5.3
中危

072f42c8d2ce79055c1617ee30f0754c054819dc3d0d925411a3628f5b65380c

072f42c8d2ce79055c1617ee30f0754c054819dc3d0d925411a3628f5b65380c.exe

分析耗时

136s

最近分析

383天前

文件大小

11.2MB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN WORM ULISE
鹰眼引擎
DACN 0.14
FACILE 1.00
IMCLNet 0.81
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Avast Win32:Renos-KY [Trj] 20200317 18.4.3895.0
Baidu None 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
Kingsoft None 20200317 2013.8.14.323
McAfee W32/Pykse.worm.gen.a 20200316 6.0.6.653
Tencent Worm.Win32.Pykspa.a 20200317 1.0.0.1
静态指标
查询计算机名称 (50 out of 231 个事件)
Time & API Arguments Status Return Repeated
1727545309.6725
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545313.4225
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545313.530875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545316.561875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545316.561875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545320.811875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545321.608875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545325.061875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545326.733875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545329.327875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545331.780875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545333.577875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545336.796875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545337.827875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545341.811875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545342.077875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545345.796875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545346.327875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545346.890875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545347.046875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545348.171875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545349.249875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545350.405875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545350.593875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545351.561875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545351.952875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545352.671875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545353.843875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545354.858875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545355.030875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545356.249875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545357.108875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545357.436875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545358.608875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545359.124875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545359.718875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545360.843875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545361.999875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545362.140875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545363.108875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545363.390875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545364.265875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545365.390875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545366.515875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545367.186875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545367.640875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545367.718875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545368.905875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545370.061875
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545371.186875
GetComputerNameA
computer_name: TU-PC
success 1 0
检查系统中的内存量,这可以用于检测可用内存较少的虚拟机 (1 个事件)
Time & API Arguments Status Return Repeated
1727545316.155875
GlobalMemoryStatusEx
success 1 0
一个或多个进程崩溃 (6 个事件)
Time & API Arguments Status Return Repeated
1727545310.5005
__exception__
exception.address: 0x40d408
exception.instruction_r: 0f 3f 07 0b 85 db 0f 94 45 e7 5b eb 35 8b 45 ec
exception.symbol: 072f42c8d2ce79055c1617ee30f0754c054819dc3d0d925411a3628f5b65380c+0xd408
exception.exception_code: 0xc000001d
registers.eax: 1
registers.ecx: 10000
registers.edx: 0
registers.ebx: 0
registers.esp: 1637512
registers.ebp: 1637564
registers.esi: 5189057
registers.edi: 2002463810
stacktrace:
072f42c8d2ce79055c1617ee30f0754c054819dc3d0d925411a3628f5b65380c+0xdaf5 @ 0x40daf5
072f42c8d2ce79055c1617ee30f0754c054819dc3d0d925411a3628f5b65380c+0x22ace @ 0x422ace
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5

success 0 0
1727545310.5005
__exception__
exception.address: 0x40d47a
exception.instruction: in eax, dx
exception.instruction_r: ed 81 fb 68 58 4d 56 0f 94 45 e7 5b 59 5a 83 4d
exception.symbol: 072f42c8d2ce79055c1617ee30f0754c054819dc3d0d925411a3628f5b65380c+0xd47a
exception.exception_code: 0xc0000096
registers.eax: 1447909480
registers.ecx: 10
registers.edx: 22104
registers.ebx: 0
registers.esp: 1637504
registers.ebp: 1637564
registers.esi: 5189057
registers.edi: 2002463810
stacktrace:
072f42c8d2ce79055c1617ee30f0754c054819dc3d0d925411a3628f5b65380c+0xdaf5 @ 0x40daf5
072f42c8d2ce79055c1617ee30f0754c054819dc3d0d925411a3628f5b65380c+0x22ace @ 0x422ace
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5

success 0 0
1727545314.280875
__exception__
exception.address: 0x40d408
exception.instruction_r: 0f 3f 07 0b 85 db 0f 94 45 e7 5b eb 35 8b 45 ec
exception.symbol: zhkuzlr+0xd408
exception.exception_code: 0xc000001d
registers.eax: 1
registers.ecx: 10000
registers.edx: 0
registers.ebx: 0
registers.esp: 1637512
registers.ebp: 1637564
registers.esi: 8727565
registers.edi: 2002463810
stacktrace:
zhkuzlr+0xdaf5 @ 0x40daf5
zhkuzlr+0x22ace @ 0x422ace
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5

success 0 0
1727545314.280875
__exception__
exception.address: 0x40d47a
exception.instruction: in eax, dx
exception.instruction_r: ed 81 fb 68 58 4d 56 0f 94 45 e7 5b 59 5a 83 4d
exception.symbol: zhkuzlr+0xd47a
exception.exception_code: 0xc0000096
registers.eax: 1447909480
registers.ecx: 10
registers.edx: 22104
registers.ebx: 0
registers.esp: 1637504
registers.ebp: 1637564
registers.esi: 8727565
registers.edi: 2002463810
stacktrace:
zhkuzlr+0xdaf5 @ 0x40daf5
zhkuzlr+0x22ace @ 0x422ace
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5

success 0 0
1727545314.391
__exception__
exception.address: 0x40d408
exception.instruction_r: 0f 3f 07 0b 85 db 0f 94 45 e7 5b eb 35 8b 45 ec
exception.symbol: zhkuzlr+0xd408
exception.exception_code: 0xc000001d
registers.eax: 1
registers.ecx: 10000
registers.edx: 0
registers.ebx: 0
registers.esp: 1637512
registers.ebp: 1637564
registers.esi: 5581837
registers.edi: 2002463810
stacktrace:
zhkuzlr+0xdaf5 @ 0x40daf5
zhkuzlr+0x22ace @ 0x422ace
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5

success 0 0
1727545314.391
__exception__
exception.address: 0x40d47a
exception.instruction: in eax, dx
exception.instruction_r: ed 81 fb 68 58 4d 56 0f 94 45 e7 5b 59 5a 83 4d
exception.symbol: zhkuzlr+0xd47a
exception.exception_code: 0xc0000096
registers.eax: 1447909480
registers.ecx: 10
registers.edx: 22104
registers.ebx: 0
registers.esp: 1637504
registers.ebp: 1637564
registers.esi: 5581837
registers.edi: 2002463810
stacktrace:
zhkuzlr+0xdaf5 @ 0x40daf5
zhkuzlr+0x22ace @ 0x422ace
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5

success 0 0
行为判定
动态指标
查找外部 IP 地址 (4 个事件)
domain whatismyipaddress.com
domain www.whatismyip.ca
domain whatismyip.everdot.org
domain www.showmyipaddress.com
在文件系统上创建可执行文件 (1 个事件)
file C:\Users\Administrator\AppData\Local\Temp\zhkuzlr.exe
创建隐藏或系统文件 (42 个事件)
Time & API Arguments Status Return Repeated
1727545316.171875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Windows\System32\dfcgflleojaogvvsurvuaat.ypd
filepath_r: C:\Windows\system32\dfcgflleojaogvvsurvuaat.ypd
success 1 0
1727545316.186875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Program Files (x86)\dfcgflleojaogvvsurvuaat.ypd
filepath_r: C:\Program Files (x86)\dfcgflleojaogvvsurvuaat.ypd
success 1 0
1727545316.186875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Users\Administrator\AppData\Local\dfcgflleojaogvvsurvuaat.ypd
filepath_r: C:\Users\Administrator\AppData\Local\dfcgflleojaogvvsurvuaat.ypd
success 1 0
1727545316.186875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Windows\dfcgflleojaogvvsurvuaat.ypd
filepath_r: C:\Windows\dfcgflleojaogvvsurvuaat.ypd
success 1 0
1727545316.186875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Users\Administrator\AppData\Local\Temp\dfcgflleojaogvvsurvuaat.ypd
filepath_r: C:\Users\ADMINI~1\AppData\Local\Temp\dfcgflleojaogvvsurvuaat.ypd
success 1 0
1727545316.186875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Users\Administrator\AppData\Local\Temp\dfcgflleojaogvvsurvuaat.ypd
filepath_r: dfcgflleojaogvvsurvuaat.ypd
success 1 0
1727545316.265875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Windows\System32\qdlakbmqlrtsvvgobjyizkojprqttemzhw.xim
filepath_r: C:\Windows\system32\qdlakbmqlrtsvvgobjyizkojprqttemzhw.xim
success 1 0
1727545316.265875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Program Files (x86)\qdlakbmqlrtsvvgobjyizkojprqttemzhw.xim
filepath_r: C:\Program Files (x86)\qdlakbmqlrtsvvgobjyizkojprqttemzhw.xim
success 1 0
1727545316.280875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Users\Administrator\AppData\Local\qdlakbmqlrtsvvgobjyizkojprqttemzhw.xim
filepath_r: C:\Users\Administrator\AppData\Local\qdlakbmqlrtsvvgobjyizkojprqttemzhw.xim
success 1 0
1727545316.280875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Windows\qdlakbmqlrtsvvgobjyizkojprqttemzhw.xim
filepath_r: C:\Windows\qdlakbmqlrtsvvgobjyizkojprqttemzhw.xim
success 1 0
1727545316.280875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Users\Administrator\AppData\Local\Temp\qdlakbmqlrtsvvgobjyizkojprqttemzhw.xim
filepath_r: C:\Users\ADMINI~1\AppData\Local\Temp\qdlakbmqlrtsvvgobjyizkojprqttemzhw.xim
success 1 0
1727545316.280875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Users\Administrator\AppData\Local\Temp\qdlakbmqlrtsvvgobjyizkojprqttemzhw.xim
filepath_r: qdlakbmqlrtsvvgobjyizkojprqttemzhw.xim
success 1 0
1727545346.311875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Windows\System32\dfcgflleojaogvvsurvuaat.ypd
filepath_r: C:\Windows\system32\dfcgflleojaogvvsurvuaat.ypd
success 1 0
1727545346.327875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Program Files (x86)\dfcgflleojaogvvsurvuaat.ypd
filepath_r: C:\Program Files (x86)\dfcgflleojaogvvsurvuaat.ypd
success 1 0
1727545346.343875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Users\Administrator\AppData\Local\dfcgflleojaogvvsurvuaat.ypd
filepath_r: C:\Users\Administrator\AppData\Local\dfcgflleojaogvvsurvuaat.ypd
success 1 0
1727545346.343875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Windows\dfcgflleojaogvvsurvuaat.ypd
filepath_r: C:\Windows\dfcgflleojaogvvsurvuaat.ypd
success 1 0
1727545346.343875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Users\Administrator\AppData\Local\Temp\dfcgflleojaogvvsurvuaat.ypd
filepath_r: C:\Users\ADMINI~1\AppData\Local\Temp\dfcgflleojaogvvsurvuaat.ypd
success 1 0
1727545346.358875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Users\Administrator\AppData\Local\Temp\dfcgflleojaogvvsurvuaat.ypd
filepath_r: dfcgflleojaogvvsurvuaat.ypd
success 1 0
1727545347.421875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Windows\System32\dfcgflleojaogvvsurvuaat.ypd
filepath_r: C:\Windows\system32\dfcgflleojaogvvsurvuaat.ypd
success 1 0
1727545347.436875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Program Files (x86)\dfcgflleojaogvvsurvuaat.ypd
filepath_r: C:\Program Files (x86)\dfcgflleojaogvvsurvuaat.ypd
success 1 0
1727545347.452875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Users\Administrator\AppData\Local\dfcgflleojaogvvsurvuaat.ypd
filepath_r: C:\Users\Administrator\AppData\Local\dfcgflleojaogvvsurvuaat.ypd
success 1 0
1727545347.452875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Windows\dfcgflleojaogvvsurvuaat.ypd
filepath_r: C:\Windows\dfcgflleojaogvvsurvuaat.ypd
success 1 0
1727545347.452875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Users\Administrator\AppData\Local\Temp\dfcgflleojaogvvsurvuaat.ypd
filepath_r: C:\Users\ADMINI~1\AppData\Local\Temp\dfcgflleojaogvvsurvuaat.ypd
success 1 0
1727545347.452875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Users\Administrator\AppData\Local\Temp\dfcgflleojaogvvsurvuaat.ypd
filepath_r: dfcgflleojaogvvsurvuaat.ypd
success 1 0
1727545368.577875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Windows\System32\dfcgflleojaogvvsurvuaat.ypd
filepath_r: C:\Windows\system32\dfcgflleojaogvvsurvuaat.ypd
success 1 0
1727545368.577875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Program Files (x86)\dfcgflleojaogvvsurvuaat.ypd
filepath_r: C:\Program Files (x86)\dfcgflleojaogvvsurvuaat.ypd
success 1 0
1727545368.608875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Users\Administrator\AppData\Local\dfcgflleojaogvvsurvuaat.ypd
filepath_r: C:\Users\Administrator\AppData\Local\dfcgflleojaogvvsurvuaat.ypd
success 1 0
1727545368.608875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Windows\dfcgflleojaogvvsurvuaat.ypd
filepath_r: C:\Windows\dfcgflleojaogvvsurvuaat.ypd
success 1 0
1727545368.624875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Users\Administrator\AppData\Local\Temp\dfcgflleojaogvvsurvuaat.ypd
filepath_r: C:\Users\ADMINI~1\AppData\Local\Temp\dfcgflleojaogvvsurvuaat.ypd
success 1 0
1727545368.640875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Users\Administrator\AppData\Local\Temp\dfcgflleojaogvvsurvuaat.ypd
filepath_r: dfcgflleojaogvvsurvuaat.ypd
success 1 0
1727545389.765875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Windows\System32\dfcgflleojaogvvsurvuaat.ypd
filepath_r: C:\Windows\system32\dfcgflleojaogvvsurvuaat.ypd
success 1 0
1727545389.765875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Program Files (x86)\dfcgflleojaogvvsurvuaat.ypd
filepath_r: C:\Program Files (x86)\dfcgflleojaogvvsurvuaat.ypd
success 1 0
1727545389.765875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Users\Administrator\AppData\Local\dfcgflleojaogvvsurvuaat.ypd
filepath_r: C:\Users\Administrator\AppData\Local\dfcgflleojaogvvsurvuaat.ypd
success 1 0
1727545389.780875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Windows\dfcgflleojaogvvsurvuaat.ypd
filepath_r: C:\Windows\dfcgflleojaogvvsurvuaat.ypd
success 1 0
1727545389.796875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Users\Administrator\AppData\Local\Temp\dfcgflleojaogvvsurvuaat.ypd
filepath_r: C:\Users\ADMINI~1\AppData\Local\Temp\dfcgflleojaogvvsurvuaat.ypd
success 1 0
1727545389.796875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Users\Administrator\AppData\Local\Temp\dfcgflleojaogvvsurvuaat.ypd
filepath_r: dfcgflleojaogvvsurvuaat.ypd
success 1 0
1727545410.921875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Windows\System32\dfcgflleojaogvvsurvuaat.ypd
filepath_r: C:\Windows\system32\dfcgflleojaogvvsurvuaat.ypd
success 1 0
1727545410.921875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Program Files (x86)\dfcgflleojaogvvsurvuaat.ypd
filepath_r: C:\Program Files (x86)\dfcgflleojaogvvsurvuaat.ypd
success 1 0
1727545410.936875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Users\Administrator\AppData\Local\dfcgflleojaogvvsurvuaat.ypd
filepath_r: C:\Users\Administrator\AppData\Local\dfcgflleojaogvvsurvuaat.ypd
success 1 0
1727545410.936875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Windows\dfcgflleojaogvvsurvuaat.ypd
filepath_r: C:\Windows\dfcgflleojaogvvsurvuaat.ypd
success 1 0
1727545410.952875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Users\Administrator\AppData\Local\Temp\dfcgflleojaogvvsurvuaat.ypd
filepath_r: C:\Users\ADMINI~1\AppData\Local\Temp\dfcgflleojaogvvsurvuaat.ypd
success 1 0
1727545410.968875
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\Users\Administrator\AppData\Local\Temp\dfcgflleojaogvvsurvuaat.ypd
filepath_r: dfcgflleojaogvvsurvuaat.ypd
success 1 0
禁用Windows的注册表编辑器 (2 个事件)
registry HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools
投放一个二进制文件并执行它 (1 个事件)
file C:\Users\Administrator\AppData\Local\Temp\zhkuzlr.exe
将可执行文件投放到用户的 AppData 文件夹 (1 个事件)
file C:\Users\Administrator\AppData\Local\Temp\zhkuzlr.exe
检查系统上可疑权限的本地唯一标识符 (1 个事件)
Time & API Arguments Status Return Repeated
1727545316.561875
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
网络通信
与未执行 DNS 查询的主机进行通信 (3 个事件)
host 185.42.173.103
host 114.114.114.114
host 8.8.8.8
尝试停止活动服务 (7 个事件)
Time & API Arguments Status Return Repeated
1727545316.311875
ControlService
service_handle: 0x00897b90
control_code: 1
service_name: MpsSvc
failed 0 0
1727545316.327875
ControlService
service_handle: 0x00897bb8
control_code: 1
service_name: wscsvc
failed 0 0
1727545316.343875
ControlService
service_handle: 0x00897be0
control_code: 1
service_name: SharedAccess
failed 0 0
1727545316.358875
ControlService
service_handle: 0x00897b90
control_code: 1
service_name: WinDefend
failed 0 0
1727545316.374875
ControlService
service_handle: 0x00897bb8
control_code: 1
service_name: wuauserv
success 1 0
1727545316.390875
ControlService
service_handle: 0x00897be0
control_code: 1
service_name: BITS
failed 0 0
1727545316.421875
ControlService
service_handle: 0x00897bb8
control_code: 1
service_name: WerSvc
failed 0 0
一个进程试图延迟分析任务。 (1 个事件)
description zhkuzlr.exe 试图睡眠 1629.015 秒,实际延迟分析时间 1629.015 秒
在 Windows 启动时自我安装以实现自动运行 (50 out of 220 个事件)
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell reg_value Explorer.exe
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\oxbmsfmm reg_value bxomffzmqfqyktnearpii.exe
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fpugnbjkc reg_value fxketpfoozgksxnas.exe .
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yjpckzikdh reg_value fxketpfoozgksxnas.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\tfmajzjmglm reg_value ztievtlwyluakrjyshd.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\qdlakbmqlrts reg_value ztievtlwyluakrjyshd.exe .
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qfpgslyebjnotv reg_value C:\Users\ADMINI~1\AppData\Local\Temp\fxketpfoozgksxnas.exe
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pdmcnfrwszccg reg_value C:\Users\ADMINI~1\AppData\Local\Temp\bxomffzmqfqyktnearpii.exe .
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zhkuzlr reg_value C:\Users\ADMINI~1\AppData\Local\Temp\ypbuidsazjpszdse.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\oxbmsfmm reg_value C:\Users\ADMINI~1\AppData\Local\Temp\ztievtlwyluakrjyshd.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\fpugnbjkc reg_value C:\Users\ADMINI~1\AppData\Local\Temp\ztievtlwyluakrjyshd.exe .
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell reg_value Explorer.exe
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\oxbmsfmm reg_value bxomffzmqfqyktnearpii.exe
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fpugnbjkc reg_value fxketpfoozgksxnas.exe .
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yjpckzikdh reg_value bxomffzmqfqyktnearpii.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\tfmajzjmglm reg_value bxomffzmqfqyktnearpii.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\qdlakbmqlrts reg_value mhxumleqthryjrkavlia.exe .
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qfpgslyebjnotv reg_value C:\Users\ADMINI~1\AppData\Local\Temp\ztievtlwyluakrjyshd.exe
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pdmcnfrwszccg reg_value C:\Users\ADMINI~1\AppData\Local\Temp\bxomffzmqfqyktnearpii.exe .
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zhkuzlr reg_value C:\Users\ADMINI~1\AppData\Local\Temp\ypbuidsazjpszdse.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\oxbmsfmm reg_value C:\Users\ADMINI~1\AppData\Local\Temp\bxomffzmqfqyktnearpii.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\fpugnbjkc reg_value C:\Users\ADMINI~1\AppData\Local\Temp\ztievtlwyluakrjyshd.exe .
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell reg_value Explorer.exe
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\oxbmsfmm reg_value ohvqgduefrzentkyrf.exe
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fpugnbjkc reg_value mhxumleqthryjrkavlia.exe .
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yjpckzikdh reg_value ohvqgduefrzentkyrf.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\tfmajzjmglm reg_value fxketpfoozgksxnas.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\qdlakbmqlrts reg_value mhxumleqthryjrkavlia.exe .
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qfpgslyebjnotv reg_value C:\Users\ADMINI~1\AppData\Local\Temp\fxketpfoozgksxnas.exe
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pdmcnfrwszccg reg_value C:\Users\ADMINI~1\AppData\Local\Temp\fxketpfoozgksxnas.exe .
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zhkuzlr reg_value C:\Users\ADMINI~1\AppData\Local\Temp\ypbuidsazjpszdse.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\oxbmsfmm reg_value C:\Users\ADMINI~1\AppData\Local\Temp\ztievtlwyluakrjyshd.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\fpugnbjkc reg_value C:\Users\ADMINI~1\AppData\Local\Temp\mhxumleqthryjrkavlia.exe .
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell reg_value Explorer.exe
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\oxbmsfmm reg_value ztievtlwyluakrjyshd.exe
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fpugnbjkc reg_value ztievtlwyluakrjyshd.exe .
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yjpckzikdh reg_value bxomffzmqfqyktnearpii.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\tfmajzjmglm reg_value mhxumleqthryjrkavlia.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\qdlakbmqlrts reg_value bxomffzmqfqyktnearpii.exe .
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qfpgslyebjnotv reg_value C:\Users\ADMINI~1\AppData\Local\Temp\mhxumleqthryjrkavlia.exe
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pdmcnfrwszccg reg_value C:\Users\ADMINI~1\AppData\Local\Temp\fxketpfoozgksxnas.exe .
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zhkuzlr reg_value C:\Users\ADMINI~1\AppData\Local\Temp\ztievtlwyluakrjyshd.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\oxbmsfmm reg_value C:\Users\ADMINI~1\AppData\Local\Temp\fxketpfoozgksxnas.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\fpugnbjkc reg_value C:\Users\ADMINI~1\AppData\Local\Temp\fxketpfoozgksxnas.exe .
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell reg_value Explorer.exe
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\oxbmsfmm reg_value bxomffzmqfqyktnearpii.exe
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fpugnbjkc reg_value ohvqgduefrzentkyrf.exe .
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yjpckzikdh reg_value ohvqgduefrzentkyrf.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\tfmajzjmglm reg_value bxomffzmqfqyktnearpii.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\qdlakbmqlrts reg_value fxketpfoozgksxnas.exe .
尝试修改 UAC 提示行为 (3 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop
通过 in 指令特性检测 VMWare (3 个事件)
Time & API Arguments Status Return Repeated
1727545310.5005
__exception__
exception.address: 0x40d47a
exception.instruction: in eax, dx
exception.instruction_r: ed 81 fb 68 58 4d 56 0f 94 45 e7 5b 59 5a 83 4d
exception.symbol: 072f42c8d2ce79055c1617ee30f0754c054819dc3d0d925411a3628f5b65380c+0xd47a
exception.exception_code: 0xc0000096
registers.eax: 1447909480
registers.ecx: 10
registers.edx: 22104
registers.ebx: 0
registers.esp: 1637504
registers.ebp: 1637564
registers.esi: 5189057
registers.edi: 2002463810
stacktrace:
072f42c8d2ce79055c1617ee30f0754c054819dc3d0d925411a3628f5b65380c+0xdaf5 @ 0x40daf5
072f42c8d2ce79055c1617ee30f0754c054819dc3d0d925411a3628f5b65380c+0x22ace @ 0x422ace
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5

success 0 0
1727545314.280875
__exception__
exception.address: 0x40d47a
exception.instruction: in eax, dx
exception.instruction_r: ed 81 fb 68 58 4d 56 0f 94 45 e7 5b 59 5a 83 4d
exception.symbol: zhkuzlr+0xd47a
exception.exception_code: 0xc0000096
registers.eax: 1447909480
registers.ecx: 10
registers.edx: 22104
registers.ebx: 0
registers.esp: 1637504
registers.ebp: 1637564
registers.esi: 8727565
registers.edi: 2002463810
stacktrace:
zhkuzlr+0xdaf5 @ 0x40daf5
zhkuzlr+0x22ace @ 0x422ace
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5

success 0 0
1727545314.391
__exception__
exception.address: 0x40d47a
exception.instruction: in eax, dx
exception.instruction_r: ed 81 fb 68 58 4d 56 0f 94 45 e7 5b 59 5a 83 4d
exception.symbol: zhkuzlr+0xd47a
exception.exception_code: 0xc0000096
registers.eax: 1447909480
registers.ecx: 10
registers.edx: 22104
registers.ebx: 0
registers.esp: 1637504
registers.ebp: 1637564
registers.esi: 5581837
registers.edi: 2002463810
stacktrace:
zhkuzlr+0xdaf5 @ 0x40daf5
zhkuzlr+0x22ace @ 0x422ace
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5

success 0 0
禁用 Windows 安全功能 (1 个事件)
description 尝试禁用用户访问控制 registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
文件已被 VirusTotal 上 63 个反病毒引擎识别为恶意 (50 out of 63 个事件)
ALYac Gen:Variant.Ulise.96666
APEX Malicious
AVG Win32:Renos-KY [Trj]
Acronis suspicious
Ad-Aware Gen:Variant.Ulise.96666
AhnLab-V3 Trojan/Win32.Zepfod.R4378
Antiy-AVL Trojan/Win32.AntiAV
Arcabit Trojan.Ulise.D1799A
Avast Win32:Renos-KY [Trj]
Avira TR/Agent.327680.A
BitDefender Gen:Variant.Ulise.96666
BitDefenderTheta Gen:NN.ZexaF.34100.@pW@aKpUC6m
Bkav W32.AIDetectVM.malware
CAT-QuickHeal Worm.Pykspa.C3
CMC Trojan.Win32.Vilsel!O
ClamAV Win.Worm.Pykspa-1
Comodo Worm.Win32.Autorun.Agent_TG0@1isiwy
CrowdStrike win/malicious_confidence_100% (D)
Cybereason malicious.be7572
Cylance Unsafe
Cyren W32/Pykspa.A.gen!Eldorado
DrWeb Trojan.Siggen.36621
ESET-NOD32 Win32/AutoRun.Agent.TG
Emsisoft Gen:Variant.Ulise.96666 (B)
Endgame malicious (high confidence)
F-Prot W32/Pykspa.A.gen!Eldorado
F-Secure Trojan-Downloader:W32/Renos.gen!T
FireEye Generic.mg.10bd658be7572e38
Fortinet W32/Agent.XEK!tr
GData Gen:Variant.Ulise.96666
Ikarus Trojan.Win32.Spy
Invincea heuristic
Jiangmin Trojan/Blocker.lhz
K7AntiVirus Trojan ( 003da8d71 )
K7GW Trojan ( 003da8d71 )
Kaspersky Trojan-Ransom.Win32.Blocker.jcen
MAX malware (ai score=86)
Malwarebytes Worm.Agent
MaxSecure Trojan.Ransom.Blocker.iprw
McAfee W32/Pykse.worm.gen.a
McAfee-GW-Edition BehavesLike.Win32.Pykse.wz
MicroWorld-eScan Gen:Variant.Ulise.96666
Microsoft Worm:Win32/Pykspa.C
NANO-Antivirus Trojan.Win32.Agent.ctkmgw
Panda Trj/Vilsel.B
Qihoo-360 Worm.Win32.Pykse.A
Rising Worm.Autorun!1.BC87 (CLASSIC)
Sangfor Malware
SentinelOne DFI - Malicious PE
Sophos W32/Pykse-F
连接到不再响应请求的 IP 地址(合法服务通常会保持运行) (5 个事件)
dead_host 172.67.155.175:80
dead_host 104.27.206.92:80
dead_host 104.19.222.79:80
dead_host 162.249.65.164:80
dead_host 192.168.56.101:49195
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2006-12-09 10:29:44

PE Imphash

d67c205451cfa889d29c6c8718886c08

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0002892f 0x0003e000 5.310821358821864
.rdata 0x0002a000 0x00003730 0x00013000 1.4545096422127213
.data 0x0002e000 0x000370f4 0x00030000 6.17846339473463

Imports

Library KERNEL32.dll:
0x42a054 CreateThread
0x42a05c GetDriveTypeA
0x42a064 MoveFileA
0x42a068 FreeLibrary
0x42a06c EnumResourceNamesA
0x42a070 LoadLibraryA
0x42a074 GetProcAddress
0x42a078 GetModuleHandleA
0x42a07c GetSystemInfo
0x42a080 GetVersionExA
0x42a084 SetThreadPriority
0x42a088 GetCurrentThread
0x42a08c FreeResource
0x42a090 UpdateResourceA
0x42a094 SizeofResource
0x42a098 LockResource
0x42a09c LoadResource
0x42a0a0 FindResourceA
0x42a0a8 EndUpdateResourceA
0x42a0b0 CreateMutexA
0x42a0b4 GetLastError
0x42a0b8 WaitForSingleObject
0x42a0c0 GetComputerNameA
0x42a0c4 GetCurrentProcess
0x42a0c8 OpenMutexA
0x42a0cc SetPriorityClass
0x42a0d0 GetTempPathA
0x42a0d4 GetModuleFileNameA
0x42a0d8 GetSystemDirectoryA
0x42a0dc SetErrorMode
0x42a0e4 HeapAlloc
0x42a0e8 GetProcessHeap
0x42a0ec HeapFree
0x42a0f0 WideCharToMultiByte
0x42a0f4 MultiByteToWideChar
0x42a0f8 ExitThread
0x42a0fc GetTimeFormatA
0x42a100 GetDateFormatA
0x42a104 GetFileSize
0x42a108 SetFileAttributesA
0x42a10c GlobalUnlock
0x42a110 GlobalLock
0x42a114 GlobalAlloc
0x42a118 lstrcmpiA
0x42a11c SetFileTime
0x42a124 GetSystemTime
0x42a128 CreateDirectoryA
0x42a12c CreateProcessA
0x42a130 GetCurrentProcessId
0x42a138 CompareStringW
0x42a13c CompareStringA
0x42a140 HeapSize
0x42a148 GetCurrentThreadId
0x42a150 SetStdHandle
0x42a154 HeapReAlloc
0x42a158 GetLocaleInfoA
0x42a15c GetExitCodeProcess
0x42a160 GetStringTypeW
0x42a164 GetStringTypeA
0x42a168 VirtualFree
0x42a16c HeapCreate
0x42a170 HeapDestroy
0x42a174 GetFileType
0x42a178 SetHandleCount
0x42a190 GetStdHandle
0x42a194 VirtualAlloc
0x42a198 VirtualProtect
0x42a19c GetCPInfo
0x42a1a0 FlushFileBuffers
0x42a1a4 GetOEMCP
0x42a1a8 GetACP
0x42a1ac LCMapStringW
0x42a1b0 LCMapStringA
0x42a1b4 VirtualQuery
0x42a1b8 InterlockedExchange
0x42a1bc RtlUnwind
0x42a1c0 TerminateProcess
0x42a1c4 GetCommandLineA
0x42a1c8 GetStartupInfoA
0x42a1cc SetFilePointer
0x42a1d0 WriteFile
0x42a1d4 CreateFileA
0x42a1d8 ReadFile
0x42a1dc CloseHandle
0x42a1e0 Sleep
0x42a1e4 FindFirstFileA
0x42a1e8 lstrcpyA
0x42a1ec lstrcatA
0x42a1f0 ExitProcess
0x42a1f4 lstrcmpA
0x42a200 DeleteFileA
0x42a204 lstrcpynA
0x42a208 GetTickCount
0x42a20c GetFileAttributesA
0x42a210 lstrlenA
0x42a214 CopyFileA
0x42a218 FindNextFileA
0x42a21c FindClose
Library USER32.dll:
0x42a248 TranslateMessage
0x42a24c GetMessageA
0x42a250 UpdateWindow
0x42a254 RegisterClassA
0x42a258 DispatchMessageA
0x42a25c wsprintfA
0x42a260 GetWindowRect
0x42a264 GetDesktopWindow
0x42a268 ShowWindow
0x42a26c EnableWindow
0x42a270 GetClassNameA
0x42a274 DestroyWindow
0x42a278 UnregisterClassA
0x42a27c PostMessageA
0x42a284 GetWindowTextA
0x42a288 IsWindowVisible
0x42a28c EnumWindows
0x42a290 IsWindowEnabled
0x42a298 GetCursorPos
0x42a29c SetCursorPos
0x42a2a0 GetSystemMetrics
0x42a2a4 ReleaseDC
0x42a2a8 GetWindowDC
0x42a2ac SetClipboardData
0x42a2b0 EmptyClipboard
0x42a2b4 SendInput
0x42a2b8 SendMessageTimeoutA
0x42a2c0 SetWindowPos
0x42a2c4 PostQuitMessage
0x42a2c8 GetClientRect
0x42a2cc GetWindowInfo
0x42a2d0 GetWindow
0x42a2d4 GetWindowPlacement
0x42a2d8 MessageBoxA
0x42a2dc EnumChildWindows
0x42a2e0 SetWindowTextA
0x42a2e4 SetForegroundWindow
0x42a2e8 SetFocus
Library GDI32.dll:
0x42a034 CreateCompatibleDC
0x42a03c SelectObject
0x42a040 BitBlt
0x42a044 DeleteDC
0x42a048 GetDIBits
0x42a04c DeleteObject
Library ADVAPI32.dll:
0x42a008 GetUserNameA
0x42a018 AddAccessAllowedAce
0x42a01c InitializeAcl
0x42a020 GetLengthSid
0x42a024 GetTokenInformation
0x42a028 SetFileSecurityA
Library SHELL32.dll:
0x42a234 ShellExecuteA
0x42a240 SHGetMalloc
Library WS2_32.dll:
0x42a300 inet_addr
0x42a304 WSACreateEvent
0x42a308 WSAEventSelect
0x42a314 WSACloseEvent
0x42a318 sendto
0x42a31c WSAGetLastError
0x42a320 gethostbyaddr
0x42a324 accept
0x42a328 getpeername
0x42a32c shutdown
0x42a330 inet_ntoa
0x42a334 select
0x42a338 __WSAFDIsSet
0x42a33c recv
0x42a340 send
0x42a344 closesocket
0x42a348 htons
Library VERSION.dll:
0x42a2f4 GetFileVersionInfoA
0x42a2f8 VerQueryValueA
Library RPCRT4.dll:
0x42a224 UuidCreate
0x42a228 UuidToStringA
0x42a22c RpcStringFreeA

L!This program cannot be run in DOS mode.
N-AN-AN-A]DAM-AK"AW-AKrA--A4AL-A]pAL-A
pAC-AN,A-AKMAv-AKwAO-ARichN-A
`.rdata
@.data
PPup hB
u| uxutPW
YYuwPhpB
YYu`PhhB
YYuIPh`B
YYu2PhXB
up PS P
UQQSVu
Eu:5lD
3RSMQV5lD
@_^[QSU38
3@_^][YUVu
_^]VW|$
t*SEPVuW
VuKYYt
EY_^:[t
P PPPXP
uj(xWVj
EY_^[U
SEPWu]V
EYY_^[UQQe
Zufj&CNhB
EY_^[UX
WjAY33
EPEPSu
Y3j?]}Yu
t^SEPuuV
E;Eu%jAEPhE
Y2_^[U
Et(SMQVWP
EY_^[UL
WjAY3hE
3Y]}EPP
YYtGj@EhE
Y3]}fjAZ3jJ
PSSSP%
SUR5tD
SPhPhHE
UU SV5E
Y3]}fEPu
GC_^]j
@uVW|$
v$u2^_
W;]}Nf~
2r8>;=PE
t.VYu#W
}}CEPWWPF
;|-WSE
E|_^[2Vt$
3S3VW],}-f3
]U]L]P]V]WEX
]@]d]H]Dj
08]V]\]j]k]dtc8]Wu^EPjB3Y3v8}L
EPjB3YFB;rj
3FE<PSSPG
SVEjPW
8]bt]}jTu8EkT@}tj
EkSE\]bP8]ct}jC
EkCE\]c,9]\
@}kTE\uc
ELEPYEdM}kSuf
+E<PSSPG
)E\9]\
~TEdjA
j@EPV\
3Y;uK(wF8
;Yu-u|uxj
u|uxudP
]X9]L_^[t
YEXlUl$
}Lf3<B
Y}f39]ht
uhEP9]lt
ulEP9]pt
upEP9]tt
MLEME|<ar
EPr]dh0B
f}`P5\B
E`Ph,B
EPS]dS
]dEPPELPE
3YBBRVJ
YY_^[TULD
2okBVj
78^Bu*j@F
PEPEA$
^_[UHSVW}
YYShPB
}MujBEPW'
YtdShLB
vTW|SEPW$t1}Ru
YFX^Uu
]UQQSV2W]]
0r79w2P
0r:9w5PP
EE_^[UQSVu
_^[UQM
hE^[SWhD
3MUVWQ
nPvXu^]hD
PEPWVE
tjEPoYu\S
j@EPV:
E_[E^UQQD
E@X;u}
jA3YvOSVt$
j@VP@L
AKu_^[UM
"u;A9"t
th"t"++u
A9"t% t ++u
_^[]Vj
V3t2WF
YY_^[U
;}P3<;t
E~*Zx-u
SSSXPXPg
SSXPSS
EPEPXSP]]
Y3j?XYYTUfXPTP
j@XPXP
tWSEPuuWW
E;Eu-8t238
PSXPXPSS
PSXPXPSS
YPXP\K
uSEPXP
PXPuSEPj
SEPEPPEPuSEPXPPXPuSEPj
EPVPh0B
|vXP;Yt
XP$;Yt
EPVPh@B
?8^Lt7;5D
t/V;Yt
jASV^N
^M^D^H^P^LvX;u
EPVPhPB
mEPVPh`B
EPVPhpB
EPVPhB
EPVPhB
EPVPhB
YEPVPhB
EPVPhB
EPVPhB
j Y3@!
EPVPhB
XPXP=YY
EPVPhB
|\j?YTUf
PXPXPhB
SSSThB
EPVPh B
}jAXPhE
@8:u8:
;GHsG}
t>FL^MVD$
u9V;~HYs
u$SWYY
uSWXYYF$
3_^[V5
SUVW33
$9_$uj
VtG$YYV
$9_$u-j
VG$YYV
r+j(3Yu v
W3F PVY(OYu_
VWj?3YfTj@PhB
SSSj@PhhB
j PhXB
t"v$9^$uMj
F$YYE}
t"v$9^$uj
PF$YY_
YYt:TE
;t19D$
YYt2D$
_^3]@[
tuD$,PSD$4(
u!D$PVPu
D$4Ph^@
_^]3[D
SVW3WEPWh
WWWjFPhB
[SEPSWj
jdWEPWh
WWWjFPhB
SEPSWj
}jdSEPSWj
jdSEPSWj
jdSEPSWj
jdSEPSWj
jdSEPSWj
jdSEPSWj
jdSEPSWj
jdSEPSWj
jdSEPSWj
jdWEPWh
WWWjFPh(B
jdSEPSWj
jdWEPWh
WWWjFPh(B
jdSEPSWj
jdWEPWh
WWWjdPhB
SEPSWj
jdWEPWh
WWWj@Ph8B
SEPSWj
jdSEPSWj
jdSEPSWj
jdSEPSWj
jdSEPSWj
jdSEPSWj
jd_^[U
}YtX~BSW
PPPhQ_@
<AtL<atHh<B
V0VYu&
}fj?3e
EWj2Y3
EPEWPY:
EWj2Y3
@PEWP^8
3E}}EjPYugM_
E3EM]3CD
YuHEMP
N>\u>\t
3WWPhHE
t|VP}X
YYVVPP
N>\u>\t
;twVEPPuPPW
VVPhHE
3@_^[U
fjAY3}
N>\u>\t
M+@PWP
SPPhHE
3@_^[U
3jWjAY3
PVYY3@_^Ul$L
E|SVWj2
XPux(WPu|(PN
ucXP(P
XPux(WP
jAY3\$
E|SVWj
E,Y}-f
E,PPE,P
tH<.tDuxP
V395xE
F@;5xE
<0r)<9w%<9w
_^[]Ul$H
SVW}|j
t>\.t5
0\Pux,hB
YYud\P,
YtS\PAYtB\PYu1xE
\PYE|0PS
_^[p3FU
SWjA3Y3
SPYY95xE
YYUQSVW=
^2^UQQSVWu
t\.tSPPu
PW0u!PW
P7YWPj?
Y1f0jxPx
SVW3j3Y89fj
<]Y}f]U
PWP8]5
2_^[U8
tSVWjAY3j?
YfjAY3
3PMQPh
PPPEj@Ph8B
3PPMQPP
Y}fj3Y
Yt)WP2YYt#PP
SVWj$E@j
2BEMUp
Etm=3'
u~EPPPj
EtAt<PV
Nu^[QQSUVt$
Wt$ t$(V
VD$$Pt$ t$0t$0t$0t$@
PVD$,Pt$$D$$VPt$$t$0t$(j
PVD$,Pt$$D$$VPt$$t$0t$(j
PVD$,Pt$$D$$VPt$$t$0t$(j
D$$t-PVPt$$D$$VPt$$
D$$t$0Pj
~t$$5B
_^]3[YY
YtEWt$
^_VW|$
SP@$tn
EvaSWh
WEPuVS
3f3f3f3f
f 3!f'3(f.3/f536f<3=fC3DfJ3Kff
33j.Zff
3f3f3f
3f3f3f3f3f3f3f3f3f3f3f
f^`3lf3opf3vwf3}~f3f3f3f3f3f3f3f3f3f3f3f3f
!3%f(3)f3j Yf/1637f=3>fD3EfK3LfR3SfY3Zf`3afg3hfn3ofu3vff
9]})@~
_3^@[S
3Y]}fEPEPE2
SSSSEPSSEP
`f3rf0B
}f3}fB
Y3}P%Y
]]]]]]]E
2lEPSSSSSSh
t39]v/W9]u"7u
^[UQQVW33EP
}1fj3YE
}fEpPEPEp
E|PE0Po
PEP5`D
PWYunE}
_^[VqT
SVWjAY33jAY
SSSjFPh8B
jdSEPSh
SSSj@PhhB
jdSEPSh
SSSj@PhB
jdSEPSh
SSSjPPhB
jdSEPSh
SSSj@PhhB
jdSEPSh
SSSj@PhB
SSSj@PhhB
jdSEPSh
SSSj@PhB
jdSEPSh
SSSjPPhB
jd9]u-
EjdSEPSh
SSSj@PhhB
jdSEPSh
SSSj@PhB
jd_^[U4
SVWjJY3
_^[SV5B
VWjA3!D$ Y|$!D$
YYSD$$P
D$ PWz
D$ Pqy
RQShXMV
E[YZME
SVWjAY3jA
EPPhdB
P_^[VW
QSUVW=
SSSho[A
SSShv^@
SSShCg@
SSShQ_@
YSSSh@
SSSSSh
SSSSSh@
SSSSSh
SSSSSh|j@
SSSSShU@
t0SSSh@
SSSSShu@
SSSSShr@
SSSSSh
SSSSSh|@
SSSSSh
SSSSShUA
SSSSShA
F>"txB
SSSh8@
SSSSSh@
Etm=3'
uzEPPPj
Et=t8PV
PWj_8Ph
t|EMQSS48Q@P
<=t!<"t
<"t<'t< u
.u?/u[
u&EPPPP
<=t!<"t
<"t<'t< u
(u9(u+(<>t
u&EPPPP
fEEPMEY}
PVPj_8Ph
Y_^]3[
UQS38]
E(Ht#j
EPSVh@
EPSVh@
r_^[SVW|$
F<> tj
>tC< u
3@_^[U$E
@u3@_^[U
3j?Yf3j?YfE
]}EPSSPG
}EPSSP3G
yfj?3Y
yfE\PxPxPulE\P
E`xPfED
yfxPxPh
}X]`ETPj
xyfVxPhB
;vfE\a}`ETPj
}`ETPj
2^[_du`
f3]\}]fj]3Y}f]o
SSEpPL
Pj EPhP
j EPhp
B@FSSEpPL
Pj EPh
B@FSSEpPL
Pj EPh
B@FSSEpPL
Pj EPhl
B@FSSEpPL
Pj EPh
SSEpPL
B@FSSEpPL
Pj EPhX
j(EPhx
B@FSSEpPL
Pj EPh
j(EPh0
B@FSSEpPL
Pj EPh
taj EPh
YYjY3LMfh
t93(}2
3_^[xU|/
PEPu|N
ElEPfEL
}`ElM\QWWQ@P
F3nPPhxB
}dGt{SW
YEdtX@B
YEpt0SW|
3;Y~2jd[
Es3A;~v
EsA;|ul
_^[tV2
Xj ShE
[339D$
SVW3j@Yu
t]SMQVWP
Y3_^[U
SVWj@Y33j@
_^[UQSV5
SVWj@3Y
PPSWPPj&7
PPSWP]Pj
PPSWP.
[UQVWlE
EPlQYt
_^UQVWE
_^UQVW
_^UQVWE
^UQSVWlE
_^[UQVWE
_^UQVW
_^UQVWE
EPjYYt
_^QQSUVWE
YYtI\$
;t =hE
t3a;D$
<\uFh8B
tN.tEPu
uW_^3[U$
3Y3SSju
6PYVPju
EPEPEPjEP3GWu
uljAYSS3jd
/uY_^[U`VWj
N>.u3FG=TE
tEPEhB
|_^Ul$
ujY3]}fh
t63(}/
kQU,VWj,3EVP5
WY3_^U@e
}+}]+]
3PPVSWPPu
EEE39u
_^UDS]
j@EPC P
(j@{`sZY3
|_^[VW8B
YYt5@VPX
YYt'@VPJ
uj,ZYL$
@$;u;u
p(q(H(;t
p$q$L$
3t2V3t*Wy$t!Q
AYu*Vgt$
YF$p(F$^U
SVW338X
;u_^[U
E|SVWj
UDrYuA=D
et*st%btGpt
EUDbt"pt
PYYjFEPhB
E PEPE PEPE PEPEPPu|EPh,
PxPE@p
SVWjFEPhB
EPEPEPEPEPEPh,
SdPPdPu
_^[UdS]
EYYE3PPMQh
Y3Y@_^[Vt$
33ESFPu
EP3f@E
jEPh~f
jAYEPSSPE@
^MQMQPu
EPEPWu
3;v19<
3;v6u94
;YYtvP
h+YYtEHHuH
3;v=U9
WVYEE;E
}j^SVW=
QSUVW=B
uSSSh%A
3;t];tW8P
;u;tG;u
uQV50E
3rSUW3
3_][^YUSVW4E
f~YYS0E
}Uf}Uft?;t
fE9UuJ
uV3=bE
u[^_UE
u_^[]UQS
%Y_[U4
QQfEufYYtR}
QQufYY
YEuQuY}t
QfEufYYt,}
EQQufYY
Suk;Evdh
YtF=8E
ty9EsrPE
EfMtJQQuf_YYu
QufCYYt
w:Ei00u
^]ULVWj
}jAEPhB
_^UHVWj
}jAEPhB
MF;r[_
^ULSWj
}jAEPhB
[ULSWj
}jAEPhB
r_^VWj
YYD>._^U
;YYu4})]uF>
YYM;tGM
;Es3_^[
#_^UDVWjAEPhB
UQQSVu
W33<0r
<0sEPD
7h_^[t
[U SVh?
SSSSSSSjj
E_^[t$
EPEPBfUfEfE
j2YBfU
j7YEPEPBfU
j2YBfU
j7YEPEPBfUj
EPEPEPV
M3;YEw
EtkSWj
t,SEPuuW
WuZEY_^[Vt$
VEEPVuE
3@^3^U0VEP3j
WEPVV3GWu
EPuSWu
_^U VEP3j
WuYEPuWj
tU3CSEP
[^UQVu
E3GPW}fE
EPW}fE
f]_^[U8j8Ej
_^U SVWEP
MtDU+U
)EU+U,
E+Ej@PE+EPVWjS
SSSSSjd
_^[U VEP
^t*E+Eh
PE+EPE+Puj
t%6)Yu
3SVWdB
3_^[Vt$
PYYt;j<EPV
U@j EPu
P1YYu(EhB
VWEh B
XEPh~f
^[SVt$
:tCx:t=x:t7:u
SW9;=PE
t'V0tV
^_[Vt$
^2^Vt$
^2^UVW}
8\@;|3~'<>\u
A9\tQP
VSVS'Yt$
EEPP3PWW}
3_^[Vt$
^UTSVWj
SE3GPW}fE
SEPW}fE
SEPW}fE
SEPW}fE
SEP}fE
SEPW}fE
_^[U8SVWj
SE3GPW}fE
SEPW}fE
SEPW}fE
SEPW}fE
u^G? u
G? t? t
3_^[V5B
WWWWWjd
_^U SVWEP
)EU+U,
SSSSSjd
_^[U0SVWu
_3^@[U
3_^U0SVWu
_3^@[V5B
jdqjdh@
YY3@^U8SVWu
_3^@[U
Y3@U8SVWu
_3^@[Vt$
YYuSU-
J3B;~KD78 u
HI8 t+;~+
HI8 u+;~
W]]9]u
Y}fElPYYup%TE
EPu\mf}`PYYt"
E`Ph,B
3YEBBRP
3PPPPEPQQu\f$$
j%_WWWWWWW,h,
EhPEdPVS
ElPYEpt=LE
VuhudV
YfPV<PPEPP,j
uhudV2
VuhudV
QQu\f!YYuupLE
XEEEPh
jFpPhB
EPEPEPj
SUVWjAD$
SSD$ PSS
V3VEPVh
VVVjFxPhB
3^UQW}
^[_S\$
VWPEPh
VPEPEPVP-,P
_[UQQSV5
f(}|BWuu
;S}/+}
YY_^[U
SVWuxP
ETPh~f
td;uWE
+EdPuXV
udP&YYu
~u|WPV%
u<EPhB
3_^[hU
PEPPPu
PPuP^ }
PPhYYtPh
PP0E`E
_[^UQSVW
3V]:YEPWu
W$Y_^[U@
tK;uGj,EWP
P[PYYt:D
WPEPPP3V}
Pu$hPB
SWj33
]Y}fEpP]pUYt
t]Ed:EpuUj
k3@^_[tU<
E$SVWj
UE}M~l9E
t!u(uu$
_^[UtVWj
+MVMM+ME+UMU
Sj!SVj
S_^[]3D$
UQSVW}
+3BP33
^[]Vt$
W339L$
GAA;|$
SVW3S-
EPVW21
Y3_^[UH
EPVWW0
@j@EPP0
tUQQS]
]3+tSKt2Kt
t3Nt"Nt
Y_^[UQS]
[t]Nt8Nt
t<Nt(Nt
aY_^[UQVK
OuSjY_^U
tcItAItIudJ
uMp}uu
t[It=It
WY_^[Vt$
^UQSVu
WY_^[Vt$
@[_^3USVu
01u_^[]USVu
u+9u'VWYY~
A?u*;u&WVYY~
_^[]US]
3F;u1;u
SWWYY|
VWS-uXu
SW-uG;u.SW!YY|
_^[]UE
YY]SVWj Y}
VW]YYVY_^[]V;W~
VWj Y|$
VW"YYW
Y_^QSUVW395D
j [+WSW]iVSVa
DSVEYY~
WuWVuV
SVW39=D
+QWMVuV
SVYY~#VSVE
VS+ S5E
_^[UQW}
<[_UQQSVW3V
<Su(V|
uSBVVu
VSV0>u
OuSvY_^[UM
|[_^]Ul$
SV3FVUj
EdS~YYEp8G
uEh^MEl
E`Mp]d
VSDSVS<SWSBEp$^X
[xUQSVW8w
Y_^[SVt$
*V8^]Vj
^UQSVWjD|j
MuS/Y_^[SVWjD{j
Ku_^[UQQSVW
EVWWVV
vVVuWuv
_^[UQx
YYWtau
WP8NYCuYY_^UQQSVW3SSSSEVu
VW|utul
_^[UQVu
8Y[_^UU
|_^[]S\$
;|^_[USVu
VyY_^[]U
SVW3Sj
SnSf,E~
tDuuVuWuu
WWuMEUuu}(UM
Su;YYu
~JME+EE+E
}t>EG;
~@UE}+
WutSVu
dSVWuuVM
)E+u)E}
A;|_^[U W}
MK;]Ur!w%
~O}UE++
G;|^[_U
M]~$Euu
E~"]uu
EKuE_F
SWYY[^S\$
^_[UQQM
p_^[EUQQE
Eu[Vt$
{YY^VWj
^[]US]
@<>@AO;v
v+u 3u
4u >@BAO;v
VWj?Y3
EPEPPEPEPPV}
v.EPEPPEPEP3
VWj?Y3
EPEPPEPEPPV}
v.EPEPPEPEP3
j@PV@q
WQP2E;v1
SEPWPu
^@@_^[UTM
AVMWxPXhpT#P
xl330#334pp3Pt33M3U
x\#33<338p|3Hx33M3U
33@>33Dv
33M33Uu
ph#xl#}33H
xp#pt#
33P33T
#H(#px33\33X3
#]33`33d3
33h33l3
M #H@0
33p33t3M3U3M3U
3(#HH3
33x33|3
30#HP3
38#HXH
3M3333M3U3MT
}MH#Hh]3M
3#3M333M3U3
P#Hp]3M
3#3M333M3U
X#Hx\#P|h
3M#3333
E%%$3
s3333MEE
X^_[]UE
u0Fu,u(u$u u
EP4VU6f
}9}(|t}(
k9}0~b}0
Qu48u0u,u(u$u Vu
P`PV8Pu
u+W39|$
6iG;|$
U]*Mf+M
?^[_UVu
X_[^]UQVu
P@YYW8;
MvDvH7SVh
@;u!8;
3CSWEVPj
@G;|(;u";
_^[UVu
3[^]Vt$
Y~OSUD$
GG;|_][
X+EE)uE
;|_^[Vt$
X^S3C9
DUW|$PD$
SW^[3_@]D
A;|3@p
WjY3E
}fjdEPux
PyYY_tEl@E
3UQj(h`E
t{SWVNYSVj
EPEPhB
3_@[^UE
;E wrE
SWjAY33
EEPM j
j2uu_^U
PxvY3Y@
VWjAY3
3u7h0u
QRVW4t
QRVW t
QRVW t
QRVWz
Hu*SSSh?A
SSSSSh
PrYYtiEP
EPSh8B
E+Ej@PE+EPE+PujS
SYu@h,
P#rYYt
SSSSSjd
WS_3^@[
P"qYYt
PpYYtiEP
EPSh8B
E+Ej@PE+EPE+PujS
SSSSSjd
WS_3^@[
tu^%XE
P=o5`B
t63CSSSW
PnYYtTEP
EPWh8B
E+Ej@PE+EPE+PujW
tCQPEEWPM
Y}uuuu
VPEEWPu
j2&vj2uuh,
VWEP3Su
u"EPEPj
MtKEQPu
Y}uuuu
j2rj2uu
@EEP5LE
@@Py<Yt$
V+fYYt
K^_[j$F:YL$
_VPYt\T$
bYYu.u
^][3_H
W3jD$
V^YYuxhlB
V^YYughB
WV^YYuUWV^YYuHh\B
V^YYu7hTB
V^YYu&hLB
V~^YYu
Vm^YYu
^][3_H
u^[_W=E
u^[_Ul$
SVWjE
CVS]prC
ulu|Eh/D
ul'[YYt0
GdP|0WPVE|pPu|l`u|0
P/hYYul{
WhYYhE
u u|EhB
uLVYtAVKYu$VVEhB
_^[tVj$U/D$
UPheYYh
UWPeYY_][^Ul$
uVj`+Yt$
|>WYu59
WNFXp\FXY
3_^Vt$
HUWV`Y
GLY][_^U
}fEh@B
WjY3E
}fSEhB
EPSEhB
EPSEhB
_^[SW|$
WjPYYu%W
j Sh/E
^[_SV5B
SYWhTB
UYWhlB
GYWhXB
9YWh@B
+YWS!YWh(B
YW_^[U
SYtpUSYu
Yt"HTu
p ^QQSUVW
X;u3Tu
v/8_Pu*hE
+tJHt;Ht)Ht
urj?Yfh8B
G;YYtHV
U\SVWE3P]
upEPEP
]]]]]]
Wj?Y33
SBYSCT
SY_^[3
YYt^Vh@B
YYu^_[
u9VW3D
_^US38
33;tGF
u3_^[]
_^3]@[VWG
:u'F;|
fuTu`u\uXEl
EPulV3
pH/RYt8h
QYt8hB
'QYt8h
PYt8hB
PYt8hB
E4Ph/E
.PYt8hB
0OYt!h
PSEPSE4P
Ulw}$qA
P!ulEP
uXuu\u`uTu|QQf2$t
ULSVWj
3}j@f^(j
Wp07YYt
u2E;~+9}~&+E;
YY_^[U@E
^%;t"?
Vva=`E
[ u2_^[
YYu2_^[
VWj3E
Y}fEPt'j
SVWj?Y33
Y]3}fh
`tKat=Ht1Ht%H
SVupt=Wj?3Y
Y}fEP_u
EPP{DYYu?v
^[xUl$
upt=Wj?3Y
Y}fEP_u
EPPQCYYt
^[xUl$
SVupt=Wj?3Y
Y}fEPt_u
EPP(BYYt
^[xSUVW
gF'39F
Pr(YYtRSVE
P'YYt8VhPux
S]xVWETP3SuT
P&YYt?El
SMYY=PE
Pd&YYt
3FVS22El;YY
VV3VS0
M\EXL9
QPEhE$SPMl^
uluDuh
uP= 9F
}\D8 )j
D8lExj
u{j Y3E
S8.YY=PE
u`]\EhP
!+jduluhC
QPEhE$SPMl?[
Y}<u@uluDuh
u@[MdE`
QPuxEhE$PMlZ,j
u@uluDuh
u@B[MdE`
QPuxEhE$PMlZ,j
u@uluDuh
_3^@[p
_^]3[h:F
DDDDDDDDDDDDDD
t+t'NW8u
8t3^[_M
^[_Vt$
YY_^W|$
Mut$VMQPV
VEPuVt
+SVWEePEEEEd
Y_^[QVC20XC00U
33333]^]
]_^[]UL$
;t_^+[]3]UQQ=;F
B8t6t8t't
B^_[VD$
tAt2t$
+WVS3D$
[]US39
j Y+L$
YYj`hB
f8MZuH<
XPuVVP
^[U$,T
3MEEEEE
It.ht lt
HHt`HHt\
YYE}[E
@@@u3@t
t$ERPWS09]
~DE]EM3f
CYCY~-
uMEFYE
eYt*F=<D
uH80t8
3@3UQQ}
SVWt']
A80t.F
D$$VP3>-
_^][USVu
|(;}$t
]EuMm]E
t;j\V.
;YYu7~
Y[^_EhB
;ru,hXB
;r3_^UV3F95`;F
^UQQS]
VWj\SC,
uEuKj:S|,
YYt}hB
qWS|WV
YE_^[t$
uH5@;F
t6SfY%P[;Yv
USVWUj
Pjh(?B
t.;t$$t(4v
EtVMf9MZ
z9<p;F
_^[UQQ=;F
F;s"95<D
QPEPW5;F
_^[UWVSM
[^_j8h
u8SS3FVh
YE;t@E
t!SS9]
E;tSSu
[e}VSW
33M;u#uV
Y;t1uSW
EPWu uN)
u9]t#W?
Wj@3YNF
EVEP5OF
t6SUW
VPVPV5NF
@;rD3Ar
@;rM^[
j@3YNF
3G9}5OF
j@3YNF
@;vAAy
3UV3PPPPPPPPU
$r ^UV3PPPPPPPPU
$s ^Vt$
t-=p=F
Yu350=F
YYULSVWj
MQ@Puu
33Vt$
uMSW<;F
_3[@^3^
P*YY}P@<Yv"PE;j
6[YP6j
^[]VW39=PF
t.t$<"u
u_^S39
P;Y=@;F
U*VE>=Yt
t7VPYY
3Y]_^[5@;F
@B8\t8"u&
_[UQQSVW39=PF
EHY4;F
3_^[QQ<F
SUVW=|B
SSS+S@PVSSD$4
;t2U\;YD$
t#SSUPt$$VSS
u+@U;Yu
_^][YY
;rSVWD$
_^3[Dj
u5EP3GWh
VIYEn]
_^[U$d
E;|!E+
3R95;F
j YjY+
VWj Y|$
PjY+3BR0
}_^UQe
Yj^+3B
QPIYYu
<+3E_^[
Ju^3L$
SVWj ^]
EPEPEWPv
@PEP 3;>v
|!3}MEP^
oYY3jY+N
E3PPPPu
E3PPPPu
EP}M$VUWVu
DDDDDDDDDDDDDD
W@PWVT
_^[]UQU
PEP)YYh
tH8;t;"t
#^]U39
Bu^[]U=NF
#]3]V5PF
uVjD^VESP
;EY0EY]H
E8]t,H
EPEPSu
_^[US]
0t=+P:F
3Y_^[]
]UQQSV3W=H;F
VVVVjPVV;
EtZPR;YEtLVVuPj7VV
t1EVP"
;u3_^[uUYU
YMj8hB
WWWWVSWu
YYE;t2WWVPVSWu
W3;u4DP
^_UQQM
MOI;|9M
3@_^[U
WI <}}
MLD3#um
#Mj _^{
;]r;]u&
]#\D\D
3@3SVt$
W>+~'WPv
^3^SVW33395NF
F3w9=p=F
SYu+Vj
u"=0=F
_^[VWj
^395NF
YF;5NF
VWumhB
t78t2=D
PMYtDu
=N@uNVEP
E3E35D
3;tMu
VSSVLWVEV9h
;VWEN@
}ShSbEPSSRE
tfEM_^fC
ESEVE33W}
+tHHt
+t%-t 0tFC~E~
VPY3YB
VPnY3YB
tfW1OM|
+tzHHtj
#fWEEEEEEEEEEEE?E
PEPfU}
EPNYuO
EPWEPNEPEPEP8EM
0H;s;s
1VTYt(CH;r
VsYu3^_][
+Hj@hB
E33F9=L=F
}}9} u
M]3F3E;u
6PvYt@E
3};tIj
S3;W]u
aV0;utSj=VX;YYEtB;t>38X
t?^_[9]t
}+}u5@;F
tB46#9]Yu
;YYtC<9]
@@P?;YYt8uV
MVVY9]t
uHYEu7E
EEEEfF
EEPKYu}
u5}u,e
^YY39M
u_^M[{Vt$
@P[YYt
YY^3^SUVW|$
tiWYt<
_^][Vt$
-AV3t$
F;r^U}
n:TroY
958=)CCcU8hr
_bA4!|
_Ax0Ogh{c@
I+=[HK
R3Fj~^B
m%=:qE
aDAr%6
^1S~to
96z[#hRL%
g/QL/{:UikbfCO4`{5/,
PvwM8v#7,f
n:TroY
C>5MvseJ/i^IU
on,7m=
tLUm:
^?p4nRy)
aEFW$GdQ^
qDbVQdI
rR/fJ`L
n:TroY
958=)CCcU8hr
_bA4!|
_Ax0Ogh{c@
I+=[HK
R3Fj~^B
m%=:qE
n:TroY
958=)CCcU8hr
_bA4!|
_Ax0Ogh{c@
I+=[HK
R3Fj~^B
m%=:qE
aDAr%6
^1S~to
96z[#hRL%
g/QL/{:UikbfCO4`{5/,
PvwM8v#7,f
O]`}Y4Y:
8q)FxM
6H|a4y
Wt)|e_PVz-
O[jB G
EqeNA(z8h
j4fv`,t {E6./9cvt[)H
Mjx8BW
I-kHX.fpq
n:TroY
958=)CCcU8hr
_bA4!|
_Ax0Ogh{c@
I+=[HK
R3Fj~^B
m%=:qE
n:TroY
958=)CCcU8hr
_bA4!|
_Ax0Ogh{c@
I+=[HK
R3Fj~^B
m%=:qE
aDAr%6
^1S~to
96z[#hRL%
g/QL/{:UikbfCO4`{5/,
PvwM8v#7,f
n:TroY
n:TroY
n:TroY
958=)CCcU8hr
n:TroY
958=)CC
n:TroY
958=)CC
n:TroY
n:TroY
n:TroY
n:TroY
n:TroY
n:TroY
n:TroY
n:TroY
n:TroY
n:TroY
n:TroY
n:TroY
958=)CC
n:TroY
n:TroY
n:TroY
958=)CCcU8hr
_bA4!|
_Ax0ya
n:TroY
n:TroY
n:TroY
n:TroY
n:TroY
n:TroY
n:TroY
n:TroY
n:TroY
n:TroY
n:TroY
n:TroY
958=)CCcU8hr
_bA4!|
_Ax0Ogh{c@
I+=[HKya
n:TroY
n:TroY
n:TroY
n:TroY
n:TroY
958=)CCcU8hr
_bA4!|
_Ax0Ogh{c@
I+=[HK
R3Fj~^B
m%=:qE
n:Troya
n:Troya
n:Troya
n:Troya
n:TroY
n:TroY
n:TroY
n:TroY
n:TroY
958=)CCcU8hr
_bA4!|
_Ax0Ogh{c@
I+=[HK
R3Fj~^B
m%=:qE
aDAr%6
n:TroY
958=)CCcU8hr
_bA4!|
_Ax0Ogh{c@
I+=[HK
R3Fj~^B
\a<o$,WIV;o</j
_OJ9]*Y
_OJ9]*Y
_OJ9]*Y
_OJ9]*Y
_OJ9]*Y
_OJ9]*Y
_OJ9]*Y
_OJ9]*Y
_OJ9]*Y
_OJ9]*Y
_OJ9]*Y
_OJ9]*Y
_OJ9]*Y
_OJ9]*Y
_OJ9]*Y
_OJ9]*Y
_OJ9]*Y
wLs!EcJ\]
_|T#BdjV1p
_OJ9]*Y
_OJ9]*Y
_OJ9]*Y
_OJ9]*
_OJ9]*Y
_OJ9]*Y
_OJ</j
_OJ9]*Y
_OJ9]*Y
_OJ9]*Y
_OJ9]*Y
_OJ9]*Y
_OJ</j
_OJ9]*Y</j
_OJ</j
_OJ</j
_OJ9]*Y
_OJ9]*Y
_OJ9]*
_OJ9]*Y
_OJ</j
_OJ9]*
_OJ9]*Y
_OJ</j
_OJ9]*Y
_OJ9]*Y</j
_OJ9]*Y</j
_OJ9]*Y</j
_OJ9]*Y</j
_OJ9]*
_OJ9]*Y
_OJ9]*Y</j
_OJ</j
_OJ9]*Y
_OJ9]*Y</j
_OJ9]*Y
_OJ9]*Y
_OJ9]*Y
_OJ9]*Y
_OJ9]*Y
_OJ9]*
_OJ9]*
_OJ9]*Y
_OJ9]*Y
_OJ9]*Y
_OJ9]*
_OJ9]*Y
_OJ9]*Y
_OJ9]*Y
_OJ9]*Y
_OJ9]*Y
_OJ9]*Y
_OJ9]*Y
_OJ9]*Y
_OJ9]*
_OJ9]*Y</j
_OJ</j
_OJ</j
_OJ</j
_OJ</j
_OJ</j
_OJ</j
_OJ</j
_OJ9]*Y
_OJ9]*Y
_OJ</j
_OJ9]*
_OJ9]*Y
_OJ9]*Y
_OJ</j
_OJ</j
_OJ9]*Y</j
_OJ</j
_OJ9]*
_OJ9]*Y
_OJ9]*Y
_OJ9]*Y
_OJ9]*Y
_OJ</j
_OJ9]*Y
_OJ9]*Y</j
_OJ</j
_OJ9]*Y
_OJ9]*Y
_OJ9]*
_OJ</j
_OJ9]*Y
no key
This program cannot be run in DOS mode
a "..\%s.rar" *
?i=%s&l=%s&t=%s
http://
btlc.dat
%s/%s=%d
tooltips_class32
twitter
svchost.exe
unknown
SeDebugPrivilege
:\System Volume Information
Gbnt#n7:
cw -y -tk -inul "%s" "%s"
c -y -tk -inul -z"%s" "%s"
a -y -tk -inul "%s" "%s"
Desktop
%s\%s\%s
icacls
%s /grant %s:D
takeown
"%s" /grant %s:D
/f "%s"
common
winrar
kernel32.dll
GetProductInfo
GetNativeSystemInfo
%s\%s*
www.ebay.com/
www.baidu.com/
www.imdb.com/
www.bbc.co.uk/
www.adobe.com/
www.blogger.com/
www.wikipedia.org/
www.yahoo.com/
www.youtube.com/
www.myspace.com/
www.facebook.com/
www.google.com/
shutdown -r
\WinRAR\rar.exe
mailto:
172.16
192.168
content-length
chunked
transfer-encoding
HH:mm:ss
ddd, dd MMM yyyy
application/octet-stream
<h1>%s</h1>
Windows NT
User-Agent:
ServicesActive
sfc_os.dll
SeShutdownPrivilege
NtShutdownSystem
ntdll.dll
%d.%d.%d.%d
Notification Ar
ToolbarWindow32
NotifyIconOverflowW
Shell_TrayWnd
Twitter
User Account Control
Registry Edi
Please restart your computer.
Shutdown
device
InternetGatewayDevice
WANIPConnection
service
WANPPPConnection
urn:schemas-upnp-org:
Content-Length:
errorCode
controlURL
</service>
<serviceType>%s</serviceType>
%s%s:%s:%d
http://%s/
URLBase
modelName
friendlyName
GET %s HTTP/1.1
HOST: %s
ACCEPT-LANGUAGE: en
LOCATION:
M-SEARCH * HTTP/1.1
HOST: 239.255.255.250:1900
MAN: "ssdp:discover"
MX: %d
ST: %s
<%s>%s</%s>
<%s>%d</%s>
Content-Type: text/xml; charset="utf-8"
SOAPAction: "
Content-Length:
HTTP/1.1
HOST:
</s:Body>
</s:Envelope>
</u:
xmlns:u="
s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
<s:Body>
<u:
<?xml version="1.0"?><s:Envelope
xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"
NewLeaseDuration
NewPortMappingDescription
NewEnabled
NewInternalClient
NewInternalPort
NewProtocol
NewExternalPort
NewRemoteHost
AddPortMapping
4d(2dhP
v.A0,;
]w[T1`m
tskMainForm.
tSkMainForm.
skype.exe
Lower: %x
Higher: %x
SkypePath
Software\Skype\Phone
TrayClockWClass
tSkNotify
tSkACLForm.
TCommunicatorForm.
OPEN CHAT %s
(party)
(kiss)
:D :D :D
:ddddd
GET CHAT %s CHATMESSAGES
CHATNAME
GET CHATMESSAGE %s CHATNAME
STATUS
FROM_HANDLE
PARTNER_HANDLE
TIMESTAMP
FILEPATH
FAILED
COMPLETED
CANCELLED
TRANSFERRING_OVER_RELAY
TRANSFERRING
WAITING_FOR_ACCEPT
REMOTE_DOES_NOT_SUPPORT_FT
REMOTELY_CANCELLED
FAILUREREASON
GET MESSAGE %d TIMESTAMP
GET MESSAGE %d PARTNER_HANDLE
GET MESSAGE %d BODY
GET CHAT %s TIMESTAMP
NROF_AUTHED_BUDDIES
MOOD_TEXT
ONLINE
OFFLINE
UNKNOWN
ONLINESTATUS
ISBLOCKED
ISAUTHORIZED
BUDDYSTATUS
IS_VOICEMAIL_CAPABLE
IS_VIDEO_CAPABLE
HOMEPAGE
PHONE_MOBILE
PHONE_OFFICE
PHONE_HOME
COUNTRY
LANGUAGE
BIRTHDAY
FULLNAME
GET USER %s ONLINESTATUS
GET USER %s MOOD_TEXT
GET USER %s ISBLOCKED
GET USER %s ISAUTHORIZED
GET USER %s BUDDYSTATUS
GET USER %s IS_VOICEMAIL_CAPABLE
GET USER %s IS_VIDEO_CAPABLE
GET USER %s ABOUT
GET USER %s HOMEPAGE
GET USER %s PHONE_MOBILE
GET USER %s PHONE_OFFICE
GET USER %s PHONE_HOME
GET USER %s CITY
GET USER %s COUNTRY
GET USER %s LANGUAGE
GET USER %s SEX
GET USER %s BIRTHDAY
GET USER %s FULLNAME
TIMEZONE
IPCOUNTRY
PSTN_BALANCE
GET PROFILE TIMEZONE
GET PROFILE MOOD_TEXT
GET PROFILE ABOUT
GET PROFILE HOMEPAGE
GET PROFILE PHONE_MOBILE
GET PROFILE PHONE_OFFICE
GET PROFILE PHONE_HOME
GET PROFILE CITY
GET PROFILE IPCOUNTRY
GET PROFILE COUNTRY
GET PROFILE SEX
GET PROFILE BIRTHDAY
GET PROFILE FULLNAME
GET PROFILE PSTN_BALANCE
GET CURRENTUSERHANDLE
GET UI_LANGUAGE
CHATMESSAGES
SEARCH CHATS
SET CALL %s STATUS FINISHED
CURRENTUSERHANDLE
FILETRANSFER
CHATS
CHATMESSAGE
MESSAGE
PROFILE
USERS
UI_LANGUAGE
SEARCH FRIENDS
SET USERSTATUS DND
Skype-API-Test-
SkypeControlAPIDiscover
SkypeControlAPIAttach
CHAT CREATE %s
CHATMESSAGE %s %s
#32770
Button
ChatRichEdit
RichView
TConversationForm.
TskMultiChatForm.
TskConfirmForm.
TGettingStartedForm.
TTrayAlert
cmd.exe
command.com
COMSPEC
`h````
ppxxxx
(null)
GAIsProcessorFeaturePresent
KERNEL32
CorExitProcess
mscoree.dll
runtime error
TLOSS error
SING error
DOMAIN error
- This application cannot run using the active version of the Microsoft .NET Runtime
Please contact the application's support team for more information.
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
This application has requested the Runtime to terminate it in an unusual way.
Please contact the application's support team for more information.
- not enough space for environment
- not enough space for arguments
- floating point not loaded
Microsoft Visual C++ Runtime Library
Runtime Error!
Program:
<program name unknown>
GetProcessWindowStation
GetUserObjectInformationA
GetLastActivePopup
GetActiveWindow
MessageBoxA
user32.dll
Program:
A buffer overrun has been detected which has corrupted the program's
internal state. The program cannot safely continue execution and must
now be terminated.
Buffer overrun detected!
A security error of unknown cause has been detected which has
corrupted the program's internal state. The program cannot safely
continue execution and must now be terminated.
Unknown security failure detected!
1#QNAN
1#SNAN
FindClose
FindNextFileA
CopyFileA
lstrcatA
lstrcpyA
FindFirstFileA
CloseHandle
ReadFile
CreateFileA
WriteFile
SetFilePointer
SetFileAttributesA
lstrlenA
GetTickCount
lstrcpynA
DeleteFileA
LeaveCriticalSection
EnterCriticalSection
lstrcmpA
ExitProcess
lstrcmpiA
CreateThread
GetLogicalDriveStringsA
GetDriveTypeA
GetWindowsDirectoryA
MoveFileA
FreeLibrary
EnumResourceNamesA
LoadLibraryA
GetProcAddress
GetModuleHandleA
GetSystemInfo
GetVersionExA
SetThreadPriority
GetCurrentThread
FreeResource
UpdateResourceA
SizeofResource
LockResource
LoadResource
FindResourceA
EnumResourceLanguagesA
EndUpdateResourceA
BeginUpdateResourceA
CreateMutexA
GetLastError
WaitForSingleObject
GetVolumeInformationA
GetComputerNameA
GetCurrentProcess
OpenMutexA
SetPriorityClass
GetTempPathA
GetModuleFileNameA
GetSystemDirectoryA
SetErrorMode
InitializeCriticalSection
HeapAlloc
GetProcessHeap
HeapFree
WideCharToMultiByte
MultiByteToWideChar
ExitThread
GetTimeFormatA
GetDateFormatA
GetFileSize
GlobalUnlock
GlobalLock
GlobalAlloc
GetFileAttributesA
SetFileTime
SystemTimeToFileTime
GetSystemTime
CreateDirectoryA
CreateProcessA
GetCurrentProcessId
KERNEL32.dll
wsprintfA
GetWindowRect
GetDesktopWindow
ShowWindow
EnableWindow
GetClassNameA
DestroyWindow
SetWindowPos
PostMessageA
GetWindowThreadProcessId
GetWindowTextA
IsWindowVisible
EnumWindows
IsWindowEnabled
LookupIconIdFromDirectoryEx
GetCursorPos
SetCursorPos
GetSystemMetrics
ReleaseDC
GetWindowDC
SetClipboardData
EmptyClipboard
SendInput
SetFocus
SetForegroundWindow
SetWindowTextA
EnumChildWindows
MessageBoxA
GetWindowPlacement
GetWindow
GetWindowInfo
GetClientRect
PostQuitMessage
DispatchMessageA
TranslateMessage
GetMessageA
UpdateWindow
RegisterClassA
UnregisterClassA
SendMessageTimeoutA
RegisterWindowMessageA
USER32.dll
GetDIBits
DeleteDC
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
DeleteObject
GDI32.dll
GetUserNameA
ChangeServiceConfigA
SetSecurityDescriptorSacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
GetTokenInformation
SetFileSecurityA
ADVAPI32.dll
ShellExecuteA
SHGetMalloc
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHELL32.dll
WSACloseEvent
WSAEnumNetworkEvents
WSAWaitForMultipleEvents
WSAEventSelect
WSACreateEvent
WS2_32.dll
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
VERSION.dll
RpcStringFreeA
UuidToStringA
UuidCreate
RPCRT4.dll
GetStartupInfoA
GetCommandLineA
TerminateProcess
RtlUnwind
InterlockedExchange
VirtualQuery
LCMapStringA
LCMapStringW
GetACP
GetOEMCP
GetCPInfo
VirtualProtect
VirtualAlloc
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
GetStringTypeA
GetStringTypeW
GetExitCodeProcess
GetLocaleInfoA
HeapReAlloc
SetStdHandle
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
HeapSize
CompareStringA
CompareStringW
SetEnvironmentVariableA
FlushFileBuffers
1.0.0.1
sjqQ@#
|)#$/C
SUHhp0
I)pZ/R
1,Eo#1"
D''s;#P
AhO#T^jymF9j
3Ll2^3PZWhrP
vi@xqA"u:=
0E_H4V/
RkW- ocC
_U~$32
i?F vr:Y
Kf&XR7
nz9E[4Yr#V
/_`w<n
C^-AD_@K
rQby3F
#L/.5uS
SiY* 7
rfA3%_{~
V @%qP
W]F`Lf
*GyE]1l
%W{`K<Y
C3s Z06
~5M}orVs
p9s8_Y
jMR+/
AYV2F-6yu">
'noe!D#e"
_O>"7;\
qAKZrh ,
~E'iy%6
+3Uo-w
1S/CYTT
PR#JaIh
'zp"D.I
tb%Z/Y`N
"#z!'F
97c-hJ.vG
.<.M6{c
%{#.~m3@D3%&
wR^OZs
El_xT:&.
[kup'V
\Y1V#8
OvsE,*NG0
~XA%8>
IE_->-
j2eRU"
=3$'`){
JP9#?.&X^Y)
R<-eq.{ujgQmz/d!$/N[{fL
]ljY0]4
9h)J|2G
ITFeD?RHy+BExy<
3!QM_w
)-X:}M|=yVg1
~YWhJa*
n8i3f:h:
6#:I`5
S<SbhYL+
0b}92:
^a3(Nb
1O!U5}Zgx
:k'6 2^
vAn_3b+
,'6-ct
,'6-ct
DjwTGwYM$L%A
4&s,?ni
1O!U5}C}94
!jQVWB\
M3t?4\iR-jJ
T$3Jxo1
!]Z'}_VR8
1k+~<|n
!]Z(dx1
:k'6 2^
*AK!jQVWB\
scUH?!B
@b3BgE|
3!jQVWB\
HvoRq3Vh
56_.:/j
7,!psE
56_.v]S
W9Cu%wy;0@n>".
$}Ms8za,BrK
/?P,Z?&x^?
7|pXXG
~62CU5
!mo-M _r3
lFN.dGwT]`1
5b>g}7w
s~6XtdU@{u5)3m\.8
o/oeyixzE]J
rf9Ni-(
R"vct)
lFN.dGwT]`1
5b>g}7w
DY}0}Q
)LQ `B$3Z'Z
FB 46|Ykg"
gt9*8Q'38
^GGS*fG4
=6Q+bizl
jaM<+biT
gZCZsm|uj0g
jx#o&+bizl.^
@wusNE
QdG@XkJ
gZCZsm|uld?`
"KP;F^Z/
a<ftlz~
&M938!L
9X~<8{
fKEmc8
eJ3UT'*s
(hOzB|
n<Q@uW
8*;w(Bq#f4
8VO8X(;
U5Vyl{s
{#<<Iv
|+%5'K P5:S
d}**_`4
{#<<.k&%+Nh
S\W\}XgBQ|
?Btc;tw;qU
^zm]M[B
,biRbY
?b2H1Py
y{C2OyO7'
#j[{#<<Iv
Ng8;zy
Et%y56_.v]S
8Vg8h_TWn*W
8JYy"}=
)#0EJvC1
#0EJvC1
&U`/G+\*
=dhX'WV^5
!!`@$hy
4&q^+99{N;
=dhKq6
1+2B`Ez
7xCNDY?
M<3$[u\5
r}lavN68_2b
=dhX'WV^XhS
9Q}Vpc
{K!F3H
:*q`}L1Y
7=dh[kr
=dh[M-
1+2BrR
T}FC#0EJu
]2,|l!`uC)$$
 o|Uz8
;b_<qk<
;b_9oG<
#L3cvN
#L3cvf~
Vm]6w*
iGf!M?
S]v[E*&
S]v[E*&
iZ7f2 j
?>R1~hN`
9@n"d!8
L,Z4<fW'0
x~$B~P4
ud0aHB
/Vl~-d?-hk>$1
bN-roygj;
J&FhrQ
,~q,M"i6Q@}q
t3!a$&,
l=}K0[HDB))
ra6vvWZ
9ydQ0(
HPirI'py#
S0cpF:0dx
0}[in5E![V;y
;D_lA<.
Ad+x( S!tQlB53
=B0rne
sD~KHI=
3yTMjuhX
gXx3}T
U}b]~8
cJ(pn9Q%h.Oo`
9W[&E5s
7q] 9;
#-))e4Cx
}52^y2*
yHBi1Q}*w<{
B\~VX%lS^P
y#/c0p
'5QsZY>
ZOn7n,cC0\[c*jiFX^`
v)q"G%>
qw}OWq
*;N_*d
<k,c7;(
X@Nt}q/!
pr!;!3
r)KOfe
&,>Y9r
M'7i8U
68!6>!q
;[K26uw+Xr}
=AhEy8w
>{-xBtk
Tg~K(4~
NIX.u2
G1P(O[xi
^W!e;Da
\2Jc[r
mAkTbe
#j,[5#p
uNgi//% 5
YSuCK\mj|
Wm_$M`aJq+gq
J6=?iH
c)yS|~
:"Z_RMh$M
xbt,Zo
`5wnwt
7`zhQ/7Yz
wY)wV>!2P
Bv]l.CIWD
[Cc|#(
.}PNVz
EdtZHf
^vp;Xht
`k,R}z<<X-w^TEYq_$ny
u\Tw:S
@8S>ILgiTp
1iiHwS
^W-tywds@HuD[l<"Ya#
X?`fA2SvX!}KyrNEx
>C`,FiQ
rT,WZ^O{\
4c[#V=G
oB(m0s
L{V|waO
jx**|m
{ss=-x
#6TB0B
JkSbx0P74v[-9
[n~NXzIX<w[k
d$K*':
fw]g`ED
1id+~xm
)E]1&8}
:[$yZ
?VpdAAt>ij,
JPHB=X7c
kGv!.5D{;
60l_w(
Lu`n=?
@oxrk*p
d(+)_&0
}c+'`D
0:w#/1'JnK
*jPfTV
dmG`\D|
AM`kqU+
X0exMO
~^}>(
anRxB ]Fl-W
W0vimE
3Go1SYm4O.m0A
yCp"|+
hU[Yc$~
Zg7.sL+w:
CJ#(NW{U
xHW*Ih3v5
@Nw,meJ~
nbM$ '*@
&!xBT|
=jSPR:)B<Pw"
gTll!>
7sM}Y0
T[-8V:kWH<
u!0FEjvwB{mPHqd/e8.
e%bjJy
8Q7bE6(0Z
~*q;/!&'Ov2i
o?.X<Y+,~1f
fLvL zTv,YI{h
.4+ZJ
#Lnuj
\$"|4_
9'`rY$
x<]rLep
AYtlffMzV)
DC;YHq@
Tj~u,AO$W-.s
:\nl/k
5wK-C8hw6Z
S=G:%D(>
rY!-diBk
XSmqaL
7tH5prC_xs>8FN]
?f_Vd"H2vE
@>'1SU
<wQB[(qoO7_
&+\=gnx
&.ul%:
mCr7qxbj)q
XH8}4|J
P(@t/u
nb0XTVmP
J{cR'/V
9Hr$3.p4K>
@.PgRUVj,,
nf.zz"
J!b>1s
q#`!cRF
wH(M6$n
X"+d|fOUgy
0r!jEu
pd@I6a+P
RyE2Vf^
G40a[?h
*Wcd_X
"M#1!d
D@N="\4&pS
;ccS!
Q:5Tz)^
Jigub(
}v0ZL$
n5n6jT',R
|]aHznM
P43lmq
Wp'E/ZH_
!^W'[wu,
=xA30?
$bXX%v
PMg#g0
z)PkQDIaf
hsSU.^G^o!9[}^P
&fO`DXU
5v1u:^Ts
D$Rh[O=
+U?6+_U2fa<xK
nL_yO^=
7d<;l_crC-
!ChRHQ
{xh{ <
sNcr2pwl
9*Z.#PX%q
"RZCf'nbJ*
%3EA3CE
_R)cJ=CFCg
n;hRZ6w
Z=x0qg
Q1CH!N%) c
G.la=+e
)7$8hlZ
/M{)75
&L*RhN
E0jQ3HLjx(%mf<
P2t4-"
@0$,UpU*wc
1~l<|Lq
.5A&,N
uDR3%
p]_z<JP
P)4k7S
IEqV#x<
5J|8r4}
pi=!S*C
e(xRUL
i#m%"8VF>
SQ A6x_>s}:&Nc
iBtHuLX*WU
M{9A4y@_l
2Jz}_of^el
(G20Rb\m`]A@.[
)@6Nm\eC>o
3hCG$-
]wfnc)}
mOn_UIt
HbW+mW,^
Os{GE.
6S}|~k2
I~[qt.31GoEH
nG_#b#1$rs
m+Yvk
6Vn4MBR
[Ad70&7_*
Q2%W;G9
T#SsQDv66c
~+QtL7md
pL?$}U)+[yK
$T3^qo?
<8O/uC_
:&x![r
jPH%n
\oH}AN
_kIOO/\(-`{Vx@N+
29d^@q
{!5(0'e
y9NgY)ZP
a%X=?R
% ^bQH5B[V SCj
o?qzg
*(g>DoE
FmOo]sf4V-
Cr{zW`0
OZ@d y z
qd!WTyP6g;
}BmxE%Z
Sd9kZ'gD
&qWRuC
X\x~k|
>"Fr-"%~yPpAwNfd
:|M?@Hk
sYiK H
BE8s`AHkta
XM(`eH
)h?>Vs
&}NXzU
bBz$7A5\
d%s?Q
1zQE1,
l*SKG>:!
>x|\P=C
`hj(3_H"
E7J^t3
`m\:>$<
q*&zga
@8Ek]3q~o>
>}[Z^G
d>Ih#}>+
<wL4Ie5j4e`(n
"TPYo!
6/eT|E
_g-R_]$O`
t i,VeR#nODo
4}h=9H
/<$H72D\0D
"iuBZX
.O2B9&
`Z)5H,4M
J5&=$}CUW
avS"lLbzYh-3l^
03y|o~g[xy
L.gy9L
|;?P;SF
R3bI9Na5}(
/-Q6*8
|@(S0s]YF
SrV^*
0)PbGc=
S*i/5J~}~v
<m~}2d8
S_ >Ko0RUv<v
=a8sTFA(`
9Q[bM$+x"f5
JS^,^C
aOY!0*
~s6T?g
P8}W@K
F$Uv>J:Ja#yL
lr/<,Bzx
Q|(Ux9>S^yE%IS
MD7i`R'+`C
gm::R#t3,L
i5N2Y(.1
lml[?B[0h:
DzXyme>rA'Z\/(\N
PFxVp.sK,
Mc.IbhS
}ne!nNXK{x-`d>o7+.hhihT5(<TR
0H 6\V,.
d3m@uJ{c
T~Gl)f
.M0b{%O
p[;lg-.BY
W'Nl.F8D|
t9>MdW"
KQ|~Q)6k
g$GCN|
yy>cG|i
=!BZl8);
gcFO) g
#K5n4iD`%
K,x!9e"OK
^PT16o1 $
vXT'KM
Qzo<>`
I:8Qqs
.yzt{T
1zCuW0
L736_JDV
bj0tbJ3k
*Nle6,
]:#9m9kz
HY%+\1f
nk?/ZuPq
/I5"nNo\tf
l'<'?%K
Q1cNtMf
]w(3FV
Wk4V2a=T1
g~MuCjJ
[YgQ@[(e 9e=`S
OWGYwQGV?ls
HyfR0MRR;Tr}/
\o=s9)
5zTO5w
0.x!fv
&c}:06y
I__Ic.1
wiTM8\
9(T#eNu
_6mzQQr
>j8GvH.'
=)z(mA(
rvwQPS
*.5DCF$
x9K4_b
m#,Aq3$8x.:UV3#
XI#1jjaoY/9w
7!S:[*
X*PlGu=
Y^Np)n1eyXx&K,Az
4<pJ' fo
>QI!Tm
bp<X='
ol+W88~
CvH\<`
NjMQ6]
9bP\a;r!Ru^vpU
y8{qEi
?kJ=kV
g)L;0Sa
mF/F"<
4>38$q
q[Cw9cPner
/4aGW !|IJ
9t=!7<j
Zilf N.Y
@l-*4o?r
mY({Wj
,G5:9)}
f|Aw-Ok
zEY9|7_
''qMKG
nVn\C`
U[IHPP.
e5Ra{/g|
-&Ni)r
Kv5nL;&Ur<
OLkN*mxe
bNl|,:c&?v%~
|6vcey
8a(\#e
005rBQXyt
2vs?gAX1E
S3di'oa%w"s
W'$^vd?2,
YOog,98
YaqARL
KO8i]:U
7;SP3ykF8
?876E#`l
4$>Nb\Q
^_o})oDhL
&&eqz$
LP\6n"
ox.$6U'ax3O[
Jg'9oa
)i%k1">u@bs
|3SiefxWxJ
88ZyU0b*~)xus}
qC4]y%f33mQo
?h+c+_
=3DQnyjf{}
^w.D"qP0}
/"S3Z|#n
Nvu]2%f"Z,g2
ZF\3-"yZL3X
u'WsOP4a
J-6NX0p
~bey1W?A
Hsbfu$tZe)
4?_o-/
lM=_l:V$9Qid
@:c6rN
" k;Zc]RX;
k'd%!uVV
w}^12
buvrS&
<yTDK7Jv
U5 i<p
h]3'}78
jcgT%i
X;jIzZ
%N#]~k
,?=9'A
T6[s=T1:
J((_iT/'`
tW1$>3qeOSc
';(p*O
qu$qjlNZ
K|sMK@NlR
8y?_{F
mZbLZ@4
_6^\9A
(-pK5
9mLU8o/
xDQqU%O&-SvE5:r@5ec@
m%C+vE
bZzKbD
2h+Vun
lPD9?5U
yf<0t)6@
wjFhMQR
a,Faa>6
8/`\mQs"3
GWjYZ^Ff
U.'?%M
+E+d R9}X8'I8
X6@Tm~
`4k,-F@-Q][wx(^yk
\oAzE6k-5xBjj|%eF
I~AIs8|8"T
=uiLplg
tn$Zg,h;'1+4OV6iB
6u51YxO
_gtXX_\=G@
7f~f%$a-e2QQ
9I$]e{?VdN:MFaL;Ne>IMSu
d!n,(D#CNZM@
v<R2>9=
-^LU6(c
o%Ur'J"Do!
*v2-i7
gT%FmO
,NJxi%m
.z[j"XN{+&
%e%LxAF.
Q+XhYq0w
O%"28xcf
y+n2l^cw#jO
vJN2B^
z`QgIN%{BM
)H^CX
T1c|'M#
@X~<]Fr(
!$RQEuw7c
QX>`31|}8W
c2r3wAL=
6.yPGlY
8v'% L-
R<oa9SoX)
>qLg6@
k>~f/6)|A
)QUPc{$
h%-v'`
hKHh%N
noK966Z/xH }T/
>2_%c4
j~*2)srm
xhAV,9$
gC\mJ]g[$4
+a?{n)-5Aw
|,wRn4at>
!yI40 "
+_'l.*
~$sk4]Yv/
dDu&j1dY3DK"DEHa
46fgeTt#0Q
@WBY9. <h
H-H# =YQ\)Ye
Dr46uHo!h`r4
$"{"K:
`:Qaov
xUcoD9v
O(k`9,r&
N@\E7N
G\QA#&
lB=AKH
D3?X&a
Ywu72&
t(o^FM0{
>y%cZM
gY-KJ+!e5
k7+lc}&%c'
f;191\BoPR
P0gOk/GEF/
U'_xLAH0
[^`q[)]@O;
:R3=xbY
!ec7)Wh&Kp
(|#Ycs
]E7*9Te*f
hbm5#,~-;f
6]8K/E2LJ:L
pA4'%MkJ;*#
>NU4iHS
jL1GH$^
>{!LGd
q~sI[m%Ik;"0K9
m~HeZf
YUXaIMQ/!F?"w
uCon?'
Qf]8>Zy?
`:=l5A-
@vup1^
umjKBF%]
$33HnY`9P
6JX4rU%`H1
jD/Ib"n$
<:7/Kv
J33no4
{|+ 5
#?f^kPb{
wrV7k:q_58
G<{Q\i
j;z@VD
{pqGjI
,dBm+xO.`!k
%bqdD&]
/.Q:@\
-_U4}N
NHOvesHD
d1\jQ.
R<dHy&
%ol`LA=U2JC*
JxS8Z(eK#`bEKO;2gwg
xtvUlJI]R
tK1^+}%
GS67K\R_!A
Kd7rYY
1,SO8z;t~\
'C=L[^B|
FwHI_s`bIK
HEGU3&Y&A
(qOcawp
ZyT-xHOwpy]
0GlL2s
%byesSn,drn!5}<
5lHnL<~iO
h&#~Sz
:pAj#_
:ZMon)BK
BMAx?`IW
GuoNWzj0&(H4qW
|i'WJp*[
\?2yzPC
"*2BK!
7yaKc^4w
~xHcB%
{'PnrKGD
j !siN
~y1@#-\
}%nj`ww@03Y
>\$jG}
d:F(\P
p>lrO6(
GP|*="M&YL
tMlZ:*W
23xjo,A
Up5P?P
-^.Hc0>
`ddzV@
W}+W$[S
rCtXi
]9?$xA
@ht79P
b^'x0_U
p|J?T!A|_m
zJ|ON*fB-.|)
k`.)?}X0p.
Cbv9 *
w~3G4kL
y8!zX!yxT>\r
<FQODr]y0J
YW()c6%D}NE"ju
S_8i#h>
NeV~-@(.@
<d`V]H
mog,/fPe#>r_
@}cGE_6j>
ee;?BNs
\<:]_9(C
g!^%lkW}tw
zF2Uj9l
CllE_<Pi0)|d
NI.pP*
*$-X0#i w[R
>LJ[QzO&
.ooPR?j=H
^D-|4D
:>7yja
\! BpA
c]or6y
$/ghlY3!Oz
!Ea3NS?_*VENL
V1XHk'7Sxj
=A{~0oPj
0v!;D2d@)
]SK?o^
JxDw!Ah<
3K].Xzs,A[Z
e<o JrZJJa
irFM'2?
RIp'Al4b0j
n~hHYi."n]7"
B4-]]jq$g
;uN^D
F>wK41+U*-p$fX-
:0n5nNp
V;42hvUe
~Z![$t
y.\N3yv^"
=*_5'>uVX
gH?Z*\AGB`
)=fNft&$
.~}&y-JNGCnSd[~vw
,/ \C=
n6-Fhg:tGK'
o:fFd8+
Oeb+p=
>/L-+8
)}u$n\1
S>t_HOp
?X!OG,'2myZ)B,T{D%I
-Ca(vt8
IfQqv}R^
Qz- 0`-2G~3
Y<Z(7cI
bt ~3uEhnSdgpcte
m'm,k"
_/t64P-
h2Y|]HW
GxT`>*j&hFJ%]mM
A5#nZf
a. RMyl2pCM
yI-0/r
,_fE<G
r17kq&Q}eF
L1,xpos
7@X*g4xqr
s:4/CfA
Th.+a_
wQmCht [
Bpvu:Vf
1\VYpQ8?"
\}V?7M
a.mUrgI,S3I-
_"<f.AQ8y
9%&oqPW
@{<>;x
@)4wcL9#[8>bz3rp%
R*,jMyzx,B
,@]"e^sWk>PK[[
d.G)$9[ee`
m6r/!}
vcmemuh
lPGY%d'i
%~It\f
3q^U*@+S'H
ggCXib4
Os5hf+@5
F5!aNk
zX #'6
%Gp/D"
9I +V/
SZRu=v
"r/}O>KS
E,*t&%XZLz
s|":'p
HD$ATt
,/D@x
bbB'X)LP
052+0h
!i`VJO
!u?fD4EIwb|#:
IGN[dV
?YL^V5Qs;!C
vJS?J^4\@+G@R
zlSL*H
HT+-=#\_
(?M/s'A
8TH@z}kl
1:*IvVZ7
:D(zkV@e
9;\-o/{=e
ETjO%k&Cp
%B>[i]C
of>oz@5*&_y.MP5dC
}ULG?,:2y
f->P2=
.9Rje>
A7[&(eE
ocb@oDVU0C"s
T~2]O3\T;<
@.B/Yt
ol3|"F\0l
<T%9n[=i
Pl&&3d1
q?(-B]
ev*x<;CGU'k
N|"s,=ty\Dwg
v*d~iH0U
/PCi\;im4(+
%WxSKBH
D6<<cRih]|
l9^T@%%uI_|Br6
?'g6yu
y>_2r^
Cn)$h#;
-SmT*
jXnH`rC
'\#]r=KT9
o7@=-SFK
@EV(w>
2dJvSh<
u(tcWI
_bHq)1$
p9"CFf
/eXMw;:8-.XV;
3z7~CZa
[=G/uT
@1!W_QJTI
Pm4;fp -3 <
?)*r~%`C
c<:DT5m
F'L}6`
Zo,'!Q*
m_]e$@rr
-~{8/a
E?&<&C
^2)nD98
YOrO?(
iq];?yfU\
lYcQ)'wztzuzH]wh
:N_*6nt}(
'O~@AZK
amKFbtSc"
9yrDSV
L\]$7:&1
W8}E:a@%&
PFKi7HS*me
frH>aV
BbtKfw2]
3'9\Z37
+/;ER-
6yu=<}F
)y:mlM
Q?(d8GF
AM-msi^<,
Qqf8(a
wZ[Yz
g)Z28b`^
g.b`C]B&:
F`"M%#
o.XaUpx
qAn%`FI
2A{m:.y
~[89`@pE
EQ:m7W|5
e)'e/_
6Ei2]._GhP
qqIanV
Y~%NwGNq3>HvDSsl
D$5!R
m_vs]J
)?lU17
z1>+FeVn
Rq=PSS
t!}F)
QAPkt\
YP6[/KK
~^lM1;
>y.JaF!
(g|IsMVb
_4S#&8NZQ/[m+`
1FY[\2vzH0.0Lkbq'
2LG3^p"C
=z^_>zb R`7eO
zn`%Bh
4-2CR
AguZY@
Hr2N-5dNAK4a
oHfE6aX=[Ow
B`S'nkn
]V_hHUxkx
o0:XdZ
x%n)+N
9(5P@qDH
}0ak^+"
Pc&:iuc
=1Z\U&
*QB5Y_ Xm39
o=(\s~b
8V'I5S
>4{4up(
xH.Xo"m
i@xl/.1#Af>
NS&WE0zWV
S+9j5B=^xF
ya6w/Gy
.F#9R\
Ak;H,Z
Lbevo|#<J!
*R4TuA,
'6.@o5O
=I#AFm
@*#]Ea
^v=1y3
_1l&,/
8\MmV;]\
W9XZ?i
0b*;Kw
(Flo8ZFYknjyU2;
!N4zb:
7$xM&R'fQ
!DVsJl
nLCxyC
G`A`&e
`Re1/Ca
Gu~n_M4}C
4MNZIi&
S]R2:
X*yWFg
IY;\Be))
FiYE}#
u]Q/QG
R=11)aIQ}F
SbA=L;g
uebJ})@d
H8Ij>Q?Bs
['5{ku
xcC!UP6
{13i:_P~
Ao`iTzJb
9Y_Jc<=
5S-j)Fo
\nF.#g
c3}|]91
j(K'~gl
>03sDbn<
R*j:XSj
\J>RE~J~D8W+%\
OSWSOvT~Lqi
t2aQ8Z
apK4.:
7+$5k
_fwX#CY[
1iJfjq.!T
uB;s)*
w*V49R
o^jpf&e
NqM/"aa]^2
z-LfM6
^]$ISe*Ns
sif0l7r)i
!#H]_wioxkO,bb7^N|J
]Q}H\,
0^q")X66BBV?":'#90
Aif6H9l$
.gUn@4
4}6q}kvViqd%
K!d23\
fVUMK;HNB
nk`2EN
Hwm|U_?
,=fMAUi
~[xSlu.JVv&a
Y`Bth 6w
y9A:|RdKvQx
b>x.UFQX
zZHTu;
W%5wvL
\-:VVWM}
+}d0=pz$%k"
@HK|9s]
J.&KTIN
~k(3d|h
tUEKt@4P1G
NE:%M5, 87M
WGL4MS
w(5FO$
Y;P3Bw\6
T/! ]s
E]t{h7xcw[
U1cif1
gIym~2/n-DDxgf
j^w@f
r2wqX;-_I3wh
#LP]Z>8
@POie'MY
a333LxwyOb3.
r8@$m"P,w
Gp"#42w'-i
:2scYzz
O )1G>eOL
s_CBuh
Fp14[|Ho0>;12
/{D;mr
cT{V:g
ly"'j8
WwS)$R$NC<Zc&
y1hV~X"
"syUF,
KKZ?dU[
~8$?@>H
=3_8B@l??)
+1$ToXx
blH*R,(
Of+n.a G0S e
qD-S_m
RyY+kj!ZxM
\Z)a0/ 86
?<AbW\g
iyH+}YH=
t;H2Ojr~mc$JkwW
k)7q!$s!
woFi6vjc
V]&I ;9]1<._>e.r|L2wf/
=;N!@uj6--jsFt
c?ZSX.A/T
wod<ib
YR<CoO*0W%5<)G
)aJCaph^_?
nTg9v=l
%S9BMbi
4c=tA
di} Ch^XqM
\*iaU\QU
eb%/lK}k
XBosX1-Z
G"qbQ2G
5v938!'I
h8s{MM$/
{\Ia\n+{TF;>=$0
30Me6jz
gNyj,Jb&8
MrL^|_*
f IWCEa
:qbL"(k<x}
B&vuFQfH;p:
RZwU6J-t
\hd:G8J
q<hPC8!,R
Gj6[5amCpRB2J
7'h`w_M
QYU;cRsj
"/f"i5C*5
b=d[h?
6-tbB*
k\SazVX
RU^;~;?quSK:q4Tt
Y"iT$J`
jyh^gX
4Pq[Yhsx%p0?o7#
+D PFxw
oB9]$.
_uS`JC{t&bs
kb|4/q@
}ZH&4IZW*z$l`p\94A
c&]m3P
1wf Fwqxa
igA7A#X
5*z))6
{@m.GUw[$&*Y!
=ukWb Jvm$\]D
g@Y}/Jx*3
]Dd6Rz
).v[n'N;!0O
>)A.=0k*6Z$\
t43S3fUBe
)+BDhz4
z=`,(E
Kbsw"e!+N
*1`#M@
5PSn:)D
e/N|pd
/O~?@;?]F0`K
QB)sS!zSB{{5|{;y
d/pKji
G.5.BB[
8)9xc~xAl
NRnt0,
?sAQ84gm^
TlZl65D
P*_@Cgn!Su
70IV3H#^
]G%z5G
{!Dj`:s0@O#19kQeJ
8fY:aHc|*<<d7NOf|
.cooqF)>
\R3w<z?B^
jXv#v;xWZ[18[}-
kBhhZ|*P
S7[{t,}#
r|m sVI}G8
9&6Ll(c
E;l7KeUD
5q&B**
G}u7Za"MD0
63,ZVu\
X">Kd!y*|
$< 0q:vX^VuL06B
ZW'Q.l5
<u #:-Cu
DF-"k.
c'<jil
E1=[5M
g?x0YZ?
],o|yvduXt
_\j&-Y$R
?xFQ|K
><!Vn$~8X5\qjB7
=4+4Ys
3yN<l/fw
.PfOaq}z*
M`_)B%m
hM+8fF$
T`3t"T?(w
ccU@gZAc
,1%3f1b
;a48\0M[12_
U:OOMaW;PKC
/j4a#/Fg
I=ocw&
E*F?ZA
tPSk10L0l$
U\4t(~c
Skou7m
+PwZ|m}KF5=0`9*
zJlQy"
Giu}}Ta}0VL!`Zt%z
&SE#7\99^JZ!1!Bfx
VOUo2N_Y!B
o|3fsq
Q *MxQnFnV-
B0EART'gl5Lp
t[m&/c2
hJHK>>=(
;Lo0x421
.]/EeS/%MT]?\0
W=+t#s'vDJb
Y&?B!wQ%gb25
H\'Elz
rx.*{;=_
5_~#|X"
4\~b1jj6:
pz058i2s`0
(huO)?
Ln/oK?reG
P&7:\<iXZW
&(/s>.
d+C]-YO
g*;5A_e{V\V&
,jv&bA
p,kNg8
,}V?\MI+[
N9VS-dD]
]_ON9^w&uCC
#8*L+>C-W1
J>NPJG&mlZc%00
Qmt&|Z6r/X[
A/`W#
/te/|3s*n
@gi{O"N:Q
W#d{@d+
4<MEdpk
0cDj<p
PIej2C~{y1
7D4Wy@73
~C`YZdllv
eI xtP5D}K~
lHWC|%
0$j$aJl&1
l.6LEx64-(:-
DRz hc.{
U"2dr"3
0?QR]o
avuCPM
|3|{7&
=IK[p.?[O
.pD"6-D
9yKBv(
xqX9o'r
Jzn~)#d%
m@|0z|SA@8
lpXL?N
uK7rY{
g>}:Tk
hbEq:$[
!K}uk(7"1oUYH
trk'bsK[J
/k~X(ax
}%]p4g,<lo_
.|GciRG`_ D^
[H2=nF?
79IOb'
{%Gp-z
$)@ewU
A^@W$"J
pc)rfA
~*>rjF
c-!kDC
k2`!K 8)qFSdD
{?E9"X
IJM)GP
4\5[[/y
#-dEj<
Vk-oIRUzlj:*Si>
)'BbSEF}ud[b]R6m4
WA6UlzCP:#
k?iV&g3}S^V.J`
7hK$C9|
(QfXOR
;Q/7kL
`wxncsVN
kUL eX;r&
~3iwJk
iUOhc?A
r.wU\mBXlV#}c>
/UvrQU
i>6bYT
=.oCe
{c; lB
V}u#yG
VIc=-Ocz
Q>)?ro{
_HxD;WT
Dr~@Hlt
D!=g\ZhIKmNYk9
u]RDdbz|[
i<e.rdgD[
omZ oSFSAX w``e
}8u]0)N
G}"#Y5)
cFT=QMXpn@j
HoIVsvKqr
`RR3vf%lU
:;=kHp
[GvG3$
ICg,,LE+
~zW@?,-)P>_%,
XKSG)Ms?6y
/;Gj2m!
27|/Q.Y
}>JNMf+
s%&Twf
pR4&n,
QOVs?5
l6{"G}
&EZJ:&&
iiIlLM
mzM-f@Z
u*Q=qJI
Ni(x`S
+h'4#z!
wZRB$4vp?
4;%zzo
,YoH+Rh
>b5H"]D
m/7EX}gv
>!#W//
Nv9 ZD
_7Di='KTdV\pYL
olP":_ubJ`z_'dC
DJuRA22FInDd
m)BAQ?{
Mvv0%8VJpI
bY;}zw
_G1#njwf
.&}-RJ`;r
>:nXXK
X~3~DP
YqeK.6m^YC
ISW2L)
6f|:@|5W;w[Vn
p/}}%tN
2N:(P@>0"C
3-b@A+k
u.i9y4/W#
nw[dMjd
.X*c[i
aJ:*bn]
>qu=T9
Ee6>!G%|Z7i
~Lp[KB
wA=!C`&=;
j#zR.ZJg/ML
O(,8$^@S
.XRG7 }
7\GvE&
$Ix}t/E:=3sR
u\t^oCqo=
9#}$p~L
Drric!(a=
iO2n&b%/u xq@i
[v 3sTYSJY$>
sEEdM/+rQ*,e}h5
r{1:3{
\Zy;4E
VXq@sn
{AaHT}j
X"-.f"F
2Xpjw{
Gs|N$={
kn\x&x|O
_E\od=
?ZcMa}
hFbh&E
1&A*>kWgRACv]
H:KR5s|]:p
3ZP}-m@'
I@J+%ZFu9WV16t
n $s@[Z=
w[.v)IO
/nS5Y]?
29#TTVGv![
|S/?*3%
5`dl=[R}D,
?;[M-!^pHL
ii_JAn6Jg/^Re9
&TRlkW|dZt|.,U@TxrSy
18xb<W?tX
Z<(t$'_]9
40RNl=,z
|.>@\J>
0Omwuz
GK U7!Uy1
Nno^jH
x-<AOo=,.}x
AaUYVyp
7Yeu[Mia$
sK$_O$qp"
7^*=YUB<#:
j;<qh
!!?MEf$
+kNHgGi
~[$Xo\
pEnP (
Ma>w,#
Q)L)$&Qi_u{K
/l`]kZ.B
"a{\5/}"r$`
28,^!
)aYj/&
Roiu^:O
D8=q&s
wtwr)0-+*s
K1 Box
k/rzJS^<{
ZEToD6i-7
(ki\K3M
%;UW.YF2wv
VyC@x'Pl
^D\\UnXc*
?R6JMMH
W1o%*T#
?k{}8Zm
Hm#9"]R
8NxQih(
*Q"D[<@l
b#1Q'a9
o{E:OSFIQ^N&j=kDO_
5;}Pr%Z
aJ"h-[
dOpbS9/^Ax
T"@Na&:
Jog07
-[(EGqw
$IZ `*
t#uB%mWwa2Oj@m
<k.qhC,Rkq [
-3EM_6Gi?x
Y0gA|&
]lP_[U
5YeikO%tx
15Ai\]!tZ
5#U&9<%2LLX.tk40
+)8W}w
5|N#`u]
Q]5XQ[
GN}+0C&LX
iaQ%GnWN`qn`:
'T3b/rO"
7cT%fl
"h;"=
mm@R@ZE o
b5*1'9
=t@%A@+_)6V&2V1p_S*^"Zse
#)u{X%(
~g@4q.
{S*BEQ^OJ
SeG-w4<C
mE,{F&m;8UW
&D85l<
Rg$fOj@4;jK
3_+(Ne
F!)-1kEIF-]hE@
9@K%"Rt
2h i!<B
Ig?Mm%
WWh"O{YcA
7$<Z~3
P{C5p#
h_q,Le0v(TfDt
b1~Kf
D^cFKesQ,
F&f`Hg
(5@+|v
W(C9FwI
63*jyC
rI].>"
w_#y]uH2
a/D!xV~Lz
KF$jyrm;gvu/q
xORi&ax4?8_^
b5/y{|&^2
'[I?X>Uc
1\;Q{`!$Hq<:
Opw7^[$j2e
zV"z(O
]Ib8wT
0!OT-f6
4kR%s"2@,
3{~;+6`
/2HdFP
.nH[>
xI'X>R^#W{
?YWt^<'
hdpArTQntvCU2tCf
1J15S{Cv^Z<q,oG
r%Ff&lD0*GKv55?vN;
-~&<fa@(AK
4R@^-Ws
AFt?aoS~
_6*O|L
K>VY}K
Gqihf;
G~w/l\
`mB}Ty
-*K]a]]erb7
84cmPWU|[E0d
"S)7FqlX$CO
JSO@ .<1i
p9hj`8
u1L*{3Vkm
tE-7X.{m
A~.OM5@3
B?Wv ;
ADwc6U
R+*\:{"
ebo@yEr6
*1?a.aR{c$(R
$4o&+?h
<u/I#^
QTvFXMRf\o
7qSR0p
{=!"1czjP
4mPaza
+CWIN4"Cefu1
6D$SO,
_eo$6BoE
YgmfAz
9O:k=NW3oOT
99(U+p
Ia@S-q
:E$DA#3
{5Oet"
O"# K5"1@|z
CS/[$X*
a[Q(B!U
e!!5GFrW'y}$
GSnlc]U$!+ aUIH
vd^QQ`|l
Pb.gJqdFhE[Qn+$k*sr
yleKwE+;[?>
G99}[M
&oa$emB
G6+~Wil
hA"-O#pK?g$3jXaI
<9Nm@UuCc^,
y{n,SKJOD}
b]k$|K|
{VrWhyL
qp8b&J
\%Hp@}o87
Ry*%FO@;S5H
=jnxu+
(wEQ6{
T1EHM2
vg<tl$19
f*s.\w
.'V>I=
n1l't!
&%=DK'
+*9Kfw
XLyDstP!Y([/
sfm9^F
Ht0a8p0
~8B^5cz\
T,+d#gs0
7,C<]9YbNq
>:G{4`
[,.n0~O1JyXnn
NOjnT/s>l
>2[D^N
3J@)&@5'
^|=#kw*PO
r?9O_gE}
~'QO;*y[@b
98{dyIfco|8@Xu
L"`'{ S'Qp?K
{tf@ADdfJv
>~S%dc]!HJ3E
P~U,b:n=t+
u==cq6r
dP2eyk
U/=YI;|
Z+P'3X0n3Y2"
13^q7X|wy-i.
'@lph{
)CDgVQ'(X
Y&SHj%Wz
]qUIMm
6X,A[<B2 2
4H\FvB5QX$P
PqB{E_EDk|
8i+nyc6_*.
E8%9;2>,
5NHoQn
&tvyNG
Uh$S`m[>
/lc~y(+3,
pz<aaN8JJ
b`h]KCo.(
:Zj/+j|
LLY+lz{T
!R}d)-
ccQ^`\
^7'_sPG,3N
[X9Zeb"^v
.JM%It
tVTFV,b
.H^;Qx
.3Ve2R];
0CUE2FgrP
aYqntvsIkiA
+W-fB,
2-"Eoo5_<&q
>B<UT#G
uQ;V@Fk
\9^D?slL3eS
^a#(nw
+mkAKlx;
9`VNV9$4
%z!}w9al
HnAzHr,_
|Cvz%H
MhD|ZiSAkc
`-bk7,=@
qsxWsh)"e
6{@v.D
Cv?b)|
]2LLe3.u
c:vi<g;
P-aB-6v;
/hOf#-
Hp'Gw<+V]O}]
|Oo(po3@/
|f[?I,,/x
%y@|k.{
D:+Osv#6I
/"5\>@_'3
D(Qy};#-)
^ur@1&O~
0,Qy?\*+
D^,!v(
N5Kcd Uhk
:H.HlIPDv6g
P+cz?THK
K<p5B1
o|*@AV7ki
`LvIr:Fy
jC)-3a^U(W_.
ppn'=
SOsb4;s=-
uVMGkcpnKl
A]m/&f$
-O&V:4mBrPJc$Pvoc`
^hrv}%(qKil
xTebdA
o789BD6
M~ M-AV~~
="*lGU
p[&*mm
ALD'L wvd
;fP35)
[%I86OPF
%me\-~
>&i0)XC
@x*a>g
oQPz.!}f/
qn61DSW
lrcET)<g8.X^;
U{9%4[{?~
f:d7$K
\LWA5?1(h
bu(I1 2%r
'^poDS
g%wLrpby+
O{t57JgTu7<~pP
INX4iMsC
>`8MDndhh
dFy*9_lOeV
ygB;;Q!yi
YI`vWmO
m.\"~j/
JnKuj@XG7j]
Y`Dd]p)|
G5r`D?
^_Rd1hAXM
'@2|Rh
;Y?Xq*\~
d$D;-o
6$3s<[.
]b0n^j
uxJ4=Apr
kr:5p9sK;
SH^Cv'
1j^C1/>?
>4zi:V||
.@Uh(7_
F*jU2!3B'Cy
D)NO\|
my+hC\pfx)m
>NpvoE
X+OMY;)aIA&E
H_113`
{C^:9D9
[gf:r9r2U
`]xXhL;<0
B(Q4p;!f_;v.XPUnC&
FUJ\KY3lS,
x8fS_:
ciL,:7
R&p|P!g
27YT'R1
93{STFiY
OdRP%n:{
@5"./B
R'p}e7
N=Ih,z
wm0-4|At
)Cte%M
%bxm~QmtT
`yoKmluF$
2?6}K]YcnAER
oy<c6!
ohuF^Y|9
m,lW:{
.;5C][0x
5pB_/l
fb^ 7q
Kq+ O=7IJ$ZR
\>^np9P
NV,f5E
s*2k+U+u{K(Iw
c4v81IMJ
Lzvo+dS=(E^G
Xyj:PoMvP<
F7iT*(-
S>(,"x
#4O[z;#
&R.?JJR.T
E"zP(>U
~@AD(f
]#^3e&3'5d
P%~2LZ
}A=[&u*
xRjI}G
!=JQU<
c9GU|IP5
x>PMOE)HR
fl!Nu3
2t-'KR
pB._]1
Ca`6XE
C\mR@oP(
G 2LsP}wa
Q}7S`S
!x~9&z
%Rk2 :K
SFj%"ke5Yo7
{yc&=y3
mHL{ iL
(9$:'<*
LVOI'd?uV
QwIcs>DK_k?M
x}2U}%Je
.[g=z',An$
Ze=FzTzvSzgQ
tz-)vz
[c<V%7
l!3@puF@j:
b~kszZ-zQ?.
/Gf(Q>Db.
`4``Z]
Ag*snc
#N}3T7c,
5co)1rVq
#AP&=2_c
#g-"T,0yp
zaN*pn
M5X8L#yJ
{R9S21[p
o36*;@uy{E
~nNi4S
?-io;+
FTQ<9b
.fM>-a
e CuQ9-m
D{<%U^1@
1^BhWA
wTqtTfqd>
dF~CYB
hhk\Ef2)$B2qWXP
$;h`Qo<Z$B}DZ
[v[PF1
@#.~fTV
%@<><`h
VzzLXIDO
?Wos*\So_
KfZ"#
IQC&Q*k4<y
I=l}ebI_6
V*E$YZG
}RlxQP
iE[ei]_ih6H
v8>z!
phZ;xKop
Q~7}N.
UR.e~T
s[zc]hKAIDD6\
"1Py>@
BmANTE
f;eP+ <
e tQ+m
dnSlou
}'T;Q4E
@HNOUZ;,V:}
0x`q\g
^>#NPOIv(z7*#
Ksyz_*Biu
Qk.glS>`
?P}DQp:
dj=(PJC{2~n
*]:uYx}f6=pFNWm
Q_@\u4"u
lH@04wYb:-Y_QlvV
X(pIW;p0
u1jwn)
uSu`I7
-cr(7!1T]5>nCg
"Fxrr@-+$
nZ|V)om%
lnr&_b
F::F\NBD
Z7S Jf
A! aGEv[
#S2~_!
m9=:jW,
hH)%1o
UvC6go
ow|hhfj
Q6E'}h{b
)_\7o
=+J7X[UO/Wrm
>6OH0n
|B5mk[
Cy5ky~Z
u!~kF#
Km)H\i'
lY57 ]
Y$GOF:D
Qo^P)Kes.'
#Ypjq A
L6u.OzlsrV
~UE='G
eLX&Z#]x
VFM/?O?.
@/q7c9?dB:
o3,N |
B<js(cr
X-.S(z8[
`EEy)d
kk;e"|yQX7
3Aj.HP
%9/X%p
CZfH(.'
N9$_1!,
KcQ[A8}
AQfXL-
pofsE`
vpdO:R9^
4Fg5yfbXe
q)f]I)5tiMI
`W=>u }
o|3u/o
?Ha&pjKn
gz\rQR&
[JO)cO
Hh;4$x
L"I^o6C
EH<zFWW_
2}TXjx\
c|`>;PmF
ZJ.H1=
"A5zNvB.gF?$96
4t\<xiF6?SQ8
2ps;:rue
0}yo$pK\VB
d';#y%
$ =MU{;uDTJ$v
aI^LL]
?UHHOSp
~!D`trP
B6gU[>A3
XoN>(g'~7`X$
PRfDUIN\
ky/B$
*%=1)8f%
lUwB#[,^3
01bCbV6
ssp1],sW
;=UJTxCX
nzo"&-3S6&
5M?V>h
6q*\:J=
_vg<]R
k-Wxr(
`Kmpm{_
^cv8Z)XS
x\d9:x
a&GisC
&668J1gGd{$
!g~<2[lKD $8*
//GeKY.
D9YX:S]
49.gC.S
"*LSU
;pxgHuB
M3PtIn
}J<*KqB
&\H[VusvHLkLh"
G0~diU
g%I=gI(K.4Iz'
d7GY4R
+m}2-l
;Z^UluOQ"^G
3$}fAwO
ZN\_*>kHa
8&+Uz'Jvfa4_vt*Qh
4fM91DB
TNoOgT
%)J9Q
SJL%/-ujaV~<Y
9x|;~=3
\v.Epia
-ub)?Dxh
Q"4(cjt
DwMgw`f7CuksU
J@NU6d
f_p[2kV
>Ss=yF
))e`Zf
UcX,nho
?aUo,l
en You need Microsoft Windows operating system in order to view this page.
Microsoft Windows
Microsoft Windows
dk Du har brug for Microsoft Windows-operativsystem, for at se denne side.
ee Sa pead Microsoft Windows operatsioonis
steemi, et seda lehek
lge vaadata.
it Avete bisogno di sistema operativo Microsoft Windows, al fine di visualizzare questa pagina.
fr Vous avez besoin de syst
me d'exploitation Windows afin d'afficher cette page.
es Usted necesita el sistema operativo Microsoft Windows para poder ver esta p
lv Jums nepiecie
ams Microsoft Windows oper
mu, lai skat
o lapu.
pl Musisz systemu operacyjnego Microsoft Windows w celu przegl
dania tej strony.
de Sie m
ssen Microsoft Windows-Betriebssystem, um diese Seite zu betrachten.
lt Jums reikalinga Microsoft Windows operacin
sistema, kad galetum
te per
puslap
Microsoft
no Du trenger Microsofts Windows operativsystem for
se denne siden.
za Jy moet Microsoft Windows-bedryfstelsel met die oog op hierdie bladsy te sien.
r duit Microsoft c
ras oibri
in Windows chun f
achaint an leathanach seo.
Microsoft
cz Pot
ebujete opera
m Microsoft Windows, aby bylo zobrazen
to str
nky .,
536$Fe
635/(E'6333320100101|
0123456789abcdef
(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U(<U
3FY';T';T';TAP^
3FY';T';T';TAP^
1:hello
3:how are you
4:hello again
10:you skype version is old
11:what are you?
12:from where are you?
13:what are you doing in my contacts?
20:as I said %s
21:so %s
22:%s :D
23:look %s
24:here %s
30:so what do you think?
110:what is in that link on your skype?
111:do you have camera on skype?
112:is it really your web site?
120:what do you think about that?
121:what is there?
160:pudge women ;)
161:piece of shit
now everyone know ;)
162:idiot
what are you doing
163:crazy bitch
170:why dont you speak
180:I saw you photo. I would like to speak with you
181:I saw you last week. I would like to speak with you
182:I watching you long time. I would like to speak with you
190:%s
I know what you did
191:%s :D :D :D
idiot name
200:i lost my job..
i am idiot..
i want to die..
201:(beer)
210:nice ass :*
muhahahaaahaha
211:little boy :]]]]
I know about your little problem :D
212:gay
213:what new?
214:what the fuck is that ?
215:bad news
220:dude
221:bitch
222:niger
223:impotent
1: Hallo
2: hallo
3: Wie geht es Ihnen
4: Hallo wieder
10: Sie Skype-Version ist alt
11: was bist du?
12: Von wo bist du?
13: Was machst du in meine Kontakte?
20: wie ich schon sagte%s
21: so%s
22:%s: D
23: siehe%s
24: hier%s
30: so what do you think?
110: Was ist in diesem Link auf Ihrer Skype?
111: Haben Sie Kamera auf Skype?
112: Ist es wirklich Ihre Website?
120: Was denken Sie dar
121: was ist da?
160: pudge Frauen;)
161: piece of shit
DU BIST NUN alle wissen;)
162: Idiot
what machst du
163: crazy bitch
170: why dont you speak
180: Ich habe dich Foto. Ich m
chte mit Ihnen sprechen
181: Ich habe Sie letzte Woche. Ich m
chte mit Ihnen sprechen
182: Ich beobachte dich lange. Ich m
chte mit Ihnen sprechen
190: %s
I wissen, was Sie nicht
191: %s: D: D: D
idiot name
200: ich meinen Job verloren ..
ich bin Idiot ..
ich wollen .. die
201: (Bier)
210: nice ass :*
muhahahaaahaha
211: kleiner Junge :]]]]
ber Ihr kleines Problem: D
212: Homosexuell
213: was ist neu?
214: Was zum Teufel ist das?
215: schlechte Nachrichten
220: dude
221: H
222: niger
223: impotent
1:Hello
Skype
22:%s:D
Skype?
Skype?
nwhat
163:Crazy
170:Why Dont
190:%s
191:%s:D:D:D
nidiot
210:Nice
nmuhahahaaahaha
:]]]]
1:hello
3:Cum te
4:hello din nou
10:tu Skype versiune este veche
11:Ce esti tu?
12:de unde esti?
13:Ce faci
n contactele mele?
20:dup
cum am spus %s
22: %s:D
23:uite %s
24:aici %s
30:so ce crezi?
110:ceea ce este
n care se leag
pe Skype dvs.?
111:Ai aparat de fotografiat pe Skype?
112:este cu adevarat site-ul dvs. de web?
120:Ce crezi despre asta?
121:Ce este acolo?
160:femei Pudge;)
161:bucata de rahat
tie toat
lumea;)
162:idiot
what faci
ea nebun
170:de ce dont you speak
180:Te-am v
zut fotografia. A
dori s
vorbesc cu tine
181:Te-am v
na trecut
dori s
vorbesc cu tine
182:Eu cu ochii pe tine de mult timp. A
dori s
vorbesc cu tine
190: %s
tiu ce ai f
191: %s:D:D:D
ume nidiot
200:Mi-am pierdut .. meu loc de munc
i AM .. idiot
i vreau s
mor ..
201:(bere)
210:nice ass:*
muhahahaaahaha
211:baietelul :]]]]
I stiti despre problema ta mai mici:D
212:gay
213:ce noi?
214:ce naiba e asta?
215:vesti proaste
220:imbecil
222:Niger
223:impotent
1:Hello
Skype
22:%s :D
Skype?
Skype?
163:Crazy
170:Why Dont
190:%s
191:%s :D:D:D
idiot
210:Nice
muhahahaaahaha
:]]]]
1:hello
2:hej
3:Hvordan har du
4:Hej igen
10:du skype version er gammel
11:hvad er du?
12:fra hvor er du?
13:Hvad laver du i mine kontakter?
20:Som jeg sagde %s
21:for %s
22:%s :D
23:se %s
24:her %s
hvad tror du?
110:Hvad er i denne link p
din Skype?
111:Har du kamera p
Skype?
112:Er det virkelig din hjemmeside?
120:Hvad synes du om det?
121:Hvad er der?
160:pudge kvinder;)
161:lortespand
now alle know;)
162:idiot
what laver du
163:crazy bitch
170:Hvorfor dont you speak
180:Jeg s
dig foto. Jeg vil gerne tale med dig
181:Jeg s
dig i sidste uge. Jeg vil gerne tale med dig
182:Jeg ser dig lang tid. Jeg vil gerne tale med dig
190:%s
I vide, hvad du gjorde
191:%s :D:D:D
idiot navn
200:Jeg har mistet mit job ..
i er idiot ..
nsker at d
210:nice ass:*
muhahahaaahaha
211:lille dreng :]]]]
I vide om dit lille problem:D
212:gay
213:Hvad nyt?
214:Hvad fanden er det?
rlige nyheder
222:Niger
223:impotent
1:Hello
3:how are you
4:hello again
10:ty stara wersja Skype
11:What are you?
d jeste
13:co ty robisz w moich kontakt
20:jak powiedzia
em %s
21:so %s
22:%s D:
23:wygl
24:tutaj %s
30:so what do you think?
110:co jest w tym linku na skype?
111:masz aparat na skype?
112:czy to naprawd
swojej witrynie internetowej?
120:co o tym my
lisz?
121:co tam jest?
160:kobiety niski grubas;)
161:piece of shit
now wszyscy wiedz
162:idiota
what robisz
163:crazy bitch
170:dlaczego dont you speak
180:Widzia
cia. Chcia
z tob
181:Widzia
w zesz
ym tygodniu. Chcia
z tob
182:I watching you d
ugo. Chcia
z tob
190:%s
I know what you did
191:%s :D:D:D
idiot name
200:I lost my job ..
i jestem idiot
i chce umiera
201:(piwo)
210:nice ass:*
muhahahaaahaha
211:ma
opiec :]]]]
o swoim ma
y problem:D
212:gej
213:Co nowego?
214:what the fuck is that?
215:bad news
220:kretyn
221:suka
222:Niger
223:bezsilny
1:ciao
3:come stai
4:ciao di nuovo
10:si
vecchia versione di skype
11:Che cosa sei?
12:da dove sei?
13:cosa stai facendo nei miei contatti?
20:come dicevo %s
21:cos
22:%s :D
23:look %s
24:qui %s
30:Che cosa ne pensi?
110:ci
in questo link sul vostro Skype?
111:non si dispone di fotocamera su Skype?
davvero il tuo sito web?
120:cosa ne pensi?
121:che cosa c'
160:le donne pudge;)
161:pezzo di merda
tutti nnow sapere;)
162:idiot
what stai facendo
163:cagna crazy
170:Perch
non si parla
180:ti ho visto foto. Vorrei parlare con voi
181:ti ho visto la settimana scorsa. Vorrei parlare con voi
182:I watching you tempo. Vorrei parlare con voi
190:%s
I sapere che cosa avete fatto
191:%s :D:D:D
ome nidiot
200:Ho perso il mio posto di lavoro ..
i am .. idiota
i voglio morire ..
201:(birra)
210:bel culo:*
muhahahaaahaha
211:piccolo :]]]]
I sapere sul vostro piccolo problema:D
212:gay
213:che cosa di nuovo?
214:Che cazzo
215:le cattive notizie
220:imbecille
221:cagna
222:niger
223:impotente
1:hello
3:how are you
4:sveiki atkal
10:tu skype versija ir vecs
11:what are you?
12:no kurienes j
s esat?
13:Ko j
kontaktus?
jau teicu %s
21:to %s
22:%s :D
23:skat
ties %s
eit %s
30:so what do you think?
110:kas ir
s saiti uz savu skype?
111:Vai jums ir kamera ar skype?
112:tas tie
m ir j
jas lap
120:Ko j
jat par
121:kas ir tur?
160:resnis sievietes;)
161:gabals shit
now visiem zin
162:idiots
what are you doing
163:crazy bitch
c dont you speak
180:es redz
ju tevi foto. Es grib
tu run
t ar jums,
181:es redz
ju tevi pag
. Es grib
tu run
t ar jums,
182:es tevi ilgi. Es grib
tu run
t ar jums,
190:%s
t, ko j
191:%s :D:D:D
idiot nosaukums
200:Es pazaud
ju savu darbu ..
i esmu idiots ..
i gribu mirt ..
201:(alus)
210:nice ass:*
muhahahaaahaha
211:mazs z
ns :]]]]
t par savu nedaudz probl
212:gay
213:kas jauns?
214:kas fuck is that?
215:bad news
220:idiots
221:kuce
222:niger
223:impotents
1:Bonjour
2:salut
3:Comment vous
4:Bonjour
nouveau
10:vous Skype version est ancienne
11:What are you?
12:d'o
tes-vous?
13:Que fais-tu dans mes contacts?
20:comme je le disais %s
21:si %s
22:%s :D
23:Rechercher %s
24:ici %s
30:Que pensez-vous?
110:ce qui est dans ce lien sur votre skype?
111:avez-vous cam
ra sur skype?
112:il est vraiment votre site web?
120:Que pensez-vous de cela?
121:ce qui est l
160:femmes pudge;)
161:piece of shit
Everyone nMAINTENANT know;)
162:idiot
what que tu fais
163:crazy bitch
170:Pourquoi ne vous parlez
180:J'ai vu votre photo. Je voudrais parler avec vous
181:Je vous ai vu la semaine derni
re. Je voudrais parler avec vous
182:Je vous surveille depuis longtemps. Je voudrais parler avec vous
190:%s
I savoir ce que vous ne
191:%s :D:D:D
om nidiot
200:j'ai perdu mon emploi ..
i suis idiot ..
i envie de mourir ..
201:(bi
210:ass nice:*
muhahahaaahaha
211:petit gar
on :]]]]
I savoir sur votre petit probl
212:n gay
213:quelles nouvelles?
214:what the fuck is that?
215:mauvaises nouvelles
220:imb
221:bitch
222:Niger
223:impuissante
1:hello
3:conas t
4:hello again
10:Skype t
seanleagan
11:cad at
it a bhfuil t
13:cad at
anamh agat i mo teagmh
20:mar a d
21:amhlaidh %s
22:%s :D
S 23:% breathn
S 24:anseo%
30:sin an m
id a dh
anaimid a cheapann t
110:a bhfuil sa nasc at
ar do Skype?
111:An bhfuil t
ceamara ar Skype?
112:Is
bhachta
ar do l
in seo?
120:cad a dh
anann a cheapann t
faoi sin?
121:cad is ann?
160:mn
pudge;)
osa cac
now gach duine a fhios;)
162:leathcheann
what t
anamh
163:bitch d
sachtach
th dont labhra
180:chonaic m
grianghraf agat. Ba mhaith liom labhairt leat
181:chonaic m
an tseachtain seo caite. Ba liom labhairt leat
182:faire I am agat le fada. Ba mhaith liom labhairt leat
Fhios 190:%s
I cad a rinne t
191:%s :D:D:D ainm nidiot
200:Chaill m
mo phost ..
n ni .. leathcheann
i mian le b
201:(beoir)
210:asal deas:*
muhahahaaahaha
211:buachaill beag :]]]]
I eolas faoi do fhadhb beag:D
212:aerach
213:cad nua?
214:Is
an rud go fuck?
215:nuacht lochtach
220:imbecile
221:bitch
222:niger
223:impotent
1:hello
3:ako sa m
4:Hello again
10:ste skype verzia je star
o ste vy?
12:odkia
te v mojich kontaktov?
20:Ako som povedal %s
21:tak %s
22:%s :D
23:pozrite %s
24:tu %s
30:tak
o mysl
110:to,
o je v tom odkazu na va
ich skype?
te kameru na skype?
112:je to naozaj va
e webov
120:co si o tom mysl
o je tam?
160:Pudge
eny;)
161:sr
etci vedia;)
162:idiot
What rob
163:crazy bitch
170:Pre
o dont hovor
180:Videl som v
s fotku. R
d by som s tebou hovori
181:Videl som v
s minul
d by som s tebou hovori
182:Ja v
s sleduj
dlho. R
d by som s tebou hovori
190:%s
I vedie
o si urobil
191:%s :D:D:D
idiot meno
200:Pri
iel som o pr
cu ..
u som idiot ..
u chcem umrie
201:(pivo)
210:pekn
zadok:*
muhahahaaahaha
211:mal
chlapec :]]]]
I vedie
o svojom mal
probl
212:gay
o to sakra je?
215:bad news
220:imbecil
221:fena
222:niger
223:nemohouc
1:Sveikas
2:Sveika
3:labas
4:labutis
sa kaip matau
11:suteiksi man d
iaugsmo
kur tu
ia atsiradai?
tu darai mano kontaktuose?
20:kaip sakiau %s
21:taip %s
22:%s :D
k %s
ia %s
30:tai ka manai ?
110:tai kur
iandien?
111:pagarbos matau truksta idiote
112:ar cia tavo puslapis? kad ant skypo uzsidejai
120:ka veiki?
121:Kas ten?
160:visgi matosi tos kojos
do gabale
dabar visi jau
ino ;)
162:idiote
ka dabar darai
163:nezinau net ka daryt dabar..
170:ko ne
neki?
180:reiktu truputi pagalbos i
181:Stebiu tave jau kuris laikas. Ir vat kame esme
182:nepatikesi kas nusi
190:%s
inau, k
padarei
191:%s :D
blogiau nebuna taip?
200:ar tu visai nu
okai nuo proto?
201:(beer)
210:ar
211:lenkiu
emai galva pries tave
pagarba.
212:as
vergas
OK ? :)
213:tau viskas gerai?????
214:tai tu
ia tas klounas
215:blogos naujienos..
220:imbicile
221:kale
222:sp
k kuris i
musu debilas?
223:su galva viskas gerai?
1:Hola
mo est
4:Hola de nuevo
10:que la versi
n de Skype es viejo
eres?
nde es usted?
s haciendo en mis contactos?
20:como he dicho %s
21:para %s
22:%s :D
23:%s mirada
24:aqu
30:Entonces,
te parece?
110:lo que es en ese enlace en su Skype?
tiene la c
mara en Skype?
es realmente su sitio web?
piensa usted de eso?
hay?
160:las mujeres Gordo;)
161:pedazo de mierda
now todo el mundo sabe;)
162:idiota
what est
s haciendo
163:perra loca
Por qu
no hablas
180:te vi la foto. Me gustar
a hablar con usted
181:te vi la semana pasada. Me gustar
a hablar con usted
182:I observando mucho tiempo. Me gustar
a hablar con usted
190:%s
i sabes lo que hiciste
191:%s :D:D:D
ombre de nidiot
200:He perdido mi trabajo ..
i soy idiota ..
i quiero morir ..
201:(cerveza)
210:bonito culo:*
muhahahaaahaha
211:peque
o :]]]]
i saber acerca de su peque
o problema:D
212:gay
213:lo nuevo?
carajo es eso?
215:malas noticias
220:imb
221:perra
223:impotente
1:hello
2:hei
3:Hvordan er du
4:Hei igjen
10:Du skype versjonen er gammel
11:Hva er du?
12:hvor er du?
13:Hva gj
r du i mine kontakter?
20:som jeg sa %s
22:%s :D
23:se %s
24:her %s
hva tror du?
110:hva er i s
koblingen p
skype din?
111:Har du kamera p
skype?
112:er det virkelig din hjemmeside?
120:hva synes du om det?
121:hva er det?
160:pudge kvinner;)
161:dritt
now alle vet;)
162:idiot
what gj
163:crazy bitch
170:hvorfor dont speak du
180:Jeg s
deg bilde. Jeg vil gjerne snakke med deg
181:Jeg s
deg i forrige uke. Jeg vil gjerne snakke med deg
182:Jeg ser p
deg lenge. Jeg vil gjerne snakke med deg
190:%s
i vet hva du gjorde
191:%s :D:D:D
idiot navn
200:Jeg mistet jobben min ..
i am idiot ..
i vil d
210:nice ass:*
muhahahaaahaha
211:liten gutt :]]]]
i vite om ditt lille problem:D
212:gay
213:hvilke nye?
214:hva faen er det?
rlige nyheter
220:imbecile
221:bitch
222:Niger
223:impotent
1:Tere
3:how are you
4:tere taas
10:te Skype versioon on vana
11:Mis sa oled?
12:kust te olete?
13:mida sa teed minu kontaktid?
20:nagu ma
tlesin %s
21:nii %s
22:%s :D
23:vaata %s
24:here %s
30:Mis sa arvad?
110:Mis on selle lingi Skype?
111:Kas Teil on kaamera, Skype?
112:Kas t
esti on saidil?
120:Mida sa sellest arvad?
121:Mis on?
160:pudge naised;)
161:sitakott
igile teada;)
162:idioot
what sa teed
163:hull lits
170:Why dont you speak
180:Ma n
gin sind foto. Tahaksin r
kida teile
181:Ma n
gin sind eelmisel n
dalal. Tahaksin r
kida teile
182:I watching you kaua. Tahaksin r
kida teile
190:%s
I tean, mida sa ei
191:%s :D:D:D
idiot nimi
200:ma kaotasin t
i olen idioot ..
i taha surra ..
210:nice ass:*
muhahahaaahaha
ike poiss :]]]]
I teadma oma v
ike probleem:D
212:gay
213:Mis uudist?
214:Mis kurat see on?
215:halbu uudiseid
220:Loll
221:emane
222:Nigeris
223:impotent
1:hello
2:hej
3:how are you
4:Hej igen
10:du Skype version
r gammal
11:vad
r du?
12:varifr
r du?
13:Vad g
r du i mina kontakter?
20:Som jag sa %s
21:so %s
22:%s :D
23:look %s
r %s
30:so what do you think?
110:Vad finns i den l
din Skype?
111:Har du kameran p
Skype?
r det verkligen din webbplats?
120:Vad tycker du om det?
121:Vad
r det?
160:pudge kvinnor;)
161:piece of shit
now alla vet;)
162:idiot
what g
163:crazy bitch
170:Why dont you speak
180:Jag s
g dig foto. Jag skulle vilja tala med dig
181:Jag s
g dig f
rra veckan. Jag skulle vilja tala med dig
182:Jag ser dig l
nge. Jag skulle vilja tala med dig
190:%s
I vet vad du gjorde
191:%s :D:D:D
idiot namn
200:Jag f
rlorade mitt jobb ..
r idiot ..
i vill d
210:nice ass:*
muhahahaaahaha
211:pojke :]]]]
I veta om din lilla problem:D
212:gay
213:vilka nya?
214:vad fan
r det?
liga nyheter
220:imbecill
221:bitch
222:Niger
223:impotent
1:hello
3:jak se m
4:Hello again
10:jste skype verze je star
11:Co jste vy?
12:odkud jsi?
13:Co d
te v m
ch kontakt
20:Jak jsem
ekl %s
21:tak %s
22:%s :D
23:pod
vejte %s
24:zde %s
30:tak co mysl
110:to, co je v tom odkazu na va
ich skype?
te kameru na skype?
112:je to opravdu va
e webov
120:co si o tom mysl
121:Co je tam?
160:pudge
eny;)
161:sr
ichni v
162:idiot
what d
163:crazy bitch
170:Pro
dont mluv
180:Vid
l jsem v
s fotku. R
d bych s tebou mluvit
181:Vid
l jsem v
s minul
den. R
d bych s tebou mluvit
s sleduj
dlouho. R
d bych s tebou mluvit
190:%s
t, co jsi ud
191:%s :D:D:D
idiot jm
el jsem o pr
ci ..
i jsem idiot ..
i chci um
201:(pivo)
210:hezk
zadek:*
muhahahaaahaha
211:mal
chlapec :]]]]
t o sv
probl
212:gay
213:Co nov
214:Co to sakra je?
215:bad news
220:imbecil
221:fena
222:niger
223:nemohouc
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
eeeeeeeeeeeeeee}
eeeffffffffffffffffffffffffffffffffffff
Ix@oGAkU'9p|B
~QCv)/&D(
uuvHMXB
9;5SM]=];Z] T7aZ%]g']
?Zd;On
7?3=Bz
;1az?aUY~S|
D?$?9'
*?}d|FU>c{
zc%C1<!8G
u7.:3q
#2IZ9W
,%I-64OSk%Y
AAAAAAAAAAAAAU
(null)
((((( H
h(((( H
H

Process Tree


072f42c8d2ce79055c1617ee30f0754c054819dc3d0d925411a3628f5b65380c.exe, PID: 2060, Parent PID: 2996

default registry file network process services synchronisation iexplore office pdf

zhkuzlr.exe, PID: 1464, Parent PID: 2060

default registry file network process services synchronisation iexplore office pdf

zhkuzlr.exe, PID: 1600, Parent PID: 2060

default registry file network process services synchronisation iexplore office pdf

TCP

Source Source Port Destination Destination Port
185.42.173.103 21 192.168.56.101 49174
192.168.56.101 49170 172.67.155.175 www.showmyipaddress.com 80
192.168.56.101 49171 172.67.155.175 www.showmyipaddress.com 80
192.168.56.101 49174 104.27.206.92 www.whatismyip.com 80
192.168.56.101 49177 104.19.222.79 whatismyipaddress.com 80
192.168.56.101 49179 104.27.206.92 www.whatismyip.com 80
192.168.56.101 49180 172.67.155.175 www.showmyipaddress.com 80
192.168.56.101 49183 104.27.206.92 www.whatismyip.com 80
192.168.56.101 49185 104.19.222.79 whatismyipaddress.com 80
192.168.56.101 49186 104.27.206.92 www.whatismyip.com 80
192.168.56.101 49189 104.19.222.79 whatismyipaddress.com 80
192.168.56.101 49190 172.67.155.175 www.showmyipaddress.com 80
192.168.56.101 49191 172.67.155.175 www.showmyipaddress.com 80
192.168.56.101 49192 34.111.176.156 www.myspace.com 80
192.168.56.101 49193 47.129.31.212 pwnqzpayi.com 80

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 56933 114.114.114.114 53
192.168.56.101 138 192.168.56.255 138
192.168.56.101 58485 114.114.114.114 53
192.168.56.101 57665 114.114.114.114 53
192.168.56.101 51758 114.114.114.114 53
192.168.56.101 52215 114.114.114.114 53
192.168.56.101 62361 114.114.114.114 53
192.168.56.101 58985 114.114.114.114 53
192.168.56.101 50075 114.114.114.114 53
192.168.56.101 58624 114.114.114.114 53
192.168.56.101 62044 114.114.114.114 53
192.168.56.101 62515 114.114.114.114 53
192.168.56.101 60330 114.114.114.114 53
192.168.56.101 61322 114.114.114.114 53
192.168.56.101 62306 114.114.114.114 53
192.168.56.101 55142 114.114.114.114 53
192.168.56.101 56111 114.114.114.114 53
192.168.56.101 58005 114.114.114.114 53
192.168.56.101 64558 114.114.114.114 53
192.168.56.101 64558 8.8.8.8 53
192.168.56.101 49986 114.114.114.114 53
192.168.56.101 65527 114.114.114.114 53
192.168.56.101 62324 114.114.114.114 53
192.168.56.101 55457 114.114.114.114 53
192.168.56.101 63148 114.114.114.114 53
192.168.56.101 55773 114.114.114.114 53
192.168.56.101 51209 114.114.114.114 53
192.168.56.101 61491 114.114.114.114 53
192.168.56.101 60789 114.114.114.114 53
192.168.56.101 59504 114.114.114.114 53
192.168.56.101 60395 114.114.114.114 53
192.168.56.101 55469 114.114.114.114 53
192.168.56.101 53131 114.114.114.114 53
192.168.56.101 58818 114.114.114.114 53
192.168.56.101 65012 114.114.114.114 53
192.168.56.101 50445 114.114.114.114 53
192.168.56.101 64590 114.114.114.114 53
192.168.56.101 54987 114.114.114.114 53
192.168.56.101 65496 114.114.114.114 53
192.168.56.101 52014 114.114.114.114 53
192.168.56.101 56171 114.114.114.114 53
192.168.56.101 50365 114.114.114.114 53
192.168.56.101 53520 114.114.114.114 53
192.168.56.101 51770 114.114.114.114 53
192.168.56.101 49587 114.114.114.114 53
192.168.56.101 64679 114.114.114.114 53
192.168.56.101 56992 114.114.114.114 53
192.168.56.101 60222 114.114.114.114 53
192.168.56.101 60720 114.114.114.114 53
192.168.56.101 60534 114.114.114.114 53
192.168.56.101 61947 114.114.114.114 53
192.168.56.101 65312 114.114.114.114 53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Name 376c576e3846d21a_qdlakbmqlrtsvvgobjyizkojprqttemzhw.xim
Filepath C:\Windows\SysWOW64\qdlakbmqlrtsvvgobjyizkojprqttemzhw.xim
Size 4.0KB
Processes 1464 (zhkuzlr.exe)
Type data
MD5 564a7269a5f84b0b22445a73e298c880
SHA1 08ce6b97d4c46e88b79fdb350cfd57855dd2d7cc
SHA256 376c576e3846d21a37fc909dca6779acedf5e5381a33c670183b2703d3eeba0b
CRC32 A7DCC407
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 543f3993857e49ca_dfcgflleojaogvvsurvuaat.ypd
Filepath C:\Users\Administrator\AppData\Local\dfcgflleojaogvvsurvuaat.ypd
Size 272.0B
Processes 1464 (zhkuzlr.exe)
Type data
MD5 cb9d7c796ca785b4ccf30356d2dabb9b
SHA1 b135cc6daaf77cea9a6d4dc2966f5281bfe4dd4b
SHA256 543f3993857e49cab2fd6e4c433accf8bcbf58b210024226c686aa330a537498
CRC32 449D2873
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name abdc34b2d0ab22dd_zhkuzlr.exe
Filepath C:\Users\Administrator\AppData\Local\Temp\zhkuzlr.exe
Size 13.7MB
Processes 2060 (072f42c8d2ce79055c1617ee30f0754c054819dc3d0d925411a3628f5b65380c.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 27bffacb9f3b7a89919489e504ee9ad8
SHA1 56be4512ad571d2a165e7fb352fd2322105ead77
SHA256 abdc34b2d0ab22dd0a4846f98111520091a061454f0d41446c302be91084d081
CRC32 BDF0A7F8
ssdeep None
Yara
  • vmdetect - Possibly employs anti-virtualization techniques
VirusTotal Search for analysis
Sorry! No dropped buffers.