1 c f 2 c 4 9 2 d 5 7 f 6 9 6 8 8 0 a 1 3 e a 5 7 e 6 1 c 5 8 6 a 5 7 e 3
C : \ 4 3 d d 3 1 c 0 8 2 5 4 7 c f 9 2 e a e 0 a 9 3 6 9 d d a d 6 5 7 a 6 9 b e b 1 1 8 5 7 8 e 3 7 f 7 d 6 a 3 e 4 2 9 9 7 6 7 a 8
C : \ x y Z c G 0 _ Y . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ 2 9 4 7 7 7 a 9 4 b 4 4 b 1 1 6 d d 9 3 1 7 e 4 d c 5 c 2 0 2 6 b 9 9 c a c a 8 c d 9 b e 1 3 8 b 3 6 b 7 4 3 f 0 1 1 e 6 b d 8
C : \ 6 2 0 f e 8 f 1 3 4 e a b 9 4 6 7 f 1 9 a 4 b c e 6 6 f 5 7 8 f e f b 2 6 5 0 a d 8 a 2 6 f a 2 1 3 9 a d 2 2 2 8 a c 6 0 4 7 8
C : \ 2 d a f f 9 e 4 a 4 7 1 0 2 7 b 2 c 1 4 2 e e 8 5 4 b a a 8 6 4 5 d 4 2 a f 2 6 3 e 6 8 0 0 c b 6 b 8 7 e 6 6 2 7 0 0 3 f d 6 b
C : \ x V C 3 J X A m . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ E p d M A 6 J g . e x e
C : \ d f 0 7 5 6 4 e 2 a c 7 4 0 7 e a 6 b 1 0 4 2 6 6 8 2 5 0 0 2 8 e 0 b 1 a 5 1 e 1 c f f a 2 2 d 0 e 3 d 2 f 4 b 3 e c 3 2 f 2 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h c b n a f . e x e
C : \ a 4 8 0 f b f 5 7 a c a 9 2 1 4 8 d 9 f f d a d c 2 f e 1 6 9 8 d d 2 b e 6 4 b 2 5 7 f b c e 1 d 5 2 3 d c 9 d 2 3 8 7 8 5 5 9
C : \ 9 b 2 7 4 5 3 f 2 5 2 0 7 9 c e 2 4 0 0 a a 7 b 0 d 1 9 8 4 6 6 7 4 6 4 3 c d 7 4 c e 6 9 c 3 5 5 8 9 6 0 0 f c 3 6 6 8 7 d c 2
C : \ 9 5 e a 6 d 1 1 5 9 c 5 2 4 c 1 b 4 9 b 0 c 6 5 2 f a 8 f 1 8 c 5 d 1 b 1 2 c 0 c 1 2 f b a 8 1 8 7 7 a 2 d 7 a d f c 2 f 9 e 7
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ X h w A c D u 8 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 9 5 e 8 9 5 5 a 9 b e d 6 7 8 5 1 7 6 c b 2 8 5 1 c 6 3 4 2 5 f c c 1 5 c 8 e 9 3 b 8 2 b 2 c 9 6 f c 4 a 2 c 1 d c 2 6 1 8 2 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ W 1 G n E i M F . e x e
C : \ 9 3 a f 1 8 a 7 5 d d 8 c 4 f 3 1 1 6 4 2 e 0 a 2 6 d 5 7 a 6 b 6 9 0 9 4 4 c e b 9 8 c 8 8 0 d 1 d 5 1 3 b 3 1 f 8 2 5 3 c 8 d
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ p o L n X Y U y . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 4 2 1 7 0 3 e 9 5 a 1 7 a f 5 9 9 3 0 9 c e 2 9 4 a 7 2 9 8 9 b 9 3 a 0 7 0 d 4 d 9 5 1 3 d 7 2 1 5 4 1 8 8 6 2 d 4 0 c d 6 d 2 . e x e
C : \ d a 2 5 e e 2 5 2 9 c 7 e 5 8 2 8 e 1 2 8 4 5 d 6 4 4 4 d f c b e 8 7 8 8 4 7 0 1 9 c 8 9 3 b f 7 5 e 9 9 8 3 f 9 3 5 1 8 7 a 9
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ F X 0 T D J f 5 . e x e
C : \ 6 3 a f 9 4 a 6 1 e 6 c 0 b 3 d 6 3 e e a 8 d c a d f f 7 c d c f f 0 4 0 3 9 0 6 b e c a b 3 4 7 b 2 2 d 9 0 2 4 c 0 8 0 0 5 8
C : \ 4 b f 1 8 5 a b 7 b e 9 9 d 0 9 3 c 9 3 6 6 8 4 2 5 7 1 8 9 8 3 7 7 6 b b 8 0 a 6 6 9 c c d 4 9 c 9 1 2 4 3 a 5 9 4 c e d a 5 b
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h c b n a f . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h c b n a f . p e 3 2
C : \ 2 a 9 8 1 d 1 2 6 f 0 0 0 f 6 b b d 3 9 f a 8 c d 0 f 4 7 b f 9 2 8 5 4 2 0 0 1 2 7 b a 2 b f c 7 c a 2 9 b d c 0 5 6 2 3 5 1 3
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ j Q 1 t a L t t . e x e
C : \ d 2 d a 3 4 e d 1 2 d f b a 6 5 3 8 0 4 7 0 e 7 a 9 e d 3 7 4 3 5 9 4 a 1 c 4 b 4 4 6 f d 6 b f e 8 b 0 7 f 0 7 9 d 4 c 0 8 1 5
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ T k E d r L X 3 . e x e
C : \ 3 a d 6 f a a 4 3 7 3 d 7 7 5 3 6 a c 2 c 2 b e f 7 3 8 1 9 f a 3 f d 4 5 d 9 c 5 b 7 3 e e 7 e 4 1 3 c 1 a c 9 0 c 8 7 2 e 1 0
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ M n I 0 2 U 3 5 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c 5 f 5 a 6 5 c 3 1 1 9 0 6 4 7 d e c f 8 0 3 3 3 2 6 c 0 2 4 b 0 7 5 5 3 9 9 c f a 1 d f 2 3 a 8 4 c 2 4 b c 9 f 5 1 7 8 4 d a . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ p E u i S W f B . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 9 0 9 d 7 e 3 8 b 7 e b d 1 f b _ h c b n a f . e x e
C : \ f e f 8 2 7 8 a e 2 3 1 a 8 4 a a 8 3 1 0 2 7 b a 6 9 f 9 6 7 1 3 6 1 d b b a b e d f 6 d 0 a 3 2 f 6 8 0 a a e 2 8 7 5 0 e 9 a
C : \ e 7 1 8 9 4 a 6 6 3 f 9 3 5 3 1 f 6 c c 4 a 0 9 4 0 6 9 d 1 8 f f 2 8 f 4 3 5 3 f e d 0 d b 9 3 8 e 5 0 3 7 c a 5 5 a d 3 5 a 7
C : \ f 0 a f 4 6 a e 6 f 1 4 9 4 4 b 2 4 4 2 1 1 6 e 3 b 2 b e 0 1 8 5 8 4 e 2 a 9 1 4 e 0 5 4 e 9 5 f b 8 9 5 4 3 0 c 9 c 7 7 d d 0
C : \ 5 e 9 0 f 3 0 c c f 7 b 6 1 8 6 1 0 9 3 0 8 a d 1 8 c 1 a d 2 a 7 5 1 9 8 6 2 7 1 6 b c 3 8 b b 0 b 3 1 5 f c 2 1 c 2 0 0 0 8 3
C : \ b 1 2 6 6 5 8 9 4 c d e 3 2 6 7 c 6 a a 4 d 0 2 9 c d a a 3 b c a 8 6 c 7 6 9 c c 0 c 6 f f 7 e 1 1 0 5 b 7 8 0 3 d 6 6 4 a 7 5
C : \ 6 c d e 1 1 6 9 3 0 f 8 7 2 f e 5 4 3 e d c 1 0 b 7 f b b f 6 5 e 7 c 5 0 7 e 1 f b a 0 4 2 c c e 2 3 d 6 f f 6 b 9 7 7 7 0 1 d
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 1 C h F T d i p . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 8 5 5 3 7 1 9 b 0 a 2 0 7 c 7 d _ h c b n a f . e x e
C : \ 6 f 2 2 3 4 5 f b 1 3 f 1 9 b c 9 e 1 0 a 7 6 0 3 7 2 1 3 f f 2 1 a 1 9 c d e 7 f 8 2 9 9 b 3 a 9 0 a 9 b 3 c c 8 9 9 7 d 8 c f
C : \ 1 a 6 f 3 7 4 9 7 2 3 3 0 2 d f b 9 d 6 4 6 2 d 8 f f 0 2 e 0 9 a 5 4 5 f d e f 6 2 4 f 3 d a a d 3 3 b e 8 b 5 3 9 a 5 5 3 3 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h c b n a f . e x e
C : \ 5 6 3 d 8 d a 6 c 3 7 d f b c 4 6 9 2 b 9 c 9 2 9 0 8 5 8 3 b e f 6 8 0 e 2 4 b b 2 1 1 5 3 7 3 9 1 4 5 8 9 d a 9 0 8 0 d 1 a 2
C : \ f 9 6 0 0 f a 2 2 1 6 0 0 6 e 2 3 1 a 0 5 e 6 4 d d f e 1 2 9 0 c f 5 c 2 9 9 4 6 f d 6 0 1 7 0 8 1 4 0 6 a 1 7 4 1 1 e b d b 4
C : \ a 0 f 7 d 9 a 1 1 5 7 b b 7 9 1 d 8 f 5 9 b c 9 b 6 5 2 1 e 5 f e 8 2 c d 6 1 1 8 7 3 c 5 1 c 0 d 3 d 5 9 c 4 2 a 8 1 e 0 e 8 5
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h c b n a f . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 1 2 4 9 e c 8 3 f b c a 1 5 7 _ h c b n a f . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ e F T 6 6 K m w . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ 9 1 9 6 6 b 6 a b 6 d b d 3 4 6 0 d 8 a 0 9 f d e 8 a 9 d e 3 e b e 8 8 4 a f 1 e 5 c 0 9 2 b 6 8 f 8 d 1 c 5 a 5 d 1 5 6 f 7 5
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ k w w G F m j q . e x e
C : \ 9 0 f 5 f 7 5 9 d 9 f 9 0 6 9 5 4 7 0 6 2 3 3 f 2 e 3 2 b 0 e f c 7 2 d b 3 8 4 5 4 9 6 0 2 6 d 6 e 9 b 9 7 3 2 3 4 d b 7 f d 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h c b n a f . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 8 d 9 3 0 4 a b 6 5 c 2 b 2 4 1 _ h c b n a f . e x e
C : \ 5 0 9 8 8 2 2 d b 1 0 b 2 7 7 5 4 1 d e 8 b 2 4 9 0 1 0 f 3 d 4 8 0 c c f a d f f 8 9 d 9 9 0 7 c d c b 9 a b d a 9 7 5 b 7 a 6
C : \ f 7 6 3 3 5 2 6 b b b e 4 3 c e 4 0 9 d 1 0 0 4 a 0 a 3 e 8 5 5 4 3 a c b 5 b 3 6 7 3 0 0 1 d 5 1 f e 6 9 0 6 4 2 b 9 f 8 b 1 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h c b n a f . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ H 1 w 5 I m 3 d . e x e
C : \ f 5 c 2 4 8 0 e c 0 9 e f e f 6 4 9 0 f 2 3 5 5 d 2 c 7 6 a f 1 7 7 c 4 9 2 c 1 3 2 0 8 3 c d d 7 8 9 a 7 c c a 5 b a 1 5 b e b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h c b n a f . e x e
C : \ 2 9 6 4 e 1 f 5 0 1 3 2 f 4 8 5 0 9 4 a e 2 e e 5 6 1 2 b c b 2 1 9 0 c 9 9 9 8 7 3 c 2 f d 6 2 1 3 6 b a 8 7 8 9 a d e d 5 c 9
C : \ 3 a c 6 c a 9 b d 6 2 3 c 6 9 3 f b b 6 7 1 b 2 b 4 6 a 3 7 3 e 2 d 7 1 e b b b 4 3 e 9 a 8 1 7 f 0 7 1 6 b d c 7 6 a 8 a 4 3 3
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h c b n a f . p e 3 2
C : \ f c 1 2 4 2 7 5 8 5 a b 6 b 6 1 9 4 8 c a 3 1 a b 0 4 d 9 2 9 b 4 c 8 a 4 2 f 3 c 8 4 f f 0 1 b c 3 1 6 e 2 2 a 6 2 c 1 b 2 9 b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h c b n a f . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h c b n a f . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h c b n a f . p e 3 2
C : \ 0 0 b c 3 1 5 a 4 6 4 8 5 f e 2 5 5 7 0 b a f d 9 2 c 5 9 2 b 7 a 5 1 8 1 4 3 6 9 f 1 e b 5 7 e a f f b c a b 8 8 f 3 8 7 7 0 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h c b n a f . e x e
C : \ d 1 a 3 9 b 0 2 e 7 8 2 7 0 7 c 9 9 3 e d 8 8 6 8 4 8 3 f 9 2 3 b 9 e b c 0 d e 6 7 1 c 4 5 f 4 3 f 2 f 3 a 1 8 f d 1 5 9 9 8 8
C : \ 1 7 a d 9 9 1 0 f 4 7 3 c 5 9 d 5 0 b 5 6 9 c 6 6 5 3 8 5 2 6 0 2 5 a 4 8 8 8 7 b 6 2 c 5 e 1 0 d c 8 b a c e 2 5 0 9 a 3 1 c 8
C : \ 3 c 2 2 9 0 d 7 b 4 f 3 a 7 3 6 8 8 4 f c a 5 c 0 f 0 2 6 f 0 1 2 8 5 1 5 0 7 d 6 5 c 6 8 b 5 e 5 7 5 a 6 9 9 e b 5 8 1 7 1 c 6
C : \ U s e r s \ R A 4 9 1 ~ 1 . V U L \ A p p D a t a \ L o c a l \ T e m p \ c 2 7 e f 6 a 5 b 0 5 4 8 7 e a 0 d a 2 9 6 6 0 3 5 a 0 1 e c 1 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ x I B T s 9 N C . e x e
C : \ 5 e 0 6 8 1 7 5 f 6 0 7 f 6 2 a 2 5 f 3 b 1 0 0 8 3 8 1 0 0 d 5 b 5 0 9 3 7 e 4 9 5 1 6 5 9 3 a a 6 a 3 9 3 1 1 d 8 2 0 1 1 d e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h c b n a f . e x e
C : \ 6 5 0 6 5 6 4 e 0 c f 1 0 9 5 1 2 9 c 5 2 d f 6 3 c 8 7 e e d 2 a 7 4 d 1 0 4 3 e c 8 4 b d f 5 b f c 0 7 f 8 5 5 0 2 3 0 0 b b
C : \ 0 b 9 f 6 2 4 1 b 0 f 5 0 a 0 e 6 2 5 3 2 7 9 1 8 f 2 4 e 1 0 b 9 b d 8 f 4 6 5 f 2 d 9 a 4 1 a 5 f f 1 b 2 b 0 1 9 8 4 e d e 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h c b n a f . e x e
C : \ 3 3 1 2 e c b 4 1 3 b e d f 0 2 2 3 1 7 a 6 c 6 6 a 3 1 a e c 1 a 0 d 1 8 2 a 5 0 f 2 e 0 3 8 0 f 0 8 0 5 8 c e 6 5 8 a c 7 5 c
C : \ 2 7 e 6 3 d d 0 0 3 3 c f e f b 6 0 1 f 2 f 6 b 8 a 2 9 a 4 3 f c e 7 f b 0 a 3 b d 7 b e 3 9 c 3 a 6 8 6 a 8 5 c f e 8 8 d d 9
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 3 0 w y Z n U G . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 0 1 e d f 3 1 3 9 9 d d 2 1 7 b 6 e b 8 7 8 9 6 4 b b 3 4 7 1 a e 5 f 2 4 a 6 c 8 4 2 9 6 d 8 8 7 2 f e e f e d 2 8 a f 1 a e f . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ t R I 0 2 F n A . e x e
C : \ 9 2 1 f 3 d f 1 e 9 e b 8 a 6 3 0 8 0 c 1 f 5 a 4 6 d 1 a 6 d 3 f 9 c 2 8 a 4 5 2 0 e b f 5 7 5 0 d 6 c 4 2 7 5 7 3 4 c d 3 0 1
C : \ f 1 a 9 d 3 6 d 1 8 1 7 5 f d 5 5 b b 4 e 9 2 3 2 e 5 b d 9 e b 4 5 7 4 c 3 5 9 e 8 7 0 c a 9 9 1 3 f d 8 6 9 3 d d 8 9 7 5 a c
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h c b n a f . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h c b n a f . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 5 b f 3 e f d 9 f 4 5 2 f 0 3 e _ h c b n a f . e x e
C : \ f a d 4 9 d a 8 f f 5 5 e 4 8 c 0 6 d 5 7 3 3 5 2 7 5 1 4 8 a 5 5 e 8 4 7 8 6 e 0 b e d f d b f 6 0 4 6 9 a b c 2 1 5 e 5 e 8 2
C : \ b 1 9 8 b 6 3 b 9 d 4 4 f 0 2 9 3 4 c 0 b 6 6 1 4 9 c 7 9 6 b 8 f 9 b c 3 e 7 c 3 f d 0 d 9 3 c 2 c c c 2 d 7 a 9 f b a c 0 3 0
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h c b n a f . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h c b n a f . p e 3 2
C : \ e 1 1 4 a 6 b a a 2 4 5 6 8 3 6 c 2 b 5 4 4 3 5 a f 7 a 8 1 6 d b 3 2 c 3 1 1 8 6 1 3 c 7 e b 6 9 0 2 5 c e f 4 6 9 4 3 2 d 1 5
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h c b n a f . p e 3 2
C : \ 9 6 a 4 b 7 9 9 c 1 e 0 f a 2 9 5 f a 7 0 2 b 4 4 b 0 e 7 6 3 e d f a a 3 3 f 4 2 7 6 1 e 7 8 2 b 1 5 c 0 b 3 0 5 9 c 0 8 8 1 5
C : \ b f 9 3 a b d b 8 a d f 2 f a 4 6 3 1 2 f a e f 7 4 a a a 1 6 1 d e 0 2 1 a 1 e f 4 4 4 9 e 4 a 2 2 5 f 3 3 c e 3 b b 3 7 1 c 1
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h c b n a f . p e 3 2
C : \ 4 9 8 c 3 6 3 6 6 6 7 a 9 5 7 1 1 5 d c 0 3 8 a 3 2 5 2 2 5 8 5 d 7 6 4 3 d 9 7 8 f b 2 9 0 6 b 6 d c f 8 2 d b c c d 0 e f 3 5
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 5 S p r 2 6 n 1 . e x e
C : \ b d 9 f 6 2 e 9 6 a 3 8 c 6 7 d 6 a 1 2 2 c a b 8 f f b d 0 1 1 8 6 3 d 8 e e 3 1 4 1 e 7 0 d 4 c 4 2 7 a e f c c 3 e e 9 f 1 3
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h c b n a f . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h c b n a f . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 2 f 7 d 2 5 b d 6 b e c 9 f 0 1 _ h c b n a f . e x e
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 9 6 f 2 9 f 6 a 6 9 a 6 b b 3 f b 7 a d 3 6 8 5 c c b 6 7 8 a 4 d 2 5 e b 0 3 7 9 b 4 3 6 9 2 0 b a 7 6 7 3 b 6 9 f 5 5 e e e 4 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ C g L M r q c 1 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 8 2 3 7 8 3 3 0 0 0 3 1 7 7 4 7 9 0 0 2 e 3 2 9 9 0 b f 3 f e f 5 f 3 6 9 9 b 0 9 5 8 5 0 0 5 6 c 7 c 0 9 c 9 a 9 e e e 7 0 5 8 . e x e
C : \ b f f 7 f 9 1 c f c 5 5 0 1 0 2 e 6 e a 7 8 5 d 1 7 9 4 8 a f 5 b b c 7 e 5 a 7 2 9 d 3 6 5 3 2 6 c b 3 e b 5 3 1 4 e a 1 3 a 2
C : \ U s e r s \ L i s a \ D e s k t o p \ G n C P X 0 I M . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d 6 9 e 2 3 2 2 0 e b 4 9 9 8 7 9 5 b 9 c 0 a e 5 c a d 8 4 0 6 2 0 1 a 3 2 8 3 d 0 a e 9 a f f a 0 6 b 0 a 7 a c 0 6 0 7 6 b a . e x e
C : \ 7 5 e 8 5 e d e f d 0 e 8 4 f f 7 5 3 d 3 3 1 7 5 4 b 5 e 6 6 e 0 3 4 a 7 5 9 9 7 5 0 6 0 7 9 6 0 b d b d 7 2 0 d 8 1 5 f 1 e d
C : \ 5 c 6 6 7 3 5 6 0 7 3 4 e 9 4 6 6 5 8 e 6 4 8 b 8 d a 3 2 2 b 2 b b d 5 f e f 7 7 6 9 c 0 2 7 f 0 e 7 5 b 1 e 6 3 5 e a e 0 e 7
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 9 0 2 V B t M U . e x e
C : \ f 5 d 6 6 f 5 1 7 7 1 9 6 4 d a 1 e 5 3 4 3 e 5 d 5 8 5 c e e 6 7 0 0 3 2 8 9 d 9 f 5 1 4 a f 0 7 7 7 8 b e a b e 8 9 9 3 b b a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h c b n a f . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ k X C M l H w H . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c f 4 3 6 0 9 e c c 6 0 d d c b c 9 4 4 9 3 a 8 b 8 a a f a 1 a 5 7 c 2 b 4 4 4 6 3 a 8 2 4 3 6 b c 2 b 6 1 e b a d c d 7 1 f 1 . e x e
C : \ 2 5 b 4 5 9 d 8 5 8 6 d c 7 6 7 f 0 0 b 9 2 9 3 e 2 1 8 d f 8 5 f d b 3 3 0 a e d e 2 4 b d 2 5 c f 2 4 4 5 e 1 7 8 3 6 c b d e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h c b n a f . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ b X I 5 f J H c . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 3 8 8 3 e e 4 6 d e 5 8 4 9 3 f 0 b c 3 0 9 6 5 4 4 d d f 1 d c a 3 a 6 8 8 6 9 7 1 2 2 8 e 7 f a 9 8 6 e c 9 a b d e 7 8 1 b . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ J u 4 u 9 h X B . e x e
C : \ a a 4 0 1 0 4 0 7 6 a 3 5 5 7 f 2 6 2 6 a e 4 4 3 b c 4 f 9 3 8 f 6 f 9 3 d 6 9 4 4 0 5 b 3 a 9 5 e d 2 1 5 0 5 b d 1 b 2 9 8 5
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h c b n a f . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 5 e c 0 f 7 7 1 0 7 4 3 b e c 4 _ h c b n a f . e x e
C : \ 8 1 d a c 0 8 1 b c 1 3 9 7 d a f f 5 9 d e 6 0 5 2 1 2 1 6 b 4 f 5 3 e 0 f 7 7 a e 7 8 1 e b 1 f a 1 a 7 7 5 a c 5 a 9 7 5 8 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ Z Q I b m k 6 P . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ 1 7 f 2 0 f 7 b 8 3 7 d 3 3 8 3 6 4 c 1 b 4 5 4 c 6 2 3 2 4 b 8 8 8 4 4 1 7 7 3 a f 1 e 2 3 0 b f 7 8 e 4 e e f 7 6 2 7 c 7 d b
C : \ d a 7 a 1 a 6 e 0 a 9 8 0 3 5 f 2 e b 0 e 1 0 9 c 1 6 8 0 c 8 b 4 2 7 d 2 0 1 1 b 7 5 b 4 8 a 1 d e 7 4 3 7 4 7 0 c 1 c 6 3 8 d
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h c b n a f . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 3 1 a 2 e f 2 a 3 e a 7 6 2 f 0 _ h c b n a f . e x e
C : \ 8 5 0 2 3 9 5 f 5 7 8 a e 4 0 6 4 d 5 8 a 3 a 5 4 f c 4 f e 1 5 d 4 2 c b f 8 1 6 e 5 0 a c 8 7 6 b f e 1 9 6 4 1 3 e 1 b 7 f 5
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ s 0 9 w M 3 0 L . e x e
C : \ 0 5 0 3 f e 2 b e e d 2 a 3 4 8 f 0 4 1 d 7 1 7 e 6 1 a 2 f 8 d 2 8 c 1 9 e c 9 0 e b d 6 c 3 1 8 6 8 e a 9 f 3 6 1 5 0 9 c 0 e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h c b n a f . p e 3 2
C : \ c 3 7 3 e 1 d e 4 2 c 2 6 6 4 7 2 7 d 2 0 0 0 1 d 8 d e 2 e b 9 3 a 7 b a 3 8 6 1 a 5 a 8 e b b 6 8 1 3 4 4 d 4 a 5 2 8 0 1 c 0
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h c b n a f . p e 3 2
C : \ 7 8 0 2 3 f 3 e c 5 3 a e 7 f e 1 b 7 c 6 a 7 7 6 8 0 8 6 2 3 f f f 0 9 e 4 7 5 5 6 d c a 2 3 6 d 2 7 2 5 3 1 c e 6 c 8 1 7 1 8
C : \ b 2 c e 7 0 a d a 7 3 7 0 8 7 2 d c a 7 0 7 9 9 b e b b 5 9 0 e 3 2 a b 1 e 4 8 b b 8 1 b b b f d 4 a 5 0 0 3 0 4 8 4 e 3 f 7 6
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ q O G S c u d 9 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ z H I 5 T w z 6 . e x e
C : \ 8 9 0 4 d 9 6 b e a 2 5 c 2 0 5 a f e f 6 c 5 e c c 8 6 3 9 c a 2 e 5 c 9 0 1 5 4 5 7 3 0 8 d e 5 d 9 d 7 e 2 0 7 8 8 a 3 e 0 d
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h c b n a f . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 0 0 6 f 0 9 c 3 4 c c 0 3 0 c a _ h c b n a f . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h c b n a f . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h c b n a f . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 5 0 3 0 6 9 4 d 2 b 7 2 4 a 0 0 _ h c b n a f . e x e
C : \ 1 5 f 2 3 f 8 8 b d 7 4 2 c e a a c 2 d 1 7 9 9 7 3 6 5 4 c 2 6 7 7 0 5 5 d 5 5 7 d 9 e 3 d 2 2 8 3 7 9 d 9 6 2 e e 6 5 7 8 3 7
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h c b n a f . p e 3 2
C : \ c 2 a 1 9 1 a d 3 a d c 4 7 b 6 4 8 b a 4 9 6 c 9 0 2 e 1 a 1 f 1 a 5 a b 8 0 6 f b c 8 c 0 d 7 c 1 b 2 4 b 4 1 1 6 1 4 b 8 1 c
C : \ 9 d a 2 8 3 d e 2 3 1 6 d a 3 e 1 2 5 8 2 c 5 9 f 6 e c f 1 2 1 9 a d d 8 4 5 f b 5 3 7 c 5 2 7 f 8 6 1 7 5 2 8 9 c c 4 9 f 0 e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ b w X C t O X I . e x e
C : \ 9 7 d 5 9 2 d 5 1 3 1 6 9 b d 9 f e c 9 7 3 a c f 3 d 3 8 f 2 8 3 6 7 7 e c 2 f 5 6 8 3 3 d 5 c 7 f 4 c 3 a 6 7 7 3 3 f 6 a 6 0
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h c b n a f . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h c b n a f . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 3 2 6 4 b c e 2 e 6 9 5 1 1 8 1 _ h c b n a f . e x e
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 7 6 3 d 0 2 f 8 f a 9 5 6 c a 8 5 9 6 f e d 4 5 b b c 1 4 3 3 e 0 2 b f 2 a 7 9 8 4 8 6 5 e b f 3 8 b 5 6 9 9 5 f 3 3 a 1 5 4 a . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ p L W l E J l 9 . e x e
C : \ 1 7 a b 0 0 3 8 0 3 0 e 0 4 9 2 1 6 4 7 a 5 b 7 5 c f 4 5 1 b 3 4 7 7 c d 0 b 7 a 4 a 7 6 b e 6 7 c 8 8 f 2 d 4 6 d c 7 d 4 a a
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ t j 7 j G l X h . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 1 6 8 5 0 3 a e 3 e 3 6 d 5 4 7 f f 4 b e 4 9 6 b 2 c 0 3 6 7 1 0 7 2 f e 5 5 0 d 9 b 5 8 0 0 6 1 7 9 4 c a 0 b d 8 7 f 7 6 5 2 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h c b n a f . p e 3 2
C : \ e 1 5 8 c d 5 b 9 7 8 9 3 e 7 7 b d a 1 b 1 e 0 3 2 6 a 8 7 9 4 3 c 7 b c 7 5 6 8 f 2 d c 5 2 6 a 9 4 d 1 4 e 1 d a c 7 8 4 1 5
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h c b n a f . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h c b n a f . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a 6 4 2 1 d f b b a 4 9 3 7 b 4 _ h c b n a f . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h c b n a f . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 6 0 6 0 f 8 a 8 f 5 a 6 b 7 c 3 _ h c b n a f . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ h O T S N t K L . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 3 5 e e e a 6 1 c 4 4 1 8 5 d 6 7 6 7 8 8 6 b 9 3 6 c b 2 0 6 a c 7 4 5 b 9 a 2 7 a 4 9 1 d 9 1 d c 1 1 b 9 7 6 8 1 c 8 7 6 d c . e x e
C : \ U s e r s \ A d m i n i s t r a t o r \ A p p D a t a \ L o c a l \ T e m p \ S a B m B C B l Q . e x e
C : \ 1 1 5 8 8 c 2 d 0 1 c 8 0 9 2 2 b c 9 a b 8 4 9 8 7 e 2 c 7 9 6 7 a e a e d 1 b 1 8 6 d 4 2 0 3 d 1 d a 9 6 2 f d d a 4 2 f 1 4
C : \ 1 0 7 8 d b a d d c 5 e c 5 a e f 4 c c 9 0 2 a 6 0 5 d 2 d b a f 0 6 b c d 0 6 c c 5 a a 1 1 b a 9 5 7 2 4 4 b a c a c 8 0 7 c
C : \ d d 9 1 0 d a 5 2 1 b 3 0 b 0 1 4 0 2 7 8 e 2 e 3 6 e e 9 9 7 d 3 4 0 d 2 f 5 4 d 1 3 c 8 e 6 1 b 0 5 5 3 c d f 6 b 3 f a 4 c b
C : \ b 6 8 e 3 e 5 e d 8 e 4 f 3 b 5 9 0 c 0 7 4 6 9 5 0 e 9 9 c 4 4 b 6 0 c 4 7 f 5 d 7 1 5 4 9 3 d f 9 3 9 d a c 7 9 0 8 e a f f 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h c b n a f . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h c b n a f . p e 3 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ Q m r B j P 2 K . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ K A B G 3 w 4 5 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c a 1 d 7 d 9 6 1 6 c 7 f d c d 6 d 3 c 7 c e 1 d c f e f 2 c b 9 4 b e a 3 8 5 8 7 e 7 2 8 4 b b 4 0 1 5 6 0 e a e 1 2 e 2 8 f . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 1 a j o 5 7 4 C . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 8 3 d b 3 4 c 8 3 d 1 d 5 9 e 9 b d 3 6 d 6 1 4 d e f 5 6 4 0 1 5 8 2 3 b 4 3 5 3 8 1 1 6 4 2 b a 4 3 d 1 2 b 6 4 4 3 4 6 7 7 f . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ g d k V n A k E . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c 3 1 3 3 e 2 5 5 b 8 c f f 7 9 7 4 8 c d b a 8 f 8 f d a 5 0 3 8 5 7 a 9 4 9 8 4 e b a 2 0 0 5 2 2 d 0 b 6 c f 1 2 3 0 8 f c 0 . e x e
C : \ 9 0 e 2 0 8 6 5 6 f e 0 9 c 8 e 4 a 8 2 4 a e d 1 d 6 9 9 d f 5 2 8 f 0 5 f a 8 e b d 4 6 2 b b 9 f f 0 7 d 1 a b f b a 2 f 2 3
C : \ U s e r s \ L i s a \ D e s k t o p \ 3 u 5 y M J I g . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ c R e k V 2 n l . e x e
C : \ 9 4 b 4 6 8 c f 0 7 f a 8 c c 9 b f 9 a 2 8 7 8 b 3 1 a 6 d d f 6 8 c b 6 e 8 5 2 1 8 4 8 9 4 d a c 7 8 1 9 1 b 0 7 1 e 8 d c f
C : \ d 6 a a c 2 5 0 8 8 f e 5 f e 3 9 7 b 0 1 1 2 d 9 4 7 6 5 c e a b 0 c 8 5 e 7 3 e 4 2 f f 3 a d 9 0 2 6 2 f 1 f 3 d 2 d 0 7 2 2
C : \ a 3 b 4 c d 0 f 5 c 4 e 7 3 3 f a b 6 c e f 4 0 1 5 9 6 7 0 b d 4 7 8 0 e 7 a 4 7 5 e 1 b 4 6 f 2 f c a 0 c 7 c d c c 2 3 f 2 6
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h c b n a f . p e 3 2
C : \ 3 c c 6 e d 0 5 0 e d 2 f b a 4 4 d 9 2 d b d 0 6 6 4 1 0 9 8 f 1 3 f f 2 a 1 3 4 8 3 f f c 7 a 9 4 8 6 a 0 0 7 8 f 0 9 5 c 7 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h c b n a f . e x e
C : \ 9 6 9 3 9 d e f b 6 c a 4 2 7 2 a c 2 d 6 a 5 c 8 5 1 e f f 6 2 2 2 e 2 2 7 5 1 d 7 a 8 f a e c e 1 c d b 8 e 9 2 3 d c 7 d e 2
C : \ 2 5 5 f 5 d c d 6 f 3 4 a c 8 e e 5 0 4 5 2 1 0 3 2 0 a 1 a 9 3 4 0 0 5 b 7 c d 5 b 5 8 6 7 3 0 b f 6 c a 4 c 1 e 1 8 2 b 1 3 e
C : \ 3 b d 5 3 2 2 7 8 f 2 3 6 7 d c 1 5 e 8 2 8 1 d d 7 6 b a 3 b 5 7 a e 4 d c 6 c d 2 2 0 0 7 3 e 3 6 7 9 b b 5 e 1 5 d 5 0 f 5 f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h c b n a f . e x e
C : \ 8 e 9 d a 7 8 a b b c c 2 5 3 9 3 3 9 f 5 b b 9 0 d 2 e 6 0 f d 8 e b 7 1 d f 6 0 3 a 9 5 e a c 4 6 6 2 6 3 0 2 d 5 4 3 6 2 a 5
C : \ 0 d 5 f 5 b 1 5 2 d 1 6 c 6 3 2 6 a 8 8 2 2 0 f 3 d 7 3 1 0 2 9 9 f a c 1 8 e c 4 3 7 c a 4 1 2 6 6 1 3 5 2 1 9 6 8 3 6 a b e e
C : \ 4 8 e d d f 9 6 f 5 7 3 0 e 0 e 7 b 8 6 3 c 6 b 9 b 4 8 3 1 a 2 5 3 5 6 3 9 b 1 e 5 2 c 4 d e c c 6 1 d 2 f c 6 1 6 c c 2 1 3 d
C : \ U s e r s \ L i s a \ D e s k t o p \ 3 u 1 s v j a g . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 6 0 2 8 d 8 c a e 6 a c 5 b 7 a 4 3 7 e 3 1 6 2 f 4 c 6 3 5 f 8 e d c 2 b 3 7 2 3 9 c 0 b 7 4 2 f e a b b 4 8 5 c 3 7 b 7 d d d . e x e
C : \ d 2 7 a 9 0 a e a 4 8 7 6 6 3 b b 4 f 5 2 9 3 a 7 a 3 a 0 a 0 8 0 0 9 9 7 9 0 8 5 7 7 4 9 8 9 0 2 3 f f d 4 0 5 5 f 4 7 b e 3 a
C : \ a 6 2 0 d 1 a 3 8 f c 0 c c 7 c 0 9 9 0 8 4 2 2 b 9 8 9 d 9 4 7 5 6 a 7 6 0 6 d 3 c 1 6 6 6 d a e c 5 1 6 f 8 b f b 8 d f 7 e 3
C : \ e 4 6 b c 2 9 4 6 4 1 b f b 4 4 8 4 e 3 7 e e 0 5 f 4 9 d a b 1 f c 5 0 5 e 4 7 5 f 5 8 c 5 d 1 e b c 7 b a 5 9 2 c 7 3 6 6 d 8
C : \ 9 2 2 0 c 2 b 3 3 4 4 2 3 e 7 6 e 2 5 3 7 a b 3 0 4 0 6 c 6 e 4 8 6 a f 1 1 5 0 1 a 3 5 a 7 c f 5 e 5 0 f 0 9 7 b 0 3 8 8 a 7 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h c b n a f . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h c b n a f . p e 3 2
Hosts
| IP |
|---|
| 114.114.114.114 |
| 8.8.8.8 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | |
| dns.msftncsi.com |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 61714 | 8.8.8.8 | 53 |
| 192.168.56.101 | 56933 | 8.8.8.8 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 8.8.8.8 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.