2.5
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.67
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Agent-AULS [Trj] | 20191230 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Downloader.Waski.a | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20191230 | 2013.8.14.323 |
| McAfee | Downloader-FAGV!BE36F91A1909 | 20191230 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b07aa6 | 20191230 | 1.0.0.1 |
静态指标
查询计算机名称
(2 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545276.391125 GetComputerNameW |
computer_name:
TU-PC
|
success | 1 | 0 |
|
1727545276.7035 GetComputerNameW |
computer_name:
TU-PC
|
success | 1 | 0 |
检查进程是否被调试器调试
(2 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545276.297125 IsDebuggerPresent |
failed | 0 | 0 | |
|
1727545276.6415 IsDebuggerPresent |
failed | 0 | 0 |
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(3 个事件)
| section | .MPRESS1 |
| section | .MPRESS2 |
| section | .imports |
动态指标
分配可读-可写-可执行内存（通常用于自解压）
(2 个事件)
在 PE 资源中识别到外语
(4 个事件)
| name | RT_ICON | language | LANG_ARABIC | filetype | None | sublanguage | SUBLANG_ARABIC_SAUDI_ARABIA | offset | 0x0000a078 | size | 0x000025a8 | ||||||||||||||||||
| name | RT_GROUP_ICON | language | LANG_ARABIC | filetype | None | sublanguage | SUBLANG_ARABIC_SAUDI_ARABIA | offset | 0x0000c6d0 | size | 0x00000014 | ||||||||||||||||||
| name | RT_VERSION | language | LANG_ARABIC | filetype | None | sublanguage | SUBLANG_ARABIC_SAUDI_ARABIA | offset | 0x0000c724 | size | 0x00000234 | ||||||||||||||||||
| name | RT_MANIFEST | language | LANG_ARABIC | filetype | None | sublanguage | SUBLANG_ARABIC_SAUDI_ARABIA | offset | 0x0000c998 | size | 0x000001e8 | ||||||||||||||||||
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\erdou.exe |
投放一个二进制文件并执行它
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\erdou.exe |
一个进程创建了一个隐藏窗口
(1 个事件)
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
在用户文件夹中创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\erdou.exe |
文件已被 VirusTotal 上 60 个反病毒引擎识别为恶意
(50 out of 60 个事件)
| APEX | Malicious |
| AVG | Win32:Agent-AULS [Trj] |
| Acronis | suspicious |
| Ad-Aware | Gen:Variant.Daytre.30 |
| AhnLab-V3 | Downloader/Win32.Upatre.C3419893 |
| Antiy-AVL | Trojan[Dropper]/Win32.Dapato |
| Arcabit | Trojan.Daytre.30 |
| Avast | Win32:Agent-AULS [Trj] |
| Avira | HEUR/AGEN.1026738 |
| Baidu | Win32.Trojan-Downloader.Waski.a |
| BitDefender | Gen:Variant.Daytre.30 |
| BitDefenderTheta | Gen:NN.ZexaF.33558.dq2@ayu@staO |
| Bkav | W32.AIDetectVM.malware1 |
| CAT-QuickHeal | Trojan.UpatrePMF.S6771930 |
| ClamAV | Win.Downloader.Upatre-5744087-0 |
| Comodo | TrojWare.Win32.TrojanDownloader.Upatre.AAL@5iclp5 |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.a19097 |
| Cylance | Unsafe |
| Cyren | W32/S-debdcfd5!Eldorado |
| DrWeb | Trojan.Upatre.87 |
| ESET-NOD32 | Win32/TrojanDownloader.Waski.A |
| Emsisoft | Gen:Variant.Daytre.30 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/S-debdcfd5!Eldorado |
| F-Secure | Heuristic.HEUR/AGEN.1026738 |
| FireEye | Generic.mg.be36f91a1909716a |
| Fortinet | W32/Waski.A!tr |
| GData | Gen:Variant.Daytre.30 |
| Ikarus | Packer.Win32.Krap |
| Invincea | heuristic |
| Jiangmin | TrojanDropper.Dapato.pdf |
| K7AntiVirus | Trojan ( 0052964f1 ) |
| K7GW | Trojan ( 0052964f1 ) |
| Kaspersky | Trojan-Downloader.Win32.Upatre.efj |
| MAX | malware (ai score=88) |
| MaxSecure | Trojan.Upatre.Gen |
| McAfee | Downloader-FAGV!BE36F91A1909 |
| McAfee-GW-Edition | BehavesLike.Win32.Sytro.qt |
| MicroWorld-eScan | Gen:Variant.Daytre.30 |
| Microsoft | TrojanDownloader:Win32/Upatre.AA |
| NANO-Antivirus | Trojan.Win32.MlwGen.dewlww |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM19.1.39BF.Malware.Gen |
| Rising | Dropper.Dapato!8.2A2 (TFE:2:1rA9VijPqKK) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/HkMain-AZ |
| Symantec | ML.Attribute.HighConfidence |
| Tencent | Malware.Win32.Gencirc.10b07aa6 |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
1973-02-28 17:38:41
PE Imphash
db776ec11532c7fb025a543dd39097bf
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .MPRESS1 | 0x00001000 | 0x00008000 | 0x00004a00 | 3.5302386415395324 |
| .MPRESS2 | 0x00009000 | 0x00001000 | 0x00000400 | 5.895198729203978 |
| .rsrc | 0x0000a000 | 0x00003000 | 0x00002c00 | 3.8743724066775247 |
| .imports | 0x0000d000 | 0x00001000 | 0x00000400 | 3.717654721056684 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x0000a078 | 0x000025a8 | LANG_ARABIC | SUBLANG_ARABIC_SAUDI_ARABIA | None |
| RT_DIALOG | 0x000052e8 | 0x0000056c | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_DIALOG | 0x000052e8 | 0x0000056c | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x0000c6d0 | 0x00000014 | LANG_ARABIC | SUBLANG_ARABIC_SAUDI_ARABIA | None |
| RT_VERSION | 0x0000c724 | 0x00000234 | LANG_ARABIC | SUBLANG_ARABIC_SAUDI_ARABIA | None |
| RT_MANIFEST | 0x0000c998 | 0x000001e8 | LANG_ARABIC | SUBLANG_ARABIC_SAUDI_ARABIA | None |
Imports
Library MSVCRT.dll:
• 0x403034 _controlfp
• 0x403038 _except_handler3
• 0x40303c __set_app_type
• 0x403040 __p__fmode
• 0x403044 __p__commode
• 0x403048 _adjust_fdiv
• 0x40304c _exit
• 0x403050 __setusermatherr
• 0x403054 _initterm
• 0x403058 __getmainargs
• 0x40305c _acmdln
• 0x403060 exit
• 0x403064 _XcptFilter
Library USER32.dll:
• 0x40306c SendMessageA
• 0x403070 PostQuitMessage
• 0x403074 DestroyWindow
• 0x403078 DefWindowProcA
• 0x40307c CreateWindowExA
• 0x403080 ShowWindow
• 0x403084 UpdateWindow
• 0x403088 RegisterClassExA
• 0x40308c LoadAcceleratorsA
• 0x403090 GetMessageA
• 0x403094 TranslateMessage
• 0x403098 DispatchMessageA
• 0x40309c LoadCursorA
Library KERNEL32.dll:
• 0x403008 InterlockedIncrement
• 0x40300c InterlockedDecrement
• 0x403010 InterlockedExchange
• 0x403014 InitializeCriticalSection
• 0x403018 LoadLibraryA
• 0x40301c EnterCriticalSection
• 0x403020 LeaveCriticalSection
• 0x403024 GetStartupInfoA
• 0x403028 DeleteCriticalSection
• 0x40302c GetModuleHandleA
Library COMCTL32.dll:
• 0x403000 None
L!Win32 .EXE.
.MPRESS1
.MPRESS2
.imports
@@@@@@
@@@@@@@
@@@@@@
hSVWe3
EEP5TG@
EPEPEP
0u>"u:Fu
<"u>"u
> vFuj
@@@@@@
@@@@@WVSQWUXE
}ht }it
@@@@@@
@@@@@@@@
S`\{FP$
}kE[.}MUVu
FG3@_^]
Pr7yb7Fx
i3|u'&5
`}j67BOc
/kR>aTrJvPG?
W!Ov)6G>D>
Z/ #Xm}
n!6YeWg5\3>
Q$[WE-
yykEA&P
3Qc%{
bV/U`U{
k2~&id}#
l=Fbzt
u/,B|\xoz+.$A
ZR}Mg;.]&1[v
:LQYR=H/}k
3RWNMZIi=#
5erML1itbj=
B7{E<P
& dl%c
EYhhJgOd RR&v UU@m
U*;b\(/
v$tc"uXjx
)#&))c'
>]O[48@
2hFPrc5FYR
{X8$UjeT
^l|J\
.'El.FU
0XE.B7
(A$$- #6nql9j
w=[8j-
,0qSVW
fZuS$AVWAf9
GGEGGEM;r
MSVCRT.dll
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
USER32.dll
SendMessageA
PostQuitMessage
DestroyWindow
DefWindowProcA
CreateWindowExA
ShowWindow
UpdateWindow
RegisterClassExA
LoadAcceleratorsA
GetMessageA
TranslateMessage
DispatchMessageA
LoadCursorA
hKERNEL32.dll
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InitializeCriticalSection
LoadLibraryA
EnterCriticalSection
LeaveCriticalSection
GetStartupInfoA
DeleteCriticalSection
GetModuleHandleA
COMCTL32.dll
8Muex<
KERNEL32
VirtualProtect
G(XPTPjxWXt=
Riched32.dll
RichEdit
Msq*688F}
tascraft
teercon5
secondmasteng
corect
Mivissini romi
<liY~EB
GetModuleHandleA
GetProcAddress
KERNEL32.DLL
MSVCRT.dll
USER32.dll
ShowWindow
COMCTL32.dll
t7Kt'Kt
* QK*
4 4 4 4 4 4 4 2
4 gZ4 4 4 4 4 4 4 4 4 4 4 4 -
4 4 4 4 4 4 4 4 4 i[4 4 3
4 4 4 4 4 4 4 4 1
3 7!7!7!7!7!7!7!H17!7!6!7!7!zm7!7!7!7!7!7!7!3
4 8"8"8"8"8"8"8"8"[K8"8"l]8"8"8"8"8"8"8"8"8"8"8"8"4
7!9#9#9#9#9#9#9#ZL9#ZL9#9#7!7!8#9#9#9#9#9#9#9#7!
9#<#<#<#<#<#<#<#<#rd<#<#~r<#<#<#<#<#<#<#9#
<#?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&<#
A)F,?&?&F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,?&?&?&?&?&?&F,F,F,A)
A)F,iSiSiSiSiSiSiSiSiSiSiSiSiSiSiSiSiSiSiSiSiSiSiSiSiSiSiSF,H0
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity
version="1.1.2.5"
name="Kindess"
/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel
level="asInvoker"
uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
MSVCRT.dll
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
USER32.dll
SendMessageA
PostQuitMessage
DestroyWindow
DefWindowProcA
CreateWindowExA
ShowWindow
UpdateWindow
RegisterClassExA
LoadAcceleratorsA
GetMessageA
TranslateMessage
DispatchMessageA
LoadCursorA
KERNEL32.dll
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InitializeCriticalSection
LoadLibraryA
EnterCriticalSection
LeaveCriticalSection
GetStartupInfoA
DeleteCriticalSection
GetModuleHandleA
COMCTL32.dll
N e w v e r s i o n a v a i l a b l e
M S S h e l l D l g
D o w n l o a d
& N o , t h a n k s
S e t t i n g s
M S S h e l l D l g
D e f a u l t & L a y o u t :
D e f a u l t & Z o o m :
S h o w t h e & b o o k m a r k s s i d e b a r w h e n a v a i l a b l e
& R e m e m b e r t h e s e s e t t i n g s f o r e a c h d o c u m e n t
R e p l a c e d o c u m e n t & c o l o r s w i t h W i n d o w s c o l o r s c h e m e
A d v a n c e d
A u t o m a t i c a l l y c h e c k f o r & u p d a t e s
R e m e m b e r & o p e n e d f i l e s
M a k e S u m a t r a P D F a d e f a u l t P D F r e a d e r
S e t i n v e r s e s e a r c h c o m m a n d - l i n e
E n t e r t h e c o m m a n d - l i n e t o i n v o k e w h e n y o u d o u b l e - c l i c k o n t h e P D F d o c u m e n t :
C a n c e l
C : \ Q S T l o 8 i m . e x e
C : \ Q L F 5 3 D I 5 . e x e
C : \ f v 5 S l
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
4 A 1 4 3 2 B 8
C o m p a n y N a m e
F i l e D e s c r i p t i o n
N A L I K c o m p a n y
F i l e V e r s i o n
V e r s i o n 2 . 1 . 1
I n t e r n a l N a m e
L e g a l C o p y r i g h t
C o p y r i g h t b y N A L I K
O r i g i n a l F i l e n a m e
V a r F i l e I n f o
T r a n s l a t i o n
C : \ 3 d 4 b 6 a 7 e c 8 2 d 1 e 0 5 a 3 4 c c 1 8 9 6 7 3 1 d 6 8 7 2 7 6 d b b d b d 8 b b 7 5 6 e b 6 7 9 a 7 d d f d 9 7 8 b a 8
C : \ U s e r s \ L i s a \ D e s k t o p \ 7 w x L 2 M x w . e x e
C : \ 8 3 e 7 3 5 d d 2 1 3 4 1 1 5 a 6 d 9 a 5 0 0 a 1 6 6 4 7 e b 0 f 6 1 f f 4 e 7 0 a d 2 1 b 1 8 0 3 6 c 8 d 6 8 1 d c b c 2 5 b
C : \ 6 8 c e f a a 8 a 0 a 5 d f 3 6 c 0 d b 7 6 c 1 b 0 e 7 d c 2 0 0 f b 8 e 3 9 c 2 0 8 0 3 e 1 b 8 b d 1 e 3 9 c b 4 8 0 6 7 0 e
C : \ a c 1 f 8 c 1 0 f a b e f c 4 8 c 6 9 3 b 4 3 0 7 9 1 3 e 5 d 2 8 8 9 d f 8 f 2 e 6 9 9 d b d 2 3 8 8 5 d 6 5 0 a 8 4 2 2 d 3 e
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ f 7 3 b a 1 3 d e 4 8 6 f f c 0 e 4 0 c f 3 c e d 9 e b 3 4 e d a f 8 b 6 d 3 b c 7 e f 0 3 3 c b 2 f a 2 0 f 1 b 9 3 f 9 f 7 b . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ k g d M A Y 5 N . e x e
C : \ 0 g Y n l 4 y M . e x e
C : \ 8 b 9 a b a a 6 6 b f 2 7 0 7 f 6 6 f e 2 e 7 6 c 6 1 5 0 3 c 7 5 6 f c b 7 2 d 6 9 d 3 9 2 6 3 4 d 2 f a 5 5 b 2 2 2 6 1 e 3 7
C : \ R a i d e n \ G o a t \ F T P \ S a m p l e \ 6 4 5 6 2 D 4 F 9 D 3 1 8 8 8 2 4 4 0 5 1 0 F 4 D 0 4 D 1 F 4 8 . b i n . e x e
C : \ x 6 Y i p 5 F I . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ o W C R W E b C . e x e
C : \ l B 1 o 0 q R H . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ W 0 2 I c A X k . e x e
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 4 a c 2 e 4 9 7 0 6 9 4 1 e 3 e f 4 5 0 4 7 0 f 5 b d 4 c 9 8 3 c d d 7 e e 8 a 2 d 6 9 c c f b 6 4 c 4 b 0 6 4 8 7 d 3 1 d e 7 . e x e
C : \ T b l F I i _ S . e x e
C : \ c f a 0 6 6 2 1 8 f c 3 f 7 f e 0 3 0 2 9 1 a 2 1 1 9 3 3 2 7 3 4 b b c c 8 4 5 d d 3 b 1 8 f b 2 3 c 4 3 1 6 0 0 4 d b 2 7 a a
C : \ P x L m 1 d w j . e x e
C : \ 2 8 a f 2 c 4 8 8 4 5 f 2 c 8 c c 5 4 7 a 4 f 3 7 1 b 6 e d b 3 5 2 9 a e d 2 e f 0 c d f e 7 2 2 9 3 1 6 a 3 7 c 7 a b a 4 3 b
C : \ 5 c c 5 d 6 6 c 7 4 8 3 9 8 e b 1 c 6 5 d 8 4 1 4 3 5 1 e 6 2 b f 1 6 4 2 5 1 4 4 5 7 7 0 5 9 b f 3 5 8 f 9 9 5 5 8 2 c 0 6 b 7
C : \ c 3 9 3 6 7 d 8 6 b 5 4 9 4 c d f 0 f 6 d d 0 0 9 0 b 4 f 6 1 d b 5 5 f 1 c e c 0 9 f 4 3 d 7 d 9 9 f 9 3 0 4 e 7 2 1 e d 7 d 9
C : \ T A T w 8 M h 5 . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ c b L 6 T U g c . e x e
C : \ X 5 _ H D e V X . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ j 7 e c q w o Z . e x e
C : \ K e Y 9 P w Y O . e x e
C : \ 0 c 8 d 0 6 4 9 9 3 e 1 b 1 5 d 8 8 b 5 3 9 4 8 0 e b 3 0 7 f 7 f b 2 1 7 2 2 d a 3 4 6 1 3 d 4 7 1 e 0 9 a 2 d e c d 5 0 c 2 3
C : \ 4 6 6 2 8 3 0 9 8 e 3 b 0 0 9 d 3 7 8 6 4 e a 5 b 5 e 5 4 2 8 a d f 5 7 5 6 8 e f d 9 e 7 d 3 e d f 3 f f 6 c 3 6 5 b f 4 8 d 2
C : \ U s e r s \ L i s a \ D e s k t o p \ n 7 A d o P I 6 . e x e
C : \ K j t L 7 O 5 V . e x e
C : \ f 6 2 5 8 a 6 4 c e 1 c c e 2 a d 7 7 0 a c d 4 d a 5 6 2 9 7 c a 7 3 c 5 5 1 f 6 2 0 f a 7 9 2 c a 0 f b 7 0 5 8 9 b e f d 2 e
C : \ 0 b 0 4 d 0 6 b 0 3 5 0 c 1 9 5 9 b 3 a 1 d f e d 4 f 5 f 4 a 3 f a 5 1 5 c 0 4 a 0 5 6 2 b a 6 d f 9 e c a 3 e 9 2 f 6 7 c f 9
C : \ e f a c 2 5 8 3 d a 9 d 1 d d 6 0 7 c 0 3 f 0 4 5 7 7 9 4 a 4 7 8 9 a f 0 f 0 7 d 4 d b 2 b b b 5 3 5 b 1 6 3 e 4 b 3 e 6 c 3 a
c : \ t a s k \ 7 5 4 E 7 E F 3 F 7 F F 4 D C D A 2 3 3 B 9 3 1 2 D 4 4 0 C 3 2 . e x e
c : \ t a s k \ B 9 6 5 C 6 D 5 9 C 4 0 3 B 4 4 2 3 4 7 7 9 D 2 9 A 3 1 2 8 4 0 . e x e
C : \ b f f 7 b 1 f 4 8 d c 9 3 9 9 a 7 2 e 5 d f c b b f 4 2 9 3 7 b 6 9 0 3 f b 2 c f d c d 3 f 2 c d 0 5 c 2 5 3 2 0 6 8 6 b c 2 3
C : \ 2 c f 2 f 0 5 d 0 8 7 2 e d 3 3 5 d 9 2 8 d c d c 8 1 6 f b 8 0 9 7 f 3 1 8 f a 0 c b e 7 f e a 1 a 2 1 3 5 a b 6 a 3 5 8 b e 1
C : \ e a 4 8 3 f 5 0 4 f 5 b 1 a 8 3 a 9 2 0 6 3 2 5 8 4 3 b a 9 2 c 3 8 a 7 d 1 7 5 7 a d 9 5 d 6 9 f 6 d d 2 9 7 4 d 8 6 4 5 0 5 7
C : \ 6 0 1 f 1 9 6 3 5 c 0 d 0 c 5 0 c 8 3 c 6 7 a 1 5 b d d d 9 9 5 c 3 1 a 7 4 0 7 8 c c 3 f 4 5 7 4 8 6 6 4 1 6 b 8 a 4 8 7 8 4 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ e r d o u . p e 3 2
C : \ d 9 d d 3 a 1 8 a 0 9 a c 8 0 3 e b f a b 7 6 6 8 f 7 4 d e 9 4 a 9 7 2 9 6 0 7 3 b 9 6 c a d c 3 8 a 0 8 8 2 2 a a a e 1 5 c 8
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ e r d o u . p e 3 2
C : \ 8 a 0 0 4 1 2 3 e a 0 a 2 a 6 0 a 8 5 e 2 2 d 8 7 f b d c 7 9 d 3 8 7 e 7 a 1 6 8 a 9 d f e 2 d c 8 6 3 8 1 5 b c c 3 6 f 2 d 3
C : \ 2 5 5 d e 1 8 e a e 3 3 3 8 6 c e 6 3 3 9 0 2 3 9 2 9 e 0 2 e 8 a c c 4 7 6 7 1 6 5 d 2 e a 7 c 3 5 4 b 4 8 2 2 9 8 7 7 7 0 2 8
C : \ 8 c 2 0 1 1 0 8 3 7 9 9 8 7 4 8 c 4 d 3 3 3 b 5 d a 4 b 2 a 9 9 7 0 9 e 6 9 e f 9 f 7 a 6 d 9 b 0 f 9 7 4 8 f 6 a 9 1 3 4 0 e e
C : \ 8 b 7 8 1 d 4 a 4 0 a 3 e 4 f a 7 b 3 8 6 e 1 1 9 2 b 9 f e e d 5 f 0 1 6 b c a f b e d 0 4 b 6 f b 4 e 2 4 6 d 7 6 1 0 e 0 4 f
C : \ i t g y z V S R . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ c 3 b 3 8 e 2 9 1 c 9 1 2 4 8 3 b f e 5 . p e 3 2
C : \ 8 6 e 2 0 0 4 7 6 5 7 0 9 7 b d b a c 2 2 4 b 1 c c c e c b c 2 d f a 5 f 1 8 b 4 b 0 6 5 8 f c a c f e 5 2 2 3 b 0 9 b 8 4 b 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 0 9 a d 5 c 9 7 0 0 d e f f 5 6 1 6 8 0 f 1 0 f 6 9 7 a 8 b a d 9 b 6 8 2 f 4 3 9 a d 6 a 0 9 8 9 c 1 6 2 b 4 a 5 0 5 2 a d c 3 . e x e
C : \ e 4 7 9 0 e 5 9 3 1 e c 9 a f 6 7 b f 3 d 9 4 d 8 b d 5 6 e c 5 d 5 f 2 f 0 e 4 3 f 0 0 b 2 6 b f 8 8 6 4 f e 6 7 9 d 0 f a 4 f
C : \ 5 9 8 c e d e 3 8 f 5 8 8 7 1 6 4 9 7 d 3 1 9 d 2 a e 5 7 3 e 8 f e 7 b 7 5 3 6 4 a d 2 d 5 1 c 0 e 8 f a 8 f 9 6 6 0 f 4 a d a
C : \ v _ P l L h u e . e x e
C : \ 4 1 9 9 c e c 5 4 9 2 e 8 4 1 4 8 c 8 8 d b 6 c 3 e 0 d c e e e 4 4 8 a c f c a c 5 9 c 0 a f 6 3 a 8 0 d 5 8 1 b b 4 3 f 4 c b
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 0 o Q y G b B E . e x e
C : \ h 9 5 a Z S w 9 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ a d 5 e 7 e a 2 d 6 9 6 0 5 8 4 5 a c e 5 2 9 1 1 e 1 a 8 5 8 6 e 3 6 f 3 a 2 4 8 d 4 6 e 3 a b e e 4 4 e d 4 d 6 a 7 b b e c 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ G h T D l C p U . e x e
C : \ 8 c b a 2 e 1 f d 8 8 e 8 0 5 e b c 9 c 2 c 6 8 a 5 6 4 2 e 0 f 7 8 a 6 0 d a e f 8 0 0 9 9 4 c d f f 9 b e c d c 3 6 3 3 1 1 a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e r d o u . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 6 g 8 G l K z d . e x e
C : \ c 3 1 5 4 3 f 8 a 2 b a 6 d 1 b 4 4 b 5 8 c d 9 e 6 5 7 a e 1 e 1 6 4 2 7 a 2 3 2 6 5 7 3 d 6 e f 8 e 2 4 5 f e b e 6 d 5 5 4 e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ A L h H R s z c . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 0 d 1 1 b 9 3 2 7 3 f f 4 8 0 c b 1 5 d e d b 6 7 3 0 4 5 c 1 e a a c a 9 0 c c 5 1 5 1 8 5 4 a 8 6 f 2 3 7 b 4 3 7 e 6 d f 7 8 . e x e
C : \ f 8 a 3 b 2 b f e 1 1 f 4 7 a e 2 0 0 6 1 d a 3 c f 0 b 5 f 1 5 6 5 c 5 0 9 a 9 c b d 4 d 0 2 9 d 5 9 d 4 0 b f 9 d 5 b 2 3 c 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ k n I V J P 5 3 . e x e
C : \ a a 0 6 3 f f 5 4 2 6 c 6 2 1 0 2 1 2 c f 7 0 d b f 8 7 d 8 9 d 2 3 b 0 1 1 9 d 9 0 8 8 d f 1 4 5 f 4 0 c 7 e 4 3 8 a c b d 0 6
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ c S e e D H R K . e x e
C : \ b 5 5 7 0 d 9 6 b f 3 6 a c d 2 e 9 c 9 3 8 9 a d 5 4 1 f 6 9 9 5 2 a 7 f 7 0 5 4 b d c 6 1 6 7 a c f 1 b 6 8 a a 7 d 5 8 1 7 f
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ d M x K x z Z 1 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a 5 0 5 4 f 0 3 3 0 4 4 6 2 d e 4 0 b 4 c 7 f 7 3 c 8 6 a 4 b 7 8 6 e c 2 1 d d a e a 4 5 4 7 b 1 c 3 2 6 5 c b e 0 2 1 7 a f 4 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ e r d o u . p e 3 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 7 0 V H U G Z X . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c 5 1 6 6 2 a a 0 b e 3 3 4 6 d 9 7 c 9 a 5 d 7 f 9 a a 7 d f 4 f e c d a 4 a 3 f 7 4 d f f 0 7 b 2 e 8 d 4 7 9 1 5 a c 2 a 6 e . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ e r d o u . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 4 1 4 2 c d b 8 8 4 a 6 5 8 9 e _ e r d o u . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ e 4 3 s S H d B . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ D Z C K C S Q d . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a c a d e 0 9 d 0 f 3 8 0 8 4 d b 6 2 5 c e 5 a 0 6 c 7 4 d 6 0 3 f b 7 a 9 2 0 6 0 5 8 4 e 5 e 7 e 6 1 0 9 4 0 c f 5 1 2 4 3 d . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ M S r 6 y z L E . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a c f a 9 f 1 f 2 f 4 8 7 e 3 a d e f 3 3 1 0 c 6 6 6 1 3 4 e 3 d e 0 a 1 7 2 b 7 3 9 d 3 d a 6 0 f 4 d c 9 8 a 5 4 9 d a f 2 e . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ Z u n U G O V 5 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 0 2 7 9 9 f 1 3 d 0 3 2 f 4 a e 6 1 4 a c b 0 5 8 d 3 a d 9 8 6 7 1 e 4 8 2 c 3 b c 0 d 5 5 e 1 e a 1 6 0 7 3 f a 0 1 c b 7 0 e . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ K n x x l W R B . e x e
C : \ 0 d 7 b e 7 2 f 4 f 0 f 3 3 9 9 7 6 e 7 1 4 f 0 5 1 8 9 b 2 c 1 e 8 0 2 1 1 c a 9 d 9 d 1 6 5 d 7 2 2 0 1 2 1 3 4 7 0 4 2 b f 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e r d o u . e x e
C : \ 4 6 5 d 1 6 7 1 b f 1 5 8 c 5 c d 2 e b 6 b a 7 9 c f 1 f 8 5 1 4 0 9 f 1 9 6 d 1 e 4 5 5 e 7 e 6 e 7 3 8 d 0 f 0 b d 1 8 3 8 9
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ X e A 5 r 6 T L . e x e
C : \ 2 7 5 7 3 2 2 0 8 0 5 2 1 1 e 3 d 9 2 1 0 0 f 4 4 3 1 1 d 7 3 3 a 4 c 1 3 1 4 5 9 4 0 2 b 2 6 d 1 e a f 8 0 c 2 2 9 8 b 6 7 9 a
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ Q Q F 2 t f K A . e x e
C : \ f 2 8 9 b 9 e 4 2 2 6 4 f d f b d 0 c 4 2 3 6 3 6 0 5 7 c 8 d 5 5 b e a f 0 a b 9 5 2 6 d 1 d c e b 3 6 6 a c 3 1 8 8 2 c 8 f c
C : \ 8 7 8 9 f e d 8 f b 9 a 1 b 7 f a 0 f 3 0 0 6 9 f 9 8 a f 9 8 f 8 7 0 c 0 e 0 f f 0 f 5 6 9 f d d c f 9 f 7 2 d b d 2 a f e c 1
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ e r d o u . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f 4 c 5 8 7 5 c 7 a 3 a d 6 8 b _ e r d o u . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ b 3 6 q h n P 3 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 1 1 8 a 7 e 6 f 1 1 3 d 3 7 0 d 4 d 3 b 0 b e 4 a 7 3 a e c 8 e 4 a e 6 b 6 6 d 8 9 9 8 b e 9 f f 4 0 e e 7 2 4 b 0 7 e 2 7 2 f . e x e
C : \ a 0 9 5 3 2 d 3 c e f b f 1 8 4 e 9 a e 2 e d 4 5 4 8 7 b 1 a 3 0 3 0 9 7 8 2 5 9 b d a 9 d 8 9 a 7 9 c 3 2 c e 7 b 4 0 0 8 4 4
C : \ c 8 0 3 3 2 f 4 c e b b f 5 d c e f 6 1 b f 9 b 1 5 f 2 a 6 e e 3 9 e e e 7 3 7 c c 8 b 1 e b 7 7 1 6 6 0 e b e 4 b 6 3 9 3 5 4
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ L r b 8 h n P f . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e e 9 e 2 2 7 e d 3 4 b 2 6 a a 7 9 a 9 1 a a a 9 6 a 8 9 1 5 2 4 f 3 5 6 f 8 f 9 8 a 3 1 f d f 3 2 2 8 8 8 e f f c b 1 b b a 0 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ e r d o u . p e 3 2
C : \ 0 d 2 9 5 3 e 2 a 5 1 2 a 2 3 2 6 e 4 5 b 5 a f 5 c 7 5 7 9 8 2 e 6 e 2 8 5 0 1 1 4 0 2 9 8 8 7 3 c 4 0 d b 2 6 3 5 1 e 9 5 5 c
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e r d o u . e x e
C : \ 1 2 4 8 6 4 6 0 7 4 e 0 1 0 7 4 f 1 5 d d 1 1 8 7 2 e d a 0 3 c 7 0 7 2 3 2 6 d 9 4 2 c 7 b f 4 e 0 6 4 3 4 3 2 9 1 b 6 2 1 5 6
C : \ 4 7 3 f e d 6 2 7 9 0 0 8 b 2 4 2 2 9 e a a 5 7 1 9 c 3 a 9 8 4 5 3 a 6 f 8 3 a c f e e 7 7 1 7 c e a d 6 1 5 9 4 4 9 3 4 0 6 d
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ e r d o u . p e 3 2
C : \ 4 8 1 4 4 9 0 7 7 c 1 4 6 9 9 a 8 0 4 5 9 6 7 f a 7 0 5 1 3 b 1 d 3 6 2 9 8 7 1 b c 1 3 9 0 a 3 2 c 1 a f 4 b 4 c 0 e 3 2 4 e 5
C : \ 2 b 0 7 6 2 2 4 2 2 f c 4 1 7 9 c d 2 e 9 8 a e 3 0 4 2 d 1 0 4 0 1 5 d 7 6 5 5 3 c 0 b 3 2 0 f 2 2 7 0 5 c a 7 2 4 2 6 2 e 7 5
C : \ 8 8 1 0 e b e d 2 c 4 6 1 c c 0 0 1 7 9 f 7 8 3 7 8 2 9 4 9 7 b e 8 8 a e 2 e 8 8 e a c d 0 7 d b 8 f 8 0 f 4 f c 5 6 0 3 8 7 2
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ N S t j v K T x . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 a 7 3 6 b b a 3 3 c 2 5 7 f 2 6 a 3 3 3 4 e 5 4 6 6 d d 7 e 8 2 c 3 5 f 4 2 5 3 0 6 a 7 f a 7 c 4 6 b 0 4 4 5 e a 0 a 9 2 5 8 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ d r r 9 O N C Z . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ e r d o u . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a 2 8 e a b 0 d 3 4 7 9 3 e 2 1 _ e r d o u . e x e
C : \ U s e r s \ R A 4 9 1 ~ 1 . V U L \ A p p D a t a \ L o c a l \ T e m p \ c 6 7 d 6 b e 5 6 b c 6 5 6 f 9 c 9 6 9 6 b d d 8 9 4 7 0 9 7 b . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ H s A U g x u x . e x e
C : \ f f f 9 8 1 5 1 8 1 f 0 1 5 b 0 1 b b e 0 9 a 7 f 3 1 f 4 c 9 6 f 7 0 f 1 f 0 f 2 9 b 4 8 0 0 1 3 5 a 7 b 8 1 e 1 3 5 1 d 2 4 d
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ e r d o u . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ e r d o u . p e 3 2
C : \ 4 6 e 7 2 b 8 d 8 c e 7 1 a 2 e 1 2 5 9 0 6 6 8 0 5 c f f f c 3 c 0 5 e f 1 9 e 3 a 4 9 c f d 0 2 9 5 d 3 1 4 d 9 c 1 e 9 7 7 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e r d o u . e x e
C : \ b 8 3 d 9 0 6 c 9 0 5 e 9 7 e 9 5 9 9 0 6 f f c a 1 7 7 3 a c 5 9 1 7 d 7 2 8 9 f 5 c d 0 3 7 b 2 5 f 0 7 1 b c c c b c 2 a 0 d
C : \ U s e r s \ L i s a \ D e s k t o p \ Y k 2 U r 4 c N . e x e
C : \ c d a 0 5 0 7 1 a c 8 f 9 1 d 1 4 3 e 8 9 0 2 6 a 0 a 1 2 1 7 d a 2 2 1 d 5 9 a 3 0 d 6 c 4 1 5 4 f 9 9 5 1 6 e 2 9 4 c 2 6 a 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e r d o u . e x e
C : \ 6 a d c 2 2 9 a f e c c c 3 1 4 a 9 8 f 5 b a 9 d 2 2 e 3 8 3 9 3 d b b 0 a 7 7 1 3 3 d e e 2 c e 0 0 9 e 0 d 9 c 0 7 a b d 1 6
C : \ 0 6 2 6 5 0 d c b 6 c d 2 f f e 5 5 8 8 f 4 a b b b f f e 1 3 e 2 3 5 9 f 7 c 8 5 c 2 3 8 4 9 a 9 b 8 a f a e 1 4 9 f 3 3 6 d 3
C : \ 1 3 c 0 9 a 3 2 d 1 3 6 b 5 d 6 9 6 c e 3 9 c 8 b 0 f d e d 2 c a d f a d 4 0 7 6 b a 3 d 6 1 8 7 5 e f 1 8 0 8 c e f 6 b f 0 b
C : \ 7 6 e 8 3 2 7 2 1 2 4 9 3 3 d a d 2 4 9 e 5 d a d 2 4 9 4 b 0 7 a 1 5 c 9 8 b 4 c 2 6 a c 8 8 a e d 2 d 7 8 5 c c b f 4 6 0 b 1
C : \ 6 a 6 6 7 e 0 3 c 4 f 3 6 2 f f a b a 5 d 8 2 e d 8 c c 4 f 4 0 7 6 4 8 e d f 3 e 6 1 b c 1 3 a f 1 7 4 f 6 f 9 b 8 7 0 2 9 2 3
C : \ c 2 b 5 8 6 d 1 c d 3 d 0 7 e 4 1 3 9 6 9 a d 4 7 7 8 b 5 1 f c 6 e 2 d 1 7 c 2 d c 8 d b e 9 9 d 4 5 c b c d 5 a 6 b d 9 8 e c
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ w d C v b x P M . e x e
C : \ 0 4 a e c 2 c b e 2 c 8 8 d e 1 3 b 9 d 6 c 9 7 0 6 d d 4 5 8 8 0 6 4 2 0 a e f 2 1 2 f 3 9 f e 1 1 9 4 0 c a e 7 e 0 c c e 3 c
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e r d o u . e x e
C : \ d c f b 1 3 3 1 d 6 6 6 8 c 7 c 4 d f c 1 2 d 8 9 0 8 f 3 2 8 5 1 0 a 0 a b 1 9 a 4 5 5 e f 0 d a c 7 d 0 2 e 2 d 5 1 4 7 f 5 7
C : \ e 5 d b 0 f 3 a a b 8 7 2 5 c 9 3 1 b 6 1 a b 9 f 4 e b d 1 8 8 4 a 8 6 2 7 f 4 4 c a 6 4 7 f 9 b f 5 8 2 9 3 3 2 f 5 3 6 1 9 5
C : \ 6 0 2 7 0 f 4 e c 8 f a 8 f c 3 b 3 7 9 7 f 3 c f f f 6 9 2 7 d 3 8 7 9 7 a 3 9 e b 7 d f 8 e 5 d f d 1 3 f 5 7 a b d f a f b 7
C : \ 1 a 5 8 1 6 4 b 8 3 8 a 1 b f 4 4 5 4 7 8 b 4 6 2 1 7 8 9 f 7 8 7 c 1 d 2 e 5 c e f 3 6 f c 7 8 5 7 7 1 a 6 2 c f f 7 f c f b 8
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ e r d o u . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e 7 1 1 4 d 5 8 2 c b 3 6 3 5 2 _ e r d o u . e x e
C : \ 6 e 6 1 9 8 4 c b 9 e b e e 1 d a e 0 0 e c 4 e 3 9 2 d 7 c c a 0 e 9 f 8 6 2 e 3 f 1 2 4 b a 2 c b 7 d 9 7 b 6 1 e 7 2 0 c 4 f
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ e r d o u . p e 3 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ W b 4 e M 4 4 E . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c e b 0 0 e d 6 1 7 e 4 d 1 d a b 1 6 a e 0 8 2 3 1 3 2 e a 0 1 8 4 5 8 4 4 7 2 e 9 c e e d a e 8 0 2 0 c 7 1 0 5 4 e f 7 3 4 2 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ z s P R X h d V . e x e
C : \ 4 0 d d e b 2 9 e 5 6 1 7 f b 6 7 d 8 e 6 e f 2 9 c 1 2 a 5 c e 1 1 9 a 3 6 a e 8 d e e 8 d a 6 8 c e e e 1 e 3 f 4 4 3 2 e 1 e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ e r d o u . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ e r d o u . p e 3 2
C : \ 8 f 0 a b f 8 2 1 b c e 7 f 4 6 7 d b e 8 9 a 7 1 8 8 a d 9 0 5 2 5 6 a f e 7 5 c e c 0 b 5 d f 7 c 0 e b 8 9 e 5 5 b 3 8 d a 6
C : \ 1 9 5 2 a 2 7 b d a b 3 1 1 6 0 4 e 6 2 7 4 c d 9 1 d f 0 8 2 7 7 b d 7 6 e 4 7 3 9 d d 9 f e 3 a d d 3 0 c 4 2 3 3 4 d 3 a 2 9
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ m t 7 q 9 P 1 j . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 0 4 d f 6 a 8 5 f a 7 e 7 0 9 8 1 6 9 5 4 8 d 2 9 2 4 5 b 3 c 1 6 d f 9 9 3 6 a 1 f f 3 0 e b 9 b 2 5 b 3 b 9 9 9 f 9 8 f a 6 9 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ e r d o u . p e 3 2
C : \ 3 b 2 f d 1 a 8 0 b 2 0 f 6 d b f e 4 c c 3 6 4 5 d 3 c 9 4 9 2 2 e c f 6 0 8 5 7 f 4 d 3 a a b f 1 c 1 4 3 3 c 5 f 2 f 1 c 2 4
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ e r d o u . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ e r d o u . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b a 4 6 c 9 3 9 1 5 b b 3 4 a a _ e r d o u . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ e r d o u . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 4 0 d 4 c 2 c 9 a 1 2 2 5 7 7 d _ e r d o u . e x e
C : \ b 6 2 2 b 5 1 a 7 3 c e b e 6 6 2 7 0 8 2 b 8 e b 7 4 2 6 5 8 1 1 a 0 4 b 7 6 8 e 0 2 b a 4 8 1 b 0 a 4 f d 2 d 5 d 1 a c e 4 7
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ e r d o u . p e 3 2
C : \ 3 a 1 6 a 2 4 e 3 8 a d c d 8 a 6 c b b c 3 5 8 8 a c d 0 5 7 8 9 4 7 4 6 6 e 2 9 d 7 2 7 9 a 6 0 3 5 7 a e e 0 6 6 2 1 a 2 9 9
C : \ b 4 d 4 f c 2 e 0 d 1 9 5 c b 8 7 9 0 0 4 f 7 e 4 6 e 9 8 d 2 7 5 e 6 7 1 d f 8 3 d d d 0 5 6 1 f 1 9 4 3 b 3 8 1 c c 7 4 4 b 3
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ k d S m w S A 4 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b 9 9 c 6 6 0 c 5 5 d e f 3 6 6 e 2 6 8 c c 4 2 b c 1 9 1 0 8 1 6 8 8 5 b 2 d 4 c a b 5 2 7 6 4 4 b 3 6 3 d b 5 f 1 0 a 8 f 7 2 . e x e
C : \ U s e r s \ a r y a \ A p p D a t a \ L o c a l \ T e m p \ 9 4 f 0 a 0 d d 0 4 7 1 1 7 6 e 4 1 2 f 1 f 7 9 1 3 b f 2 a b a b f a d 5 f c 6 . e x e
C : \ e e a 3 a 8 3 4 4 4 4 5 7 5 4 0 0 4 1 0 5 e 2 8 f 6 f 1 6 9 3 5 3 2 9 2 0 f a e 4 8 4 e 8 4 d 4 8 5 8 c 7 a f b f f 7 a 0 a 3 c
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e r d o u . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ K p h B H 0 g 0 . e x e
C : \ 0 8 3 9 c d 1 a 6 f f d 3 3 0 1 a 8 3 f 3 8 9 4 0 8 2 5 d e c b 7 2 c f 9 5 0 2 3 5 3 7 9 f 2 c e d f 9 0 8 3 f 7 3 8 7 3 4 b 5
C : \ 9 b e 0 7 3 6 e 8 7 4 0 b 7 a 7 9 8 3 f e e c 3 5 d a e 2 d e f 0 d 6 7 b 9 3 c d 1 9 e d f 8 1 9 b c 4 1 c f 9 6 e a b 1 5 9 a
C : \ 2 f 2 8 9 f 6 e e 1 c 9 1 c 7 f a 0 1 1 3 0 f 6 f 6 5 a 3 a 9 2 5 e e 6 9 f 1 b 8 1 9 3 7 c 1 8 b 3 1 c d 8 4 d b b b b 1 0 b 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e r d o u . e x e
C : \ f 8 b 8 1 1 4 5 c d 1 6 9 5 4 0 7 3 a 8 d 2 4 9 5 2 5 4 9 6 4 1 2 6 0 3 7 8 f 2 8 d a 6 8 e f 1 4 1 2 2 c a 5 b 5 9 d 1 0 5 a 6
C : \ b 5 a 9 d c 9 e d b 5 c 4 0 4 4 2 f 8 2 9 a e a 5 0 e 0 5 5 d 6 0 2 a a 3 b 2 a a 0 0 9 6 b e a c 6 5 b 5 a c d 4 6 a 7 8 6 a a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e r d o u . e x e
C : \ d f c 4 9 f c c a 6 d d d 2 c 1 1 9 8 7 1 6 7 d 4 2 4 e d 1 0 f a 6 1 0 d 3 7 0 3 0 8 0 3 8 2 b f 2 b 8 d 1 7 0 c 8 d b 7 4 8 d
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ e r d o u . p e 3 2
C : \ 2 b 4 c 9 2 c 1 5 7 9 b 0 4 b f 6 2 f 1 2 a b a f d 6 b a 4 9 b c 3 1 9 3 2 7 b a f 7 3 6 6 6 6 e 7 3 b 3 4 0 d c 2 5 c 5 2 3 3
C : \ 2 1 c 9 0 f f 4 8 f e 7 2 a a 8 f c 9 d 2 0 8 0 d 0 b 1 c 1 b e b c 9 e e a 8 5 2 1 9 a 0 2 5 2 0 c 3 7 4 f 1 b 9 0 3 3 1 4 4 8
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ e r d o u . p e 3 2
C : \ e 9 2 f f b 3 c b b 2 8 c a 0 1 3 c f 6 5 7 1 f b 1 8 7 3 7 e 5 4 a 5 c 0 3 a c 1 7 d c b 7 7 5 2 6 e 3 3 0 2 6 8 e a 5 c 1 e 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e r d o u . e x e
C : \ 6 8 8 a 3 1 f f 2 2 e d b 0 8 b 5 1 7 6 5 5 b 0 9 d b e 3 d 9 9 a c b 4 e 0 3 a b 8 a 0 7 b c 3 5 7 e 9 8 6 0 9 7 3 7 a 0 3 6 3
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e r d o u . e x e
C : \ b e 6 8 f 9 4 f e 2 9 4 0 1 d b f 0 c 8 6 6 6 d e 4 6 b 0 1 7 5 7 c 5 e 6 a 0 6 a 4 5 a 9 d 4 0 f 8 c f 6 0 1 6 c c c c b 8 0 c
C : \ 2 8 8 f 5 4 9 1 7 6 c 2 c 8 3 b 7 4 2 6 c c d 8 6 c 2 d f 2 d b 0 e e 9 a 0 4 1 e 6 d c 8 3 0 9 5 f 4 e 5 0 4 9 1 5 8 a 8 a e d
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ e r d o u . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ e r d o u . p e 3 2
C : \ f 3 e 8 8 7 4 b 2 2 1 a b 1 5 2 0 b a 9 b e 9 b 7 e a 5 a a 8 a d 8 c f 1 2 8 a d 2 6 5 c a b 3 b b c e a a 7 e e b b 2 7 d c 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e r d o u . e x e
C : \ c a f 5 1 d 4 0 7 f 8 6 b 5 c e 3 f c 4 1 6 1 3 d d d 0 b 7 5 5 e c c 6 6 6 8 f f c 7 8 1 8 1 8 4 5 3 1 6 1 6 c b 8 e 3 f 3 e 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e r d o u . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ e r d o u . p e 3 2
C : \ 8 1 0 3 9 f 6 2 b 1 8 a d 5 3 2 a e 5 5 5 5 9 3 7 1 a 3 6 2 8 7 4 f 5 4 3 9 1 9 a d 4 8 2 7 2 a c 8 4 4 7 d 2 f e 6 b c 4 d 3 5
Process Tree
-
01297d2ada74df7359997f925bfb6e390c2ffb7d5b221571da20050ae5518538.exe (2264)
"C:\Users\Administrator\AppData\Local\Temp\01297d2ada74df7359997f925bfb6e390c2ffb7d5b221571da20050ae5518538.exe"
- erdou.exe (2400) "C:\Users\ADMINI~1\AppData\Local\Temp\erdou.exe"
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | ea18b34cf013664f_erdou.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\erdou.exe |
| Size | 56.0KB |
| Processes | 2264 (01297d2ada74df7359997f925bfb6e390c2ffb7d5b221571da20050ae5518538.exe) |
| Type | MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS |
| MD5 | db39a862d061201bd38492ad5c42dd9e |
| SHA1 | fc60dff58e87828b250eac0bc02dedecce0f2d13 |
| SHA256 | ea18b34cf013664fc6d7415eb826157d84ae1e16ef962f791836f69da98210ef |
| CRC32 | 68C9A3C1 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.