3.4
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.63
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Evo-gen [Susp] | 20200405 | 18.4.3895.0 |
| Baidu | None | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200406 | 2013.8.14.323 |
| McAfee | PWSZbot-FIA!17B5D213DE7A | 20200406 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b07717 | 20200406 | 1.0.0.1 |
静态指标
检查进程是否被调试器调试
(2 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545310.469 IsDebuggerPresent |
failed | 0 | 0 | |
|
1727545310.87425 IsDebuggerPresent |
failed | 0 | 0 |
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(2 个事件)
| section | |
| section | petite |
动态指标
分配可读-可写-可执行内存（通常用于自解压）
(8 个事件)
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\misid.exe |
投放一个二进制文件并执行它
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\misid.exe |
将可执行文件投放到用户的 AppData 文件夹
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\misid.exe |
一个进程创建了一个隐藏窗口
(1 个事件)
将读写内存保护更改为可读执行（可能是为了避免在同时设置所有 RWX 标志时被检测）
(8 个事件)
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(2 个事件)
| section | {'name': '', 'virtual_address': '0x00001000', 'virtual_size': '0x00005000', 'size_of_data': '0x00002a00', 'entropy': 7.785696004392148} | entropy | 7.785696004392148 | description | 发现高熵的节 | |||||||||
| entropy | 0.4810738255033557 | description | 此PE文件的整体熵值较高 | |||||||||||
网络通信
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
生成一些 ICMP 流量
连接到不再响应请求的 IP 地址（合法服务通常会保持运行）
(1 个事件)
| dead_host | 103.91.187.97:443 |
文件已被 VirusTotal 上 58 个反病毒引擎识别为恶意
(50 out of 58 个事件)
| ALYac | Trojan.Ppatre.Gen.1 |
| APEX | Malicious |
| AVG | Win32:Evo-gen [Susp] |
| Acronis | suspicious |
| Ad-Aware | Trojan.Ppatre.Gen.1 |
| AhnLab-V3 | Trojan/Win32.Zbot.C205277 |
| Antiy-AVL | Trojan[Downloader]/Win32.Upatre |
| Arcabit | Trojan.Ppatre.Gen.1 |
| Avast | Win32:Evo-gen [Susp] |
| Avira | TR/Crypt.XPACK.Gen |
| BitDefender | Trojan.Ppatre.Gen.1 |
| BitDefenderTheta | Gen:NN.ZexaF.34104.cq2@auXxNqci |
| Bkav | W32.AIDetectVM.malware |
| CAT-QuickHeal | Trojan.GenericRI.S5449057 |
| ClamAV | Win.Trojan.Zbot-64721 |
| Comodo | TrojWare.Win32.TrojanDownloader.Upatre.MAUA@5rueuc |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.b1b8d9 |
| Cylance | Unsafe |
| Cyren | W32/Upatre.HM.gen!Eldorado |
| DrWeb | Trojan.DownLoad3.28161 |
| ESET-NOD32 | a variant of Win32/Packed.Petite.M |
| Emsisoft | Trojan.Ppatre.Gen.1 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Upatre.HM.gen!Eldorado |
| FireEye | Generic.mg.44e6e96b1b8d98bf |
| Fortinet | W32/GenKryptik.CZTO!tr |
| GData | Trojan.Ppatre.Gen.1 |
| Ikarus | Trojan-Downloader.Win32.Upatre |
| Invincea | heuristic |
| Jiangmin | Trojan.Generic.czmjl |
| K7AntiVirus | Trojan ( 00547ef71 ) |
| K7GW | Trojan ( 00547ef71 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| MAX | malware (ai score=88) |
| Malwarebytes | Trojan.Injector |
| MaxSecure | Trojan.Upatre.Gen |
| McAfee | PWSZbot-FIA!17B5D213DE7A |
| McAfee-GW-Edition | BehavesLike.Win32.PWSZbot.pm |
| MicroWorld-eScan | Trojan.Ppatre.Gen.1 |
| Microsoft | TrojanDownloader:Win32/Upatre.A |
| NANO-Antivirus | Trojan.Win32.DownLoad3.foeljv |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM19.1.60F9.Malware.Gen |
| Rising | Ransom.Genasom!8.293 (TFE:dGZlOgEKsHrIqmKeOA) |
| SUPERAntiSpyware | Trojan.Agent/Gen-Upatre |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/Agent-AEBE |
| Tencent | Malware.Win32.Gencirc.10b07717 |
| Trapmine | malicious.high.ml.score |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2013-10-02 20:54:25
PE Imphash
9470ea6ce8a031743fbf1e256278f573
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| 0x00001000 | 0x00005000 | 0x00002a00 | 7.785696004392148 | |
| .rsrc | 0x00006000 | 0x00003000 | 0x00002c00 | 4.977150450770832 |
| .reloc | 0x00009000 | 0x00001000 | 0x00000000 | 0.0 |
| petite | 0x0000a000 | 0x0000014e | 0x0000014e | 3.824617517256452 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x00006448 | 0x00002668 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x00008ab0 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_VERSION | 0x00006150 | 0x00000198 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_MANIFEST | 0x000062e8 | 0x0000015a | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library kernel32.dll:
• 0x50a104 ExitProcess
• 0x50a108 GetModuleHandleA
• 0x50a10c GetProcAddress
• 0x50a110 VirtualProtect
• 0x50a114 VirtualAlloc
• 0x50a118 VirtualFree
• 0x50a11c LoadLibraryA
Library gdi32.dll:
• 0x50a124 CreateFontIndirectA
L!This program cannot be run in DOS mode.
^|S^|=
^|I>|h^|+
^|Rich
`.rsrc
@.reloc
Bpetite
be:F=O
n`llW:
!2ki"#lU[
l T#1@
:/:3M8Hi6{
-Xm8T,]*-X,q;
=&MY?yl
#e@bfN\W
8.1Vm9/p3jK&#
j7p&o,
oV>REp
V}xpb[
x+(KtV"Y.
^+vSELZ"XX
P0Cjb"q:K
;(n0n+Eq_FJhL45MdQ4L
~wdqoH
LXG U@ -{
\0~e*`
DE <I+d+!?|J\
Ap%Rl.U
AVABX#p:)
XS38hTV
KXwo T
#[fI8] `
@hS)G@u
da5i!M
l+ j'DN
/h?`O
H<(]@H
!d1\y{?
p,z*v|+,Y"
b&_Y'i*|
%d";VS
h[ gzt
cRfMMAH
~jo@8~
+5!6)1l@8?W\>
SEeX|g4k|DiRVS
wsnQ,a
aj@&v.
ngsC,MqXilI.
[Z|F-J
xwdc|K
).(kJv
q`@\JLH>
SMD$:>wp
!8@J6a{^f
`V|+qDD
"vKcM=U
@('vbjK+
mB1^&/twtZH[
R,^0U%
9l+@xJ
N{s"TQ
[TV, }
5(.$Ts=Y4
0.4nnl(
KJ )<\@
mPlF8n
. QuG
ppcR^ t
{B+"@2E
~!IhH[
jw,>]Oun%
%c\-;U5
H2?x @
@'zM6Y9@
ch+ *
W;V@Ff/
mj9:A \
k]7#%L
>[An,sB
pA{"w^
#o)+A\_
yC%iK35
"-}\BUQ0
$w|i?24
Xmxne~e@
i^/}t8S@D
2 ?ac
fDGS}
fKeI3zs
9sfhW@
9\B*U:d)R
B>ja%69{
_U;c9e
h+/HtxV
Vi].xEQo%?V
VJh8Gz
s2`)rh[
h\u2/!
@0Seg'
Fd[+Cu
,{'EZUbfU&U6^
WA5 e%lQ
DizI 9
oRLbY-
L,?1S.X83h>:b%/$
?(TC-'A
pH"zwh"j
k'"Cbot
E gU!"r
=[+L@7~]
O+m93\
'R%ok-E
p(o6^razf+
wci9uC
g-&ZaRT
brY\V8i
4g)KBD
JI|-@
S7c G^
H,)QY-@
MX"+eeV ww=
A9=0P>5X
@X9,v~QQ0P!
@HoPse
-_T!Pz\
mK=2T*
i,0KpE
_7Jj }+`!
@`=!T"\
O%NEmM.
_(_M<V;F:U
[DLp-Ns
)oAM[k*Yh5k.
H@?<<OAp B
T9'G,P96
$e.,H
Td v+rx
CpI@R=
k(n]L(
Y}$tZWw% W `
k%"}tg?I
]jvwEMJ
*%41M;
"%]$q>ZlI.
wX$.aWiZ#[B
Ab[9'h'
U,%8pEz*
"^K$xJ=
UblZUp
o*NZv
R+&`aEz
@Du%ph"
=*jzs7D
$S5/$49
n5X4w(
zRc0k[u&@f
lW)2]&5[
2'OoMdk"L4
jN\BGJ*KM@e
OK$WWy
dfuq*xZ$g
#;NvV-
>^V^8Y6Q>N
l+Y[8J
K8mRZbz95
rFA,&%,~
:$.,|~+i
OqJopX
dxDgL$i
rB%}1T;E
+nVn4"
>hP'$6*#R<p=o}ED
6>wc[V@
_ ~KDir$
1>/rJ-.
KR|8b0
@;R}({( !u{R
Mq4FK{X
) p8Mn
g<yO5x
d#=1:#`A
$BE.43
TXS[U&B
T@M#tg8
:N9h{,@
$AE`r\$
&Z'uv\cn
D`V./z
H/m+0*h
RBNB<=tC\$K
t$G7s.CE
`B,7nZ
u*+$<.
<*435`y}$v}{h"t
JU]\B^c
Z^f{W
%dprJ*<j
V48^XXXX]
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
+ F<e]xq:/
9.OGhaRH
VNvnmf
gdDA;8
lVOUOUOUOUOUOVOVOVOVOVOVOVPXQ_X\VUOVPVPWPTN
wwwsssxxx
dZdZ:-,
- - - - - - - - /"
- .!w- -
- - - - - - - +
- / / / / / / / / / {0!/ / `T/ / / / / / / -
/ 0!0!0!0!0!0!0!1"J=REQD5&1"J=RE0 / 1"1"I<SFSF9*0!0!0!0!0!0!0!/
1"2"2"2"2"2"2"2"1!)
2"3#3#3#-
2#5%5%5%5%5%5%5%4%
2#3#3#3#3#3#3#3#G9H9H9B3A3A2B3B3A2A2A2A2-
MessageBoxA
wsprintfA
ExitProcess
GetModuleHandleA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
LoadLibraryA
CreateFontIndirectA
user32.dll
kernel32.dll
gdi32.dll
I D R _ V E R S I O N 1
V S _ V E R S I O N _ I N F O
F i l e I n f o
F F F F 0 4 E 3
F i l e V e r s i o n
2 . 0 . 1 . 7
P r o d u c t V e r s i o n
2 . 0 . 1 . 0
C o m p a n y N a m e
S a n n y L t d .
P r o d u c t N a m e
L o o k F o r
V F i l e I n f o
T r a n s l a t i o n
l C : \ 2 a 5 5 a 7 1 7 8 3 6 a 2 8 9 c b 1 e 8 b 7 4 6 f c 7 5 2 7 5 9 a 0 5 e 2 c 4 2 2 0 f 0 3 a c 8 a a 8 7 d 0 0 b f 7 2 b f c 4 e
C : \ b 4 a 6 b c f f 8 3 c 7 2 c e 4 4 1 5 7 1 d e f 2 5 d 0 9 c c 6 1 6 5 a d 0 c 1 5 e 9 b 4 9 6 f b 6 c c 4 f 8 c d a 3 b 9 e b a
C : \ U s e r s \ L i s a \ D e s k t o p \ U 0 V g u W k W . e x e
C : \ _ g 8 y F L L i . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ 2 2 O p p 2 e L . e x e
C : \ 2 8 5 d 3 7 c 1 8 0 b 2 4 e e 8 8 5 e d 6 d 7 6 3 6 f 3 a 0 e 0 2 b 2 f e 8 c f 9 0 7 b b 9 b 2 2 d a 2 e 4 f 2 0 0 f 6 6 b 3 6
C : \ 6 f d b 4 f d 9 c 4 a 1 a 0 1 b 0 c 5 a f 8 8 e 1 c e e 1 9 6 c 3 5 a 0 d e d 3 1 2 b 1 5 d 1 b 9 a 9 6 5 b c b 6 f 4 5 a 9 e d
C : \ 3 3 e 7 7 d 1 0 1 4 f a 6 9 0 e 5 a 1 4 7 d 6 3 6 f 3 9 e 8 d 7 9 8 e 5 f 4 5 2 7 9 7 2 d 1 1 c c 5 a 2 5 e 6 e c 3 0 6 6 c 4 b
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ z X t T z 8 X N . e x e
C : \ d 6 2 7 7 0 a f c b c 0 2 2 b e 1 e 2 7 1 5 a b d 6 e a c e 5 a d e a e 0 5 b 2 2 8 d 9 1 d c 7 e 6 b d 8 a 5 5 f 2 1 f f c e 8
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ y Q C x b l E r . e x e
C : \ e L G z Z a J V . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ r 8 M K Q r R d . e x e
C : \ z q P 0 1 w 2 P . e x e
C : \ U s e r s \ J o h n n y C a g e \ A p p D a t a \ L o c a l \ T e m p \ 1 e 4 f 9 c e 8 d e 2 d 8 7 5 4 3 5 b 7 1 f 2 8 c e c a 9 f 4 4 4 5 d 1 f 3 5 f a 1 c 3 f 1 a 3 9 d 5 9 c 0 b 9 2 9 9 a 8 d 5 a . e x e
C : \ I l R P B 3 G I . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ l g D B V j d L . e x e
C : \ z 0 1 i A g E M . e x e
C : \ 8 a 6 3 0 9 e e 0 7 0 0 f 4 b a b e 0 2 d 4 0 5 e 2 1 f a 2 f d 1 c 2 5 e a 4 1 f 1 1 d c 0 b 3 b 1 6 3 7 4 e 3 2 4 7 7 c 8 3 3
C : \ 0 b c 0 9 2 d 4 2 1 2 7 9 7 a 2 3 d e 9 d 8 6 5 4 0 a 4 e 4 b b 9 b 3 7 9 b f a a 6 e a c 7 5 b 1 c c 3 0 9 1 c 1 0 7 a c d 9 f
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ f O T 0 w s 5 3 . e x e
C : \ 3 1 5 a 2 a b 1 e 6 f 0 e c e 4 3 8 b d e 8 f 5 5 2 e b 0 9 c 5 6 d b a c a 0 2 b e f 9 4 8 3 0 a 5 4 d 3 d f d e 6 5 1 e 6 8 7
C : \ U s e r s \ L i s a \ D e s k t o p \ B t q r I 7 Z D . e x e
C : \ 8 G P 1 Q K p j . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ n E n Z 3 9 D a . e x e
C : \ Q q z e 8 4 b o . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ V 7 h q 8 B t 7 . e x e
C : \ d Z n O 3 Q T e . e x e
C : \ c a 7 8 1 6 f a 4 8 8 4 f c 2 8 9 7 4 6 a 2 3 a c 1 e f 2 4 9 c 3 1 c 4 a 6 2 8 9 f 2 9 6 d b 4 9 b d e e f f 2 0 1 c 3 f 8 5 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ b T 4 N o Q l 3 . e x e
C : \ l B U O 4 d e O . e x e
C : \ 2 f 0 4 9 d 9 0 b 4 6 8 5 1 6 b f 0 d e 3 4 a d 1 9 3 2 1 4 0 4 8 b 3 0 0 3 e b 8 8 f 7 4 8 c 3 6 6 d f d 3 2 2 e 4 8 b 8 4 4 c
C : \ 4 f 7 7 f c b b e 3 d 2 7 c c 5 0 9 9 d 0 a f 3 c 1 4 1 3 9 c 0 2 e 7 3 f 0 c a 2 b 9 9 3 9 e a 2 8 7 e 9 1 f 4 7 c 1 6 0 f 9 b
C : \ U s e r s \ L i s a \ D e s k t o p \ A n P F x x k i . e x e
C : \ X 9 a J P 3 d X . e x e
C : \ e b f 1 0 4 0 3 b 0 b 1 8 a 2 7 2 f 0 e f 5 4 3 7 5 4 3 7 a 1 1 6 0 f c 9 a 8 0 8 a 9 8 a 0 5 f 5 c d b 2 a d d 3 1 5 8 1 1 2 5
C : \ b 1 1 c e 7 0 7 2 1 0 d 0 4 1 e f 3 c b 4 9 2 0 9 b 4 7 d 0 c c 1 f a 3 f 2 c 7 4 4 1 6 5 5 8 d 5 6 f b 2 9 5 e 5 1 0 d c 6 3 2
C : \ 9 0 b 8 7 f 9 e 6 f e f 5 b 4 6 4 8 8 a e 3 7 3 6 6 9 a 0 a a 5 2 a 2 c 1 3 4 1 6 9 c 7 f 4 d 9 d 2 c b 3 3 5 d 4 4 6 c a 4 e 5
C : \ U s e r s \ L i s a \ D e s k t o p \ 6 T 2 z z b h B . e x e
C : \ 5 c e a 5 d 4 6 a 0 e 8 e d 7 2 b c 9 d a d 6 a c a 9 e 7 c 5 2 1 d f 9 f e d 6 d 4 3 d e a f e 1 8 d 9 f e 5 0 4 7 2 2 6 c f b
C : \ 7 1 b e 0 4 9 5 2 0 8 0 1 9 a 7 9 2 c 8 e c 4 6 0 a 9 9 8 9 a 8 d b e 5 4 d e 5 a f f d 2 7 1 8 4 9 7 5 9 f f 5 7 7 4 0 e f d 9
C : \ U 7 z J W F U Q . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ l Q s 3 0 l y x . e x e
C : \ 7 p f m p k Z m . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ V u t x w 8 z y . e x e
C : \ k O y p J Z v t . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ Y E x o y x j I . e x e
C : \ b J Y t e x S D . e x e
C : \ 4 0 7 2 d 4 2 5 1 1 e 7 8 7 5 f 6 8 e d 1 9 d e 1 f 1 3 a 0 8 3 4 4 d 2 7 8 5 9 1 7 b c 7 1 b d 9 5 e 6 d 2 1 f 7 7 c f 9 5 7 f
C : \ r N X _ s d i H . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ x U 2 M y p o n . e x e
C : \ n m H R Q E L A . e x e
C : \ W I N D O W S \ s y s t e m 3 2 \ d 4 8 c 7 7 e 4 5 8 c f a 8 4 a 6 e 7 2 7 2 d 0 2 8 c a a 5 e 2 e 7 3 d a 9 7 3 b b 2 8 8 e f b f 9 9 c 6 4 8 8 5 1 2 4 c c f 0 . e x e
C : \ V 5 o z f 4 L 3 . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ p w Z w M q k j . e x e
C : \ 3 2 c 5 6 7 7 6 7 6 7 3 3 8 8 5 5 a 0 7 b 3 0 f b 1 a 1 c b 7 3 b 1 3 c a c a 1 2 a a 1 0 5 b c 9 f 8 6 d 4 5 5 1 d 2 e c 3 0 6
C : \ 4 1 b e d e 0 e 6 2 5 e 0 0 3 5 2 6 7 d 1 9 f d 5 5 c 0 a 3 d f b 7 4 b a 4 e f 3 7 f 1 a 6 6 c 2 9 8 5 e 8 f a 4 f 9 5 1 b 0 d
C : \ 8 9 b c 2 9 c 5 e 7 c 5 c d 8 1 1 3 c 2 3 7 f 4 a 1 d c 3 0 6 b a 0 1 8 9 0 8 f 4 5 4 a 2 e 8 5 8 f 5 0 9 1 9 7 8 d 1 e 0 3 d 3
C : \ 1 4 8 6 5 b 0 5 5 3 6 d e d 2 9 8 1 c 3 a e 8 4 a 2 f f 5 c 7 b c a c 8 5 b 6 0 f e e b b e c 2 b 0 f a 9 f 5 3 6 a 0 d a b 3 a
C : \ 3 f 1 6 a 7 7 a e 3 d a 0 4 6 a b e b 4 0 d 5 c c a d a f 0 c 5 f 6 8 f 5 c e 6 6 3 1 d 9 a c d 8 b 3 d b 5 b 3 3 8 f 5 2 7 1 1
C : \ U s e r s \ L i s a \ D e s k t o p \ u 9 i C f F K Q . e x e
C : \ _ T T Z B b i a . e x e
C : \ 9 0 e 1 e c 0 c 8 8 e e 8 a b c a 7 3 4 7 2 7 4 3 5 1 9 b 7 8 3 f 6 8 2 b 4 e 9 e 7 c 3 9 5 b a a 8 b 0 1 0 2 7 c 4 f b 0 9 a f
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ a 2 4 c b b 5 1 6 2 e 3 0 d a 4 4 c e b 1 2 f 8 9 a c 7 6 b 6 2 c a 2 6 e 5 5 6 f 0 3 c a b f 2 1 5 7 e 0 7 e 0 3 1 b 5 7 b 0 2 . e x e
C : \ 0 1 1 0 1 1 c 8 6 7 a a 1 b 4 4 4 2 a 6 6 3 6 d 4 c 1 a 3 1 d 5 4 e 9 0 2 1 c 1 d e f 7 2 a 9 8 1 d 8 6 0 d e 1 8 2 c f c 0 a 6
C : \ K f C K v _ 1 j . e x e
C : \ 5 6 8 d e 6 e e 5 8 2 2 d e 5 f 3 f e b d 9 c d c 1 7 c 7 3 e b 8 8 c 7 f 5 a 0 2 0 6 d 1 f 3 3 b a d d 4 9 6 8 6 2 f 5 0 7 7 d
C : \ 6 f 0 3 8 6 c 2 c 0 b a a 5 b 1 c 6 d c b a 5 e 3 f f e 2 3 c e c c c e 6 0 3 0 8 5 4 5 b 0 8 0 f 1 9 4 7 3 0 3 4 4 a 1 2 b c c
C : \ 4 5 1 c 5 c 6 7 5 c 6 a 6 7 8 3 5 4 7 2 a 3 4 7 1 1 1 e 9 6 b 3 9 a 7 c d 9 5 9 d d 9 3 8 1 9 c 6 6 2 c 8 e f 3 5 7 9 2 0 a 1 9
C : \ f c 0 7 3 d f 0 c f 7 2 f 8 3 4 a 4 e 3 b d 1 5 c b e 7 9 4 3 c 5 e 7 9 6 b 5 5 4 e 9 2 4 9 b 0 e 8 1 8 5 9 b 2 1 1 b 0 6 5 b 3
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ m i s i d . p e 3 2
C : \ 9 9 a 1 4 3 f 3 0 1 b 3 8 3 d e 2 f f f a 8 6 5 8 d 7 3 6 0 4 f c c f e b b 2 9 c 0 6 6 8 4 7 e 8 9 b 4 c 0 d 6 1 9 c 3 2 3 d 7
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ m i s i d . p e 3 2
C : \ f R b u o 4 Q x . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f i l e . p e 3 2
C : \ 3 q G 6 r 4 v A . e x e
C : \ 4 a 4 3 a 1 0 1 3 7 8 4 c c 3 8 7 e a 6 d c 6 c 4 7 d 6 d 6 1 1 b e 2 b 3 b 6 a 2 2 f a 0 3 b 1 4 5 4 a 3 7 8 7 b 2 2 0 4 6 f e
C : \ a 2 5 f 0 6 7 d 7 c a f e f 4 8 b e c e 9 8 a 6 1 0 3 6 2 b a 6 e 7 2 e 5 e 4 2 d 6 b 1 d d d c 0 9 6 f d c 3 c 1 6 6 6 7 d f 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ N K e i 3 k 6 z . e x e
C : \ 8 8 7 6 6 2 3 b 7 1 2 f 2 b c d a 8 2 f 4 9 7 b f 1 4 3 2 b 0 5 0 5 c 8 4 f 9 6 d c f 8 c 2 5 c c f 3 9 e 5 a b 3 8 d c 8 e f 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ p u T V v g 0 R . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ c 4 7 6 8 f 0 6 3 3 2 b a 6 4 f 0 a 6 c 0 1 1 9 e 3 7 f 6 7 3 d b e a f 2 4 a 7 1 5 2 b 1 6 2 d 2 f 9 7 d a 9 2 f 1 3 9 f 7 e 9
C : \ f 3 3 e 8 5 2 9 7 c e e 4 b 1 5 5 0 6 8 e 3 c e d d a 0 1 2 2 8 2 b 2 0 7 f 2 6 9 5 4 e d a 9 f 3 8 6 c f 0 8 6 d 0 7 a 3 1 7 c
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ m i s i d . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ 2 6 d 2 b c a c e 7 9 6 d f 3 f 7 7 6 f c d 1 2 3 9 0 0 b c b f a 2 4 4 8 9 e 1 e d 3 8 9 8 b 0 a 0 3 d 5 6 3 8 1 f 8 3 0 b d f
C : \ 6 4 4 d a V t R . e x e
C : \ 7 e f 5 a 4 3 2 9 d d 1 9 a e 9 a e 0 e 6 1 a d a b 4 1 5 6 4 4 3 7 5 9 9 2 0 b c 5 2 3 6 a c 3 f a 2 c 6 1 9 2 4 5 8 2 d f 3 9
C : \ O f t I 4 7 b n . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ H 7 A T 6 5 P k . e x e
C : \ b 6 8 a d 2 8 d 1 5 2 c 1 2 a 3 9 9 e 7 4 d 9 6 3 c b e 0 5 1 3 0 d 1 e 4 9 0 f 1 2 c 1 a 9 e c 0 c 9 3 6 a f c 4 4 7 1 b 3 7 7
C : \ 5 2 3 1 5 f 2 2 0 5 c 2 5 d 7 8 2 d a e d 1 2 1 2 b d 4 c 9 d a e f f b 0 a a c 2 2 c a 0 1 5 2 a a 1 5 e 0 c d 8 8 d 5 7 e a d
C : \ 0 h z u p g 0 h . e x e
C : \ f 6 b d 8 9 8 a 0 5 7 a 6 e 0 b 0 1 0 9 5 e 3 9 c 6 4 0 6 4 a 7 f e e 5 5 0 4 8 6 d d 9 7 4 2 c e f 0 5 9 b 9 9 0 c 3 b 1 5 f 1
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ V u G y W e o d . e x e
C : \ L S G O H G w n . e x e
C : \ f c 8 b 9 3 4 7 e e 4 0 a 3 8 e 9 0 f 7 4 4 9 1 6 1 c 5 2 2 3 0 3 0 e e 2 5 e 8 1 0 1 e 1 f 5 b 2 8 f d b d 0 6 6 f 1 d 5 1 e 0
C : \ w H y g T v a n . e x e
C : \ 5 b 6 1 e c d 3 6 c 5 6 6 a e 3 6 9 1 e 7 7 0 5 f 9 4 b d a b 7 9 e 6 6 d 7 5 4 6 6 8 d 3 8 7 2 5 8 e 5 8 c 3 d 6 4 f 5 4 e 9 0
C : \ 4 f 1 e e 9 f 7 e 0 2 0 2 3 c 3 0 c 5 4 c 7 6 5 0 2 d 3 9 5 3 5 5 d 7 e b b 0 8 3 3 a d f 4 6 6 2 7 c 0 f c 7 5 f a 3 8 a 1 1 2
C : \ U s e r s \ L i s a \ D e s k t o p \ H N a c 1 k p H . e x e
C : \ 8 x H 9 F 6 a t . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 8 j 5 x 8 B b H . e x e
C : \ f _ 9 h G K O j . e x e
C : \ b 9 f a 1 2 1 3 4 0 8 9 e 9 a 5 4 8 c 8 c 2 a d 7 4 8 a 2 1 9 a 2 2 1 8 7 9 b 9 5 b 2 d b 3 5 b c 9 a e 7 5 4 a 2 2 b 8 6 f 1 c
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ b k 3 v c 9 H I . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ . . e x e
C : \ a d 0 3 3 a 5 8 e c c 0 4 5 a 5 f 0 9 4 5 b 0 a e a 0 3 1 4 1 e 6 4 4 6 8 e 6 a 9 b 5 2 8 4 5 6 9 d 5 9 6 b 2 3 c b 4 4 e e 6 a
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ Y L E h W e q C . e x e
C : \ G c w A z r z S . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 1 v S V 9 m I a . e x e
C : \ r M C T T M 8 o . e x e
C : \ 6 9 c 5 a 4 7 7 a b 0 7 0 9 5 1 1 0 7 f c 5 a a a 1 5 8 b 2 1 6 8 4 d 2 7 2 e d 2 0 a 6 2 e 6 7 c d a 9 6 4 0 5 4 e 5 3 7 f e f
C : \ F N Q H a H b a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b d 7 8 5 3 1 8 0 0 5 4 e c 9 4 0 c f 6 b a c 4 b 6 4 7 6 6 4 0 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ F z I u V d k 5 . e x e
C : \ D 6 1 V s q v W . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 5 E i e U 9 X f . e x e
C : \ 3 5 0 7 d e 1 9 7 4 8 c 7 d b a 1 8 0 c 8 0 5 f 9 5 7 5 5 5 9 8 b 9 9 2 8 8 b f 5 7 b 9 4 c d 4 6 8 e e 1 a 5 9 1 9 1 a 1 9 c 6
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ m i s i d . p e 3 2
C : \ 6 1 a 2 9 8 a 3 6 f 1 a f 0 e 8 6 4 c 1 7 1 a 4 5 6 2 7 c 4 3 7 b 4 5 6 c 9 d e 2 8 6 e a 1 a 4 4 4 5 1 d 7 1 a a a e c 7 a 5 7
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 5 j V b 2 V E t . e x e
C : \ d f 4 b f 7 b 5 6 6 5 9 f e 5 e 0 2 7 3 a 4 b 6 6 1 6 0 c f c 0 8 5 5 6 8 0 9 1 a 1 c b 9 7 2 2 c 7 7 4 7 3 1 5 6 c 6 6 4 8 6 7
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ N n c C L E R 4 . e x e
C : \ 1 4 8 9 3 5 a 8 5 7 2 e d 0 7 5 7 a 3 4 b e f f a 0 a f 1 4 6 c 2 0 f d 0 8 4 f b 5 c b f 1 6 a 2 3 6 6 9 4 c 5 e 3 d 4 2 a 2 6
C : \ 7 u H p D U L O . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b f e 5 d f 8 5 e 6 2 f e 2 0 a 9 5 8 6 c 6 9 3 a b c 5 2 2 a 3 . v i r u s . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ L P 9 I c 1 C K . e x e
C : \ L k K C E T 0 u . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ 2 g O s s 8 t c . e x e
C : \ k 9 k m K 4 y o . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b b 7 0 6 7 7 3 0 3 7 1 d 8 2 9 7 d 6 7 c 6 5 e e d 4 4 4 2 c 3 . e x e
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ c 7 a 2 9 5 6 4 1 e a 6 d 7 3 c 8 c 6 c 3 6 2 c e f e 0 9 0 0 c 8 a 5 8 b 0 a 9 8 5 d a 9 5 e 3 9 8 9 e 1 a 7 d e 5 2 5 c 4 0 b . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ m i s i d . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ D V N X i 4 r 7 . e x e
C : \ 4 b a a 2 4 8 b 8 b 8 8 8 6 b d e e 5 3 8 7 0 a 3 d 6 d 5 e c 7 0 d c 2 d d 4 5 8 7 b b 6 8 2 9 b 4 3 2 3 6 e a a f b d 6 3 1 1
C : \ 7 A Q H 6 R q j . e x e
C : \ 1 5 4 c b 7 9 3 e 9 0 f 9 5 1 7 a a d 5 7 3 2 1 6 f 7 4 4 b 5 d a c 3 c 1 c 1 0 a 0 f 9 1 1 5 6 a 0 7 e e a 8 0 8 b b 2 8 5 2 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ m i s i d . e x e
C : \ U s e r s \ R A 4 9 1 ~ 1 . V U L \ A p p D a t a \ L o c a l \ T e m p \ c 8 d 7 2 2 f f b 8 e 1 f 4 c 6 e 5 d a 3 4 5 0 a 8 9 c 7 3 4 4 . e x e
C : \ 2 9 2 b 8 5 9 d b b 0 f 4 1 6 f b 9 7 d b 6 9 7 d 1 5 e 5 b 6 d f 1 7 d 6 9 d 8 8 8 0 3 c c 8 e 4 6 0 6 6 3 3 a e 5 a 5 5 0 c 3
C : \ N 0 8 _ 6 L q F . e x e
C : \ e 3 1 0 d c 6 3 2 9 a 7 3 a d 8 d f 4 1 8 8 0 d 2 0 6 6 1 f 3 a c 2 0 3 f f 8 e 6 b d 1 b c 2 d 2 d 7 0 9 0 1 2 7 b e d 8 3 6 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ m i s i d . e x e
C : \ b 6 6 b 2 b 6 5 5 9 0 a 3 1 6 d 7 d 1 0 1 8 3 8 a d 2 a 3 0 1 b 6 0 e 6 d 0 1 1 0 2 6 5 9 3 b f b a 2 e d 7 a f 0 e 2 4 f f a 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ G A Q 2 0 Y f Z . e x e
C : \ 7 d 3 5 4 d 6 a a 1 7 2 c a 9 7 3 4 4 1 5 9 1 6 4 d 9 5 3 c 0 8 1 8 3 4 d b 8 0 b 3 f 5 f c e e 9 0 6 1 3 f 3 f c f 7 d e 8 b 0
C : \ 7 a 3 0 6 a 5 6 1 f e 8 4 8 0 b 7 9 9 0 a 7 2 a f 9 f c d 0 0 3 a d 8 8 a f 5 f c e b e 2 d 9 8 4 2 4 7 e 6 7 6 6 7 4 8 d b e 4
C : \ f 2 6 6 3 d 3 6 b 1 7 7 b b f f 2 c a 2 1 b 6 6 a 3 8 7 9 f 2 a 3 7 8 c 7 9 a e 2 5 2 f f 1 7 6 1 5 c d d e 3 1 4 c 5 1 2 1 2 c
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ O P 9 z E 8 1 7 . e x e
C : \ N m z W y r g B . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a 2 8 c 3 3 7 d 6 5 7 1 4 d 9 1 e 8 f 7 1 2 a f 8 b 9 4 4 4 6 0 . v i r u s . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ m i s i d . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 3 1 c c c 7 9 1 9 d 4 b d 4 7 6 _ m i s i d . e x e
C : \ 9 2 9 4 b 6 8 9 0 b 4 5 0 0 0 b 7 4 e a 8 b e c 7 b 6 6 a 0 4 9 c b 7 e f 9 8 4 4 9 d 9 a f 8 1 e 9 c 3 5 a a f 7 8 e d f 8 7 e
C : \ 9 6 e 9 a b 3 3 2 7 3 3 2 4 8 4 d b f 5 c 4 f c f 6 a c 9 8 b 9 a f 4 b c d c 8 e 6 b f a 3 d 1 c 9 8 5 d 3 f a 1 1 0 6 9 6 d 8
C : \ 3 8 5 f f a 4 d 9 e 9 e 4 0 c 7 3 7 7 0 3 1 f 3 4 f f 9 3 7 1 d 8 6 1 d 0 e 4 d c d b e 8 7 4 0 3 e e e f 7 f f 7 5 5 a f a 9 0
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ m i s i d . e x e
C : \ a 4 2 6 9 3 1 7 8 3 8 3 4 4 6 d 2 9 7 a 4 3 5 0 9 5 a 8 7 2 2 c 7 9 c d 9 6 0 c 8 b 0 6 6 5 1 2 c 5 d a 8 e b 1 d e d 0 4 5 d 5
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ j D X 3 t e y c . e x e
C : \ U s e r s \ J o e C a g e \ D e s k t o p \ N 9 r E C p j x S o . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 6 5 e 6 3 0 5 9 4 4 d 3 7 5 b 7 b d b 1 5 5 d f 5 3 5 a 6 4 a 9 . v i r u s . e x e
C : \ U 0 e 3 _ 9 i 1 . e x e
C : \ 2 3 c d d 9 a a d 5 0 3 2 4 3 a b b b f 1 6 0 0 4 7 c 5 d 7 2 7 3 2 a 3 e c e 3 b 2 8 b 3 4 0 9 4 1 4 3 a 5 6 1 0 c 8 8 8 a 5 e
C : \ 0 T B O Y p o N . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d 4 e 9 4 9 b b 2 9 7 5 4 4 3 d 1 9 4 c e 2 0 9 c a 0 b 1 4 5 2 . v i r u s . e x e
C : \ d 1 b 0 3 f e 4 6 9 7 1 e 7 3 9 1 b 5 1 9 6 6 7 8 e c 9 6 9 6 3 3 c 1 f 0 d 8 2 0 4 9 d 3 6 1 0 7 c d 9 b e 6 d f a 2 a 1 5 d c
C : \ 9 3 e d 9 7 0 5 d d d f e 1 9 5 5 a 6 b 1 d 4 3 e f 3 0 f 0 5 5 8 5 4 e 9 2 d 2 b b e 9 6 2 4 7 2 7 d 9 5 e 4 9 6 e 3 e e a 8 3
C : \ 7 1 e 7 f e 1 1 5 6 b c c 3 5 c 8 a 3 e 0 a c 5 3 6 2 0 c e d 6 c 1 2 d 3 d 3 7 5 0 4 7 c d 0 b 5 1 a f e 9 0 9 d 5 5 7 c 5 8 f
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ o L Q 5 k v H D . e x e
C : \ W I N D O W S \ s y s t e m 3 2 \ 4 b 4 b 2 d f 7 f 8 9 d f 6 7 5 0 d 1 b 9 1 b e 5 b c 2 3 7 3 a d 1 8 c 4 3 8 6 b b f 2 b 6 f 0 8 f 0 e c 5 f e 4 9 e 7 f 5 e 1 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 2 b 7 6 1 1 3 0 b 3 9 8 5 8 0 6 6 2 e 8 b b 2 8 5 9 e 1 e a 5 9 . v i r u s . e x e
C : \ 6 C e o h x 3 7 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ d A 2 f z j z h . e x e
C : \ P P B Q Q g F T . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ V p B h h o P u . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e 7 7 e 3 b 4 3 b 9 8 6 4 1 8 f 8 a a a 4 5 2 4 e c c 0 b 1 e 7 3 b 9 3 9 6 0 0 4 d 7 5 5 9 3 4 c 6 6 3 d a 7 c 7 e 6 d d 5 d c . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ b D R j t o w W . e x e
C : \ 8 Z m r R w _ 1 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ 8 c 7 a e a b 2 f c 5 f 1 7 6 b f e 8 8 . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d c 3 0 8 1 e e 0 e a 3 6 4 a 5 _ m i s i d . e x e
C : \ J z H z E l l 4 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c 3 3 4 5 3 e 8 7 b 0 a 0 7 0 9 8 9 9 d 4 e f 2 1 5 d 4 0 9 8 2 . e x e
C : \ f c e f e d 9 a a 1 7 f 7 8 f f 1 1 4 2 2 a b a 7 6 b 0 f 3 2 b d 2 b 2 3 0 b 0 2 d 3 6 6 e 3 a 1 4 e 2 d c 8 2 4 3 c 5 0 d a 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ m i s i d . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f 4 2 f f f 4 d 6 7 2 2 a a 9 4 _ m i s i d . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ i U W r l a i F . e x e
C : \ d b 2 2 e 1 0 c 3 6 7 1 f 2 8 6 1 a 3 9 c b 4 7 d f 8 0 c 4 6 b b b 6 d 2 1 3 f f 1 c 8 2 6 4 2 9 a 4 b c b 2 d 7 c 9 4 0 0 3 c
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ m i s i d . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 f b 2 f a b 1 e a 3 0 5 b 2 e _ m i s i d . e x e
C : \ 2 b 7 0 7 d 8 1 3 2 b 9 4 6 e 3 9 6 9 f 5 d 2 2 e b 1 4 4 8 8 b 4 1 7 4 5 1 c 6 4 7 2 3 5 3 1 b 5 b c 3 0 9 1 2 c 2 3 6 5 2 1 4
C : \ d a a 2 f a 9 3 2 3 6 3 f 0 1 7 7 0 3 2 6 6 d c f e c 5 7 1 2 4 d d 5 c f a f 8 1 2 3 c 9 e 3 c 5 c 0 7 6 7 4 4 0 0 c 7 5 a 2 e
C : \ 3 a 3 4 f 9 8 0 4 c d 0 8 e e e e 7 5 f 2 0 6 8 5 2 1 a b 0 1 0 b 2 8 4 a f 4 b 1 3 1 a 8 4 2 0 5 a 2 0 5 f d d f 6 8 9 8 f 2 6
C : \ 4 a e 8 a 0 a 6 7 1 e f 9 6 9 e 2 f f f 5 b 3 b 6 1 4 d b 2 c 0 6 1 5 0 e 6 1 d 5 0 8 5 1 9 1 4 1 d a a a a f a 8 b 2 4 0 d 0 6
Process Tree
-
078ed96acce1a4a3e365485d7df3b4558b124674a99e0cb923d875075261d69c.exe (600)
"C:\Users\Administrator\AppData\Local\Temp\078ed96acce1a4a3e365485d7df3b4558b124674a99e0cb923d875075261d69c.exe"
- misid.exe (1852) "C:\Users\ADMINI~1\AppData\Local\Temp\misid.exe"
Hosts
| IP |
|---|
| 114.114.114.114 |
| 8.8.8.8 |
| 103.91.187.97 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com |
A 131.107.255.255
A 131.107.255.255 |
131.107.255.255 |
| dns.msftncsi.com |
AAAA fd3e:4f5a:5b81::1 AAAA fd3e:4f5a:5b81::1 |
131.107.255.255 |
| bestccc.com | A 103.91.187.97 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 8.8.8.8 | 53 |
| 192.168.56.101 | 57665 | 8.8.8.8 | 53 |
| 192.168.56.101 | 57665 | 114.114.114.114 | 53 |
| 192.168.56.101 | 51758 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52215 | 8.8.8.8 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
| Source | Destination | ICMP Type | Data |
|---|---|---|---|
| 192.168.56.101 | 114.114.114.114 | 3 |
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | c2d66edf9457d7e8_misid.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\misid.exe |
| Size | 43.2KB |
| Processes | 600 (078ed96acce1a4a3e365485d7df3b4558b124674a99e0cb923d875075261d69c.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | 8fe291ccca197edb3cfdc4984d1c0620 |
| SHA1 | 094fc77f8aa3f1ef93dfb5adab5889c05a7a0ca7 |
| SHA256 | c2d66edf9457d7e86acec41cd429406186a53d375b2e95bfa89e4fc7c1a6ad5f |
| CRC32 | E28FCC6B |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.