2.9
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.58
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | TrojanDownloader:Win32/Upatre.ae6d25d2 | 20190527 | 0.3.0.5 |
| Avast | Win32:Waski-A [Trj] | 20200811 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Downloader.Small.ck | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (W) | 20190702 | 1.0 |
| Kingsoft | None | 20200811 | 2013.8.14.323 |
| McAfee | GenericATG-FKM!FF6D1B95C488 | 20200811 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b0797b | 20200811 | 1.0.0.1 |
静态指标
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(1 个事件)
| section | .imports |
动态指标
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\hromi.exe |
投放一个二进制文件并执行它
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\hromi.exe |
将可执行文件投放到用户的 AppData 文件夹
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\hromi.exe |
一个进程创建了一个隐藏窗口
(1 个事件)
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(1 个事件)
| section | {'name': 'UPX1', 'virtual_address': '0x00007000', 'virtual_size': '0x00001000', 'size_of_data': '0x00000800', 'entropy': 7.106201096924853} | entropy | 7.106201096924853 | description | 发现高熵的节 | |||||||||
可执行文件使用UPX压缩
(2 个事件)
| section | UPX0 | description | 节名称指示UPX | ||||||
| section | UPX1 | description | 节名称指示UPX | ||||||
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 62 个反病毒引擎识别为恶意
(50 out of 62 个事件)
| ALYac | Trojan.Ppatre.Gen.1 |
| APEX | Malicious |
| AVG | Win32:Waski-A [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.Ppatre.Gen.1 |
| AhnLab-V3 | Trojan/Win32.Upatre.R265826 |
| Alibaba | TrojanDownloader:Win32/Upatre.ae6d25d2 |
| Antiy-AVL | Trojan/Win32.SGeneric |
| Arcabit | Trojan.Ppatre.Gen.1 |
| Avast | Win32:Waski-A [Trj] |
| Avira | TR/Crypt.XPACK.Gen |
| Baidu | Win32.Trojan-Downloader.Small.ck |
| BitDefender | Trojan.Ppatre.Gen.1 |
| BitDefenderTheta | Gen:NN.ZexaF.34152.dqY@aykCIYpi |
| Bkav | W32.AIDetectVM.malware1 |
| CAT-QuickHeal | Trojan.GenericIH.S12588965 |
| ClamAV | Win.Downloader.Upatre-5744089-0 |
| Comodo | Packed.Win32.MUPX.Gen@24tbus |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cybereason | malicious.5c4883 |
| Cylance | Unsafe |
| Cynet | Malicious (score: 100) |
| Cyren | W32/Downloader.OSAR-4665 |
| DrWeb | Trojan.DownLoad4.11213 |
| ESET-NOD32 | Win32/TrojanDownloader.Small.AAB |
| Elastic | malicious (high confidence) |
| F-Prot | W32/Downldr.AS |
| F-Secure | Trojan.TR/Crypt.XPACK.Gen |
| FireEye | Generic.mg.ff6d1b95c488326d |
| Fortinet | W32/Waski.A!tr |
| GData | Win32.Trojan-Downloader.Upatre.BJ |
| Ikarus | Trojan-Downloader.Win32.Upatre |
| Invincea | heuristic |
| Jiangmin | Trojan/Generic.azrvz |
| K7AntiVirus | Trojan-Downloader ( 00457c511 ) |
| K7GW | Trojan-Downloader ( 00457c511 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| Lionic | Trojan.Win32.Generic.lY5V |
| MAX | malware (ai score=86) |
| Malwarebytes | Trojan.Upatre |
| McAfee | GenericATG-FKM!FF6D1B95C488 |
| MicroWorld-eScan | Trojan.Ppatre.Gen.1 |
| Microsoft | TrojanDownloader:Win32/Upatre.A |
| NANO-Antivirus | Trojan.Win32.DownLoad3.cmcgoi |
| Paloalto | generic.ml |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | Trojan.Downloader.Win32.Waski.G |
| Rising | Dropper.Generic!8.35E (TFE:dGZlOgPqI1TWNgPuNQ) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
连接到不再响应请求的 IP 地址（合法服务通常会保持运行）
(2 个事件)
| dead_host | 3.18.7.81:443 |
| dead_host | 3.19.116.195:443 |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2013-11-05 18:07:10
PE Imphash
e8a152262666487600bae63a404244a1
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| UPX0 | 0x00001000 | 0x00006000 | 0x00005400 | 0.888181922176666 |
| UPX1 | 0x00007000 | 0x00001000 | 0x00000800 | 7.106201096924853 |
| .rsrc | 0x00008000 | 0x00001000 | 0x00000400 | 3.860174873565648 |
| .imports | 0x00009000 | 0x00001000 | 0x00000400 | 2.7513124369232798 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_MANIFEST | 0x0000805c | 0x00000165 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library KERNEL32.DLL:
• 0x402000 GetTempPathW
• 0x402004 GetFileSize
• 0x402008 GetCurrentDirectoryW
• 0x40200c DeleteFileW
• 0x402010 CloseHandle
• 0x402014 WriteFile
• 0x402018 lstrcmpW
• 0x40201c ReadFile
• 0x402020 GetModuleHandleW
• 0x402024 ExitProcess
• 0x402028 HeapCreate
• 0x40202c HeapAlloc
• 0x402030 GetModuleFileNameW
• 0x402034 CreateFileW
• 0x402038 lstrlenW
Library SHELL32.dll:
• 0x402040 ShellExecuteW
Library USER32.dll:
• 0x402048 wsprintfW
Library WININET.dll:
• 0x402050 HttpSendRequestW
• 0x402054 InternetSetOptionW
• 0x402058 InternetQueryOptionW
• 0x40205c HttpOpenRequestW
• 0x402060 HttpQueryInfoW
• 0x402064 InternetReadFile
• 0x402068 InternetConnectW
• 0x40206c InternetOpenW
L!This program cannot be run in DOS mode.
898k8k8Rich8
.imports
_3^@[VP
CVMQuPu
VSVuh!@
tVVVVh!@
0EPEVV4
_EPEPj S}
WEPj S
3VVVVS
u3VEPEPh
u+};}t
GetTempPathW
GetFileSize
GetCurrentDirectoryW
DeleteFileW
CloseHandle
WriteFile
lstrcmpW
ReadFile
GetModuleHandleW
ExitProcess
HeapCreate
HeapAlloc
GetModuleFileNameW
CreateFileW
lstrlenW
ShellExecuteW
wsprintfW
HttpSendRequestW
InternetSetOptionW
InternetQueryOptionW
HttpOpenRequestW
HttpQueryInfoW
InternetReadFile
InternetConnectW
InternetOpenW
`.rdata
@.data
@.reloc
Vll3nh
4Fm_^@[VP
@]hm>EPS$
}@d8GA<9
A.\t;u
_caa+P
}0-XXM
7k)UPh
-3`x!@
5Wm{Wd+%;Tt
L'pS'S
$ZL6M4>2&
^puY6"
_aLu)n
wtie7a
uMedGt
!illllc
iO.Wm36ns#l
on]}od
tIt63*7a
or$^+y$$#dBL&d22L&$8g
x$FU0
GetTempPathWFileSize
~ CurrentDi
ctory"De
te%/CloseHandlWroi
Ulstrc!Read~f
NModul/=Exk0Process(HpCf
Al[c5D{Nam7&j
@Shl\k[u%
Hws?Mpf
PHttnpS>dqutPI!
tOption
#0fo-!`7
coIW _PEL
Pt 7o".
XPTPSWXaD$j
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>PAD
KERNEL32.DLL
SHELL32.dll
USER32.dll
WININET.dll
ExitProcess
GetProcAddress
LoadLibraryA
VirtualProtect
ShellExecuteW
wsprintfW
InternetOpenW
KERNEL32.DLL
GetTempPathW
GetFileSize
GetCurrentDirectoryW
DeleteFileW
CloseHandle
WriteFile
lstrcmpW
ReadFile
GetModuleHandleW
ExitProcess
HeapCreate
HeapAlloc
GetModuleFileNameW
CreateFileW
lstrlenW
SHELL32.dll
ShellExecuteW
USER32.dll
wsprintfW
WININET.dll
HttpSendRequestW
InternetSetOptionW
InternetQueryOptionW
HttpOpenRequestW
HttpQueryInfoW
InternetReadFile
InternetConnectW
InternetOpenW
/ P u b l i c S e c t o r J o b s . i n f o _ f i l e s / b o d y _ t o p . e x e
/ i m a g e s / s _ i c o n / t w i t t e r _ h o v e r . e x e
f r e e d a t a v e r i f i c a t i o n . c o m
s e l l m a k e r s . c o m
h r o m i . e x e
U p d a t e s d o w n l o a d e r
t e x t / *
a p p l i c a t i o n / *
h r o m i s . e x e
o u b l i c
y : \ w i l d l i s t \ 1 3 1 2 2 7 \ 3 3 9 9 2 e e 7 7 8 8 6 2 7 b 4 0 1 f 8 f d c e a 2 c 6 1 a 3 9 . e x e
C : \ r s d o v . e x e
c : \ c 6 8 e b 4 6 a 0 b d 2 b f 8 3 b 1 d 5 0 5 c b d 8 7 5 4 a e c . e x e
C : \ y b y n g r . e x e
C : \ i b s f o v . e x e
C : \ y x m h i t s v . e x e
C : \ r w d a n . e x e
C : \ 3 4 k 0 7 2 f Y . e x e
C : \ x N i U 1 r F I . e x e
C : \ 8 u Z y N j 6 H . e x e
C : \ u v S C 7 D e l . e x e
C : \ L l S o Z w X N . e x e
C : \ d 3 3 f a H L j . e x e
C : \ 7 3 m Y K a W f . e x e
C : \ N G A R w u l e . e x e
C : \ t w w t b 5 Y t . e x e
C : \ W i 7 I D y M T . e x e
C : \ P t a p g V H 7 . e x e
C : \ U n k t c Q E M . e x e
C : \ a 7 k f s Z A n . e x e
C : \ C s _ J f a e q . e x e
C : \ Q y Y m x w J s . e x e
C : \ 3 d d Y v w u 6 . e x e
C : \ 0 g T R 6 S q F . e x e
C : \ N d 9 4 w S W s . e x e
C : \ 9 D l Y V b Y w . e x e
C : \ S K J B p I 0 l . e x e
C : \ 5 P y f 2 z n Q . e x e
C : \ h i 6 q m a L W . e x e
C : \ P g o L K d u j . e x e
C : \ 5 N u 6 t 7 j f . e x e
C : \ h 2 f b b 5 _ 8 . e x e
C : \ l k 6 Z 9 N _ j . e x e
C : \ Q 9 u 1 J Z I 3 . e x e
C : \ i f 9 n P T Z d . e x e
C : \ 2 E O K a 7 A S . e x e
C : \ O q 9 H F Z 5 A . e x e
C : \ Z u O G l b o b . e x e
C : \ I H k 4 e O l p . e x e
C : \ d q n F F p D z . e x e
C : \ 6 t I l h N C 1 . e x e
C : \ X S O 2 D S a x . e x e
C : \ t m L 8 e Z w R . e x e
C : \ Z _ P k t I P E . e x e
C : \ L o 1 _ 0 V N M . e x e
C : \ 4 m N f j E Q k . e x e
C : \ Z 9 J h L 3 3 k . e x e
C : \ w z d B z J D C . e x e
C : \ w E o Q 7 i A O . e x e
C : \ D 7 w 1 o C o 6 . e x e
C : \ B 9 V 4 O 5 z s . e x e
C : \ 1 v s 6 o k R U . e x e
C : \ A V j O p 2 f r . e x e
C : \ r t 1 K s N 2 0 . e x e
C : \ 9 N M 0 H y j x . e x e
C : \ J 7 x K S U V u . e x e
C : \ m V A h V d N g . e x e
C : \ O Y p c D F 8 M . e x e
C : \ 1 Q y M D p 8 Z . e x e
C : \ X r T H w x p Q . e x e
C : \ v o _ 0 _ Y g m . e x e
C : \ G j 6 Q O W y c . e x e
C : \ c O G J X B d p . e x e
C : \ h U K v 5 n p r . e x e
C : \ 9 A q R 5 o U G . e x e
C : \ N Q X q q l L 8 . e x e
C : \ 5 j 8 9 f h 0 g . e x e
C : \ V E z N J T V m . e x e
C : \ R 3 3 n A 6 K 9 . e x e
C : \ G O i _ Y p S E . e x e
C : \ 9 D Q r F M 4 U . e x e
C : \ I 4 k N L T T C . e x e
C : \ x V A I x y b X . e x e
C : \ U U e u 6 2 1 o . e x e
C : \ P 3 E c 1 3 K d . e x e
C : \ T M O T 2 Z T C . e x e
C : \ 4 b 1 e e b 0 7 9 5 0 c 8 f 5 6 1 3 1 9 4 d 5 5 4 b 5 f 5 9 2 d 8 b 5 2 9 3 f 0 b 6 e b a 7 5 b 8 5 8 5 1 1 2 8 4 6 8 0 9 8 4 e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ Z A a q N E G E . e x e
C : \ 6 e c 9 f 4 a 4 c f c 2 8 0 b a 1 6 f 1 8 e a a 5 e 4 c f 2 a b b d f 5 a f 8 4 8 0 4 3 f 3 7 5 6 9 3 c 3 2 9 a 8 2 8 0 0 a 4 8
C : \ c d 3 9 e e 6 b 8 1 4 7 f d d 9 8 9 d 9 3 6 a b a 1 8 d 5 a a 1 7 f 5 7 c 6 f c d 7 b a d 9 f 5 c d d 4 a 3 f f 5 7 5 5 2 e 6 5
C : \ e 7 7 7 d 1 d c 7 3 a a d c 5 f 0 6 8 0 4 0 7 e 4 1 1 6 5 4 7 4 5 d b 3 f 9 2 d 1 c f 5 5 3 8 b 5 4 9 4 d 9 4 a 6 0 e 1 d e d a
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ F e g b i d z l . e x e
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ e f 3 6 b 4 4 4 2 c 2 e 5 7 5 d 3 e b d 0 5 7 4 a 1 5 1 7 a d d 5 0 7 9 7 2 e 7 c 8 4 6 1 1 3 2 c 6 3 4 a 3 f d 3 5 2 6 3 9 4 4 . e x e
C : \ c 7 9 d 5 c e b f 9 f e 4 b e 5 e 7 3 0 a b 5 b 8 c 4 1 e 5 1 3 9 6 f 4 f 5 8 7 3 5 f 6 7 6 c c 2 f 7 5 0 c 1 9 4 e 8 a 2 f 8 e
C : \ a d 7 1 a d d c e 9 8 a 9 b 7 9 e c c 7 9 b 5 8 6 8 e d c e 4 4 3 e 4 3 9 e 0 5 4 8 a d 3 c b d 8 e 5 4 d 9 5 d b 3 d a 4 4 c 9
C : \ 8 2 1 b f f 0 b 2 6 a a c 0 b a 8 8 5 e f b 6 0 0 e c 1 7 7 e 1 5 1 7 d 0 b b 1 1 e e 6 9 f e a 3 9 f 4 b 8 8 9 a 8 8 d 6 e 4 c
C : \ f b e f 2 b 1 5 c a 2 7 9 3 6 f 8 1 1 a 5 4 4 3 0 6 7 3 f d 5 6 8 6 7 f 9 a 4 c f 5 e c 3 8 5 1 c 3 1 8 b 2 e 0 5 5 7 6 8 9 6 7
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ V D 3 E m a 0 b . e x e
C : \ d O Y 4 x 7 X w . e x e
C : \ 8 0 4 c d 9 7 a b 3 3 c c c 3 3 2 b d 5 7 1 d 2 6 d 8 c 7 2 f b 9 3 8 2 7 3 5 c 4 7 3 d c 7 a d 1 a d f e c 7 c d 8 7 9 1 c a c
C : \ U s e r s \ L i s a \ D e s k t o p \ P v b O w N C c . e x e
C : \ b 8 4 8 8 7 4 a e a 1 9 f 1 0 3 5 c d b d 4 b c 8 5 1 7 f 2 6 2 7 a 2 5 3 6 8 4 b 8 a e e 8 3 0 3 6 1 d e 6 c 6 f 0 3 6 c b 3 2
C : \ c b b 3 7 d a 5 a a a 0 0 0 5 5 a e 1 6 d c e a e 4 d 1 d 0 1 d 4 6 7 f 5 b 7 2 7 3 d 2 6 6 4 c 6 e 8 e 0 1 c 7 9 1 8 7 d 8 7 0
C : \ d d d 5 8 9 2 2 3 c 6 c 2 3 a c 2 e a 9 2 1 d 3 7 c 3 c 8 9 2 a 4 0 2 5 0 8 c a a 7 9 5 5 a f 9 1 b 5 3 4 b e 7 1 1 0 e a 0 7 a
C : \ 7 f 8 b 2 d 0 c 9 0 2 9 e e 3 3 6 7 3 6 7 0 1 9 7 d 7 4 3 3 8 e e b 0 4 8 e c c 9 1 7 d 9 0 0 8 2 4 5 3 4 5 4 1 0 6 a 2 4 c b 9
C : \ 5 7 c e f 5 4 3 4 5 1 b b 0 f 6 f 1 a 2 9 6 c f 3 c 5 7 9 6 8 d 2 5 2 4 8 0 5 4 d c f 1 4 d 5 1 3 3 b 1 a 4 0 6 5 8 4 1 a f 2 8
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 9 5 3 5 e 7 c d a b d 8 a c 2 5 2 4 3 2 e 4 6 1 6 2 f f 6 4 b f 7 6 b 0 c 2 7 2 d 6 5 1 9 1 c 7 0 5 f 5 a 5 3 a 5 e d 3 1 0 7 4 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ J y 2 l q K t x . e x e
C : \ b 0 2 f 1 6 c a 6 a 9 2 1 3 d 2 8 4 2 e e 3 1 7 a 6 9 8 f 5 3 0 7 4 c c 2 c b 0 d 8 9 f 9 7 c a c 1 e 7 4 8 2 6 f f d 0 a 5 7 e
C : \ c 6 a 0 2 2 b 7 7 e 3 a f 5 9 8 4 3 3 5 6 8 c f 8 9 a e 9 b f 3 d f 4 4 f e 1 d f e 4 0 5 3 f a 7 a 6 b 8 7 c 8 e e 1 f c 4 d f
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ N g 9 F Z D I 1 . e x e
C : \ 4 f b 7 1 9 7 0 2 b 9 4 f 6 1 5 a 5 9 1 b 9 c 0 3 e 8 6 e d b a 3 4 5 7 9 b 9 e b 5 9 6 b 1 5 b 8 1 2 e f 2 f 1 9 f f 0 8 3 a c
C : \ 9 d d 8 f d c 2 2 b 2 e d e 2 2 3 3 2 3 5 f 8 2 2 6 9 2 0 1 3 2 d 5 1 b 6 2 0 f 5 b 5 3 9 d 9 e 8 f a 1 e f 0 c 2 4 6 d 3 d 7 3
C : \ 7 c 1 1 0 9 8 a 4 6 5 a a f 3 5 5 1 a b 1 1 6 7 2 b 1 8 3 f e c 3 c 7 a b 4 3 f d 8 1 0 9 0 e a 4 8 2 2 0 3 f f 5 9 2 9 8 8 5 6
C : \ b 5 5 e a 7 8 9 3 a d d e 3 7 a 4 1 7 1 6 2 6 e 3 2 f 2 d e 3 2 7 4 4 2 d 0 e 1 9 4 5 6 6 c f 5 1 b 2 6 4 d d 5 7 c 0 9 a 3 d a
C : \ 1 9 6 c 1 3 2 d 1 0 4 7 d f 8 d 8 e b 4 c e a 1 a 4 d e 0 a e 0 6 a 4 1 4 8 a 2 3 2 3 9 d f 9 f 3 7 6 8 0 0 c 0 7 f 0 3 8 c c 9
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ t d J s G C Z 0 . e x e
C : \ U s e r s \ J o e C a g e \ A p p D a t a \ L o c a l \ T e m p \ 1 7 9 a 6 b c 9 7 6 2 3 e a f 7 b 8 b a d 6 d 6 c f d 1 3 c b 5 3 f 2 f 2 e f b 3 5 1 e f 5 2 6 a 3 0 2 3 9 5 9 1 2 4 a 6 1 7 e . e x e
C : \ C M K C e q i 6 . e x e
C : \ 2 3 5 a 9 4 7 0 d c 5 4 4 c 4 6 6 7 9 8 3 5 0 9 e 8 8 7 8 a 2 3 f 6 9 3 c 1 f b 4 0 c f 5 c c 0 c b e 2 e 9 f 3 6 1 9 7 1 9 c 7
C : \ 5 9 3 e 7 c e 5 d 7 b 5 d 1 7 1 c 8 b c e f 0 2 9 c 5 0 8 8 0 3 6 2 3 a 3 1 5 6 8 5 6 3 a 1 3 0 8 b 3 1 6 8 2 f b c 5 4 1 f 7 5
C : \ 5 E u e s p j r . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ f Y Z y i S r F . e x e
C : \ 5 7 7 4 1 8 a a 3 b 3 9 3 7 5 7 2 8 3 3 4 a a 9 e f 5 4 b d 0 c e c d 3 b e 7 c 9 7 d 9 e 4 c c 0 b b 6 4 7 6 a 7 d d 1 0 2 0 5
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ V c d M y q w M . e x e
C : \ 2 0 3 b 5 b 9 c 2 5 6 9 d c d 8 0 b 9 7 6 b d 2 9 5 4 d 6 e e e 3 d 1 7 a 2 2 9 3 1 c 8 0 c 2 f 7 b 4 9 8 c 8 e a 4 c 7 e 6 5 d
C : \ f 6 5 e 6 e c 1 f b e 9 e 2 7 7 0 b 1 6 d 3 a f 2 2 e 5 6 8 0 6 8 d 9 e e 9 5 e c f 1 6 c 0 b 9 7 a 4 7 b 9 7 0 c d 9 1 9 0 6 5
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ p C X e d M 5 k . e x e
C : \ 1 1 6 8 e 3 e e 3 9 3 7 e 4 d 8 8 7 3 9 3 b 6 e 1 1 5 9 f a 3 9 1 f 3 1 7 1 a f 6 6 4 5 c f 1 a f 5 4 7 f b b 1 1 2 d 3 e 5 7 5
C : \ U s e r s \ L i s a \ D e s k t o p \ o X E O w 9 i S . e x e
C : \ i t I G S e n c . e x e
C : \ 0 9 d a a 8 9 f a 7 8 b f f 6 f f 5 1 2 8 e e 5 e 6 4 b 0 6 2 c 7 d b 8 f 1 e f d 4 5 c e 5 1 9 9 2 c 1 4 8 a 5 3 9 3 9 9 b 6 0
C : \ e 4 3 3 a 7 6 4 5 1 f c 3 9 3 c 3 e 3 a 4 c 9 5 1 7 c 4 f 0 d 8 e f a c 4 4 b 0 7 1 f 4 a 8 6 9 c 6 1 4 3 0 0 b a 9 b 2 8 a 5 5
C : \ a c d 7 1 1 5 e 5 f 7 e 3 b 7 3 0 f d a e 0 b b c c c 6 2 a 3 1 5 a d f f 7 9 4 b 8 5 3 9 2 8 9 5 8 c f c 8 6 e 3 1 1 6 b f 9 d
C : \ 4 O N 0 1 0 j N . e x e
C : \ a 8 8 1 7 9 0 b c 4 b a 9 5 1 e 2 f 2 7 3 a d e 1 5 1 f 0 3 d 2 4 e 5 5 6 e a 1 2 b 0 8 1 f 4 9 5 1 3 f 1 2 6 e a 8 f 6 2 4 3 9
C : \ 8 f E p I q w Z . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ u Z W R J m K R . e x e
C : \ U s e r s \ J o e C a g e \ D e s k t o p \ 7 6 o a y F A B g D . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a 6 3 4 9 0 2 0 d 9 3 9 9 5 d c f 9 6 d f 4 b 8 a 4 e 2 8 6 e 7 . e x e
C : \ 4 e 6 0 6 0 f 6 7 4 2 0 6 5 d 4 6 f e 4 5 c c b d c 6 2 d 5 a 7 d 8 e 2 a 1 2 1 4 b b 2 7 f e b d 6 d 7 4 5 9 7 f 9 0 3 5 c f a
C : \ 3 0 a e 1 8 8 1 e a c 9 b e b f 6 d e 9 b c 0 e f a 1 3 0 f c a 8 b 9 4 1 f 5 f b 9 b 9 c 2 e 1 1 5 6 f c c 6 d 9 3 d 9 1 a a 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h r o m i . e x e
C : \ e 0 a 4 b f 6 c 2 9 6 a 9 5 f 7 1 8 2 e 1 1 c 6 3 f d 2 1 0 d 7 9 d a c 6 a 9 a 4 a e 1 0 7 9 d 9 7 9 4 f c 9 2 6 9 a c 2 a 1 9
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h r o m i . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 8 8 f 2 0 7 1 b d d c 8 a f 8 6 _ h r o m i . e x e
C : \ 6 4 c e f b d 6 2 d a 6 3 d 4 c f 2 3 2 c 2 c a c 2 2 5 b 4 9 b c 4 8 0 3 9 6 6 4 d 1 0 4 3 d c 8 8 c 2 9 8 3 d 3 7 d 7 2 5 9 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h r o m i . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h r o m i . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 6 1 b a 3 2 d 6 6 4 2 8 e f 0 _ h r o m i . e x e
C : \ 1 d b 0 9 0 e e 9 3 4 5 5 c 6 5 a 0 3 2 9 3 6 7 4 1 d 7 e e 4 0 8 8 9 f 0 0 1 9 2 4 f b f 8 9 4 7 6 6 7 3 6 1 2 5 d 7 d f 4 3 b
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h r o m i . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d 7 5 f 4 b c 4 b 8 d e 7 5 e 8 _ h r o m i . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h r o m i . p e 3 2
C : \ 4 8 0 9 8 a 1 0 4 c d f c 2 2 0 4 2 a 0 4 d 5 1 7 d 6 3 d a c 6 0 0 5 7 7 6 9 d 8 c c 3 e 6 1 e b b 3 2 9 d d 4 8 0 4 1 5 8 c b
C : \ b 0 e 2 2 1 c c a 6 7 3 1 3 9 e f 5 6 d 2 e 4 f 5 1 4 a f 6 c 5 8 5 e d 5 c 7 6 4 c a 3 c 3 7 d c 3 d c 4 8 9 1 f 7 d 1 9 8 c 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h r o m i . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h r o m i . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h r o m i . p e 3 2
C : \ 1 1 b 8 7 2 6 d 5 a 0 8 3 8 b b 7 6 d 8 8 a c a e a 2 e f 4 6 0 d 7 1 e 9 f f 0 7 f 9 4 d 9 4 e b b 5 7 5 f b 1 c 2 9 9 c 3 f 0
C : \ 1 7 d 4 1 6 9 c 3 2 d 8 5 f 2 7 6 6 f 0 4 3 e a 3 3 0 5 2 8 5 2 2 5 3 7 e 6 e c 0 3 d 0 f 8 c 0 e 3 b 9 2 b 7 4 3 4 d 1 8 0 4 2
C : \ b 7 b d e 6 f 5 d f 0 8 3 b c 5 3 6 c a f d c 0 b d d a b 4 a 2 1 a 1 7 4 f 5 7 2 f e 2 f e d f 6 e f 1 f 3 4 9 a c 0 7 3 1 9 0
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h r o m i . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h r o m i . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 9 5 9 d 3 7 d 5 a 1 5 2 8 a 0 2 _ h r o m i . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h r o m i . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h r o m i . p e 3 2
C : \ e 5 f e c 3 8 9 b 2 9 3 7 7 4 7 4 3 e c 4 7 1 b 9 a 6 3 8 f c f 4 0 a c a 0 f 3 7 b 5 7 0 7 c d 9 d 5 7 2 1 8 1 a 2 3 7 3 4 1 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h r o m i . e x e
C : \ 5 2 2 3 4 5 4 8 7 2 e 3 b a 6 2 d 8 8 5 0 d 6 a a 7 6 c 2 b 1 3 9 9 5 e 4 f 7 2 b e 8 6 b 4 7 8 e 5 b d 8 0 9 a 3 d 9 5 3 2 e 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h r o m i . e x e
C : \ 4 f 7 a c 7 5 2 6 2 d d e e c b 8 7 8 4 8 6 b d 1 3 2 f 3 9 6 6 e a 5 c 5 5 0 1 a 6 4 3 f c a e e 5 6 2 4 5 a d b e d 6 2 6 5 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h r o m i . e x e
C : \ 6 2 5 2 4 4 1 9 5 1 8 b b 9 5 d 9 4 3 3 b 0 a 3 e 4 6 d e f 9 c 0 8 e 7 8 5 1 4 3 8 e 1 6 f 5 c 0 b 1 d 6 f 3 e 1 b b 4 3 4 7 a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h r o m i . e x e
C : \ 8 a 9 a 6 7 3 8 2 3 b 9 3 9 9 4 7 4 d b 3 f 3 1 4 c f 7 4 6 d c b a 5 f e d 1 2 a b 9 5 5 a 1 a b e 3 d 9 8 4 9 6 d 1 a 6 9 b d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h r o m i . e x e
C : \ b 1 8 6 1 d 1 d 6 1 8 f 5 a 7 a e 2 9 5 a c b d 5 3 f 9 1 b 1 b 5 1 d 0 4 7 e 3 3 2 2 3 f c f 0 4 1 5 9 d d 0 1 e 7 5 a 0 a e 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h r o m i . e x e
C : \ 7 f 6 4 1 d 8 3 e 9 e b 1 e 4 1 5 d b 2 6 1 c 7 9 7 2 7 4 2 2 4 5 3 4 8 a e d 1 1 4 1 0 5 a 3 1 d 3 8 9 8 7 d 4 1 0 c f 5 e b f
C : \ 8 3 6 1 9 5 5 7 c 2 6 5 b 6 b 9 9 d 2 b f b 5 6 e 2 b 9 8 9 d e 1 6 b 4 c e 4 3 5 7 0 9 3 b 7 2 b 8 8 a f f 0 e a 3 b 5 4 e 7 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h r o m i . e x e
C : \ f 8 4 5 f f 7 2 a 5 a 6 7 1 c 0 9 b a 6 5 c 5 a f b 1 2 7 4 f 8 7 4 5 4 b 1 a 9 9 5 3 4 6 9 7 1 5 3 e c 7 b 7 8 c 6 a d 0 a 6 0
C : \ e 8 e 2 b 7 5 6 b 6 b e b e 7 1 6 a b d 6 d a 0 b 4 f b d 3 4 7 9 9 5 3 8 1 0 3 5 4 4 7 c 4 5 4 5 1 5 e 0 b d d 8 4 b 3 3 8 1 b
C : \ 3 1 c 7 b 6 1 a c 2 1 8 4 0 1 d 6 7 b 1 9 6 a d f 9 0 4 c 4 8 1 8 0 f e d d 9 1 0 d 5 7 6 e 3 0 8 1 d 5 b d 5 e 3 6 7 9 b d 3 c
C : \ 0 7 9 b 8 4 1 9 e 3 1 1 3 b 7 3 e f 7 1 b 7 0 4 0 3 a 4 e b e d 0 b c 3 7 f a c 7 5 8 3 9 e f 3 b 7 1 9 1 d 0 4 d 0 2 8 c 3 a 3
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h r o m i . p e 3 2
C : \ b 5 f 4 d b 2 d b 4 8 e 0 4 4 a 7 1 3 c a 2 5 1 2 c c 9 7 2 6 8 f f 0 7 d c 2 4 4 9 2 a d 2 a 1 b 6 2 8 c 3 8 c c 9 b b 6 e 9 f
C : \ 1 6 b 2 2 3 e f c c 0 4 3 b e 2 1 4 e 8 9 4 1 5 2 4 1 7 f 9 7 7 2 b 4 b f 6 5 4 e 5 b 7 6 e 7 1 3 b d 3 6 3 6 6 0 e 8 4 f e 6 4
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h r o m i . p e 3 2
C : \ d 6 e b c f 1 1 4 5 2 c 3 f 8 a 3 8 2 e 6 5 7 6 b 6 5 d c 8 f 1 b 3 2 8 5 1 3 0 0 2 c 3 0 0 1 a 3 a 0 e 4 7 c f 0 d c a 1 8 9 3
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h r o m i . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 1 3 5 8 a f 4 c 3 b 9 5 d 7 0 0 _ h r o m i . e x e
C : \ 0 4 3 7 6 2 4 4 2 3 1 c 0 e f a 9 a e 9 b f 7 f 2 3 4 1 8 b c 9 d 9 0 a 5 8 2 b f 9 d a d 9 b e 6 d 3 f f 5 4 f 4 7 a c 0 1 a 8
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h r o m i . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 0 4 a 7 d 8 9 4 b e 9 a d 6 9 e _ h r o m i . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h r o m i . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a d 2 3 7 c 6 d c 3 e a c c 0 5 _ h r o m i . e x e
C : \ 0 2 a 6 c f 0 0 5 a 3 e 3 d f 1 f f f 4 d 9 b a 8 c 1 0 6 f 4 c d 6 d 9 b 2 f 6 a 9 e b c 5 f a f 5 8 e 4 4 7 6 5 8 e c 0 b a 7
C : \ e 0 c 3 e 3 a 5 8 7 c 1 8 a 2 7 c c 4 b 2 5 5 2 0 4 7 e 9 2 b 5 2 1 3 3 e f 6 d a d b 9 e 6 9 d 6 9 c e 1 e f 1 f 2 a b 8 f f 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h r o m i . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h r o m i . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c 4 4 e 2 f 0 4 5 3 a 8 b 3 8 5 _ h r o m i . e x e
C : \ d 7 2 5 4 3 d 2 a 0 0 a b a 2 a 9 3 1 4 8 e a 2 4 4 a c 6 6 6 f a 7 9 2 1 8 2 e 4 e 0 7 1 9 e b a 2 b a 7 a 6 d a 4 6 5 2 d 0 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h r o m i . e x e
C : \ 9 8 2 d f 6 5 1 1 5 2 1 9 a d 3 2 9 d e 3 0 b d 8 c 5 8 c a f b 8 9 9 c 5 5 d 9 4 7 7 7 0 f 4 9 d 1 9 0 3 1 1 d f 9 2 1 d f 4 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h r o m i . e x e
C : \ a 9 a 6 2 2 e d 0 3 e 3 f 8 5 9 c c 2 e 3 c 0 5 6 3 9 b 3 4 b 1 c 0 d 1 e 6 3 d 4 2 7 3 4 2 0 b e 3 f 6 a 6 0 b c 8 3 c 4 f 2 8
C : \ b a b f 5 f 8 9 e 0 9 0 5 0 c 5 d 1 b b 1 4 5 4 5 4 1 b 4 4 6 f 9 a 3 8 4 4 1 4 2 5 a 4 f 3 d f 4 5 a f a 9 8 1 5 c 7 5 e 0 0 c
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h r o m i . e x e
C : \ 3 8 1 f 2 2 f a 3 5 a 2 3 0 a b 2 a f 6 e 7 6 3 6 c 6 d 4 1 9 b 5 8 6 c b a 3 b 0 1 b 6 1 9 e a 5 1 d 6 1 6 6 3 1 9 d a b 3 f 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h r o m i . e x e
C : \ 5 d 2 9 4 4 2 e 7 9 f e c a 8 5 9 1 c f f c 0 5 d f a f 0 b 9 b e d d d c f 0 8 4 9 3 9 2 7 4 1 e b 0 c e 0 3 7 d a 0 2 a 7 e 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h r o m i . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h r o m i . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 1 1 9 6 8 2 9 9 1 9 7 5 2 e 9 e _ h r o m i . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h r o m i . p e 3 2
C : \ b b c a 5 3 d b 0 1 e 8 0 3 c 8 2 5 1 6 f b e 5 e a 6 b e 7 6 2 9 2 3 9 e 9 3 d e 1 0 7 0 f a e 7 c 8 4 d e 4 2 5 f d 0 c 1 b 4
C : \ 6 f 4 2 b d b c b 3 f 5 5 c c 2 c a e 8 8 b 9 3 6 2 9 2 e 2 c 4 3 b 7 2 2 9 a d c 1 a d 0 b 2 9 8 5 f 6 2 a 8 a 3 f c 6 d 5 2 9
C : \ 7 e 1 9 f f 4 4 6 f 5 1 e 7 2 4 2 d b 3 5 8 c 2 c 6 2 3 9 f a c 6 7 7 d 0 6 b 5 9 e e c 5 5 1 3 2 8 2 8 9 0 2 d a 6 8 e 7 5 9 c
C : \ f 1 4 7 f c 6 7 f b e 3 f 1 3 0 3 d c f f b 1 7 7 3 4 1 f d 4 c 5 a f b 4 f 7 0 9 f a e 2 b f 8 6 7 0 5 b a 4 a f 6 4 4 5 8 6 f
C : \ 1 a 5 7 4 2 5 c c 0 b 0 d 5 7 9 2 5 b a 5 7 8 3 6 4 7 8 2 6 7 1 5 5 a 8 1 7 4 b 9 e 4 6 7 1 8 0 7 7 f a 9 d b 0 9 7 9 c 3 1 4 a
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ k x m X e D F 7 . e x e
C : \ 0 1 8 1 f 4 a 5 d c d d 0 f 1 f 8 b 2 b b 1 a 4 9 6 b 8 2 6 0 9 a d 7 0 e 4 4 0 f 9 1 5 0 e c d 1 6 c a 0 7 d 0 1 7 1 0 0 2 3 b
C : \ 3 4 4 f 1 9 0 c 8 6 4 6 7 5 e 5 6 d 8 6 5 1 1 6 1 9 9 8 b d f f 8 c e 6 3 d 6 d 6 e 4 9 d e d d 8 4 f c 4 9 0 5 0 f c 2 6 b 5 8
C : \ 1 3 5 3 6 1 e 5 3 a 4 a a 1 1 e c 4 9 e d c 2 e 3 7 1 5 f b b 7 f 1 b 5 f 9 5 3 b b 3 d a 1 e a b d f 2 6 a 2 1 6 c 8 f 1 a 9 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h r o m i . e x e
C : \ e 2 3 a 6 b 2 5 a 8 1 b 2 6 1 a 5 c 0 1 6 3 c 1 6 5 4 5 2 a 0 0 4 b 6 8 3 4 c 3 b 0 3 5 7 c e e 5 c 9 a 5 5 b f 5 5 f d 3 1 b 9
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h r o m i . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h r o m i . p e 3 2
C : \ 1 b f c b a 6 1 8 4 6 e 7 8 e c 7 7 c 0 6 7 6 5 4 c e d 8 7 7 6 e f 4 2 5 b 4 8 b b f f 4 2 4 b e f 9 e 6 0 7 5 6 5 1 b d 9 a 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h r o m i . e x e
C : \ f 5 4 5 b b a 4 8 6 b 1 0 f 5 f f 8 b b b e f b 8 7 f 1 c 8 6 0 e c f 0 5 1 f 1 5 5 f 6 3 2 f d a 5 4 e a 1 c 2 2 3 7 b 5 2 1 7
C : \ d c a 2 1 c 0 9 c 9 4 0 c b 5 f 3 b 0 9 4 c 8 1 0 5 a 1 e b f 8 5 4 a 9 5 6 f 9 b 8 f 3 6 f 8 8 0 f 0 b 8 6 0 0 0 4 2 3 d 6 0 0
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h r o m i . e x e
C : \ 5 f 6 d b d e 7 8 e 5 0 b 7 2 d 8 6 4 0 e 2 4 c 5 8 0 3 7 9 7 b 4 d 2 2 5 f 6 9 9 d 9 2 c c 5 b b 3 b f 7 6 b c f e 1 9 c 1 0 e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h r o m i . e x e
C : \ a 3 b 8 3 c 3 8 5 3 b d 1 3 b 0 6 9 6 c 4 e 2 0 5 9 c d 2 8 1 a 7 4 c d 7 2 a 1 6 f 9 3 2 b a c 8 1 0 2 5 8 d 3 0 b 4 7 4 e f f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h r o m i . e x e
C : \ d 2 0 5 1 b b 5 6 0 3 0 f 4 d 9 c 6 8 e e f 4 a d d 8 6 d 5 3 6 0 6 f 2 7 3 f b c 6 6 d 8 9 0 f 7 4 2 2 0 5 d e f 6 a 2 1 6 3 e
C : \ 9 c 9 0 6 2 7 d 1 7 3 4 9 e 7 1 5 7 9 b e f 3 f 6 4 8 6 6 d 8 a 0 3 1 c 6 2 7 9 2 4 c 7 2 a 9 a a 8 1 5 7 7 7 3 3 7 0 8 8 1 1 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h r o m i . e x e
C : \ 8 b 0 4 7 7 8 c 0 8 1 4 b c f f e 6 1 5 1 3 c 8 6 0 b c 6 8 2 7 d 9 f 0 6 0 e 5 e f 7 8 9 5 f a 1 7 1 7 a c 4 e 2 7 2 8 a 5 c 6
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h r o m i . p e 3 2
C : \ 5 8 8 1 4 3 b 7 a 9 6 f 3 2 a 1 d 3 5 c 9 b d e d d 9 c 1 c c 5 a 9 e 0 4 4 0 1 9 b d 9 6 e 6 4 5 5 7 3 c c 6 b 2 e a 0 9 0 3 4
C : \ 3 7 7 5 5 4 d c 3 6 4 a 1 e 1 c 1 a a 6 f 5 b 9 2 2 7 d c 2 f 4 4 2 3 1 5 3 a 4 a a 8 3 e 6 f e 6 a 7 f 3 9 d 5 f 1 0 1 3 e 3 1
C : \ 4 2 1 6 9 1 4 9 9 5 4 6 0 3 7 1 9 b 6 f 1 3 9 2 6 3 f 0 f 9 1 1 c d f e a 2 2 0 d f f e f 4 d a 2 f d 1 7 2 6 9 5 3 2 6 5 3 8 d
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h r o m i . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h r o m i . p e 3 2
C : \ e 1 2 6 5 f b a 9 b 4 9 f 8 7 f 4 f 6 c b d f e 2 2 6 5 e c 1 b 8 0 f 6 e b d 8 c 9 6 f 7 b b e 9 8 1 a 5 6 3 8 e e 7 b 2 a 5 2
C : \ 3 b 6 f b 9 e 5 3 f 3 6 6 d f f d 5 f a c 1 4 5 7 2 b 1 e a a 7 c d 7 0 8 1 3 c b 7 6 5 4 3 b a c 2 0 2 9 7 1 8 9 6 1 4 c 1 5 f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h r o m i . e x e
C : \ 4 d 7 4 b a 2 f 5 2 0 8 1 c 7 0 9 1 b 0 d 9 d 0 6 4 2 7 2 d c 6 4 7 7 c 2 2 0 b 1 1 e 6 3 4 5 5 9 6 d 9 8 b c 6 9 a b e f 5 a f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h r o m i . e x e
C : \ 0 c 6 3 7 0 b 9 d 9 1 0 c 6 6 5 3 6 5 e 6 0 0 2 8 3 2 1 c c 7 0 7 5 b b 4 8 c 7 0 1 0 7 8 9 5 e e f 2 b a a 3 0 a e d 0 4 b b 8
C : \ 6 a 2 d 7 7 6 7 e 0 e b 7 7 4 6 3 c d c 9 2 7 d c c 8 b f c 0 e 5 e 6 5 8 5 8 7 6 8 2 c 1 5 2 f f 3 4 3 3 1 3 5 8 b d 3 1 b c 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h r o m i . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b b 2 9 f 5 b 6 0 4 f d 6 b 6 7 _ h r o m i . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h r o m i . p e 3 2
C : \ f 3 8 3 e b 6 1 0 7 6 0 1 1 4 6 2 1 b 0 d f 4 3 2 5 2 0 2 5 3 4 7 2 d 0 4 a 1 9 8 9 6 0 0 a 4 2 9 1 0 d e 2 3 e d c 0 7 f a 0 8
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h r o m i . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 6 0 8 2 b d 1 7 b d b 9 8 d b 8 _ h r o m i . e x e
C : \ d a b a 6 c 0 8 8 d 2 2 8 d 8 6 9 6 4 a b 7 b c 1 e a 4 1 c b 3 1 8 7 8 6 c f 9 2 7 0 f e 6 4 0 3 b 1 c 4 3 9 7 0 e e 9 a 0 3 8
C : \ c 2 9 f 3 0 2 8 f b a 3 2 3 3 b e 5 f 8 5 7 e 6 9 4 3 5 0 1 a a 7 7 7 2 1 4 c 6 d 5 7 b e f f 0 b 4 4 4 c 4 e f 8 f 5 7 9 4 c b
C : \ 5 1 9 c 3 4 5 4 6 6 f 3 0 6 e 3 a a 8 6 d e c 4 c 9 f 7 9 b d a 2 b b e d 6 3 b 4 d 0 5 f 3 a 5 1 c 2 9 3 6 d 0 b 2 e 3 c 8 7 a
C : \ 9 d 5 e a 8 e 2 4 5 4 1 c 8 9 c f d 2 1 a d 4 c d a 9 5 6 7 9 e 0 c 4 e 3 8 f f e 1 d 5 8 6 2 a e 1 0 0 6 1 4 0 b 1 0 d 7 c 7 c
C : \ e f 8 f 6 8 1 d 9 a 7 c 2 a a 8 c 9 0 2 6 8 8 9 2 0 6 d e a b d e 5 f 4 c a f b b 2 3 5 2 2 7 0 4 b 4 4 d 3 1 6 7 3 b a b 6 9 3
C : \ 4 4 e 6 5 a 7 1 2 6 d 4 6 5 f 5 1 b d c 2 4 b c b 7 a d 9 a 4 6 7 2 9 e 2 d e 0 8 e 9 e d 7 6 1 9 1 9 8 9 9 3 e 6 e f e b a e 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h r o m i . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ 1 c p N N Q o r . e x e
c : \ t a s k \ D 3 5 D A 7 7 B 2 C 1 D 8 F 0 1 E 2 7 B 8 C 9 D 5 1 E A 6 C 0 0 . e x e
c : \ t a s k \ A 9 F C F 7 9 0 C 9 3 F 7 3 3 A B F C 5 D 0 D 5 4 6 5 F 7 7 2 8 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d 9 8 f c 4 7 c 9 9 e 1 1 1 f 5 9 9 2 8 6 f f 5 2 0 c 3 7 1 0 4 . v i r u s . e x e
C : \ 9 a a 1 d 9 8 f 0 a d 3 3 c b 0 c 7 2 8 a c c 3 7 d 5 1 f a c c f 3 5 2 1 2 8 d 0 1 3 6 6 2 8 0 1 2 4 8 c 7 3 0 1 8 4 f 5 1 d b
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ p Z D p j Q v r . e x e
C : \ c 8 5 c 0 1 9 6 8 1 5 3 3 a 8 7 1 9 4 c b 4 7 4 e 9 f 1 6 2 4 9 a d 3 c 8 e a c 5 0 9 2 5 6 d 3 9 1 8 2 c 6 f 0 f 2 8 0 6 e e e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h r o m i . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h r o m i . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a 0 8 c 5 1 5 f c 8 1 3 2 9 1 3 _ h r o m i . e x e
C : \ 0 3 d 5 3 5 b 8 e 7 8 9 2 3 4 1 4 e 5 4 1 7 9 e 4 a c e 8 b 0 a 2 7 6 d b f 7 8 7 a a 0 6 e 8 8 f 5 2 e 7 6 c 7 9 0 5 9 2 a e e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h r o m i . e x e
C : \ 2 8 e b b c 8 f 2 5 4 2 0 8 5 e 9 f e 1 b 0 2 b 8 e c f 5 3 8 5 8 4 5 5 c f 3 3 4 7 0 b 6 a e a 2 a 0 8 1 8 1 3 b f d 8 b 2 1 c
C : \ 0 1 6 8 f e 0 a f 0 3 c 8 d 0 e d 7 0 b b 8 b b 4 d 8 e 0 f f 5 4 3 5 c 2 6 c 3 1 a 8 6 a 2 b 1 2 7 f 3 0 f 1 4 4 e a 4 8 6 c 8
C : \ 9 f 3 0 4 f 8 e 7 2 8 9 f 6 1 1 5 2 7 6 e a e 3 5 2 4 b b 7 f 2 8 b c 2 e d d 3 8 5 b d 3 a f b b 8 2 5 7 0 4 8 6 e d 6 4 c b 0
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h r o m i . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ 6 c a 3 4 f 7 a 1 8 f e 7 b 7 c - h r o . p e 3 2
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ I q Y k s D V o . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 1 b 9 7 b 8 7 3 a 3 8 3 5 2 c 9 c 8 0 c 3 e c 9 d 2 1 5 c b 9 5 6 6 a b 0 a 2 6 c 2 d 9 3 6 7 e 3 c 3 1 4 a 8 4 4 4 c 8 6 a 0 7 . e x e
C : \ e b 2 e d f d 1 2 c 6 7 f b c d 8 4 5 f d 0 3 7 4 0 6 d 0 1 6 b 4 3 6 c 1 8 4 0 a 1 e 0 a 6 3 3 c 4 4 c 6 0 a 3 d d f f b 1 5 0
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h r o m i . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 2 e e 1 4 1 d 2 7 b 4 0 8 d b d e 9 d a b 6 d f 3 e 9 c b 7 b 5 2 7 0 7 3 a 7 2 2 3 c 1 8 b 4 6 b 6 5 8 4 b d 5 1 7 9 1 f a 4 c . e x e
C : \ 5 c d 6 0 1 e a 6 4 a f 6 d 4 e b d 5 a c 8 b d 1 7 e b b 7 5 3 4 d 8 b 4 6 9 f 4 5 9 e d 0 a 4 0 5 7 6 c 3 c 5 1 2 2 b 9 c 1 d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h r o m i . e x e
C : \ b f 5 1 1 0 5 0 f 7 a e 3 3 6 9 7 c 3 5 e 1 4 2 8 6 a 5 1 8 0 5 c 2 1 d d b 0 9 1 d d d 5 0 7 7 0 9 3 4 f b 5 a 6 9 e b 6 b 6 f
C : \ b b d 9 4 5 7 5 5 9 d 3 5 a 3 f 7 e b a 9 c 1 5 6 e 1 1 1 3 e 1 b 0 0 d e e e 9 3 c 4 f 7 3 0 b f d 6 3 9 4 2 7 d d 8 2 6 2 c 8
C : \ a d 8 a 6 b b 9 8 f d c 7 f 8 6 c 0 2 9 e e 6 f b b 2 b 4 d e 2 b 5 7 6 2 4 b 0 d 0 1 a 4 7 c 6 d 3 3 b 2 8 1 3 b 3 7 6 3 e 4 c
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ c w M M g M 3 k . e x e
C : \ e f 0 9 0 e 7 8 4 4 d 9 9 c f c 3 0 4 8 9 5 9 c 0 9 a 0 a 6 b 5 3 2 b 7 0 2 7 5 5 b a 3 8 b b 1 f c 9 3 4 c d a 7 d 0 a 9 2 5 4
C : \ b 0 b 8 c 2 f f 8 f b 2 a f a 6 3 b 0 f 0 a 5 3 d 5 c 5 0 f c c 5 1 6 0 9 7 a 0 1 0 4 c 2 a a 5 f 0 d a 8 e d 9 8 e 8 8 f 1 e 8
C : \ 5 b b 9 9 f 1 9 2 2 e 8 2 6 3 a 7 0 f a 3 f c 5 6 7 1 c f 5 4 f b c 5 9 3 1 6 d 4 e e 6 b c 1 4 f 7 3 f c 8 d 0 6 0 8 0 2 7 2 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ S g h 2 o D R 5 . e x e
C : \ 6 2 2 d b 2 c 3 4 e 1 b b c 2 9 3 3 2 3 a 2 4 f c e 8 a 9 e 3 0 2 c 3 d 7 2 0 d e d e 8 c 5 b 0 f a 4 e 1 f 8 c 1 1 b 6 7 c 9 9
C : \ 2 e O Z f E o N . e x e
C : \ b 6 5 7 8 7 3 9 f 6 2 3 8 9 5 7 2 d 5 9 9 9 1 a 9 d 4 7 5 3 6 f f 7 7 9 0 1 a 2 d b 5 5 0 0 f 4 d a 0 b 1 9 6 2 6 1 4 e 3 6 b 7
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h r o m i . p e 3 2
C : \ 3 8 e 7 d e 6 2 3 c 6 7 2 5 6 4 6 9 0 4 8 5 e 8 c 7 a c 9 d 4 7 6 1 0 7 d 9 8 8 9 2 1 7 e d 7 f 7 3 9 7 d 5 2 2 5 a f b 0 a 9 e
C : \ e c 8 a 2 e 4 b 1 9 c a a a c 7 a c b f b 8 0 6 1 5 e 6 9 0 9 e 6 6 b e 7 d 3 4 a 2 6 5 2 e b 7 a 8 b 4 1 a a a c 4 0 2 7 f c 6
C : \ 1 J Q 9 f l w b . e x e
C : \ p D Z 6 X 9 j 8 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ d 5 e b 4 f 2 0 4 1 8 6 2 d 5 0 b 9 d 4 . p e 3 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ P A V y H J w q . e x e
C : \ 7 8 2 8 7 b a 4 a b d e d e 9 f 7 6 5 4 4 9 3 1 6 0 6 c 3 b 6 9 e 1 1 2 3 0 1 0 2 d 9 6 5 4 3 9 3 0 7 6 3 e 6 e c 8 0 1 0 c 3 6
C : \ 6 7 e b 3 2 9 1 1 6 0 c 5 c 6 2 a b 4 1 c 2 4 2 5 1 d d 8 3 4 d 2 d d e 4 0 f c 4 1 b b d d 2 6 e d 6 b d 7 8 b 9 4 2 5 c 7 4 d
C : \ 8 6 3 4 2 f 2 1 0 9 5 4 0 9 0 1 4 c d 1 1 2 5 e e f 7 c e 0 3 b 7 6 2 8 6 3 1 b a 2 d c c f f a 4 c 7 8 6 1 2 f b d 1 2 7 b f 6
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ Y j s 9 9 G 0 M . e x e
C : \ f e 5 a 7 1 a b b 5 c 7 8 3 4 7 3 0 7 3 2 a 1 0 c b 3 e c d f 6 5 f c 2 8 e 7 1 2 b b 2 9 f 1 0 d 8 4 2 e 0 c b f b 0 f 7 f 5 c
C : \ 9 b 5 6 d c 7 3 b 8 8 9 5 8 e 7 d 7 1 7 8 2 6 5 9 9 4 5 7 7 0 a 8 0 a d 4 f e 7 5 7 0 6 4 7 e d c 5 5 1 0 7 c a f 7 0 2 a e 6 5
C : \ 2 a 5 d d f 4 6 8 2 0 5 e 4 4 9 6 e 8 3 d 1 8 1 d 9 f c 2 5 5 e 1 6 5 8 6 d 4 e 7 f 3 8 c 3 4 4 9 6 0 2 0 e e f 3 0 f e 9 b 3 a
C : \ 9 e 2 7 c 2 3 c e 7 5 c 4 e 7 7 e 7 e 2 2 b 6 c 5 f 4 c 7 e d 8 3 8 6 d e 0 2 e 0 a a 2 5 1 d e 9 7 d 1 f e a c 7 9 6 b 5 8 b c
C : \ e 5 5 f 5 2 9 d a f 3 8 8 a d 2 6 0 6 f 9 0 5 1 f 8 b 0 9 1 3 0 0 d e a 3 9 1 f e 4 9 f f b 8 0 d 5 1 b 5 3 8 0 b 6 a 8 d 5 1 f
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h r o m i . p e 3 2
C : \ 3 0 c a e 0 d c 0 8 7 b 7 6 d 6 8 d c 6 5 1 9 a 6 c 9 8 5 d 7 6 8 8 f a d 0 d e d 0 7 4 e 1 3 1 3 c 4 5 9 8 e 0 4 0 b 0 2 2 b 5
C : \ K D W I g G h J . e x e
C : \ w E V 9 F r B D . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f i l e . p e 3 2
C : \ 9 6 7 6 b 6 b 9 e 8 a c 4 e 0 9 1 a 7 1 0 c 1 2 c 1 f 4 a b 4 2 3 7 8 5 c a 5 a 3 a 4 0 5 6 f 6 d 3 5 2 8 9 c 5 0 9 9 8 d e 6 e
C : \ c 7 9 c 9 5 4 2 a 1 5 e 7 3 6 e c b c c d 5 f e 3 3 0 b 1 c 9 6 6 c 2 a 7 8 f e 6 8 9 8 2 b e 3 5 5 f d 1 e 7 3 4 1 6 2 f 8 6 7
C : \ 9 7 9 6 c f e 3 e 0 6 6 0 1 1 c a f d 1 d 0 5 b 2 1 4 b b 7 2 b 6 7 d 1 4 d 8 7 e 2 e 7 f 8 4 3 f 3 b 3 a 6 8 4 2 0 8 a 4 c f 6
C : \ 4 9 4 8 c c 3 5 e b f f 3 7 2 a 7 2 d e 6 4 8 9 d 6 d 7 5 0 a 5 c c 8 9 5 2 b 9 f 4 4 d 6 e 6 b 2 9 5 b 8 0 2 8 4 8 0 2 b 4 f 1
C : \ a 9 d 3 d 9 3 5 9 b 7 b 3 f 3 9 7 5 9 4 3 c 6 5 1 a 4 9 a d 9 c c 3 9 0 e 0 7 c a 0 5 b 7 6 2 a a 0 7 2 e 9 0 a 2 2 6 8 f d a f
C : \ 0 5 3 9 7 5 7 5 a 0 2 7 6 b f 2 7 0 6 b 9 9 6 d 3 0 4 f d 5 5 1 f e 6 b 9 e f 5 a 4 8 c 8 4 2 7 2 1 2 4 8 3 6 2 d f e 5 f b 7 7
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ h O e U S z Y L . e x e
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 7 f a b 5 7 b 0 c 5 f d 7 c 7 5 e 1 3 a 5 0 f 2 6 3 5 f c 3 e 6 6 f a c a b 8 d 1 0 4 d 5 8 c e b 6 e a e 5 0 c 5 b e d 2 a e d . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ K i m t m H 7 I . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f i l e . p e 3 2
C : \ 5 d 0 c e b a f 3 3 2 d 0 3 5 2 2 5 8 8 5 7 8 8 d f 1 0 d 6 d 4 b b 4 7 c 5 8 0 1 b d e 5 f 5 d 5 b e 8 b e 8 c a 1 0 8 6 e 4 b
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h r o m i . p e 3 2
C : \ 8 0 e 6 e 6 4 8 6 e 4 9 e b 8 f 8 c e b 0 a 4 b e 3 1 d d 9 e 3 8 8 a 1 0 e 9 d 6 7 9 c 8 6 0 1 d d f b 8 8 0 0 4 b 2 b 5 f 3 4
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 2 T y X Z q p l . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f i l e . p e 3 2
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ G x Z W 8 d D h . e x e
C : \ C 4 8 p i G b G . e x e
Process Tree
-
011844ba5cc520cad3634beb81fae3e74bd9c3c97551e5e8bc1d24383fbf2895.exe (1784)
"C:\Users\Administrator\AppData\Local\Temp\011844ba5cc520cad3634beb81fae3e74bd9c3c97551e5e8bc1d24383fbf2895.exe"
- hromi.exe (2996) "C:\Users\ADMINI~1\AppData\Local\Temp\hromi.exe"
Hosts
| IP |
|---|
| 114.114.114.114 |
| 3.18.7.81 |
| 3.19.116.195 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
| sellmakers.com |
A 3.19.116.195
A 3.18.7.81 CNAME traff-3.hugedomains.com CNAME hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com |
3.19.116.195 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | bc57f2247c32c1a4_hromi.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\hromi.exe |
| Size | 58.1KB |
| Processes | 1784 (011844ba5cc520cad3634beb81fae3e74bd9c3c97551e5e8bc1d24383fbf2895.exe) |
| Type | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed |
| MD5 | 9c34c963d2a3e04225bd05ccecd8bb24 |
| SHA1 | c05ce9f54540583a19e774bb966a9f2a4af91e8c |
| SHA256 | bc57f2247c32c1a4647c9167f62717adf3605e7f52c63479d92ffa772df1efef |
| CRC32 | 00C9751F |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.