2.4
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.53
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Waski-A [Trj] | 20200221 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Downloader.Small.ck | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200221 | 2013.8.14.323 |
| McAfee | GenericATG-FKM!7C4920B2F4E8 | 20200221 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b07973 | 20200221 | 1.0.0.1 |
静态指标
动态指标
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\hummy.exe |
投放一个二进制文件并执行它
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\hummy.exe |
将可执行文件投放到用户的 AppData 文件夹
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\hummy.exe |
一个进程创建了一个隐藏窗口
(1 个事件)
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 61 个反病毒引擎识别为恶意
(50 out of 61 个事件)
| ALYac | Trojan.Downloader.JQDW |
| APEX | Malicious |
| AVG | Win32:Waski-A [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.Downloader.JQDW |
| AhnLab-V3 | Trojan/Win32.Dloader.R87521 |
| Antiy-AVL | Trojan/Win32.AGeneric |
| Arcabit | Trojan.Downloader.JQDW |
| Avast | Win32:Waski-A [Trj] |
| Avira | HEUR/AGEN.1025965 |
| Baidu | Win32.Trojan-Downloader.Small.ck |
| BitDefender | Trojan.Downloader.JQDW |
| BitDefenderTheta | Gen:NN.ZexaF.34090.duY@amDnDEni |
| Bkav | W32.AIDetectVM.malware |
| CAT-QuickHeal | Trojan.Mauvaise.SL1 |
| ClamAV | Win.Downloader.Upatre-5744089-0 |
| Comodo | TrojWare.Win32.TrojanDownloader.Upatre.A@52i1eo |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.2f4e83 |
| Cylance | Unsafe |
| Cyren | W32/S-5aba6b96!Eldorado |
| DrWeb | Trojan.DownLoad3.28161 |
| ESET-NOD32 | Win32/TrojanDownloader.Small.AAB |
| Emsisoft | Trojan.Downloader.JQDW (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/S-5aba6b96!Eldorado |
| F-Secure | Heuristic.HEUR/AGEN.1025965 |
| FireEye | Generic.mg.7c4920b2f4e832c2 |
| Fortinet | W32/Waski.A!tr |
| GData | Trojan.Downloader.JQDW |
| Ikarus | Trojan-Downloader.Win32.Upatre |
| Invincea | heuristic |
| Jiangmin | Trojan/Generic.azrvz |
| K7AntiVirus | Trojan-Downloader ( 0055e3da1 ) |
| K7GW | Trojan-Downloader ( 0055e3da1 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| MAX | malware (ai score=86) |
| Malwarebytes | Trojan.Downloader |
| MaxSecure | Trojan.Upatre.Gen |
| McAfee | GenericATG-FKM!7C4920B2F4E8 |
| McAfee-GW-Edition | BehavesLike.Win32.Generic.pz |
| MicroWorld-eScan | Trojan.Downloader.JQDW |
| Microsoft | TrojanDownloader:Win32/Upatre.A |
| NANO-Antivirus | Trojan.Win32.DownLoad3.dgmrrz |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | Trojan.Downloader.Win32.Waski.G |
| Rising | Dropper.Generic!8.35E (TFE:dGZlOgPqI1TWNgPuNQ) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Mal/EncPk-ACO |
连接到不再响应请求的 IP 地址（合法服务通常会保持运行）
(2 个事件)
| dead_host | 198.251.88.188:443 |
| dead_host | 173.209.36.35:443 |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2013-10-30 18:58:20
PE Imphash
e836076a09dba03e4d6faa46dda0fefc
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x000003d8 | 0x00001000 | 2.018853001442933 |
| .rdata | 0x00002000 | 0x00000474 | 0x00001000 | 1.7348019257994853 |
| .data | 0x00003000 | 0x00000014 | 0x00001000 | 0.036262711990452945 |
| .rsrc | 0x00004000 | 0x000001c0 | 0x00001000 | 1.0593330749615644 |
| .reloc | 0x00005000 | 0x000000b2 | 0x00001000 | 0.28352924868764734 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_MANIFEST | 0x00004058 | 0x00000165 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library WININET.dll:
• 0x402050 HttpSendRequestW
• 0x402054 InternetSetOptionW
• 0x402058 InternetQueryOptionW
• 0x40205c HttpOpenRequestW
• 0x402060 HttpQueryInfoW
• 0x402064 InternetReadFile
• 0x402068 InternetConnectW
• 0x40206c InternetOpenW
Library KERNEL32.dll:
• 0x402000 GetTempPathW
• 0x402004 GetFileSize
• 0x402008 GetCurrentDirectoryW
• 0x40200c DeleteFileW
• 0x402010 CloseHandle
• 0x402014 WriteFile
• 0x402018 lstrcmpW
• 0x40201c ReadFile
• 0x402020 GetModuleHandleW
• 0x402024 ExitProcess
• 0x402028 HeapCreate
• 0x40202c HeapAlloc
• 0x402030 GetModuleFileNameW
• 0x402034 CreateFileW
• 0x402038 lstrlenW
Library USER32.dll:
• 0x402048 wsprintfW
Library SHELL32.dll:
• 0x402040 ShellExecuteW
L!This program cannot be run in DOS mode.
898k8k8Rich8
`.rdata
@.data
@.reloc
_3^@[VP
CVMQuPu
VSVuhL!@
tVVVVhX!@
0EPEVV4
_EPEPj S}
WEPj S
3VVVVS
u3VEPEPh
u+};}t
wgwwM7wO!w>w-w&<wVww
"qAw!q~!qBJ"qu\"q
!q,I"q"q
InternetOpenW
InternetConnectW
HttpOpenRequestW
InternetQueryOptionW
InternetSetOptionW
HttpSendRequestW
HttpQueryInfoW
InternetReadFile
WININET.dll
GetModuleHandleW
ExitProcess
HeapCreate
HeapAlloc
GetModuleFileNameW
GetTempPathW
CreateFileW
GetFileSize
lstrlenW
ReadFile
lstrcmpW
WriteFile
CloseHandle
DeleteFileW
GetCurrentDirectoryW
KERNEL32.dll
wsprintfW
USER32.dll
ShellExecuteW
SHELL32.dll
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
10>0L0Y0g0s000000000
1E1m1v11111111
282A2h2p22222
3F3z3333333
/ c o m m e r c i a l / m r x 3 0 d . e x e
/ i d e v a f f i l i a t e / d o c s / x 3 0 d o t . e x e
g r o u p e s o r e p c o . c o m
b u l k b a c k l i n k s . c o m
h u m m y . e x e
U p d a t e s d o w n l o a d e r
t e x t / *
a p p l i c a t i o n / *
w i n y g . e x e
C : \ 3 H D t m R v 0 . e x e
C : \ c h e x 5 y r I . e x e
C : \ 6 7 8 c 9 1 c c 2 6 f 7 1 6 4 2 7 6 b 6 9 6 7 4 8 9 7 d 7 5 d a c 0 2 c 3 7 5 6 8 7 a 6 6 b 6 b c 6 9 8 b f 7 e a 4 7 f f f 6 0
C : \ K p 0 k X 8 7 L . e x e
C : \ D e M T 3 8 U N . e x e
C : \ v 7 A T k i _ j . e x e
C : \ Y F B d 6 8 H X . e x e
C : \ 6 4 o H 3 O x c . e x e
C : \ t F I a c E P c . e x e
C : \ w W A m X c g 5 . e x e
C : \ k Y e X v r x i . e x e
C : \ s r D V y 8 A p . e x e
C : \ u g _ H d 3 I 5 . e x e
C : \ 3 E 6 W G 0 O 5 . e x e
C : \ b I n 9 m w C Q . e x e
C : \ r i r D 5 b K T . e x e
C : \ O I l 2 _ N D m . e x e
C : \ 9 h 2 j G C K K . e x e
C : \ a a 9 b 2 2 a a e d 4 8 9 6 5 a 7 c 4 8 e b 9 c 9 b 1 a 9 c e b 0 f 9 6 7 8 f e 9 d 4 4 c 7 b c d 1 b c 6 5 e 7 c f 2 5 1 8 a a
C : \ b e 9 1 0 e a 4 d 8 e 0 5 3 8 c 7 7 0 2 a 9 b 5 4 1 f 9 d b d 9 1 f 5 e f 6 9 6 b 2 1 a c 9 2 7 f 0 3 5 9 d c f 3 1 d 6 d d 4 d
C : \ 9 P f J z c N Z . e x e
C : \ 5 x d B H a V w . e x e
C : \ D o I S L 6 5 s . e x e
C : \ n F 7 D e 2 1 B . e x e
C : \ U V a 9 K K x p . e x e
C : \ a g r p s p K Y . e x e
C : \ g W B k T 8 E w . e x e
C : \ o s M B a 7 a 1 . e x e
C : \ i 7 o g U o a c . e x e
C : \ T s K 8 6 L d z . e x e
C : \ T o C 5 k F 3 p . e x e
C : \ 2 p G O S V 4 A . e x e
C : \ A l Q 5 B L c T . e x e
C : \ S S C l M A 4 h . e x e
C : \ z S _ 3 S S x 6 . e x e
C : \ k F f C Z S t 8 . e x e
C : \ c B j h 7 P 4 4 . e x e
C : \ z 5 q M h S l t . e x e
C : \ w e v y B h W v . e x e
C : \ s Z c u I C E d . e x e
C : \ o 0 8 c d G w V . e x e
C : \ f c f 5 b 2 1 6 c 6 d e 0 b e f 5 b 8 9 6 7 2 b 4 f a 8 f 6 a 0 5 9 f a 4 b 9 2 e 2 9 a f 2 b d f 7 c 9 d e 9 6 9 2 6 8 0 0 d 1
C : \ 4 5 c 6 b f b 4 0 6 f d 2 e 9 6 0 7 b 5 b a d d 8 f 1 7 b c b 0 9 a a 1 9 8 9 4 a 6 5 2 a c 4 d 0 a 0 c 7 9 f 0 b 3 6 f 4 8 5 c
C : \ 3 c 8 6 e d d e 2 d 5 a f 4 0 1 5 e c d 2 d 4 b 1 b e b 4 4 f e f 4 b d a d e 0 5 e f d d 6 c 6 d d 2 6 c 6 1 0 6 3 f a 3 b 9 4
C : \ 1 9 1 4 d 3 b b 6 9 c 2 6 0 5 5 8 2 4 9 8 0 6 1 1 a 9 5 5 2 3 a 3 9 3 d 9 9 c d a 4 6 1 e 1 9 3 e 0 b f e 7 f 7 9 4 3 0 8 d 3 d
C : \ R _ f Q N k w 9 . e x e
C : \ S _ T B d 4 b T . e x e
C : \ N L K i w B 3 y . e x e
C : \ W m v t C f f 3 . e x e
C : \ y C f i Q x B E . e x e
C : \ p k m 5 o e 1 N . e x e
C : \ u N 9 j 7 h C C . e x e
C : \ b C r Y Y e s M . e x e
C : \ 9 Y 0 Y h O E S . e x e
C : \ 9 7 J e z c w c . e x e
C : \ v N k W M s E d . e x e
C : \ V K E A U g 4 C . e x e
C : \ _ B b z b X n C . e x e
C : \ p Q 6 2 w l p H . e x e
C : \ E P H 1 s n V r . e x e
C : \ D b y g 8 q o e . e x e
C : \ F e X M v b y z . e x e
C : \ 1 9 g Y K k 9 2 . e x e
C : \ o w E R n N V W . e x e
C : \ t I p U y 8 c u . e x e
C : \ h 3 B x 3 b N R . e x e
C : \ T d x N t h 2 _ . e x e
C : \ d X j J L s P g . e x e
C : \ T y j x 0 G 3 2 . e x e
C : \ w 0 E 7 0 M E R . e x e
C : \ 7 8 J U S T 9 C . e x e
C : \ b P G b e A i X . e x e
C : \ z N F _ G w 2 D . e x e
C : \ u z i 3 7 Z N V . e x e
C : \ 3 C B A q F 9 q . e x e
C : \ H L L l E h I 8 . e x e
C : \ f 4 b Q f Z 9 J . e x e
C : \ O Y a k f m F i . e x e
C : \ n n y t 6 F r W . e x e
C : \ d t K V 7 y Y h . e x e
C : \ E 5 h _ V t o I . e x e
C : \ U n W i S v 4 _ . e x e
C : \ Z G Z 5 t N o 8 . e x e
C : \ Z Y G i r f B E . e x e
C : \ 4 _ Q z U 1 k e . e x e
C : \ 8 W 5 u _ N B 4 . e x e
C : \ h 4 2 n 2 q D B . e x e
C : \ t H Q v I D w H . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 1 1 k 1 O y 9 I . e x e
C : \ 9 Z d B n 3 N q . e x e
C : \ e e 6 c 3 3 0 b 4 8 b 3 a d 7 f 7 8 a 1 b 0 5 3 4 f 7 a 4 0 8 7 9 d 7 0 5 8 8 2 b e 7 9 1 c 9 d a d f e 8 a e 4 1 c 7 7 4 c 8 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ e 9 R Y 9 0 c w . e x e
C : \ w z F D n _ 1 1 . e x e
C : \ X k U C y c w H . e x e
C : \ _ J M w 1 v W F . e x e
C : \ I e x Q N Y X k . e x e
C : \ U s e r s \ l u s e r \ D e s k t o p \ a a H 7 s v l Z . e x e
C : \ 1 G H 7 B I s O . e x e
C : \ l I P e c e N P . e x e
C : \ M 3 r Q M V P 7 . e x e
C : \ S u s d a r P q . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 2 s C 4 i o 9 Q . e x e
C : \ p 0 R n 8 k U T . e x e
C : \ d 7 7 4 2 1 3 9 8 a 7 5 e f 9 a 7 1 3 8 7 2 d 9 8 d d c f b 8 e 4 e a 6 1 b 4 4 0 7 c c 4 9 0 2 a 5 a b 1 7 d 0 e e b c 0 8 e e
C : \ b b f 6 0 0 2 8 0 3 e 7 c c 2 c 2 f 0 7 b d 3 d 7 b 5 9 b 1 9 d f 1 8 e b 3 c 5 2 7 0 3 4 4 f 2 1 e a 6 a f e 8 a 0 9 1 2 6 f 4
C : \ p 8 P w 3 u D V . e x e
C : \ z k 9 b 1 d K 6 . e x e
C : \ I G F H n m g W . e x e
C : \ U S I D x B M I . e x e
C : \ A t W 4 D b u H . e x e
C : \ Z 2 6 T Q z i w . e x e
C : \ b 2 6 e 1 d 9 d c 6 9 1 b 5 3 0 9 7 e e 8 7 2 6 0 4 4 e 8 4 b 3 b 6 d 6 d d 2 6 1 f d 0 b d f 0 c d 7 9 4 e 2 a 3 7 c 2 a 1 d f
C : \ 2 6 e 4 2 6 0 5 0 0 c f 5 9 8 5 0 a 4 7 5 c 9 6 7 7 6 3 0 5 3 e 6 1 0 3 d 6 d 1 8 f 8 c b 4 d f a 9 e 4 8 8 4 5 7 6 8 b 7 b 7 f
C : \ 1 N D 5 w w b t . e x e
C : \ h y M p 9 N K q . e x e
C : \ J S 9 9 4 o r V . e x e
C : \ 4 G a M R U j R . e x e
C : \ _ i Z t 8 j k G . e x e
C : \ d B O S k N _ 0 . e x e
C : \ U s e r s \ l u s e r \ D e s k t o p \ d c 0 B j F L A . e x e
C : \ d D e Y V x p P . e x e
C : \ I x A 8 9 p g 8 . e x e
C : \ a Q H O p Q J K . e x e
C : \ h W I c l J 7 4 . e x e
C : \ q y f U k O H A . e x e
C : \ x J 9 c q k 6 e . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ S D D i k c R 9 . e x e
C : \ O Z B c P U 3 K . e x e
C : \ d _ l j R F _ W . e x e
C : \ i N H s z L q 7 . e x e
C : \ H X p h F H N 5 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ A 1 N r G a 9 5 . e x e
C : \ d n z K U t T m . e x e
C : \ K R C p a _ Q w . e x e
C : \ m 3 h S v p B N . e x e
C : \ A 1 7 i 1 5 X 1 . e x e
C : \ U s e r s \ l u s e r \ D e s k t o p \ y 4 W R o 8 C F . e x e
C : \ l N d 8 r o R O . e x e
C : \ U s e r s \ J o h n n y C a g e \ D e s k t o p \ y C b o c L r z s c . e x e
C : \ U O E Y N t s a . e x e
C : \ K M 5 L i 9 G d . e x e
C : \ r s r h n 8 f d . e x e
C : \ n y 7 D 0 f Z g . e x e
C : \ E f q y a w y x . e x e
C : \ a 8 h L f P u k . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ R S s c N 7 W L . e x e
C : \ j k u U A v E M . e x e
C : \ 0 5 i R S u G q . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 8 f S a 7 t d E . e x e
C : \ m n P J m g 0 J . e x e
C : \ m u L a d 4 e m . e x e
C : \ U s e r s \ J o h n n y C a g e \ A p p D a t a \ L o c a l \ T e m p \ 3 d 8 1 f 1 5 e b 5 8 7 3 0 c f 0 2 d 7 f a 0 3 8 4 2 0 1 f 3 8 a 7 f 5 3 9 b d 9 6 7 2 a e e d 4 5 c a 9 1 a c 0 5 c a a 5 6 c . e x e
C : \ r 5 i 5 9 l q _ . e x e
C : \ H V t K s f b L . e x e
C : \ 5 i 6 f U B 3 9 . e x e
C : \ q t f p C 2 _ r . e x e
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ e 4 b 3 f 0 2 b d d a 3 7 f d a 7 9 8 b 1 5 3 7 3 4 d 5 0 8 1 d 7 2 8 b 1 3 b b d 5 1 4 a 4 7 1 9 7 3 2 4 0 9 0 f 2 6 d 8 8 7 e . e x e
C : \ 8 e 9 0 f 8 e 2 d a 7 a a e a e 9 4 2 3 5 a c 6 6 1 e a 9 b 4 4 0 4 8 8 b a 9 6 2 7 a 9 7 9 e f f 4 0 3 2 b b f d 4 8 6 e d f e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ m S O V 5 D H n . e x e
C : \ F a b Z E n B w . e x e
C : \ u j c t h M e L . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 8 8 K V R v F F . e x e
C : \ K d n _ E o l J . e x e
C : \ 0 M 7 J c P 2 T . e x e
C : \ X y M N E F P d . e x e
C : \ J x d 3 C U x y . e x e
C : \ H O l p p U J c . e x e
C : \ S d O F 0 i X F . e x e
C : \ U s e r s \ J o e C a g e \ D e s k t o p \ 8 g i 8 a 0 u J J u . e x e
C : \ Q 1 j 6 X A V Q . e x e
C : \ W o f 9 u d d r . e x e
C : \ H W F j d H B j . e x e
C : \ V i l 2 t V w u . e x e
C : \ 1 6 6 8 5 f a 3 3 b 1 1 f f 8 d 0 2 a 1 e 7 b d 5 1 2 c f 1 a c 1 7 d d e a a b b b 6 c 8 f 7 7 f 6 0 3 f 6 4 7 7 f 6 8 3 f b e
C : \ R x s R g e R C . e x e
C : \ u T z Z T H d d . e x e
C : \ P d y D K K k X . e x e
C : \ C X M 4 6 e Y i . e x e
C : \ a 2 a 0 1 e f 0 2 1 8 e 3 0 f 7 c a 5 5 8 2 c 4 6 e a e c 2 3 f c b 5 a 3 a 5 1 d 3 2 5 9 e 0 e d 8 3 0 5 9 5 1 1 2 d e 7 0 3 4
C : \ c d e a f 7 8 a 1 b 7 4 5 7 e f d 6 7 c 3 7 e 3 5 2 3 c d 3 6 7 1 7 4 e 7 3 c a c e 8 6 8 3 1 4 3 2 5 5 f c e 6 0 4 7 3 e 9 d 7
C : \ 6 3 a 5 8 2 d 0 2 f b e a 9 d 0 2 5 d 6 4 6 0 9 5 1 c 3 0 c 8 4 d 1 0 1 c a 3 5 1 c 9 3 2 1 f f 5 f f 1 e 3 b c e f f a 7 c 7 7
C : \ 5 7 0 c 5 a 4 c 4 f a f 4 7 d d 3 3 9 9 4 5 8 1 a 0 8 d 5 e e b f 7 b 5 e d 0 a 2 d f 9 9 f 8 8 2 9 0 f 4 c 9 4 d 4 1 6 6 7 2 f
C : \ h I 0 X x m B 4 . e x e
C : \ c 4 7 4 a c 8 a 8 8 9 4 c f 2 1 8 0 5 4 c d 5 9 b a 6 0 0 b b 8 3 d b 7 0 0 f b 4 1 2 f a 8 9 7 1 b 4 4 2 8 d 1 e 9 1 5 4 5 7 b
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ U r A Q 6 k i s . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ 4 a 8 8 1 6 7 c 9 0 f 5 f b 2 3 4 2 1 5 f c 2 4 f d 9 f 4 5 0 6 f 3 4 7 c 7 8 d 1 8 a 4 1 a b 2 7 e a f c e 1 8 a d f e 2 8 2 f
C : \ a 6 5 5 d 5 f 0 0 2 e 7 9 0 2 b 7 5 9 0 5 9 6 9 3 5 2 3 0 2 8 0 f 4 3 f 2 2 f 6 8 0 7 c d 3 f 2 6 f c 9 4 4 9 f 8 1 a e f 1 d 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ 4 _ z k p 7 W F . e x e
C : \ F S 2 e 1 a H D . e x e
C : \ G r 5 t 5 c B h . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ 4 d d 4 e b 1 2 5 d 5 b 9 9 0 6 b 1 3 a 5 4 0 e d 3 7 b c 8 b 7 0 d 5 1 1 f 4 7 2 8 c a b 5 7 a 6 a f 2 c 7 5 6 d 5 9 7 0 1 d 0
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
c : \ V I D 6 9 2 1 2 3 9 3 4 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ N 1 M P y t T S . e x e
C : \ U s e r s \ J o h n \ A p p D a t a \ L o c a l \ T e m p \ a X d R Q a h z l C W y . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e 4 d 1 d 9 9 2 d 7 e 3 f 4 5 8 d b 1 d 9 c 9 3 9 4 0 a b 9 3 6 . v i r u s . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ d c 7 8 8 5 9 8 d 2 2 f 7 d 6 1 f 8 e 6 8 e 7 7 4 4 c e a 0 3 f 2 7 5 a 1 d a c 6 1 2 c 9 5 a b a 8 a 7 4 1 5 7 1 5 b 4 b 3 4 0
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ 2 3 4 f 7 8 0 3 1 5 9 f 9 f d 8 f 3 5 6 8 6 8 9 9 e 2 f 3 1 5 0 2 4 6 2 6 8 7 0 9 8 0 4 1 2 7 6 f e f f 0 a 2 b 3 5 e 0 2 3 0 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ p C e U J i S L . e x e
C : \ c 1 6 9 e 7 b 0 d c 4 2 a 4 e 7 b 2 2 b 6 8 d 1 3 0 d b 2 b 9 f 7 a 5 9 b f 6 5 6 a 8 f 1 f 7 5 d 2 9 5 1 4 e c 5 6 6 8 c d 3 9
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ 8 f 9 2 0 5 e 0 b 6 1 0 f 5 4 6 8 5 a 3 e 6 6 2 2 b 9 1 e 1 d f 9 7 f c 2 2 4 0 6 1 4 1 f c 2 d b c 2 9 e 9 d b c d 8 d 8 c 3 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ g h 5 m Z b r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 b a b 1 d f 3 0 8 d 1 e d 8 3 1 3 b c b 0 0 3 2 b d 6 4 7 0 5 2 9 e e 3 9 b d 0 2 7 2 7 1 6 6 5 6 b 5 8 a 1 d d 4 d 8 a b 8 6 . e x e
C : \ c 3 d 9 5 d 0 b e 7 6 a 5 7 a 0 5 f f 6 3 0 0 b a c b e 7 b b 4 8 9 5 1 d 2 3 e a 9 f d b 3 b d 1 9 e 7 7 1 0 3 7 d 7 e f a c d
C : \ f a 1 3 1 9 d 1 c 0 6 8 7 4 5 9 0 0 b 6 a 1 1 c f 6 4 9 c 3 9 d a 7 9 8 c 6 6 b 5 1 b 5 8 1 3 0 f e 3 4 d 3 0 1 0 5 b 9 0 d 6 7
C : \ c d 2 4 8 e 6 3 c 5 d b 3 8 f a e 6 f 6 3 1 b c b 3 7 d f e 6 7 f d d a f 5 4 d 1 e 4 b b f d 3 4 6 2 a 5 1 e 2 1 d 6 d b d d 4
C : \ f b 2 c a 2 c 3 6 a a 1 5 f 5 5 5 e f 3 2 1 2 5 9 7 3 3 1 9 1 9 3 2 1 b 0 c 9 5 4 9 c 3 8 3 2 e 2 4 b 5 1 0 1 b a 6 f 3 4 0 4 5
C : \ 5 b 5 0 2 9 0 1 e e 4 d d 2 1 6 3 0 c f b 2 8 0 a 3 5 d 0 f 1 3 3 8 a 2 4 1 b 0 6 6 0 2 8 f a 3 a d 4 0 a 4 b d 4 5 8 0 6 7 8 a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c f 9 0 e 6 2 3 0 7 6 c 1 5 1 1 _ h u m m y . e x e
C : \ 0 0 b 4 d 7 7 3 2 0 a 2 2 9 e 3 0 e e f 6 9 2 b 1 b 7 b 3 e b 7 d d e 1 6 f b b d 8 2 b 3 6 b 4 1 c a 7 1 6 a 9 e a 6 c 8 e 3 9
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ S V d l m B r q . e x e
C : \ 1 5 5 4 a 9 2 5 6 3 0 e c 8 d 8 c b 4 2 4 b 8 2 c b f a c e 0 8 6 d 5 f a 2 2 6 5 2 5 0 8 a 9 d 3 1 d 0 2 f 9 a d b 5 3 d 6 1 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 6 3 8 8 f e 3 6 1 5 3 3 7 8 f 4 _ h u m m y . e x e
C : \ 2 e a 3 1 c 0 1 b d 1 f d c c 0 a 5 f 9 2 f a 2 6 e 8 e 9 b f a e 2 3 c 4 2 d 9 7 5 2 e 0 a 3 4 e 8 1 4 1 4 5 1 c 6 6 2 c b 4 f
C : \ l V W r 9 x j M . e x e
C : \ 9 9 0 a 3 6 1 8 b a 6 7 e 7 6 b 0 a 3 3 a f d 8 c f 7 6 4 6 0 0 2 e 5 5 5 d d c a 4 3 4 2 c 1 f 7 1 d b 4 6 2 c 2 0 e 7 f f 5 0
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ a 2 0 C r W B Q . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 9 a 4 7 6 7 6 0 2 9 c 5 d b 8 0 5 0 b 0 a a b 3 1 a c 6 3 4 c d 7 0 1 a 1 7 8 d 4 a d 4 b d f 5 d 8 a a 9 9 9 1 2 4 1 5 9 2 2 e . e x e
C : \ f 5 6 2 1 3 6 9 9 2 a d 6 0 9 8 8 b 7 9 2 8 3 0 d f 0 2 5 e 1 e d f 5 c f 0 e 7 4 d 2 1 3 f e 0 d 0 8 9 1 d 5 c 3 3 3 b 2 3 f b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ 5 3 e e a c b c 3 c 7 4 7 9 a b c 7 5 c e 4 e 7 1 3 6 3 9 4 0 f 2 c 6 6 9 1 a 3 9 2 5 f a 8 2 d 4 3 9 0 d a 7 c 6 c 1 d 3 8 3 b
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ e 0 4 6 2 e 0 f 1 a 3 3 8 7 4 7 d d c 5 c f d 0 b 0 f 2 6 1 7 9 4 9 4 5 4 c d 1 7 7 1 3 6 2 6 e 6 8 1 8 8 e 0 3 0 9 1 a 0 d b 4
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ e 3 k 7 w F z W . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 a 6 7 2 d 0 8 0 b 2 0 0 8 6 7 b 9 f 2 8 c 7 3 a f a 7 f 7 c 0 4 4 4 a 0 9 6 5 d 5 c 1 1 e 6 8 d 8 8 3 1 8 0 7 1 1 3 6 4 c f e . e x e
C : \ 8 9 c 0 1 f 7 e 4 c 2 6 2 7 c 8 e 7 f 9 4 0 4 a 3 c 2 5 6 d a e 1 7 a c 6 2 0 7 8 e d 1 9 c 3 a d d 0 7 7 2 c b d 6 b 6 2 b 9 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ 7 c d 5 e 6 d 8 5 6 e a 9 3 f 0 f a 2 a 9 5 6 d 9 a d a c 4 a f b 5 0 2 5 0 0 d 0 6 9 9 9 e 5 4 5 0 6 3 f 8 1 7 c 0 2 b 4 e 1 3
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ 9 d 6 4 d d 2 3 3 7 f 1 1 4 6 b c 7 8 c 6 3 4 0 6 a 7 8 d 1 3 c 4 3 a e b 5 f 6 9 f b 2 c 4 8 3 e c d 7 8 c e 1 6 1 c 2 2 8 c 3
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ h B N 6 6 O T G . e x e
C : \ Q 0 X U f z X 0 . e x e
C : \ N b 4 Z 5 4 7 W . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ j U a J 4 A y O . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 6 b 0 3 d d f e d b e 7 f e 9 5 9 9 4 4 2 a 6 d d 9 d 9 0 7 7 e e 0 4 8 f b 4 a 5 e 5 1 c 7 f e 1 5 c 9 0 d 6 b 4 8 5 f 2 f 6 7 . e x e
C : \ 1 d a 9 6 7 6 7 1 2 3 7 d 9 f 1 3 5 d 7 1 2 a a b 0 2 2 2 4 0 5 e e 5 0 0 f c 3 4 d c 6 c 1 9 1 1 0 f e b 9 d 6 8 2 b b 3 d 1 3
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ 0 9 4 a e 2 c e 9 5 1 2 3 2 6 c 3 e b 1 d 0 f 8 3 1 b e 3 6 d d 7 5 1 0 b 1 2 9 4 e 3 7 a 8 7 2 2 e f 7 1 f 4 e b 4 0 d 9 2 2 4
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 4 4 0 7 8 6 1 b 1 1 6 b 1 8 e b _ h u m m y . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ C 9 W V l L j 5 . e x e
C : \ d 4 c 4 1 4 d 9 8 a 3 6 c 9 f 9 4 f e d e f a 3 2 f b 4 0 b d 3 b a 7 1 9 1 1 b 9 4 c 7 0 2 3 5 a b 1 c 6 0 6 5 5 e 3 0 9 5 f a
C : \ d 7 c 3 d 7 4 7 8 9 3 0 b 6 6 a c a 8 6 f c 3 4 c f 2 f 7 1 c 5 8 5 0 0 b 4 5 9 3 8 c b 9 0 f 0 3 4 f 1 3 6 1 b 7 5 6 f 0 1 e c
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ F 6 C g L U X f . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 1 3 7 f c 4 9 c f 0 5 4 7 a a e 7 3 6 a 7 7 f 0 d 0 d a 7 f e 1 5 5 5 b 0 3 8 e c 3 6 d 5 d 3 b 7 8 4 0 0 0 1 4 1 4 8 2 c 4 8 9 . e x e
C : \ 9 a c 6 5 3 d 2 a 0 2 f 4 2 6 4 a a 7 9 0 9 2 0 0 4 9 e 6 d e 1 a b e 2 4 3 f d 6 c a 3 9 e f 4 d 7 8 2 c 2 f a 4 7 0 4 4 9 9 b
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ i a A q i m 7 W . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 6 1 c 2 b 2 d 8 5 1 b d 0 6 e 1 0 0 9 e 8 5 c 8 1 c d 9 6 1 0 5 e c b 5 f 9 8 4 f 0 e 6 6 d b 4 2 6 e d 2 9 7 4 0 0 3 b 1 4 2 a . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ 8 8 3 9 f 3 6 0 f 3 c 3 6 7 a b c d 9 7 0 c f 4 4 5 a 1 2 2 a a c 3 2 4 2 e 7 e a f 4 9 c 4 1 d c 2 4 3 8 e 0 5 4 e 7 c 0 9 1 a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ A a Y 5 M e E 9 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b 3 9 b c 0 8 f a b f 4 7 c 9 8 7 2 f 1 7 3 0 2 9 a 5 4 e 1 0 a b b 7 3 4 9 0 8 1 3 9 c 2 9 3 3 3 d a 1 8 5 4 b 8 f 4 4 0 c e b . e x e
C : \ 8 e 4 b 6 1 f 4 7 0 1 8 1 2 c 6 7 c d 3 0 6 4 3 1 0 d 0 b c d 1 5 f 8 a 5 9 5 d 1 1 c 7 f 2 b c b 4 b e 6 4 9 c 8 d 3 4 3 2 0 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ a 7 9 b 5 e 8 d 3 3 6 a e e d b b 6 6 1 4 6 5 4 e 0 2 3 c c b c a 5 6 0 b c c d 1 0 5 d 1 b 5 3 c 3 8 8 a 3 f 7 f 6 8 0 c 7 a 0
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ 4 a d f c 3 c 5 4 3 b 9 b 9 d 1 8 b a 5 4 6 c c 3 d 3 5 5 0 6 0 e b 1 b 7 3 3 5 9 1 1 9 3 d e 7 b 4 5 a b 6 e 1 e 4 b e 2 d b 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ 3 4 2 3 b 0 0 c 9 3 a 7 2 8 e 0 0 c 7 a 8 e 4 6 8 1 d 6 7 2 5 9 7 3 6 a d a d 0 7 6 5 8 9 d 9 9 c 3 0 2 1 3 e b 4 4 0 e 9 3 1 8
C : \ 8 a f 3 6 5 5 7 a 7 4 8 c c b 5 5 0 c e 1 b 5 f 9 8 f 4 3 0 e 2 6 9 5 9 5 6 9 3 8 0 3 1 2 d 7 6 7 c 7 a f a b 4 8 c 4 c d 4 5 c
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ 6 b 4 4 c 6 8 9 f e 8 a f a 0 f f f 2 f 2 0 e 5 5 a f 5 e 2 4 1 2 5 d 6 a a b 7 e f 3 d e c 0 f 4 0 6 1 2 2 4 f 4 7 4 6 b 1 4 3
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ c b 2 3 1 4 4 8 2 4 3 1 8 1 c f 1 5 0 7 4 d f d d 1 0 3 b f 0 a 6 6 5 0 a 9 4 6 5 1 6 f d 4 d 7 3 0 8 6 e e d 4 e 1 7 4 5 8 f 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ d d 0 b f e 6 7 5 4 2 3 1 1 2 4 3 4 9 9 1 e 6 5 d 2 b 8 2 b 3 0 9 d f 2 1 1 1 5 7 9 a 4 e e 5 c 4 0 f 2 1 5 0 e f c 7 0 a c 3 9
C : \ 6 2 5 b 7 1 f 1 7 7 6 a 4 1 8 3 6 9 4 1 6 f e 7 e 9 7 9 f 0 d e 6 c 7 f 2 c 3 b b 3 b 9 0 7 8 d d 1 5 2 2 f 7 8 7 4 2 1 b d a e
C : \ d 6 c 9 2 a f e 4 c 4 7 5 f 0 d e a 8 9 3 1 5 9 6 5 1 4 d 7 7 c 3 7 a b f 4 6 6 f f e a 6 b 4 0 c 2 6 0 1 4 1 f f d 2 c 6 a f c
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ 2 9 c 0 1 8 a d 0 d c 5 2 c 6 d 9 8 d e e 0 a 3 a 7 f 5 2 7 8 7 5 5 7 1 b f e 2 6 1 e e f 8 e 7 5 0 9 f 8 4 7 c c a 1 6 0 8 2 9
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ a X S e 3 3 I Y . e x e
C : \ d 4 2 2 1 6 0 4 9 8 4 3 a 9 a 3 5 1 9 6 9 e 6 8 9 6 a 8 c e 4 2 5 d 9 0 5 9 f 3 b e 8 3 a 9 3 1 5 8 5 b 8 5 2 a 4 3 c 0 8 1 c 8
C : \ 2 6 f 1 2 1 a 1 5 e 4 9 0 d c 7 c d 3 c 8 1 a a 3 c 6 3 c 2 5 7 8 3 4 1 f c c 9 1 9 d 3 c c c a e 8 2 d 0 1 f b 5 a 4 b d 5 e 0
C : \ 3 2 e 6 5 c d b 5 d e a 5 9 e f 9 8 7 4 5 4 a 8 0 9 1 9 d 7 c a 0 4 c 4 c 2 2 0 b f 5 4 9 f 2 8 6 9 3 3 a 5 5 2 7 7 f 7 c 2 d 0
C : \ 2 2 c 0 a 5 f 8 a 4 0 8 8 e 6 a b 3 0 a c 6 a c e 0 e 8 4 5 e 5 3 f e 9 0 7 4 b b 2 4 a 2 9 0 8 2 5 7 4 2 3 2 9 b d 2 8 1 5 5 e
C : \ 3 4 2 c 7 6 b 2 4 a 8 6 f 2 e c 3 4 5 d 2 5 7 6 7 9 b 1 e 6 4 8 2 4 3 c e 8 6 3 9 f 6 3 6 b f a 1 d a 2 2 7 c 8 2 5 2 0 2 c 6 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ d 4 2 0 4 1 c e a 3 5 0 3 f d 5 1 7 6 e 8 5 a f b e 0 e d c 0 c c a b a 2 a 1 1 4 3 3 3 d 5 0 7 4 3 c 1 6 0 b 2 e a 9 8 7 0 4 b
C : \ e e d b 3 5 3 7 4 e 5 c c 7 6 d 3 5 c 2 1 9 7 0 8 8 c 4 7 5 7 5 e e 1 0 7 8 9 8 4 4 5 1 7 f 2 6 c 0 2 7 8 a 3 7 9 6 f 1 1 2 b 8
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ 6 8 2 b 3 0 6 a 4 6 0 2 1 5 7 e b f 6 f f 4 b e 0 9 1 7 d a 0 f 4 a a 2 9 3 c 3 4 8 1 7 a d 1 d 6 a 4 c 5 f b 3 7 1 3 7 b f 6 b
C : \ _ a P F K t 2 g . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c 0 b c 0 4 2 4 a 6 4 2 9 4 c 9 b e 8 6 1 0 9 b 7 a 2 3 b c 6 3 . e x e
C : \ 8 0 8 4 a 8 7 c 6 9 9 6 3 f 0 b 7 0 0 4 1 0 0 6 a f 6 b 0 4 9 2 1 7 e b c e a 7 f 8 d 6 6 4 f 8 4 9 6 0 9 1 6 a 1 f e f 7 c 2 6
C : \ 6 b 5 e 9 7 2 e c f 0 f 8 2 1 9 4 3 0 f d 5 d 2 3 2 0 5 1 c e e c f 7 4 2 5 e 9 f e 0 5 1 1 d c 4 5 5 d 0 a d b 5 f 1 1 d b 9 f
C : \ 2 2 5 8 f 3 f 7 b 3 7 e 9 5 8 8 0 a c d 3 b a d c e d d 2 b f 4 c 8 6 8 a 0 1 6 c 0 1 7 3 3 2 4 c 0 f 8 1 7 a 7 0 9 d e 3 b 7 6
C : \ 7 6 6 c f b 8 6 1 f 2 9 2 7 4 6 8 d 6 e 9 e f 4 8 8 1 c 3 9 d 5 b 3 6 b 9 0 1 e 3 7 f 5 4 a 6 4 9 3 8 c b 8 3 f 0 b b 3 b 9 9 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ 0 b 6 b 6 a f b e d 7 3 4 1 f 5 6 1 d d 4 4 4 9 f 6 3 4 4 5 0 f f d 1 b a 9 7 9 3 b 2 7 c 6 8 9 c 4 c 1 d 6 d 7 2 2 f b a 1 0 0
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ 5 f 4 4 2 a 1 2 c 5 c 6 b 4 6 9 d e 9 7 8 a e 1 6 a 0 6 3 3 e e 1 a f f 1 3 1 8 f 7 a 5 a 1 4 1 8 7 5 4 7 6 8 2 6 8 a 6 6 f 2 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ c 6 8 3 8 2 e 6 2 9 c a d d 6 a 0 d e 0 4 9 3 4 8 0 3 4 d 9 9 7 a 5 d f e a 2 0 e 4 d a 4 c 3 a 7 e f f 3 3 d e b 5 f b 5 c 4 0
C : \ 7 1 1 6 d b 3 8 6 e e 0 0 3 0 8 1 e 1 0 1 7 d e e 1 e c 1 9 b a 4 2 b b a 7 a 1 8 e 2 e 1 8 5 0 4 b 0 5 1 e e d 9 2 6 2 7 1 5 c
C : \ c f e a 7 9 4 6 a 9 b 5 9 b 3 2 6 d e 4 d 8 6 3 f 0 e a f 9 a 6 1 7 e c c 7 a d 0 7 9 6 8 2 c 1 0 2 d d 4 e c e d 5 e 6 5 c 0 d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ 9 e 7 9 f 7 5 6 e 1 d 9 0 f 1 d e 9 9 7 5 d 6 3 4 c 7 0 5 e 5 e d b e 2 d d 3 d 9 f 5 2 5 3 9 5 f 6 9 2 b 4 e 5 4 e 2 f 2 c f c
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
Process Tree
-
0035e7c72fdc7f564704c665757f067775d891ad2150d06e3cfa25ae8b710193.exe (1332)
"C:\Users\Administrator\AppData\Local\Temp\0035e7c72fdc7f564704c665757f067775d891ad2150d06e3cfa25ae8b710193.exe"
- hummy.exe (2656) "C:\Users\ADMINI~1\AppData\Local\Temp\hummy.exe"
Hosts
| IP |
|---|
| 114.114.114.114 |
| 198.251.88.188 |
| 173.209.36.35 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
| bulkbacklinks.com | A 198.251.88.188 | |
| groupesorepco.com | A 173.209.36.35 | 173.209.36.35 |
TCP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 49164 | 198.251.88.188 bulkbacklinks.com | 443 |
| 192.168.56.101 | 49165 | 198.251.88.188 bulkbacklinks.com | 443 |
| 192.168.56.101 | 49166 | 198.251.88.188 bulkbacklinks.com | 443 |
| 192.168.56.101 | 49168 | 198.251.88.188 bulkbacklinks.com | 443 |
| 192.168.56.101 | 49169 | 198.251.88.188 bulkbacklinks.com | 443 |
| 192.168.56.101 | 49170 | 198.251.88.188 bulkbacklinks.com | 443 |
| 192.168.56.101 | 49172 | 173.209.36.35 groupesorepco.com | 443 |
| 192.168.56.101 | 49173 | 173.209.36.35 groupesorepco.com | 443 |
| 192.168.56.101 | 49174 | 173.209.36.35 groupesorepco.com | 443 |
| 192.168.56.101 | 49176 | 173.209.36.35 groupesorepco.com | 443 |
| 192.168.56.101 | 49177 | 173.209.36.35 groupesorepco.com | 443 |
| 192.168.56.101 | 49178 | 173.209.36.35 groupesorepco.com | 443 |
| 192.168.56.101 | 49180 | 198.251.88.188 bulkbacklinks.com | 443 |
| 192.168.56.101 | 49181 | 198.251.88.188 bulkbacklinks.com | 443 |
| 192.168.56.101 | 49182 | 198.251.88.188 bulkbacklinks.com | 443 |
| 192.168.56.101 | 49184 | 198.251.88.188 bulkbacklinks.com | 443 |
| 192.168.56.101 | 49185 | 198.251.88.188 bulkbacklinks.com | 443 |
| 192.168.56.101 | 49186 | 198.251.88.188 bulkbacklinks.com | 443 |
| 192.168.56.101 | 49188 | 173.209.36.35 groupesorepco.com | 443 |
| 192.168.56.101 | 49189 | 173.209.36.35 groupesorepco.com | 443 |
| 192.168.56.101 | 49190 | 173.209.36.35 groupesorepco.com | 443 |
| 192.168.56.101 | 49192 | 173.209.36.35 groupesorepco.com | 443 |
| 192.168.56.101 | 49193 | 173.209.36.35 groupesorepco.com | 443 |
| 192.168.56.101 | 49194 | 173.209.36.35 groupesorepco.com | 443 |
| 192.168.56.101 | 49196 | 198.251.88.188 bulkbacklinks.com | 443 |
| 192.168.56.101 | 49197 | 198.251.88.188 bulkbacklinks.com | 443 |
| 192.168.56.101 | 49198 | 198.251.88.188 bulkbacklinks.com | 443 |
| 192.168.56.101 | 49200 | 198.251.88.188 bulkbacklinks.com | 443 |
| 192.168.56.101 | 49201 | 198.251.88.188 bulkbacklinks.com | 443 |
| 192.168.56.101 | 49202 | 198.251.88.188 bulkbacklinks.com | 443 |
| 192.168.56.101 | 49204 | 173.209.36.35 groupesorepco.com | 443 |
| 192.168.56.101 | 49205 | 173.209.36.35 groupesorepco.com | 443 |
| 192.168.56.101 | 49206 | 173.209.36.35 groupesorepco.com | 443 |
| 192.168.56.101 | 49208 | 173.209.36.35 groupesorepco.com | 443 |
| 192.168.56.101 | 49209 | 173.209.36.35 groupesorepco.com | 443 |
| 192.168.56.101 | 49210 | 173.209.36.35 groupesorepco.com | 443 |
| 192.168.56.101 | 49212 | 198.251.88.188 bulkbacklinks.com | 443 |
| 192.168.56.101 | 49213 | 198.251.88.188 bulkbacklinks.com | 443 |
| 192.168.56.101 | 49214 | 198.251.88.188 bulkbacklinks.com | 443 |
| 192.168.56.101 | 49216 | 198.251.88.188 bulkbacklinks.com | 443 |
| 192.168.56.101 | 49217 | 198.251.88.188 bulkbacklinks.com | 443 |
| 192.168.56.101 | 49218 | 198.251.88.188 bulkbacklinks.com | 443 |
| 192.168.56.101 | 49220 | 173.209.36.35 groupesorepco.com | 443 |
| 192.168.56.101 | 49221 | 173.209.36.35 groupesorepco.com | 443 |
| 192.168.56.101 | 49222 | 173.209.36.35 groupesorepco.com | 443 |
| 192.168.56.101 | 49224 | 173.209.36.35 groupesorepco.com | 443 |
| 192.168.56.101 | 49225 | 173.209.36.35 groupesorepco.com | 443 |
| 192.168.56.101 | 49226 | 173.209.36.35 groupesorepco.com | 443 |
| 192.168.56.101 | 49228 | 198.251.88.188 bulkbacklinks.com | 443 |
| 192.168.56.101 | 49229 | 198.251.88.188 bulkbacklinks.com | 443 |
| 192.168.56.101 | 49231 | 198.251.88.188 bulkbacklinks.com | 443 |
| 192.168.56.101 | 49234 | 198.251.88.188 bulkbacklinks.com | 443 |
| 192.168.56.101 | 49235 | 198.251.88.188 bulkbacklinks.com | 443 |
| 192.168.56.101 | 49236 | 198.251.88.188 bulkbacklinks.com | 443 |
| 192.168.56.101 | 49238 | 173.209.36.35 groupesorepco.com | 443 |
| 192.168.56.101 | 49239 | 173.209.36.35 groupesorepco.com | 443 |
| 192.168.56.101 | 49240 | 173.209.36.35 groupesorepco.com | 443 |
| 192.168.56.101 | 49242 | 173.209.36.35 groupesorepco.com | 443 |
| 192.168.56.101 | 49243 | 173.209.36.35 groupesorepco.com | 443 |
| 192.168.56.101 | 49244 | 173.209.36.35 groupesorepco.com | 443 |
| 192.168.56.101 | 49248 | 198.251.88.188 bulkbacklinks.com | 443 |
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 57665 | 114.114.114.114 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | 1267efc23b335651_hummy.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\hummy.exe |
| Size | 49.3KB |
| Processes | 1332 (0035e7c72fdc7f564704c665757f067775d891ad2150d06e3cfa25ae8b710193.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | 0dc3420f4ee1ba72a81bf3655f416bc7 |
| SHA1 | 3946831a545cc065a93bcff2e77c67bf9a31adf7 |
| SHA256 | 1267efc23b335651b6211114318a847bcf2d579eb697895ba3784b03f69120d0 |
| CRC32 | 7FC79742 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.