1.1
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.76
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Malware-gen | 20200501 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Downloader.Waski.a | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200502 | 2013.8.14.323 |
| McAfee | Trojan-FAUH!B0EBFC9F095A | 20200502 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b59229 | 20200502 | 1.0.0.1 |
静态指标
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(3 个事件)
| section | .MPRESS1 |
| section | .MPRESS2 |
| section | .imports |
文件包含未知的 PE 资源名称，可能指示打包器
(1 个事件)
| resource name | BIN |
动态指标
网络通信
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
文件已被 VirusTotal 上 57 个反病毒引擎识别为恶意
(50 out of 57 个事件)
| ALYac | Trojan.Agent.BCZD |
| APEX | Malicious |
| AVG | Win32:Malware-gen |
| Acronis | suspicious |
| Ad-Aware | Trojan.Agent.BCZD |
| AhnLab-V3 | Trojan/Win32.Upatre.R327784 |
| Antiy-AVL | Trojan[Downloader]/Win32.Upatre |
| Arcabit | Trojan.Agent.BCZD |
| Avast | Win32:Malware-gen |
| Avira | TR/Dropper.Gen |
| Baidu | Win32.Trojan-Downloader.Waski.a |
| BitDefender | Trojan.Agent.BCZD |
| Bkav | W32.AIDetectVM.malware |
| ClamAV | Win.Downloader.Upatre-5744087-0 |
| Comodo | TrojWare.Win32.Upatre.SJZ@5a8ghq |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.f095a5 |
| Cylance | Unsafe |
| Cyren | W32/S-c9d5c927!Eldorado |
| DrWeb | Trojan.DownLoad3.33360 |
| ESET-NOD32 | Win32/TrojanDownloader.Waski.B |
| Emsisoft | Trojan.Agent.BCZD (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/S-c9d5c927!Eldorado |
| F-Secure | Trojan.TR/Dropper.Gen |
| FireEye | Generic.mg.b0ebfc9f095a5441 |
| Fortinet | W32/Waski.E!tr |
| GData | Trojan.Agent.BCZD |
| Ikarus | Trojan-Spy.Zbot |
| Invincea | heuristic |
| Jiangmin | TrojanSpy.Zbot.eepa |
| K7AntiVirus | Trojan ( 0052964f1 ) |
| K7GW | Trojan ( 0052964f1 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| MAX | malware (ai score=83) |
| Malwarebytes | Trojan.Upatre |
| MaxSecure | Trojan.Upatre.Gen |
| McAfee | Trojan-FAUH!B0EBFC9F095A |
| McAfee-GW-Edition | BehavesLike.Win32.Generic.lt |
| MicroWorld-eScan | Trojan.Agent.BCZD |
| Microsoft | TrojanDownloader:Win32/Upatre.AA |
| NANO-Antivirus | Trojan.Win32.Zbot.cxukjz |
| Panda | Generic Malware |
| Qihoo-360 | HEUR/QVM19.1.F31C.Malware.Gen |
| Rising | Spyware.Zbot!8.16B (TFE:dGZlOgXMsfRG5USnsA) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/AutoG-Z |
| Tencent | Malware.Win32.Gencirc.10b59229 |
| Trapmine | malicious.high.ml.score |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2014-05-13 17:03:14
PE Imphash
4031e5d49f34c1eef26fe2b91cee7b63
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .MPRESS1 | 0x00001000 | 0x00007000 | 0x00006e00 | 3.1520645033744206 |
| .MPRESS2 | 0x00008000 | 0x00001000 | 0x00000400 | 5.863017299316366 |
| .rsrc | 0x00009000 | 0x00003000 | 0x00002800 | 4.892188306495154 |
| .imports | 0x0000c000 | 0x00001000 | 0x00000200 | 3.6460228121130327 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| BIN | 0x000040f0 | 0x00001600 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_ICON | 0x000090b0 | 0x000025a8 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_GROUP_ICON | 0x0000b698 | 0x00000014 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
Imports
Library kernel32.dll:
• 0x402000 FindResourceA
• 0x402004 GetCommandLineA
• 0x402008 GetModuleHandleA
• 0x40200c LoadResource
• 0x402010 LockResource
• 0x402014 SizeofResource
• 0x402018 ExitProcess
Library user32.dll:
• 0x402020 CreateWindowExA
• 0x402024 DefWindowProcA
• 0x402028 DispatchMessageA
• 0x40202c GetMessageA
• 0x402030 GetSystemMetrics
• 0x402034 LoadCursorA
• 0x402038 LoadIconA
• 0x40203c PostQuitMessage
• 0x402040 RegisterClassExA
• 0x402044 ShowWindow
• 0x402048 TranslateMessage
• 0x40204c UpdateWindow
L!Win32 .EXE.
.MPRESS1
.MPRESS2
.imports
EEf8MZu
@<f8PEt
+]]]Sh_
<X[PSu
-EEXt:E1;E
t:E1;E
Et:EY1;E
Y@EB$Eh
mE2EMx
AAmEmEEJ;Ar
=p]$oAE
9Q%CuhE
9Q-C,hE
9A5@EEUar
UaSE/|-Fz
9Q-CihE
9Q%CihE|)\9
9Q%ChE
9A-@EEUar
9A5@EEUar
9A-@EEUa
9Q%CuhE
9Q-CuhE
kernel32.dll
FindResourceA
GetCommandLineA
GetModuleHandleA
LoadResource
LockResource
SizeofResource
ExitProcess
user32.dll
CreateWindowExA
DefWindowProcA
DispatchMessageA
GetMessageA
GetSystemMetrics
LoadCursorA
LoadIconA
PostQuitMessage
RegisterClassExA
ShowWindow
TranslateMessage
UpdateWindow
8Muex<
KERNEL32
VirtualProtect
G(XPTPjxWXt=
WinClass
Application
GetProcAddress
Fuck this shit
VirtualAlloc
ExitProcess
LoadLibraryA
UnmapViewOfFile
VirtualFree
VirtualProtect
GetModuleHandleA
GetLastError
iEEEa|E"EEEEEEEEEEElECK7;
o-57&*
e OEE&
lfhsSsv|
]k-hEE
EEHDEEEEEEEEEEEEEEEE"E
EEEEEEEERE
EEhEEEEEE0EEEEEEEEEEEEEE(EEEEEEE=
EEEEEEE%$EfEEEEEEE
EEEEEEEE7
EfEEEEEEE
)EvEEEEEEE
EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEC
~7MAE+oM
=UyEF-|iZ|K
aY|a|E
aerXEU
O+]ae1Oaeae1KaQaep1
%x9}hkvO
-~9ja|
/|a|e~h}_|
a>Yp1t
aeae|\r@
a-Y}`|
G/|a|e~j}\c|
9q81387\Qd
PE/eEz
?0|a|U
Gt|a|U
EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEBEE
EjE|EEREhEEEE
EE4EEEdEEEXEvEEE
EEEEEE
E"EEEE
EEEHEE
EEEEEEETEE
EE6E>E
EhEvEEPEfEEEE
EE2EEEfEEEVEEE>++5E
4G5$Em )E
vE$,Eb
D1&Er ,E
6G5 FD
kEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEdE
E0EMTMTEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE
EEEEEEE
EJEE6)
(x+-6&*&$3(#
06((*1((gey0<ee 6
Oee41=1
+77, g6
)ee7 !
3"He67{e7
uyu*tu
zw/@wc
wv-Lvr-vG
EEEuuEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE
PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD<
GetModuleHandleA
GetProcAddress
KERNEL32.DLL
user32.dll
LoadIconA
t7Kt'Kt
U#U#T"S"R"R!Q!P!O N M M L K J J I
f>iiiU
de3|TP%
zq?pAwL
}LzJ|P
l).o)s
m(+o)qo)
m(=n)n)
l( n)Qm)m)m)
l)k(i(j(j(g(f'f(f'e'd'c&b&a&a&`%_%_%^%]%\%[$[#Z#Y#X#W#V#U"T"
kernel32.dll
FindResourceA
GetCommandLineA
GetModuleHandleA
LoadResource
LockResource
SizeofResource
ExitProcess
user32.dll
CreateWindowExA
DefWindowProcA
DispatchMessageA
GetMessageA
GetSystemMetrics
LoadCursorA
LoadIconA
PostQuitMessage
RegisterClassExA
ShowWindow
TranslateMessage
UpdateWindow
s 1 e 9 8 0 2 1 7 2 e 8 5 8 f e e 9 1 4 e 5 9 6 4 8 1 2 a 5 3 c 8 c 7 c 2 5 4 6 5 a 0 a 2 7 a 6 6 a c 1 8 a 6 8 d 7 f 3 b
C : \ G 0 I H 0 3 I C . e x e
C : \ i U j U
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ p 8 K M q l D Q . e x e
C : \ 3 4 7 f 9 d 6 e 2 7 1 7 9 9 e f 3 b 3 8 f 0 2 4 d 4 b a 4 4 7 7 e 2 5 5 7 1 a e 1 0 0 6 0 5 9 0 f 8 1 f 9 1 3 c 4 c 9 7 1 f 0 8
C : \ U s e r s \ L i s a \ D e s k t o p \ N q q K B x h T . e x e
C : \ 0 D 8 5 l r H i . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ d Y P E b 0 R d . e x e
C : \ 2 f 8 c b 6 3 3 9 a 8 4 7 9 7 7 7 8 1 9 4 8 f c 5 c 9 2 7 a 1 a 5 2 f e 2 6 b 1 4 4 5 a 2 6 2 7 3 3 a f d 4 9 f d 7 6 d f 1 f 5
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ Q M E N K A F P . e x e
C : \ l g C l v U n X . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ l 4 0 z B T J k . e x e
C : \ R 6 8 r i V C w . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ D e H x N r y d . e x e
C : \ e d 6 1 f 9 e 4 e b 7 6 5 8 c 8 e e d 5 0 c 7 0 2 6 1 3 f 8 d c c d 1 f 0 b 9 f 4 a d c 6 2 7 e 1 7 8 2 d 2 7 8 e f 0 5 6 b 0 b
C : \ C S 4 2 m s o z . e x e
C : \ 1 7 0 1 4 f 7 a 3 7 e b 3 c f 1 e f 2 c 1 5 a 3 9 6 0 1 c f e 5 c 0 7 c 3 f 7 f 5 a f b 7 3 9 b b 0 2 c 5 4 8 7 e 5 a 0 b c 6 1
C : \ 5 8 3 3 0 f 7 e 6 f 5 a c 0 a c 7 6 8 5 6 c 5 8 4 f a 2 b 1 2 f e e 1 2 1 e 4 d d 8 1 5 0 6 e f 5 7 0 a b c 2 b 4 a 8 3 7 4 f 2
C : \ a 3 e 0 3 8 3 a 7 d a b 9 d 0 c e 2 9 c 9 5 b 9 5 7 7 9 8 1 e 6 f d 9 5 4 0 5 0 1 0 c 5 0 b 5 4 9 0 3 8 0 1 8 1 0 d 9 c 1 1 1 7
C : \ U s e r s \ L i s a \ D e s k t o p \ t a n M J l 3 K . e x e
C : \ D w s J E K l x . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ t 5 B J r v 9 q . e x e
C : \ 7 9 1 8 5 e d 0 4 d 5 9 e 7 9 1 4 b 8 a 3 3 4 7 a 2 a 5 a d 8 3 6 9 5 1 4 5 8 4 3 f 7 5 6 4 4 4 8 5 4 0 f d d 7 a e b 2 2 2 e 5
C : \ d 0 4 a 5 3 2 8 3 9 e 1 3 d 7 7 d b 4 b a e b 1 a 8 5 2 6 5 3 6 f 7 0 e 4 e 8 b 0 a b 2 c a 0 3 2 9 2 e 1 c e 4 d 3 f 3 c 1 1 5
C : \ e 4 b d 5 3 a 2 8 3 7 e 1 d 1 7 d 9 9 6 1 4 d d a e 1 f 5 0 8 f 7 0 9 3 9 4 9 6 c 6 5 d 8 a 1 3 8 b 3 0 a 3 e e c 8 b a 0 8 1 2
C : \ e 9 c 3 2 e f a 8 6 1 5 9 9 1 8 3 b e 0 8 d d 0 4 f 9 0 5 1 6 a a 1 3 8 4 9 4 a e a d 0 6 b 1 a e c 4 1 e 4 2 6 9 0 a 9 8 7 d d
C : \ c e d 5 b d 5 d 0 6 a 2 8 a e 9 4 2 5 2 0 7 d e a 7 1 e 0 e c 4 2 8 f c d 3 9 3 4 c a e 4 0 9 6 2 2 7 8 7 c 5 b 7 c f 4 c a e a
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ O t a b J 0 p W . e x e
C : \ a 6 f 1 b 4 e 1 4 9 d 7 b 1 1 c b 9 8 9 a 0 4 7 3 0 1 e 2 7 0 1 c 6 c 6 f c 1 e 6 f 8 9 d 4 1 f 7 1 1 c 6 5 5 b 1 5 f f 2 2 3 d
C : \ 2 4 c b 3 4 2 2 f b 9 7 7 8 1 e b 0 f 8 0 5 1 5 7 b e 9 f 4 1 1 7 d f e f 6 1 1 4 6 d b 0 c 5 3 9 e 8 3 a f b 5 5 1 6 e a 4 6 3
C : \ U s e r s \ L i s a \ D e s k t o p \ a L X 6 z P Q c . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 3 b e 1 a e c 7 a f 3 e 1 9 0 7 e 9 2 a 7 2 a b 4 7 b 3 3 5 5 6 3 4 5 4 d c 5 2 1 1 c e 7 1 c 0 9 e 0 c b d e b c b 6 d f 6 4 b . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ Q h N u h 1 8 b . e x e
C : \ 6 e f 8 3 a 4 1 8 2 3 8 f 5 1 d f f 4 d 0 9 8 1 a 5 2 0 1 b 0 c f 6 0 0 1 1 e 7 2 7 f 7 7 6 6 e a 7 8 9 e 6 2 6 1 e 2 c c b a 9
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ d e n i s . p e 3 2
C : \ 0 9 c b 6 4 d 8 9 a d 0 1 e 8 5 8 6 d 8 0 9 5 5 1 d 1 f e 2 d 8 e 1 1 4 6 e e c 4 d 5 f f 0 3 6 1 8 6 0 8 6 8 a 8 5 9 3 0 c d 8
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ d e n i s . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ d e n i s . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 0 f 4 c e 1 6 8 5 f b d 5 7 9 a _ d e n i s . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ V K v N G H O 3 . e x e
C : \ a 2 4 4 1 8 8 6 4 1 b 9 1 c c e e d 3 5 6 e d 1 e c 2 4 1 4 b 5 e 0 c 5 0 a 4 4 8 8 7 6 0 4 d c 2 c 9 3 8 d e d e 7 7 2 2 6 a b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d e n i s . e x e
C : \ 8 d 7 2 9 c e 4 8 2 1 b 1 3 f d 6 6 b e 9 d 1 4 7 e 8 d f 4 c 9 f 8 e 3 a e 0 a 5 5 2 d c 9 2 a 2 b f 3 b c 7 0 c 1 e 8 2 e c 0
C : \ 5 7 1 4 9 c a 8 8 f 1 1 c c 1 0 2 3 8 7 0 7 7 7 9 4 d 8 c 7 a f 0 0 b c 3 b 0 6 c 4 b 7 8 e 7 6 1 2 7 0 d 7 1 2 3 f 9 7 0 4 d 7
C : \ 5 1 5 f 4 c 8 9 d e 1 2 0 3 8 7 4 d d 6 6 1 6 6 8 f 8 3 c 8 8 b 7 4 8 c 8 8 2 1 e 7 7 e 4 4 1 e 0 7 2 8 c 4 8 b 5 1 9 a 9 c 3 4
C : \ 9 9 8 b c 4 f 7 e 6 4 6 3 5 2 1 f 4 5 7 2 6 3 f f 3 a e c 0 5 9 3 1 7 1 d 5 3 a 6 7 4 0 4 b a 5 b 8 5 9 5 c 2 e f a b 3 7 5 c 2
C : \ 5 4 8 7 a 2 8 d a 6 c 2 7 0 8 7 3 3 9 9 0 9 7 0 5 2 7 5 a d f e 2 5 0 6 2 a e f c b b c d 7 4 2 3 0 6 d b a d 4 5 e 4 8 7 4 2 b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d e n i s . e x e
C : \ d d 2 9 8 a 5 2 a f e 3 b a 1 f 7 7 4 5 a d f 3 5 d e d 9 4 d 0 1 5 3 c d 3 c 1 1 0 b 7 0 f a 0 7 d 1 c 5 8 e f f 2 d 5 4 f 9 5
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ d e n i s . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 2 3 c f b d 0 e 5 5 3 9 4 5 a _ d e n i s . e x e
C : \ 6 c e d e 3 4 7 d 9 4 1 6 4 9 a 6 0 6 f f 3 1 c 6 0 5 2 4 b e 0 c c e 9 b 1 9 8 c 9 1 2 f f b 2 d 4 8 7 2 a 1 e 1 7 9 c 3 d 9 e
C : \ b c 1 b f c b 8 7 0 b c b 0 1 0 3 8 6 f 9 f 9 7 8 d 7 c d 0 b 2 2 4 c b f e 5 6 0 9 a f 2 7 7 a 4 9 d 3 c c b e b 1 f 9 f a c f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d e n i s . e x e
C : \ 3 0 f f 0 b c 8 0 4 9 b 3 5 9 b 1 f 8 8 e d d f d a 3 0 9 c 5 b 1 3 3 e e e a 9 b 0 e 7 a 6 d 1 b f f e 7 6 6 4 7 7 4 5 f 0 c c
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ y i Y 0 l n u O . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 e 5 2 6 8 e 3 7 b 3 5 c 0 4 8 _ d e n i s . e x e
C : \ f 9 1 2 7 9 c 1 d e 2 8 4 4 1 8 7 6 a c d 8 8 9 a 2 c 3 0 a 8 1 5 2 b d 3 0 a 4 6 2 6 b 5 a 3 1 9 4 d 9 d 4 f a b 8 9 0 a 9 b a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d e n i s . e x e
C : \ U s e r s \ J a s o n \ A p p D a t a \ L o c a l \ T e m p \ 4 b 3 e 0 3 3 3 f 7 2 a 2 b 5 a 7 4 f 0 b 7 0 7 9 4 7 e 4 f 0 f 9 1 b 0 2 5 7 f . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ o H p u D N r 8 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e 7 3 7 b f 3 7 1 0 6 a 0 2 e 7 a 7 2 3 4 f 6 1 5 b 3 6 5 9 d 9 6 9 9 2 b d c 8 1 1 f 2 5 0 9 5 c 2 3 b 5 e d d 5 5 a 1 a 8 3 9 . e x e
C : \ 7 1 a c f 2 2 1 a 4 5 0 c 3 e 7 0 1 5 9 3 a e 7 e 2 b 1 d e 1 1 9 2 4 d e 9 c 5 5 9 d 3 e b c 2 b 3 6 e 4 1 1 f d f f d b 2 e f
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ d e n i s . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 5 1 4 a a f 2 c a 6 e 5 0 0 d e _ d e n i s . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 0 8 e N d 7 t N . e x e
C : \ 1 a 9 0 a f f 6 e f 2 b a 6 d c 0 c 4 b 8 8 8 4 7 6 3 9 b 5 e f d 7 4 2 9 f 6 9 a f 2 1 3 4 a 0 d 1 5 8 8 e 0 7 7 8 3 9 1 c f d
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ d e n i s . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ d e n i s . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ d e n i s . p e 3 2
C : \ c c 0 4 3 e f 5 1 c 4 2 4 e a 3 b d c 1 a 5 9 7 2 b 8 0 0 1 f 6 3 9 4 9 4 8 9 6 6 a f d 8 4 9 a b a a 5 7 0 5 4 c f f c 9 d 7 b
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ d e n i s . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ 0 e 5 1 d 0 3 e 5 e 9 1 0 2 b e - d e n . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 1 7 4 0 2 c a f 1 1 f a 5 4 8 a _ d e n i s . e x e
C : \ 5 5 3 e 4 4 8 5 4 f f c 7 e 3 6 4 1 e 5 c 7 1 9 c c e 4 0 8 6 5 b 7 1 f b 2 d 6 b 5 6 6 0 7 9 4 0 d a 9 7 7 f 1 3 5 9 3 4 6 2 f
C : \ 7 7 1 a 1 d 9 d f b d 0 f 1 8 0 4 c f 8 8 a b e 5 4 7 5 f c 0 8 6 c f b b 9 9 4 5 9 c 7 b 4 9 c 5 5 6 0 f 1 5 e 7 0 0 c 9 c e d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d e n i s . e x e
C : \ 5 c 0 b 8 6 a d 7 5 6 7 5 2 6 1 9 5 8 5 f 7 1 a 8 0 5 4 a 8 b 3 7 0 b 6 0 0 7 7 3 4 2 8 e 7 d b 6 7 e a 2 5 a 2 d 6 b 9 5 1 3 d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d e n i s . e x e
C : \ 3 d 7 6 c 0 d b 1 a 5 3 9 5 9 0 1 c 1 e 8 e 5 a 8 7 f 6 e 9 9 1 c f a b c a 0 a e e 6 a 1 e 3 4 b 0 4 6 e a 5 b a 4 4 4 0 4 1 b
C : \ U s e r s \ L i s a \ D e s k t o p \ 4 y L 6 N T P r . e x e
C : \ 0 b b d 8 4 0 c 5 c d 4 7 6 4 f 3 a 7 6 4 3 e 7 a a d 3 0 5 0 8 4 f 4 d 1 8 4 b 4 0 5 6 7 a e a d b 3 3 3 3 4 0 6 a c f d 2 b f
C : \ U s e r s \ a r y a \ A p p D a t a \ L o c a l \ T e m p \ 8 b 5 d e b 7 4 d f c 5 b c 5 1 9 6 a 0 a b 6 c b c 8 9 0 d e 6 f 1 3 c 1 0 8 f . e x e
C : \ 9 4 0 2 9 a 5 3 a a 9 b 2 f b f 6 8 d 1 a 4 a 0 8 1 3 6 d 6 8 d 2 a 5 e 6 2 b 2 1 a b c 7 f 1 e 8 0 9 b a b e b 5 0 0 5 d 6 1 1
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ d e n i s . p e 3 2
C : \ 5 4 d 2 9 0 d 4 2 6 3 3 8 6 2 1 b 7 c 5 6 b 2 6 7 9 1 c b e b 6 f b 5 b 1 a 5 e d 1 9 f c 2 d 9 f f 6 c f b 6 c 9 f 2 9 7 4 f 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d e n i s . e x e
C : \ c 1 f 7 0 e 9 f 0 7 d 7 3 3 b 4 4 2 1 8 2 1 9 a 9 a 9 2 7 0 0 c f 8 e 3 7 3 3 6 8 0 9 8 3 6 2 9 2 6 0 5 b a 1 e 2 d 0 7 8 2 c 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d e n i s . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ f s w K t H 8 z . e x e
C : \ f d 0 5 c 7 3 b 3 8 2 5 2 2 8 c 9 4 e c c a 0 4 f c 9 f 2 5 0 2 1 b 5 2 3 4 7 6 c 8 9 0 7 0 a 0 d 4 2 b d f d 0 d c 1 a 8 a d 8
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ d e n i s . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 6 5 f 0 6 e f 8 8 0 2 5 f 7 3 _ d e n i s . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ T Z 2 w h l a Y . e x e
C : \ 2 4 1 8 5 e f a d 4 0 2 4 e 2 5 5 6 b c 0 2 a e f 8 a 2 c 1 a 2 8 6 b c b 3 3 5 9 6 0 b e 7 7 2 b b f a e e 6 3 0 e 5 1 e e f 7
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ Q t g 2 e M E b . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ 4 9 f 9 2 c 2 1 4 3 c 8 0 7 a 0 4 1 7 b 1 2 6 a d 3 c 9 2 4 3 1 8 8 8 c 7 5 f 5 6 5 9 7 6 5 1 4 0 e 8 9 7 a e 3 d 1 a d 7 c e f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d e n i s . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ m B b h 3 O y k . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ q O j v b w 5 i . e x e
C : \ 1 d 3 a 7 7 4 3 e 3 e f 0 8 a 3 7 4 1 5 0 b 6 8 d c 9 2 9 d 1 7 c d d e c 7 a 3 2 a 0 7 d f d 5 0 9 7 9 c 0 1 b f 3 4 9 d f c 6
C : \ U s e r s \ L i s a \ D e s k t o p \ l 4 p k g p k t . e x e
C : \ c c 9 d 5 d 8 a 1 a c 9 a e 6 d a c 4 2 5 e 3 3 7 d 8 6 0 3 c d 9 5 f 5 6 f 8 d a b b 9 5 f d d 6 9 e c 3 7 d c 3 d e 1 0 d 7 0
C : \ U s e r s \ L i s a \ D e s k t o p \ y W Y 0 i b n P . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 6 5 8 0 e 3 3 5 9 3 5 9 3 7 c 7 2 0 1 6 0 2 1 a 9 2 8 0 0 6 a 5 2 8 b 4 b 9 5 5 6 a 1 3 9 5 2 f 6 a 9 4 4 c 4 5 5 2 f 4 6 a 2 0 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ d e n i s . p e 3 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ U q B D g d R 3 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ 1 2 c c d 9 2 6 d 5 b b 1 b 0 b d f 8 1 a 0 5 f c 3 6 c 6 e 5 2 e a 9 2 d 1 c 9 7 0 1 2 9 8 f f c 9 5 0 d 9 9 1 4 0 2 7 0 b 5 2
C : \ 1 4 2 e 6 e d 9 d d 4 c 8 3 c f c c f 9 4 5 a 3 c 5 3 9 c f d f d f 7 2 0 5 9 d 9 5 e 6 7 4 0 a 9 3 4 7 2 4 f 5 1 a a 0 8 8 b b
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ H 4 t m k u W v . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ L 6 4 3 h O 4 M . e x e
C : \ 1 b b 0 0 0 c 3 d 0 d 2 0 a 4 2 2 4 6 e d d 7 7 6 4 5 5 2 2 6 0 4 4 f e d 3 a d a a 6 2 6 9 2 9 a 7 2 d b 1 b 4 8 e 8 0 b 3 a e
C : \ 5 e c 7 2 2 3 5 6 9 e 9 2 0 c 0 9 f f 6 a 7 8 f 2 5 b 6 9 f d 2 d 3 3 0 3 b b 4 2 1 f 8 a 8 b 6 7 8 5 7 d 7 a 2 5 1 a 3 d 0 0 3
C : \ 3 7 c b 0 9 e d 0 4 b 7 b 6 5 c 9 c f 9 6 1 f 5 f 5 b c b e c 9 a 4 a 8 f 7 8 1 f f f a 7 f 9 d 7 e b 2 6 4 e d 6 8 3 6 0 6 b 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d e n i s . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 7 3 s V A i U x . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d c 1 d 9 f a 3 4 8 1 b 3 f b 6 _ d e n i s . e x e
C : \ e f 5 c c c 1 b c e 8 7 3 9 6 9 9 7 f 1 9 f f 9 8 c 7 2 a d 2 8 2 2 e 6 0 b 1 6 3 0 b 2 0 4 e e 8 8 d 8 2 c 6 0 5 c a 2 a 3 2 f
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ d e n i s . p e 3 2
C : \ 0 4 2 6 7 2 c 5 e f 0 a f d 0 a 0 2 b 0 8 f 5 a 0 b 9 c 2 a d 7 7 5 e a e 9 3 8 b 7 c 5 c f 8 7 9 1 3 9 e 2 7 4 e 6 0 0 a 9 3 1
C : \ U s e r s \ L i s a \ D e s k t o p \ P s A 0 W m S l . e x e
C : \ f 1 b 6 c b 5 a c a f 1 8 8 8 8 0 9 5 6 5 b 8 e f 1 d f 8 5 5 e d 6 9 a 5 d 5 7 7 3 7 6 1 1 1 7 e 4 2 3 7 d 0 5 9 5 e 1 7 7 f 4
C : \ e 4 6 f 9 f 9 6 e 3 d 5 a 6 3 c 6 b f 0 f e 5 6 b a 4 b 0 6 b 3 8 6 1 5 3 7 0 2 a 7 2 0 6 9 9 a 1 d 9 3 f 3 3 d b d 8 2 b 2 9 6
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ d e n i s . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 0 3 8 7 7 9 3 3 a c 8 b b d 1 9 _ d e n i s . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ d e n i s . p e 3 2
C : \ 5 b 0 1 6 b 0 2 9 c a c a b 1 7 3 f 1 0 7 b d 3 4 f b e 4 e c 0 3 f c f a 6 e f a 2 7 0 5 6 7 d 0 1 6 0 b e 0 4 7 9 f 4 0 0 f 3
C : \ 5 b 2 b 3 8 0 5 9 a 2 d 4 4 7 e d 3 0 e d f a d a 2 1 4 e c a 2 3 3 5 4 a 8 4 c 1 c a d 3 5 3 a d b 3 4 1 2 7 b 8 2 a 9 0 f 3 4
C : \ U s e r s \ L i s a \ D e s k t o p \ I O i 2 h B r g . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ d e n i s . p e 3 2
C : \ f e 9 7 5 c f 4 d e 7 7 e d b 3 c 0 d 4 6 4 0 9 c 9 b f 9 f 7 4 d 2 f 8 6 f 0 b d 7 9 c c a 4 2 a e 8 4 e 4 b c 4 f 7 4 0 f f 5
C : \ U s e r s \ L i s a \ D e s k t o p \ j 8 S b b U y f . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b 0 f 1 d 0 b 4 a b 8 9 7 e c f 6 f a 5 6 2 b 5 c 8 6 e b a e f 0 9 3 b c 3 a 9 7 c 0 6 a 1 9 7 8 e c e f 3 8 3 8 f 8 9 0 d 8 9 . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ W b 3 4 2 0 r g . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 8 f c b 1 3 8 9 3 f d 9 2 e c e 0 0 3 1 1 2 8 4 a a 7 5 7 1 a 6 d d c 4 0 3 6 e a 9 f 8 8 7 c 4 4 4 4 3 5 4 1 2 1 5 1 1 1 5 c c . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ I 9 h S T H u g . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 5 a c 8 0 f 0 7 9 4 1 1 7 8 0 2 _ d e n i s . e x e
C : \ 0 5 d 3 e a 9 f 3 4 a 7 7 2 4 1 2 d 3 8 1 2 e 6 1 e 8 d 0 0 8 a e 5 d b 8 3 a e 4 3 e 6 2 8 8 4 8 e a 4 1 9 9 d b 7 4 9 5 6 7 f
C : \ 3 4 6 f 4 0 3 4 6 b f e 4 5 8 8 9 5 a 4 a 0 2 f d c 2 a f 4 9 a 5 c 5 a f 5 c 2 6 7 8 c 1 a e c 0 f 0 c d f d 8 4 2 e 1 9 8 2 a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d e n i s . e x e
C : \ 5 6 8 f c 5 8 6 a b c 7 7 f 7 4 c 3 e 6 7 2 1 f a 6 0 5 3 d 9 8 9 2 e e 1 4 9 1 3 7 2 4 d a 2 c 5 e 1 1 0 6 f 6 f 2 e b 6 f 9 a
C : \ c c 0 8 7 0 7 e c 3 3 a 4 a 7 0 1 8 b a 5 5 5 b b 8 f 6 7 c 4 3 b 3 2 7 6 a a d a 7 b 1 a 3 d f 5 e f b 1 d b 4 4 8 4 8 b 1 1 a
C : \ 7 a 6 5 7 3 6 6 d 4 b 0 b 9 5 8 b e 6 5 a 7 3 f d 0 4 b 7 e 5 9 4 1 d a a 9 4 f 4 2 8 5 3 1 a c a 3 1 5 d 2 c c 0 e 0 8 c c a b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d e n i s . e x e
C : \ 7 3 d c 1 6 3 9 a e e 8 0 6 f 9 a c 3 c a b 5 9 6 b 4 a 1 4 8 7 4 0 b b 2 d 3 4 e c 6 d 6 2 d 1 7 1 0 8 f 7 d c 1 4 4 e d 7 0 c
C : \ U s e r s \ L i s a \ D e s k t o p \ k T 3 L z W Y 7 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ d e n i s . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 2 e 2 b e e f 3 6 5 d 0 5 2 f _ d e n i s . e x e
C : \ 0 f 4 3 c f 8 e 8 0 a 7 d 4 e c 4 f 9 7 a 9 9 8 0 0 2 5 d 0 9 6 5 8 1 4 6 1 4 8 4 6 8 8 1 1 c 1 2 9 5 c 9 5 5 a 3 c 4 c 0 5 d b
C : \ 0 f 3 5 5 9 4 d 7 5 c b 9 d 2 0 6 8 d a 8 7 f 8 5 a 3 0 5 1 f d 5 4 3 4 a 7 6 8 4 2 9 0 d 0 f a 6 0 3 0 f c 1 c d e e 9 8 c 9 4
C : \ 5 9 2 2 3 2 e 1 d 9 4 8 f 8 5 d b 1 8 3 a 3 8 3 c 6 c 5 b 3 8 8 3 8 d 6 1 6 5 3 f 0 4 6 2 9 6 2 5 d 8 5 0 2 6 8 4 b 0 7 6 6 2 e
C : \ 8 3 e c b a 9 7 0 f f d a 6 6 b 8 9 7 e 0 d c b 2 7 8 b e 6 2 6 d f f 9 e 9 6 f 8 3 f 9 5 a 4 a 4 c f 6 c b 3 3 b 8 7 b b 9 c 0
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ d e n i s . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 1 2 8 8 4 0 0 0 5 a 3 2 8 3 4 f _ d e n i s . e x e
C : \ 0 5 0 3 a b 5 9 f 4 6 9 f 9 0 9 c c b f 4 e c 7 9 d 3 5 b f 5 7 4 c 0 0 9 2 f e 6 1 0 5 0 2 7 a f a 8 7 e f 1 0 0 7 6 f 6 e 7 0
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d e n i s . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ u Y 2 o 6 J J k . e x e
C : \ 3 1 4 2 6 a 0 d 3 5 5 a d 5 f 2 5 7 5 f e 7 d 6 9 6 c 6 d 4 5 9 4 4 e c c 0 7 f 0 d b 9 4 2 7 0 c 4 c 3 3 7 3 d d 3 9 b 0 9 a 0
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 1 y N 3 Q q k p . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c a a d e 1 e 4 f 6 2 e 5 2 7 0 3 9 7 5 b b c 3 8 9 5 3 5 8 0 1 f e 9 9 5 e 4 7 0 3 a 0 7 3 0 8 0 e 7 b 4 e 7 e 9 8 d e 0 9 d 0 . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ n k t U z R s s . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 9 e 4 e 8 d 2 1 b c 5 d a d 3 b a 7 8 0 b 6 c a e 7 4 a 2 5 5 b 3 a 7 a b f 6 3 3 0 2 0 5 5 6 6 8 4 7 d 9 9 1 6 6 c 3 0 e 6 4 6 . e x e
C : \ b 1 8 6 c 7 8 a 8 e 4 6 5 d 8 5 a 5 7 1 8 1 d d 3 a 4 b d 5 8 f 3 b b 2 f 6 9 b e 7 1 c 0 f a 5 7 2 a 7 8 7 2 9 a 4 e 0 1 6 c a
C : \ 8 8 c 4 1 8 6 9 e 1 5 c 8 1 1 9 4 1 8 9 8 8 7 f 1 b 2 0 9 2 6 d f 9 8 3 9 d 0 5 6 b a 0 0 5 c 3 b f b 0 7 c 3 1 b c c a c 3 7 e
C : \ b 6 c 0 0 6 2 4 f 8 d 0 1 9 2 b 2 5 1 7 4 2 a a c 7 1 6 7 9 f 9 f e 3 2 6 6 c c 4 d 9 4 7 c 3 3 b 9 b f 3 5 3 2 0 9 d 9 2 a 3 e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ d e n i s . p e 3 2
C : \ a 1 9 b a b 1 e 8 6 a 8 6 a b 4 0 7 a 7 9 e 1 b e 1 1 7 0 4 e 1 a 7 b b 9 4 5 f 1 9 7 6 3 d 9 8 3 1 0 8 2 a 9 b 1 9 c 5 7 d c 2
C : \ U s e r s \ L i s a \ D e s k t o p \ e L h w v U n n . e x e
C : \ 1 8 e 9 8 5 b f 9 7 d 9 1 7 5 f 1 6 f 5 3 c 9 1 2 0 b 0 e 6 a e a 6 5 3 1 2 9 d 4 c 3 5 8 b 6 b 6 9 5 7 b 3 4 0 6 e c 2 e b 4 a
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ l H 6 Z q 8 z C . e x e
C : \ 0 4 c 8 a 7 f 1 5 9 1 1 e 5 b 8 3 8 7 6 4 1 8 2 1 c 0 d 4 7 d a 5 8 6 a d 6 4 2 d b d 4 5 6 c a a b d 8 e 7 7 d 3 2 f 7 5 6 5 4
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ d e n i s . p e 3 2
C : \ a f 1 2 d 8 5 b b a 4 8 f d f 0 c 3 d 8 c 1 6 d 8 8 e 8 a c e c d 2 c a 8 7 a 1 6 a 2 2 e 1 7 7 c a 7 0 4 8 3 5 3 9 0 e e 6 0 8
C : \ d 8 7 f 9 d 0 6 9 2 c d 7 5 8 e 4 4 4 2 2 1 d e 1 6 0 9 d 8 6 9 2 e f 7 2 9 b e a c 3 9 3 e b 3 0 0 c 4 6 2 4 6 f e 3 e 6 9 a 1
C : \ 2 c e 6 0 e c 6 7 7 4 4 7 0 f 7 8 0 c 1 5 8 5 a 0 7 5 e d c d 5 6 5 a 3 2 b 6 2 d e c e a e f e a 7 f 2 f 4 1 d 8 2 e 5 5 9 f 2
C : \ 3 b e 1 4 0 5 3 7 6 6 8 8 d e 1 e 2 0 3 a e 8 7 2 0 5 f a d 5 1 b b 4 d 0 6 6 3 2 9 8 f 1 a c 4 9 e c d 1 8 1 9 d 2 3 d 7 8 b 1
C : \ b 3 5 b d f 3 d 1 4 b d a a 3 c f 6 4 c 0 0 3 4 5 2 4 2 1 c f d 0 4 b 0 c f b 1 2 f 0 f 4 c 7 b 1 c c 0 4 8 0 b 4 6 6 d 0 1 3 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d e n i s . e x e
C : \ d a 0 6 0 f 0 c 6 a a 4 1 6 2 6 f 0 5 d 5 f 6 9 7 a f f b 4 1 7 f c 9 6 5 2 3 f a 2 6 6 b 3 a 9 d 7 0 6 4 6 6 5 f 2 e 8 f d 0 3
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ d e n i s . p e 3 2
C : \ 9 5 a f 9 7 b 8 0 2 2 1 b a 2 f d 7 b 0 0 2 d 3 0 9 4 a 5 4 6 d a c 2 a 8 4 9 f 3 0 5 5 3 a 9 e c 4 8 5 3 0 e a c 8 9 b e 3 6 8
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ x K O S D k E G . e x e
C : \ 1 7 c b e e c 4 4 f 3 4 0 e c e 3 4 c 7 4 c 6 b e 8 8 6 3 b 9 9 3 e 6 9 2 3 c b 8 f 3 1 d 4 3 7 0 c 5 c d e 9 f 1 b 6 b 7 9 5 b
C : \ 3 8 0 a 3 2 8 a a 0 1 d 6 6 5 4 6 e a 5 d 2 5 5 b 4 9 1 d 8 a 9 5 0 a 5 0 6 2 6 d c 4 7 6 9 f 8 f 6 b 0 3 8 3 5 d 8 d c 2 1 c 5
C : \ U s e r s \ L i s a \ D e s k t o p \ a 0 a J o 3 a W . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 8 1 e 7 b 0 b 9 6 c 5 a 5 5 2 2 0 1 9 d 9 8 7 c 4 c 7 3 9 0 9 c 2 f 1 6 9 1 5 e 0 6 f 7 b 8 2 c 9 5 5 1 5 e d c d e 5 f 5 e 0 2 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ d e n i s . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ d e n i s . p e 3 2
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ G S E Z I O a Z . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ e 7 2 b 3 8 9 5 e d a e e 6 0 4 8 7 0 6 f c 0 9 a 9 9 f 0 9 b f d 9 7 a 6 c 5 7 b a 6 1 b 5 9 3 3 c b 0 6 a 2 9 4 0 9 d 6 b 6 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d e n i s . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 2 d D t T B s f . e x e
C : \ 2 5 f 4 f 8 5 6 7 6 5 6 6 b f 4 3 4 4 2 6 0 5 0 4 e e a 6 1 e d 4 3 6 8 9 2 3 b 6 4 e 3 0 f e 7 e 0 7 4 a 8 2 1 7 d 6 0 f 2 3 b
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ z 0 v i E v t L . e x e
C : \ 4 c 2 6 2 e d 5 c a a 4 b 8 5 5 e 3 2 7 4 d 1 d d 0 4 2 6 a 3 3 1 a 5 6 4 3 5 b 7 8 8 f 1 8 0 7 e 3 1 f 9 a c a 1 3 8 b a e c 6
C : \ 3 f 2 0 4 7 e c 9 1 0 2 5 0 5 7 2 3 5 2 5 8 8 2 3 1 f 0 2 a c 6 5 5 7 7 2 8 9 3 3 2 0 2 e 0 b f 1 4 b b b b 2 6 3 0 9 3 e b 4 6
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ G j 6 m O 8 M I . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 0 4 8 2 2 2 a b 3 3 7 5 4 f 5 8 b f 6 2 a c 1 b d 8 0 1 d 8 9 4 3 c 1 f 6 4 a b d 8 4 2 e 2 b f e b b a 5 7 3 c e 0 2 4 e e b 5 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ d t 4 Q e w G A . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 3 2 2 7 5 f 8 2 8 4 8 4 6 0 e f 7 e a 2 1 4 0 1 3 a f a c 6 6 9 5 7 3 3 f 7 b 4 a 7 a b 1 b b 3 8 b f 8 8 2 7 c 3 5 d 0 5 5 5 1 . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ w j s 5 V 0 H b . e x e
C : \ 7 c b 7 2 c 1 4 9 e 8 f 8 7 1 7 b 6 3 7 0 e c 6 7 5 5 e 0 0 d 4 0 8 9 e 1 6 b b 9 0 d 9 f 9 4 9 f e 5 d 2 4 e e 8 4 2 a 2 6 9 e
C : \ 3 1 a 2 8 5 3 4 7 7 e 7 9 2 4 6 a 2 1 8 3 2 5 7 2 0 7 2 a 2 0 b 9 f f 9 1 8 b 9 1 d 9 0 e 1 5 e c 8 4 d 1 0 f c 9 f e 7 2 7 5 b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d e n i s . e x e
C : \ 6 5 7 2 8 6 f 5 b c e 4 4 e 6 6 5 6 5 a 6 c 0 3 7 b 8 1 d 3 1 0 2 f 4 6 0 c f c b 4 6 3 2 3 7 3 e 0 a 2 1 8 d 4 8 5 b 6 4 0 f 0
C : \ U s e r s \ L i s a \ D e s k t o p \ 9 X q m X c M N . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 2 5 c 9 b 4 9 e 8 1 d b 7 6 5 5 0 b 1 c 9 6 e 2 0 b 5 b b 7 e c 1 f f f 7 2 1 1 e 1 f 1 4 d c a 9 c d b 7 a 7 2 2 8 6 7 4 8 d . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ T b B t k k 1 O . e x e
C : \ 5 e d a 7 1 5 5 6 5 b d 3 c 3 2 3 4 6 6 2 5 6 c 8 4 d 5 d 1 b b f 8 a 8 9 6 e 1 7 c 4 5 9 b 0 5 0 2 f a 4 7 c 2 6 5 b 4 4 e 6 0
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d e n i s . e x e
C : \ 0 a a 4 1 2 3 f 5 9 8 3 b 1 2 c 4 9 5 0 c 4 b 9 c 9 d 1 e a 8 d 6 3 8 6 8 1 2 3 a 4 d a c 0 3 3 e f a 8 8 d e 6 c 0 d f f c c d
C : \ d 3 b d 9 0 b 8 b c b 0 c f c a b 8 9 3 1 b b d 3 b 5 a 9 e b 8 6 7 9 7 3 5 a 4 a f f 0 9 1 7 6 6 b d b 9 9 b 3 1 3 4 f 9 9 5 c
C : \ 6 9 5 8 0 d 9 d 8 3 1 8 d 8 d a e 2 c 2 2 7 9 6 f d 4 4 7 8 c 4 1 7 2 b 2 e c 5 3 c c c 8 f 4 9 3 5 1 2 f 2 7 5 8 6 0 7 f 5 3 c
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ S V I z W o t I . e x e
C : \ 3 e 6 b 5 7 f 0 7 a 5 c c b d 0 5 8 a 2 f 9 5 8 3 a 5 c 5 a f b 2 6 a 2 9 f 2 e c 1 9 6 c 2 e c 0 6 2 9 f 8 8 6 4 0 e 6 c 7 d 9
C : \ U s e r s \ R A 4 9 1 ~ 1 . V U L \ A p p D a t a \ L o c a l \ T e m p \ e 6 a c 7 9 0 5 a 6 7 f 5 6 8 e 0 6 d 5 a 8 2 5 c 5 d 4 5 0 b f . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d e n i s . e x e
C : \ 3 f 6 d a b 6 7 5 d 5 5 0 d 2 3 3 8 4 d 8 7 1 d e 4 c f e f 1 8 8 9 1 c f b a e 6 2 a 4 2 1 f a 9 b f 7 8 7 a 1 5 e 7 3 c 1 5 f
C : \ d 6 b f 9 4 8 a c b 7 e 9 a a 9 d 0 d c 9 3 7 a 8 a 1 b e 4 b 4 9 2 6 c 1 2 4 d 8 4 4 1 4 c c 4 3 5 9 c 4 b d 7 f f 0 5 0 5 f 4
C : \ U s e r s \ L i s a \ D e s k t o p \ x 4 W t M f y v . e x e
C : \ 5 7 f f 7 4 0 6 c c 3 f d f a b 4 d 7 d a 8 9 a e 2 f 7 8 5 a 6 c f 4 f 8 a 8 2 7 2 b c b b 6 d 5 f 4 e 7 6 e 9 d 6 7 d 8 c a 1
C : \ 6 3 c 0 f 0 9 7 2 f 5 f 0 0 b 4 1 b f 3 9 c e d 5 c f a 7 2 2 d 3 c b 7 2 4 8 6 1 7 e f d 2 9 8 4 5 e 7 b a 5 1 7 a 9 5 9 4 e 8
C : \ U s e r s \ L i s a \ D e s k t o p \ u s 4 C f f u B . e x e
C : \ f 7 3 b 0 e b 4 a 7 c c f 6 8 c 4 7 0 4 4 7 f 2 3 a 9 2 a 8 a 1 4 f 7 5 d 5 e 4 7 2 b 2 5 d f 7 8 6 2 f 6 9 7 0 2 4 0 8 b f 0 c
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ d e n i s . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 8 d e b e 0 f 9 e b 4 0 0 f 1 9 _ d e n i s . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ i B I b o b D q . e x e
C : \ 4 b 4 8 7 2 4 a 0 5 2 1 9 6 0 4 f a 7 8 0 9 b 0 b c 3 9 7 3 b 5 2 6 c b 0 d 0 c 3 2 8 3 f 1 9 0 d 3 6 f 4 1 8 e 1 9 c e 6 6 8 a
C : \ 7 2 6 c f d 2 c f 3 e 0 3 5 6 b d 8 f e e c 9 0 d 9 d e e 7 8 9 1 6 2 f e 3 a b 0 0 5 4 2 f 6 a e 0 d 8 a a 7 6 5 f 0 7 8 5 1 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d e n i s . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ Q L j b S L g 7 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 1 7 5 7 3 9 8 8 e d 6 2 f 0 1 3 c d c b 6 e f e f 8 a f 9 2 8 d 7 c 9 1 c 6 a 5 9 9 b 8 2 4 7 0 7 7 e 9 5 c 6 8 b 8 f 0 f 9 c . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 3 c 4 e 7 9 d 3 5 7 9 c 2 d 3 9 f 2 1 0 b 8 8 3 6 4 f 4 8 8 1 4 8 f c 3 4 7 f 0 d 5 4 1 0 0 e 9 c f 1 5 8 0 2 e 3 c 1 d 6 0 2 8 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ B p N E C x H w . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 3 7 4 a 4 b b 7 8 5 7 d 3 4 5 b d a f d f 1 e c 0 3 c 4 6 a 8 1 b 3 b 0 6 2 3 5 2 0 0 9 f 6 b c a 3 c 3 c c b b 7 b b c b e f 3 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ Z S p Z m X t I . e x e
C : \ U s e r s \ R A 4 9 1 ~ 1 . V U L \ A p p D a t a \ L o c a l \ T e m p \ 7 b d 5 f 3 c a b 4 7 3 3 9 4 5 3 e 7 5 f e 5 d 5 a 1 e e 3 0 1 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d e n i s . e x e
C : \ U s e r s \ R A 4 9 1 ~ 1 . V U L \ A p p D a t a \ L o c a l \ T e m p \ e 6 a c 7 9 0 5 a 6 7 f 5 6 8 e 0 6 d 5 a 8 2 5 c 5 d 4 5 0 b f . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ P N A V p h C J . e x e
C : \ U s e r s \ R A 4 9 1 ~ 1 . V U L \ A p p D a t a \ L o c a l \ T e m p \ 7 b d 5 f 3 c a b 4 7 3 3 9 4 5 3 e 7 5 f e 5 d 5 a 1 e e 3 0 1 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ d e n i s . p e 3 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ f z S W 4 R 9 s . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e 5 d a c 2 8 9 d 0 0 7 6 e 0 3 8 a 2 8 4 b 8 4 3 e 6 0 b 5 4 6 0 4 4 6 3 3 f e 8 3 0 6 4 6 6 5 e 1 e 3 0 c 2 6 a 4 1 c a 0 2 5 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e c 0 7 7 c 1 0 c 5 7 9 0 4 d d 2 c 0 e 6 1 2 2 f 5 7 f 4 8 0 3 b 0 7 3 b a a 8 a c 0 0 8 2 4 2 d a 5 6 3 6 c 9 0 5 2 2 1 7 4 9 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ d e n i s . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 e a 7 7 2 0 2 c b 5 b f 3 a 5 _ d e n i s . e x e
C : \ c 1 7 e 7 8 5 1 f a 9 9 3 f c 8 7 7 5 4 c 8 1 c 7 3 e 6 4 d 5 f 2 9 5 6 9 6 9 a 0 8 1 a f a 2 4 b 6 6 7 6 d 7 2 a 1 c 7 4 f 6 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d e n i s . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 1 b 0 d 6 6 5 e b f 4 8 4 1 8 b 0 f 7 3 0 1 7 2 7 3 e 2 3 9 5 5 0 2 a f d 8 5 c 4 9 b 7 9 2 2 9 d a 5 1 f a f e b c 8 1 1 2 2 c . e x e
C : \ 2 b d c 8 0 2 3 0 2 c 8 0 e b 8 8 d 8 8 3 c 2 0 4 3 a 1 d 1 7 5 7 1 b e e e 6 c e 7 c b d 6 3 b 9 9 4 4 b 9 3 b 3 b 6 f f 5 e 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d e n i s . e x e
C : \ e 4 4 1 5 4 a f f 5 e 9 c c f c 6 8 9 b 7 8 e 9 c 5 4 8 f 2 8 0 3 3 5 a 8 2 6 0 d c 6 3 9 5 4 a f 7 4 8 6 c f 0 2 1 3 a 3 6 9 c
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d e n i s . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e 7 2 4 d a 8 e d 6 0 5 8 6 d d a a 5 3 3 e e 6 9 f d 0 0 8 0 3 c 1 7 e e d c 4 6 5 6 6 9 5 d e 2 c a 3 3 a 1 8 5 9 b 9 3 0 c 3 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 1 5 7 b c 5 a a e 3 b e 2 6 4 c 9 2 0 9 b 4 4 e 3 2 1 9 9 d d f c 8 3 d c 5 e b 9 2 f 7 f 4 9 6 3 2 a 5 7 8 5 3 2 4 5 8 2 b 1 a . e x e
C : \ b 0 e 0 d d 7 0 5 7 c c 4 e 7 5 d f 8 e 2 a 6 1 9 6 2 6 c 3 6 b 9 a e 5 3 7 7 9 4 3 0 e 2 f 4 1 7 7 8 4 d 0 2 8 c 9 4 7 6 a 0 9
C : \ d b f 7 7 5 4 e a 6 c 8 7 2 c 8 d 0 c f 6 f 5 b 3 2 3 e 8 1 e d a 2 0 5 9 a 3 2 f d 3 5 3 a b 5 2 b 7 9 a d 5 5 0 7 2 4 7 3 a 0
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ d e n i s . p e 3 2
c : \ t a s k \ 0 0 D 8 8 1 1 7 6 3 F 3 8 F 0 3 4 F 2 C 4 5 8 B A 3 5 0 9 A E C . e x e
C : \ 5 8 f f 8 9 9 1 f 9 1 d b 9 d d 1 5 0 7 a d 6 8 f f 8 3 9 4 a b 9 b 8 c b c 7 c a 2 9 a 3 f a 6 2 c 5 0 9 f f e 3 b 4 d 4 f 7 c
C : \ b 4 f f a 2 d 7 7 6 e 5 b 6 3 1 6 3 b 8 d 1 4 d 2 2 5 d 5 3 4 2 0 4 2 d 7 5 f 1 6 4 c 1 2 9 7 4 8 9 1 4 f a 5 6 d 2 8 f 1 b 8 5
C : \ 6 6 8 6 4 8 b 2 7 7 a 0 7 6 2 2 3 5 5 c 1 9 4 e a 9 9 3 4 1 f 3 f f 8 c 1 8 d a c b d 5 7 4 e 8 4 8 2 e f 7 b 2 d 9 7 e b d 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d e n i s . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ A C A z 3 m A T . e x e
C : \ 4 c 1 4 7 1 e 1 e b 0 e 5 6 1 b d f a 4 b a 8 2 3 f 0 1 9 5 b 6 b b d 9 5 1 e f 1 7 3 7 4 d 5 2 9 a c f c 0 d 1 4 3 7 7 1 d e 9
C : \ U s e r s \ L i s a \ D e s k t o p \ D E 4 9 d D B o . e x e
C : \ d f a b 9 2 e 4 8 c 8 d a 7 d 2 b f 6 4 0 2 e 8 5 e 9 2 c f 1 5 5 a 7 d d b e e 5 f 3 a 6 9 5 d 0 0 a 2 f 4 c 5 0 a b d b 7 a 6
C : \ U s e r s \ L i s a \ D e s k t o p \ B j 1 L X a 8 d . e x e
C : \ d a d 1 7 6 e 7 3 6 f f 8 0 a 8 c 5 9 e a b 5 0 0 7 5 8 b 7 3 f 3 4 a e 7 9 f d 8 d 0 6 f f b 2 3 2 7 e a e b e 1 c 6 4 e f 0 e
C : \ 1 a d 3 9 3 a 0 4 5 a a 5 4 d f 2 9 b a 6 f 4 c 5 9 4 2 2 d 5 5 6 7 b 0 2 e 7 c 9 6 a 0 3 b 2 b 7 2 3 e a 9 9 1 b 8 7 2 2 3 6 3
Hosts
| IP |
|---|
| 114.114.114.114 |
| 8.8.8.8 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 61714 | 8.8.8.8 | 53 |
| 192.168.56.101 | 56933 | 8.8.8.8 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 8.8.8.8 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.