1.0
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.73
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Agent-AULS [Trj] | 20200114 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Downloader.Waski.a | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200114 | 2013.8.14.323 |
| McAfee | GenericRXHD-XW!6D0BB5D00FA7 | 20200114 | 6.0.6.653 |
| Tencent | Trojan-spy.Win32.Zbot.tzfja | 20200114 | 1.0.0.1 |
静态指标
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(3 个事件)
| section | .MPRESS1 |
| section | .MPRESS2 |
| section | .imports |
动态指标
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 60 个反病毒引擎识别为恶意
(50 out of 60 个事件)
| ALYac | Trojan.Zbot.IKS |
| APEX | Malicious |
| AVG | Win32:Agent-AULS [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.Zbot.IKS |
| AhnLab-V3 | Trojan/Win32.Upatre.R305327 |
| Antiy-AVL | Trojan[Spy]/Win32.Zbot |
| Arcabit | Trojan.Zbot.IKS |
| Avast | Win32:Agent-AULS [Trj] |
| Avira | TR/Crypt.XPACK.Gen |
| Baidu | Win32.Trojan-Downloader.Waski.a |
| BitDefender | Trojan.Zbot.IKS |
| BitDefenderTheta | Gen:NN.ZexaF.34082.dqY@aifLCXbG |
| Bkav | W32.AIDetectVM.malware |
| CAT-QuickHeal | Trojan.GenericPMF.S5667825 |
| ClamAV | Win.Downloader.Upatre-5744087-0 |
| Comodo | TrojWare.Win32.TrojanDownloader.Upatre.AAL@5iclp5 |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.00fa78 |
| Cylance | Unsafe |
| Cyren | W32/S-7f247be0!Eldorado |
| DrWeb | Trojan.Upatre.87 |
| ESET-NOD32 | a variant of Win32/Kryptik.GSDY |
| Emsisoft | Trojan.Zbot.IKS (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/S-7f247be0!Eldorado |
| F-Secure | Trojan.TR/Crypt.XPACK.Gen |
| FireEye | Generic.mg.6d0bb5d00fa78930 |
| Fortinet | W32/Kryptik.CRUP!tr |
| GData | Trojan.Zbot.IKS |
| Ikarus | Trojan.Win32.Bublik |
| Invincea | heuristic |
| Jiangmin | TrojanSpy.Zbot.egez |
| K7AntiVirus | Trojan ( 0052964f1 ) |
| K7GW | Trojan ( 0052964f1 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| MAX | malware (ai score=83) |
| Malwarebytes | Trojan.Upatre.Generic |
| MaxSecure | Trojan.Upatre.Gen |
| McAfee | GenericRXHD-XW!6D0BB5D00FA7 |
| McAfee-GW-Edition | BehavesLike.Win32.Virut.kt |
| MicroWorld-eScan | Trojan.Zbot.IKS |
| Microsoft | TrojanDownloader:Win32/Upatre.AA |
| NANO-Antivirus | Trojan.Win32.Zbot.denqev |
| Panda | Trj/Upatre.B |
| Qihoo-360 | HEUR/QVM19.1.8E1F.Malware.Gen |
| Rising | Downloader.Upatre!8.B5 (RDMK:cmRtazpi9rSWr/MgtfvlwAdBe72b) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Mal/Zbot-QL |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
1979-06-21 06:03:35
PE Imphash
1fb57b3425048683d2b780e925e7835f
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .MPRESS1 | 0x00001000 | 0x00008000 | 0x00007000 | 3.460625638802884 |
| .MPRESS2 | 0x00009000 | 0x00001000 | 0x00000400 | 5.9012319132165265 |
| .rsrc | 0x0000a000 | 0x00002000 | 0x00002000 | 3.9745917530814974 |
| .imports | 0x0000c000 | 0x00001000 | 0x00000400 | 3.799752676707672 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x0000a070 | 0x00001ca8 | LANG_GREEK | SUBLANG_DEFAULT | None |
| RT_DIALOG | 0x00007df0 | 0x00000130 | LANG_GREEK | SUBLANG_DEFAULT | None |
| RT_GROUP_ICON | 0x0000bd98 | 0x00000014 | LANG_GREEK | SUBLANG_DEFAULT | None |
| RT_MANIFEST | 0x0000bdec | 0x000001e9 | LANG_GREEK | SUBLANG_DEFAULT | None |
Imports
Library USER32.dll:
• 0x40406c PostQuitMessage
• 0x404070 SendMessageA
• 0x404074 DestroyWindow
• 0x404078 DefWindowProcA
• 0x40407c PostMessageA
• 0x404080 CreateWindowExA
• 0x404084 ShowWindow
• 0x404088 UpdateWindow
• 0x40408c LoadCursorA
• 0x404090 RegisterClassExA
• 0x404094 LoadAcceleratorsA
• 0x404098 GetMessageA
• 0x40409c TranslateMessage
• 0x4040a0 DispatchMessageA
Library KERNEL32.dll:
• 0x404008 GetStartupInfoA
• 0x40400c GetCommandLineA
• 0x404010 HeapAlloc
• 0x404014 HeapReAlloc
• 0x404018 InterlockedExchange
• 0x40401c ExitProcess
• 0x404020 GetModuleHandleW
• 0x404024 GetModuleHandleA
• 0x404028 GetTickCount
• 0x40402c HeapFree
• 0x404030 RaiseException
• 0x404034 RtlUnwind
• 0x404038 lstrcpynA
• 0x40403c LoadLibraryA
• 0x404040 LCMapStringA
• 0x404044 WideCharToMultiByte
• 0x404048 InterlockedIncrement
• 0x40404c InterlockedDecrement
• 0x404050 GetProcessHeap
• 0x404054 InitializeCriticalSection
• 0x404058 DeleteCriticalSection
• 0x40405c EnterCriticalSection
• 0x404060 LeaveCriticalSection
• 0x404064 GetVersionExW
Library COMCTL32.dll:
• 0x404000 None
L!Win32 .EXE.
.MPRESS1
.MPRESS2
.imports
U\j h@@
MUU}ht
}it2<h
@E00ME
M0MMEEU@@
ME0@ME0
00M0@0E
FG3@_^]
MM@ME@
@@0MMU
0U@M0U
M@MM@0
@U@U00MU
UUEMUE0
@UEEUUU
000U0M
U0M@EU@
0UEMUU
@0MM0UE
M0@0@E
EE@0MEEE
E0U@E0UUMEUM
U@EMUME@EEM
YG+EU@
0U0EE@
U@@@@0E
0E000MM
EUEEMEM
UUU@@EUM@E
EUUU00E
@000@0U00E0MMU@UU0
ME@@UUU
0@E@E0@UE
UEE@M0
U0@UME@0W
E@UME@M0@
@M000U
0M0UU@
E@E@M0
MEEEMEMME0@M0
0EMUEESW
VQCY^3_[
@EM0U0
@@E@MU
AVWAf9
GGEGGEM;r
U@M@UM@
@0EUUU
@0UM@E@U000U0
EMMM@@
M@UUU@0@U0
U0@EEE@M@E
E@UUE0M@@0M
E0MMM0E@E
EM@M@EM
MMMMEE0
MUM0ME
0@00MM
00E0@U
@U@@00@
MU@MU0M0E@0MEEE
@@00ME@
0M0@E000
@MM0@0
UUM@@M
EEMMUU0
@M@E@E
EMEUE0
MEM0MM
MUEME0M0MU
EEUU@EUM@
EMEE@U0E
E@U@M0
E@EM@E
MEUM0@@
0M0000@MMU
MUU0EM
EU00ME
UEE@@@00EU
0@0MEUEU
U@EE@E
U0M00000U0
@@@EM@@M0M@M
UE0@@U
ME0UQV
@MUM@@
EME0@0M
@E0U@M
BK";pO
hJ]@T8Q
XsP#54
j].20"P
5+hK.,
[hKG0?\sc
)Tpr+V]
iFBVU)ADiomZ9.@
DAJ_U)AZ~N
\\0?5_u_*UM
b[m\;/A~o[a\<4
w;6!PE
x.z!>[uwceU(A%
JB_g(Yesn|L9$
&8e<'S
i/ZV!f5Fw_m
nJVVlb
5+pJ/o@Ew=
kLA^z<
qV,%pG3sJ*,T
mHBC6!5
YiBrW(62[3r
!J@!$8UB96
F]hSz8>{d?.3
Br{.Z:
Tw> V-bz{
/I3zeSn
{R,9MA2
,~Y=L5|N
MppV|+Q
B!8:,#
Uz7i4!c
f{g~Fd(!h
!g%j ?f
xvwKw>GF3U
`nrJ^,9MA2
g=OJNZ/
A= lIr
3|*<2}-j@au%
^<8Iq7%59t}
#3/HbU
5zU LcHW
0tv0JAL~
"EB>nT>;NFm
yq4!cx i
^xz.iY
qI/{7R.8wF{
1H/.3f'
c`M>nj=
kYhO5gM
G5uAUZ9gt
*Y9*NhhjTf
)|l9M%G
Jg--YWR0v
/-j9o3cQDFV;
~#T lA
$iVKKW$Jy.
GM*XN6p
v#M9bv
M0E@0M
@EEU0E
M0EEMMU@@
]U=8T@
USER32.dll
PostQuitMessage
SendMessageA
DestroyWindow
DefWindowProcA
PostMessageA
CreateWindowExA
ShowWindow
UpdateWindow
LoadCursorA
RegisterClassExA
LoadAcceleratorsA
GetMessageA
TranslateMessage
DispatchMessageA
dKERNEL32.dll
GetStartupInfoA
GetCommandLineA
HeapAlloc
HeapReAlloc
InterlockedExchange
ExitProcess
GetModuleHandleW
GetModuleHandleA
GetTickCount
HeapFree
RaiseException
RtlUnwind
lstrcpynA
LoadLibraryA
LCMapStringA
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
GetProcessHeap
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetVersionExW
COMCTL32.dll
8Muex<
KERNEL32
VirtualProtect
G(XPTPjxWXt=
Riched32.dll
RichEdit
immortable
hairgrips do must merrily cold and postseason
reapportionment
incorrectly
octahedra odeon Rossini
GetModuleHandleA
GetProcAddress
KERNEL32.DLL
USER32.dll
ShowWindow
COMCTL32.dll
t7Kt'Kt
ie95he
GDGDFC
-!-!-!-!-!-!-!-!-!-!-!-!-!-!-!-!-!-!-!-!-!-!-!-!-!-!-!-!-!-!-!-!
."3&3&3&3&3&3&3&3&3&3&3&3&3&3&3&3&3&3&3&3&3&3&3&3&3&3&3&3&3&3&."
0$5'5'5'5'5'5'5'5'3&5'5'5'5'3&3&3&5'5'5'3&5'5'5'5'5'5'5'5'5'5'0$
2%6(6(6(6(6(6(6(6(6(6(6(6(vp6(6(6(6(6(6(6(6(6(6(6(6(2%
4&9*9*9*9*9*9*9*9*6(6(7(9*}v9*9*9*9*9*9*9*9*9*9*9*9*4&
5'>/>/>/>/>/>/>/>/>/>/
x>/>/7(7(<.>/>/>/>/>/>/>/5'
7)D3D3D3D3D3D3D3D3[MD3D3C3D3D3D3D3D3D3D3D3D37)
>/H9H9H9H9H9H9H9H9G8qgH9G8
{H9H9H9H9H9H9H9H9H9H9H9H9>/
D4L=L=L=L=L=L=L=L=qhL=qhL=L=D4D4J<L=L=L=L=L=L=L=D4
K<RCRCRCRCRCRCRCRCRCRCRCRCRCRCRCRCRCRCK<
RCWHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWHRC
YJ\L\L\L\L\L\L\L\L\L\L\L\L\L\L\L\L\L\L\L\L\L\L\L\L\L\L\L\L\L\LYJ
_P_P{p{p{p{p{p{pxmxmvkvkvkvkvkvkvkvkvkvkvkvkvkvkvkvkvkvkvkvk_P_P
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity
version="1.1.1.3"
name="Same uno"
/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel
level="asInvoker"
uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
USER32.dll
PostQuitMessage
SendMessageA
DestroyWindow
DefWindowProcA
PostMessageA
CreateWindowExA
ShowWindow
UpdateWindow
LoadCursorA
RegisterClassExA
LoadAcceleratorsA
GetMessageA
TranslateMessage
DispatchMessageA
KERNEL32.dll
GetStartupInfoA
GetCommandLineA
HeapAlloc
HeapReAlloc
InterlockedExchange
ExitProcess
GetModuleHandleW
GetModuleHandleA
GetTickCount
HeapFree
RaiseException
RtlUnwind
lstrcpynA
LoadLibraryA
LCMapStringA
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
GetProcessHeap
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetVersionExW
COMCTL32.dll
S e e t h e G N U G e n e r a l P u b l i c L i c e n s e f o r m o
A b o u t L o n g o
M S S h e l l D l g
W o o D P e k e r , v e r s i o n 1 3
C o p y r i g h t ( C ) 2 0 1 2
s 5 e 2 7 5 f 0 8 6 6 a e a c d d 7 e 9 4 9 2 1
C : \ E V W V U I S q . e x e
C : \ 1 L d x Y S Y C . e x e
C : \ V Y 2 O A v
C : \ U s e r s \ L i s a \ D e s k t o p \ Y f S U t 7 J o . e x e
C : \ 2 3 a 5 f f 0 b 3 7 d d 7 8 9 6 6 1 1 7 7 7 e 5 7 6 8 c 6 8 e 0 5 0 d 0 4 b 4 9 2 e 8 8 f d 1 b 7 f 0 1 e e 7 1 a a 9 3 4 b 9 7
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 6 a 8 H k u 3 E . e x e
C : \ d U F n J B M I . e x e
C : \ a 3 f c 1 9 f 4 9 d 3 6 7 7 7 8 6 3 f a 6 3 e 1 0 d a 3 7 b 3 b 7 5 8 1 4 9 c 0 c 5 0 b 7 5 a f 6 f 9 f d 7 9 f c 3 d 0 8 b 9 6
C : \ U s e r s \ L i s a \ D e s k t o p \ a v T 2 U M 5 a . e x e
C : \ 5 9 f a e 0 8 a e 1 4 1 5 5 1 9 4 2 f d 8 1 3 2 c 6 2 3 d e 4 b 9 d 5 7 e c 8 f b 5 4 6 0 4 5 6 8 9 e 8 9 0 9 b 8 4 9 8 e 6 a 1
C : \ 4 e a 5 8 a 7 1 5 7 3 6 9 d a 0 4 b 5 f 7 6 8 8 a 6 c 4 5 1 1 b b 7 a b 2 8 a 5 6 0 b 6 8 c e c b a c 9 6 e 7 5 d a 2 c c d 9 6
C : \ U s e r s \ L i s a \ D e s k t o p \ v c l 0 V L n I . e x e
C : \ e 7 3 0 c 2 8 4 9 b f c 7 4 3 2 8 1 e 3 b 8 7 a 7 f 1 c a 5 7 f 8 6 c 7 7 0 f 4 9 a b 5 9 c b 3 e 0 2 7 8 b e a 8 a c 8 f d 0 2
C : \ 6 d 9 f 2 8 d 8 5 b 0 a 2 a 7 1 3 e 5 d d f 5 9 3 8 6 8 e 4 1 8 d 0 4 e 3 a 5 0 8 8 7 3 d e f 6 8 4 5 c 0 0 1 4 3 f a e 6 d 7 3
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ R B b u I Q d z . e x e
C : \ 8 0 3 3 1 6 a d a 6 e 5 8 e 3 f 6 0 a 6 2 a f 0 1 c e 9 8 8 3 6 4 c a 2 7 d 0 b 5 5 5 d 6 2 9 5 f 2 9 6 2 9 e 1 b 3 e 4 1 9 a 2
C : \ c c 6 1 6 6 b 9 0 b 1 8 f 7 3 7 b 9 9 7 3 5 5 8 c 5 5 b 2 f 9 d b e 5 c d 0 c 8 0 c a 7 b b c 7 a b 4 e b 8 d a 3 d a 8 0 4 3 1
C : \ 7 1 b d f 6 e 1 1 1 a f b 7 a 2 5 0 5 a e e 5 d 6 2 0 0 0 f 2 0 b 4 5 b e e e 6 1 a 3 5 7 e b 3 1 3 9 2 3 e e a 1 f 2 d 2 0 5 b
C : \ U s e r s \ L i s a \ D e s k t o p \ f q R 4 p R P 1 . e x e
C : \ 2 e d f f f a a 4 9 5 c 3 3 4 0 8 e 6 7 8 e 1 3 d 4 d 1 2 2 9 6 a 4 1 d b 9 6 5 f d e b 5 3 2 b a e 5 3 0 9 d 3 0 7 3 e d 4 3 d
C : \ 0 8 3 1 e b d 6 0 f d d 0 0 1 b 7 1 d 0 1 9 f 5 0 9 e 3 c 5 f 9 5 5 e d 4 a e 4 c 2 1 4 0 b d 8 2 4 3 1 a a 3 c 0 7 7 c 2 1 4 7
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ T N C R s e K J . e x e
C : \ e e 2 e e d 4 3 9 d a 4 d 2 4 1 2 a 0 c 0 b 8 7 7 d 3 f 6 a b c 6 5 9 e 3 9 8 2 4 4 a 8 c a 8 1 d a f 6 9 0 8 c 6 a 9 f a 5 6 e
C : \ 6 f d a 4 b f 8 a 5 7 a e 8 2 9 a d 6 4 7 7 2 1 5 5 4 9 6 8 4 d 2 2 4 6 b 2 f 1 1 f 5 b 8 0 5 8 4 3 4 f 6 c c 2 7 a e 8 2 0 3 7
C : \ d 1 1 a 9 8 f e d 7 a 8 a 8 1 8 b a a b 4 7 8 2 7 f 4 6 f 2 b c 1 6 f c 7 7 5 6 6 a 8 c 8 c c d 5 e 3 a 0 2 d 4 7 6 b d 7 d 9 1
C : \ 1 c b 3 9 5 6 2 9 e 3 3 8 b 7 f 6 d 7 c 0 1 b 3 c a d 5 e c 3 f 6 0 7 f 9 f 2 4 2 a 8 f 6 3 d b a f 9 1 f c 3 1 1 d 4 5 8 7 3 5
C : \ 6 0 f f 6 1 6 c 3 a 7 5 1 3 a 8 c e b 9 3 8 5 4 1 7 c 5 2 9 3 1 5 2 e 3 b f 8 1 2 6 7 c 0 e 8 6 d 7 7 f a 9 a 2 d f 0 5 e 0 5 b
C : \ U s e r s \ L i s a \ D e s k t o p \ r 9 B y J W e v . e x e
C : \ 6 a 3 1 4 7 c 4 9 3 1 e 8 c 6 0 f 8 3 2 7 0 2 8 d c e e 9 5 c d f c 2 a c e 3 3 7 7 2 e 5 2 2 0 b 2 5 d 6 6 f d 4 c d b d 7 4 a
C : \ U s e r s \ L i s a \ D e s k t o p \ X d f F T O E V . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 0 1 3 f 0 b c 1 9 2 4 b d 1 2 a b a c 1 f e 6 7 e c 4 4 a a d 0 2 f 5 f 0 4 9 c 3 9 c f 1 2 9 e a 6 7 7 5 f 0 3 9 9 3 2 a 4 a e . e x e
C : \ 8 2 c 0 5 1 5 3 d 5 8 7 1 6 8 2 5 2 a 5 8 f 2 f 2 6 2 1 0 3 9 a 8 1 5 9 f 6 d 9 f 9 d 1 d 0 0 a 6 2 5 d 3 9 2 d 1 a 3 b 3 4 3 0
C : \ a d c 2 7 0 9 c 3 d 4 6 7 8 6 2 5 d e 5 0 3 7 a 6 e d 8 6 b 8 e b 9 3 2 b a e 8 3 c b 3 3 f d 3 e 0 1 4 c 9 0 7 8 7 d e 7 9 c 9
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ l a c F e i S M . e x e
C : \ 1 2 f 0 0 9 3 2 d 1 0 e 4 0 b e e 2 c f b 0 f 0 1 3 b a f 1 6 b 6 7 5 7 4 4 7 9 5 b a 0 1 f 4 5 a d 2 d 5 6 3 5 7 1 c 2 d 4 2 3
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f p x l b . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f p x l b . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c f b e e b 0 b 6 e 3 b f 6 7 7 _ f p x l b . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ 2 2 f s h L Q R . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ a 4 d 2 d 2 e 4 3 7 2 f e c 0 1 f f a c c 3 5 5 f d f 0 6 4 4 f 1 c d 8 0 f e 3 0 1 b b b d 1 2 8 b 1 3 0 1 2 9 1 e f 4 c 7 f 4
C : \ 6 4 d f 1 b 0 2 d 2 e 7 b 3 1 c a 4 a 7 8 d 0 8 1 b d 8 1 e 9 7 3 0 8 c e 5 4 7 e f 8 3 2 6 d c 6 f 8 2 a b 3 4 c 7 8 3 c f 7 0
C : \ U s e r s \ L i s a \ D e s k t o p \ 5 Y e G A G o w . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 2 d e 7 9 d 0 0 2 e 3 a 1 e e b 7 a 1 f e 2 b 3 3 e 4 f 7 d f 9 3 5 c 4 3 4 6 b 4 c 8 b b 7 d 3 0 8 f 3 7 1 6 2 9 3 f 0 5 2 2 b . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ x I h A g x L V . e x e
C : \ 9 a a 8 4 a 5 3 8 4 6 3 7 2 4 2 5 c 3 3 0 8 e 4 4 c d 2 0 9 5 4 8 7 6 6 b d d 5 1 e 6 c f b 0 a 1 a c 2 e 5 c f c 1 3 0 6 6 0 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f p x l b . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f p x l b . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e 8 b a 7 1 4 a c 3 5 7 e 6 9 4 _ f p x l b . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f p x l b . p e 3 2
C : \ a b 9 1 d 6 c 0 9 f 9 5 3 e d 9 0 6 6 7 f 4 e 3 7 2 c 8 f d 6 8 6 3 3 e 8 d 2 0 5 e 7 5 2 8 1 4 3 b a 9 4 7 1 f 9 2 2 b 8 6 8 c
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ J G x C s K 4 2 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e 6 a d 1 e 6 3 7 7 f 2 9 d 6 7 e 2 9 9 f d f 2 a b 5 e b a 1 1 9 b 0 2 3 e b 6 4 a 8 a b a 1 f 6 0 9 3 3 3 f 0 2 9 1 f 5 e 2 6 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f p x l b . p e 3 2
C : \ 3 5 e 6 1 0 1 5 6 6 1 0 8 4 1 d 8 1 8 9 2 5 3 e 6 f c 4 b 6 3 8 6 4 1 1 8 d 7 2 f b 9 f e 1 9 b c 6 5 2 6 c d c f e a 0 f a 1 3
C : \ 1 4 d 0 2 a 8 a e c 0 3 0 5 1 2 7 5 b d 5 7 8 3 8 6 5 9 6 9 7 1 e 1 7 d 0 a 0 4 7 3 7 2 3 0 7 4 3 b d 1 6 1 b d 4 6 6 b 4 7 9 f
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f p x l b . p e 3 2
C : \ 2 0 f 9 7 c d b 2 6 9 2 9 5 4 6 b 2 c f b 0 3 c 0 4 3 c 1 8 f 6 1 8 0 d 9 c 3 e a f c 3 6 e 4 a 3 e 9 2 3 2 7 5 c 0 a 6 7 d d 9
C : \ a 1 3 4 e 7 c 6 e c f c 5 2 8 b 4 c 9 d f f 9 7 d 3 5 c e d 7 2 8 f 8 b 9 7 4 a 0 a 8 9 9 f a 2 2 5 2 d 2 e 7 2 d 6 7 4 4 8 b 0
C : \ 0 b c 6 a a 5 d d c 8 3 5 d 2 c 2 8 b d 3 3 b e 2 a 5 2 5 a 9 4 f 4 8 5 4 8 9 8 6 7 8 d f b 9 a 9 8 1 d b e 4 4 0 1 1 a f 8 b d
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f p x l b . p e 3 2
C : \ f d a 6 2 d 2 7 a e 8 0 3 2 1 0 d a d 5 b e a 3 6 9 9 f 3 6 f 6 4 b 9 9 f 1 1 e 7 f d 4 8 a d 4 8 e d 6 7 e 2 f f e a c c 2 9 8
C : \ c 7 a 4 f a 6 a f 9 d 6 2 5 b f 6 b f f 9 2 5 c 1 f 8 0 a 1 2 9 e 6 5 7 c 3 6 7 a b c 9 4 c b 8 9 4 9 f 3 1 6 a c 1 c 3 8 8 b b
C : \ 2 a c 6 5 a 2 3 7 2 2 b 8 2 7 5 4 6 4 d 9 1 4 b 4 a 4 8 8 4 7 9 4 a 8 4 6 d 5 3 c d 4 6 f c f 3 4 1 0 2 8 3 6 2 a 3 f 0 3 8 a 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f p x l b . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ A L u u K I v 1 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f p x l b . p e 3 2
C : \ f 8 1 b d 6 f 1 4 0 3 1 4 7 4 0 4 d c 5 4 5 c 5 1 b 2 5 6 4 1 a 7 3 5 8 1 9 e 5 e b 2 c c 8 0 b 7 4 0 e 3 0 e 8 5 8 2 a e 5 3 4
C : \ 2 2 0 0 4 6 7 b 6 9 1 3 a f a 1 0 b 9 1 c 2 b d 0 e 5 8 b e 5 9 9 5 8 2 e 4 6 a f 2 9 6 c e 8 1 0 0 1 5 4 e e f a c c a 8 1 1 0
C : \ c 3 c f 7 3 c b 7 7 1 c 1 8 f d c d f 1 4 4 9 0 a 2 e 2 3 9 6 7 2 c 2 e a 5 b a c c b f 9 b f e d a 0 b 7 d 7 b c 9 c a 1 6 6 6
C : \ U s e r s \ L i s a \ D e s k t o p \ T d Y Z U 2 1 j . e x e
C : \ 4 f e 7 8 2 7 0 4 c 5 4 1 3 c a a 1 f e 9 e 6 4 7 c 0 2 2 a 7 c b 1 b f 1 e b c b 4 a d e b 0 7 a c 9 0 a 5 3 d e 7 5 5 a 3 6 8
C : \ 0 4 b e 7 a 7 5 5 8 9 5 b 6 1 f 3 7 4 6 8 b 3 3 d d d 6 8 2 3 3 8 0 e 2 3 4 0 6 5 f a f 5 f c 2 e b f 2 a a d 1 e 5 9 2 6 4 8 c
C : \ U s e r s \ L i s a \ D e s k t o p \ m d o V u X J j . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f p x l b . p e 3 2
C : \ 4 7 c b b 4 6 1 3 b a 6 2 9 5 e 5 d a 7 6 0 e 9 2 b f 8 8 3 8 f 1 8 c c b 9 a 4 6 8 7 0 7 3 3 c b c a 3 8 5 5 8 e a f 5 3 8 f c
C : \ f a e 4 9 2 e 6 6 8 6 2 4 d 0 b 2 8 4 e e 7 3 9 5 c 5 2 d e 6 9 0 5 a 2 9 a 0 6 b 3 2 f 9 1 2 7 f 9 a 2 6 8 3 d 3 a 5 a 4 c c 5
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f p x l b . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f p x l b . p e 3 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ h r o 1 p p N D . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ U s e r s \ a r y a \ A p p D a t a \ L o c a l \ T e m p \ 2 d d b 0 2 b 7 a a 6 e 2 f e d 2 d a 2 e b 6 7 f e 6 3 e 3 e 3 1 e 8 8 5 5 4 c . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d t t c o d e x g i g a s . 5 7 9 c 2 f 0 8 4 0 7 8 6 3 4 f 8 4 3 9 e 6 f 1 2 8 f 4 7 4 d 2 b e d 9 b a 0 d . e x e
C : \ 7 3 d a 0 9 b a 8 5 5 9 c b 4 0 6 b c 9 8 2 1 6 8 5 7 b 8 d 1 3 0 1 9 e 4 c f 9 9 b 1 d 1 c 0 3 b 7 7 d 2 3 f d f e 6 4 b 0 8 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f p x l b . e x e
C : \ 3 0 2 3 6 3 c 7 4 c d b 2 1 6 a 5 c 5 9 3 3 a 9 a a d e 6 8 1 1 9 9 3 4 0 7 3 f 2 5 f 2 7 f 0 d 9 1 5 2 3 7 f 7 0 3 8 f 6 e 6 f
C : \ 4 0 c 9 4 6 d 4 6 5 0 2 0 f 6 1 9 9 c f f 2 9 6 9 4 c c e 0 d 4 a e b 5 b 0 5 d 2 3 4 c f f b 8 b 9 1 d b 2 0 9 f b 2 f d b 3 5
C : \ 7 c 6 9 9 4 5 5 c 1 f 7 7 8 e 9 e 4 b 5 8 e 4 a 2 f a c f 2 e e 3 d c 6 b c 1 1 a 3 4 9 1 9 a 6 a f d 8 7 6 f 2 c 6 e 8 c 8 c 3
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f p x l b . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c 6 4 0 1 f 5 d e 3 d 9 b 8 8 5 _ f p x l b . e x e
C : \ 8 3 2 8 f a c e c 5 f b 5 f 6 8 5 a 3 a 8 a 6 6 4 0 c c 6 5 2 9 4 b 3 e 5 0 f 6 1 e a 7 b c 0 1 f d 9 d 7 4 a 1 b 3 b 9 5 8 b 2
C : \ 8 9 9 2 b 1 9 5 7 6 a c d 4 c e e 3 1 b a 5 d 1 9 2 3 4 e 8 4 8 7 2 f 0 c 9 8 c c 5 0 d 0 e d 4 8 d 8 f d c 9 b 6 2 c a d e 6 f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f p x l b . e x e
C : \ 4 8 5 9 9 e a a e d d a e 2 2 0 a 7 b d a e 6 5 b 3 c 8 c e 6 b e c 3 1 2 c f d 9 0 a 3 d 5 1 c 6 5 d 5 6 c a 2 1 5 8 4 9 8 0 3
C : \ U s e r s \ L i s a \ D e s k t o p \ R O O 7 8 W o i . e x e
C : \ 1 1 3 7 a 6 8 a 8 2 f 4 2 f 4 b 6 9 b 7 c 2 f e 6 2 7 d 6 3 9 7 0 1 4 1 f 2 5 6 0 2 0 6 d 3 6 d 9 5 b d 4 d 3 9 5 e d c 1 e 4 1
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f p x l b . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f p x l b . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f 5 f 1 c f 8 9 9 7 9 4 c 8 0 d _ f p x l b . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f p x l b . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a 2 0 a 2 0 b 4 1 4 8 5 7 2 9 a _ f p x l b . e x e
C : \ 7 f c b 9 1 7 8 8 5 e a 1 1 d 9 8 d 8 f a c 9 a 0 b 7 7 2 e b 8 c 9 2 c c b 3 3 0 4 f 2 1 7 2 e 5 2 4 0 5 8 8 5 9 0 0 0 0 f f 8
C : \ f 5 1 0 0 8 3 9 0 7 b 9 b 2 1 7 4 0 c e f 4 b 3 b a 5 0 e 7 0 2 3 a a 5 f d 8 7 c d 1 9 7 3 3 b c 2 d 8 0 3 9 1 9 3 9 0 1 9 b f
C : \ U s e r s \ L i s a \ D e s k t o p \ v y C J l P a O . e x e
C : \ 1 2 4 c d 6 4 5 0 a 5 d 5 5 1 5 6 b 3 3 8 9 6 1 6 7 c 0 d c e 0 4 c c f f a 5 6 0 e 1 6 b 0 f 1 f 3 9 f 2 9 3 7 5 6 c 9 3 7 1 9
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 1 3 f c 2 d 6 d 0 7 a 8 0 c 2 d d 2 3 e a 5 3 8 e 7 3 6 4 a 7 2 f 2 9 a 8 3 f f 5 b 0 4 7 f c 7 8 f f b 5 4 4 4 e 0 f 2 1 c e 1 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f p x l b . e x e
C : \ 7 1 4 a 0 7 1 a c f 3 7 1 6 b a 0 5 6 7 6 9 8 b e 3 3 8 6 a 2 c e 4 d 4 0 1 5 8 1 a 3 d 5 8 1 e 9 7 6 a 2 7 8 4 e 6 f e f 6 4 6
C : \ 8 7 0 a a 3 0 a a f 0 5 2 0 5 6 5 d 1 4 f 0 9 b 8 8 a 6 a 4 7 4 f f d f 2 6 3 5 2 0 4 7 4 3 7 b 0 6 b 3 7 c 9 c 6 a 2 7 3 5 4 e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ D U w J R 6 a U . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 4 0 c 5 9 1 8 e b 4 8 d e 2 3 2 1 d 7 c a b d 2 9 a 5 3 c f d b e a a a 3 8 d d 9 0 7 b 6 3 0 d 6 3 b b e 8 7 e b 7 9 0 5 7 b 1 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f p x l b . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 2 0 e 0 c 7 4 5 b f 2 b 1 7 7 a _ f p x l b . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ 1 P N R 1 Q y C . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 2 b 7 f 9 8 1 0 e c f 1 6 9 4 a 4 d 4 5 1 e 4 6 e 2 9 8 e a 1 4 8 5 f c 2 b 9 3 6 c 8 1 f f b 6 0 2 b e d 7 b e f 4 a 0 1 d 7 0 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f p x l b . p e 3 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ F N A b P V o 9 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 2 f f 8 8 4 b b 7 4 3 f d 8 9 8 _ f p x l b . e x e
C : \ 2 5 0 6 7 5 4 e e 7 d d e d 6 0 e f e 5 d 6 c 6 1 3 9 e 2 2 0 1 7 b 6 a 2 3 a b 1 9 1 9 8 9 a a f 7 5 2 6 e 7 c 3 9 7 6 0 a c e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f p x l b . p e 3 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ g U c S M k 9 A . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ 7 y X 2 z p t 5 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b c 7 d 5 f 8 2 9 0 5 0 d e 9 7 8 8 6 d e d f 7 4 b b a 6 6 b 4 c 7 4 4 6 a e 3 9 e b e 0 a f f 2 d 9 e 7 0 7 7 a 4 7 5 2 d 7 0 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ B O 0 K l q v 8 . e x e
C : \ 0 5 2 8 3 9 4 7 8 2 1 5 9 1 c 6 d c c 8 8 0 d 4 b 0 d d e 6 b 4 5 7 f 7 b 9 e 4 8 c 6 2 3 4 7 8 7 2 e 8 3 9 2 3 6 a 4 e 0 2 d e
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ W u 6 i 7 Z A N . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ e a 3 6 4 1 2 7 d 8 8 3 a 9 9 7 3 e b a a 0 d 9 4 3 9 a 9 3 8 8 c f 7 c f 2 2 f a 7 d 6 d 7 a 8 9 4 4 0 5 8 4 0 7 e d 3 0 3 8 4
C : \ 8 7 0 0 2 0 7 e c 7 a e 2 1 a f 5 f e 1 3 7 0 f 4 0 5 9 0 b 2 a f b 4 9 a 8 1 f b a 0 9 6 7 4 8 8 1 3 d b 1 4 7 4 f d 4 e 0 3 d
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ i q a F t f i j . e x e
C : \ 3 5 4 a d 7 7 5 0 7 c 5 7 1 b c 3 c e 3 9 6 a d b 8 a 7 a 4 7 7 5 4 f 3 8 e 2 0 0 2 4 9 e 0 8 3 f 7 0 2 f f 1 6 4 9 7 b 4 4 3 2
C : \ a 9 6 c 9 7 3 f 1 1 e d e e b 2 d a a e 8 a 2 f 0 c b 6 3 c a 7 2 6 a f 4 3 5 e 0 7 6 0 9 1 d 5 4 6 f 7 1 5 2 d b c b 2 7 4 f 1
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f p x l b . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f p x l b . p e 3 2
C : \ 5 0 c 0 f 6 d 2 b 4 6 9 c 0 1 6 f 1 4 a e e 9 8 8 8 0 d c d d c 3 1 c e e c e f 3 4 b 8 9 2 9 8 7 3 4 6 0 b c 7 1 3 a c 4 e 6 c
C : \ 0 f 7 4 7 8 8 c d 8 f 4 5 3 8 c b 1 e a 3 2 4 f a 3 8 7 f e 6 0 9 8 1 e 9 7 e 1 9 0 e 8 c 5 7 d a d 3 a 2 a d b 9 b 7 7 d 7 a 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f p x l b . e x e
C : \ 8 c 8 6 9 f 1 f 4 6 2 c c d 3 a 8 7 c 4 b f d b c 0 4 a 4 c 8 a 4 3 6 e 5 e 2 4 3 4 a 6 3 6 b b 5 e 7 4 8 4 3 5 9 c e 7 7 a 8 8
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f p x l b . p e 3 2
C : \ b b c 4 d 8 c 1 f 0 a 4 a 2 4 7 3 a 0 3 f 1 1 1 d 8 d b 5 f 6 e 2 7 2 5 5 2 3 0 a f d f 9 4 b 8 1 4 8 f a e 9 e 6 5 9 d a d 5 5
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f p x l b . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 1 3 c a b 7 1 a 3 5 6 f a e a 9 _ f p x l b . e x e
C : \ 7 b 8 5 f e 8 6 5 6 4 f 2 c 5 2 5 8 0 5 f a 1 6 d 5 a 6 e 1 9 8 5 9 3 9 1 d 9 8 4 3 a f 1 3 c 6 2 4 e f c 1 4 6 2 4 e 8 a 5 6 b
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f p x l b . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f p x l b . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 5 1 3 d e 6 1 0 b b e 0 d 7 2 5 _ f p x l b . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 8 O y S S 9 Y S . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e 9 c 0 4 8 6 1 6 3 5 d 9 6 9 b 7 f f 5 9 8 8 1 8 1 3 8 0 f b c 3 c 8 0 3 3 3 d 9 8 5 7 1 2 4 9 f d 0 5 4 0 8 e f f a 3 5 b 0 0 . e x e
C : \ f e 7 8 c e d 5 7 5 f 8 0 a e 3 6 b d e 1 b 5 4 8 7 0 f 3 9 c d 0 0 3 4 3 7 0 5 b d c f 4 1 b 9 0 2 3 0 9 7 f 5 f 7 4 0 8 5 4 a
C : \ 1 6 2 4 a 4 b f 0 9 c 6 e d f 8 3 7 6 f 2 1 3 b c e 3 8 2 7 9 7 5 1 1 c 2 0 8 4 0 c 1 3 9 8 f a 1 9 0 8 9 8 3 6 7 c 2 2 4 7 7 d
C : \ e 1 0 4 2 1 2 a 8 7 a 5 4 d a 2 4 5 0 f 5 e 7 d 0 7 5 2 f 5 5 c 0 7 8 2 c 6 4 4 2 0 d 2 8 5 f 5 b 1 6 5 6 d 0 c 1 c 2 9 8 c 3 0
C : \ 5 d e 5 a a 8 e 0 e c 7 2 6 8 6 e 2 6 9 8 5 b f a e 6 e 6 8 5 e 4 c 1 f 3 f e 4 6 9 8 b 5 7 b e d 8 8 4 0 2 4 6 0 5 9 f f 9 f 5
C : \ d f c 2 d a 3 5 8 4 3 0 d 9 e 2 c 0 4 5 5 8 f c 4 a 9 4 7 e 3 7 c 1 9 d 7 9 1 1 b 8 4 f a 4 a c 9 0 f 0 1 4 e 3 3 5 6 1 6 f 3 a
C : \ 3 0 4 d 6 5 9 b b e 7 3 a 3 a f d e 9 8 9 9 4 d c 5 6 e 2 b 3 3 3 9 a 9 8 e 7 a 3 f a d 9 8 5 3 3 8 0 3 9 d 2 5 2 0 5 b 5 6 5 d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f p x l b . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ v q Z N J j 5 j . e x e
C : \ 5 8 0 4 d 7 b b 3 c 4 c 0 f 8 8 3 c 2 4 f 1 e 5 8 1 2 c f 2 a 1 5 9 c e 5 f d 1 0 8 9 a 6 9 2 a 2 d 4 f 4 b 1 c 3 3 a 9 0 2 e 6
C : \ U s e r s \ L i s a \ D e s k t o p \ R p s K U V R N . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 8 2 e 7 4 a a 5 0 6 6 c 9 3 5 e _ f p x l b . e x e
C : \ f e 8 a 7 7 6 8 c a 7 2 2 9 6 9 e b d 8 1 c 0 e a b c 9 5 f 4 e f 8 4 5 9 d f 8 d 3 0 1 6 3 b 0 6 3 b e c 5 a 6 1 4 3 d d a c 4
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ F I 6 z 4 q Y R . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ g 0 y q 5 l Q d . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 1 8 d 6 b f d 4 d 0 a d 1 8 e 5 9 9 d 2 7 3 4 f 8 5 e a d 4 b 5 e d b c 5 0 6 d 3 a 7 9 f 0 8 7 1 7 4 e 8 d 0 2 a 2 f b d e c 1 . e x e
C : \ 3 f f 5 a 1 a e c 2 c 1 0 c a 6 b f 7 6 d f 1 c 0 8 5 a 1 4 6 9 6 c a 3 7 c d f d 9 0 6 7 4 d f a d d f c a c 6 7 1 4 e 3 2 1 b
C : \ U s e r s \ L i s a \ D e s k t o p \ 5 0 P j L i I u . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ 7 d 8 3 b e 0 9 9 3 c 0 a 3 d c 3 2 0 5 1 5 9 8 3 6 4 d 2 d 8 0 5 d 4 e b e f e d b 7 4 6 7 0 d 5 9 3 0 4 3 0 7 5 0 7 3 a f 0 a
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f p x l b . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 2 0 5 8 b d 7 7 3 6 a 9 5 5 5 d _ f p x l b . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ O Y Z T 2 8 Q F . e x e
C : \ 0 7 6 3 6 e d 5 7 c 4 2 d 9 2 d 2 d 8 8 2 a 5 c f b b 5 c d 3 7 e 3 7 4 2 0 7 f 3 3 e 4 5 f 8 1 b 4 b e b 8 d 3 c 2 1 0 b d a e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f p x l b . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f p x l b . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f p x l b . p e 3 2
C : \ 7 0 f 8 4 2 a d 1 3 a 1 6 5 4 e 0 d 5 6 f 5 2 f a 1 1 8 d 2 a c 1 b b 9 5 9 0 8 0 1 a 9 2 2 1 6 4 4 3 d 7 b 8 7 4 7 2 b 4 d f a
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f p x l b . p e 3 2
C : \ 6 4 6 5 3 f 5 1 0 a 5 7 f e f e c 9 2 5 9 c c 3 b b b 9 6 f f 5 1 f 1 2 d 2 6 7 b 5 8 0 1 c 6 d 2 4 2 d 7 8 8 a 5 6 8 c d c b a
C : \ 9 7 e 3 8 8 2 f e 9 3 f 8 f 6 a a 9 b 6 7 e e f f 6 2 0 4 0 0 d d 1 b 1 e 7 3 e 6 d 6 8 4 3 7 c 7 e b 9 c e 6 a 2 9 f 0 b 2 e 8
C : \ b c 8 4 4 0 c 3 d 8 a 5 3 0 6 0 4 8 7 3 6 2 c 7 d a d 9 2 a 0 a 3 0 e a 5 9 c 8 c 3 c 1 4 8 8 4 1 4 3 9 4 9 7 c e b 6 b 6 2 0 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f p x l b . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f p x l b . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b 5 b 9 6 9 7 e 1 2 c 0 1 9 b 4 _ f p x l b . e x e
C : \ 7 9 7 b b 8 3 b 1 5 e 0 a 4 c 8 d 7 6 f f 9 b 9 1 8 f 0 6 4 a 7 7 3 9 9 e 0 7 3 3 e 5 d a 6 b e 6 9 0 a 2 4 c b b 7 e d 8 0 4 a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f p x l b . e x e
C : \ 2 a 1 d 3 a 9 5 8 8 5 e 4 e 9 2 4 3 c 8 c 2 2 5 7 3 4 e 8 1 4 2 9 c 9 a 4 0 9 7 5 8 5 9 7 2 f a 3 9 c 0 b 4 3 1 6 2 d 5 0 a 6 1
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f p x l b . p e 3 2
C : \ 8 0 0 0 e c 8 9 9 8 f 4 b b 9 9 1 5 c e 8 9 c e b c 1 5 7 2 6 b 1 d d 6 3 7 0 4 c 6 b 1 b 5 2 b 4 c 1 1 a c 3 f a 6 0 d 2 4 f 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f p x l b . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f p x l b . p e 3 2
C : \ 9 b 0 2 4 4 9 a 4 b 7 e d d e 0 3 4 1 5 c d 1 4 c 0 c 4 4 4 2 8 1 3 f 4 2 9 4 1 1 0 9 2 4 e f 6 7 1 d 3 6 8 0 2 0 c 8 e 7 6 e 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f p x l b . e x e
C : \ 0 a 5 9 c 5 3 5 e 9 1 1 2 6 2 3 c a 1 f 7 b 3 7 2 7 8 8 1 0 2 0 5 1 a 6 f a 9 6 3 8 f c 4 f 7 8 d 4 2 8 3 0 d e c 6 0 e f 1 a d
C : \ d e 0 5 b 5 0 4 7 6 a c 4 7 2 3 d 6 8 6 1 5 b 4 7 f 2 1 a 5 8 1 4 f 2 1 1 b a 0 e b b 6 7 2 8 7 4 2 c 8 e c 6 9 9 3 4 1 f e 2 b
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f p x l b . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e 0 7 5 4 8 9 1 2 1 d c e a 5 3 _ f p x l b . e x e
C : \ 6 b e 5 c 5 f 4 b 7 a b c f 1 3 6 b 3 e f 3 2 5 1 7 4 d 8 d 5 f 5 0 8 0 4 c 0 5 5 9 1 b 0 3 3 1 f e 9 3 f c b 1 3 6 b 0 a 4 a a
C : \ 5 a 4 2 c 8 1 c 9 1 5 e c f a f d 3 4 0 e f 0 8 f 2 5 3 f 2 3 c 6 7 5 9 6 d 7 a 0 e e 8 c 5 9 6 2 b 5 0 e 3 6 d f 9 7 6 d 7 5 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f p x l b . e x e
C : \ 5 6 9 c c b 6 9 7 6 1 5 0 6 0 6 1 b 0 6 3 a c 1 7 2 c f d 4 f f 8 a 9 f a c 5 0 6 9 7 c 0 e 1 6 4 1 b b 5 b d b d e 4 1 0 f f 0
C : \ 7 7 1 5 4 4 f 4 2 2 6 9 4 f c 0 e f 6 2 8 b 1 8 7 d 8 c d a e 6 8 e 0 2 e 8 5 6 f f 4 1 3 c c f 9 6 5 5 e 5 b a 9 3 4 9 3 2 5 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f p x l b . e x e
C : \ b 8 7 d 3 a 1 e a a 8 6 0 1 7 3 a 3 7 5 9 f 0 0 7 1 d e 2 7 5 5 5 d 9 1 a 5 c 7 b 4 1 3 0 6 f f 6 8 3 c a 9 a c 0 8 a 2 3 7 2 7
C : \ f 0 8 f d 0 4 2 6 5 3 3 4 a 0 0 8 3 6 8 9 c 7 2 1 d 1 6 c 0 7 c 7 d 8 2 1 a a 0 1 5 1 1 8 2 a f 9 f d d e f 7 5 e 2 f d 0 4 d e
C : \ 4 7 7 b d b 3 a 7 1 6 9 3 6 2 0 7 c 1 d 7 6 0 b 6 5 8 b e b 9 b b 9 4 9 c 2 9 3 2 8 b 3 3 5 9 7 7 e 4 b c 6 5 b 7 b e 3 4 5 e 3
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.