3.3
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.64
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | TrojanDownloader:Win32/Upatre.dab9935a | 20190527 | 0.3.0.5 |
| Avast | Win32:Trojan-gen | 20200902 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Downloader.Small.cl | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (W) | 20190702 | 1.0 |
| Kingsoft | None | 20200902 | 2013.8.14.323 |
| McAfee | PWSZbot-FFA!B989F17138C1 | 20200902 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b0784b | 20200902 | 1.0.0.1 |
静态指标
查询计算机名称
(2 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545330.499875 GetComputerNameA |
computer_name:
|
failed | 0 | 0 |
|
1727545330.9225 GetComputerNameA |
computer_name:
|
failed | 0 | 0 |
检查进程是否被调试器调试
(2 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545330.390875 IsDebuggerPresent |
failed | 0 | 0 | |
|
1727545330.9065 IsDebuggerPresent |
failed | 0 | 0 |
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(1 个事件)
| section | .imports |
动态指标
分配可读-可写-可执行内存（通常用于自解压）
(4 个事件)
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\weyjba.exe |
投放一个二进制文件并执行它
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\weyjba.exe |
将可执行文件投放到用户的 AppData 文件夹
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\weyjba.exe |
一个进程创建了一个隐藏窗口
(1 个事件)
将读写内存保护更改为可读执行（可能是为了避免在同时设置所有 RWX 标志时被检测）
(8 个事件)
可执行文件使用UPX压缩
(2 个事件)
| section | UPX0 | description | 节名称指示UPX | ||||||
| section | UPX1 | description | 节名称指示UPX | ||||||
网络通信
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
文件已被 VirusTotal 上 59 个反病毒引擎识别为恶意
(50 out of 59 个事件)
| ALYac | Gen:Variant.Razy.727641 |
| APEX | Malicious |
| AVG | Win32:Trojan-gen |
| Acronis | suspicious |
| Ad-Aware | Gen:Variant.Razy.727641 |
| AhnLab-V3 | Trojan/Win32.RL_Upatre.R275748 |
| Alibaba | TrojanDownloader:Win32/Upatre.dab9935a |
| Antiy-AVL | Trojan/Win32.Bublik |
| Arcabit | Trojan.Razy.DB1A59 |
| Avast | Win32:Trojan-gen |
| Avira | TR/Crypt.ULPM.Gen |
| Baidu | Win32.Trojan-Downloader.Small.cl |
| BitDefender | Gen:Variant.Razy.727641 |
| BitDefenderTheta | Gen:NN.ZexaF.34216.eqY@aS36lwei |
| Bkav | W32.AIDetectVM.malware1 |
| ClamAV | Win.Downloader.Upatre-5744087-0 |
| Comodo | Packed.Win32.MUPX.Gen@24tbus |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cybereason | malicious.138c11 |
| Cylance | Unsafe |
| Cynet | Malicious (score: 100) |
| Cyren | W32/Upatre.KF.gen!Eldorado |
| DrWeb | Trojan.DownLoad3.28161 |
| ESET-NOD32 | Win32/TrojanDownloader.Small.AAB |
| Elastic | malicious (high confidence) |
| F-Secure | Trojan.TR/Crypt.ULPM.Gen |
| FireEye | Generic.mg.b989f17138c11b29 |
| Fortinet | W32/Agent.ABI!tr |
| GData | Win32.Trojan-Downloader.Upatre.BJ |
| Ikarus | Backdoor.Win32.Androm |
| Invincea | Mal/Generic-R + Troj/Agent-ADVQ |
| Jiangmin | Trojan/Bublik.gey |
| K7AntiVirus | Trojan-Downloader ( 00457c511 ) |
| K7GW | Trojan-Downloader ( 00457c511 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| Lionic | Trojan.Win32.Generic.lNlt |
| MAX | malware (ai score=85) |
| Malwarebytes | Trojan.Email.FA |
| McAfee | PWSZbot-FFA!B989F17138C1 |
| MicroWorld-eScan | Gen:Variant.Razy.727641 |
| Microsoft | TrojanDownloader:Win32/Upatre |
| NANO-Antivirus | Trojan.Win32.DownLoad3.cjbvxe |
| Paloalto | generic.ml |
| Panda | Trj/Tepfer.B |
| Qihoo-360 | Generic/HEUR/QVM19.1.4F77.Malware.Gen |
| Rising | Trojan.Kryptik!1.C070 (CLASSIC) |
| SUPERAntiSpyware | Trojan.Agent/Gen-Upatre |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/Agent-ADVQ |
连接到不再响应请求的 IP 地址（合法服务通常会保持运行）
(2 个事件)
| dead_host | 54.209.32.212:443 |
| dead_host | 52.71.57.184:443 |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2013-09-30 20:47:01
PE Imphash
d91a0778a77c133468d4cb3a15c1fa92
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| UPX0 | 0x00001000 | 0x00008000 | 0x00005800 | 4.167495769824498 |
| UPX1 | 0x00009000 | 0x00003000 | 0x00002800 | 5.169652986195809 |
| .rsrc | 0x0000c000 | 0x00003000 | 0x00002a00 | 5.412790753446936 |
| .imports | 0x0000f000 | 0x00001000 | 0x00000400 | 3.324441959170754 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x0000c0ec | 0x000025a8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x0000e698 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_MANIFEST | 0x0000e6b0 | 0x0000015a | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library KERNEL32.DLL:
• 0x40400c GetLastError
• 0x404010 lstrcpyA
• 0x404014 GetModuleHandleA
• 0x404018 GetCommandLineA
• 0x40401c FindFirstFileA
• 0x404020 FindClose
• 0x404024 FindNextFileA
• 0x404028 GetCurrentProcessId
• 0x40402c GetCurrentProcess
• 0x404030 GetSystemTimeAsFileTime
• 0x404034 GetComputerNameA
• 0x404038 CreateFileA
Library user32.dll:
• 0x404040 GetMessageA
• 0x404044 PostQuitMessage
• 0x404048 GetClientRect
• 0x40404c UpdateWindow
• 0x404050 EndPaint
• 0x404054 DrawTextA
• 0x404058 DispatchMessageA
• 0x40405c BeginPaint
• 0x404060 TranslateMessage
• 0x404064 MoveWindow
• 0x404068 CreateWindowExA
• 0x40406c RegisterClassExA
• 0x404070 DefWindowProcA
• 0x404074 MessageBoxA
• 0x404078 SendMessageA
• 0x40407c LoadIconA
• 0x404080 DestroyWindow
• 0x404084 LoadCursorA
• 0x404088 ShowWindow
• 0x40408c GetWindowRect
L!This program cannot be run in DOS mode.
.imports
y@x%@h
)x@h@%
=taf l
crnAon
;]x@h@%
\h^aZtW
%hE|be%
haah %
c7kQ`l%
%%,6jnj
%hb' 9eh
$2b%'e7Kh%
%hvc@!%
hBokd0
b)f =q
cc3bh%
%_b (aeI%
GTI#lh%
hp!@M'BkW
hRvl'ke
%>- 1Zh%
%h$ S)Z- JA%
h{4 3|
2i&XU%h
eLgp`!
P#- x%
Ua; T%
XT$N[$
%h!ha%
-Px-NB
h4-$TaN
%bjew%
+|0Yns%
hDPI.blb%
%8 gzJ#
0s"Y:%
ns:.Yc'Mh%
%hWm$%
41 y%h
h!-gb%
@Xaah,iE%h
h$g(Z
%$&%lmY%
d$N-%h%
%h,4a]'5H%
miA'e7
hCk4!%
Bux?!%
%3 5N7
b%c-ersh%
eYBf$!
%hDqfy-%
, nh8%
h*`e5q%
biMe=e%
&a`0R-
Y(aaA3%
h)dg]4
+f,gh%
nluVh%
%hfe'%
(ae($mc%h
oae7#%
O!gfv%
%aY,bf%
%h6{}d"#5u)%
3&`=aSZ
h Ibei
%oU0( %
N'ScU;
A+%0h%
%h p7,
ae.J%h
a)#+a,6
h%sch=%
hMoqshw
!hda{k
% "hak%
g,NhqQTd
ektr%x@@h
fd(mnrn"!h %
h@@xIreU
+u]UuM
GFu;uu_+
.G|h
x@@(*i
-t@x%@h
2saau}
h@ca )Ssup
t"VP =
ulWnh%@
x@leee#h
S#no @
FGIu5P@
FFFF=xQ@
@;sy;s
FGIu=xQ@
2x@h@%
:Ht `2n
!2=%x@@h
xhlom!hp2mr
x@shleL#
BrTit)
x@x@h@%
h%x@@h
h@@xh%x@
hGhw5(Q@
bE.. 2m
x@lEV|1aW
0\IrVW
u x@h@%
d@h%xh
h0+ea" "l
io@mtF
uV 0"CwuW
h@xPu
@hCVEAH
ptE<l<x]@x%@h
x@ bi>l
Ux@h@%
j2hFP@
EM+PEM+X+j3j
3u;3@@@@
GGGGBBBBIuj4j
BBBBR5
BBBBRV
GV+=|Q@
QRRh|Q@
/"id%x@@h
h@@xRre
njXVh%@
@%qwLl3e
ElEH"P38aN
x@@fRX
V@x%@hU
E;Es%N
plumbum
second
megafit
ad.org
static
button
-AF7h:Bvak4(
j*aE &
#HbiKd
?mnT)#(h%
h794Ma
heSAi%
h=Tr7#
GetLastError
lstrcpyA
GetModuleHandleA
GetCommandLineA
FindFirstFileA
FindClose
FindNextFileA
GetCurrentProcessId
GetCurrentProcess
GetSystemTimeAsFileTime
GetComputerNameA
CreateFileA
DeleteObject
CreateFontIndirectA
GetMessageA
PostQuitMessage
GetClientRect
UpdateWindow
EndPaint
DrawTextA
DispatchMessageA
BeginPaint
TranslateMessage
MoveWindow
CreateWindowExA
RegisterClassExA
DefWindowProcA
MessageBoxA
SendMessageA
LoadIconA
DestroyWindow
LoadCursorA
ShowWindow
GetWindowRect
`.rdata
@.data
W#aK;opt|6li1m
pTD5a5
HhxCh)|hgFh(3{-0_
R<Ou"LOGwa0%d
LU`o~@
bE.. 2
Cyl[}t
?Oo'Qa;1qE
~ZwtotE0#1
x7NXGn
Hlm-`0w1
"_i3`j
/NQ;F=
}0+ea"xv"3
LiojHDmt|n
V 0"CwW
XXjW5IZ
y(7wdXD
UEX+({
qPu.vN
LI'EP[
CVEAHDPPSe
PKBo_zp,
/e'<l<x]
Blgv&
ueE~!c|\1F
uN? EMh6iP
;f,E#;
Brj4eC
7j4ugTb
pW555u~
S5P]R/#
d;76uUu7lblq2x
i#QTb'
YvX f\
vKHj@;
%DJ_>8~uph609r7{4
DYL8uM9
<Z@Qt:h
=7[GV=|
o{QRRh
7A+TN[
o1/"id
r2p,.!
y%D/+Rre;<Ee
$8)t'*jTrjXVo B |i
'rmyo!G9
see}4,
2$uqwE}Ll3?,o
,mH'38aN~
xk?fRX'"E
GQfMZ
uu~ Fu}
vf_^[n
"$r5p(
~kinXD*
iini`N:(
Ar]ial
ad.org
tatied-
y!x%mini;CB^+ D
Cd2L&&dd2LL&P
-AF7h:Bvak4(
j*aE &
Iw*&a?r
s3ab5'
#HbiKdkJg(
-4e'?b-!
?mnT)#(
,3Q??,c
5]04!?
k794Ma
q#]Lu[
<'eSAi
hQ=Tr7##
0y$TA`
GetLastErrorl
rcpyA?k
ModuleHand
:uaentPfcessId
SyOemTimam7s=
krNamRC8a
#Object
o7H+@MuagNl
qli]XRJUpdWow
DrawTBD}isp#chTBeg$(!{
TnslCa^llvP
Ex:{msMRsa.
SdwLoadIc
<ji[@.&'J
XPTPSWXaD$j
.F;, {s
.LB/#PD
;1TLxrK@
C9$!lc
F=_We]
.0&2-&!!
.-#<50-
VPVOUOUNUOUOUNUOVOUOVOVOUOVOVP\U_XXQUOVP[UD@
I?qj.#
G<4(kb
xxxtttttt
ODj_[P
MCVK/!,
- - - - - - #
. , - - ,
- / / / / / / %
PCbW`TI<
0!/ / . 3%
/ 1"1"1"1"1"1"0 4%K>REF91!6(K>PC>0/ / 9+M@THH:2#0!1"1"1"0!5'
1"1!1!1!1!1!1!4$2"+
3#4$0 +
3#3#3#3#3#2#7(!
4$F8F8F8F8F8F8>.@1A2B3B3A2A2B3B3B3A3A2B3B3B3B3A2A2A2A2A2@1H9!
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
gdi32.dll
KERNEL32.DLL
user32.dll
DeleteObject
ExitProcess
GetProcAddress
LoadLibraryA
VirtualProtect
EndPaint
KERNEL32.DLL
GetLastError
lstrcpyA
GetModuleHandleA
GetCommandLineA
FindFirstFileA
FindClose
FindNextFileA
GetCurrentProcessId
GetCurrentProcess
GetSystemTimeAsFileTime
GetComputerNameA
CreateFileA
gdi32.dll
DeleteObject
CreateFontIndirectA
user32.dll
GetMessageA
PostQuitMessage
GetClientRect
UpdateWindow
EndPaint
DrawTextA
DispatchMessageA
BeginPaint
TranslateMessage
MoveWindow
CreateWindowExA
RegisterClassExA
DefWindowProcA
MessageBoxA
SendMessageA
LoadIconA
DestroyWindow
LoadCursorA
ShowWindow
GetWindowRect
C : \ U s e r s \ d r t i e t . X P S 4 2 0 - P C \ D e s k t o p \ D o c u m e n t s _ 0 9 3 0 2 0 1 3 . e x e
C : \ K p T I 4 j T w . e x e
C : \ x A u b e 3 S m . e x e
C : \ a 5 2 8 b 7 e a 3 9 0 b 4 c 9 1 7 4 2 a b e e 8 5 c c 0 a d f 3 5 8 0 b 9 6 8 9 e f 9 b f f 0 8 e 1 9 7 e 2 c 3 f 9 3 c 3 c 6 b
C : \ 0 e c 4 5 8 c 5 2 a 1 6 2 4 a 0 6 1 0 0 9 f c 5 3 a 0 7 8 2 3 f f 5 9 3 6 e 4 9 0 e 3 1 c 0 0 1 8 0 8 f b 8 e 7 5 6 a f 4 e 3 c
C : \ 2 0 4 9 6 e 8 0 7 5 d 2 1 2 f 4 9 3 2 3 d 5 a d 6 f 9 9 3 3 2 5 2 d f 3 4 6 3 7 c 1 0 7 8 b 9 3 1 4 9 4 d 2 1 c 4 d c 0 3 0 e 8
C : \ 8 a 8 c d b 7 a 2 0 3 9 9 d c c 0 7 0 a 1 c b 2 1 c b 2 a b 0 a d e 7 6 8 b f 6 d f d 8 b a c e d 2 8 d b b 7 5 c 9 7 7 4 5 d 9
C : \ 6 a 0 7 5 f 1 0 6 0 e a c 1 5 7 c 3 a 9 e f 3 e d b b 5 1 0 2 2 2 3 d 6 a 1 d 6 3 3 2 5 e 5 e d c 6 2 9 8 f 0 2 d 0 8 e e 6 1 7
C : \ j G w j V p v f . e x e
C : \ H q D A a 9 c k . e x e
C : \ 4 s V x 0 v 9 F . e x e
C : \ d x H r x m 1 P . e x e
C : \ F f W h g _ e a . e x e
C : \ 4 9 t I A v M C . e x e
C : \ 7 p D n U V S L . e x e
C : \ R 2 r t b l H i . e x e
C : \ 4 W P i 4 L H U . e x e
C : \ 2 7 x _ g B z f . e x e
C : \ M 0 2 N 4 R D o . e x e
C : \ 1 n 1 i M Y N g . e x e
C : \ H v o 3 h R s r . e x e
C : \ X 2 A 7 v 5 0 X . e x e
C : \ i t n 4 Z B b W . e x e
C : \ 1 a p u a 4 a y . e x e
C : \ l h J h R H U 6 . e x e
C : \ i s i z I q s K . e x e
C : \ d d 4 1 2 a 9 8 e 6 c b c f f e 5 4 1 7 7 8 4 a f 8 e a c 9 9 4 4 c f 7 c 9 5 f 9 c 3 4 a f d d 8 c c a 7 9 9 2 3 6 0 b 4 7 a a
C : \ 3 4 d 2 d 6 0 9 c 9 a 4 6 f 4 2 3 8 4 c 3 f 2 6 e c 8 0 2 0 1 f a f 6 c 9 d b 5 2 a 9 8 8 5 d 8 3 b e a 4 f 3 7 8 2 1 8 5 0 8 4
C : \ I 0 0 3 e f o b . e x e
C : \ U j K h R Q l D . e x e
C : \ s u 8 7 y l Z Y . e x e
C : \ L 0 W B U G R y . e x e
C : \ t T 4 s v P k j . e x e
C : \ 1 8 b c 2 7 f 9 1 e 2 a e 8 3 c 8 5 a 9 e a 6 5 a c 1 1 e e 9 d 9 a 6 3 0 9 f 9 e e 5 2 a d 1 f b 6 9 6 a e d 5 7 7 8 1 9 1 8 4
C : \ 0 2 3 1 3 e a 6 f 0 0 d 3 8 e c 2 3 1 f a 9 d 6 7 6 8 c d c b 1 f d 9 6 2 a d 3 c f 8 c 9 3 d 8 3 c 1 a 2 9 c e 0 2 9 7 a 4 8 e
C : \ 7 c e 0 0 4 1 a 9 9 a 6 4 f 7 9 d 8 e f f 4 a e 8 8 c a 8 d d 7 a 9 c c 5 5 b 7 e 9 9 3 b 8 7 2 6 e b 5 9 6 2 3 f 4 0 7 6 9 2 8
C : \ z a W F o k W c . e x e
C : \ p S U q _ l P I . e x e
C : \ 7 x X k F A f p . e x e
C : \ 3 6 Q e 1 A t 8 . e x e
C : \ h 0 X O e D v E . e x e
C : \ p E S d 6 h M 3 . e x e
C : \ 5 d c a 0 3 d 4 5 0 c 2 3 c 4 3 3 7 b f 8 0 9 b d b f 5 d f 7 8 4 c 9 8 d 0 9 6 4 f 5 2 7 2 3 b c 8 5 c f 4 f f c 4 7 d 6 b e 3
C : \ U s e r s \ L i s a \ D e s k t o p \ q u X T f w Q L . e x e
C : \ 8 d 1 6 4 d f 2 c 8 a 4 f f e c 9 f 7 d c 1 5 a 9 d 2 6 0 9 9 6 a 4 d 0 1 0 2 9 2 1 0 b 9 a 4 1 b b 7 d 9 0 b 2 0 0 4 3 9 5 4 6
C : \ e 5 2 e e 7 4 1 b d 0 3 c 7 7 9 9 4 9 3 2 5 4 e 1 c c d 7 1 c 9 1 e 8 7 7 2 7 f e b 3 3 f 9 8 9 b b 4 d 6 e c 9 6 b 4 9 9 e b d
C : \ U s e r s \ L i s a \ D e s k t o p \ x y B W 5 a q n . e x e
C : \ U s e r s \ J o h n n y C a g e \ D e s k t o p \ p 4 x h t 3 3 6 3 S . e x e
C : \ p s w m d W 9 3 . e x e
C : \ 4 d 0 4 d f d b f 1 a 6 3 3 0 9 3 0 b 2 0 d f 5 2 c b b 9 8 2 7 d a b 5 0 b 4 3 1 1 4 c 1 d f e 9 5 9 5 1 b 6 8 f a 3 c f 0 a 4
C : \ a Z 7 w l H X e . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ G K q s l L m O . e x e
C : \ 0 d 5 e 6 8 1 1 f 5 f b 8 e 0 b a c 2 d d 7 3 1 1 1 0 c 8 3 b e f 5 4 8 c c 5 2 c 8 1 9 a 5 5 9 f 8 d 1 d 2 b c e 1 9 c c d 7 f
C : \ v W _ E C 3 i I . e x e
C : \ 6 0 a 4 1 9 3 9 9 6 c 8 4 6 2 b 9 c 4 d c 1 8 8 c b b 9 d e 3 4 4 0 e 8 4 a 3 1 0 a a c c 9 3 3 0 6 4 a 3 9 f b 4 2 7 4 2 e a 3
C : \ U s e r s \ L i s a \ D e s k t o p \ U R T A w u 6 B . e x e
C : \ Y C D y B w b z . e x e
C : \ 3 3 f b c d 4 d a 2 d 3 9 f 2 0 8 a 6 d c b 3 6 f 0 b 4 7 f 2 9 5 0 e 6 d 4 8 7 7 8 a d 4 3 4 1 0 8 b f 0 e 4 9 6 9 b e e e b 8
C : \ 8 a a f d 9 e d d 6 8 0 f d 1 c 5 f b b b 0 3 a 1 9 0 e 6 2 4 b 7 3 d c e 8 6 7 7 7 7 a 9 2 2 a 7 e 8 5 d 4 8 d e 3 8 7 a 1 b 8
C : \ 7 b 4 d a 7 e 2 3 c 0 d 4 2 e 7 3 8 6 1 4 4 8 2 2 d c 6 e 0 c d 8 f 8 b 7 7 5 5 a c 6 5 a 1 4 d a c c 7 a 4 7 1 4 b 7 7 f 2 7 9
C : \ U s e r s \ L i s a \ D e s k t o p \ c g U 1 d M 1 C . e x e
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ f 1 0 4 c 0 4 6 f 8 0 9 7 4 9 9 1 b 0 3 0 d 0 1 2 6 c f f b 3 e d 5 4 8 b b 1 6 7 7 9 4 5 7 c 5 7 8 4 e f 4 9 5 7 1 b 5 f 8 c c . e x e
C : \ 2 2 3 e c 0 7 d 2 b 1 4 1 6 9 8 1 b 1 c 3 0 3 8 1 2 9 f f c e 2 8 2 b 7 8 e f 5 4 3 1 7 1 6 a b f 6 8 8 c 8 4 e 0 7 3 d 0 c 6 7
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ a t j k b u 0 m . e x e
C : \ L s 7 l R n 3 l . e x e
C : \ c 4 d 3 c e 9 6 9 d 3 4 0 0 1 9 3 d b c e c d b 6 f a 3 6 f d 0 e 1 e c e 5 3 d 9 7 8 d 8 d e 0 8 8 8 9 b b 2 d 0 2 7 c 5 2 0 f
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ o Q h T l l R n . e x e
C : \ c 6 4 1 d 3 1 4 8 5 6 5 4 a e d 5 6 7 b 5 c e a 5 1 f 0 5 c 7 9 5 d 1 a e e 9 9 7 a 0 f 3 1 9 d 4 9 f 7 d e c a 0 0 1 7 b 4 6 8
C : \ 2 b 6 6 e f c e 7 7 4 2 d 4 7 8 d a 3 c 8 2 c 8 c 5 0 4 a c b 4 0 8 6 8 6 1 0 d f 1 d e 1 1 f 8 5 8 f 3 1 0 f 1 0 e a 5 0 5 f 2
C : \ b c 1 e 3 c 4 0 3 2 f 2 a d 0 d 7 5 4 d c 2 e 1 7 d 5 2 e d e f 4 f e 4 5 a f d 8 1 4 6 1 5 e 9 9 e e c d 3 9 d 9 d 5 0 a a 2 b
C : \ U b h x N Y R 4 . e x e
C : \ 3 2 3 9 9 e 3 b 9 6 6 3 2 2 4 a 1 e 9 f 2 2 d 1 a 6 3 0 0 1 3 5 e 5 3 1 c 5 2 0 8 b 2 d b a c 4 f 2 5 f a a 6 8 5 0 5 4 a a 2 5
C : \ 7 3 a 7 3 1 0 d d 1 e 2 a c 1 c d 6 a e e d 0 e c d 3 6 0 7 c 3 5 f a a 7 f 7 9 9 b 1 c 4 2 f 0 8 5 9 0 1 9 9 0 7 8 9 3 1 8 8 c
C : \ U s e r s \ L i s a \ D e s k t o p \ D g v y u 2 3 R . e x e
C : \ c m p u R 7 G 3 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ J I 2 h P 8 8 8 . e x e
C : \ 5 d f d c a c a 7 5 7 8 5 d d 1 1 4 6 8 1 c e 0 0 e 5 6 d f 9 e a 1 2 d 0 c 7 6 3 b 9 e 9 9 9 e 8 3 1 0 b 9 4 9 6 2 8 8 a 9 9 5
C : \ U s e r s \ L i s a \ D e s k t o p \ L D o R 7 n m H . e x e
C : \ 5 b 0 6 c e 2 d 5 5 1 7 2 0 d 0 7 e 8 2 1 9 c 0 4 1 c 3 c 1 4 5 c e c e 2 1 2 d 8 1 2 0 9 6 5 0 e b f e c 1 e 8 a 6 f 6 5 4 9 0
C : \ U s e r s \ L i s a \ D e s k t o p \ i 3 X Y s r H V . e x e
C : \ F 6 j 3 0 c Y 3 . e x e
C : \ 7 b 9 d 6 c b 8 1 7 c 9 1 0 2 4 5 5 8 c 7 f a f 6 c 5 8 8 8 f 2 c 0 8 a b 0 7 2 8 8 3 8 4 0 4 3 f 6 c 7 b 7 9 9 6 6 b a 1 8 e 4
c : \ t a s k \ D 9 5 3 C 9 2 4 4 3 4 A B E D 2 2 4 B 6 2 F 1 6 B C 3 C D D 9 A . e x e
C : \ 5 4 6 1 3 0 e 0 c 5 0 5 b 0 d 0 c a d 8 e 1 3 8 e 7 1 3 5 6 3 6 a 0 d 1 6 4 5 f a c 1 9 2 7 e c 6 4 9 7 2 c d 5 c a f 4 6 d 6 b
C : \ 4 0 5 0 2 0 c 9 4 6 e 7 5 b d 8 d 1 2 a 8 1 b e e a c 5 3 5 5 8 8 6 9 5 a 8 e 6 7 7 0 3 d d 4 6 2 e 0 a b 4 3 f 7 e 6 5 e e a d
C : \ _ r y x Q D m R . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ d 5 e 5 0 3 e f 0 b c 0 e 6 2 5 f 6 a e 4 7 f 3 8 0 e d 7 c c b c 8 3 d 9 9 9 2 c a 9 c d 0 d e 5 7 c 0 2 3 1 1 4 4 2 9 0 0 4 a
C : \ 8 2 e e 9 b 8 5 0 5 1 8 1 6 a 4 5 5 c b 1 c 9 5 a 4 a 4 d 1 6 5 1 0 4 e 1 8 7 0 3 e b d 8 2 e 5 b d 6 7 9 d 1 c 0 a 1 e c e 4 4
C : \ d 1 a 3 6 2 4 6 d 9 5 a 1 2 7 5 0 e c 2 8 1 5 8 2 d 4 f d e f a b 9 6 5 0 f 1 d a 5 b b 8 a f b c 3 b 6 8 3 b 3 3 1 4 4 8 4 2 1
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ g 7 2 v J W z A . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ 6 9 5 4 5 7 e b 9 4 1 d 2 7 a 1 7 9 1 e 4 b 6 6 d 7 9 f 0 f 0 d 3 2 7 9 4 0 d 3 7 6 9 b 5 7 0 2 4 7 5 4 5 0 3 9 f b 2 f 2 b 1 0
C : \ 4 e d 4 b a 2 d a 2 e 5 1 b 4 0 1 b d 7 9 d d e e d 2 9 1 1 7 9 9 9 5 4 d a 0 b 6 8 0 9 c 6 f c e c c 9 f 1 f 4 8 2 5 2 3 b 3 c
C : \ 8 4 3 2 b 0 1 0 8 6 f 4 d 0 b f b c 8 3 0 0 4 6 f 3 a 7 5 a f 3 c 3 d e f 2 9 2 d 6 0 9 e 3 b a 4 f 0 0 e e 7 2 8 7 6 4 5 8 6 d
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w e y j b a . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ 3 3 1 f 6 c a b a 4 a 3 c f 1 1 7 e 7 a 4 d 5 e 2 a 6 f 4 0 1 c f a 7 6 7 0 8 9 6 d d 8 3 4 b 9 6 c b 5 0 5 e 6 8 9 1 6 d 4 8 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ f J v U e z q 9 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ N w m S U i 9 z . e x e
C : \ I K 6 s 2 z z L . e x e
C : \ 9 7 b 4 9 f 8 f 3 0 a 1 9 7 8 4 f 3 e d e 7 5 a f 5 8 d d e 3 e e c 0 8 f 3 8 8 b c 7 4 1 f 0 c a 2 9 9 c b 8 3 1 c e 7 c 7 4 8
C : \ 2 e 1 5 5 f b e d f 2 3 1 7 4 8 6 4 4 b c 3 2 0 2 8 4 1 1 a 1 6 0 b 1 8 c 8 0 f 9 f 0 6 1 9 4 c f 4 9 5 e 4 2 9 e 4 b 1 a 9 9 c
C : \ U s e r s \ L i s a \ D e s k t o p \ e 2 f 3 7 U h 9 . e x e
C : \ 7 4 9 3 b e 8 0 8 5 c 7 1 1 a 5 5 4 6 1 7 d b 8 9 1 b a 0 e 2 a f 4 c 2 2 6 3 8 4 b 1 8 f d 4 9 4 a d d 6 6 5 a c 1 6 b 1 e e 3
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w e y j b a . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 4 3 f 2 2 e 4 4 3 e b c b 6 b a _ w e y j b a . e x e
C : \ 4 4 5 6 3 2 1 d e e 5 b 2 9 b d 1 d f c d 5 2 2 6 c 8 d e 6 1 0 9 b 4 a a 3 9 6 3 2 4 d 0 0 f c e 1 8 7 3 4 c 3 6 e e d e 0 9 a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w e y j b a . e x e
C : \ 9 8 d c c 0 2 d 1 d c f 6 f b 1 7 6 5 5 6 f 3 1 f 9 3 6 d 4 3 5 9 b 0 1 a 3 7 8 3 c 7 8 c 0 b 7 3 0 4 3 5 7 f 3 f e 0 f b 2 9 b
C : \ 0 d b 7 4 0 6 0 3 c d 2 4 b 5 2 d 7 f 1 d d d 3 c 1 8 e f 2 0 5 1 c b 9 6 c 1 2 a 9 e 0 e 3 a e b e 1 b e a c 8 1 b 1 7 2 9 b 7
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ G N d U f T C E . e x e
C : \ f f 9 1 9 1 b c 4 b e 4 a 2 2 c 8 1 0 a 8 d e 3 e 2 8 d e f 3 1 4 4 6 e e 4 4 1 c 7 2 b 3 8 a b 1 0 1 1 5 0 c f c a f 7 d 1 6 6
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 4 P h t O v 8 j . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 9 b c 7 6 c a e c 6 1 e 0 1 5 6 4 3 b 2 4 1 2 e 3 7 e c 8 b 3 c 5 d f a f e 9 0 d d 4 2 e a 3 3 4 4 7 b 7 b c 1 a 0 2 9 c c e c . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w e y j b a . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w e y j b a . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 8 f 7 1 e 8 b 6 1 5 c 1 b 7 3 d _ w e y j b a . e x e
C : \ 4 2 5 3 4 6 b f 8 c 5 9 b f 8 e 4 d 6 f 4 7 4 1 f d b 0 1 b 6 9 8 d 8 e 5 a 1 6 d 5 1 4 7 5 5 e c a 0 e 1 b d 9 e c d 2 c c c d
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ x S k 8 p 9 M O . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b d a 7 8 9 2 4 a d 5 6 d f 5 2 a 2 1 4 d b 1 e 6 e 4 4 1 8 5 9 9 6 2 2 7 a f f b 7 e e b 4 7 5 a 7 5 5 5 7 8 4 5 8 b 9 b 9 a d . e x e
C : \ 3 b a e 8 b d 2 1 8 f b 9 b 7 3 8 a 6 a 1 4 4 f 9 c d 7 7 0 e 4 4 c 5 0 e 4 4 4 9 3 2 2 1 4 a 0 c e 9 4 2 c d 5 3 3 f e e a c b
C : \ e 3 5 8 f 9 2 8 3 a 0 5 f b a a 9 2 5 9 b a c a 4 7 0 0 0 3 6 d f f d 8 0 2 e 8 d d 3 1 2 8 f 5 5 2 9 f 3 d c 0 3 1 7 3 f e 9 a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w e y j b a . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ l c J X K S e I . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 1 5 5 7 e f b e 3 a 5 3 f c 4 2 8 d 6 7 9 5 1 6 3 c 6 f 3 7 0 0 e 9 d 4 1 e 3 a 0 2 f d f 8 d b 2 e d 2 8 f 5 b d f 9 1 2 6 e 6 . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ U w 6 m w k Z N . e x e
C : \ 5 e e a 4 b 4 6 a 4 e 8 6 6 6 3 e 0 c 1 0 b 8 1 4 8 9 7 a f 6 1 a d c b d c 6 0 b d 1 d 6 6 7 8 4 1 d 4 f 9 2 d f f 2 c 0 2 b b
C : \ e a c 7 c 8 9 e 4 2 8 2 6 2 5 4 6 3 3 1 2 2 b a e 6 e c 7 7 a 2 3 b 6 b b 0 7 2 4 f 8 5 7 f a e 1 f d 8 2 d 8 3 3 3 5 0 c 8 f 5
C : \ 3 3 c 3 e 5 e 1 c f 9 3 7 2 6 9 5 c 9 4 d e 4 2 9 8 c a b 9 d 2 d 2 7 c e b c 7 7 6 c d 8 4 e 8 3 7 b f 1 e d 4 9 4 6 b 6 1 2 d
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ P g V X P Y Y X . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 8 7 c 5 b 1 a 2 7 6 4 8 c b 6 f e c 3 e 7 5 b 1 1 9 6 b 0 e 8 2 e 0 7 4 7 a 4 c 5 7 9 1 2 5 6 f d 4 c f b 4 e e c 5 0 f 3 0 e a . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ X U w i H h S H . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 1 1 6 d 0 1 e 9 9 7 2 e a e 3 1 c 6 4 a a 7 9 e a c c 9 7 2 1 6 f 9 9 a 8 2 4 7 7 f 8 a 0 d f 4 8 a 1 0 8 e f 0 e 3 3 2 5 2 8 . e x e
C : \ c 9 b 8 6 d 2 8 0 a 9 0 f 4 1 a 8 2 9 6 e 4 e e 7 3 f e 0 1 9 4 9 7 4 6 9 2 d d a d 2 f f a 4 9 2 5 4 e 5 a 6 c 6 2 c a 0 f d 3
C : \ 7 c 3 0 6 4 d 1 f 8 4 6 6 d e 0 a 2 6 7 1 d b 8 3 a f 2 a 5 e 6 6 b e f 2 8 0 f f 4 0 3 3 a 4 b a 2 b 2 0 f 2 8 6 2 8 a f a 2 8
C : \ 3 b 3 7 7 0 f a b 2 7 5 f e d 4 d d 0 7 c e e b d 4 1 0 9 7 7 8 b 7 7 e 8 0 f 5 f 1 f e 4 5 9 b b e 8 d 9 0 a 5 2 8 8 9 0 5 3 a
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w e y j b a . p e 3 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 0 W M H C A 9 L . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 1 d 1 8 f f 3 9 0 a f 0 b 5 d d 4 a 9 f d 9 c 2 2 5 8 6 e 9 2 e 4 b 8 4 5 1 4 1 7 e 8 8 a 3 7 1 0 8 9 a 6 9 8 3 f d a d a b 8 d . e x e
C : \ 6 4 3 4 7 d 4 6 d a a 9 d 8 0 3 1 8 5 f 8 9 d a 0 0 5 c c 6 e 2 0 1 8 6 b d 6 e 5 4 f f c 2 b a 2 a 7 5 3 8 8 1 8 d f e 0 2 f 3
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 0 3 5 7 d d 6 d b 4 3 e 7 4 0 b 9 f 7 9 1 0 1 8 2 f 9 7 0 d 2 2 f 8 1 1 c 2 f 4 e 7 9 4 d 3 e d e 3 4 2 2 7 0 3 4 2 9 9 0 0 8 6 . e x e
C : \ 5 6 2 3 8 1 d 6 c b b 0 1 6 b 4 c 7 9 d 5 2 8 4 c e a 2 f f b 7 4 6 2 8 4 1 b 0 8 0 c f 3 0 3 8 2 6 c 4 9 3 8 8 e e f e a 8 3 4
C : \ 1 c 3 d c 5 b 5 1 4 2 b 5 8 d 2 f e 3 5 f 4 5 d c e b 2 0 a 0 2 e 9 3 d 4 8 5 8 b 3 9 a 8 6 9 4 f 1 d 4 e 9 9 3 8 a f 5 4 4 e a
C : \ 1 b 3 c 6 2 c b a 8 a 7 d 7 c 9 b 6 1 0 4 0 8 5 3 d 5 8 2 7 6 d 7 8 2 a 3 7 5 1 9 a 0 7 5 a e b a d c 1 5 6 4 8 e b d e 3 4 c 0
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ a 6 3 B o H Z R . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ 8 9 3 e 9 c e 4 6 d c 3 1 e f 1 4 6 0 7 2 0 a f 0 f 2 7 e 1 f 1 6 c f 2 a d c f 2 4 6 d 2 9 9 1 7 a 6 6 6 9 8 2 e 0 0 6 1 b 7 4
C : \ a 6 d 7 4 a 3 d b 9 b 0 5 4 c 0 c 4 8 8 5 7 5 5 c 0 2 c 4 0 0 5 9 2 d b 0 3 7 6 7 d 8 1 b 3 b b 3 e 9 7 5 b e 7 6 1 b a 5 c 6 6
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ l I a 6 n A T v . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 7 f f 4 b 0 f 9 e d 8 b 0 2 0 1 c f 1 8 5 3 8 4 2 2 5 6 e e c 7 7 0 2 9 a 5 0 9 e 5 1 2 3 0 a 3 a b 9 6 f 6 4 5 9 e c 2 3 7 4 . e x e
C : \ d 9 e 3 2 8 1 5 9 b 8 9 7 5 0 8 b 0 1 0 1 9 f d b d 6 7 d d 4 c 1 5 0 d 5 b 8 0 7 5 c 3 b d 4 f d b b 4 b 6 5 e e 7 5 0 2 f 9 4
C : \ 0 2 c d e 2 3 6 8 5 0 7 f c 6 0 9 8 6 c 9 5 f 7 9 f 6 e b 2 c 7 5 9 0 d f a a 2 d 3 d e 2 d 5 e d d 7 2 e d 1 9 8 1 9 c 7 1 7 b
C : \ 7 d 5 7 2 8 b 6 f e 3 3 2 7 4 9 7 0 c 7 5 2 f d c 7 3 3 4 f 3 e 7 5 f f 5 1 2 1 3 1 c 1 3 6 4 d 2 0 c a 1 f e 8 6 f 6 1 8 d 5 9
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w e y j b a . p e 3 2
C : \ 9 8 a b 8 8 c 7 8 5 9 e 0 1 8 b a e 9 1 c d e 6 5 8 2 9 5 7 1 5 e c 1 c 4 d 6 0 4 f e 3 3 1 0 3 2 c 5 3 7 5 1 2 b 8 1 f a d 8 b
C : \ 7 9 7 c 3 b 7 f 4 b 7 f f 5 3 3 b d 1 e e 0 4 b f b 5 a 6 1 1 5 2 2 d 3 0 a 9 8 5 c 8 1 3 6 6 a 5 8 b 6 4 7 b a 4 7 2 6 9 2 0 0
C : \ 5 e 2 a a c 7 2 3 c 9 0 d a 0 3 f b f c 4 3 c d 9 8 4 e f d e c d 4 d 7 1 d e 6 2 9 8 e 8 4 0 1 9 1 8 a d e 2 f 6 5 5 1 3 9 f 9
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ R h V o k 7 P a . e x e
C : \ 1 0 3 7 2 7 6 8 b 7 a c 4 5 f d 4 8 7 2 4 e 9 c 4 0 0 b a 2 c 9 5 5 2 a 7 7 5 b d 6 c d 7 f 9 d 5 5 f c c 6 5 f 3 a 8 0 f 7 7 5
C : \ b e 4 7 5 e 6 4 c 4 f d 7 5 4 1 a 7 c 5 0 3 3 4 6 f e 9 f 5 1 d 9 b b f b 5 f e 1 0 0 c 5 6 9 b b 6 7 8 3 5 5 7 3 6 d 4 7 a 4 7
C : \ D o c u m e n t s a n d S e t t i n g s \ W i l b e r t \ L o c a l S e t t i n g s \ T e m p \ K W Z U 6 5 \ S T u i N j _ e f a 3 c a 2 7 d 2 0 0 6 d e e 4 3 d c 4 5 7 3 a d 6 f e 9 3 d 1 5 c d 1 c 2 2 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ W i l b e r t \ L o c a l S e t t i n g s \ T e m p \ K W Z U 6 5 \ w e y j b a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 3 e 5 d 5 d 5 e 3 9 a d 3 8 b 4 b c d 5 2 f 2 c f 8 0 6 6 c b 5 . v i r u s . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ s I q N G J n S . e x e
C : \ 1 4 b 9 4 3 7 5 6 6 e 9 7 0 8 c 1 c b 5 d 0 9 3 c 8 e 2 4 1 2 0 6 7 7 5 5 9 7 d 3 3 0 d 7 4 8 0 9 4 9 2 2 8 d c a 5 5 9 5 3 c 9
C : \ U s e r s \ R A 4 9 1 ~ 1 . V U L \ A p p D a t a \ L o c a l \ T e m p \ 1 3 6 3 a f 3 0 0 2 e 8 a d 2 c 0 0 b 6 1 d e 7 e 9 c 0 7 f 1 6 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w e y j b a . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w e y j b a . p e 3 2
C : \ U s e r s \ L i s a \ D e s k t o p \ G M q z T Q 0 v . e x e
C : \ 9 9 5 d 9 7 7 3 e 9 3 a 7 6 d 4 a 4 8 9 0 5 c d 9 1 7 7 f 4 8 f 3 8 d 8 4 1 e e f 4 0 b 2 3 6 f 9 5 e 1 2 9 d 0 f d 4 3 a 8 b b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w e y j b a . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w e y j b a . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b 3 2 2 9 0 2 2 b 6 6 d e 3 e 1 _ w e y j b a . e x e
C : \ F n R U e T _ X . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 0 8 6 5 d c 9 3 7 2 a 4 2 d c 2 7 6 0 f 3 9 2 0 1 0 5 5 a c 0 . v i r u s . e x e
C : \ 2 7 a 0 0 d 8 4 9 b e e 9 7 2 0 d 8 0 0 d 2 a 7 2 1 2 d f 6 a 0 c d 0 f e 5 d b c a 9 9 5 3 0 c 2 c 9 e 7 9 9 b 5 a 1 2 e 6 8 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w e y j b a . e x e
C : \ e 0 7 4 7 7 4 9 5 f 0 7 0 4 3 c e a 1 e a 8 5 1 c c 1 3 0 e 9 2 d 0 f f 5 3 a 6 0 a 6 c 9 6 1 d 7 d c 3 d 3 0 9 9 1 a f b 8 e b
C : \ d 2 9 6 d f 8 b 1 e a e d 9 3 8 3 b f 8 e e e 2 b 8 3 f 5 8 d 7 e 8 5 a 8 1 6 f b 1 2 6 9 5 f 7 0 b 1 4 e b e 2 6 0 5 a 1 f 8 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ J X 2 M P O 3 1 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 5 7 8 f 8 2 e d 2 6 4 d a c 6 4 c 5 7 8 6 0 7 2 c 3 f f 7 4 9 2 3 0 d 0 3 d c 4 8 4 1 a e 3 5 a a 5 c 4 4 3 7 d f 2 8 1 1 0 7 9 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ I C 1 T 8 3 G j . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 2 5 b b 5 a e 8 4 d 5 2 6 7 9 b 9 4 f 8 e d 6 5 1 5 8 0 9 7 b 8 c c b 7 d 8 5 9 1 2 9 1 b d 1 0 2 6 b 4 0 e d 5 4 f 6 3 6 e 4 5 . e x e
C : \ 0 e 5 0 4 7 9 0 4 2 e a 4 6 1 8 1 3 d 2 6 5 2 7 4 6 3 1 f 2 5 a f 5 2 5 8 c 1 a a 4 e 0 8 9 c 5 9 8 5 d f 7 0 9 a 0 c 8 f b e 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w e y j b a . e x e
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ c e 6 5 6 2 b 1 9 3 d f 7 4 e d 4 b 5 1 7 a c a 9 1 f 6 a 6 d 1 e 8 4 7 a 7 6 a b 5 e c b c 0 0 b 0 0 0 f 7 b 5 e a 9 a 6 e 2 b . e x e
C : \ 8 3 c a f 5 2 1 6 3 3 7 5 1 c 4 d 1 e 0 2 f a 9 a 4 2 0 b 9 2 9 a 0 e 0 5 6 b 1 6 4 9 6 9 9 9 c 4 8 a a e 1 4 5 a 5 d f d 1 4 e
C : \ U s e r s \ J a s o n \ A p p D a t a \ L o c a l \ T e m p \ d 3 a d c b 9 b a f d 0 a 6 4 a b 8 f 7 c b b 7 2 a 9 b 7 7 3 5 a 7 4 d d d f 2 . e x e
C : \ U s e r s \ a r y a \ A p p D a t a \ L o c a l \ T e m p \ c a e 8 1 2 8 2 9 f 8 3 8 6 5 3 2 e e d 2 1 1 c c 4 3 7 3 4 d 3 f 6 4 4 e 1 c f . e x e
C : \ 2 1 f 3 4 e 0 8 7 5 c 1 0 3 1 3 d b 1 9 0 d a d 7 c e 3 1 4 2 6 6 a 4 3 2 6 c 1 9 b 2 b 5 e d 6 0 a b c 6 1 b 2 3 c 5 b a b 0 9
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ w n z T L I z T . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 6 f b 6 7 5 d c 8 e a a 8 3 0 c 5 a 9 e 9 5 2 b a 7 4 d 2 d 6 f 0 e 7 f 6 1 3 f 8 0 d f 4 1 c 7 5 7 b c b 7 0 8 0 8 4 6 2 1 f 0 . e x e
C : \ 2 d 4 e f e 4 2 6 b c d 7 3 3 9 6 5 a f 5 e b 3 7 3 8 2 7 7 c 4 6 2 0 b b 1 e a 5 e 2 1 b 6 2 c 9 2 f 6 3 3 f 9 a 1 b 9 f 9 8 8
C : \ 6 1 a 4 e c 7 c f 2 4 4 d 9 6 0 9 a 1 2 9 6 1 5 8 3 a 4 c 0 e 2 f 5 0 e 0 3 3 3 9 2 2 9 5 a a 9 d e 8 6 3 6 1 0 2 1 5 5 e 0 b e
C : \ f 7 d 1 1 0 5 d 5 6 3 f 5 2 a 3 6 b a e d 0 e d 1 e b 1 b 9 2 8 6 d 9 e d e 2 e 3 b 8 3 c e f 0 b 4 5 a 0 4 d 6 9 a 5 2 5 9 d 8
C : \ a 8 6 9 e 7 9 8 7 e 2 9 9 d 9 0 c 9 5 8 c 2 6 6 3 2 a b 9 5 7 4 c 9 a b 5 b 3 0 0 b e d d 7 e 6 b a 2 c 0 c 1 2 e 8 2 4 5 0 c e
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 9 7 c 9 3 4 4 6 5 c 7 4 b 7 8 7 d 1 4 0 0 5 a c 3 9 3 b d 9 e 9 7 1 6 9 c 1 7 0 5 9 2 e 3 e 7 2 2 b 3 1 f 3 1 b a b b 9 5 7 4 8 . e x e
C : \ 9 7 3 b c a 4 b b 6 a 4 4 0 3 a 8 5 8 e b 0 3 7 a a f 6 0 7 c 0 c 7 9 a 0 7 e d 5 d f d 3 6 1 4 6 3 9 f 6 b c 7 8 6 8 1 1 d e 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w e y j b a . e x e
C : \ d a 9 0 a 1 3 b c 4 1 6 9 f 2 9 a e d 2 d e a 9 4 6 6 1 c c 2 2 6 8 e c 0 8 a a 2 3 6 0 8 5 d c 6 0 c e 1 4 3 0 3 c c 5 0 7 6 3
C : \ 7 2 3 e 2 0 c 8 7 0 b 1 f e 9 b 3 3 e c 6 a 4 e 9 6 5 9 0 5 2 5 8 1 a 3 2 1 c 0 3 f d 3 6 d d 8 5 9 b 0 1 5 6 3 9 f f 7 2 0 9 3
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w e y j b a . p e 3 2
C : \ 6 5 e 5 5 9 0 2 1 0 7 6 1 f d 1 d b 1 3 7 a 8 b 0 e 8 1 e 2 c c 4 d 4 8 2 d 0 7 6 c 3 7 8 f 3 f f 9 3 3 9 c d 2 6 5 0 3 e e f 2
C : \ d a 0 8 4 1 1 3 0 0 5 d 6 9 9 d a 4 6 6 3 6 a b f a d 8 9 f c 9 f 1 6 1 8 a c a 8 2 4 5 1 c 3 8 f f d 9 e 1 d 6 a 9 4 f 1 7 2 5
C : \ U s e r s \ L i s a \ D e s k t o p \ Z w A M c G 0 s . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ P q k c Y X I s . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d 2 6 e 4 5 e 6 6 a 0 d c 5 d e 9 a 0 d 5 1 0 7 6 f 3 7 e 5 2 3 4 0 c 4 8 4 2 a 2 f c 7 0 3 2 c c 6 3 9 9 9 7 5 0 2 e 1 2 2 6 5 . e x e
C : \ 1 c b 1 7 a a 2 d 3 5 c 3 8 e 4 a 4 8 b c 2 0 9 d 9 8 9 d a 4 a 2 f 0 9 3 a a 4 1 d e e 5 a 4 7 5 1 b b f 5 2 8 a d f 6 7 d 0 c
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ q S s H R g y 2 . e x e
C : \ 1 3 7 b 8 1 f b 0 f 7 b a 1 f 4 f 9 3 b 0 1 d 4 a b 9 6 8 3 2 d b b d 4 9 2 f 8 b 2 6 4 3 b 6 b f 6 3 0 6 9 6 7 0 2 f 4 7 5 d 8
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ N Z R b f k 9 5 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c 8 4 c d 1 3 c 6 0 3 6 5 c 4 2 4 b d a 7 a 5 1 2 0 5 3 f 0 6 1 5 b 1 8 9 f c a 9 a e f 4 9 d b 7 0 a b 9 9 3 8 1 7 9 0 0 d d f . e x e
C : \ 4 e a c 5 a 8 2 1 e f c 3 4 6 3 8 1 2 1 6 b 8 4 b 5 2 e 5 9 4 9 7 1 b 7 a f f d 9 3 f 5 7 e 9 f 2 1 0 e 6 b c 0 c 6 2 a b 6 f 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w e y j b a . e x e
C : \ 6 8 4 0 7 9 e 1 4 4 e 6 0 0 7 3 8 1 2 f c 1 7 3 5 1 a 1 5 6 b 0 c f 7 7 e 9 2 7 6 b a b f f 2 9 e 3 7 1 b a 0 5 f 7 f d a c e b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w e y j b a . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w e y j b a . p e 3 2
C : \ 8 9 f a f 1 f 1 2 e 9 f 6 6 9 c 9 c d 9 6 9 9 3 e 8 d 5 c e 3 8 4 a 6 d 6 3 6 5 a 1 1 7 5 d c 0 3 6 d 2 7 9 5 c a f 9 b e 5 0 6
C : \ 6 5 9 b c 2 d 9 a b a 2 e 2 5 f d 2 5 8 9 9 9 1 4 9 c 1 5 7 6 2 5 1 0 8 0 c 6 b d 2 2 2 1 c f 0 4 2 7 6 9 b a c 4 c d 7 c 7 8 7
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ j 8 5 C T H Y q . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ f 6 8 5 b a 5 a 5 d 1 5 f e 6 b 5 9 5 a 4 7 a 4 8 8 0 a e b b 5 7 b 0 6 a e a 3 f e 9 7 5 8 0 9 4 6 3 0 5 9 8 c a 9 f 7 b a d 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w e y j b a . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w e y j b a . p e 3 2
C : \ 1 8 4 6 e 9 1 3 4 4 1 1 3 8 2 f a 5 4 3 e 8 2 5 0 c 4 6 4 a 4 8 9 3 b 5 3 a 0 3 2 e d 3 6 0 9 c a 5 7 7 f a 6 9 b 8 6 2 6 c a a
C : \ 3 c 7 6 6 4 3 6 6 5 7 0 c 1 4 5 4 f 9 1 9 b 6 c 0 8 0 3 0 1 8 2 b 3 f 0 6 7 9 a 6 c 1 f a 1 5 b 6 8 f 7 2 6 9 0 3 3 6 4 9 6 4 3
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ J v G K P 8 m Z . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ f 8 d e 2 6 8 c 0 c 1 d f b b 4 2 f 9 e 8 7 f f f 2 b 4 7 5 1 0 8 1 5 b 9 1 d 6 7 e 7 5 e 2 5 3 5 f 0 b d c 3 c e 8 c 9 e a 4 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w e y j b a . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ u a I 8 0 y R P . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ 9 e 0 5 6 2 4 e 9 9 d 6 1 1 e 9 2 4 c 5 d 5 d 0 0 7 1 e 2 7 7 4 7 1 5 0 a b 2 3 4 1 e 1 f 5 d 2 b 3 2 c a e 3 0 d d 5 b e 4 c e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w e y j b a . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f 4 9 4 3 3 0 6 a 2 c b 2 1 1 a _ w e y j b a . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w e y j b a . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 a e 9 4 d d 0 1 b f a f 3 7 7 _ w e y j b a . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w e y j b a . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 0 4 f 1 8 f b a 1 7 7 6 e 8 0 c _ w e y j b a . e x e
C : \ 6 0 0 d c 3 9 2 8 1 2 3 3 5 f 4 0 3 b 9 a 1 c 8 6 e 9 9 8 e b 3 c 6 0 5 e 1 c a d 1 8 f 9 7 8 e f 1 a 2 5 5 3 f 2 9 e f 4 e c 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w e y j b a . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w e y j b a . p e 3 2
C : \ 4 e 3 5 f c 1 c 1 0 7 d e 5 e 3 6 3 7 b 9 6 7 d 8 a 1 b 6 7 4 e 8 6 5 2 6 8 0 a 2 a d b 6 c 3 b 9 2 b 0 f c 2 c d 2 a 1 6 1 9 0
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w e y j b a . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 9 6 4 1 d 4 1 8 e 7 0 a f f 3 3 _ w e y j b a . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ g J R M i y y 7 . e x e
C : \ 3 c 5 7 3 e d 4 e 7 6 9 8 6 2 c 4 9 a 0 e 1 7 b 9 0 1 7 e e 4 e d f 1 0 3 0 5 6 9 0 9 9 0 b d f 6 a b 3 f 1 d e 7 a 0 8 4 d d 8
C : \ 0 e f f 7 4 9 2 8 5 7 7 1 9 8 6 c d c 5 8 f a 6 4 a 9 4 e 4 8 7 5 d 7 f 2 a f 7 a 1 e 9 4 0 d b 8 a 2 c 5 f 4 9 a 1 4 4 2 1 a 8
Process Tree
-
0b66e2937c5a64657ef3496f7f948096517dbd63b95c9c1d12c23d59f3322398.exe (616)
"C:\Users\Administrator\AppData\Local\Temp\0b66e2937c5a64657ef3496f7f948096517dbd63b95c9c1d12c23d59f3322398.exe"
- weyjba.exe (1404) "C:\Users\ADMINI~1\AppData\Local\Temp\weyjba.exe"
Hosts
| IP |
|---|
| 114.114.114.114 |
| 8.8.8.8 |
| 54.209.32.212 |
| 52.71.57.184 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
| demandtosupply.com |
A 52.71.57.184
CNAME hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com CNAME traff-1.hugedomains.com A 54.209.32.212 |
52.71.57.184 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 8.8.8.8 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | a5bed13ecdac52c8_weyjba.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\weyjba.exe |
| Size | 72.1KB |
| Processes | 616 (0b66e2937c5a64657ef3496f7f948096517dbd63b95c9c1d12c23d59f3322398.exe) |
| Type | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed |
| MD5 | e6f2321b236f533651327ddda9d0fecf |
| SHA1 | 29ec5004f523c18bbd935c528dce92d0e54ceb9e |
| SHA256 | a5bed13ecdac52c8a56baa5ad3ba4c2532ef7354c52e00b0b7ccddded265ed31 |
| CRC32 | 86F9F0FC |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.