2.3
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.77
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:GenMalicious-HVT [Trj] | 20200513 | 18.4.3895.0 |
| Baidu | Win32.Backdoor.Agent.i | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200513 | 2013.8.14.323 |
| McAfee | GenericATG-FCKW!ECCC610EFF23 | 20200513 | 6.0.6.653 |
| Tencent | Trojan.Win32.Agent.acf | 20200513 | 1.0.0.1 |
静态指标
观察到命令行控制台输出
(12 个事件)
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(6 个事件)
| section | CODE |
| section | DATA |
| section | BSS |
| section | .aspack |
| section | .adata |
| section | ExeS |
动态指标
在文件系统上创建可执行文件
(2 个事件)
| file | C:\Windows\System32\svchosts.exe |
| file | c:\$$$$$.bat |
将可执行文件投放到用户的 AppData 文件夹
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\68f7dab335d8e6e05e6f223ec63755da31ddaca81cfbfbec6f3003942644eb1f.exe |
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(4 个事件)
| section | {'name': 'CODE', 'virtual_address': '0x00001000', 'virtual_size': '0x00028000', 'size_of_data': '0x0000b800', 'entropy': 7.985330386647021} | entropy | 7.985330386647021 | description | 发现高熵的节 | |||||||||
| section | {'name': '.rsrc', 'virtual_address': '0x00031000', 'virtual_size': '0x0000a000', 'size_of_data': '0x00009800', 'entropy': 6.928504988659096} | entropy | 6.928504988659096 | description | 发现高熵的节 | |||||||||
| section | {'name': 'ExeS', 'virtual_address': '0x0003d000', 'virtual_size': '0x00002000', 'size_of_data': '0x00000d5b', 'entropy': 7.7114067838204905} | entropy | 7.7114067838204905 | description | 发现高熵的节 | |||||||||
| entropy | 0.9257994058155544 | description | 此PE文件的整体熵值较高 | |||||||||||
网络通信
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
在 Windows 启动时自我安装以实现自动运行
(1 个事件)
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\SvcHosts32 | reg_value | C:\Windows\system32\svchosts.exe " | ||||||
从磁盘删除已执行的文件
(1 个事件)
| file | c:\$$$$$.bat |
文件已被 VirusTotal 上 66 个反病毒引擎识别为恶意
(50 out of 66 个事件)
| ALYac | Trojan.GenericKD.40513395 |
| APEX | Malicious |
| AVG | Win32:GenMalicious-HVT [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.GenericKD.40513395 |
| AhnLab-V3 | Worm/Win32.IRCBot.R3593 |
| Antiy-AVL | Trojan[Backdoor]/Win32.IRCBot |
| Arcabit | Trojan.Generic.D26A2F73 |
| Avast | Win32:GenMalicious-HVT [Trj] |
| Avira | WORM/IRCBot.86875 |
| Baidu | Win32.Backdoor.Agent.i |
| BitDefender | Trojan.GenericKD.40513395 |
| BitDefenderTheta | AI:Packer.A8390A801D |
| Bkav | W32.FamVT.LoringK.Trojan |
| CMC | Trojan-Dropper.Win32!O |
| ClamAV | Win.Trojan.Obfuscated-1662 |
| Comodo | TrojWare.Win32.IRCBot.RICD@5j7h88 |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.bc4a7e |
| Cyren | W32/Risk.VXNU-4867 |
| DrWeb | Trojan.MulDrop5.7150 |
| ESET-NOD32 | Win32/IRCBot.OV |
| Emsisoft | Trojan.GenericKD.40513395 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Malware!9219 |
| F-Secure | Worm.WORM/IRCBot.86875 |
| FireEye | Generic.mg.0fa8b48bc4a7e912 |
| Fortinet | W32/Generic.AC.56!tr |
| GData | Win32.Trojan.IRCBot.L |
| Ikarus | Trojan-Dropper.Win32.Loring |
| Invincea | heuristic |
| Jiangmin | Trojan/Generic.bglly |
| K7AntiVirus | Trojan ( 7000000f1 ) |
| K7GW | Trojan ( 7000000f1 ) |
| Kaspersky | Trojan.Win32.Reconyc.gunk |
| MAX | malware (ai score=89) |
| Malwarebytes | Backdoor.IRCBot |
| MaxSecure | Trojan.Loring |
| McAfee | GenericATG-FCKW!ECCC610EFF23 |
| McAfee-GW-Edition | BehavesLike.Win32.Sdbot.bz |
| MicroWorld-eScan | Trojan.GenericKD.40513395 |
| Microsoft | TrojanDropper:Win32/Loring |
| NANO-Antivirus | Trojan.Win32.IRCBot.dpvlrd |
| Panda | Trj/Dropper.AAP |
| Qihoo-360 | Worm.Win32.Agent.B |
| Rising | Trojan.Loring!1.A1A2 (RDMK:cmRtazpZPCKihxT8rN45plg4aBrl) |
| SUPERAntiSpyware | Trojan.Keygen/Crack[Payload] |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | W32/Sdbot-Gen |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
1992-06-20 06:22:17
PE Imphash
5a498eee87e4d89512a84502f500181f
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| CODE | 0x00001000 | 0x00028000 | 0x0000b800 | 7.985330386647021 |
| DATA | 0x00029000 | 0x00001000 | 0x00000400 | 5.990819765625397 |
| BSS | 0x0002a000 | 0x00001000 | 0x00000000 | 0.0 |
| .idata | 0x0002b000 | 0x00001000 | 0x00000600 | 6.692664294641467 |
| .tls | 0x0002c000 | 0x00001000 | 0x00000000 | 0.0 |
| .rdata | 0x0002d000 | 0x00001000 | 0x00000200 | 0.2044881574398449 |
| .reloc | 0x0002e000 | 0x00003000 | 0x00000000 | 0.0 |
| .rsrc | 0x00031000 | 0x0000a000 | 0x00009800 | 6.928504988659096 |
| .aspack | 0x0003b000 | 0x00001000 | 0x00001000 | 6.111174633718887 |
| .adata | 0x0003c000 | 0x00001000 | 0x00000000 | 0.0 |
| ExeS | 0x0003d000 | 0x00002000 | 0x00000d5b | 7.7114067838204905 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x00031654 | 0x00000128 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_ICON | 0x00031654 | 0x00000128 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00032494 | 0x000002a0 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00032494 | 0x000002a0 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00032494 | 0x000002a0 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00032494 | 0x000002a0 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00032494 | 0x000002a0 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00032494 | 0x000002a0 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00032494 | 0x000002a0 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_RCDATA | 0x000327e0 | 0x00007b5b | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_RCDATA | 0x000327e0 | 0x00007b5b | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_RCDATA | 0x000327e0 | 0x00007b5b | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_GROUP_ICON | 0x0003a33c | 0x00000022 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_VERSION | 0x0003a360 | 0x000002bc | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
Imports
L!This program must be run under Win32
.idata
.rdata
.reloc
.aspack
.adata
EHF T!
It<,IU{
7@@onH-sPsb
n^{*.3x
vIW(U*s~p
HPYEA
/wY-$m>
+b!YphQYQzV
MF<"hD
***z*j*R*J%K%KHr
"$OHDEQ
$PPgo<NTv
-bA"E"
4fsx^F';r
HA@Tu1bU"i
0$*Tb%g
hvX# B7
ob!}L<
Xd24sR*
#?+o^^!M@z&&O
r+h=kLD
GK4v[J
A)Hpz_
S-qF`13S
N?&}&/v;9u.I
JhH2IS
5)K^u+p
WK,HI!
61;RKjNV
vJ]%|)DKcq|=tH9d<g
Lv9"c
}#DL_T
eCN8{z
L~x8/un0
O77YG0I3$?
$6O5>Y2^d
/5ox[34X0v
b>eCP|_X9\
$Gr,_F
`B!BCXzE
vF_hK&?
`%CwlY
=QDTYbyX)
\3M9f6%
DQU'ARvpsP
ZT:W/)
],e3D}}
vcy?B%~
`mCjU`<?0Hw
tPbLN(
XJ^8n%
zW'YU 6
J]Ab.'gw$;@qw
,y&k*c
#ni3Cks/|^>Qr
RRud4 x^
Au:|Em
uLPHuHU
E%s5&:*SXjay
9RQ:j_
ELJzIX{L
yPX9D~XU~
^$jG;R9
2dR84 !M"
O0gXGj
G.c`Of
,/#(mM=
TFX;!W:R
SPU< 7
%{ h:PM[L
F$6+]Q4Y9
DO\h)l6joovJ\9W
D'K+;#
RZQ5Q.j
lI6YhX>
n(%]*PK
qt13Qv5@)
,t?x'NiG7F
$,O%>\\(qJP
36l{w0
kKgsJ`X
jD)1Wfb
}O1\O14
imfD3-
ryk1 o
ouY 4E
JK%D\/*D
ebmYID.jd4
9m2pf[`G/0kE
Be@pPR,1Oy
V9&(IfdmN!
P2k7Ax.o')2Fv^gu
{ca \=>
^Q5jJ5N
~/D[?KY
l|3A?_S
x^EL.ryW
:Mu*R\f
5z-/M]
U}Ts|)'
_iLXh0{
d 7;#*6@7
7j[O\na>t)
_P\yu(
#d,a~0#
6tpu6#5
`~wU|p
@V[*"1
|4XM!LE
qH\g9~_
58k;dUm)
%V/*=j
AIId)$.]LK
{@xH'K
})3hU%y
mG`nowQ
!jA P#s
F.KiH\
IX1'k{amQ
6w'#=9b)
` Uy(uRG4
(~HL8jmXZ
1_wMF8}ko
t@<=5@CNe~.MmF4mc
6E|DJ
/="*t4i)j9
D)td(_6%
Wobg^D
CPHxv^H@,?OEI
V@)Tr2H%nS
sBt2G&V:Gtb
BeA M_
|+\8Fc6
rI%CIo$w
Vb9lw=]ai26y$3:<`=(H[
A<kccZ
i>ur(OMTm7+
"W0Deg
=4e1,MQl
="3RfGkl
m=(]J4/'9L[bR
h|S9fN=o]6t.Dop}f)Dxx M
723l]7g
|6"[RSS
-qDc}g*
2*tH"%?;cNle5
x.|e=|GgNo@ d
V|k"Kj56
)|1.zs
)^fNYl
b##oNxp
T763qCe
sDIYv'*q)2N
l$AG9PV*m),]
{.LYGR?FA
mLxMI +
_[(N,z}
*uxl|.
''d xG
a~bj,3>
|:{"TZ
OTn-QwG__
?2&iU|=S
~SEpM5}
ee09+(L1CJ-H
etF rGqjw7,`;
ZA>7lDUcCg_`%~@
ETE@ i
A>wSt)
<_9ejC[^
414JM7[9E)?@c
(TR XE[6i%PA
*`W~o|nn{*;M
zlX_N;
)Mk;!s
L3`&325?R75w:@
7pLtg*
xzwd.z
sb;!r7
S?]:*5
VRTP,5~G1.
zwL?Cy
#iw1p(1
|JF bL[SsP^
7?$s)\
K:TgRV%
W7HOzZ
K#?II{u
NqN{4!
.x'-Ri
nm{5'&E`&nl(aa[A3fL4,
K\W;n>G/-]
i W#:w
3(|`;?X
UX_":o?[c
WR]m[c
QQxt)gy
Wg#@2e1
k.`/4"
L)\.m;
c[dD?J2iH0?P
$pUGm{ot
GB%U`&uyc
@n6p5/J
Ov9)bHI
!@/ynQusP^
"Hr1FSi
wfBx"h~T_
YHG= >Am
oof79k
kjA9O'3:N
/c(~bl/6%
nlDLJ^
^}DrXB`U
\:m_l"
q j4Tk
6!p.CdeE
z?KH {
0~F27>6Rm[
;'w,W?gT
E4iGE!tSKKfx,TYq/wzMk
\Qtx:)C5omTz
ST"%<E)bR
"'BNDN
N|NKq>
%Fq-"sBZ"ssXDr"X
< 5cDGV5.4
G7G1(V^
5>MF`4(T
7_23C<wq]
{I59T7~
XYT` ]
p5a.J}
Oaa`5;s
sG>S^H~
.SZ{YW
SSdS [
EiZ=X}o
Ny$|7a
3m7)QXHv)3C7
"o`3\O
A+Rd>KG
xiM{[m^iM,w8_$l[k
rXkI@k2.RfZO
kOZj$=p]Z
[<P>3KM#,_
?lc)=2MrT]"
!/lq,j%_
Gr^KHizxeZ
$iMI!U
/e)#=Y
6yK}7<
5-6j,j
4]Z$R(
MY`bvy35
c2/YLPV4
[vek`o<C
%D;"pM
W{OR`( 3
2<qh=;
&T S%(I
UpVv^$`0M
gX>=?>RLFG%
C`_#ncY#
/zZu(Ma
8:X2!EzPPl
"HQk &
kSL{a#AEoY&
[a@M}D#\
WPltpX&N7['dw
G7 stR~n}=`7J
6cdZIA/H
qH;Q{u
~xJUZ4
6XGmMKZ&*3Je
1@uRF]
K&/&7O
u&a=c
rV\/!#V
nM)/K>H
;0^[a(c{
b1JQ>OW
*L;Ikc
iNPPB@
+}8}?=>rY
Z,}z!%
^x3hP |n
T):7Nm]A
To++K&
#`+y5r
9sz'+gwW
\7'GG'
QCF=Za
^~?x5HN|>O
` 4aP_e[|ep }Y
[r1hU~#
hs;U@Z
I'|bN",
Vo'K&_r^8W61
o`45Db
N1SGS~x@
N[Y=[9
S.7RMl
9B5`kof OH7[
hC!Y/*1yPYc
qnh)qpWG!]
)][ZRJ1)T)8
vd 'd[eA@=[W}
tD#Am-N
t[&l|sAP
fO XFs0*
ll1E8
RxH?<@+(
9k$Z-QFJc!;
evm<Ma
!e~1Elu
~I4wyg(2
~2FzC]`
pbO>pUF*53t>
(8:'GJC_
Os&pgE
{mxE+^TI
$Xu3kfq-VP
} UR:IjA
Q9P"8E
+049|F2
a\V6Q|y
.Cw.MVE
)NS+cK
%~A{e)`F@
);P"XF/
elq~v$87
l`8qpnj
Trdw%Aw=
6sL|@q
m`'3K%*wp
2Sw@c'=
Q4/'yUf2I
@4$?9
3Y["Po
fT{{7Hu
uhfPyTcZ@
m0mb/s!Kxav
Bj8(;Nk
aw5G<
t0sAcG
iGEpBsj-r
P=M>9rV
#VqKwOB
2 >;Q&4U
LOeQ&@c+Ok
pr\Kc$
o&Aha#!
w[pNCRlt
6GZJP<
:|(@Hq
dd0TO)C
g7)b\4`:
@#}*Ng
1+U)@;6D,u'
ry2Z`xvm~X2s
Cy1}5f=y
95-J.Ua
7O&.r-
\A)_/6z
uS=N$D
>Fg9rv
lBLx)2\~
q/Mts?\t
k[0KHs|UZ
^[1tq9
kA`_Hmv@_
G'zDW6
D')[r.-x
/J2L;X^]7
JXjVPqfN
t(DeGZX
J2te"Xbj
,-at Mra
$WPq~J",ss
A6a9,9Y]LJ.Xa
<*"0r ~Al22
(Eef`|?
}AoD"42R
|={#xv*~^^
w[~\wp9R>8
OI=HVs{
l'![_X,
u"jWCB
]*/b72'
ek,aX;T,D
iyf] 8?
LIzfHP1s@Wp
%fI,|V
R0,!)kgn
,xw`HP]a:[\nQ
/>(16AgG:
-_77'7c
yH[eak
=O?0F?
d{z3J6
z\Wx%aXl&nuAEYi? c>3C3
Ku):H{o{
OBgc$2
uJN9bIbv
cL!YJd]<
<WOy%f
8"0~#Fd
A5&[pu
J/k]ja
s! /WY
$'?.$6]
?[afaUo
GOx;2(\d
>gxT9I0P`
8([7}0|S9
x>0%>Zi
aIE8D4TtR
G!X@}Ke
_yp_A3
'JI\~m8 \y(
ut$IJ<
"#2&e(SL-I
Q/GU8n
Hy)d|8ljQ#
BfhtVM93h;jl
3TcP| N/
AKz{yzth{g
,|0jYe*+|Y1S}n~)&
Ue~x0]
WdpmL!
$q&Jx\h
n$M}8{hdj
.(fkhOkO^PQ#
1 ^xv|PP`
U_RZ5a.;
),|Y%PZ)V
9r<.S?
uV4AUSdU_~w
[('\8B/2!:>"o]
^Ks( F@
Od?:1%
9+2CwNID`
lH?h!Fy
]tEkz{ 8S#y
4kbg
$xw0JY
zybB7J;w"qGJ*
_hnIB'
g@waWp.LHW@SxRL7Y
H+,HX^}q$i@^
@P'TAkM8*bj
BzHR#H
lS!_13
f{^`0]|
z*?*72
"!J%y+
uX?*T7
H&V6MRa
P$%`$"j
VYTR}RI
0jQ7JENs
|T1oJc~
vT}Ox.
42!oeZ
y~@ VoF&c
t x.U(\h
bwJ00=
'.z^kzp[oh^#
uE]00.`06=f
*{[%mh[^c f3
}[c9$"(:
-r26Xek2
/hut52
e)E6+0%"7r"
kLV1@{
_j5MXKa+3
B@3E|u
Tv,&j.&
VL{(*5
,'(@n1
))*G>0+,>
F~J2k3
"!xKb]
Q(;T{2D
UI#{(<|wp
ERRlr+Fo:S
gZ-vG_M,mJK
"c;L9'.K_|$
z{0`Nq2YqQ
|eb{,
u+n m:%w4
pPKKmy
wbp<XLH
7&*0(L
V i(BV>Y!nX
tuU=+\b
cCv+1t3!H
cwWdiO++Q
x*hjo5
H?8?Dz
m5bhRi
[=\v<|
yP[G[x
9@t@=\
fl{{wd.
c8R)u<
{u55o.
TsF6Mh
^!xEPh
0)N<JK
{9XIB3
9{l)&51w]
RIJokl)R
C6vce+i
#T4{]V[b
$t!ze$^~
z$2^cf^BEuZgD2xD
FPJA~8
rT}mj;6f
7WxcrNCnU
rDC-P\
<eUQ=O:U.:
-N\J3zfE{3M
Hvq_;Z#
bz/?qX=c7GP
{]l6jt^
1jVkK,;*[k
+U:S^Y
[{yd?(
{#6a9tM.y
7j{il?
;yk e}X
jGG^d[fAM
03a "Ir
K!J7#Ngg;
]p 3t)
hG`n]VYW
j.cnra:8
]tfh1b#
Zj 2`Z
qd5ThNI
MT=PT%
O4Qf>+MfQ6EYv<20qwX
!;Ls0ESO
@ml,aj}\hL/M{
<vKBe8I9onT
A.^nWo
y0V\9=
>oD'Ip>[Fh
(ZL2J]y{%i
oaev).
pfITusJePlgmd@
JD5{wii0
/O!RDF?
=Fyzb+
<A+F82@
[4OndN]87xHqB_
vZ%CR8H
Ixd!VC>
/fYEU_
AqVGOBLW1^w
h0g4"G
'9xt{#
t"I:6)V>
{[^5b0
_{k^\'
4Sf&[H
/5`6bJ^0>P
:3;^vfS
7|{%z1
==AHt&[
@G*vD=/^RN
Q]j:>s!^h
suhzPrF
Ap%'4_
9(+M{}cs|uq7
#*2!Oh
,[\n#td+M_m:rFFc8.
7R4Dhj
W8qPN1
nH<lA'
LYY(]9%?=x
,FY;;O
V3L+ Eh
[-'x)h
#WqSlGN
xnF-!\Mg&IR
<N1\OgZ
,xi4XT+ V!
8NJtRh5
$`C]8~&;O|
bMYC^O$
H@RGc`D6
4-Hi:="W
!(3x U;"t(_
vFF<Ax}
dblIc0x>SH
jX~y5~O`)2
LME;.yc~7$[
'w,kwJ1<siU
v8h8FU
nUnoz[9/
P"vXz[WL
i.{4GZ(
L(}/2s];
Tq-C,wQ"
!{OUUI-*jKWqzN
%lAx(kQo.Iv_a
p4 e.)
[Cu}^N^
2_h7Go
t>t0Ku
~?LD~^
<|6dwsl
[N27^qr
q\yCv.;C
;"rmyq
Td)Y'O(
Y[SNB^i|
h!%5q5#a8Dk
&k<}M3mv
Y_H^!W
5LeF#o
L8NZb
l6MNNa[
*aQMniY
KMRHcd
<AT.Ikue|P
C/*LZpVsl
4!-W8mv
X_x-4xpPd?
S&{ Ls/rB(
V {w 3u
7qUfza{-J[
$(TU%^
)%:iRT_Awj(
S}^5^V
W';??E
_%}D@m
d>g17o-
3WvgW\GgYw~h~{
vwOtW|?r8{
Lo^:=z
2?~eT~z/
6psQ;s8
7F;5"]
=?==y kj
]#z>Kw
=_zE}_xe:
MxgV]Sw|.j~
iKAdG`
ygp"^$Y
`"Z&`=+&2(C
<`DL`vWc
\"I#@ 2
r"@#nk
rl"<OX
"H#nV-a
%26tGT
D~F.h$6
Jy`@\%6
@"`#nc
0;+'(.
Y+[%+0j5Bn
Z3i+cA=H(
9Hifa[U3vA8/dO6
N(I"#\nH
qAZi"B
z<VL+0d
pzM@[c
Xz@0A]
x+^&xT-A
Zq2(V#q
xLP+0:
k.?8zk
ev<PV&(b
VKAdG`
V&xT-A
ygp+L$Y
o+^%+0]
5AZ)5Bn
ygp+A$Y
03K9`TQe
(+B$PX
o+gk..YT
9lif`+;z`f4rZ
JyeiL.PA
=@VM@[c
="}4x`P"%
nhp8"%Z
ygp+:zpM,
X+J$YC
= V&hDuA[+
8"^$pX
z<D&Xe
0"Z&0;+&1C
~ rW#p
6p1v0"ns
{wLucz.V-a
0+F&0;+
2b!Y+Z#rW#p
DJADG@
=03K9`
z<DL.PA
bzPTMna.
=@VM@[c
+\&hDuA[
Jy`0aV`
x<VL+0c
|ih|$1
z.og n'
f2%M>VKs;aq7|}w;7tQ.^oXZ52T
n [Yh~&a|7%g+^4
$oLJo.@q+H
Zdu74XN
vxsYdv
H{O>n(0[
_;Y"n;
Gr9y"D
L x$L0
mcA=/c7|W
q7eN -
KhA"M%[
'8t>No
A_7v{Ou
{!9JiyD
$IAL>!"g#"D
'|/(n@-
HB9s~n0
sdwcqD
"N:3{w3\Jwg
-xgxyg
'aP6O?
;a&9jf:d;g
TM>Ds<
i7$I!wZ7tH
`57$Kw/
#K|7$HAw}bD
N!g0ql
,n$rR;"S%
KDw<7<
dnpY|Q
Hna&q&
+7,I@,
*nI$I;7
>DH{'.n0~"y,
~%h ?S/,
1%l 83
1%j> S8D
:#xVd hm
w9;&m2
.ocy{cj
%r7^x7|Wf
df "S%
7|lgy.xsMW;>
?fQH#
&xT;7$MP;h
$G\)D!"?
#$|y99-"L
T)*EKLY
/7+YHL
acgx$,
1NMI"D
lP7NHY
UKv <T_F;Bj=J
AdtT+s~H}J@HC12SQ9B*t
ISxO0<Q2
BhF'WB
UzEPx<;jCfT
l9W8]!WYlJ
6EPfR6BE
"<=YGU
j9v\mF7|*i;<KL
2F?"Rn
"<tpSg
v 2TNdx
"8|(B[gweMb[
[ %FrF
"y,|iQnx*
U2"Ijl
"0=yFA>*w
f={8hEf=xq
@#4g-P<eO
8eDpDJP
N@~P2w
$~^"Gxbr
w ,TY3@
`"0 t?(TNh
*&DyA
TL8v4>@bd
AOaN/82#5
P;wx4EDdE
]Q'(-@D
NX{8N1} wkTD
@Kh'h!
]{yQ0J
j7 ;BZ^GE ^`
,;T%D%(xT%Dd
0(?3BT
%(r8!T%D
D<fZwP
["(pPNV\
xeNUpT
Q(r"NU
0aoL>c{7k[]2E?
v/n5?e
xD2<we=s?w
oeqcs"W_yW4s;
gd{rxn_9ll|Ts
jL| {9u:
{91y[M
xWwmOd6s3]
%5:mN[2
up1w$
9Q;{}T
3o?f4xG@:'x
#>7#t!E
>*[znCs:c K{Ufu
%I!E6z
Oqq|OEWt_A
:2*X=,#k
_^(3/='}0G
Mw:;^
2wwdpgz62k;TBZolW]gEz;IzM4mn
}k=/#|nr/Y/V
Io}$ ~5E915?
zK?9],D^Vc
lS9[xwn>#~tU
oqo^tM
svQNHz3gm|
4[?DGu
!,11],{GO
niXJfyvo
$f\w7c"
eW"YDazA
(T<]OUb
883si]dJ<NY:
uh"4@N
r!}(7#^Sx
6^k\,n
w1nGWtZ_l
=kEl`3{P,Yk$eO
=1._j^
'}P{zC{|:
w;;\?2Y
LKt^,
Wkf4^c
C}>9[@
M?_+T^t^R MJH%^$
j?qeqF
y- t/Z{~z`
sy]VRN^W#
&'p3L_!
xW?XapiE
%&Sm@XHs:}
06>MD.}m
{wa YWFG
[*E:S w
s#,uhu1
fHc`3aa
-"}Z,!`
[2lQ4i\B
CwR1g2J(%jY|`
V,z2oLj9Y~
6Bm$C7c
pFm4nLk]
R)`,?0A
i$0}1*mPIXi.0v
+%,P^P
t5X" fX
3oD9V#A
ZyL&n)hmFn5F|yIEP
2s-beJ
n\^V,}B
7R1-N1J
7s 4yO.
kzr+9{"
A\#^jA(V
PQ[(0\B!0pQ 8
89-q.4o7
wOFuil
zRCm9q:-+^G7
gI_KB:*
ip4?=Lj{"
E| x/B2d+
pI=J"2%Y o?JKfF,rE[
9e&KBmItFD^.~9n
q%hA1N5 ~
UF}RtV1NJNTR(p
9E! YdD
H1RA 9
(h*bYMet{H
BFGQ/DJ<
p<(vld
wlDM3s>R
cl(DDG
+~v9x[8{xn,b
LyC<[T5
)i,ZJ`6#d
Pi&o@N-`!
:eKP ^
I_NxRXI8Mic&
Tc~uR'YxV`rF
4,-K>6
DXKG#ngA5!
wJvJXR:9NPAU\,2
g.#1Gbet,
"_gg
^qY)eq[SPDU/=K
7$l-^0
+w25BO
?$}'4_>IYf
z9QYs
'c8K+Z}
[F-" 1F<
e>l;33!
k%ZhLO
wwwwwwx
fffffffff`
wwwwwwx
Install
QTypInfo
"RTLConsts
System
SysInit
SysConst
CVariants
KWindows
UTypes
$VarUtils
SysUtils
sActiveX
3Messages
^Classes
L!This program cannot be run in DOS mode.
.idata
.aspack
.adata
_ 6r 1>
]{G&j>1
w0}>QX
qC.<<R\iC
bvB 1U7
OK*i(qP
$pAA{+
;.sW}AHe2wM
x6vG`14
ef]JcpKR
{t[sJ"
WVC.K(RjUE;-purz
EOW*?LI\S-7S
$@}c{b{d1
N#2tCiZI4SuM%
ei8Q4RIX
E%m%[xfk
GtN\of=G
X/ {&fM83c;
R5ZX~b+Sjx
{nH'"~xe<gwt:
d=uotu|
".k-,QTO
R:q:%`~
d@s4t;<?O~6+m
EE&ThkXY_Q
c`E1I5>B^r
6VCR ^4p
s3WcQ?Gc?: ~/+
ZVOGmmX)*k:I
wI9:F YmLd
G:I.rA
AbvVs~
oT'lIK
hOQwuzR
Z&UVI0
/)X7}7
Iz:+F%
EtT(a9h
P%1%5h5 Zz
VmQpKWej
5KG R^
T)J}Z-&&
2-FI>Z
&?z}j&
~G58*|
(h7drBF
.?X.@/!
IABC2mm?z
(UV6LpF
hQNPv\E SHRI<[<bK;q\
$:at?tx
.[pOZ3
z@ HE |XETo
(nL{zs:q[d
i,gfWy
8BV/@:X#
Oa!<ML7UX9w
1x|P=!r)C1>ldNv|dRc|
/J\3*am
M?y0S<2+
A-abpa
!/&s"I.t
.bn6m8p(
!0lnF'7
sG zu""|JY
W?i:DL~
W^,&zy?(^
Pu9J;V*
GO+^J,e @XV
Sd_p@}
pz\PVAY
68p:HE|
l~>6.$r
;z,,\M
sOy+CAh
i %rRB
RAd+E0
)L9MJRL
!gmNGs
^LOri{D
R[kP{COj_WIft2
mj^11UI!mKn_
]Y&85)8,^6
E(T=c:#&
/go"v=+cb
8*ePL~8
noB.Ah
y~ei<V7
=ojyrO
q-k=ej>Yz
8=T7KI
Kg1\YLXw0%2
+htqMl
9@F:(X'
!mOmp,5
zn5D"<9
~zbmLD%Mm
^<=~@1
xo68BgKy
IS1-0gX}!
P]7*/vS
gpzH@4BT
m3a3ci$
#%4C8
-#vF-r
^cMGCsALD
$;;N{4kk
6#=c6n3
[`bxhczC)
CtJ=,m
} '=+2(6l!$f
xXcX"?z\b8>z}
R2,Z5!:b
]^oo#i
rG1'}s7F!Oi?y
uADRexxF
BJL0Bwj
B7.,03<l
el\O30
SFqT.jq
8O}WJ1
059v>J'G^N _
Cx;^N6
%A)m+r:{]x6G
D*}s GcgC
SteO)_}\SbP
~JDA1[
@KGfq68U!/
~KJ9ObY
p|?bG|W=!
c1{g3g3DH,
7 x1#P
tC'lGC'c
N/$*\,
!VQOu/mNY}
Z4E8#a
;vWbklIw*
S@#b?]o
1gnX[ ~6%C,T
Ag05As4M0
Syzeu%
hfXI=Y+6o1'J9]\e5
1?^4}cE:H
ge`QP#*6K
"te,D7t
&=||s@Z"Yxl[\
}UFa5c
<:hfsSExCj
[];T2)
S{(N]]lW
!SdSc~RZ
!EUrM/^>
YLfcc]
<O2v8k
!(f8{P[:=
E@8pQO
2O.::X(ej=|0
%MmvszKv
J!;nr\
(#! B\
Znqo8j\
-?2fJO
q(dTy%r
L0,C~;*
V f:^oZ]P
t!c;O)`P}y/5@n
rPP4W:
Q,&[ImnExAH
3^T;'xu
e|wTUB
M?I8t 7
c"'4m+ag:i
Fe1K#A
D!*Z;]
mqdn]^
mrVUbWkNwD`:
?L5lnCbH
o q.UtOY
uW$z|t2zgoGPmouw|
b@R+#S5S82!
QQ<kM=X]f
{+`q't
fFpPu#C
l@dfzpVZ+KNdWmdjt=Np`Li 6
"mK.Q_
^S@Pth
tW[Y*d)L/3/2R
b}O[kD5Y
E6("o5
"O_>o2=?ZDii
+KEJc&
d3f#ZF\
yqMhu>OV^!Px'nDJu
yGfa,w
E|^ja|Do
[:,=,Y;f
g9N?J<N
lc&wUY5
J67DE-3^UQ
# kuB/2
lMI-.W52O@s0Y=vZxZ_+
V|!md"g&$X-$|
4+>TbTW{
C@!5{3Q#Qk
(Szp&$
b2[0_V,O|F@)^n\
IK*vw'&
njHjr?u
'hKsg$D/K'
Jx hH3gBb:]
.8[`P";E3k
tOTj2_qMf
Oy[1XB<sVR
2i,IP<CCG
XB7<;nh
j}tc8~F-B
I<e:w]SZy
rw1V+FwQ\N"a
:Y8,e\>#
ibd<&=cU%ls@
PrC8Wmjz
SzD?0K~>
S\%:UyVR^CN
QS$/n<A[{3
73Ay;N
CM4+)Ki
Yga-J\W
E6>Z6Mi
iI{QVX-`+
%Q3Vei
R S#"o!,
79=9:8
####################################################################################################################################################################################################################################################################################################################7##
BFsl%!gkEgG62";J
*zp @.i
)J2P<<<
+#OQL.6
Y?YzUQ
&xw{sw4_u/K1
+.P4TYfN P!9$
. &|M3
-]a^;b
@1tI1JE6m9r&?LM,r*B7%p
~4~ )I
D*sY:j
y}>Mvug{x
W=V*u,~
76/3z+'G
e<? `2
per=>O
mp}F6:fp
CA@g 6'
9S|k)OXg
5V1~n'_:hzGz'Z k2$E%
4uH{9HA|
N l|X"@!
3~)rb4
S]}/9KQ?
n! [w}GLgOC
i@|"u*[
X[K#-+ml@4
> ]"a#x[7Z
+[rF6w[%C?@
d9.YPiN
KC[NfK)D
,@%xjf
D"yr{{
"05cP,
pT[ _h
hkiGF)
VH1sDe
0?q3Xs,5`=]AN
GNpeS0~9u&I'L0N%@
&%7BxiW
A;Tv$
,DQNakNOj#
CmiC2)1Uu9@
+WT]A
LN,V+v[Q^M
]C'ppD
tS? f8
8J`xS'ow
~2Tl2(^5ke5b'_
ut=O[zYA
z]d3,-M
N,">Rh.//
g=zc}G5
rUQJdPl<Vb
6ujG^f8Q
nV~T,ZG\d4
f8A_Yz@
dG#scG
s%5-?y
###########################################################################################################################################################################################################################################################################################################################################################################################################################################################7NN;##"
o)68{[/[n
38EsW!
^+SWx{
*]cT]Hv
(y'UJv=S9"G
"a;Z/Z
TOtNM:.;dXGEy
2H__>\
7Z_2F9
Q]n!'u
kq93YW
$F,^N_
TcrO*^5
VL v!WN
uj#xa+
4B} <Ej
>]DiXo
rIg\e\'
CX.(ZA};@\x
KS################################################################################################################################################################################################################################################################
\;. V5-2P3'HN1$FS5)8S6-,P3,
T.&1V6*_X:0L0$L/$P3&P2'~K,"[N.#:W1&&X,,
qjdC9C'
L+"R0#tQ-"KO.!1S- R)
xvSL`6+I)
@\1$PE|v
kbl=1L*
Bt>/[Lwo
xO@f4&N)
rQ.##Z,
gVb4$L.!Q0'0S1!
u:'gwl
yp[<2T9,0`@0
{qkK.%jO2(:M3"
m{qsrvy
zweB;9
J,#G+ ;L/
x9$zAD?=>?A
Km^aejkur}x
mjZ90;
i\`]WK>/!
krtqk`RC3
|oaO<'
uuqqts8
}}uvcb9
?c?m =
{{tt{{ji:
xxzzji:
uugf:
nnookkvvwwdc:
7=752
mmjjggjjdc;
8"E'O UWWeT0Z
xxhgD&
13 L1`;nHt<qy
hgI+ 4E'
ge]YZkKH3\=1 U+
=%P?pb
#_Gxvvn
rm~|kieVjH?)O5,
)ITmu/eDE
z|ZxIJLLB3
jpjg^4
o###!o###<<<#+"#2!###2!##
*)---#
*###)>
#a##.!/#;##/#7##.#<##
!4##.!/#;##
o$###c#,m###
2!##<X<
?########_
q,/#c##.#<
##<##X?
<<</#c##.#<
##<####)?
##2!##
##[)Bo;
##2!##
2!##X?(
=)=")0)3
<##(!(
<##(94(
<##9#(4<X"RIv2!##
C)>Bg((\#
"#2!##j
=Ca>##BW
<##C<##
######2!##8C
##7|;f
ar######c!V<<<<
##<##C###c
w###<<<
;X92!##<<G
2!##O##?G###B=#/####
!##!##
!##,!##
<##<[A;.
/!##.#<##.<<##############*$-
'#+*$)(#
*3$)*3+$)33-
3$3)/3
$3-$3-
3$3)/3
$3-$3-
Ft1uM>C)9
[K?n8jv
##########################################################;######3"#K###
"#S=##########################################################################################################################################################################################################################
oO##}1
1=o!##aC>_<A
1=oo##aC>_<A
##B;##"!8?>=4;9753
+csCS########""""!!!!####""!!88??>>==44;;::::::::
!*\g<<<"~7
?%1=S?<###&!
?%1;To7###
<<<#o*!,B!#
1?a###
###!b}######B?#mw###
###Na###C%1
`E1M###d
)1/<)15
17.?)19
Sg<###%11t###
15F}###d;T<###
~W~)15)19S;("^
<<<<###),
CAw###B!#ba###C I1M###~!aC)2F
###<###
a/=C~!%a/
ba###_*],KAw###B!#
1=?R<###^
!Bg ?^
??###^o
9p}###_;~5
F=###9
ZB4!f!5p7###
ZC/"##0
o"##~}
/"##o <<
.5s###o
"##,"##B!#
;bs###b
##bC##C###b
"##^No!###B?#m=##
!.oe<<C4
"#####N`.!o=e<<
oce<<aC,A=##
`oQ<<g;
"##~9"[cR
."o<<CC|
g4.ox<<C=.o'<<CC|"##X
C"##}<<<
o<<aC,A=##a1"##s###
o<<aC,A=##}1##
##o<<aC,A=##X
"###CcE!##?
"##)11"##q,KA=##o###{,d
11<C%1;x"##
;oe<<###4
44%1;"##["##"###<<<oS
19y###ts###o
o<<<~u
17?R<###^
n7###|?R<<<#n
o<<<~}
"##uD/"##Z
oV<<~y
#,aCf) <*
15<###g[g?
?|=?###_7###
?<<<#t
##o<<5g|??*
13<###g[g?
=?###^o7###
<<<#oW
"##8%199
1;gTo<<aC)5%1
,KA9B?#,
CA9B?#############################?###"#~"#"#####@
XX###)
9###A`0
09#&&&&&################################################################
kernel32.dll
LoadLibraryA
GetProcAddress
6666dl8
d$#$$$$
d$m>$$c"$$
d$)t`=)`
q|yb^@$#=)`9
@(@p?#C
d$9d(?$$$<9
$$$1)d$
)d$p$$$/)d$+)d$Y$$$
)d${)d$r$$$O)d$K)d$c$$$`)d$\)d$
$$$S)d$o)d$
$$$)d$)d$6$$$)d$
d$ttN=
d$4$$$p%`=/
Z$=1)d$k4j<=o:r@bt$4$$
d$MP)d$tZ@s=
d$<$$$
$$$\@#$$)d$EZ$=/)d$Z$\$$$Z9Z$Z#\$$$E=
)d$=o@)SZ$E=)d$?NZd=O)d$1o"zZ$)d$tNIE=S)d$IE4$$$
d$t)))59buI=`)d$tE=)d$L
d$#$$$<$$$
d$t9($$$)&RiRYo?
$$$&R_Xmo?
R_Xo?$$$&Vm_io"j&
l_Io"T&
_`Co"^f
$p>f4$o"LDv41o8n
9~==:n89"$$$%0I
#0+0w0
d$5H 4
d$9($$$$p
d$y<$$$$$
d$1p7!)d$p?
$$$p{N)d$)
d$@c@*$o8f@$o)?$$$tZ$=O)d$1o?
@C5u@Fb#$$
d$<$$$
@}$o]FI=
d$@$$$p6
d$t|"$$Av<1o9v@9
d$$$$#$$$oq#"9
===LrstI=
d$1o5KJ
$$$KJD
d$@$$$p6(
d$t#$$C"
$$$tI=
d$ppKJ"
$$$TR<===en6
:$$$i"
EN)d$e@
~#u@?F]@@+$
0===8f@$
==)d#p"C
d$"$$$p
d$9(MP
d$m>$$#
d$)p<#
d$$$$)0k
WhY8Boo:LQ'qCm/)c8e_zG
]Fs}~{>(M
L/;bDy
32 6-
SG+D]I!Id~29!Fw
`@$$d,$oOE
d$$$$$$$$$$@$$$$$$$]OE
d$$$$$$$$$$$$$$$$$$]$$d$#T"$'$$$$$$$$$$$$$$$X"$H"$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$q_RV_X)
`XX$$$$$u_pwm`oX_|CV`X_c$$$$$N[RpoCXtRmp_Yp$$$$$u_pwm`oX_~[X_vCW_c$$$$$yR_Cp_~[X_c$$$$$uXmBCXcXXmY$$$$$uXmBCX~R__$$$$$r_C`~[X_$$$$$u_p~[X_I[j_$$$$$yXmi_|CV`X_$$$$${i_BoUU_RtR_i_Vp$
EwVirtualAlloc
VirtualFree
t.x,<t
kernel32.dll
ExitProcess
user32.dll
MessageBoxA
wsprintfA
LOADER ERROR
The procedure entry point %s could not be located in the dynamic link library %s
The ordinal %u could not be located in the dynamic link library %s
(08@P`p
8\(L(C@;
rDt$h3t$
E@D4l|Mu
1|hDhG8
A;r_^]
YSVW33h
T4$F`u(j
}RL4#HL4$F
D$$W3|$
3V5:@D
D$,8_^]
kernel32.dll
GetProcAddress
GetModuleHandleA
LoadLibraryA
%2%2%2%2%2
kernel32.dll
LoadLibraryA
GetProcAddress
,x S,i*
J|CJ6!
_-gs q
6+%K4-A[
xFVi7"_(U5E
V4S'IVC/^rN~1
MR=xybsZ-c
[J9p/M+
:zf3`Pm!
Kho>M[k
qi4=hF
ae*RjP'
Q&}CV#Z#INb
B<TI/4\{1be
m|KB1bC# ("
WJK:)2c
a|zODTO
yfO^-0
rO^jf`
%qO^-f
J;i/m[J5
1zU&VV
pRT@og
K(2!nxqCB`1
m312als{Ri
\o1{pF
lr{J@h
1{R1C#}e3B
:,3:19P|cjY
id*,],
vY3:Bu
Vh5BQ [(~m[k9(
Da^gA"
Kt#V(4
ixGV%4
ixGV%4
~dSB1
dsBQ /
dpBQ /
~m[J9(
ixFV$3
ixGV(4
ixGV%4
ixGV%4
~dSB1
dsBQ /
dpBQ /
~m[J9(
ixFV$3
ixGV(4
ixGV%4
ixGV%4
~dSB1
dsBQ /
dpBQ /
~m[J9(
ixFV$3
ixGV(4
ixGV%4
ixGV%4
~dSB1
dsBQ /
dpBQ /
~m[J9(
ixFV$3
ixGV(4
ixGV%4
ixGV%4
~dSB1
I{Sb-<Er
ixFVWvK
8zXg5:
ixeFRY
C2 ixGVo%
D V C L A L
P A C K A G E I N F O
I D A P P L I C O N
L i s t c o u n t o u t o f b o u n d s ( % d )
L i s t i n d e x o u t o f b o u n d s ( % d )
S t r e a m r e a d e r r o r
% s . S e e k n o t i m p l e m e n t e d $ O p e r a t i o n n o t a l l o w e d o n s o r t e d l i s t
S t r e a m w r i t e e r r o r
S u n d a y
M o n d a y
T u e s d a y
W e d n e s d a y
T h u r s d a y
F r i d a y
S a t u r d a y
C a n n o t a s s i g n a % s t o a % s % S t r i n g l i s t d o e s n o t a l l o w d u p l i c a t e s
C a n n o t c r e a t e f i l e " % s " . % s
C a n n o t o p e n f i l e " % s " . % s
I n v a l i d p r o p e r t y v a l u e L i s t c a p a c i t y o u t o f b o u n d s ( % d )
J a n u a r y
F e b r u a r y
A u g u s t
S e p t e m b e r
O c t o b e r
N o v e m b e r
D e c e m b e r
A b s t r a c t E r r o r ? A c c e s s v i o l a t i o n a t a d d r e s s % p i n m o d u l e ' % s ' . % s o f a d d r e s s % p
S y s t e m E r r o r . C o d e : % d .
% s A c a l l t o a n O S f u n c t i o n f a i l e d
V a r i a n t o r s a f e a r r a y i s l o c k e d I n v a l i d v a r i a n t t y p e c o n v e r s i o n
I n v a l i d v a r i a n t o p e r a t i o n % I n v a l i d v a r i a n t o p e r a t i o n ( % s % . 8 x )
% s 5 C o u l d n o t c o n v e r t v a r i a n t o f t y p e ( % s ) i n t o t y p e ( % s ) = O v e r f l o w w h i l e c o n v e r t i n g v a r i a n t o f t y p e ( % s ) i n t o t y p e ( % s )
V a r i a n t o v e r f l o w
I n v a l i d a r g u m e n t
I n v a l i d v a r i a n t t y p e
O p e r a t i o n n o t s u p p o r t e d
U n e x p e c t e d v a r i a n t e r r o r
E x t e r n a l e x c e p t i o n % x
A s s e r t i o n f a i l e d
I n t e r f a c e n o t s u p p o r t e d
E x c e p t i o n i n s a f e c a l l m e t h o d
% s ( % s , l i n e % d )
I n v a l i d p o i n t e r o p e r a t i o n
I n v a l i d c l a s s t y p e c a s t 0 A c c e s s v i o l a t i o n a t a d d r e s s % p . % s o f a d d r e s s % p
A c c e s s v i o l a t i o n
S t a c k o v e r f l o w
C o n t r o l - C h i t
P r i v i l e g e d i n s t r u c t i o n ( E x c e p t i o n % s i n m o d u l e % s a t % p .
A p p l i c a t i o n E r r o r 1 F o r m a t ' % s ' i n v a l i d o r i n c o m p a t i b l e w i t h a r g u m e n t
N o a r g u m e n t f o r f o r m a t ' % s ' " V a r i a n t m e t h o d c a l l s n o t s u p p o r t e d
W r i t e $ E r r o r c r e a t i n g v a r i a n t o r s a f e a r r a y ) V a r i a n t o r s a f e a r r a y i n d e x o u t o f b o u n d s
O u t o f m e m o r y
I / O e r r o r % d
F i l e n o t f o u n d
I n v a l i d f i l e n a m e
T o o m a n y o p e n f i l e s
F i l e a c c e s s d e n i e d
R e a d b e y o n d e n d o f f i l e
D i s k f u l l
I n v a l i d n u m e r i c i n p u t
D i v i s i o n b y z e r o
R a n g e c h e c k e r r o r
I n t e g e r o v e r f l o w I n v a l i d f l o a t i n g p o i n t o p e r a t i o n F l o a t i n g p o i n t d i v i s i o n b y z e r o
F l o a t i n g p o i n t o v e r f l o w
F l o a t i n g p o i n t u n d e r f l o w
A P P I C O N
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 4 0 9 0 4 B 0
C o m p a n y N a m e
M i c r o s o f t C o r p o r a t i o n
F i l e D e s c r i p t i o n
G e n e r i c H o s t P r o c e s s f o r W i n 3 2 S e r v i c e s
F i l e V e r s i o n
5 . 1 . 2 7 0 0 . 0 ( N T c l i e n t . 0 1 0 8 1 6 - 1 1 4 3 )
I n t e r n a l N a m e
s v c h o s t s . e x e
L e g a l C o p y r i g h t
M i c r o s o f t C o r p o r a t i o n . A l l r i g h t s r e s e r v e d .
O r i g i n a l F i l e n a m e
s v c h o s t s . e x e
P r o d u c t N a m e
M i c r o s o f t
W i n d o w s
O p e r a t i n g S y s t e m
P r o d u c t V e r s i o n
5 . 1 . 2 7 0 0 . 0
V a r F i l e I n f o
T r a n s l a t i o n
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 4 0 9 0 4 B 0
F i l e D e s c r i p t i o n
C r a c k s W a r e O r i g i n a l C r a c k s .
I n t e r n a l N a m e
L e g a l C o p y r i g h t
C r a c k s W a r e C o r p o r a t i o n . A l l r i g h t s r e s e r v e d . (
O r i g i n a l F i l e n a m e
C o m p a n y N a m e
C r a c k s
P r o d u c t N a m e
P r o d u c t V e r s i o n
5 . 1 . 2 7 0 0 . 0 4
F i l e V e r s i o n
5 . 1 . 2 7 0 0 . 0 D
V a r F i l e I n f o
T r a n s l a t i o n
Process Tree
-
68f7dab335d8e6e05e6f223ec63755da31ddaca81cfbfbec6f3003942644eb1f.exe (1612)
"C:\Users\Administrator\AppData\Local\Temp\68f7dab335d8e6e05e6f223ec63755da31ddaca81cfbfbec6f3003942644eb1f.exe"
- cmd.exe (920) cmd /c c:\$$$$$.bat
Hosts
| IP |
|---|
| 114.114.114.114 |
| 8.8.8.8 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com |
A 131.107.255.255
A 131.107.255.255 |
131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 61714 | 8.8.8.8 | 53 |
| 192.168.56.101 | 56933 | 8.8.8.8 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 8.8.8.8 | 53 |
| 192.168.56.101 | 57665 | 114.114.114.114 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | a4ad85a3958b704a_$$$$$.bat |
|---|---|
| Filepath | C:\$$$$$.bat |
| Size | 280.0B |
| Processes | 1612 (68f7dab335d8e6e05e6f223ec63755da31ddaca81cfbfbec6f3003942644eb1f.exe) 920 (cmd.exe) |
| Type | ASCII text, with CRLF line terminators |
| MD5 | 69258ad87889af525c315484897eff5e |
| SHA1 | 65b863a87323ad47b4fcf111d1e8901c760ae7a5 |
| SHA256 | a4ad85a3958b704a7fd2c50a53d46360e239adc0a9887dc9e4f344bc849d5682 |
| CRC32 | B5300052 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 68f7dab335d8e6e0_68f7dab335d8e6e05e6f223ec63755da31ddaca81cfbfbec6f3003942644eb1f.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\68f7dab335d8e6e05e6f223ec63755da31ddaca81cfbfbec6f3003942644eb1f.exe |
| Size | 780.4KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | 0fa8b48bc4a7e9121b2165dd1ad5473e |
| SHA1 | 303ff803002d5d34ec40d14a47996b7d1c978325 |
| SHA256 | 68f7dab335d8e6e05e6f223ec63755da31ddaca81cfbfbec6f3003942644eb1f |
| CRC32 | 7014F3B3 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 3c18c1970a9a5827_svchosts.exe |
|---|---|
| Filepath | C:\Windows\SysWOW64\svchosts.exe |
| Size | 30.8KB |
| Processes | 1612 (68f7dab335d8e6e05e6f223ec63755da31ddaca81cfbfbec6f3003942644eb1f.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | c68822bee0a9091abb64a1e20fba238a |
| SHA1 | aa7b77b8973fbb62637de7ddec0617434a4534af |
| SHA256 | 3c18c1970a9a58271716173e594504765d41199991e7035bc1f34bfa16c160ec |
| CRC32 | 08CA9DD7 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.