1.2
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.77
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | Trojan:Win32/Starter.ali1001008 | 20190527 | 0.3.0.5 |
| Avast | Win32:Malware-gen | 20200110 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Spy.Quart.a | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (W) | 20190702 | 1.0 |
| Kingsoft | None | 20200110 | 2013.8.14.323 |
| McAfee | BackDoor-AXJ.gen | 20200110 | 6.0.6.653 |
| Tencent | Trojan-Ransom.Win32.Pornoasset.a | 20200110 | 1.0.0.1 |
静态指标
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(1 个事件)
| section | .aajaic |
动态指标
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(2 个事件)
| section | {'name': '.text', 'virtual_address': '0x00001000', 'virtual_size': '0x00007e54', 'size_of_data': '0x00007e54', 'entropy': 7.147291639255227} | entropy | 7.147291639255227 | description | 发现高熵的节 | |||||||||
| entropy | 0.6552925919922191 | description | 此PE文件的整体熵值较高 | |||||||||||
网络通信
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
文件已被 VirusTotal 上 65 个反病毒引擎识别为恶意
(50 out of 65 个事件)
| ALYac | GenPack:Generic.Malware.SYd!g.39B433A1 |
| APEX | Malicious |
| AVG | Win32:Malware-gen |
| Acronis | suspicious |
| Ad-Aware | GenPack:Generic.Malware.SYd!g.39B433A1 |
| AhnLab-V3 | Win-Trojan/Berbew.51712 |
| Alibaba | Trojan:Win32/Starter.ali1001008 |
| Antiy-AVL | Trojan[Proxy]/Win32.Qukart.gen |
| Arcabit | GenPack:Generic.Malware.SYd!g.39B433A1 |
| Avast | Win32:Malware-gen |
| Avira | TR/Crypt.XDR.Gen |
| Baidu | Win32.Trojan-Spy.Quart.a |
| BitDefender | GenPack:Generic.Malware.SYd!g.39B433A1 |
| BitDefenderTheta | AI:Packer.CD2748831E |
| Bkav | W32.FamVT.QuKartHV.Trojan |
| CAT-QuickHeal | Worm.Dorkbot.A |
| ClamAV | Win.Trojan.Crypted-29 |
| Comodo | Worm.Win32.Qukart.K@565w5t |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cybereason | malicious.20fe0e |
| Cylance | Unsafe |
| Cyren | W32/Berbew.WRHR-5462 |
| DrWeb | BackDoor.HangUp.43882 |
| ESET-NOD32 | a variant of Win32/Spy.Qukart |
| Emsisoft | GenPack:Generic.Malware.SYd!g.39B433A1 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Berbew.A |
| F-Secure | Trojan.TR/Crypt.XDR.Gen |
| Fortinet | W32/GenKryptik.BJQV!tr |
| GData | GenPack:Generic.Malware.SYd!g.39B433A1 |
| Ikarus | Trojan.Win32.Senta |
| Invincea | heuristic |
| Jiangmin | TrojanProxy.Qukart.bgg |
| K7AntiVirus | Proxy-Program ( 00557ea51 ) |
| K7GW | Proxy-Program ( 00557ea51 ) |
| Kaspersky | Trojan-Proxy.Win32.Qukart.gen |
| Lionic | Trojan.Win32.Generic.kZnr |
| MAX | malware (ai score=80) |
| Malwarebytes | Backdoor.BerBew |
| MaxSecure | Proxy.Qukart.gen |
| McAfee | BackDoor-AXJ.gen |
| McAfee-GW-Edition | BehavesLike.Win32.Backdoor.cc |
| MicroWorld-eScan | GenPack:Generic.Malware.SYd!g.39B433A1 |
| Microsoft | Backdoor:Win32/Berbew |
| NANO-Antivirus | Trojan.Win32.Qukart.fokxzm |
| Paloalto | generic.ml |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | Win32/Trojan.Qukart.A |
| Rising | Ransom.PornoAsset!8.6AA (TFE:dGZlOgWfQ/+w2skqwg) |
| Sangfor | Malware |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
1986-11-21 03:31:28
PE Imphash
a64e048b98d051ae6e6b6334f77c95d3
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x00007e54 | 0x00007e54 | 7.147291639255227 |
| .bss | 0x00009000 | 0x000213b0 | 0x00000000 | 0.0 |
| .data | 0x0002b000 | 0x000031d0 | 0x000031d0 | 6.010527456609595 |
| .idata | 0x0002f000 | 0x00000ea4 | 0x00000ea4 | 5.0788658748287245 |
| .aajaic | 0x00030000 | 0x00001000 | 0x00000200 | 2.2345128017072797 |
Imports
Library ole32.DLL:
• 0x42f308 CoCreateInstance
• 0x42f30c CLSIDFromString
• 0x42f310 CoInitialize
• 0x42f314 CoUninitialize
Library OLEAUT32.DLL:
• 0x42f320 SysAllocString
Library WININET.DLL:
• 0x42f32c DeleteUrlCacheEntry
• 0x42f330 FindFirstUrlCacheEntryA
• 0x42f334 FindNextUrlCacheEntryA
Library KERNEL32.DLL:
• 0x42f340 ExitProcess
• 0x42f344 ExpandEnvironmentStringsA
• 0x42f348 GetCommandLineA
• 0x42f34c GetComputerNameA
• 0x42f350 GetCurrentProcessId
• 0x42f354 GetCurrentThreadId
• 0x42f358 GetExitCodeThread
• 0x42f35c GetFileSize
• 0x42f360 GetModuleFileNameA
• 0x42f364 GetModuleHandleA
• 0x42f368 CloseHandle
• 0x42f36c GetProcAddress
• 0x42f370 GetSystemDirectoryA
• 0x42f374 GetTempPathA
• 0x42f378 GetTickCount
• 0x42f37c GetVersion
• 0x42f380 GetVersionExA
• 0x42f384 GetWindowsDirectoryA
• 0x42f388 GlobalMemoryStatus
• 0x42f38c CopyFileA
• 0x42f390 InterlockedIncrement
• 0x42f394 IsBadReadPtr
• 0x42f398 IsBadWritePtr
• 0x42f39c LoadLibraryA
• 0x42f3a0 LocalAlloc
• 0x42f3a4 LocalFree
• 0x42f3a8 OpenMutexA
• 0x42f3ac CreateFileA
• 0x42f3b0 ReadFile
• 0x42f3b4 RtlUnwind
• 0x42f3b8 SetFilePointer
• 0x42f3bc CreateMutexA
• 0x42f3c0 Sleep
• 0x42f3c4 TerminateProcess
• 0x42f3c8 VirtualQuery
• 0x42f3cc CreateProcessA
• 0x42f3d0 WaitForSingleObject
• 0x42f3d4 WideCharToMultiByte
• 0x42f3d8 WinExec
• 0x42f3dc WriteFile
• 0x42f3e0 lstrlenA
• 0x42f3e4 lstrlenW
• 0x42f3e8 CreateThread
• 0x42f3ec DeleteFileA
Library USER32.DLL:
• 0x42f3f8 GetWindowTextA
• 0x42f3fc GetWindowRect
• 0x42f400 FindWindowA
• 0x42f404 GetWindow
• 0x42f408 GetClassNameA
• 0x42f40c SetFocus
• 0x42f410 GetForegroundWindow
• 0x42f414 LoadCursorA
• 0x42f418 LoadIconA
• 0x42f41c SetTimer
• 0x42f420 RegisterClassA
• 0x42f424 MessageBoxA
• 0x42f428 GetMessageA
• 0x42f42c GetWindowLongA
• 0x42f430 SetWindowLongA
• 0x42f434 CreateDesktopA
• 0x42f438 SetThreadDesktop
• 0x42f43c GetThreadDesktop
• 0x42f440 TranslateMessage
• 0x42f444 DispatchMessageA
• 0x42f448 SendMessageA
• 0x42f44c PostQuitMessage
• 0x42f450 ShowWindow
• 0x42f454 CreateWindowExA
• 0x42f458 DestroyWindow
• 0x42f45c MoveWindow
• 0x42f460 DefWindowProcA
• 0x42f464 CallWindowProcA
Library GDI32.DLL:
• 0x42f470 GetStockObject
• 0x42f474 SetBkColor
• 0x42f478 SetTextColor
• 0x42f47c CreateBrushIndirect
• 0x42f480 CreateFontA
Library ADVAPI32.DLL:
• 0x42f48c GetUserNameA
• 0x42f490 RegCreateKeyExA
• 0x42f494 RegCloseKey
• 0x42f498 RegOpenKeyExA
• 0x42f49c RegQueryValueExA
• 0x42f4a0 RegSetValueExA
• 0x42f4a4 GetSecurityInfo
• 0x42f4a8 SetSecurityInfo
• 0x42f4ac SetEntriesInAclA
Library CRTDLL.DLL:
• 0x42f4b8 __GetMainArgs
• 0x42f4bc _sleep
• 0x42f4c0 _stricmp
• 0x42f4c4 atoi
• 0x42f4c8 exit
• 0x42f4cc memcpy
• 0x42f4d0 memset
• 0x42f4d4 printf
• 0x42f4d8 raise
• 0x42f4dc rand
• 0x42f4e0 signal
• 0x42f4e4 sprintf
• 0x42f4e8 srand
• 0x42f4ec sscanf
• 0x42f4f0 strcat
• 0x42f4f4 strchr
• 0x42f4f8 strncmp
• 0x42f4fc vsprintf
L!This program cannot be run in DOS mode.
.idata
.aajaic
D5:F0t>4?zd8jd <3t>@'h
(0d~@T
@0t>$Q>@0t
Lrd8vL
E0t>@2 n/
g!T@ZtV 4>E|~Jt>
o*e)e|m
6>pp8@0t1
t>@1ud
2K|{0t><
<p>4M"k[d
|@f#o$t>@I
rtg nj4)`mx7D\Ft
826psx
|;826@R
1eUPZm2*0;P6>K0t>*;m<0t8}5
91t>@S
A.rtZLt>|u |@
E@0Du>@0)a
l6>@EsA0t>
Z0t>@e*
"rtV 4>
@0t>dm
dV2d0wl
DZtT@X\
rtV`6>%
rte$|@4H@0X
@0t>0!`rA0A60tm
ZtT@ZwT@ZtV@0t(
H@0E*1
$]1t>x
$T@XK>O0
>Ex5890tz*0t7Dp
I90t7Dp
m=uKGv>@02
g}2gQ{`
'@2tT@
2E|zIt>}44E
.EfIt>KpG@0}44E;E
0[0[0WU>];46>q
|u?!6Op<O`
u>5M2{16p
k:@1trDt>
f#5<cP
ED|@16p
7u>tvR
!6$N5u>3
5u>t1to*e!a'h
u80t=8
s/]-_$Cxy
u|D(ta
0t%{1q
Q*wvM<;46>u|D(t
iko*e!a'h
D^h{p]>@qJrth
isL?*Q
gKH:fA5
u=<3i(n|@fL
+`!c"imx
>(k>@c"58
>*0!40t1p
c"iE|tl
0$X'6vp64&c|5t>{FBX'6!
>@o*e!
D:=>@R>Vp>*000t
>@Rtt>{
rtTDZt
$@t>EI{1I
rtFBP`+@0t>
i<(t>q+`
<6>t>47
0M{L?A0t
<I0tKLQrt>du>@?X>@1
i\1M>O_?@0C0{a1t>U>
'7@0;<6>u
EL|@FseL|@0Brt
$5PD0t>CH
{o0t7E!V
6>(|@1
t>@0{9KwK30t`
0t>u7EaEL|@
uEiU>u||
t>@9KQ1A0t>iEi<
8zC1$V
@0;6>@
}4:[0iM>4ajrt$6>u
EvR164D
%t=tJO
~@xP@0Ju
Q@0{H4|1tKT@9
0KQ@0X
t>Ez^t> n/et<@
ni}O6@0A*0I10t_t>
LIrt>4:$t>
$I>@0t
}OH6@0A
H{917|>@X$
0$x#Bu7?G0tX
t>OB<@0{
@IRrt>O?@0A*1
>@DSTAX
?(|@X$
<I0tJgZuV6>
A0t>*1
>@DSTAX
?(|@X$
<I0tJgZuV6>
A0t>*1
1t>@^@0
1t>@ZuV86>(`
<I0tK]ZuV06>
tKVqNrt>
eE@|@1jrt$6>
1I{4t>
AM>O:@0
@0t>u7?
W@0}Ou:@0
@?C0tf>@
u7?VC0tuy>@
il1]C0{72t>
$I>@0t
z7t>I{q2t>
qM>O?@0
>e >@i
PD0t>0
@?PA0t
t>@0{91,u>@
>O{?@0
i`1EC0{0t>&^
6O>@0(
@?@0tQ
A0t>*4
$Zt>`1
$fZt>d
>40.]0t
$p"6V>@
$p"6$*@0
PptZ0t>@`
e0t>@*
fB0t"Xt>p
HIrt>5
e1A0t>uU
\K|">@
{T>@0tp>
t*%i(|@ZtT@X
>*0%0tg
$0taelm
)67l_@0uqJrtQ:pt>`/@0
@4t>@?Et
@4t>@x0~qt154
<@0I@0t1Cv>@P
04 2t>5
v>@y&qt~6L1 v>@q~qt?4=qt?E
H2t>5L
0A0tED|@q&qt.47E
@ ~qtP4>
q&qt:47E!w>@"@0uy&qt:<q&qt647Ev>@?0tM(
q&qt?47Ev>@
@1;5>B0t>q&qt<47Ev>@jf0tM(
5>B0t>qJrtE
@p?A0t5>A5L
0@0t5>A5L
0@0tED|@q
qt<t>@
?@03X5>`d0tv>`|@?;
6>}t>@L5
|@y&qt~
@p.qaA0t
?@0tv>@|@
{E@|@9u1u
0t>O>@0Cp
0t>5;zqt?E8~@Izqt<5%C0
rM85v;H4>BI=pKdy&qt]
t5>Oqqt7{
EEy=tKGq6pt:
0tXx%x
qtE<~@|
0M;L4>2
0tXx%x
0>4artE<~@L
0M;L4>2;46>]4~@
1*e!a"im}J
m0tED|@X}
0 0tXg
ot>l|@
rth+>@d
rth+>@
urth+>@D
`rthI+>@,
Q4Pat>5
$Ul|@1X0t>][0{1
u~@0t%t@u>@
@qJrt%t y>@
@1A0t>u?@0tED|@1
0{2t>@
u>@0[0C
$V@0r>un%
0qun*0{`
_@0{`K1
>ET@ZtTDZr5
u*>@qJrt
$5{`+5>uL
o*e!&u
{ZpT@Zu
+P5> mkLc"iE|
<;46>q{D
I@0tKt?zw1I@0tKh?zw2I@0tK\?zw3I@0tKP?zw4I@0t1:v>@1.tw;$JT
t>@2{T&M5Kw1$b
:Op8}t>@E*1uU?:EY|@`
0t1eU$*U|@b$lt>ukP -E14]Cu4{1.tw;AD!$q?@0t`?{[*
qrt>4?{1
uBH8DE4=
0t>4;q|6PKV=
jx5D94a?@0t|
r<5lv|6vK
9}t>@E[kP -E14]AD1ud
3q?:eT5u>@0
l<|6uK
CH8AEG:Op8|
0}t>@Ds
0t>5(5
jS5upD%u>@030p>@?
qJrt58"q
J>593w>@Fw>@Cfxux
BH+`4>qA$
qJrt14k
I@0tJ`
@z31$sT6{p
0M{Bgp!4j
/u@1uiAuu
0EBA]uAD1
4Gtj?ePqJrt]dj;AD1
u>@0'hO!.vt%,
kbe0tnit>
tZjt>}0t>Cs
@qJrt9tKQ?
q^rt?4*@Dg1
U.2M|@aB
^H;6>@?s
pt>O:@0{
<$anqtqJrt
0{1t>S
(0d>@c1
n,>@qJrt
0@0tVt>
0rEB<CetD
5930p>@Bw>@B{5t.@0~@ t>t@0
B2B39A4B
0p>@BED|@
`rtJgt>
>@6TT@
Xy>A0;46>O
(0d>@b
91Pu>@
?>}t>@D{=8u1
u>@o?@0
$q?@0tzB4t
BL>5.wx0
*DL>5:qx0
v%A?8}t>@EbD
u>@0tKhH
B0t>@Ej|
w>@0tKTH
D0t>@E~|
q>@0tJCwO
=8uJ\?
2v2ws+4e
>D0tLqJrtn
^H;6>@?
)6u\S5}
@0{1CAJrtQ0t>S)^>@
09@0tOY5<7
T@0{1{0(3{
8u::{1C!
{0@0tC?k
0+?@0t
0t>=\{?!O7?et>@~54{1{
4qKI~=4{1{
:u=O7?et>@
54{4{1C?{
u>&=O!zta56{14u?M92{?!Ow
0t>54{1{
Ut>{V0t>
Zt"bt>p
Jb57zw1tF
n/e4T>@
o@0"iU\YD0timt>KLfKH>
nY">@>
n?t>@.qi n
MhC0tT@Zt58
>'>@o)
F%yt>*0
@0tTCZtTCXt>@KH
,o@0dn*p)
>Mx>48{L1
EmEh%&>@f
T@X>@0
:q]My>@
H?@EZt
&mExh!&>@Zt
{1?@0ta
>(t>@ZpT@ZtV@0tE|fat>Ep
>*0"jat>*0{`KP
o@0"b`t>q4F
gKH1Sy
G?:~1y{MxB1uemExV
6>'>@XO
0t E#{D.$Vu6>'>@6
rtvct>
rtbct>|yy
|@dm@0-
iko*e!
u>U>U>U>Mu|@w>@0ECP1
8&1X0{H?~B1
BEp-vw_>@
2{Ws>@?{?zE^11M<54S2S1C0
u{L?>e|1"])
{11ux1pr
6]O!O?
>t>ux1p|
q|ptmH~@&
ktc"im|
1u%{1&1@0@0tgt>U
tjq@0{A@09@0t1e
ueD.HN2$HA7 A41 {
] {D.I@0tKP?p{P?s
P1EeTHX>@0{`
0t1unu
~t>*6{`A$~t>P
{8&1O12
1>o*e!
f#S<IE
ie}|@0
8I{]2t>O
0_*}|@qMiO
>w;6>Cun9>@&|@1
'}{t>w{art
0w;6>yuL
0{e31%
0E.u:|@3qrt
O?d7Irt}t>u>}t>M1O }
rt3qrtn-9>@2|@1
t>w{art
0w;6>yuL
+6>q {4rt=E|@
$rtM|@x
*|@yrtL
:]&u?{`C5
|T@ZtTBZtT@Xt>@pKHHw@0{Zt
o*e!&B0tm
ED|@t>@irt
@u@0uKN;
$.{t>]
n(1l>@X
zt>r@0
@0tED|@X
>@0]0t>
CrtVB0t8t>@j n/e
$T@XK>O0
>Ex58Y
C=?5$m
0tTA`KT
@0t(+ce
:u`nEd5<KHr>@0Xo)
gm!{>@1
ZtVF0v>*0
6<>@9JD
0t7Dx5
~ kTf#5${XV{X{:P@Lt>5`>@
$VY0v>*0KL
<>@9JD
<>@9JL
XY}@0u
3>@?{Xo*e
LT@X>@0
>(Q|@x@0
rtvt>ua
.s%Ezd4+!6>`|
l1]eA|
0t<ikPp<@1zt>B
<|6~KY1.0t&t>U
tt>Syc>@9J]?`KP
>@o*e!.
19JJ?:sO4Gx{ELV{0t
3kQ#=#V
x@0TV{?{
12{o*e!8>B0
gD9PB>@
nEx|9KG
S5@0KT}@0
N>D0ti*p
E|VD1t>5>@?
{@0HX:
1>@6]1>@~>@0
{@0H<{@04@0tEMWvut>St>@
p{@04@0tEMgV6>
z@04@0tEMgV6>
0tJ0t>
0#tt>d5
rtnY0>@*y0>@~>@0
z@0HX~
e0>@6]5
0tJ0t>
jtt>|VC6>
0tJ0t>
0#st>d-Z>@}@0C0t&V6>
0$:st>T
st>:t>@qCc<}@0]@0t&
rtiu7>@.
7>@~>@0
0}@0Hk 0t
rt>:t>@qCSX
)7>@66>@~>@0
0tJ0t>
rt>|lt>
0tJ0t>
>rt>|zrt>:t>@qCc\|@0]@0t&
6>@.MT>O
@2?@0@0@d
$@0t!b*t>@;
drt0tg
qt>lnqt>:t>@qCSX)
}5>@6]=
0tJ0t>
pt>:t>@qCSX
4>@6>@0
hu>@>@
>O??@0iuh;@t>y{
n(T|@`
t>:t>@qCSX)
K>@6K>@~>@0
@04@0tEMgV6>
K>@6J>@~>@0
@04@0tEMgV6>
~0t8iJ>@~>@0
J>@6QJ>@~>@0
q~0t#0t>
@04@0tEMgV
u~0t8$Tt>1J>@~>@0
@04@0tEMgV6>
}0t8}0tJ0t>
t>dVi6>
]}0tJ0t>
t>|V\6>
}0tJ0t>
t>|VZ6>
}0t8iH>@~>@0
@04@0tEMgV6>
|0t8i(0|@
t>:t>@qCSX
H>@6yH>@=@0
t>:t>@qCSX
H>@6(|@
@04@0tEMgV6>
{0t8{0tJ0t>
t>dV6>
o*e!:A0timZF(
t{90t1un(|@
nN>@ZtV6>
EBT@XL
trtVA0tX
rtV6>(3t>
a!B0tm
8:E1t>@
8qhAC>@!6dv;
hmC>@F
t>e|D 4EN
@0qA>@`Uy0tVD1t>
$V6>(|@Xv>@
t>qTB0tR
t>q<B0tV6>
z@0t/et>,
@0}O>@0
G>@X0tXf
`w0t +
n(E|@4
V@Ht>Y@>@
t>')>@
TVD1t>
$m@>@ZuV*6>
`Ut0tP*>@fs0tT@
@0&!Ex
@0qC\1{16q*4{X`
`u0t<KH5$
t>Ex1u
@0KP?{08E?k0.B`
q0t1c{
uO!td=
>*0-s0t
$hyE>@fMq0t
$V&6>[>@7?@0t
$`" t>I
oH@0'
@0H9K_
p:E n/e,T>@
)6sR}fr@0
Xp?@0Up0t
H?@EZ|1l?6(e|@cit0t8~ 0t
@04@0tEM`V6>
@04@0tEM]
t>St>@
i(h|@>
iG>@.MG>@~>@0
rt0`s0t8
rt0`s0t8
s0tJ0t>
neG>@6!G>@~>@0
r0t#0t>
rt0`r0t$r0tJ0t>
nF>@6(:|@>
nF>@6tl@0Mr0tJ0t>
nF>@6(3|@>
nMF>@6
F>@~>@0
r0t#0t>
t>dVi6>
t>:t>@qCTX
t>:t>@qCTX
@04@0tEM`V6>
t>:t>@qCTX
@0H%@0
D>@~>@0
rt0`p0t8p0t3t>
t>:t>@qCTX
t>:t>@qCTX
@04@0tEM]N
t>St>@
i(h|@>
i5D>@.(|@>
n%D>@6*0
>@04mX>@
n%Y>@Zt
g$0gX>@
o*e!D0tm
t>m|mX>@!6dv?
@0$z t>%Xt
nZ>@Xp?@0
rtVB0t
I{2t>(4u>@
L91Hv>@X
t>I{1t>
_>@7EoV3t>]^>@A
H;2}O{?@0
t>(4u>@
<I0t1t>@
t>`7E]VK6>]>@
n]>@ZtL
t>u5<}i0t
f!g0tot>{m)]>@
t>un*0"V<n4>*0
Zh\>@1
g0thYS>@1
6i n/e4d>@
@0u}54Es
O0t1`"
t>*1KL?
>@DpfB*>@Zvh\>@o*exi5\Hms]0tXu?@
t>un*0
}A0tu|@`
$T@X7?@0
l5>\>@'O0tXu1u=
A0tT@ZtTFZdn
@0Yt>*1"TpAqt6
t>*1"TpArt&
t>*1"TpA
t>*1"TpA"pt
ZDu|@d
ZDuD|@t
@0i*1"TpA
t>*1"TpAqt
t>*1"TpArt
t>*1"TpArt
t>u+`e
ptTAqtr
6>)S>@H
ptTArtN
0f0td5>(~@Zu
0f0t@4>(~@Zu,~@
0f0t86>(~@Zu
0f0tl4>(~@Zu
6>iR>@h
ptTArt
t> kTf#i^)@0
dH5>08@0
@0{`""
$T@ZtV@0n(|@X
@0:qtT@A
qtT@AzqtV1t>u
7@$V6>(|@Zt
t>P|@ZtTBZtT@ZqTAZtT@ZtV2t>*0
*Q>@Z>@Zuh*
D5>eQ>@Ztu
@ZdVv2t>*T
@0BrtT@A
qtT@AzqtTPXW<@0
>@0$VX6>(|@ZtR
t>|@Ztu
@ZdV1t>(t>@Z\V@0tn(|@X
FA0tV0t>*
>@0$V6>(|@Zt
@ZtuP|@Z
T$X>@0
@0qtV:6>*0
>(su>@AqtR
u>@ZFV0t>*J
=@$V6>(|@ZtB
t>|@?T@A
qtT@A^rtVl1t>*
@0tV0t>(3t
>@0$V+6>(|@Zt
t>|@a0tT@A
qtT@AzqtTPX>@0
@0tVT1t>(0t>
@0JrtT@A
qtT@AzqtTPZ
VX1t>(t>@Xt>@`
|rtV6>*09c0tp5>*0
@0tVq1t>*T
>@0$VS6>(|@Zt
qtT@AzqtTPZ"V
1t>(t>@Xt>@`
8rtV6>*0b0t
A0tV0t>*$
>@$V6>(1|@Xt<@0mb0t
@0tV0t>*$
6>(1|@Xt<@0)b0t\4>]
@0tTTXt>`
rtVA6>(0v>@
qtT@A^rtTXZ
V0t>*$
>@$V6>(1|@Xt<@0a0t`5>*0
@0tV1t>*.
>@$V6>(
qtT@f{
1kun*0
rtV@2t>T>@0
Z`TTXt>`
rtV6>*0`0tD5>5
Z%TTX}>`
rtV6>*0
`0t 6>*0
B0tT@ZtTHZ`
=@$V6>(|@Zt
V:6>*0
KrtT@X7?@0
5>Ik>@Irt
@(!@0**0
>(~u>@Aqt
u>@ZFTTZ
VC0n(|@X
0WCt>*0
u>@ZHTTX>@0
=@$V6>(|@Zt
.(t>@Z
VT1t>(0t>
rtT@ @0Jrt
@ZdT'X>@0
@0tV@0tn(r|@X
>Mj>@D
.(t>@X>@0
rtT@0 @0qtT@A
qtT@AzqtTPZ"V0t>(t>@Xt>@`
8rtV6>*05^0t
A0tV0t>*.
>@0$V>6>(|@Zt
-t>L|@Ztu
@ZdV0t>(t>@ZjV@0tn(g|@X
&(t>@ZYTTXt>`
rtVA6>(0v>@
#@0"pt`>@Ztu
@ZtuP|@ZlThZ2TTXt>`
rtVA6>(0v>@P#@0
qtT@A^rtTXZ
T Z`V@0n(|@Xu
@ZcV0t>(pu>@ZjV@0n(
f#BX^G5@0
>(t>@ZwT@ZwV@0tE|*t>?@0tT@fY0t?hm>@
@1D0t>unununEdV}6>(1t>
6>(d|@
:*4{`KPXI
lWt>{a
8u>@c"M/~ "@0
rt0`mX0t1
"@01@0tm=uKQX
P&@0C2
CEeV6>
't>?"@0C4
/($|@>
EEeVp6>
't>M85!
urt0`W0t=sKQX
IEeV6>
't>M45!
rt0`}W0t=
X)@0iM25!
rt0`1W0t=yKQXM
/(e|@>
nb>@ZtT@X6
gKHoxi":(t>lr?
<&@0+`
m:@e@6@0'h
$V&t>n>@{>@0
`EU0tTN>@
nI`>@X
0{t3t>E%/t>q
7?B0tD3t>
tJiL&@0+
s/]-wO
5>BECV
n=l>@HL0tV
6>(/|@
nc>@&y
`W0tVC6>
nEc>@.*0
n2I{)1t>
E`V0tg
4OC?@0
nMb>@.
>*0qS0tne>@
~7+tj%t>
:@ePg>@.@0'h
Fwt>(|@ZtVA0k>%f>@
7D`nue>@Zu
@t>@:0tV
5>me>@X>@0
rt^!t>
e>@`%U0t
6d>@ZuV
t>Oj?@0;46>HQJrtED|@e|0t$t>9\Pa
AB.$t>O
HFr|>@
`9T0tT@
`P0t1Zuj?t>(|@X
RA:rta0t>VV6>(|@X
Nrt*#t>
6>-t>@
rtV`4>
Artc0t>VV6>(|@X
>qtJ#t>4ArtI0t>q*0
>@04V@5>{>@1*2
>*0$?t>uO0t
H?@ET@
0K1@0{{>@1
4|1tKZt5"n
#5AO0tT@1
ZvV6>E*?t>
0{XtA@0
>{>@1]
=?0tT@1@0{1@0t>*0P0t
w>@0{0t>@1@0t>u{`MO0tT@A
qtT@ZtT@ZtT@ZtV@0>(
0]t>(|@ZtT@h0@0
>*:}y>@
@rtn1y>@
6>(1t>X9KGQRrt>5
~@ZtT@
3@0$"<t>
$T@ZtVB4>*0
>y>@`}L0tT@X?@0
0@0iunz>@ZtT@Zt
$n>t>I
n/ tk|2t>
ux {1t>?>B?TA0t8t>}!u>@?[B0t
S1t>4+I/A0t1O|>@
L?@0{1t>_|>@IVrt>O>@0
rtuX|@k
0L0t7D
ZtT@Azqt>=t>]
$6>@?G0t$6>X|@
06>@ExuX|@
-}@|@1{
@5>yu|1
0M{HE|58L0t
E7t>u`
ED|@DH
EL|@Dh
@?F0tT@
EL|@Dd
@EyV d>Ed<t>(
.Ax>@80t0
mrtT@L5@0
@INrt?O>@0
6>]~>@
4|1tK;2-
>@ETT@ZtVs6>*0J0tu|@(4@0kE0t; t>
nYx>@.(t>@
>(>|@Zt~:t>
dJ`ZtT@X
>9~>@A"pt9t>p>@
0II0t04t>u
dLwY0t
5@0PX>@0
8t>tK`ZtT@X
>a}>@Art
8t>w>@
$Z;t>dV0t>
@ETT@ZtV6>*0H0tu
@6@0C0tU>@
$:t>dV0t>
@ETT@ZtV+6>*0H0tu
2t>t}?
yNTT@ZtVl6>*0-H0tu
9@0B0t
n}>@.(t>@
>(!|@Zt7t>
2t>t}?
yNTT@ZtV6>*0eG0tu
@|9@0?B0t
6@0Pt@0
0E0tZvT@Zt;@0
06>@E3M
H?@EZt
b'Vp4>
0F0tT@ZtTDZtT@Xt>@p
p>@yrt4|1tKT@
Uw>@qRrt?@0tTDZpV,6>(I|@X$
lTEA6qt
5t>E/E`5 KL
6q>@o*ed>
<I>A0t1t>@
.I?@0t
@:@0tt>{
\4>Qp>@
A"ptKKA
qtr4t>{
0tKKAqtV4t>{
0uKYArt
6>56#|5>]O
l5>56#d5>{
h5>56#86>{
6>56#\5>I
,E`5 KLf'64t>6i n/ t>@0
t>@0!a#0t>
bEWTb~
$;@0H1I
`D\w{G9JE
0t>*1#T@`x
a-0d>@
t.@0:d
>@0jd8E
ptP:8t>@0
(,,(,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,cZKcRXG]
FFEFWT
C\([XX
KAXGC^]
X[,@G\
AIIJIX
ZFEFWT
C\([XX
X[,@G\
M[VDCR^]
X[,@G\
ZHMK\@CD\G
X[,@G\
KG_IF@BL
ZHMK\@CD\G
EDVIIAD
DX3X\C
DX3X\C
]J\QBC
ZHMK\@CD\G
C^ZKGWDG@
[XEFWT
C\([XX
ZFEFWT
C\([XX
ZFEFWT
C\([XX
DEEFWT
C\([XX
DX3X\C
_MZXBE
ZHMKD\^D\G
@G,@G\
XE3X\C
ZHMKD\^D\G
ZFEFWT
[A([XX
ZFEFWT
[A([XX
KAXGCB]
@G,@G\
ZHMKD\^D\G
MRRMCR^]
@G,@G\
ZHMKD\^D\G
CFU_CR
XE3X\C
C^MKNI]
ZFEFWT
[A([XX
@G,@G\
ZHMKD\^D\G
@G,@G\
JMGMZWNAIEFWT
[A(`J\D^MoEKA_GU,{\X_RIt~OZ\CNG,(3,(3,(3,(3,
3,(3,,)3,
,ka||xu(]HD_HD_~\_BAGBAPHM`^A],fGBERzAVcN`O\ZB(}cXV
MPEG]b\~\~Z[gUIKGCF3XD}
\RY[ghG@^Z\,kf~m}s}`~(3,t3,M3,A3,M3,X3,Q3,A3,I3,E3,E3,Z3,(3~qcifwyx
m'pQ8 w O$o(F
.*1mx-Gmp0
q#s,(M ,%-
2-)F+;Y ,(3*2+;X!
(Sx Yy8'#;X+R
2-)G ;$-)2+
2-)F*1.}
$nU;rp
.*1p_
$nU;rp
(puxgiq3^GP_[
bMK,(3,(3,(3,(3,fGYMA
Q@IEzJGAM\ZB(3,(3,(3,(3,(3,(3,(3,(3,(3,CVBM_
W@(3B\W@
W@(3,(3,i,,(2)/;&#]HD_HD_,(3,_@OC
L_,(3GMAID
L_,(3IZ]@
HD_,(FIZ
L_,(3,]@^
HD_,(3GMAID
L_,(3O[P\(3,(3,(3,(3XG],(3,(3,(3,(3EZGMDcC\VX(3,(3I\p^ZVXxAOM@eL3EFWEFW[i3,(3,(3IFWI[@KMr,(3,(3_jR~MR|\A,(3,(3IZ]@
HD_ozjxm},-
,BGP-(2-(2,)3,)
,(,(7,|M,\
;3,s3,F3,R3,s3,3,eik,+3,,3,,3,(3,h3,(3,(3,(3,(3,(3,(3,(3,(3,3,&,A"(
DA@\Z\^I^OI]C\
3,(3,xv,d2,yMl(3,(3,3
(5,(?,(3,",(#,(
,(3<(#,(1,)3,(3,,3,(3,(C,(7,(3,*3,(3,(#,(3,(#,(3,83,(S,h3,(s,D1,(3,(3,(3,(3,(3,(3,(c,3,(
,|3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,
GT\3,6,(#,6,(7,(3,(3,(3,
AM\R,|3,(
,|3,(9,(3,(3,(3,
WXI3,3,(
,3,(?,(3,(3,(3,h3
ZM\R,D1,(s,D1,(=,(3,(3,(3,H3
A@GP,3,(c,3,(',(3,(3,(3,
VM\R,h3,(S,h3,(%,(3,(3,(3,
3l(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,
i7,(3#w$g<1C/(3{el
L,(3?rs`{}YF([i<(#
Y =((3svhru
yx `{} vh7,(33,v
'S,(3v ^,3Q~fvG83p,
,8jrgt(umpq$:;X
?$?,po$
,(?(ulw
~dxQ$2)
<rs9 (,(3
\0,;,8[
q/(3x
3%GF(d
)(3s,}
(3,,(8u
1(3,(F.U
(#xQ3(
,(31,m}v0;1(3,(FY}<(=3,(3,(,(3rs8,fr
r)r~(3rr
r@,8YD)3,,(~
l,(#-8
;l,(#-8
s(3z/,@7,(~
|,(8)3
i)3#rr
#8=}3F)~
*rs9 (3,x
?l(#k(3,
3l(#k(3,
7l(#k(3,
+l(#k(3,
/l(#k(3,
#l(#k(3,
'l(#k(3,
l(#k(3,
l(#k(3,
l(#k(3,
l(#k(3,
l(#k(3,
l(#k(3,
m(#k(3,
m(#k(3,
m(#k(3,
m(#k(3,(3,(3,(3,(3,(3,(3,(3,(3,)3,)3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,a <(3,(3,(3,(3,(3,
@,_3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,IQHMUDAY@E],
[3GKP,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,Xs,(3,(3,$q,s,s,(3,(3,
q,s,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,<r,
r,hr,xr,@r,Pr,r,(3,(3,r,r,r,r,r,r,r,r,r,(q,(3,(3,<r,
r,hr,xr,@r,Pr,r,(3,(3,r,r,r,r,r,r,r,r,r,(q,(3,3TAG^GP_[3,3I\vZAABEVX{GEFTm(3,33@G@dI]@M3,
2I\`_\VhAAO\\Ui3,2\M]Y\Vm(3,&1XDf[A],1EFvIK3,3JL\IF3,g2CXVsG@DI]@M3,%1OD\I(3,
3OMKX(3,f1MD_O(3,s1^A]J(3,H1MA@,O1I\QJ(3,E1\ZZXN3,]1XZPU(3,cvbm
w`(3,(s<(s<(s<(s<(s<(s<(s<kahd
,<s<<s<<s<<s<<s<<s<<s<<s<<s<<s<(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,
3,(#,(%,(
,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(#,p3,
,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,yMl(3,
S,)3,)3,)3,
L_,` ,
S,(3,wX,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,(3,|[_
|}cef AGW^IG^
KAXGCB]3IDPAM
kaxgcb}
`rhk|i
pedw|gac
a|m3ii
kaxgcb}3,(3BK\^MP
P^ZVX(cII@
VXMAUGF
xz,a]CZAO\
\DV_M OGAIKG|DV_M IFG^
,x_M[V
[VIKGiPC^IGCF
IIA|DV_M _M_O\
TXZM\ZB
~B\[eFP^ZVX
CZAO\3@MRI
@|DV_M IFG^
MEV|DV_M _M_O\
~_\VoIA
3IOZXMAIZEOMcCKV_(X^FV
@D3YZUHIGHFX
LR,_FH
@pK\AI]
@OG^MFW\AU
TM3_tPH
FCN@GC3ZXFGA]OZFCX3,CX|DV_M
MCVOGAIKGCF@MFWXZJMORB
IFDGAVM
m|~|a}oGW
A@^MBEZV
\\OG^@MG
\AB[RXA\
rX@\ERREG]jIZIL
pB\ZYM3y|gb(ve|3xe
WKAGZI_HIGCF
3C]AOIA
FFNMAoIA
IPC^IGCF
M\Vj]_
fRI(e_I3M[G^kRH(paj|cp3@MRI
ZJGAM\ZB
^VENJUGF
AWB\ZU
\BMACN
DA@MKPYFG,GUJZRH
]]IZGGA]
GUC]AAM^IZ
OK\B\@,i@\IA
GUC]AOG]EFFBO
CE^XEVX
ZVYKVX@VEF@MFP,"
{VYZZU
~M[FI[3xigo(xBOx^\\,mK@GA^(wOgQIKG
3_[VxA^C]G
D\M\ZB
J]]XA\
(zjZRI(
eZ^G@J\
B\VBMGiPCCZV,tzTX_^M
|IG,{\X_RIt~OZ\CNGem
I\Fp{VYX3I[3^GDIfV|Z\I[@
rit~OZ\CNG{A]C_@o]AIFGIZ@CFoTX_^MAnZ\_M}[xAOM@,o_NI__MAJN_BM3CNGMZVaAPC[\XtdBL\_tp^ZVX~V_A\pa]IZ]X
`X\ZK[3
gu{iapeZ^G@J\oEFW[[oYZAB\e^[ZBtzXMAI\
I\GBO@vG]_t
[PEXG,
@I\gAM\X
,U3_L\YEVX
3,NFO\ZB
%9EL3_
Z\]GXQC
PO(QEFWY[V,
COT^(`J\D^MoEKA_GUp
ZHGDpkF^M]zMAEG]
@V@{VZAPcJYO\w@IJCIWmXRXEVX(g^MREFTCLV,(p
[oBxAO{VZMA
@HD_W
U3,"gx
(hIFTD
JDG\OG^[MQMA_F]]
K\,EJF]]
MZG@A]
B(@KFZ
PA(3,^3,D3,M3,%9aAPC[\X
zXMAI\
TX_^MA,S3,j3,
3,n3,i3,
3,n3,i3,
3,i3,n3,
+=g5(Z0~4=?
(3,(3,3,(3jI%+=
CoCreateInstance
CLSIDFromString
CoInitialize
CoUninitialize
SysAllocString
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
ExitProcess
ExpandEnvironmentStringsA
GetCommandLineA
GetComputerNameA
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeThread
GetFileSize
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetTickCount
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatus
CopyFileA
InterlockedIncrement
IsBadReadPtr
IsBadWritePtr
LoadLibraryA
LocalAlloc
LocalFree
OpenMutexA
CreateFileA
ReadFile
RtlUnwind
SetFilePointer
CreateMutexA
TerminateProcess
VirtualQuery
CreateProcessA
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
lstrlenA
lstrlenW
CreateThread
DeleteFileA
GetWindowTextA
GetWindowRect
FindWindowA
GetWindow
GetClassNameA
SetFocus
GetForegroundWindow
LoadCursorA
LoadIconA
SetTimer
RegisterClassA
MessageBoxA
GetMessageA
GetWindowLongA
SetWindowLongA
CreateDesktopA
SetThreadDesktop
GetThreadDesktop
TranslateMessage
DispatchMessageA
SendMessageA
PostQuitMessage
ShowWindow
CreateWindowExA
DestroyWindow
MoveWindow
DefWindowProcA
CallWindowProcA
GetStockObject
SetBkColor
SetTextColor
CreateBrushIndirect
CreateFontA
GetUserNameA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
GetSecurityInfo
SetSecurityInfo
SetEntriesInAclA
__GetMainArgs
_sleep
_stricmp
memcpy
memset
printf
signal
sprintf
sscanf
strcat
strchr
strncmp
vsprintf
ole32.DLL
OLEAUT32.DLL
WININET.DLL
KERNEL32.DLL
USER32.DLL
GDI32.DLL
ADVAPI32.DLL
CRTDLL.DLL
Xt>@010
X(3,10
L!This program cannot be run in DOS mode.
.idata
.aajaic
+VH[h^
lQ(V8NnC]
znvvjl V$f^o
l#L9v5
nXj.XhXf.
j.b.'XK
8tZG2p
`^iXl^
gfldokC_
aNZl:I^
Kal/DK
6%l^pl^pl
x;lr3riXl
&m+Uo|
x^E29rh_
OdqJ o[
mlgdAW
6D^L~r
?zE22O
yy!7r3r
LVpl^s^
Sl<lx8
];Wcg)
E29r\_
lYIXlb
lm#86l__dp
<pf;_x#l1m^
lx;lzcf
^^n@zIe^iXlp
gXl._"c
[^i[Xl
_dqZ*P!
rpl^ph^pl^
pn^plj
JgXl"&)
l^pm.6J
l^pm.6J
c^n(_r
h^/m#^
l8[^S^
<pf;_nG
#_8gQ^
;pa;_r3r
x#lm^Km^pl
<pf;_r+r
LdC8l~
LdzJx^
) lFxgr
6H^pl^
}^I[l?Td
l*q^,b
l>kXl{S
^+{`:cnR
*. td
F-N,b
F-V,b
lE3F-_i
F-\i[l^
lZ-n["^^
[l["^^
*. Td
l]3f-]^
];m^a[l^
.QiXlf8x
l"[Q4^
mf-?f-R^
^i[lQ^
lY..]3cM[j
mV,'(b
^o {#j
[l f
^#iZl+J
R,"^#iZliXlr3XZ,o,
_rD72O
El^r'A
El*^r2A
pl^phX
;DAQS]
*.ody[l
iqJ$f)
l^Qxgc~
iOrJ m^
5x{b G
*.&R+N
PZo'r&j+Z
lUx X>
oN8[krZ
]P\o*rQhcl^nk
l+539N
l^P_o>rRX
\P_oRr&j+)
k{b$lW]
l^I:O|:
?RE29r0^
P>.\on
%KJ^+^
q&i%XlQ!
$lrlX:
lgdQV^
[ rR^oDr"l@x
^oxr"lTx ^ne
q&i%XlQC
fI:Gd<
G0lgvk
d^y.Q^
lcl^oh{
E29rK<
P^orb{b$0Y(_
CZ:lb=^L;D;2^
_rplB=^x
_rplx#
6l^ph^pl^
\pl^L=
Qr+rpl
IldeG`+
UP^oh=Z$Beg`)
m9O62^
?VE29rK?
Mt%~r3r|
lx;lx;lx;lv#
_oj_^)Q,_
1lwg+R
Q(__{#nZ
cLL3wm^
X3OmsP
)#__^^
j__`gcyP
^1x.#r#;g:
WltZ._
hZ.] F
Wlg9Q:
CWl`Z._
_=oy'XlN)
Q?XlO*xn.
_ohx3trr
&%^) 4
lr3rpl^pn^pl^
w=odC.
I:oxDxP]
6%l^pl^pl
+Rlo,9r
MJ)8))>"
6l^pl^pl?.*^.
wr+r(ZyXlr
lrh+{b$l
vP^oNrRX
Yl_zi>^+
Xl*^8)
l/v l^
P^orpdp
)^R)^f^
)^(^f^
^ldr3rg^
C4l/^^
{Xl|x#:lom^G\m^^6^
C&Wrv^
[ldr3ro^
&m+<8Ez
S^FS^f^
S^R^f^
XlVR^6R^f^
:R^Q^f^
6$^MYc
w=W^f^
6$^M]e
?Vpl^pn^pl^
6"^r&&
{rg_d{f
w<oVx :
/-lOdv
<^pl~pl^plv
<+.ZY^ow
P,e *p
lCIGl~:
lzEB^kx
JI:GxD
_^O_^Oz_^
X ,Z]^
pl6?^pl^
E29r$^
5le;Q^
CB:lC^I:GdE
X^_^f^
=Sel_^f^
]^j]^f^
*]^w^r
~\^:\^f^
K*ld^pl\pl^rl^Z?
<JG^Jq
lCrHl~
cr3rp(^C
pl^pL^pl^
{1le;+
^F^rg'
NI:GdD}&
G3lo`v
lJ^L;D
6Ym^Y[l
^pn^pl[pm^pl^r^
lrpm4*
lr+rpm4*v-*D^pm4*~-:D^pm4*
D^pm4**.
c=l:^r}
G=l&^r}
[l,4r-J^p
Zl,4B,J^p
Xl,4v-J^p
Zl,4~-bJ^Y
=6^L~x
[lz^j^plrJ^)
lr3rpl
k.^pl_
^<.6^rl^
u_x~<Jpx^
p=JreJ
l^plVpx
?l<4l4
l6v^r
<.6^pl
l^Y[l^Y[lNr
lvrl^J
6l^px]
Xl^r/^
w>l6o^pl
l^Y[l^YXlr
^Y[l^Y[lNpW
l6rm^rl^J
l6I^r
!Xl^k^
[l^Y[l^Y[lNr^
l:rl^J
oXl^Y[l^YXlFr@^
'Xl_.6
Xl^Y[l^YXlFr^
kXl_.6
Zlr3rpl
^ptvr^
lM^Dd
'Xl_.6
[l^Y[l^Y[lIr^
zmt^r
[lr3rpl
k.^pl4&
[lz[U^pl
!Xl^S^
Xl^pn^pl[pm^pl^r^
lrpm4*Z-s^pl
:pxJroJ
Xl^r/^
XHpl_r"^
-Fs^x^pl
l^Y[l^YXlr
^<.6^pl
l^Y[l^YXlr
6l^roJ
l6I^r
!Xl^g^
oXl^Y[l^Y[lNr^
l@rl^J
lzq^pn
l>q^Dd
z)g^pl
^rm^ox
rzp^rK
_=p^c^
l{#jOr'J
l{#fOrJ
{#`OrMI
6X^r'"
VplRt^E2
z.d^I:
"t^lEx=r:
Un^Q[l+-
^pl^#^
lzx8^r,E
l|^I:)h&s
lE#VXd
l6l^rZ
m^iXl?
E15roc
^plZpl^rl^Z
\pl^JYQ
Zj-_v[
l_r3rro^
c^)+_^
^l.6^pl
lhC.`^r
8,hl`^pm
<^plj,4
,Zl^pl
lr3rQXlQ^
XlX6.]
:.^QXl+
.*^W*.*&Wn-*.W-*6W
.*>W".*
lr+rr^
l~pl^r?#
.Ff^9^
^oL^plP.4
nfhgdL^pl.4
fg^6l^
v-.d^A^
]nL^plr.4
^oL^plO.4
rpl^ph^pl^
i^QXl+]n,
Xl'.6J
^rm^[x
RI:odDwm
r-nh^!Y[lUYZl
<e/Dd
lk:^ox{cj
lk:^oN{cj
_r+k^ojpC:^!Y{XlXq[lr3r!Y[lXq[lk
^!Y[lXqXlk:^ojpC6^!Y
XlXq[ln~
l^IXlk
l^IXlk
l^IXlk
l^IXlk
,Ji^_nEr]
LmQknix:
l^8V+B
l^IXlk
l^IXlk
l^IXlk
l^IXlk
l^IXlk
l^IXlk
l^IXlk
l^IXlk
l^IXlk
l^IXlk
l^IXlk
l^IXlk
l^IXlk
l^IXlk
l^IXlk
l^IXlk
l^I{Xlk
l^IsXlk
l^IwXlk
l^IkXlk
l^IoXlk
l^IcXlk
l^IgXlk
l^I[Xlk
l^I_Xlk
l^ISXlk
l^IWXlk
l^IKXlk
l^IOXlk
l^ICXlk
l^IGXlk
l^I;Xlk
l^I?Xlk
l^I3Xlk
l^I7Xlk
l^I+Xlk
l^I/Xlk
l^I#Xlk
l^I'Xlk
l^I Xlk
l^IXlk
l^IXlk
l^IXlk
l^IXlk
l^IXlk
l^IXlk
l^IXlk
l^IXlk
l^IXlk
l^IXlk
l^IXlk
l^IXlk
l^IXlk
l^IXlk
l^IXlk
l^IXlk
l^IXlk
l^IXlk
l^IXlk
l^IXlk
l^IXlk
l^IXlk
l^I{Xlk
l^IwXlk
l^IkXlk
l^IoXlk
l^IcXlk
l^IgXlk
l^I[Xlk
l^I_Xlk
l^ISXlk
l^IWXlk
l^ICXlk
l^IGXlk
l^I;Xlk
l^I?Xlk
l^I3Xlk
l^I7Xlk
l^I+Xlk
l^I/Xlk
l^I#Xlk
l^I'Xlk
l^I Xlk
8]~0Am?l(Q[m!
62Al>C7$
p5Va![i9Gmk
k~Zw4K79C
p5Va![i9Gmk
6>_v|Qx:
k~Zw4K79C
k~Zw4K79C
Al8]})
i!3q%C#~Ul:
k~Zw4K79C
~=W|"Rw
Al8]})
i!3q%C#~Up4@|#Pq#F6?W|
CqQ[m!
]t#F6?W|
CqQ[m!
6#\j?V
Al8]})
i!3q%C#~_v8]~5
p5Va![i9Gmk
6&D74Wu?V7$
p5Va![i9Gmk
p5Va![i9Gmk
60Pr#@7'
p5Va![i9Gmk
64Gq#W78I6?W|
CqQ[m!
Al8]})
q<3q%C#~Tx|Ck<
k~Zw4K7%^
i>^v#F6?W|
[mQ[m!
6!\m4R
Al8]})
q<3q%C#~Xx4G7$
p5Va9Gt9Gmk
p5Va9Gt9Gmk
w~Zw4K7%^
Al8]})
q<3q%C#~^x0Ux0
k~Zw4K7%^
a0A|2Y{?Vm8]})
q<3q%C#~Xv7Zj0G7#T6?W|
[mQ[m!
p5Va9Gt9Gmk
68Wv|Qx:
k~Zw4K7%^
Al8]})
q<3q%C#~_}#X7<
k~Zw4K7%^
p5Va9Gt
~p#\j7G
>Um0A|
Zz>@v%3
v@?G}=
}=3K=zw%fw2\}
%fw0CO4DV
Vz8\w GV4]J2Gp?3W
Ri8Vn7`|%ZvQam GJ0Gl
\]"vk>A
3LtO=G=/=~#Edn
G=O=D?A3
Q3P5mC
G=O=D?Y3
x\Qck2Vjb
%bl#JJ"G|
#^x8\wQ3
+5_uQ3w5_u5_uQ3
Q3r#]|b
QX|?Vuc
Q3r#]|b
QDz2^iQ3
Qep%Fx
Av4PmQ3
Fk4]m#\z"@PQup5dp5\nQ3
Q`|5~|"R~
Qzj0WK0WI#3
QX|?Vuc
:2U0pgq"
z?]vqQ|#Fw8]9
`9>W|\>
Q=8P1.W3
Q3y#Wx03
Q3Y5RmQ3
Q38Wx03
Q3#Vu23
Q39]lGf
eN;3s9
fvS!Q#U%Q#O
(=*Lp:#s
]ds;UR3
vl7)A:ZY
E`OvQ3
=%c%`>dQt
|aFQ[M3
t2tlG
t3XAQ3
t7XAQ3
t;XAQ3
t?XAQ3
3P}7Tq;Xu?\
"o<QXr23
|Qva%ck2VjQ3
]o#\w4]m%Ap6@XQ3
Qpu"VQ?WuQ3
Jj4^]#Vz>A`Q3
/P|i?~l4KXQ3
Plv4]F"Uq?WuQ3
SUz>@|Q3
Qlz)ZmQ3
S^x=\zQ3
S@i8]mQ3
S@m2C`Q3
a>(`((`(
`(c<+c
+Cc*eH-d
,dq,di,dA,d,kd,Sd,;d,#d3
+cg+co+cW+c3
u90@9>W|qQ`
t5Vk%\k>U9#Fm!
wQd|2\tqGv>Fk7\k< 95Fuqd|q~x%Vkp
q%C#~Pk%\i?F
~5&Vu>^|%\9
Qzw>Ak2G9
}5!_|"V52\k4Pm
_|"V54]m#
?Pv#VzqpOc
1|Wp8G9>W|>]90Pr>U90A}}
z#A|%3I4Rj}
|%Vk(\lqpOc
1|Wp8G9>W|>]90Pr>U90A}Q
=Vx4 94_|%
\!Zk%Zvqj|#3I4Rj}
j=Vzqva8Ax8\w
\w93P2\k4Pm
Rkq}l3VkqCu0@|qPv#VzQcu0@|qVw4A9>Fk
Rkq}l3Vkt@9"3I4Rj}
|%Vk2\k4Pm
Fuq}x43I4Rj}
j=Vzqpx5
Rj4AZ#W07AtQa|8@m#`|'Zz
Av4@j:Vk4_*
WuQ@l7
}%3}:X7=_
+'K}:X*
p9Gtt@E%WatZ70G
j~p9"3E>^t?W7>^
"oz<^x5
j2^}!Z
)$3v"lrQEo$Cr?3z$GvQB
:3I4Rjq^x4
z#A|%Zv"
x0ZwQfw3_|%\9$Gq#Zc
k Fp4W9>
z<Cu%V99V9#Rw0Pm>]7[
Fm>Ap0Gp?
\w8]lQqL
wPQrMqcP|pv43*5Z~%
o=Z}%ZvqPv4
1'E+Qjv#
z#W9$^{#3Z#W9w
|!Zk%ZvqWx43_=_90^|
ZjQ~x%Vk0A}
qVQcu0@|7ZuqZw%[|2\k4Pm8]
#^x8\w%\94Ap(
`$A95Vw8G`Qq|>A|"Z~8]~8]5!_|"V9>]
#^99Rm(\l0A|%[|>Dw#
0F}>]9$A94Qj%V5&V9#V9?W|%Rr?T9qC|8\}#Vo4D97
t<Q|qRz>Fw"
z?Gp$ZwqPv<Zm4]m%\9#\m2G9>Fk0Pz$]m0]}%\94Wl4
p"Gx2V
94Pl8G`
Vx$A|Q`M
)Cu#Vk
\z3Y|%3+t
j4GM<Vv%
!Rk?G7>Px8\ws
?Pm>]9y
7Qk4:a|'
v_0^|t@<q
98Pk"\
qzw4Aw%
\!_v4A
Vaq3I%[
>Um0A|
Zz>@v%oPq`|$CE4GlQJ|Qqk&@|4DI>P|"37
Zz>@v%oN?Wv"oZ#A|%e|"Zv
va=\k#o[>Dj Vn#\z"@
=\{=fj#|
=ZwQ`v%Dx4oT2Av>Um
Fk4]m4Aj>]E?G|?Vm
Vm8]~Q
vE8Pk"\
]m#]|q`|%Zw"oC?VjtF
Zt>FmsI1s <x
j>Pl4]mt@7$Qt%
$]z8\w+
0m@z8CmQ
p!Fm%Jil
't@ew]{!
p!Fm%Jil
|8G;'Ru4
'3A'[3pQ
m!V$4Wps
'3A'[3%#
#^92Gp?
`Mq]x4
7$3%>W`Q
64R}Q~p#\J7G4>Ait@%8Guo
68Guo3%4R}Q
z3_p5ll4A
4Q9'Vwq
~p#\j7GE8]}&@E$Ak?GO#@p?oJ4_u4Ao2VV;Vz
v53X0Am4]m
[k0Wp6~v4_
zw#\z4Ao#
}=3bhu\
_|6GqtZD
z<3n3^x=
s?\7>^
s?\7>^6~37$]v2\t
Vx%[u?X7
Z~qzw"Z~8]73R`Q
Cx!Ru2\tQ3
[3T2Av>Um
]m#]|qva=\k#3
Q3_G?R
CoCreateInstance
CLSIDFromString
CoInitialize
CoUninitialize
SysAllocString
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
ExitProcess
ExpandEnvironmentStringsA
GetCommandLineA
GetComputerNameA
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeThread
GetFileSize
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetTickCount
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatus
CopyFileA
InterlockedIncrement
IsBadReadPtr
IsBadWritePtr
LoadLibraryA
LocalAlloc
LocalFree
OpenMutexA
CreateFileA
ReadFile
RtlUnwind
SetFilePointer
CreateMutexA
TerminateProcess
VirtualQuery
CreateProcessA
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
lstrlenA
lstrlenW
CreateThread
DeleteFileA
GetWindowTextA
GetWindowRect
FindWindowA
GetWindow
GetClassNameA
SetFocus
GetForegroundWindow
LoadCursorA
LoadIconA
SetTimer
RegisterClassA
MessageBoxA
GetMessageA
GetWindowLongA
SetWindowLongA
CreateDesktopA
SetThreadDesktop
GetThreadDesktop
TranslateMessage
DispatchMessageA
SendMessageA
PostQuitMessage
ShowWindow
CreateWindowExA
DestroyWindow
MoveWindow
DefWindowProcA
CallWindowProcA
GetStockObject
SetBkColor
SetTextColor
CreateBrushIndirect
CreateFontA
GetUserNameA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
GetSecurityInfo
SetSecurityInfo
SetEntriesInAclA
__GetMainArgs
_sleep
_stricmp
memcpy
memset
printf
signal
sprintf
sscanf
strcat
strchr
strncmp
vsprintf
ole32.DLL
OLEAUT32.DLL
WININET.DLL
KERNEL32.DLL
USER32.DLL
GDI32.DLL
ADVAPI32.DLL
CRTDLL.DLL
B B B B B B B B B B B B B B B B B B
B B B B B B B B B B B B B B B B B B
Hosts
| IP |
|---|
| 114.114.114.114 |
| 8.8.8.8 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 61714 | 8.8.8.8 | 53 |
| 192.168.56.101 | 56933 | 8.8.8.8 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 8.8.8.8 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.