3.6
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.57
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Agent-ASIP [Trj] | 20200217 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Downloader.Small.ck | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200217 | 2013.8.14.323 |
| McAfee | Downloader-FVF!CE6054F30B91 | 20200217 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b07980 | 20200217 | 1.0.0.1 |
静态指标
检查进程是否被调试器调试
(2 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545293.796625 IsDebuggerPresent |
failed | 0 | 0 | |
|
1727545294.28125 IsDebuggerPresent |
failed | 0 | 0 |
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(3 个事件)
| section | .MPRESS1 |
| section | .MPRESS2 |
| section | .imports |
动态指标
提取了一个或多个潜在有趣的缓冲区，这些缓冲区通常包含注入的代码、配置数据等。
分配可读-可写-可执行内存（通常用于自解压）
(6 个事件)
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\hhcbrnaff.exe |
投放一个二进制文件并执行它
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\hhcbrnaff.exe |
一个进程创建了一个隐藏窗口
(1 个事件)
检查适配器地址以检测虚拟网络接口
(50 out of 1456 个事件)
网络通信
一个或多个缓冲区包含嵌入的PE文件
(1 个事件)
| buffer | Buffer with sha1: 0d22af1d0d72870672eb36e666f9a5eb8cd9dd43 |
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
在用户文件夹中创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\hhcbrnaff.exe |
文件已被 VirusTotal 上 58 个反病毒引擎识别为恶意
(50 out of 58 个事件)
| ALYac | Trojan.Ppatre.Gen.1 |
| APEX | Malicious |
| AVG | Win32:Agent-ASIP [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.Ppatre.Gen.1 |
| AhnLab-V3 | Trojan/Win32.Agent.C2589213 |
| Antiy-AVL | Trojan/Win32.AGeneric |
| Arcabit | Trojan.Ppatre.Gen.1 |
| Avast | Win32:Agent-ASIP [Trj] |
| Avira | TR/Spy.Zbot.amoan |
| Baidu | Win32.Trojan-Downloader.Small.ck |
| BitDefender | Trojan.Ppatre.Gen.1 |
| BitDefenderTheta | Gen:NN.ZexaF.34090.eq3@aSt9fnc |
| CAT-QuickHeal | Trojan.GenericCS.S6402929 |
| ClamAV | Win.Downloader.Upatre-5744087-0 |
| Comodo | TrojWare.Win32.TrojanDownloader.Small.APVL@8cytsl |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.30b91d |
| Cylance | Unsafe |
| Cyren | W32/Upatre.JQ.gen!Eldorado |
| DrWeb | Trojan.DownLoad3.28161 |
| ESET-NOD32 | Win32/TrojanDownloader.Small.AAB |
| Emsisoft | Trojan.Ppatre.Gen.1 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Upatre.JQ.gen!Eldorado |
| F-Secure | Trojan.TR/Spy.Zbot.amoan |
| FireEye | Generic.mg.ce6054f30b91db37 |
| Fortinet | W32/Agent.AEJB!tr |
| GData | Trojan.Ppatre.Gen.1 |
| Ikarus | Trojan-PWS.Win32.Fareit |
| Invincea | heuristic |
| Jiangmin | Trojan/Agent.hnzm |
| K7AntiVirus | Trojan ( 0052964f1 ) |
| K7GW | Trojan ( 0052964f1 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| MAX | malware (ai score=81) |
| Malwarebytes | Trojan.Upatre.Generic |
| MaxSecure | Trojan.Upatre.Gen |
| McAfee | Downloader-FVF!CE6054F30B91 |
| McAfee-GW-Edition | BehavesLike.Win32.Cutwail.lz |
| MicroWorld-eScan | Trojan.Ppatre.Gen.1 |
| Microsoft | TrojanDownloader:Win32/Upatre.A |
| NANO-Antivirus | Trojan.Win32.DownLoad3.clryhy |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM19.1.4D57.Malware.Gen |
| Rising | Spyware.Zbot!8.16B (TFE:dGZlOgJ3QL8LmQCxzQ) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/Agent-BCMT |
| Tencent | Malware.Win32.Gencirc.10b07980 |
连接到不再响应请求的 IP 地址（合法服务通常会保持运行）
(2 个事件)
| dead_host | 156.254.147.137:443 |
| dead_host | 124.225.27.61:80 |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2013-10-28 20:23:24
PE Imphash
bb9a68197a2dda6c8411f08fed623690
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .MPRESS1 | 0x00001000 | 0x00006000 | 0x00006000 | 3.4191889024472206 |
| .MPRESS2 | 0x00007000 | 0x00001000 | 0x00000400 | 6.08964226056419 |
| .rsrc | 0x00008000 | 0x00002000 | 0x00001600 | 5.021704654870794 |
| .imports | 0x0000a000 | 0x00001000 | 0x00000200 | 3.511396965723055 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x00008078 | 0x00000ea8 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_DIALOG | 0x00006020 | 0x000000e8 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_GROUP_ICON | 0x00008fa0 | 0x00000014 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_VERSION | 0x00008ff4 | 0x00000324 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_MANIFEST | 0x00009358 | 0x00000193 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
Imports
Library kernel32.dll:
• 0x4040b0 ExitProcess
• 0x4040b4 FreeLibrary
• 0x4040b8 GetModuleHandleA
• 0x4040bc GetProcAddress
• 0x4040c0 HeapCreate
• 0x4040c4 HeapAlloc
Library Winmm.dll:
• 0x40421c mciSendStringA
Library Msacm32.dll:
• 0x4041fc acmStreamOpen
Library user32.dll:
• 0x40414c LoadIconA
• 0x404150 LoadCursorA
• 0x404154 RegisterClassA
• 0x404158 CreateWindowExA
• 0x40415c GetMessageA
• 0x404160 DispatchMessageA
• 0x404164 DefWindowProcA
• 0x404168 PostQuitMessage
L!Win32 .EXE.
.MPRESS1
.MPRESS2
.imports
f?MZue
W<f:PEuYUBx
D$(D$,
1P>?GFFP
kernel32.dll
ExitProcess
FreeLibrary
GetModuleHandleA
GetProcAddress
HeapCreate
HeapAlloc
Winmm.dll
mciSendStringA
Msacm32.dll
acmStreamOpen
Luser32.dll
LoadIconA
LoadCursorA
RegisterClassA
CreateWindowExA
GetMessageA
DispatchMessageA
DefWindowProcA
PostQuitMessage
8Muex<
KERNEL32
VirtualProtect
G(XPTPjxWXt=
open waveaudio
TranslateMessage
LoadLibraryExA
user32.dll
GetModuleHandleA
GetProcAddress
KERNEL32.DLL
Winmm.dll
mciSendStringA
Msacm32.dll
acmStreamOpen
user32.dll
LoadIconA
t7Kt'Kt
Ms%0q0
%0q0`%0
$0n%00
%0Rich
#######
###;KK>
26;2+##########
#########
#####+bEXL
+######+
#####3
######3#
PD[>J22Ib|tLx63
#######3#>>
vDDP>2
########3+ug
DW[[FvV####
########3#J~~3#5gJIk#
3333333333+g +zT
##++++######
3333333333#J%Tz+33#3333######
33333333333+
#3#############
33333333333@II#3#3###########
33333333333@+333##3#########
33333333@?a
+23333##3#######
332@j+23333333#######
j@33333333#######
2+jj23333333333####
$2+I@33333333333##
$$$$$2+@2333333333#
$$$$$$$
al2333333333
$$$233333333
C&SCCCSCS&&&&
&&&&$$
7:::::::****************ss****@$$$$$
788888881;111n;;;11p;11111111;
))))))
o,,,,,,,L6,6Lr66rq6,,,,,,,E
)f/HHHH/
8(((((,Lx|>>Eq6,(,((,EM&/-999N/
K((((((XmV#R?DlV((((((EMC/N9<<<<<
,444444X|JJVT
DRmXF4444F4VMC-9<UUU
(444444X3?
DPIDP#F04440tM
4000000y2WIWRIuRI
0000050
5y{kkJ0? D~`f9f
0%%%%%%_
3^%%%%%y`f\f#
%%%%%%%%^_a%G_a%%G=%%%%%%^`f\f#
%%%%%%%%%BB%%%BB%GG%BB%GGGGG%G`f
G.......'''''''''''''''''''''.
-----------------d-)/
&&&&$$$&
$$$$$$$
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
TEE ,EM
E-BFSOE
E-CFSOE
E-5=bE
kernel32.dll
ExitProcess
FreeLibrary
GetModuleHandleA
GetProcAddress
HeapCreate
HeapAlloc
Winmm.dll
mciSendStringA
Msacm32.dll
acmStreamOpen
user32.dll
LoadIconA
LoadCursorA
RegisterClassA
CreateWindowExA
GetMessageA
DispatchMessageA
DefWindowProcA
PostQuitMessage
A b o u t
M S S a n s S e r i f
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 8 0 0 0 0 2 5
C o m m e n t s
C o m p a n y N a m e
M S C o r p o r a t i o n
F i l e D e s c r s i p t i o n
n o t e . e x e
F i l e V e r s i o n
2 . 0 . 0 . 2
I n t e r n a l N a m e
n o t e . e x e
L e g a l C o p y r i g h t
C o p y r i g h t ( C ) 2 0 0 5
L e g a l T r a d e m a r k s
O r i g i n a l F i l e n a m e
n o t e . e x e
P r i v a t e B u i l d
P r o d u c t N a m e
P r o d u c t V e r s i o n
3 . 0 . 0 . 3
S p e c i a l B u i l d
V a r F i l e I n f o
T r a n s l a t i o n
C : \ U s e r s \ L i s a \ D e s k t o p \ B v Z H y i v D . e x e
C : \ E 0 k p _ k M P . e x e
C : \ f 1 f b b 1 3 b 2 8 4 f 6 b f d 8 e e 3 1 e 2 5 8 0 9 4 f 0 c 7 5 e 6 d e 8 6 f 8 1 4 c e d 4 4 3 2 d f 1 b e 7 a 5 c a b 2 9 8
C : \ U s e r s \ L i s a \ D e s k t o p \ v d x f C K i G . e x e
C : \ f 4 6 f 1 c b 3 9 a 4 3 3 9 8 8 3 b 7 9 e c 1 2 f a b 8 9 d 1 5 2 9 a 7 0 d 8 0 f f 6 6 3 d b 9 4 8 c 5 d 8 6 a c 9 4 b e e 9 6
C : \ 7 7 4 1 e 8 6 0 a 5 3 0 7 9 7 e f 1 3 6 3 3 7 b 7 e f 7 a 5 a 7 a b a 2 d b a d 8 a f a 8 9 8 7 d 4 0 a b b e 7 1 3 a 8 8 6 a 6
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ c 0 e 4 1 3 3 e a c e 7 4 5 c 0 0 b 8 f 5 e d d 4 6 e 4 1 9 0 6 2 7 a f b b c 4 b 8 8 4 7 6 8 0 1 e 1 3 1 0 8 3 7 1 4 c 7 1 d d . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ U A x k k 1 B 3 . e x e
C : \ 9 5 5 5 e c c 1 1 1 4 7 0 b 7 6 4 4 0 1 7 6 8 8 d 2 0 8 6 6 d 9 b 4 d f 8 2 b 1 5 0 b 6 3 3 7 6 7 2 d 3 e 8 f 9 0 a d e b 0 b 9
C : \ P 0 M u p l A p . e x e
C : \ 8 b a f e 5 f b e 1 2 1 d e c a 7 0 9 8 a 8 7 c 9 1 c 6 8 9 e 6 e 9 d 7 f b b 1 5 a 8 2 6 1 f e 2 e 2 d f 0 a 3 f d 3 b 8 b f 8
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ X v P j q x Z b . e x e
C : \ 5 e 6 6 1 7 4 4 9 b d b c 6 2 5 f 4 9 2 e 9 1 1 c 2 e e a 1 1 2 3 c 8 6 5 a f 0 d 5 b 5 d e 2 a 0 c 7 6 2 2 8 2 f 6 3 0 0 5 d 4
C : \ c 0 a 3 9 9 9 e f 3 6 5 e 9 d 1 e 5 c 3 4 d 6 3 6 2 b f 5 2 6 c 9 a 5 c f 2 b 1 6 f 1 6 a 7 6 c b 9 9 3 c 3 6 6 1 a 4 b 7 4 c 7
C : \ k j i h 1 o A 7 . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ p D 0 H j 5 D 2 . e x e
C : \ K W N o O D s h . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ q e F l V O b q . e x e
C : \ 8 r A Z X O E 5 . e x e
C : \ b e 0 2 4 3 5 3 b 4 0 9 1 e 8 b 6 b 3 e 4 0 b 2 8 1 2 7 6 0 9 2 2 0 3 c 8 a a 9 f 4 7 f 4 b 8 c 3 3 1 f 6 c 0 8 0 d 6 e 9 8 3 1
C : \ 1 e 0 c 4 3 3 8 9 9 f 0 1 1 3 f 5 b 1 2 3 d 6 c e f 5 0 8 d 0 8 2 3 4 7 b f b b f f b 4 0 5 a b a 7 0 8 0 e 1 0 e c f 7 6 a 0 9
C : \ U s e r s \ L i s a \ D e s k t o p \ R X 0 w s B k c . e x e
C : \ 4 j 3 8 J j B t . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ P d 0 0 q n 1 4 . e x e
C : \ 4 g z g o Z 3 e . e x e
C : \ e 0 2 6 f a 6 2 f 5 6 9 6 8 6 e a d 4 5 e f 7 8 0 9 2 d 9 0 e f a c 7 e 4 c 9 4 5 4 8 2 1 5 4 7 d 7 c 4 d 6 6 d 0 4 f 3 e 2 4 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ q M R I w G M O . e x e
C : \ m 3 K 4 R p 0 1 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ G 6 b n 1 f a N . e x e
C : \ 2 8 e 3 7 4 7 8 5 d 7 0 8 e 2 6 7 d 3 8 c 8 6 5 e a 0 6 d d 1 4 6 9 e 8 3 3 e 3 f 3 b a 1 a c 1 0 5 9 2 c 8 a 2 6 b e f 5 6 7 d
C : \ b 9 6 0 9 0 6 7 3 2 c 9 4 2 2 f 4 3 2 9 0 8 f 7 2 d 4 2 a 4 c d d f 0 5 1 3 c a 1 f 2 e 9 9 1 1 b c c 0 1 3 d 1 e 3 a f 5 2 a 7
C : \ 5 c 9 d b 3 7 6 5 8 0 c 5 0 b 2 3 d 0 3 0 6 b d 5 4 2 e 5 0 b 7 e 3 6 3 3 b c 1 8 f 3 2 f 4 6 5 0 4 5 a a 9 7 1 6 c f a 8 d 2 a
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ k P J U y B i R . e x e
c : \ t a s k \ 0 8 0 C 9 7 8 E 2 8 6 5 3 6 8 3 8 A 2 F 8 C 4 F E 5 7 A 7 3 0 B . e x e
c : \ t a s k \ 9 4 5 1 C 4 D 0 8 3 2 4 6 8 6 B 2 0 E C 9 C 5 F 1 6 E 6 2 7 3 B . e x e
C : \ 0 2 6 2 5 6 1 9 4 d 7 b 5 1 0 f 1 1 a 2 f 6 0 c 7 3 2 b 1 9 4 9 8 a 3 3 2 0 2 0 0 a c 3 a f f c 1 3 e 2 2 c 9 f 3 5 d c 1 2 4 5
C : \ P Z C C A g b t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ 9 b d 5 f d 3 e 4 1 b f 4 9 b 1 5 b 9 e 7 f c 0 f f b 7 d f a c 0 c e e 9 1 7 5 b 5 e 9 e 7 8 a 5 8 6 f 7 c f 4 e 4 6 f 9 2 1 4
C : \ 3 d 1 e 3 3 1 2 0 4 e 4 8 d b 5 8 1 2 e 9 c 5 8 e 5 c 7 0 b d 3 8 a c b d 4 6 b f 5 e b b 1 7 6 0 c 8 b e 0 c 8 4 e 2 f d 4 d 2
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ z s z 1 5 U B 0 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ 8 c 9 7 5 5 c b 9 4 a b 1 2 e 0 2 1 b b 1 e 1 1 5 5 6 1 6 e c 2 f 1 9 4 8 f 9 f e e 3 c c b b a c f f 9 4 b a 4 b 5 1 5 b 1 3 3
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ 1 8 7 5 e 9 4 1 3 3 8 7 a b b e f a e 5 3 7 2 3 a d 6 6 f 3 4 0 4 5 2 9 a 7 6 7 c 5 9 e 8 6 6 b 1 c e 0 f 6 8 2 d 3 d 8 b 2 2 0
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ B Y y t O I E c . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ 6 a 6 9 b b d 7 c 2 9 9 a 2 0 c a d 5 8 d 0 b 5 e 0 9 2 b 4 0 b 2 5 0 2 4 0 8 6 e 9 a 1 3 2 6 d a 3 4 b 4 2 3 e 2 0 6 f 3 7 a 9
C : \ c 4 b e 2 6 1 d 6 0 f c e 2 0 f 7 b 5 c 0 f 3 3 d 5 6 9 e d 5 7 c a 5 9 7 6 7 e 4 7 7 b e f b f 9 e 6 8 6 6 6 1 a e 5 8 a c 4 0
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ e a d d 7 2 a 6 6 e c 2 3 1 f 0 b 4 4 c 0 9 2 7 a 5 e 5 2 5 0 4 9 e c 6 a 7 6 f 1 f e e c 9 5 6 4 4 a 3 3 3 0 a c 0 a 1 0 6 f 9
C : \ 1 9 8 7 a e 3 6 c 1 b c d 6 d 2 b 4 1 4 6 5 4 7 b 5 e 2 b 8 e 5 7 c 9 5 5 c 6 4 0 1 b 1 1 d f e c 3 6 a b a f 6 7 6 6 6 c 0 8 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ n X H 1 F 7 1 6 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ 7 a 9 4 2 c 0 2 7 0 4 6 1 9 c 9 e 7 4 9 0 7 8 f c 4 e 5 1 2 3 3 3 6 9 6 7 e 7 0 f 3 0 3 5 1 4 c 7 b 8 a 6 6 e 6 9 3 a 3 d 1 6 6
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 3 5 1 b c 6 b 7 9 2 d 2 1 4 1 a 7 6 3 a a 9 9 5 7 b 1 e 6 9 1 f 5 0 1 3 3 4 3 2 6 e b 4 8 c 4 3 c 3 9 2 5 4 f 8 8 3 8 d f 4 b 3 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ 4 0 9 e a 6 4 9 a f b e c 4 c f 7 f c b a 6 e 9 0 7 f 4 1 7 6 a 4 7 2 e 2 5 1 0 c 1 e 2 2 f 9 4 1 1 5 a 9 4 c 6 8 e 8 2 d 9 c 6
C : \ 2 e e 0 a 7 f 1 b 6 6 3 1 a 5 4 2 b 5 2 6 9 1 c d 8 8 0 6 a c d 3 4 d 3 8 4 1 d 0 d 4 0 a 1 a 1 2 1 a 7 4 d 4 1 f 8 2 2 d 5 7 6
C : \ 0 f 2 6 7 e 3 e 3 4 c 0 6 8 f 9 6 6 5 a f c 6 a a f 4 4 1 2 b f d 3 f e 2 8 7 7 4 2 c f e d e 5 b d a e 7 2 d 5 d 9 3 d 9 1 1 3
C : \ a a a a a f 8 b e d 0 c c e a 6 e 6 e 1 2 5 0 7 4 2 1 c 7 0 5 7 8 b f b 1 3 1 d d 6 5 d 6 8 1 8 7 8 b b 3 b 6 c e 0 e 0 1 4 7 f
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ t O u h H h 4 G . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ 2 x 2 V R j L 6 . e x e
C : \ L x 1 S _ 7 y C . e x e
C : \ 1 d 9 8 6 5 2 b a 4 5 d d 6 9 a d 9 7 3 f 8 5 0 6 0 4 c 9 d 2 b c 6 b 4 6 0 f 0 a 2 4 9 a 5 1 b e 3 4 d f e 2 7 8 9 4 9 4 f 5 a
C : \ 9 4 3 c f 9 3 3 d e 8 d b c 2 1 7 b 5 2 2 e f 4 8 3 8 e 7 8 8 b 0 3 0 7 1 d 5 8 5 0 3 b d 0 2 2 1 6 4 c 5 6 d 1 7 3 7 0 0 6 5 e
C : \ U s e r s \ L i s a \ D e s k t o p \ j R p v 7 9 0 h . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ B m S o H 6 f o . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ f 5 b 2 4 f a a b 9 4 5 5 f d 5 3 7 7 6 6 7 8 4 c b 9 c a e 7 f a 6 b 9 1 f 4 e c b d 6 1 2 8 c e 6 a f 2 5 7 b 6 4 5 b 3 8 4 e
C : \ Y K W 3 B b p T . e x e
C : \ 7 3 c f a 2 1 2 e 5 c 0 3 9 1 2 c 4 f a 1 6 5 5 3 2 3 a e 9 1 d 2 6 a a 0 0 a 8 e e 5 8 4 e 6 2 6 0 3 7 1 5 8 0 0 8 4 1 c a a 6
C : \ y I 4 _ 2 6 E b . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ d 6 f d 3 8 b 4 f 2 6 5 c 9 d 7 9 a c 6 0 7 c e e f a f 7 1 8 4 b 5 3 a 9 d e 2 1 d 3 f e b b 7 9 b 3 0 5 3 0 4 0 4 b 5 a 5 a 6
C : \ c T X b R i h I . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ 4 8 3 9 b 4 f 7 d 6 7 9 a b 5 f 8 3 1 a . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ 3 6 0 7 6 a a 5 6 7 4 b 9 f 9 9 5 3 8 6 c 2 d 1 d 1 c 8 e d 8 7 6 2 b 2 5 b 1 5 8 5 7 0 d d 5 2 e 6 5 9 5 6 1 5 0 9 1 a 7 b e 1
C : \ b 8 e 3 0 d 6 8 e 3 0 7 e 1 1 3 f e 4 2 9 b 9 9 9 4 7 a 3 1 3 d a f 9 4 4 6 b 6 3 1 a c d 0 f f a c 3 b 9 b 5 e 9 b 9 d 7 6 5 a
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ V C P I 4 G I k . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ b 0 8 8 e 1 9 d 1 d 2 c 5 a 2 9 7 1 5 e 7 1 c 0 9 8 8 e f a 7 a 7 f 2 9 6 5 9 8 a c 9 5 5 d e 2 6 4 c 5 9 8 d 7 2 b e 9 b 8 3 b
C : \ z M n y _ W m r . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ 7 d b b b a 9 0 f d e 0 1 a 4 6 e c 9 b d 2 4 0 b c 7 4 0 b b 4 1 3 f 1 0 7 9 7 f 4 1 d f 8 c f 4 3 0 9 3 f e 7 4 f 0 f b 9 1 f
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ X M 5 C d 5 N 7 . e x e
C : \ U s e r s \ A d m i n i s t r a t o r \ A p p D a t a \ L o c a l \ T e m p \ h L L w M q b . e x e
C : \ U s e r s \ R A 4 9 1 ~ 1 . V U L \ A p p D a t a \ L o c a l \ T e m p \ f 8 3 3 6 8 e 8 8 5 7 9 d 6 e 7 e 4 d 0 8 3 e c e c a c 2 4 e 5 . v i r u s
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ v u J 8 M l I M . e x e
C : \ 0 7 0 0 0 e 4 6 4 5 7 d d 5 e 0 e b d 8 e 9 6 5 d 4 e 1 5 e 4 a 6 e 9 4 6 7 f 3 3 f e 8 6 3 b e 2 5 6 5 b d f a 7 0 3 d b 8 2 5
C : \ b 2 4 c 4 1 3 f 4 7 a 4 6 0 c 0 e f 5 9 f d 5 a 2 3 e b 6 b 9 a 2 2 a 9 7 a b d e 3 f 6 8 7 c e 5 e 0 3 e 0 1 3 8 e b 2 d 8 1 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ f 5 a 4 m L 0 C . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 2 5 c a 1 a b b b e 7 f 6 6 4 d 5 3 4 4 6 f 3 7 e 2 9 2 8 e d 5 0 0 e 0 4 0 f d 1 9 c 9 b 2 d 2 b e f 1 5 d 4 0 8 6 3 2 8 8 8 e . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ P J K R 7 U D K . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 1 1 c 5 0 b 3 6 c 9 7 9 e 3 b e _ h h c b r n a f f . e x e
C : \ 8 a 4 7 7 2 b 6 a 5 7 5 1 3 e 3 b 5 a 8 4 6 5 5 4 c 3 7 0 7 c 5 c 8 8 6 7 f 7 7 e 1 a e f 6 6 8 3 9 1 4 d 5 1 d 3 6 7 1 c c 7 a
C : \ 9 7 0 2 e 5 1 2 b 6 b b 4 5 5 e 2 c 3 b c 6 0 0 4 6 5 5 3 f 9 3 9 0 b 5 4 2 a 6 0 5 f f d b a 8 1 5 8 6 b 5 b a c 0 b e 0 c 2 3
C : \ 5 4 b 0 f 7 2 d 7 a 8 d 0 2 0 6 7 c 6 2 e e 8 9 3 8 b d 0 2 8 c 3 6 c a e 3 8 c f f 1 9 5 4 1 4 d f a 8 e c 5 c b 1 a 3 3 3 8 6
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ S D t Y 5 c R j . e x e
C : \ 0 4 8 d 6 2 9 0 3 7 a 5 e 6 3 a 4 9 9 1 e 2 8 9 8 c d 3 1 2 f 5 e b 6 0 e 7 a 5 e 1 b 2 8 9 a 3 d 6 8 b 2 c b 0 3 a c 7 6 8 a 1
C : \ U s e r s \ L i s a \ D e s k t o p \ 1 q a X E p F S . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c 7 8 1 6 b d 1 3 1 a 4 e 1 d 8 b 5 f 3 e a b b d d 9 c e f 9 b 1 3 6 e d 3 e 5 d b f 4 a 8 b b c a 9 6 5 1 3 b 1 f f 3 5 7 7 6 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 3 4 8 2 d a 2 2 d 2 4 8 f 5 c 3 _ h h c b r n a f f . e x e
C : \ f 7 5 3 e d d d 9 e 1 5 c 5 1 1 3 4 c b 0 7 e 4 e b 7 0 a d c 3 3 c d 9 5 e b e 9 0 5 b 0 f 6 e 9 2 b 1 4 3 7 4 2 0 7 b 4 2 b 1
C : \ 3 8 e 3 7 8 8 0 0 2 0 3 0 e b 7 6 7 7 6 7 8 9 c 9 d 8 5 f 3 2 d 3 d c 5 d 1 6 f e 3 5 1 6 2 5 d e a b b b 4 b 7 5 5 a 5 3 7 4 b
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ l 1 S I s 1 V T . e x e
C : \ 3 2 f 7 5 1 8 9 4 c 9 a 5 9 e 1 4 9 4 6 2 c f 0 5 0 9 f a 2 7 1 e d f 2 3 6 6 b 7 b 1 0 b 6 a 4 6 1 3 0 3 9 f c 5 6 6 a 2 a c 5
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ i c Y x a L Q n . e x e
C : \ 4 3 4 9 4 6 f 7 a 9 0 8 c 5 8 8 e 7 2 e 2 d 5 0 d 9 e 6 f 5 d 6 1 7 a 3 b 4 c f 6 a 8 0 a f 2 8 4 f c 4 6 a 4 8 a e b b 1 7 7 1
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 0 Q P i w N F S . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f 9 5 6 c 1 b c 7 a d 5 1 e 8 8 7 0 f 6 d 0 a 4 1 e e e 4 1 c 3 e b d 4 a 1 0 2 8 8 f d c 7 b 9 a 4 7 e 7 c e e 8 9 d a e 9 4 1 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ d 8 5 a f 8 5 f 9 6 e 9 d 0 a 4 5 c 3 e a 8 b 3 b 3 7 5 3 b f 1 c 6 d 8 1 c 9 e 1 8 7 5 7 e 7 4 e 1 7 f 0 9 a f d 6 1 9 2 4 a 2
C : \ b b a 5 9 1 e f a 2 6 e b 5 0 a 0 f d f 5 0 6 5 e 8 4 b a c 6 e 1 0 2 b 5 1 7 8 c e 0 1 1 4 6 0 0 a 9 3 e 5 f 5 e f e b 8 2 2 e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ B s X l z 8 q 1 . e x e
C : \ 9 1 f 1 f 5 a 9 e 2 a 9 a f 2 6 7 6 7 a d 9 3 7 4 4 0 b e f 6 8 f b 3 e f 0 0 a 3 6 5 1 e 2 6 d 0 5 e 1 6 3 8 7 b b 4 9 9 4 3 f
C : \ 8 4 c 5 6 1 4 a 6 f c 7 f 2 7 a 3 b f b 8 2 2 c 0 8 3 7 3 9 a 7 4 1 e d f e 3 4 4 f 2 6 9 3 5 1 9 c 3 3 b 6 b 2 7 3 b d 8 5 6 1
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ s M a k z o D 4 . e x e
C : \ 0 f 7 c 6 0 c 5 9 5 f 7 d f 6 6 8 a 2 a a 2 5 6 d f a 0 0 2 b 1 1 e 6 0 e b b c b a 9 4 9 8 b e b 9 9 4 f 5 1 f 9 f 8 8 8 0 9 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ r R z 2 S R m Q . e x e
C : \ 4 0 f f d 3 4 c 6 8 9 1 d e 4 8 9 a c f 3 9 b f a 4 b 5 2 8 7 2 2 1 1 0 6 b 9 0 1 5 c c a b e a e f 5 d 3 a 8 0 a b 4 3 8 3 7 f
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 9 9 h g l w M b . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ O T Y d l k D I . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ b 9 e f f a 7 2 3 b e 2 4 a 4 5 c e 2 e f c c 5 c f e a f f f 9 d 6 4 3 a c 9 6 0 f 2 2 7 c 9 d 5 5 d 8 d 6 d f 9 e 1 1 a 2 0 9
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ f d 7 d 2 7 5 6 e 0 a c 0 d f 9 a 1 c 3 f 0 f e 4 4 1 b 5 e a c 3 1 6 2 d 4 d 1 5 0 5 1 5 a e c 9 0 f a f b c e f 7 b b c 0 a c
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ 8 5 3 9 5 6 3 a f 9 e 6 a d d e a b 5 f c 7 9 6 0 e d a 1 4 5 0 f 2 7 b d 0 a 1 d f f f 9 d 1 c 7 1 e e d d 4 4 4 b 0 a 3 b e b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 9 9 3 6 1 1 e f 7 8 4 b b 9 8 2 _ h h c b r n a f f . e x e
C : \ b 9 6 0 e a 9 c 1 7 1 0 8 f e 5 0 4 0 e 7 f 0 0 6 d b a 3 d f a 6 8 d 0 9 0 6 a d 0 b 4 f c a 2 b 3 e 9 9 5 b e 4 6 0 8 c 1 2 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ i y 8 K V h X s . e x e
C : \ 3 a 0 0 f 1 4 0 a f 4 a 1 6 3 1 a 6 4 0 0 a 2 5 0 6 6 b 3 1 e 4 4 f f a d a c 8 9 e 7 d 3 0 d 6 c d e 4 8 a f 0 7 9 f 9 0 3 e c
C : \ 1 c 2 7 d 3 0 1 b d 4 6 b 8 0 3 3 1 4 0 5 2 0 5 a a 7 1 4 f 0 d f 2 0 2 c a 3 2 d d 9 5 8 4 9 5 4 2 4 9 2 5 b 6 9 9 e 6 a 2 f e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 1 7 6 0 f 8 f 6 e 8 c b b b 1 7 _ h h c b r n a f f . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ v g G 9 q S I M . e x e
C : \ 6 0 0 8 0 f b 2 c 3 f 5 4 4 4 1 6 8 d 3 5 9 9 a 4 b e f 4 d 2 b d 0 5 1 b 8 9 1 4 5 1 2 e d e 7 9 b 6 b f 1 c f 2 0 2 3 8 6 5 4
C : \ 4 c 9 6 e 5 5 d b a 3 2 0 8 3 2 e b 6 a 8 b d e 9 7 7 8 6 2 1 c 4 b 3 8 0 4 d 4 6 7 a e 8 c 5 a 7 a a 6 1 c d 4 b 4 3 2 3 6 e b
C : \ e 9 a 8 e c d 1 3 3 d a e b 0 c e a d 4 2 0 d f 1 2 a 7 2 e 5 1 9 a 4 d a 9 5 2 e f 3 0 3 e e a 3 2 4 3 e 1 3 9 9 5 9 f d 9 b c
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 0 0 4 a 0 c d 1 1 6 f 5 6 2 7 2 7 2 f a f c 8 b d 7 5 3 1 7 0 9 1 5 b 1 f 5 a 4 e c e 8 f 7 4 8 c 1 a 7 1 1 f f 7 b 0 1 d 7 5 a
C : \ 8 6 2 3 6 1 2 d b 1 4 8 3 9 c 4 e 5 e a f f d 6 7 8 6 b 8 0 b d d 2 5 a b a 8 a 2 3 6 2 8 5 8 d 7 e f 1 6 d b a 7 0 3 7 1 d c 8
C : \ a 0 5 7 7 5 f 7 5 4 a 6 6 2 9 7 6 f 5 3 7 c 0 6 1 3 c 3 9 9 7 0 5 e 5 2 b 0 c 2 1 b e 0 9 a 6 d 1 4 6 9 c 2 0 1 d 8 4 2 2 1 f a
C : \ 3 1 7 5 2 3 9 f 0 8 8 b e 1 3 4 3 0 0 f 1 1 6 c c d d a 9 8 2 2 c 7 2 0 d a e d 8 4 b 3 9 6 5 0 2 6 c 4 7 8 2 1 d 5 1 5 4 2 5 a
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b 8 7 2 6 0 8 6 f d 6 5 6 d 3 5 _ h h c b r n a f f . e x e
C : \ 3 0 9 7 6 4 7 e 8 5 3 6 6 a e 0 5 5 d 4 b 2 8 7 c 0 0 1 f c b 1 b 9 5 9 9 4 4 1 e d 8 e d 3 6 9 5 2 9 9 9 0 9 c 0 e c 0 e e f 8
C : \ 5 4 9 1 a e 9 0 b d 9 e 0 b 3 3 8 e 0 2 2 7 e d 5 d a 0 5 4 6 2 1 1 e 2 9 7 c 8 6 3 7 a 6 d b 3 e a f d b 0 0 9 5 8 b d 8 7 2 a
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ X 4 x D R h M B . e x e
C : \ 9 7 e e e 7 e 9 7 b f 9 f 6 c 9 0 3 c f 7 0 3 8 f 3 3 e 6 1 6 a 3 b b 8 3 d a d d 6 d 3 6 8 6 b 9 f 5 6 3 f c 1 6 2 7 8 7 b a 1
C : \ d 7 d 3 f 2 6 0 4 9 2 8 e e 6 1 8 d 9 b c e 6 3 a d e 6 0 7 e 5 2 d 1 a 9 e 6 f 9 0 d e b 5 4 d 3 e 1 1 f d 8 4 8 3 6 8 f 8 3 9
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ I X D m P E u 8 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ d 6 5 7 5 6 9 a 1 3 0 a a 3 5 b 2 b 3 a 5 e 1 c d 3 2 2 c 2 2 a 1 c b 7 c f 4 5 2 b a b 3 c 1 1 b 1 9 9 2 b b c e 5 d e 3 4 1 0
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 8 S Z 5 l d n g . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ l A S g l x T 9 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 4 2 5 F c t e E . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ y l B u S I A R . e x e
C : \ 3 0 6 f a 0 a 6 4 e 8 a 9 d 5 3 e b a 1 1 b 9 4 d 6 1 c 2 4 a c 8 1 6 e a 7 2 2 a d 9 7 3 4 5 e 2 5 1 9 d 7 9 3 0 7 0 4 b e 3 d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 1 4 4 d 3 7 0 f 4 b d 2 a b a e 7 e 2 0 e 2 a 3 1 f e 8 f 4 8 1 b f b 5 3 0 b c d 2 e a 6 6 9 c b c f 3 3 9 c 1 6 c a e e 3 3 a
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ L N 1 Y i P Z d . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ 1 8 5 7 b d e d 3 b 2 9 d 5 8 0 7 8 8 7 e 9 7 7 a 0 4 1 9 9 a 9 9 e f 6 a c e c 0 c e 5 e 5 7 3 b 2 f 7 4 2 6 1 0 e 5 2 4 1 7 9
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ D 6 3 x E 0 C h . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ 5 8 6 f b 4 f 4 b 8 7 1 f b 7 0 4 5 e 0 a 7 7 5 a 5 d b c 9 1 5 7 2 f f 8 0 3 4 5 a d a 9 a 7 c 3 b 3 0 4 d 2 f 5 c e d 0 1 6 f
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ 3 d 1 b d 7 2 a 4 0 1 0 4 4 9 9 7 e a b 8 4 f 7 5 4 6 7 4 f 9 0 4 1 7 e a 8 b 5 1 a 2 d 1 f 8 f 5 4 7 9 8 6 6 f 6 4 7 d b 4 9 1
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ P 4 G q 7 A 2 y . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 0 f 0 c 8 4 1 2 d 3 7 a 4 c 2 2 0 4 2 a 4 4 9 7 a d 8 4 1 e 8 4 7 5 3 d 7 2 f 6 b 9 c 1 3 c 1 d 8 e 6 a 5 c 0 3 7 9 5 3 2 f 8 1 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d 7 4 b 6 0 0 5 e d e 5 c 8 9 b _ h h c b r n a f f . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 1 9 8 e 7 d 4 c 7 8 4 7 6 b f b _ h h c b r n a f f . e x e
C : \ 1 9 c 1 4 9 9 9 e 6 6 5 d 1 7 9 c 9 a 6 c 5 5 2 b 0 e c d 8 e 9 e 3 1 4 4 3 7 4 7 b 2 9 6 f c d 9 a a e 9 4 7 8 0 7 a e 4 3 0 5
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a 9 b e 1 7 8 0 1 6 b d c 1 a 6 _ h h c b r n a f f . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ v J z g 4 W w y . e x e
C : \ 0 8 f b 5 0 7 f d e b a b b 3 d f d d 1 3 5 6 7 b 8 3 b 8 3 c b 8 8 f c 9 b 5 4 6 6 3 e a 0 3 d 8 c 3 6 f d 0 f 5 7 0 c 7 b 5 7
C : \ d 5 d 5 0 b 4 0 5 d 7 1 3 1 d 7 e d d f 0 7 5 f 6 4 9 d d 2 6 9 6 b a a d 5 c 0 9 c 1 1 2 3 5 6 a e 8 5 1 a 5 9 6 4 c f 2 d 6 a
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ g 4 P H D M v B . e x e
C : \ 0 5 7 6 3 5 6 4 3 5 3 c 4 3 8 6 f 9 2 2 5 c 9 6 f b c e 7 6 1 2 6 b d 3 4 b 7 5 8 5 3 7 e 6 f 8 6 d 8 1 3 b 1 9 1 9 b 0 f b b d
C : \ 5 e 1 1 f 9 f 1 2 f 2 c 0 3 2 2 a a 2 4 4 d f a c 5 3 1 1 6 3 f e 0 6 0 c 5 0 1 3 e 0 d b 9 d 1 7 d 2 d 9 0 9 c 9 7 4 4 1 9 a d
C : \ 4 4 e 8 3 4 e 2 d 8 1 4 2 9 4 f b 6 d 2 5 a 5 3 4 9 5 a 3 2 2 b 7 e 1 9 5 2 7 4 9 d 3 e 5 9 1 f 8 5 5 e 1 9 2 4 5 4 1 2 5 4 7 d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 1 8 2 2 2 4 5 b a 7 d b d 8 1 5 c 8 5 4 2 9 f 7 1 6 7 5 a 9 7 8 9 8 8 0 1 3 c 1 d c 2 b 9 6 8 0 6 2 b e c 7 1 f c 9 b 2 c 2 5 9
C : \ b 5 2 f 5 b 3 d 0 3 8 6 8 8 c 2 9 f 8 0 1 e f f d 8 a 5 3 8 3 1 6 a 6 e a 7 c e 0 3 5 e 9 1 a 9 e 3 e 1 e c 4 e 0 a 6 7 a 4 f 6
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ D Q 2 P 7 C l b . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e 3 f 0 d 6 4 c 5 a d 4 e 9 7 1 _ h h c b r n a f f . e x e
C : \ d 9 a 0 0 8 b 8 5 5 1 3 a 1 6 b 9 1 8 4 d 2 f 8 0 4 7 9 9 7 9 d f 4 7 6 1 4 e 4 b a e 6 9 c 3 3 0 c 0 1 c 7 5 7 8 f f c 3 2 6 b
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 0 w P t a T 0 l . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 9 9 2 3 4 7 d b 4 0 3 5 1 d b e 7 b 6 5 1 4 1 3 0 a f d c 1 2 5 d 2 c 4 8 7 5 a 0 2 8 4 9 4 9 b 4 e 5 2 9 0 6 6 d a c 7 f 0 4 e . e x e
C : \ 3 4 4 e c 8 1 c 1 8 9 7 1 b 8 b 3 8 5 a c 1 1 a 8 7 d f 9 a 0 c 8 f 7 4 7 5 e 6 6 9 a 7 4 9 6 4 a e 9 b 3 6 1 3 1 4 9 2 3 4 7 3
C : \ f 8 6 9 b d 0 4 c 9 8 d 1 8 e f 0 2 c 6 a 3 7 a f b 2 7 7 5 a b 6 0 0 d 3 b a 0 0 0 5 8 e 7 1 0 f 5 a c 5 9 8 f 5 9 7 2 4 0 3 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ y d v 0 T h 6 v . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f 8 c 4 7 a 5 c 5 9 2 e 3 8 3 c e 3 a 5 7 1 9 d 8 5 6 b e 6 1 f 7 d 1 a a d 0 c 6 e b 6 8 2 b 2 5 2 f 0 f e c 8 2 6 7 4 3 e c b . e x e
C : \ 9 1 4 3 0 1 8 0 0 e a 8 9 a 3 c 1 b 5 2 b e a 7 6 c 6 f 3 b e d 4 4 e a 7 a 1 1 0 2 3 3 0 b b f 3 c 6 c c 8 d 2 4 f b 0 4 1 8 c
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ p z b v v 1 K d . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ a 1 2 7 b b 3 a 2 6 8 4 d 7 7 4 e 0 b 9 8 8 b 8 d d d e 4 f 3 e a 2 c 4 1 e 3 0 3 b f 6 8 c d a 7 4 b 7 8 9 6 7 8 b d e e 7 7 3
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 5 a d 2 b b b b 3 d a 1 2 1 a a _ h h c b r n a f f . e x e
C : \ 1 d f d 1 a e f 6 d 0 3 9 d 6 4 2 4 8 5 4 2 9 f 6 3 f 6 0 c a 6 0 4 6 4 d 2 9 5 e 8 d 6 e 5 0 6 6 f a 2 8 4 8 7 7 9 a b 5 e b c
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ D 9 w e I i k r . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 6 2 d 9 f 1 1 4 3 6 9 3 d 2 9 0 7 6 3 6 c e 3 4 b 2 e 1 e f 0 0 4 9 a a c b a 2 7 0 1 4 e 5 d f 2 9 4 d e b 5 9 b 1 8 d a 9 0 2 . e x e
C : \ 4 2 7 a 8 3 5 d 9 f 5 8 d a 9 5 1 e e d 7 3 4 b 7 b 6 0 8 9 1 7 2 2 d 3 6 1 d 7 d 6 c 7 c 1 0 7 b 3 8 1 7 a 1 b 2 5 5 8 a 6 2 9
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 5 2 a 5 7 1 e 1 4 e b 2 c c 5 _ h h c b r n a f f . e x e
C : \ 7 4 1 5 6 6 4 d c 8 8 6 a 1 f 4 c 6 7 6 8 9 e 6 5 2 8 a 1 8 d 4 4 7 e b 0 7 5 7 1 1 1 9 4 d e c f 5 d 4 f f 1 f 3 0 1 1 5 d c d
C : \ e 3 3 b d d d 3 e d f f b e d e d 1 9 5 e a 4 5 6 a d 5 7 9 d 9 e 9 f a 5 d 6 b 6 c 1 3 c f a c b f 8 7 5 9 8 a e a 4 b 9 c 6 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ a 0 2 9 0 e 7 e e 8 5 e b 9 2 8 9 9 7 a 3 7 f 5 e 0 9 c 2 7 9 0 2 4 0 b 7 0 c 6 0 6 f 6 2 b 2 1 e 7 7 5 4 8 3 9 b 4 9 4 6 a 9 6
C : \ 8 c c 7 6 d 1 e 5 2 d 4 0 5 4 7 2 1 8 e 4 b f 2 8 c 8 e a 6 d 1 8 c 3 1 d a 1 8 7 b 6 3 a b 1 b 5 6 3 3 5 3 6 8 2 0 f 1 f 9 6 a
C : \ 8 8 b a c 5 a e a 7 b d 0 5 d f 3 1 0 8 4 c 5 6 f a 4 7 8 e 6 e 8 2 b c 9 7 c 1 4 d e 9 2 5 4 3 2 e 6 e 1 4 1 3 4 f 5 8 6 9 b 1
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ 0 e d f 3 8 e 4 7 c b e 8 1 2 6 3 9 5 f 8 5 4 7 8 2 d 8 6 c a 6 e f 1 5 1 9 8 a 3 f 1 1 c 2 a 6 6 5 c a 4 b a 0 5 2 6 d b d a f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c 2 f a f 6 b 3 e 0 5 0 6 c 0 9 _ h h c b r n a f f . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 2 3 2 E m l K W . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ x c 4 g p y 7 q . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c 6 4 f 8 6 0 6 0 d b d 2 a e 1 7 7 3 3 0 0 e c e 3 8 b a 2 4 5 c d 6 2 9 8 0 9 6 a 9 9 5 c b 6 e d b 5 5 a a 5 d 7 d 9 7 e c 2 . e x e
C : \ 3 4 8 8 1 6 c d 7 1 a 5 6 3 2 7 a d 1 d 3 7 9 8 1 6 b 9 c d 0 4 e 6 2 9 a 7 6 f d 5 a 8 6 b f d 3 2 9 6 7 8 6 e 0 8 3 4 3 b b 6
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ e k 6 V b s J d . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 4 4 7 f c 2 0 e 9 e e 0 e 2 d f d e 2 2 9 8 6 8 3 4 7 2 4 e 4 c f 0 c e 1 0 f f f 7 c b 4 2 d f 6 9 e 2 f f e a f 4 3 6 d 3 0 7 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ A h n P 4 j p J . e x e
C : \ 0 b 6 a a 6 c 0 9 a 0 0 7 4 a 9 0 0 1 f 5 a a f 3 9 0 a 1 2 b c 7 8 3 d c 8 f 0 0 9 0 b 8 6 1 3 8 b 1 6 b 2 3 d a 4 b d d d 5 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ w i U g y 0 t O . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 6 5 5 8 d 0 c 2 5 1 b 7 0 9 1 3 8 6 a d 6 8 c 6 0 5 8 4 7 f 8 1 1 3 4 d 9 f 9 b 8 9 9 3 8 f 3 4 1 3 7 b 4 2 9 9 5 e a 4 d c 4 0 . e x e
C : \ f e a b e 1 b 4 2 8 7 0 5 9 a 3 d 2 3 8 b 2 b 2 1 7 1 4 8 d e 5 8 1 1 3 a 5 8 6 4 e 0 a 8 7 c 7 4 6 d 1 2 8 f 4 a b 5 5 1 b f 8
C : \ 4 6 e 6 3 1 f 0 d a 3 3 d 7 0 6 6 1 3 b 1 e c d c 9 5 9 7 7 2 b 8 2 3 5 a 7 d b e b a b 6 7 a d a 5 b 4 c 6 0 4 c 7 e d 0 d e 0
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ 1 7 4 9 4 a f c d 5 1 0 7 0 5 2 a c 9 9 8 1 4 4 b 7 d 2 f 9 0 8 5 2 d a d 2 7 d 9 2 1 6 c 2 4 c 2 5 d e f 0 5 e b 6 9 d d d a 2
C : \ 5 2 2 6 5 a 0 a d 0 5 6 6 4 d 2 e 3 3 3 d 2 8 b c 8 b d a 0 d 5 8 c 3 2 e f 1 9 0 a 8 1 4 6 7 e 2 0 7 d 6 7 5 c 2 8 6 5 6 2 1 f
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 8 0 8 f d c 2 a d 9 e 7 a 3 8 2 _ h h c b r n a f f . e x e
C : \ 7 6 1 1 0 5 8 f 5 8 3 a e 2 b 2 c 6 4 c 8 b b b e 0 f 8 f 8 c d d 8 0 9 1 c 4 d 7 0 f 9 c 7 4 9 3 a 7 1 e 4 0 a 9 c c 6 7 3 1 f
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ P 8 F 8 A y e l . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b d e c 8 5 a c b 2 2 1 c 7 8 e 8 2 a 2 d 8 0 f f 1 4 b 8 9 e 6 e 6 8 9 1 a 6 6 9 a 1 5 5 5 a d d 8 a 2 4 b 2 2 e 3 a 1 5 1 3 5 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ k b q b Z 0 9 u . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d e 9 b 2 6 b b 8 0 e 3 c a 9 e 5 6 e 4 8 5 b 2 7 0 7 1 a 9 b c 0 a 5 6 9 9 6 0 4 3 8 f f b e 7 3 9 7 3 c f f 6 f 9 4 4 f 6 d 7 . e x e
C : \ 2 4 4 0 f c 1 7 1 d 2 6 3 f 6 0 2 9 5 2 a 8 e a 9 b b 7 f 2 1 1 a 9 9 6 a 9 2 4 5 2 c b 1 7 f 1 0 a d 7 1 0 e 8 5 3 1 a 9 b 8 a
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ a 1 3 a f 2 a d 1 f 1 6 e e 2 3 3 7 b 7 6 e 8 d f b 2 7 b 3 b 9 9 d 8 7 7 8 e 0 1 3 c 7 9 b 6 3 f d 1 e e 0 0 d c 2 5 3 f 6 b 1
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 8 y f 2 j Z u a . e x e
C : \ 8 7 9 6 e b 7 d 7 b c f e b 0 e 1 f b 9 9 a c f 4 c d 7 e 3 9 7 d a 0 b 5 8 5 0 d 8 5 8 f 5 5 9 4 b d 6 4 8 c 4 b b 6 9 c d 1 8
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d 3 e 6 f 3 c 0 1 e 1 0 5 6 4 9 _ h h c b r n a f f . e x e
C : \ 3 a e e 5 0 2 0 d 2 0 0 0 3 5 7 0 1 0 4 9 9 f 5 1 c 0 8 1 4 5 4 d d 5 0 e b 7 b 6 f 0 b e 7 7 d e 1 a 9 e 5 9 3 1 5 0 2 4 5 e 7
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ e c c e 8 9 8 3 d 8 a a 7 b 1 8 8 8 c d b 3 a 3 6 e b c 4 6 d c 8 7 4 7 6 2 8 7 f 8 d d 9 b d c 4 9 2 8 c c e 7 b 4 4 a 7 9 d b
C : \ 2 9 1 b e 5 8 0 b e 7 f 2 d 9 1 f b f 2 6 f d 7 d 1 4 0 1 b 3 c 8 c c 1 0 1 c 8 7 1 e 5 a 0 3 7 e 1 3 f 6 7 9 8 e 6 9 b e 4 0 5
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ r C A K 2 l c M . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 1 4 f e 1 1 2 f 9 e 8 6 0 0 0 9 b 3 b f c 1 5 8 a 5 7 b 8 b d 9 3 0 9 d 6 1 8 9 f 5 d 0 2 c 8 7 a 9 e 2 9 e c a 2 8 3 1 3 5 6 9 . e x e
C : \ 2 4 7 5 4 a e d e 3 4 c a c 2 c 5 4 7 6 c d 4 6 b 9 4 9 8 0 c b 9 6 f 7 7 b d 9 4 2 6 5 3 1 9 0 a 8 4 6 9 4 2 9 f 1 d 2 1 8 5 6
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ k T x l Y X m b . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ 2 3 5 8 a d 6 2 9 2 f c c e a a c 3 8 6 4 3 6 8 f 3 8 a a f 9 2 c 2 8 8 1 9 2 e d f e 2 c 2 4 0 8 0 6 9 5 4 2 e 5 6 c 4 5 0 1 1
C : \ 2 4 5 f 1 6 7 4 b 7 5 3 e 0 8 9 c c b b 9 f 7 9 d c a 6 8 2 a c 9 e 7 f a b 9 8 1 5 d 4 2 8 c f f 5 4 3 f f 3 9 8 f 5 2 b 9 b 1
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ g 2 4 3 H a p U . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b 3 6 2 2 5 f 0 7 7 8 2 8 e d 2 f 5 e 3 8 d 8 a d f b d b f b 3 5 7 3 2 2 f a 8 1 9 e f 0 7 c 8 9 7 6 3 a 7 e 0 f c c c 6 5 6 d . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ N 8 H m 6 i b e . e x e
C : \ 1 9 5 7 e 6 2 0 4 b 7 8 6 c 8 8 a 6 3 0 d 2 5 3 a b 1 9 2 c c 7 6 f 2 6 e 0 8 5 5 2 c 1 5 d 8 7 3 2 0 4 5 0 a d f 4 1 9 6 5 6 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ a c c 7 6 4 8 1 d 2 5 2 0 5 3 3 8 d 3 3 3 5 e a 2 6 1 1 4 1 f 5 1 b 4 0 c 6 4 1 2 9 2 4 1 1 d a 7 9 1 8 e f 0 5 d 7 5 f 3 6 5 2
C : \ U s e r s \ R A 4 9 1 ~ 1 . V U L \ A p p D a t a \ L o c a l \ T e m p \ 4 2 e 5 b 9 3 a b 2 9 1 5 f 5 9 c b 4 8 6 7 2 a 2 8 d 2 6 9 8 2 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ d e 2 9 c 2 a 2 0 4 2 7 4 0 d 0 b a c d 9 9 a 5 8 9 5 f 2 8 a c 9 d 9 e 1 1 e c d 3 7 4 9 2 e 5 7 7 a 1 7 6 2 1 4 1 1 4 f 6 f d
C : \ b f e 6 5 5 f 5 0 a d c 3 2 5 4 a 7 2 e e 3 a 5 4 e 8 6 8 c 5 e c 8 a e 2 2 6 3 f 6 5 4 3 1 9 4 5 c 7 c 8 2 1 e 3 d b 2 f 0 7 c
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ Y u A X 6 N P g . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a f c e d e 1 1 4 4 e 4 1 5 e 0 2 c c 8 a e 8 e f 8 8 4 1 5 7 e 6 9 5 3 6 d a b 5 1 d 4 f f 0 5 0 4 b 9 e c 2 e c 3 7 c d 4 3 b . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ 3 f f c e b e e 5 0 a f a a e a 9 a 2 8 9 c 9 7 9 7 3 7 8 5 8 4 0 f e 6 3 4 a 6 2 7 5 1 c 8 2 4 8 7 c 8 3 1 d 0 0 4 2 5 c 0 7 3
C : \ e 6 5 4 6 e c a 4 c f 6 c b b 3 2 f 4 d 8 e 8 c d f 7 0 e 2 e 7 1 a 8 7 7 6 8 c e 3 c 1 c 9 9 f 2 e 4 e a 6 6 4 2 1 1 e 0 0 2 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 7 7 2 1 c a 0 4 7 1 d 8 6 e 1 1 1 3 e 7 a 5 d 6 d 8 a d d 7 0 4 8 c 3 8 d b 8 e f e 4 b 8 5 d a 1 e f d 9 0 f f 8 9 4 7 e e 5 7
C : \ c d 9 9 f 6 7 3 5 1 8 6 5 7 9 c d 8 8 e e 4 3 1 5 5 7 d 4 a 4 f e e 4 7 8 5 5 2 a d a 0 d 4 5 3 8 3 f 1 f 7 e 5 8 6 3 2 9 1 d 8
C : \ 6 9 7 4 f 2 f 9 a d f a 6 1 6 1 d 9 8 2 8 c 4 b e c 5 b 1 d 4 5 2 2 0 f 3 d 8 2 c f b 8 1 b b 9 f 5 6 3 7 a 9 6 b a c 4 a e 0 2
C : \ 6 a d 8 f c 5 0 4 a 6 6 6 5 c 6 c 7 5 d 2 6 8 a d 7 d a 5 5 0 e c c c 1 9 a 4 d 1 a 4 2 7 0 a 2 8 4 1 a 2 3 9 c 0 b 3 8 e 0 4 3
C : \ 9 c c 3 2 d e a e 8 3 5 6 c 7 6 f d d 4 d 5 7 2 f 9 3 0 3 f 6 8 2 a 0 d 0 2 1 7 4 9 3 7 a c 6 0 3 d 3 8 e 6 9 a 3 7 7 a 7 6 9 9
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ i w B t j e s S . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b 1 d d 9 3 2 7 9 5 4 4 f c f 6 8 b 3 7 7 e e c 0 0 7 8 1 1 6 d 3 8 7 b 4 c 0 b 9 5 a 5 4 4 f 4 a 2 f a 8 4 e 0 d 6 b f 5 a 2 6 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ 1 a 9 e b c c 6 2 5 b 7 c 6 9 3 b 1 c 7 5 a 6 a c d c d 9 2 5 9 d 2 a 2 3 d 2 6 3 f 0 6 1 5 7 7 3 9 5 9 b 2 2 e 5 2 6 d c 6 5 f
C : \ 3 3 3 a 3 e 2 a d 6 a 4 e 1 1 2 d d b 0 a 4 b 3 3 f 4 1 d e 5 9 c c 3 8 1 5 e 4 5 6 b 1 f b 9 9 a 7 e 6 2 c d c 8 1 3 d 3 f 6 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ f 0 4 6 f c f 7 6 a b f d d f a 1 f e 3 5 2 a b 8 6 2 d a 2 1 3 4 5 c 2 4 a 6 0 1 8 9 7 e a d 4 4 8 f c 1 e 7 2 c a 6 c f 5 f 6
C : \ 4 f 4 4 c 2 8 8 7 5 7 6 2 4 1 1 0 5 9 8 9 0 4 d 5 8 7 c f 5 f 7 4 a 7 2 2 2 4 e c e 6 7 a a 0 e d a 3 1 9 e 8 e e 5 e 7 5 1 e b
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h h c b r n a f f . p e 3 2
C : \ 0 3 9 3 a d 8 a f d 3 9 b c e 6 d 9 5 6 6 6 8 7 2 5 1 9 3 0 8 b 1 c 1 4 8 c 2 0 1 9 5 5 0 9 5 1 6 d e 5 9 a c 4 2 e c 4 c e f 6
C : \ 2 7 0 9 a f b 3 0 8 5 4 6 8 b 2 3 3 b 1 d 3 6 4 9 9 e 5 4 5 3 d 0 8 8 e 6 8 4 a 2 8 7 f 1 8 7 2 1 b 3 7 3 f 4 7 7 f 0 b a 2 4 b
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ k t H r T B L w . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ 3 4 6 c b 1 f 2 c c 3 b d 5 d c a 9 a b 8 6 a 8 d 9 e 4 f e 6 b 7 7 c 3 a e a e d 3 6 1 7 e b a e 3 a 3 d 1 0 2 2 a f c b 7 e 4
C : \ 1 1 9 5 6 3 1 7 b f a 9 0 2 f 2 e 8 0 8 3 d 8 e 6 1 5 e c b 6 4 2 6 8 e c 8 a 8 7 1 2 8 0 c 9 9 0 4 d 9 5 6 d d f d f 1 3 2 6 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ U s e r s \ R A 4 9 1 ~ 1 . V U L \ A p p D a t a \ L o c a l \ T e m p \ 4 2 e 5 b 9 3 a b 2 9 1 5 f 5 9 c b 4 8 6 7 2 a 2 8 d 2 6 9 8 2 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ z V C d 7 L f Q . e x e
C : \ 0 8 d 5 2 9 e 4 6 5 e 7 1 3 b 3 2 5 0 e d 9 f b 0 6 c 4 b 9 2 c 4 3 4 2 1 f 5 b 9 5 3 e c 4 6 8 5 c d 3 0 3 a 8 e b f 7 6 1 f 1
C : \ 5 7 e b 1 b 0 1 1 2 6 6 1 e 1 0 f 6 4 d 7 3 a 4 4 5 7 5 1 e 6 f 7 e 6 8 e 1 f e 3 6 5 b 9 f 3 5 1 f d e f 4 d e 5 8 f b f 2 5 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ 3 U P 8 Q 5 w X . e x e
C : \ a a 3 6 5 c 2 c f 8 b 6 8 0 2 8 b 4 2 d d d f f f 5 5 a b 1 3 0 3 a 3 e 6 9 9 f 7 d e 9 0 e 1 a 2 e 9 6 1 c b f e b 7 f 7 b 9 f
C : \ 1 b 5 d 8 f 6 5 5 c 0 d 0 b 2 a 4 5 3 5 c a d 3 4 3 8 5 9 2 2 5 3 d 6 3 f 1 4 0 6 5 9 3 8 4 e f b e 7 c f e 7 1 3 6 d 0 7 a 4 e
C : \ 4 c 6 5 f 9 0 f 3 c 3 7 d 7 e 6 a d 1 6 8 8 5 9 d 4 c d 2 e 5 0 7 5 b b 7 1 1 b 9 6 1 d 7 b d 8 e f f 9 f 6 6 b e 3 c 1 4 3 7 4
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ f a 1 q T j t g . e x e
C : \ 3 6 7 9 e b e 2 9 b 4 7 2 f e 6 5 b 2 b d 1 8 3 c a a 3 4 7 1 8 1 0 8 a 7 0 7 c 9 d 5 3 0 3 3 c f f 9 d 7 7 8 c 2 6 4 c 9 2 e 2
C : \ f c 6 1 2 f 3 9 c 7 6 7 d 7 a 1 e 5 1 1 5 9 4 6 5 d 2 a 2 f c 7 d 2 c 8 b 7 2 2 3 b 1 4 b f 6 e 3 2 5 7 2 9 5 4 d 4 8 0 2 d 7 3
C : \ 6 8 3 1 2 7 4 a 5 8 5 b b f a a c 8 e 0 c d a 5 3 d c f 7 a 9 c d 3 3 e a f d 6 6 4 d d 0 b 2 3 9 6 9 3 5 0 b 9 a d 8 0 5 d c a
C : \ a c c b e 7 8 c 3 1 8 9 7 8 f 7 4 c a a 2 6 7 1 8 b 7 7 5 4 4 d 0 8 1 e 7 4 1 2 4 6 3 7 c 0 b f 3 c f 2 2 4 a 5 3 b 3 9 5 c 8 8
C : \ 5 6 e b e 7 7 4 9 f 7 0 8 1 8 f e e a 2 7 9 9 0 7 8 b 6 8 0 5 e b 9 f 6 2 7 7 0 9 a 9 6 8 f b b 4 f 0 7 3 d 2 5 a f 7 8 2 3 1 b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 4 9 f 8 d 1 1 7 8 d d 7 9 8 2 4 3 a 7 d f f 3 f e 2 0 e 2 d 8 7 0 b 6 e 5 a c b 9 4 7 a 9 7 0 c c 9 b 4 6 2 6 f d f 9 9 9 6 b 3
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 1 2 6 4 5 b 9 1 d 5 7 a e f 7 d 2 6 0 d 9 c 0 9 9 8 c 2 9 b 2 5 c b 9 6 5 0 2 0 0 c 7 a c f a f b 6 0 9 f 5 2 4 f 0 0 c 8 3 4 c
C : \ 9 1 1 5 0 c 1 1 5 5 d 9 0 7 c d c 1 d c d 6 e 8 e 3 b b e f 4 0 4 5 b 7 a 1 0 8 6 f 6 2 f 4 2 d e 5 5 8 d c f 4 e 5 b 4 8 d 3 e
C : \ a 4 a f 2 c c 4 8 f 4 5 d 8 e c d 8 f e d d 2 9 6 0 1 f 4 6 4 0 4 2 e 5 4 c 4 d 0 c 0 c f 6 6 5 0 c 2 f c f 2 2 a a a 2 1 2 8 d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ W 8 d V 2 v m Q . e x e
C : \ 0 0 1 c 8 a 5 4 1 3 3 4 8 d 3 9 7 6 c e a d c a f 6 e f 0 3 8 1 3 a d 4 a 6 1 1 5 0 f 4 d 2 9 7 e d f 7 8 a 4 a 3 f e f b b a 1
C : \ 7 1 8 8 6 8 2 e 9 d 0 4 6 9 8 8 d e 0 b 2 4 d e 4 2 8 7 9 f 8 b 5 3 e f 3 2 2 6 b 1 0 2 e 1 d a d 8 c 2 0 3 8 3 2 8 f 4 d 5 b d
C : \ 7 8 5 1 c f e 4 c d 8 8 b 2 4 a 0 4 1 f d 7 9 3 0 6 5 5 9 6 a 9 5 f 9 2 7 1 0 4 8 f 4 9 8 2 8 1 2 f f 2 a 2 7 c e 7 b 6 7 c e 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 2 1 2 d 3 8 b a 8 8 8 b f a 7 a 4 8 f b d a 5 0 5 a 9 3 a 7 4 9 0 b c b 2 1 3 4 7 1 0 4 4 6 3 4 d c e 7 7 1 2 b 8 7 2 1 3 5 e b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
Process Tree
-
04529f545e6dd0401cf7ac9f43324e2b0405b8b4857fc5697d14a126b514fe66.exe (616)
"C:\Users\Administrator\AppData\Local\Temp\04529f545e6dd0401cf7ac9f43324e2b0405b8b4857fc5697d14a126b514fe66.exe"
- hhcbrnaff.exe (1404) "C:\Users\ADMINI~1\AppData\Local\Temp\hhcbrnaff.exe"
DNS
TCP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 49166 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49167 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49168 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49169 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49170 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49171 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49172 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49173 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49174 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49175 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49176 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49177 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49178 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49179 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49180 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49181 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49182 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49183 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49184 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49185 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49186 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49187 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49188 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49189 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49190 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49191 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49192 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49193 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49194 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49195 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49196 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49197 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49198 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49199 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49200 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49201 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49202 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49203 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49204 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49205 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49206 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49207 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49208 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49209 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49210 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49211 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49212 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49213 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49214 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49215 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49216 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49217 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49218 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49219 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49220 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49221 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49222 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49223 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49224 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49225 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49226 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49227 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49228 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49229 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49230 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49231 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49232 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49233 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49234 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49235 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49236 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49237 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49238 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49239 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49240 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49241 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49242 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49243 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49244 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49245 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49246 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49247 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49248 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49249 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49250 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49251 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49252 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49253 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49254 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49255 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49256 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49257 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49258 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49259 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49260 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49261 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49262 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49263 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49264 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49265 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49266 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49267 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49268 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49269 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49270 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49271 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49272 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49273 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49274 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49275 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49276 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49277 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49278 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49279 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49280 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49281 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49282 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49283 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49284 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49285 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49286 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49287 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49288 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49289 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49290 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49291 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49292 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49293 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49294 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49295 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49296 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49297 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49298 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49299 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49300 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49301 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49302 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49303 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49304 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49305 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49306 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49307 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49308 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49309 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49310 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49311 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49312 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49313 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49314 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49315 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49316 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49317 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49318 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49319 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49320 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49321 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49322 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49323 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49324 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49325 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49326 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49327 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49328 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49329 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49330 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49331 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49332 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49333 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49334 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49335 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49336 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49337 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49338 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49339 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49340 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49341 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49342 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49343 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49344 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49345 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49346 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49347 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49348 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49349 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49350 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49351 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49352 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49353 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49354 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49355 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49356 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49357 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49358 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49359 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49360 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49361 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49362 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49363 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49364 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49365 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49366 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49367 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49368 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49369 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49370 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49371 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49372 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49373 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49374 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49375 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49376 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49377 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49378 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49379 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49380 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49381 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49382 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49383 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49384 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49385 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49386 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49387 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49388 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49389 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49390 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49391 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49392 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49393 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49394 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49395 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49396 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49397 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49398 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49399 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49400 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49401 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49402 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49403 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49404 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49405 | 124.225.27.61 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49406 | 156.254.147.137 mokoshoponline.com | 443 |
| 192.168.56.101 | 49407 | 124.225.27.61 www.download.windowsupdate.com | 80 |
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 61714 | 8.8.8.8 | 53 |
| 192.168.56.101 | 56933 | 8.8.8.8 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 8.8.8.8 | 53 |
| 192.168.56.101 | 57665 | 114.114.114.114 | 53 |
| 192.168.56.101 | 51758 | 114.114.114.114 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | 986e1f719e785da0_94308059b57b3142e455b38a6eb92015 |
|---|---|
| Filepath | C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 |
| Size | 342.0B |
| Processes | 1404 (hhcbrnaff.exe) |
| Type | data |
| MD5 | 7282c95bf98c5f053c01ab9f9f25fbcb |
| SHA1 | f20f63deaf5219baa38d12565e98964ac17eac29 |
| SHA256 | 986e1f719e785da01f0646e5f0a14b97ccd2b02fd9a752b7415f22bdd5c13a6a |
| CRC32 | 47DD5BAD |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | f03994a2f97fc16f_hhcbrnaff.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\hhcbrnaff.exe |
| Size | 73.5KB |
| Processes | 616 (04529f545e6dd0401cf7ac9f43324e2b0405b8b4857fc5697d14a126b514fe66.exe) |
| Type | MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS |
| MD5 | 52967f87abcd88625d6c98c027540f58 |
| SHA1 | 6e117aaa1b18e3c4904bd9d7dad94a694c345888 |
| SHA256 | f03994a2f97fc16f2876ee6290efe757a8bb7b9c84eab0b68fd9a666cc2b0f16 |
| CRC32 | 3E2BA81C |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 0d22af1d0d72870672eb36e666f9a5eb8cd9dd43 |
|---|---|
| Size | 4.5KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | 52adfff604af1d0434bbadc9c9859061 |
| SHA1 | 0d22af1d0d72870672eb36e666f9a5eb8cd9dd43 |
| SHA256 | f14074d4ec44eb3c708ff1fc4b07f459a396a87542112d80e5cd268304abe580 |
| CRC32 | BAEF690E |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |