1.5
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.49
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:AutoIt-BYV [Trj] | 20200425 | 18.4.3895.0 |
| Baidu | Win32.Worm.Agent.y | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200426 | 2013.8.14.323 |
| McAfee | Generic VB.jc | 20200426 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b0cc19 | 20200426 | 1.0.0.1 |
静态指标
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(1 个事件)
| section | .imports |
文件包含未知的 PE 资源名称，可能指示打包器
(2 个事件)
| resource name | PERS |
| resource name | SETTINGS |
动态指标
在 PE 资源中识别到外语
(1 个事件)
| name | SETTINGS | language | LANG_ARABIC | filetype | None | sublanguage | SUBLANG_NEUTRAL | offset | 0x0006fcc8 | size | 0x00000156 | ||||||||||||||||||
可执行文件使用UPX压缩
(2 个事件)
| section | UPX0 | description | 节名称指示UPX | ||||||
| section | UPX1 | description | 节名称指示UPX | ||||||
网络通信
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
文件已被 VirusTotal 上 62 个反病毒引擎识别为恶意
(50 out of 62 个事件)
| ALYac | DeepScan:Generic.MSIL.PasswordStealerA.26685368 |
| APEX | Malicious |
| AVG | Win32:AutoIt-BYV [Trj] |
| Acronis | suspicious |
| Ad-Aware | DeepScan:Generic.MSIL.PasswordStealerA.26685368 |
| AhnLab-V3 | Worm/Win32.Shakblades.R241382 |
| Antiy-AVL | Worm/Win32.Shakblades |
| Arcabit | DeepScan:Generic.MSIL.PasswordStealerA.D1972FB8 |
| Avast | Win32:AutoIt-BYV [Trj] |
| Avira | BDS/Backdoor.Gen |
| Baidu | Win32.Worm.Agent.y |
| BitDefender | DeepScan:Generic.MSIL.PasswordStealerA.26685368 |
| BitDefenderTheta | AI:Packer.4621CB3621 |
| Bkav | W32.AIDetectVM.malware |
| CAT-QuickHeal | Worm.Ainslot.A3 |
| CMC | Worm.Win32.Shakblades!O |
| ClamAV | Win.Trojan.Blackshades-2 |
| Comodo | Packed.Win32.MUPX.Gen@24tbus |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.2d38fb |
| Cylance | Unsafe |
| Cyren | W32/Hupigon.D.gen!Eldorado |
| DrWeb | Trojan.Inject.51371 |
| ESET-NOD32 | Win32/Ainslot.AA |
| Emsisoft | DeepScan:Generic.MSIL.PasswordStealerA.26685368 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/S-0ec7d9be!Eldorado |
| F-Secure | Backdoor.BDS/Backdoor.Gen |
| FireEye | Generic.mg.65897242d38fbe71 |
| Fortinet | W32/Cospet.HA!tr |
| GData | DeepScan:Generic.MSIL.PasswordStealerA.26685368 |
| Ikarus | P2P-Worm.Win32.BlackControl |
| Invincea | heuristic |
| Jiangmin | Worm/Shakblades.zs |
| K7AntiVirus | NetWorm ( 700000151 ) |
| K7GW | NetWorm ( 700000151 ) |
| Kaspersky | Worm.Win32.Shakblades.wvd |
| MAX | malware (ai score=85) |
| Malwarebytes | Trojan.Agent |
| MaxSecure | Worm.Shakblades.WVD |
| McAfee | Generic VB.jc |
| McAfee-GW-Edition | BehavesLike.Win32.Backdoor.gm |
| MicroWorld-eScan | DeepScan:Generic.MSIL.PasswordStealerA.26685368 |
| Microsoft | Worm:Win32/Ainslot.A |
| NANO-Antivirus | Trojan.Win32.VB.ebynje |
| Panda | Generic Malware |
| Rising | Backdoor.VB!1.651D (TFE:dGZlOgUYXFKyCyVwjQ) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Mal/Generic-G |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2011-07-25 01:13:21
PE Imphash
58fb7fafd0cf99568cf6a5a9bf62c650
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| UPX0 | 0x00001000 | 0x00048000 | 0x00048000 | 5.960932072153658 |
| UPX1 | 0x00049000 | 0x00029000 | 0x00028600 | 5.066744659903652 |
| .rsrc | 0x00072000 | 0x00001000 | 0x00000200 | 3.0778188609149804 |
| .imports | 0x00073000 | 0x00001000 | 0x00000200 | 3.5325278412267864 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| PERS | 0x0006f0c8 | 0x00000c00 | LANG_SWEDISH | SUBLANG_SWEDISH_FINLAND | None |
| SETTINGS | 0x0006fcc8 | 0x00000156 | LANG_ARABIC | SUBLANG_NEUTRAL | None |
Imports
Library MSVBVM60.DLL:
• 0x401000 EVENT_SINK_GetIDsOfNames
• 0x401004 None
• 0x401008 None
• 0x40100c None
• 0x401010 MethCallEngine
• 0x401014 EVENT_SINK_Invoke
• 0x401018 None
• 0x40101c None
• 0x401020 None
• 0x401024 None
• 0x401028 None
• 0x40102c None
• 0x401030 None
• 0x401034 None
• 0x401038 Zombie_GetTypeInfo
• 0x40103c EVENT_SINK2_Release
• 0x401040 None
• 0x401044 None
• 0x401048 None
• 0x40104c None
• 0x401050 None
• 0x401054 None
• 0x401058 None
• 0x40105c None
• 0x401060 None
• 0x401064 None
• 0x401068 None
• 0x40106c None
• 0x401070 None
• 0x401074 None
• 0x401078 None
• 0x40107c None
• 0x401080 EVENT_SINK_AddRef
• 0x401084 None
• 0x401088 None
• 0x40108c None
• 0x401090 None
• 0x401094 DllFunctionCall
• 0x401098 None
• 0x40109c None
• 0x4010a0 Zombie_GetTypeInfoCount
• 0x4010a4 EVENT_SINK_Release
• 0x4010a8 None
• 0x4010ac None
• 0x4010b0 EVENT_SINK_QueryInterface
• 0x4010b4 __vbaExceptHandler
• 0x4010b8 None
• 0x4010bc None
• 0x4010c0 None
• 0x4010c4 None
• 0x4010c8 None
• 0x4010cc None
• 0x4010d0 None
• 0x4010d4 None
• 0x4010d8 None
• 0x4010dc None
• 0x4010e0 None
• 0x4010e4 None
• 0x4010e8 ProcCallEngine
• 0x4010ec None
• 0x4010f0 None
• 0x4010f4 None
• 0x4010f8 None
• 0x4010fc None
• 0x401100 None
• 0x401104 None
• 0x401108 None
• 0x40110c None
• 0x401110 None
• 0x401114 EVENT_SINK2_AddRef
• 0x401118 None
• 0x40111c None
• 0x401120 None
• 0x401124 None
• 0x401128 None
• 0x40112c None
• 0x401130 None
• 0x401134 None
• 0x401138 None
• 0x40113c None
• 0x401140 None
• 0x401144 None
• 0x401148 None
• 0x40114c None
• 0x401150 None
• 0x401154 None
• 0x401158 None
• 0x40115c None
• 0x401160 None
• 0x401164 None
• 0x401168 None
• 0x40116c None
L!This program cannot be run in DOS mode.
sisisi
ldsiRichsi
.imports
{T){I^
R_FB.Nbss_server
ww.face
= True
usrReverseRelay
DDF5KN
4~Go98
", "SysWusrRelay
"\winloK;LlR
PrivateSocket
rWGf/K
7rg,@\KZ
_<sGOL%4:O3f
frmMain
tmrLiveLogger
tmrIntervalUpdate
usrReverseRelay
bss_server.usrReverseRelay
tmrGrabber
sckFormGrab
bss_server.usrRelay
tmrFocus
tmrAlarms
picThumb
picThumbSize
tmrDoWork
tmrPersistant
tmrWebHide
tmrInfoTO
sckInfo
bss_server.Socket
tmrAudio
sckServer
bss_server.Socket
tmrCrazy
tmrAlive
tmrScreenshot
sckRelay
bss_server.usrRelay
tmrDOS
tmrInaktivitet
picScreenshot
tmrSprid
tmrSpara
tmrAnslut
sckTransfer
bss_server.Socket
VB5! *
bss_server
lhR(PC
$krllA
krll. A
qX-\- lXi
f=3t)D
f=3,qC
f=3xMC
f=3 @C
f=3xpC
f=30bC
f=3lkD
q0<l0i
q0<l0i
7rg,@\KZ
E@kAU@6
y1uC><
.qk1v@#R/
f=3$fC
f=3loD
f=3H9C
f=3hLC
f=3\PC
f=3d7C
f=3 [C
stGGWGf/K
Y=9iIN
bss_server.Socket
Socket
V5/*R X2XJ[R
Kj+F7AO'?CI#
bss_server.usrRelay
usrRelay
L%M8i4~Go9
DDF5KN
T%aYI~5W=]
bss_server.usrReverseRelay
usrReverseRelay
<WA\yY{
.L?kGb
l;J*JFh'o
mswinsck.ocx
MSWinsockLib.Winsock
Winsock
f=38sC
f=3d9D
f=3DVC
f=3$CC
f=3T%C
f=3($C
f=3HLD
f=3<;C
f=3,5C
f=3TED
f=3(&C
f=34DC
f=3@"C
f=3\ C
f=38dC
f=3$;D
f=3l#C
f=3pJD
f=3xPE
f=3@`C
f=3xeD
f=3DOC
f=3dzC
f=3L,C
f=3t+C
f=3p!C
f=3lmD
f=3\}C
f=3lHC
f=38xC
f=30gD
f=3LlC
f=3DYC
frmMain
modFuctions
modSpread
modAPI
modSocketMaster
CSocketMaster
socket
frmSck
usrRelay
modIInet
modICallBack
WinInetAsync
modPWs
modLaunchWeb
cCDECL
modRegistry
cSubCls
iSubCls
modSniff
modSqueezer
modAudio
frmHijack
modHijack
frmChat
modInfect
modTorrentSeed
modInjPE
modCrypt
cImage
modScreencap
mWinsock
modBtKiller
usrReverseRelay
fSteam
modENC
bss_server
tmrAudio
_<sGOL%4
vL[nr).
7rg,@\KZ
5L,&oyP+O3f
MBROWSER_FB
C:\Windows\SysWOW64\ieframe.dll
SHDocVw
Kj+F7AO'?sckFormGrab
tmrAnslut
+3qC:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
tmrSpara
tmrIntervalUpdate
tmrDOS
tmrDoWork
tmrFocus
tmrWebHide
wisckTransfer
tmrGrabber
sckServer
tmrSprid
tmrInfoTO
tmrAlarms
tmrInaktivitet
tmrPersistant
picThumb
picThumbSize
picScreenshot
tmrScreenshot
tmrAlive
sckRelay
tmrLiveLogger
Y=sckInfo
tmrCrazy
TheBrowser
winmm.dll
mciSendStringA
user32
SetCursorPos
SwapMouseButton
FindWindowExA
FindWindowA
C_Mutex
iSubCls_Antes
iSubCls_Despues
GetBrowserName2
PATH_WINLOGON
TheBrowser_BeforeNavigate2
TheBrowser_OnQuit
BROWSER_FB_DocumentComplete
BROWSER_FB_OnQuit
FACEBOOK_START
user32.dll
SetTimer
KillTimer
advapi32.dll
GetUserNameA
kernel32
GetComputerNameA
shell32.dll
SHGetFolderPathA
GetTempPathA
GetDesktopWindow
GetWindow
GetWindowTextA
IsWindowVisible
GetWindowRect
MSVBVM60
__vbaStrToAnsi
kernel32.dll
SetFilePointer
FlushFileBuffers
CreateFileA
WriteFile
GetFileSize
GetVolumeInformationA
GetDiskFreeSpaceA
BringWindowToTop
GetLogicalDriveStringsA
avicap32.dll
capGetDriverDescriptionA
SystemParametersInfoA
GetDriveTypeA
MoveFileExA
advpack.dll
IsNTAdmin
GetTickCount
GetLastInputInfo
GetLocaleInfoA
GetAsyncKeyState
CloseHandle
CallNextHookEx
SuspendThread
SetWindowsHookExA
UnhookWindowsHookEx
ToUnicodeEx
GetKeyboardLayout
GetKeyboardState
GetKeyState
PSAPI.DLL
Sensapi
IsNetworkAlive
ToAscii
SHFileOperationA
GetForegroundWindow
GetWindowTextLengthA
FindClose
FindFirstFileA
FindNextFileA
CreateProcessA
CreatePipe
ReadFile
CreateMutexA
ReleaseMutex
WaitForSingleObject
avicap32
capCreateCaptureWindowA
RtlMoveMemory
SendMessageA
RtlAdjustPrivilege
NtSetInformationProcess
GetWindowThreadProcessId
TerminateProcess
OpenProcess
CHAT_ADDMSG
GetModuleFileNameExA
EnumProcessModules
CreateToolhelp32Snapshot
Thread32First
Thread32Next
OpenThread
txtChat
ResumeThread
advapi32
OpenSCManagerA
OpenServiceA
StartServiceA
ControlService
CloseServiceHandle
iphlpapi
GetTcpTable
WSOCK32
inet_ntoa
SetWindowPos
IsWow64Process
GetModuleHandleA
GetModuleFileNameA
GetCurrentProcess
ExitWindowsEx
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
SetLastError
EnumWindows
WinInet.dll
DeleteUrlCacheEntryA
urlmon
URLDownloadToFileA
ShowWindow
tmrCheck
BlockInput
SetForegroundWindow
SetFocus
ShellExecuteA
InternetGetCookieA
InternetSetCookieA
PostMessageA
DestroyWindow
keybd_event
ExitProcess
`f9*!!N
txtMain
+3q"=h
VBA6.DLL
+3qClass
C:\Windows\SysWow64\msvbvm60.dll\3
GetWindowLongA
ws2_32.dll
IsWindow
SetWindowLongA
AddMsg
SubClass
UnSubclass
closesocket
GetDiskFreeSpaceExA
WritePrivateProfileStringA
SetFileAttributesA
GetClassNameA
DragQueryFileA
GlobalAlloc
GlobalLock
GlobalUnlock
EmptyClipboard
OpenClipboard
CallWindowProcW
CallWindowProcA
GDIPlus
GdiplusStartup
LoadLibraryA
GetProcAddress
__vbaCopyBytes
GetVersionExA
GetWindowDC
BitBlt
SetStretchBltMode
StretchBlt
ReleaseDC
GdiplusShutdown
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipSaveImageToFile
CLSIDFromString
mciGetErrorStringA
GlobalFree
WSAStartup
WSACleanup
WSAAsyncGetHostByName
WSAAsyncSelect
CreateWindowExA
lstrlenA
lstrcpyA
=s*=h
+3qx{KL
socket
connect
gethostname
gethostbyname
getsockname
getpeername
inet_addr
sendto
getsockopt
setsockopt
recvfrom
WSACancelAsyncRequest
listen
accept
ioctlsocket
WndProc
RemotePort
RemoteHost
RemoteHostIP
LocalPort
LocalHostName
LocalIP
BytesReceived
SocketHandle
protocol
CloseSck
Connect
SendData
GetData
PeekData
Listen
Accept
ConnectionRequest
DataArrival
SendComplete
SendProgress
I .P$#A
WSOCK32.DLL
WSAIsBlocking
WSACancelBlockingCall
WSAIoctl
WSAGetLastError
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
FreeLibrary
GetCurrentProcessId
Process32First
Process32Next
VirtualQueryEx
ReadProcessMemory
TerminateThread
ntdll.dll
NtQueryInformationThread
GetSystemInfo
WideCharToMultiByte
VirtualAlloc
RtlZeroMemory
RegCreateKeyA
ole32.dll
CoTaskMemAlloc
CoTaskMemFree
VirtualFree
LocalFree
LocalAlloc
CredEnumerateW
CredFree
crypt32.dll
CryptUnprotectData
oleaut32.dll
SysAllocString
RegDeleteValueA
RegOpenKeyA
RegEnumValueA
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptSignHashA
CryptDestroyHash
CryptReleaseContext
wininet
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
%9?J["P)j.qk1v@#R/o5%"SM
imgLoginPressed
imgLogin
txtAccName
txtPassword
tmrKill
imgRemember
imgSteam
imgMinimize
imgClose
RegDeleteKeyA
RegSetValueExA
RegEnumKeyExA
CreateCompatibleDC
CreateCompatibleBitmap
gdi32.dll
SelectObject
DeleteDC
DeleteObject
olepro32.dll
OleCreatePictureIndirect
InternetOpenA
InternetSetStatusCallback
InternetConnectA
InternetReadFile
InternetOpenUrlA
InternetQueryDataAvailable
FtpGetCurrentDirectoryA
InternetCloseHandle
SleepEx
OFJq 6|
FtpGetFileA
FtpPutFileA
FtpSetCurrentDirectoryA
FtpOpenFileA
FtpGetFileSize
FtpDeleteFileA
FtpCreateDirectoryA
FtpRemoveDirectoryA
FtpRenameFileA
Disconnect
FtpDownload
FtpUpload
FtpGetDirectory
Http_DownloadFile
LastError
^HKlYF;(4
DoA>xdA
cmSocket_SendProgress
UserControl
cmSocket
cmSocket_CloseSck
cmSocket_Connect
cmSocket_ConnectionRequest
cmSocket_DataArrival
cmSocket_Error
cmSocket_SendComplete
D{UlB%,<d@
E@kAU@6g
TGI4#-
vtmrTCP
l;J*JFh'oUDPSocket
JC:\Program Files (x86)\Microsoft Visual Studio\VB98\vbc14663.oca
MSWinsockLib
tmrUDP
UDPFlood
HD3MeP
RemoteSocks
LocalSocks
StartListen
ActiveHosts
StopListen
SocketEvent
#If2o/D
GetLastError
GetMem4
PutMem1
PutMem2
PutMem4
PutMem8
z_DO_NOT_CALL
CallFunc
DllLoad
DllUnload
WrapCallback
SHGetPathFromIDListA
SHGetSpecialFolderLocation
GetPrivateProfileStringA
Enumerate
Despues
h2LND'^}
.y1uC><
sQK#H-
lstFiles
lblHeader
lblTimer
lblInfo
lblInstructions
tmrCountdown
cmdShowfiles
tmrBlink
PRINT_INSTRUCTIONS
-U$<PN;`
CreateDIBSection
CreateDCA
LoadImageA
GetDIBColorTable
SetDIBColorTable
GetDIBits
GetObjectA
msvbvm60.dll
VarPtr
PlgBlt
Height
BitCount
DIBitsPtr
BytesPerScanLine
Create
CopyHDC
DecryptString
EncryptString
EncryptByte
DecryptByte
"JS?1mj
L%M8i16!D
DDF5KN
4~Go9ThreadStart
StopSockets
xY:O3f
frmChat
tmrCheck
txtChat
txtMain
E@kAU@6Gn&%
frmSck
UDPSocket
MSWinsockLib.Winsock
MSWinsockLib.Winsock
tmrUDP
tmrTCP
HD3MeP
usrRelay
LocalSocks
bss_server.Socket
RemoteSocks
bss_server.Socket
shpLogo
usrReverseRelay
LocalSocks
bss_server.Socket
RemoteSocks
bss_server.Socket
shpLogo
y1uC><
h2LND'^}:O3f
frmHijack
tmrBlink
lstFiles
cmdShowfiles
Show hijacked files
tmrCountdown
tmrCheck
lblInstructions
MS Sans Serif
lblTimer
MS Sans Serif
lblInfo
MS Sans Serif
lblHeader
MS Sans Serif
Socket
??????????????????????????????????????????????????????????????????????????????????????????????????????????????????_X_PPP @@@@@PPP``````@`` ??????@@@opp@@@@``?
??????
?????? @
ppp
?????? Ppp@@
@@@@@@@@``````PPP@``???????8?00
` `@@@@@@@@@???????8?oo@@
`````` ``
PPP???????8?o00P
p ```???????8?
@`@@@@@@@???????8?
@@@@???????8?
?`````````@@@@???????8?
ppp ???????8?
PPP???????8?
``???????8?
@ ``???????8?
@@@@???????8??8??8??8??8???????????????????????????????????????????????????????????????????????????????????????????????????????5
.qk1v@#R/
fSteam
tmrKill
tmrFocus
txtPassword
Tahoma0
txtAccName
Tahoma0
imgLoginPressed
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
`03?K7
w ]M{{
MJEYTXoR
SxF{Ap
n'omX$"sI
w ]OQP
.F2.e^
<=N7i#YG*
kUDz|:XYi[$h=:
SxAZ>#xR
u >63Os-m/
3O;y!]
$-'VR0f-`
x|YOj+
]SM<$"FX
_7G-ozi+
'bk-NMP
?xW?5|_
p=n*+)A
q\=$I#
imgLogin
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
->g{<]=s9/*1
wQ\V:c-
2 PNhZ6ko4XE
-Rk9$Xi#
/}|?.x?
~` .4@%\+
F?:%gc
?j_q?:nu^~
W+?:?@\'
?j_q?:
JqOc|a
F' v@0OC
,v ^ku
7 ] ^=
imgRemember
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
/7Oq=7.3
L,t}OZQ
V 2y/^iq,r V
}yWD6\
Lm*t?o
x{LO_lllP[s
QkWR0A
{9J(2?
imgClose
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
0F?;n (
imgMinimize
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
g; zt^:
imgSteam
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
Ci4wI,bgv1$$
6MjS.=m
\i8yqq
B2?h-ex
|?M x_
F<3K=/X[
.Si7\]@g
8q$M_vG
I:n[w5Y-Be+."
;B2~p;
|?M x_
|?M x_
|?M x_
Am2S5X
(;[[Gw
&4Pks
Oxn5ui~9
"uRSMvnu
BM }(P
QX_G}"\$J
T*_Z_4
2K[[Uy%B,
R< t}I0;
\j,IlrI<] k
o>~u>@\y o>
/t}?:>}GY
OQ?:] k.j}
o>~u>@\y o>
/t}?:>}GY
OQ?:] k.j}
o>~u>@\|
,wQE3"\``
Q]EgxvL,lg
>@\ln<[n
=>,|2H
j6u>"EYdR<|(
eo>y?v?
xSZuI^
RM.e S
}wGm).s[Z
2@%I;X
UrZ/<9["4kI
V(o>y?nIg"}
>y?nAk|-=[gi,W
tC~z/g{<Skj^K&5
}h|NXdrlm2!
9f,a!$
C$%Q_Q"
~6:,zv7'Pqmp[
c<#23.Db
O`-}yg
N_kwVo
n]K\T1
\cWEOR
k$m$wZ
Fkh`>&|q
[ZG8>'-rF
xCL<1"
.h%cWlR)!sE
_#a$R$d`
3Ev^8?y
|EFA&|GU&f
Rgn`U\FX
*{xC&XJ<FT
>.$/$S
2[ZDq+T
(Z{^YZ-
6Xh"!I!H$
D/ u/w
k}B-QV
,9X&Ds>a(s_
pXos.t
#U_rK!(?
:E{P[izijqt
c7_hc2
,FAb~tK^g?[
[\h*Em
(-u{+tNO}
$]"o4$
t2yq,@
dw=u/O
~ w3U=
V'8 Yd
thntJ+
v* :wz
swD:Q^
=wgx_E;b
][|45YlDai3
&HsSN7=>
0O"LT^[xm
Vi<icU
~)xL-G[HOP-H0q
_5vLu Q
d\os~!;|M{xS
"ega4ec
_KXtRH
iqm-v5
WKnf~;;
jWQxPm7:n{
$3M&AXx\[(n`9@
+7Z|G{]_NA{ZYd
)~mXkz^*6o(Sp
Q6COyyM
[,}d;}
k?5XQ`6
}(t5h(/1/9
ED%$B.
Ski$RxwW
x#wmgJ>
4Rj:J^
:TKyivh
>n?GEo}uZ%Tf-]
o[(u*`2t;O
w=![\jxPxn]J(#6kD
l5 LuH8
wZo@BK1
KimmeXr9
]o_g)IvnNpgX
(~T5sXQ.$
fi 9I%
~V%~}kc'c
X>+h#OM
QhkF[vk
.x4=AgwqD'
FDwJciu
$~[k:(
n,N/ VR
|gmj@eqbqqi<
Bl"O?|/
o,|E}
S+o=Uo%y
g-x:W45
+|K$2X?S
!=>6{{:E$
4Q])Fxd
~)_m<_k
_V|Z[\$
6~ Tx.~Q
'/>+i-Kt
>fES jy
o>~)O7R
RZsBE0#G0f
uZ(Py"(
QR|!\j~3
Q_ixz #
YpsF:9_D=Vw
_Q$|<>(
`6b++{
PL0hl*
ncFKI7
J!14J;DJ X~IY
VG32v,"%N
\=C u4
2A"2"neUs
xv[KMsF
d,'XMM
[\i]:sy
Xo0&WHny`|
4n-n>a
wkxY`d?
j|E}]?
!K8;\)^w#?u1u `$!-!d{2
6w 'V
k,F(QjL
"z__A[
_|N6EDVwr
fuo6[K
|kM+Nm
R[kE-D
dwL$I\
|*.5gc~
H16t3G[
b:UG+{
jz705O
?EkF5?
>&i-7 Z(m1g`
^.;kQ"y)RiT|MC7Iiq&
|T"72_HN3;+1
{(/!@[
!w2d8ub
t#IHV7
\ZY![99m<
h[\cAuEcMi
54wom/nmZ
o~|1aW
M(x' _
5'>(O]Vi
oC!'L|
EIUwxZ
C~_E;b
hr2gxj#Z
Q_wXz
~x_E;b
|IY,#qaMs
Mgql<asi[XR
z([[Iyq
RM:m6[{
`>q>`<
e9drZoe|
e'<=j\\Z
&j$$S,
{ 7:5{k
B[(Xdy?^
m/W_ Vy g
}'qz-awuois=M
L+0E.aAb
\7F AzM
ukWM&6h
~*k:%59l
=OxGVayiz
p29\E}I{
t+Or66Y3
hyli?-
nNoEhB
ZB%ec" CJ
H16t3G[
b:UG+{
|;gWPcI+=O1
LjyI;ctqYx
:"'2G6b9&Um?V
7V#\^q
w~&Xx,hn3l
`m.;c?*
HhU"hW
n#LU],b
Z7tkwlu
\.oego
uKme~t`l
}$|km.4K
xR|3;BVth
ereKpM
uuQ.bXY)2
sm;.c~)o
_!JM+3
[c4skOs(@^C'W
V#Enl{gV."fSRH#
wI.Z6J?
}E o>W:OJ? [q\O{W^9K.zSj+
q_}/Xz
~x_E;b
~I<AVVVosv6
^Iqj7e
j:(Cq}r
hr2gxj#Z
bW9rZ*1w
*9%9J)
GEK)4a7hr
}{Hw+V
~[))aa
(5?a3 Duc
+SeTV
x6+3:d
+XX'\If
imgSteam
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
Ci4wI,bgv1$$
6MjS.=m
\i8yqq
B2?h-ex
|?M x_
F<3K=/X[
.Si7\]@g
8q$M_vG
I:n[w5Y-Be+."
;B2~p;
|?M x_
|?M x_
|?M x_
Am2S5X
(;[[Gw
&4Pks
Oxn5ui~9
"uRSMvnu
BM }(P
QX_G}"\$J
T*_Z_4
2K[[Uy%B,
R< t}I0;
\j,IlrI<] k
o>~u>@\y o>
/t}?:>}GY
OQ?:] k.j}
o>~u>@\y o>
/t}?:>}GY
OQ?:] k.j}
o>~u>@\|
,wQE3"\``
Q]EgxvL,lg
>@\ln<[n
=>,|2H
j6u>"EYdR<|(
eo>y?v?
xSZuI^
RM.e S
}wGm).s[Z
2@%I;X
UrZ/<9["4kI
V(o>y?nIg"}
>y?nAk|-=[gi,W
tC~z/g{<Skj^K&5
}h|NXdrlm2!
9f,a!$
C$%Q_Q"
~6:,zv7'Pqmp[
c<#23.Db
O`-}yg
N_kwVo
n]K\T1
\cWEOR
k$m$wZ
Fkh`>&|q
[ZG8>'-rF
xCL<1"
.h%cWlR)!sE
_#a$R$d`
3Ev^8?y
|EFA&|GU&f
Rgn`U\FX
*{xC&XJ<FT
>.$/$S
TfsVvV]
1$QTrI
9#%YX`
\;*rcL
g?`?:_*
tU\|O]J{
y7^/ ?
7+~_hR|+?}:wz
_?uCxzW
MCEa}.]>
NTqyo{+
RvQed:
'K.n}?ix/
^i%WVio
kK?m>vr6mm
#O,?!Ivp<eAma?
^]\x^5KfU
p1(V~$
p1(V~$
h2 0Ip
~x_E;b
l:z}nZts#dml@Uu@I!v
"nnTJ+
w5[kGuH)|S
N]>I&y@GD'j@
$&74-RKW
@@bU^Mk
}_ K_e
xltuY"Uey!a7 0v
95fuhR_xi
jj~$4*RMa|
/iw6mR
w~%77S
$:v^/E~+.
_<MVk[qoj
}BTn3]^N)
EMa?Q^
(5'K3>4*q C
4H4sg%[_'x|
.\ $Z}/
eiB1H;s
%4GB,_
#3k^^Wpie
%4GB,_
#g"3K8-
j<Ht{+i,
Qu?i6A
YIT*)+R%Oob-/,
h|9\jvp
e8fME'
Ft{=3/
c1Z+ZF
SZm|M}cK}
VfpBMnb2G
</uY[\|5M&o
-Io
3imoIop-
~&xd~;7
(^TS$Au
*Yd *[
nmX<N*
L.%\xOl
BO:[i&[=GjZq{{s=
4!YYK1$O&KbZ
r4T,bd$@%
o>6en<C]]M
:5[S:m}F
h.5,!.A"H
th,=Nr
QWGyfp
wI,9v;O
G0|E}
{P& *t
]OZ+pk
I58_RVW
%X#y)2
CxIQ{;xo1ZI"
nsxT/h
d~dt W
;Hm(pIwl |
x[r_A+
";~j0Lnk<
Z=v6oehe
fYj]%bIdI_K
feK]o@e4
kidU>A?QP
0^E%:/
AZ*oEn
_$}HQE
}XVu;xZ
6mN2\NzHH5
~x_E;b
n<gqq2
x -gYxMc
@ (4?_H
95 GoaK
l\w>2Z([?4k
YYZ[[0aiU
guk,.=-ds=(
x^e| OZla
CHTpml+O[|/5
1w]@@Kjka)
6Lvp/^uib`E
Y^70-gi
O.h>P<
OK(<z}(<
GY#(@d
v1RkIoP5
y/0yr'
iTEgw *Olo .oVi^%
%[+F]BM]G
Ox]e`rC
GzuI<=K&MKQ
"SVv=]h
cTmi><
/CnaFw<
'Z0xWOgq(
;w!0'kg)
z}Z{}Cfxb
"#s%nt=
/ICV)Imoq)mt
xO24cp+.6py<q
6_)wsJ?
v8 ZdV:4
u5gm-/*
+XmNA[b'[Q#
<g}GW|^-VZ
q jB4]./
#]3GvF
xA|3;60Y^Z
0m/@XI
=/{1?}7T
D66^hea
g#O}__1}O?w+n;V
f<}Q-4 w
nd%*o|
o,DDRN
lo%X. s
`_J4<%'BO
Fs `nv
kl~ ~~%/
xil- r=~]MY-h8$
Rj6zBN>R]
W~^kf(yPD>RPN
l.W`T%
;4}yg~gw
!A8 ux[N
_\=im8
gVtmmfnmK@n
^6Go@6dVd-
Z :Z|7
u+rV]F;
ye>=]h
8V7J7 5G
cB"s*[m
lF(sj\
%jZQZA[
JQk;,F
2")7a;\
]h>(g}geI|6EGq
iRi~<$k
M%pmOJ?
'KWHBN\i;9.
!2kko!}ly_%Wu
}-O|]ExJ}F]WP]gy.n;?*Y"E
`WT6[F
%eW-G3t+OgF"`B
\)D7b[o
o>'AD0LZZXk/.
%[2c,Z "
orGG8xo u-N
u=Nl:-QNdF
!u]y5>sG=
2upU1AUb9]^9t]Vgyeh]
&e8%$:)*G Q
E8o>~)O7R
ek},6;coX+e@Sr
@\<.!*A*{Q@
#e]H Q@
>)Xz_27
/q)QnrN
D66^hea
tUQY |
Ybjv^
q k )~
|s.}3i
4TM?7i
}{QV?n?
~(SC*V
=?_yEi
mOfQZkGa
=?_yEj
7Q^\Y'b\c8#A
imgSteam
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
$aBW$I
`C6r?T
aifkxZ7<go[jB
c/^\\B
F<3K=/X[
";_|?O
nth,mhd2`l
;B2~p;
}pifj8Iy?
b~ 7M%
4B49=X1|'k
W.ihf[>
>zQV?nY>kNoM"1
E-n6;;ts'<_{_7T
r:hU&>
1^m>Eo|o~rfOeBjsHn}dq>
wg&Y|U
}cH(/.l%
/KgO/k
tRAk}'96
_[r;xlm
(&$8Da
v$I9$Me}
/t}?:>}GY
OQ?:] k.j}
o>~u>@\y o>
/t}?:>}GY
OQ?:] k.j}
o>~u>@\y o>
/t}?:>}GY
OQ?:] k.u
UN=h~%i1x
;.QX0WPp0
("dyIJ;&v
Ppw63qZ] k.x ib
Z++COS
oWK++=>
|9 |9;
xC%|@m}3GDOC
2XjGm{
<Y(<=i7:K0
$ebR]5R
eUrK"v?
:EhgH%Y
?;m}Lx
FIEvS^9fz_O'
2_hxNuX
76sHYC&I
;-|)HK>D
'$DuWq
mtXNnN
Q4Oi/9
xFef\g
W^ 5[k9,
c{7/"Gi
llUT$pN
8(PpFO=,
N}Y7L7
u<>.sas
-^;I,Ff{|A
{\Gu[xHIcim
m5Rf`;>b
x~}Mmu&{{
$OwkPBm*
_dp8 ni|[G4
ee@'_SK
\ZBHzu=
9$SB<r#G$d+
\[c)FI
g?`?:_*1(Y$
g?`?:_*1(Y$
g?`?:_*1(Y$
g?`?:_*1(Y$
g?`?:_*1(Y$
g?`?:_*1(Y$
g?`?:_*1(Y$
g?`?:_*1(Y$
5lKpIcY"?6cC
k4p<XJ
oO/FpX
[=yb")[_a9Z
II2\*a
[XZEuf
qtHp_]~ xwSfvoG(o
~I+~ -
_>=wLQSxY_Aik
RIY%][6?
nTFeQ`
M01(V~$
p1(V~$
M\/|1-J{
\{O;5
78kQ `?&:<
|9oggGSMBKy
ydhIRV
3E{e6!
}W-2G]v&Q
#^_]Ls
m=zE"E:|ZjD,60f
<_qirx
w+&3js
dnT<S~(KVKo
>O3uo~
8"72^4H
d9$w&'o4
{=N[Fr
01(``= f?
jx+Zf[Yuk2L
^O<@V5
}"};QS
khm>kb!w
rkz`o!&6
eKJMn#+]<
k?5XQ`6
>zv$3Ko~&
Zo ukRj.U|
ZL##$C
t[M?EA
QVI=v?z
i>7M;+I\xY6~t
Nco?PN$R7yu~ x*H$ xt
`,tw;Kh
G}s|(f)m4g
L5].m#
kX#J<J7
CVO{spM)9.1,
rNj=s\>wjWZ
3]]\Ms+K31$I$wRmkzX''
# :w[O]#KUMS
N$ah-#%mOn
|)}um@41VN
jzkC mQo5"&FV+-
OP+YIw
dbY<Tp
)H+k1>s
E-m'O'
o,|E}
}JU[^D6
~[(=Yv>
}<> qZYYP,Y$
;H}r=}x^
NtI$2(RZ;V
kr+h_Ww
WrjJQ/0
?vB2a.G4&
~k~ |
&e%~b,Dd
x{Mn|9
|9O&]S
1h5*jho
K[u ko
K[uG (
[b L;R@F
9\Qf6eF&|
y#jxgR
Eeeimn
<*@oew7lfk}
SU+~ <
sin[Q{+
HLM<"dd}
.-_ZYE
s-iz<~f"i>k
SR#M&N-wfm
+PdH[fx
F E2cqbn
I<(]C`V
X (@9&/v
M&[[XGu
~1Q_WO
G?/(H?vRr
]H.lX5I4dHKHf
xDZAg,mc
m&JL6G
&#jW9&;>
lti$PM>f
$/-5-F
MY w|7>M]$LV@XUQ
~ x|g
V-s('|i
pwgTb*f,dm
>=}o#NB
l-P4Vs#LmvGo#8
ycHn{oLY%
PQ|5/Z5i
HnbNc[O+&vA'
q_3V/u~
mo-D0KV
z?[}jBMQZF<
<J%d792%
|$_8mF
G#v;p\V
o>Q@\?*
qW>}EbRo/9
(Bl($>
D66^hea
Q_wXz
E-m j(
g#O}__1}O?w+n;V
f<}Q-4 w
nd%*o|
o,DDRN
lo%X. s
`_J4<%'BO
Fs `nv
kl~ ~~%/
xil- r=~]MY-h8$
Rj6zBN>R]
W~^kf(yPD>RPN
l.W`T%
;4}yg~gw
!A8 ux[N
_\=im8
gVtmmfnmK@n
^6Go@6dVd-
Z :Z|7
u+rV]F;
ye>=]h
8V7J7 5G
cB"s*[m
lF(sj\
%jZQZA[
JQk;,F
2")7a;\
]h>(g}geI|6EGq
iRi~<$k
M%pmOJ?
'KWHBN\i;9.
!2kko!}ly_%Wu
}-O|]ExJ}F]WP]gy.n;?*Y"E
`WT6[F
%eW-G3t+OgF"`B
\)D7b[o
o>'AD0LZZXk/.
%[2c,Z "
orGG8xo u-N
u=Nl:-QNdF
!u]y5>sG=
2upU1AUb9]^9t]Vgyeh]
&e8%$:)*G Q
E8o>~)O7R
)-g!xl#3
QE0=z]
3kDSC#F#PA
_XmQX|>
j+(xD?
s#B<UX
h}w/QT%
(`rj*/
k (`rJ)3
t2YzE'iEX
40(#G?s
(5?a)QW3
7Q^\'|pGLQ_epk
/////#
qp<lpqtltqx
qx<lxR
qt<ltqx^
qt<ltlxl
qp-tlpqx
qt<ltqx
qt<ltqx
pz<kz+x^/
ql<llqtlt
qt<ltqx
qp-tlp
#t*Fd_
#t*Fd_
#t*Fd_
tXlhRpr/lkrpz/
tXlhRpr/lkrpz/
tXlhRpr/lkrpz/
tXlhRpr/lkrpz/
spnxnp
D4lD^2
q@<l@1x2
px<kxQ
px<kxQ
#x*Fh_
1X5\'\
1T5\lTPlXP
qp<lpqtlt
i4%lxF
%ltF%l
q\<l\qdld
pZ<kZ+X^/
qt/llt
#H*1x/H5X
qp<lplx
P@`1x6
qp/llp
P@`1x6
#Plt*1x/P5T
tXlhqp/llp
q\<l\qtlt
l4ll^g
d4ldlh^h
pXl`qx2
q`<l`qh/d
lqdldqx
l\ltl\
H4lH^>
tXllqp/HlpR
d4ldlt
pXl`Rpn2
hdknpz/
@`1x5@/
d4ldlp
tXl`Rpn2
hdknpz/
@lHdI $
1t5LltJYDlt
tXl@Rpn/Hlt
`#Plx*F@%!
q`<l`qhlh
qh<lhqt
d4ldlt^
pXlhql/dll
D`1x5D
d`1t5d
tX/XltCx/
qt<ltqxlx
#x*Fh_
#p*1x/p
d4ldlt
pXl`Rpn2
hdknpz/
lp.d@ltJ
hXlhltG
lhltClll
1hllltG
>h1x/l
p4lp^B
qh<lhqt2
qh<lhqtlt
p4lp^B
qh<lhqt2
qh<lhqtlt
q\<l\qtlt
pZ<kZ+X^/
ltJYhlt
lXllltG
ltCplp
1llpltG
>l1x/p
ltJYhlt
lXllltG
ltCplp
1llpltG
>l1x/p
ql5Dlxll]
pXlpF`NP
h4lhlp
xX/hlx
xXlllx
F<,`$l
#t*FPlxp
n0n(hI
*#Plx]
w/Tlx=
qD<lDqx
ltlp]
L`1x5L
qp<lpqx
qX<lXpV
@XlXp:/<
lZlHqt
ltlp]
s$lx(D
#(*1x/(6
,i0Xl\@
knpz/p
knpz/p
1`l`Jp^k^
8`1`58l`
H(`1`6
L4lLlh
XTPLHD
z'X%'h%
qP<lPqTlT
ltlp]
L`1x5L
#(*1`2
<84,5@
#`3tt/`
#`3tt/`
#`3tt/`
rltJch
qd<ldqtlt^
T`1l5Tlpll
P4lPlt^
lXldqh/PllJ
T`1l5TllCx
tXlhqp/llp
dXldlpG
\Xl\llG
hd`\ltR
l`ld.0@l
ltlp]
*#Dlt]
PLHDlt
PLHDlt
qp-tlx
l4lllp
pr<krQ
pr<krQ
pr<krQ
H8`1t2
%lxih%
%lxih%
%>TFD%
%lxih%
%>TFD%
,`5<(L
tXl8qp/<lp
qt<lt{
qt<ltqx
qD<lDqp
qD<lDqlll
qD<lDqtlt
qD<lDqL
qD<lDqt
pltJc`
CtlXl\
P4lPlt
T4lT^U
\XlHR2
dlhJdT
l\*1\2
l`l\*1`
l4ll^&
hXlhltG
<`1x/l5</
Jqpltlp
(`1d5(ld
`lloP%
qh<lhqplp
qL<lLqt
pJ<kJpn
qL<lLqp
pJ<kJpn
qH<lHqt
qH<lHqp
#lpltll
hXl\qt/`
q\<l\qp
*#Xlh*#T
qD<lDqplp
L@lp^.
q@<l@qt
<4l<ldlp^/
hXlDql/<lp
*#`lt^C
ltlP=F
qD<lDqplp
q@<l@qt
<4l<ldlp^
hXlDql/<lp
q`pZl\
d`1t5dltCx
lt.@@M`
d`1t5dltCx
d`1t5dltCx
d`1t5dltCx
q@<l@qt(
l@RpFkF
l@RpFlt
tXlPqX/T
tXlPqp/T
X`1t5X
pltJdP
pj/<5X(X
ph/<5XllF@kjkh
X,`1l6
X`1x5X
H`1x5H/
1p/85\
qp<lpYl
lp.d@ltJl\
q`<-dl`qh
<`1x5<
L`1x5L
q$<l$q,
q$<l$q(l(
tXl$q(/ l(
d`1t5dltCx
V'X%'l%
lLqPlP
qd<-hldqplp
<`1l5<
84lpqx/
qp<lpqtltqlll
1t/,5`
qd<ldqt2
lhlpJlp
l4lllt
hXlhlpG
lpChlh
1`lhlpG
*#4lt#0*#,
*#(lp*FX%
T`1h5T
d4ldlllp^
h`#P*#L
h"#,*#(
PL0,($
qd<ldql
d`1t5d(d
h`#L*#H
D4lDlh
XDl`l\
`Xl@qd/X
xXl8qp/<
Y0l4lp
ld.,@lp
pltJd(
qllllp^
s<5@ll^
@`1d5@
hltJd4
*# lxlt*1p/
</dltR
q\<l\qplp
hX/dlllh
1x/d5<
lhCxlt
lxll]
lllt*#h
ql<llqxl
ql<llqt
ql<llqtlt
hpflpDT%lp
hlTo8%
*#0lt*#,
*#(lp#$*#
ll*FT%
#d*FL%
tplhd)
4p5Llp
ctcpcl
>41lll
44l4^)
lXl0qt/4lt
T#4*#
18l8Cx/
<`1p5<lpJ
pv5<lxkv]
^/8kvl`
q`kvl`
q`kvl`
q`<l`qh
h`#P*#L
pTPL8)
<#x*#$
qh<lhqtlt
1llpll
d4ldlt
lX/dllJ
*#dll*#`
<lDqtltlH
ltlx^^
qplpll
l l,qtK
q(<-0l(qHlH
`Zl,ql2
`Zl,ql2
`Zl,ql2
qp5Xltlp]
qT<l\l
XlTqp/\lp
\4l\ll^
qX<l\l
dXlXqp2
\4l\ll^
qT<l\l
XlTqp/\lp
qX<lXqp
q<lqplp
4llp^>
tXlql/ll
q<lqhlh
qh<lhqxlx
qh<lhqxlx
ql<llqx
qh<lhqxlx
qh-llhYd^
qh-llh
l4ll^*
tXlhqp/llp
`pZl\DH%l\
ld#l*F
tX/llt
tX/llt
CplpJqt
#8*1l2
llqtlt
q4ltl4
xtplh\
xtplh\XT)
*#hlL=F
xtplh\)
*#lt]
n`j0%nhj@%(P
44l4^*
tXl0q\/4l\
44l4^)
tXl0qp/4lp
@#4*#$
nj8%njH%(X
qD<lDqHlH
qT<lTq`
qT<lTq`5D
qT<lTq`
lPqxlX
hqLlxL
pJ<kJL
qP<- lPq\l\
lXD8%lX
>#4*F$
tXl<qT/@
@4l@ll^
pXl<qT/@lT
@4l@ll^
pZ/@kZ
*#@ld#
q<<l<qT
qH<lHqh
qH<lHqd
ldlLlPlTlXlH
,Xlq0/
ihDI0@
-4I 36@
,Xlq0/
ihDI0@
-4I 36@
lltJfT
ldlx*1d
ldlx*1d
\4l\ltP
<`1`5<
\4l\lhll^
P>(#TlpltP
\XTPL0,(
,Xlq0/
*#t><#p*#l
*#h>8#d*#`v_
xtplhd`\XP@<8)
ql<llqt/p
k^qdl`
q<<l<qH
q<<l<q@
84l8lH^
dXl<qD2
hXl<q`/8l`
l\.,@^
q(<l(R
l\.,@^
TlXl<l`^
q(<l(R
lPlTqP
nhl`n8ndl\n,)
nh)\(?sh
nd)\(?sd
'%'%'%'
%ndj<%nhjL%
7Q4[0H
q<lq\l\
tXlq\/l\
q<lq\ld^
q<lq\l
q<lq\lpCx
L4lL^
HXlHltG
ltCLlL
1HlLltG
HXlHltG
Vkjc<_
lPkVlX#L*#H
pl$ 5H
' %'0%
lhlllp
Pi :l@
dXldltG
\Xl\lpG
h4lhll
dXldltG
\Xl\lpG
lxll#h*#d
ltC`l`
1\l`ltG
lpCDlD
1@lDlpG
hd`L\HD<@8
<4l<l@^
pXl8qH2
qlXYYYY@ll
qlYP+6ll
qllHll
q@<l@qx
qH<lHqtlt
D4lDlt^
hXlLqd/Dld
$`1h5$lt^
qL<lLld
qL<lLqp
l\lTl`lXnLnHn
lPlt#D*#
*#ll#*#
qL<lLqt
l l$*#
q$<lXlHlL@XI0iH@
qX<lXqp
q <l t
lt*F,:\6
pB<kBp^k^
q<<l<qLlL
(I0n"A
q<lqDlD
ql<llqt/p
lt*F,:\
#<*#8lx#4*#0
*#(>$#t
*#d> #`*#\lx#X*#T
td`\XTPLHD@<840,($
#T*#Plx#L*#H
td`\XTPLH5
8"lT/6
\kvlxJlT
qDlplD^
qlXYYYY@^
qlYP+:^
qllHll
q@<l@qx
'<%'L%'\%nt
'<%'L%n4?n0
'<%n4@
jL%ntnl
'<%'L%n4n0@
j\%ntnlx7!
PXlPlhG
X4lXlp^
TXlTldG
HXlHlhG
XTPHlp
X4lXlp^
TXlTldG
PXlPlhG
X4lXlp^
TXlTldG
HXlHlTG
PLHlTCP
]3/P5$
HXlHlTG
PLHlTCP
$`1p/P5$
HXlHlTG
PLHlTCP
$`1l/P5$
HXlHlTG
PLHlTCP
$`1h/P5$llPlXPlpP
qt<ltqp/llp^
dl`dX}
1t5dlt
<l`lHlL@X/`ltlHlL*#`
lPl\lX
lTl\lX
X4lX^j
q$<lXlHlL@Xl$iH8:(J
q,<-0l,qplp
pl(D4%l(
lllpql
qllli4%
l\lLl4
q`<l`o
''>LF(l`i8
lh5<'<
lh5<'<
lh5<'<
lh5<'<
*#Tll*#
*#Tll*#
q8<l8q\
#,*1d/,lh
Hf8]/(l
H4lHlt^6
FlxFp``1x6
H\XTPLHD@<840,5
lxlpqt
*#l$*#
l$*#^C
,I \@
qL<lLqplp
qplplt
(`1x5(
l`.H@^B
qD<-HlD
lXl`.H@
qD<lD#$*#
X4lXlhJ^
TXlTlhG
"lhCXlX
1TlXlhG
`1`/X6
`XlP1\/X
c0]3/X5
jlhJi
%',%'<%ltFL%
lx.@M<
lx.@ML
*#@lP*#<
T@P<84
krlhkr
qX-\lX
$krllA
krll. A
qX-\- lXi
XlXqt/
qX<lXqxlt
krll.\A
ld#@*#<
XTLPHD@<6
XTLPHDk
ld#L*#H
XTPLHk
ld#L*#H
XTPLHk
ld#X*#T
*#0lH=F
DXlDl`G
DXlDl`G
DXlDl`G
<Xl<l`G
DXlDl`G
<Xl<l`G
LHD<lpP
>$#L*#H
(Xl(l`G
LHD<($llPltPlpP
DXlDl`G
,`1D5,
TknlpJlL
d`1x6(
T4$tdT4
T4$tdT4
<l@qplplD
lplt^^
qllllh
*#hlllp*#dl
#t*1x/t
lt*1x/t
#t*1x/t
#t*1x/t
#t*1x/t
#t*1x/t
(Xlq,/
l$l *#
l$l *#^C
l$l *#
l$l *#
qp<lpqx/tlx
qp<lpqx/tlx
qp<lpqx/tlx
qp<lpqx/tlx
qp<lpqx/tlx
qp<lpqx/tlx
qp<lpqx/tlx
qp<lpqx/tlx
qp<lpqx/tlx
qp<lpqx/tlx
qp<lpqx/tlx
qp<lpqx/tlx
qp<lpqx/tlx
qp<lpqx/tlx
qp<lpqx/tlx
qp<lpqx/tlx
qp<lpqx/tlx
qp<lpqx/tlx
qp<lpqx/tlx
$'P%v)
W'P%v)
$'P%v)
,Xlq0/
l(l$*#
l(l$*#^
l(l$*#
l(l$*#
,Xlq0/
l(l$*#
l(l$*#^
l(l$*#
l(l$*#
ltPiX%
*#@lP*#<
T@P<84
l lXql
lplD^9
q <l lP
q lplDl lP
'lplDlx
$4l$lP
lplD^9
q <l lP
q lplDl lP
'lplDlt
$4l$lP
*#lt*#
X4lXll
\XltCTlT
$`#\0/\6
04l0lp
\X40,(
04l0lh
\X40,(
n0n(qd)
n0n(q`)
q0<l0i
q0<l0i
<lXlPqdl\lTq`
q0<l0i
q0<l0i
q0<l0i
nnn0n(
q0<l0i
l\.@ll^8
v'T%'d%
dK1LlLJ
<`145<l4J
mlxF,(L
blxF,(L
*#lt#*1x2
ix`1x/6
\XTP,($
\XTP,($6
lh.@+J
lh.@+J
lh.@+J
lh.@+J
lhR((V
lhR(xM
lhR(x_
lhR(h^
lpltDlp
lpltDlp
lhR(Ho
lhR(8a
lhR((d
llFXlplt"
lhd`\X
lxqtpr
#\*F4%
lhd`\)
#\*F4%
lhd`\)
lhd`\X
*#\lD=F
lhd`\X)
F]<h'X
P0 xhX8
0llF :f
P0 xhX8
@lliP]t
0`150lFP0
<-m?Pb
<-okPb
<-kDPb
<-liPb
<-njPb
mlxF,(L
mlxF,(L
mlxF,(L
blxF,(L
Zlll`q
iSubCls
strMutex
lHandled
lReturn
wParam
lParam
TargetFrameName
PostData
Headers
Cancel
strMasterName
strVicName
strMsg
strUser
MsgNum
hWndSub
AllMsgs
lngPort
strHost
strTag
enmProtocol
RemoteHost
RemotePort
LocalPort
LocalIP
varType
maxLen
requestID
bytesTotal
Number
Description
Source
HelpFile
HelpContext
CancelDisplay
bytesSent
bytesRemaining
Server
UserName
Password
AmIRegistered
AsyncMode
RemoteFile
LocalFile
TransferMode
FileName
WebURL
ChunkSize
Returns/Sets the port to be connected to on the remote computer
Returns/Sets the name used to identify the remote computer
Returns the remote host IP address
Returns/Sets the port used on the local computer
Returns the state of the socket connection
Returns the local machine name
Returns the local machine IP address
Returns the number of bytes received on this connection
lHeight
Returns the socket handle
Returns or sets an expression that stores any extra data needed for your program
Returns/Sets the socket protocol
Accept an incoming connection request
Binds socket to specific port and adapter
Close current connection
Connect to the remote computer
Retrieve data sent by the remote computer
Listen for incoming connection requests
Look at incoming data without removing it from the buffer
Send data to remote computer
Occurs when a remote client is attempting to connect
Error occurred
Occurs after a send operation has completed
Occurs during process of sending data
nAddrParamBlock
sFunction
ParmLongs
nModFuncAddr
nParms
strHeader
strInfo
strInstructions
clHeader
clBackColor
clInfo
clInstructions
lngMaxTime
boolHeadBlink
lWidth
iBitCount
boolGray
boolGrayscale
lSrcLeft
lSrcTop
OutputInHex
IsTextInHex
8`1t58
8`1t58
4p5Llp
*1x',:\Z
4p5Llp
*1x',:\Z
4p5Llp
*1x',:\Z
4p5Llp
*1x',:\Z
4p5Llp
*1x',:\Z
4p5Llp
*1x',:\Z
4p5Llp
*1x',:\Z
4p5Llp
*1x',:\Z
4p5Llp
*1x',:\Z
4p5Llp
*1x',:\Z
4p5Llp
*1x',:\Z
4p5Llp
4p5Llp
*1x',:\Z
4p5Llp
*1x',:\Z
4p5Llp
*1x',:\Z
4p5Llp
<4l<>8#T
*#LlP*#H
TLPHD@<8
*#<>8#T
*#LlP*#H
TLPHD@<8
*#LlP*#H
TLPHD@
*#LlP*#H
TLPH<8)
lL*1L2
lRl Ji
lRl Ji
$Xlq,/
$Xlq,/
(Xlq0/$
l*#L^C
lH*#D^C
l*#L^C
lH*#D^C
lH*#D^C
l*#L^C
lH*#D^C
l*#L^C
lH*#D^C
lH*#D^C
(Xlq0/$
l,l*Ll
l,l*Ll
M4I @
<4l<^J
q8<lxJlx
44l4l8
0Xl0lxG
q8<l8qt
\I0G1A
lp.<@>
1-<>1t2
lp.<@>
1-<>1t2
lp.<@>
1-<>1t2
*#lT#*F,%
lpP#*#
lpP#*#
_''l`lp
lp.<@^
q-<lp/(
*#kl*1t2
'@%'P%
1(-<>(F,
*#ld#*#
*#lt*F,
*#ld#*#
*#lt*F,
*#ld#*#
*#lt*#
*#ld#*#
*#lt*F,
*#ld#*#
*#lt*#
*#ld#*#
*#ld#*#
'@%'P%
lplh#(
lp*#lh
$l`lpP
*#lh]
*#l(*#
*#lh]
*#lh]
*#lh]
*#lh]
*#lh]
*#lh]
*#lh]
0r(If8
(gzuC-;?
\ jA%z'
RV#``",*
W=oqW6
e|(2 W
BB-#<]uv
@)@~vg~X
pilpq
zDBIG
0\EUN33_)
@\2dck
MS"(kbC
q|:&ez
9II9`~t
\c]!nm~b:ZETp-t}'EV?L_]R
eNGfa&6
%3<ZoxM0YY>0|@&ph[
2--27G&
5NM K`&O">X
D!{Zr*.
#(3)#~
mu^`ZIAc
u@[GJc
2MbH>kA*
p?W,>ws
UmvBn.})S_sW_qh,E]2..
{vt=,\
Z$}tw3Uo
^$i.6_att}
DnnP~/=g
Kx{d9Pz
P6f$veZ
V$$"SBd
;I/h%QA
O2-Ad6
<bUAxa\q
wyKL<O
0n$;Vu
Xs\o]z
]d5lw72sPCN&[
=7Kajt8
Mv8_?#[UpmneJ;
gFt;(1,Y-BHa|"'
"V?=4|)eyh
rJvj_Vd
jPT8fr?Y}
qtQG**`Q+}_j?
RchQOD{f$/
_yH:E=ntV
3,1KN'
s_,tcd
9h'\kf
oqRarK$`Ej
#m2Zd|S
@Y'a6t
_3C)|@
V%?}_q.
2Eom$gQDo
[OmjCU
g0 98UzuF
_rfhPyPElqXL
2"0+.z3&
L)^Y"aA'
645D3D536E405C5445723535333A6F656F506362783438764F655A4474774B73460D5AE13CF7C5E3E969234E3C41E1891352A3B2DBA3BEFE62806AE766B89FEE3481C75318AF58B00A6524CAD8DE0BBF48DCE74F0AA8C8BA6E92DD015C3DD5E0A9B2B5874B65AB71855BF45F8BD7707A6897DD9E596AE88EBC10949637347FDD27FEF9A2FEB370FA541BECB49B32EBCFC8F285E1AA6E1671D7DCEF703D370C6B2E18435B4BC3D29C0DBE75PA
EVENT_SINK_GetIDsOfNames
MethCallEngine
EVENT_SINK_Invoke
Zombie_GetTypeInfo
EVENT_SINK2_Release
EVENT_SINK_AddRef
DllFunctionCall
Zombie_GetTypeInfoCount
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ProcCallEngine
EVENT_SINK2_AddRef
`.data
BB-#<]uv
@)@~vg~X
Ipilpq
[zDBIG
0\EUN33_)
@\2dck
]7j3Y.6
q|:&ez
9II9`~t
\c]!nm~b:ZETp-t}'EV?L_]R
eNGfa&6
%3<ZoxM0YY>0|@&ph[
2--27G&
5NM K`&O">X
!{Zr*_`
#(3)#~
mu^`ZIAc
u@[GJc
2MbH>A*
p?W,>ws
S<sW_qh,E]2..
Z$}tw3Uo
^$i.6_Q
DnnP~/=g
P6f$veZ
.?qc\W
V$$"SBd
;I/h%QA
<bUAxa\q
wyKL<O
0n$;Vu
{vld^G
U7thTy
w^2sPCN&[
$=7Kajt8
Qv8_?#[Upmne
gFt;(1,Y-BHa|"'
"V?=4|)eyh
8rJvj_Vod
PT8fr?Y}
_C ;ge
qtQGH*`Q+}_j?
Rc^QOD{f$/
_yH:E=nA
3,1KN'
s_,tcd
9h'\kf
oqRarK$`Ej
#m2Zd|S
@Y'a6t
V%?}_q.
2ETm$gDo
_aJmjCU
g0 98UzuF
_rfhPyPElq
2"0+.z
L)^Y"aA'
645D3o_X36E405C54
A6F6}o5
506:27834387\&5Am
B7(60zAE1[mF7|E3E9694
C41*89052A3B2DB
EFE8^55
ET81C753A8B00`4CAD8DE0BBF<DC
Z.~C>:5D01V3
:h5FTD@07^89779E5988EBC1094
3.t7F22
B$k0FA
FFb1A16`
FR\C6a0 29CR
EVENT_SINK_Ge
6sOf/'|
BeeInvokeV
4Zombie;
A4M:;<
ABd"CM;{Mb.
$"DEWHFE
{{Su( t
@f.rsrc
WO@7$x/
GPGWHU
XPTPSWXaD$j
KERNEL32.DLL
MSVBVM60.DLL
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
MSVBVM60.DLL
EVENT_SINK_GetIDsOfNames
MethCallEngine
EVENT_SINK_Invoke
Zombie_GetTypeInfo
EVENT_SINK2_Release
EVENT_SINK_AddRef
DllFunctionCall
Zombie_GetTypeInfoCount
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ProcCallEngine
EVENT_SINK2_AddRef
9OVQWCIBG8Z3PAMXPGABLW13T2K2NXB2GHHTS900NUNTF96X0ZBBCCMMVY0LFA1JYSZ2UQQDYQGS71LG2JKXKNTNF400T8ZE2H3BBIS1IH0T3A5WPN4H1QX2LKT8GIKHJL42R8J1RJBD4BTKNE5NV1KOLMF2STN5SNIBNN18WHJOC5LIDGEQ5OCFWD0M7JMSCTDK8P9HHADCQVWZOE17FY7IOHCPNXDXUT1OP09Q1BCC07GRNOKM94JZBQBNBHWOVWB2PFUJP2PF8298EM936C5G7R1Y0MSX4LVMCFW4EN0ADJ5M53J4GHN1GOCXEMCPA7MK56BXQMAUDGLQWMOI0L1MDVUBNM6TAPLA41FIIL6Q5TMC7OJWV0U8P6ZO5GO5DJV4HBMVVK8PUZ9VB4T98HRF4EUGN5YDCHIML0BJRBOB5HI009VLLBJE0FPX46M8I8FHG88S5PTTXGO7Z6PG4HKL6USVTIBR6A1AW89M37J5B2HUMCT8ES9O0KXF8YWIIM7C4BPBVR3MF45JYZWVRWGHZE6D5XPUMG9K8MTXRM0ITP3JMWG7P82W3PHZV404Q7LOKSXPOEYRV44HYVKXJPN4E54462PNCD2HRF7A7DA5QMCQ6IMNJA6QLWQQ9804EA4VW30GO0DTOTSCXT4YA2PHC9TR3T0XMCOWJWC7D59AYXG9B0H501I177C3CDFE8XVJYSD46ISXKPIYMB5IOOLOUVQUCMUUQ7O50VAVH1Y89SRTKYK5Z1MAM1HUQB74WGJROGWZDP0VV8IEA3BBBINVE0RC2U36XZ5EBXEP9KJRRWFTDWPUMYDLXMCG8SWUQM5OLKU5PB4KMEPJL0055WV25FP7KYXB7VB7UAH0NQ82OPFI3WC1N0SJKODUR50VXKRI7JNLIWDSYDRE44JPY60TXCWIUPWJZYW458XUHVZFP9VR4ETKC34XSSLL430MO9XAX154WFO7P4O7DLF59AQI5XIQA4J37F5KGFYWDDWH2KMKKXOQONK1Z24RFS3VJ6LY1IH2GUD96XGB1YIMUKP1GU7ACJGVA996NRDBBKAIJF92I3BC4L54BQAQ37R3QRGLCYWBXAF5FBW7L7XNW19F6RBGNEG0KUF1XAOT1Z9QA2USCBB8QRMUXC1TRDJVAVQYR8FM2G2Q89Z7ORUCFKGJMG7XRA0R8J3MCHLFS79UPGI2VL444DB3QOXHSAX93OLBQ0XLE5X4XLOVYH0SC5VYMRFRODDO741X6OWV1DXA0HPZ1XNU0IGYEQL1DKXTOMK0U7W25PVLKKD44AQ4RNZNAVO8GF16SMNMKBOKTPVNFY7O82TKD19G48Z3NG5CPKRNIHB8TZ766FE3V0I150CBNTUQX0CBD538V0U76XBTCYURSD6QYXJOAKEMX8ZCRQ7C4IQKSMOCTCC5HJXTZ49SYF5BRVOIGBHF6GC43TR4J0TFW0HCU7YVJ1AZGNUMFIMUBL50U48SAA97TDS1PTKPD3GJMPXE0SQPDQY0NK7PY51QXCWJRY7O1XKGEWO2LPX4YFLVBBPZW4VYIEF1512K90Z71AOMQH2L3ECQ4ST7FWKZZVEUJJSXPYGSEXO4QHWC08AOT2VGI04Q5AINLP2R85DGZ8ICC684BCUBVMSQMYDH0NFQSVBKLGCXG5KHGRU9S1C0PV15S5SGSAMV9ZMXLZ4H0SSJOQZTG88R2R71USFOWK00RKLTStarted: 12/17/2019 : 8:12:54 PM
R6D7HLQOM8H43KAFILDJGSWZ9Y9Y2DT1T3NKYH9HJ7C9EHDZN7D322VMB7FN80MMOEW3HK16PKQQ976NCOB4NA46G5GY8DDRQ7NDVLB553KWJ0WW4AQ3UFPI9C7XOUGX7DF5FIWG4WXF3UY47OJRP8YHM5Y5QO74BAXWDV1CNCGA86JKSJ6ANQEFGTLAW76A7X3C70XW3OKRLZFWR86XUT8J
_ e x t e n t x
_ e x t e n t y
_ e x t e n t x
_ e x t e n t y
_ e x t e n t x
_ e x t e n t y
_ e x t e n t x
_ e x t e n t y
_ e x t e n t x
_ e x t e n t y
_ e x t e n t x
_ e x t e n t y
* \ A C : \ U s e r s \ A d m i n \ D e s k t o p _ o l d \ B l a c k s h a d e s p r o j e c t \ B l a c k s h a d e s N E T \ s e r v e r \ s e r v e r . v b p
2 c 4 9 f 8 0 0 - c 2 d d - 1 1 c f - 9 a d 6 - 0 0 8 0 c 7 e 7 b 7 8 d
@ @ @ @ @ @
@ @ @ @ @ @ @
@ @ @ @ @ @ @
@ @ @ @ @ @ @ @ @
A F F F F F F
@ F F F F F F
@ @ @ @ @ @ @ @
A @ @ @ @ @
@ @ @ @ @ @
@ @ @ @ @ F
5 5 8 B E C 8 3 C 4 F C F F 7 5 1 4 F F 7 5 1 0 F F 7 5 0 C F F 7 5 0 8 E 8 w n d _ p r o c 8 9 4 5 F C F F 7 5 1 4 F F 7 5 1 0 F F 7 5 0 C F F 7 5 0 8 8 D 4 5 F C 5 0 B 8 p t r O w n e r 8 B C 8 8 B 0 9 5 0 F F 5 1 1 C 8 B 4 5 F C C 9 C 2 1 0 0 0
5 5 8 B E C 8 3 C 4 F 8 E B 6 A C 7 4 5 F C 0 0 0 0 0 0 0 0 8 D 4 5 F C 5 0 C 7 4 5 F 8 0 0 0 0 0 0 0 0 8 D 4 5 F 8 5 0 B 8 p t r O w n e r 8 B C 8 8 B 0 9 5 0 F F 5 1 2 0 8 3 7 D F 8 0 0 7 5 3 A F F 7 5 1 4 F F 7 5 1 0 F F 7 5 0 C F F 7 5 0 8 E 8 w n d _ p r o c C 9 C 2 1 0 0 0 E 8 w n d _ p r o c 8 9 4 5 F C F F 7 5 1 4 F F 7 5 1 0 F F 7 5 0 C F F 7 5 0 8 8 D 4 5 F C 5 0 B 8 p t r O w n e r 8 B C 8 8 B 0 9 5 0 F F 5 1 1 C 8 B 4 5 F C C 9 C 2 1 0 0 0 8 B 4 5 0 C F F 7 5 1 4 F F 7 5 1 0 5 0 F F 7 5 0 8
E 8 w n d _ p r o c C 9 C 2 1 0 0 0
M o z i l l a / 5 . 0 ( W i n d o w s ; U ; W i n d o w s N T 6 . 1 ; e n - U S ; r v : 1 . 9 . 1 ) G e c k o / 2 0 0 9 0 6 1 2 F i r e f o x / 3 . 5
S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ I n t e l l i F o r m s \ S t o r a g e 2
{ 0 0 0 2 0 4 0 4 - 0 0 0 0 - 0 0 0 0 - C 0 0 0 - 0 0 0 0 0 0 0 0 0 0 4 6 }
c C D E C L
w s 2 _ 3 2
k e r n e l 3 2
a d v a p i 3 2
u s e r 3 2
E x i t P r o c e s s
S e t U n h a n d l e d E x c e p t i o n F i l t e r
C r e a t e P r o c e s s W
S E T T I N G S
V i d e o A l l i k a s
f r m M a i n
I N S T A L L
s e t C D A u d i o d o o r o p e n
s e t C D A u d i o d o o r c l o s e d
\ n i r _ c m d . b s s s p e a k t e x t
\ n i r _ c m d . b s s s e t s y s v o l u m e 6 5 5 3 5
\ n i r _ c m d . b s s m u t e s y s v o l u m e 1
\ n i r _ c m d . b s s m u t e s y s v o l u m e 0
\ n i r _ c m d . b s s s c r e e n s a v e r
\ n i r _ c m d . b s s m o n i t o r o f f
\ n i r _ c m d . b s s m o n i t o r o n
T R A N S F E R P O R T
3 6 3 C 3 2 2 0 3 2 3 2 2 6 3 1 3 9 3 E 1 D 1 7 1 7 1 C 0 7 1 B 0 3 0 7 2 8 2 3 0 C 1 D 1 0 1 B 1 2 0 0 2 8 3 7 1 0 0 1 0 6 1 1 0 B 0 7 2 2 1 1 1 7 0 0 1 D 1 B 0 B 2 F 2 6 0 1 0 B
S O F T W A R E \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ P o l i c i e s \ E x p l o r e r \ r u n \
S O F T W A R E \ M i c r o s o f t \ A c t i v e S e t u p \ I n s t a l l e d C o m p o n e n t s \
K e y l o g
W i n d o w t i t l e
V i d e o S o u r c e
V i d e o k
V i d e o k i l d e
S o u r c e v i d
S u m b e r v i d e o
n F o i n s e
F o n t d e v
V i d e o i z v o r a
V i d e o a v o t s
V i d e o S o r s
V i d e o b r o n
d e o F o n t e
S u r s a v i d e o
F u e n t e d e v
V i d e o K a y n a k
V i d e o q u e l l e
F f y n h o n n e l l F i d e o
S t a r t e d :
3 6 3 C 3 2 2 0 3 2 3 2 2 6 3 1 3 9 3 E 1 D 1 7 1 7 1 C 0 7 1 B 0 3 0 7 2 8 2 3 0 C 1 D 1 0 1 B 1 2 0 0 2 8 3 7 1 0 0 1 0 6 1 1 0 B 0 7 2 2 1 1 1 7 0 0 1 D 1 B 0 B 2 F 0 4 1 B 0 9 1 A 1 7 1 D 0 0 0 0 2 8 3 1 1 D 0 3 1 8 1 B 1 7 1 6 0 6 2 8 1 7 0 6 1 A
S t u b P a t h
P r o g m a n
S h e l l _ t r a y w n d
A p r o j e c t
\ M y D o c u m e n t s
b y t e s .
U n k n o w n
W s c r i p t . S h e l l
M y d o c u m e n t s
H K E Y _ C L A S S E S _ R O O T \ H T T P \ s h e l l \ o p e n \ c o m m a n d \
R e g R e a d
s y s t e m 3 2
S y s W O W 6 4
\ w i n l o g o n . e x e
i e x p l o r e . e x e
L e n g t h
= = = = = = = = = = = = = = = = = = =
c l a s s n a m e
u i T e x t a r e a A u t o g r o w i n p u t m e n t i o n s T e x t a r e a t e x t I n p u t
s u b m i t
h t t p : / / w w w . f a c e b o o k . c o m / ? r e f = h o m e
h t t p : / / w w w . f a c e b o o k . c o m
T r u e F a l s e F a l s e
F a l s e T r u e F a l s e
F a l s e F a l s e T r u e
R e g C r e a t e K e y A
{ B a c k s p a c e }
{ C t r l }
A D V A P I 3 2 . d l l
R e g C l o s e K e y
R e g S e t V a l u e E x A
R e g O p e n K e y A
R e g D e l e t e V a l u e A
n e t s t o p
k e r n e l 3 2 . d l l
F i n d C l o s e
P r o t e c t e d
W i n d o w s F i r e w a l l / I n t e r n e t C o n n e c t i o n S h a r i n g ( I C S )
u s e r 3 2 . d l l
S e t C u r s o r P o s
m o u s e _ e v e n t
\ D e s k t o p
W e b C a m C a p t u r e
H o m e p a t h
D e s k t o p
M a g e n t a
Y e l l o w
\ V u z e \ A z u r e u s . e x e
\ L i m e W i r e \ L i m e W i r e . e x e
L i m e W i r e
T o r r e n t D o w n l o a d
\ u T o r r e n t \ u T o r r e n t . e x e
u T o r r e n t
T o r r e n t
\ u T o r r e n t \ u T o r r e n t . e x e / H I D E
\ B i t T o r r e n t \ b i t t o r r e n t . e x e
B i t T o r r e n t
\ s y s t e m 3 2 \ d r i v e r s \ e t c \ h o s t s
\ c m d . e x e
W i n I n e t
D e l e t e U r l C a c h e E n t r y A
u r l m o n
U R L D o w n l o a d T o F i l e A
\ d a t a . d a t
p r o g r a m f i l e s
\ s t e a m \ s t e a m . e x e
\ M S W I N S C K . O C X
r e g s v r 3 2 . e x e
\ p w s _ m a i l . b s s
\ p w s _ m e s s . b s s
\ p w s _ c d k . b s s
\ n i r _ c m d . b s s
\ t n 0 0 1
\ w c 0 0 1
s y s d i r
w i n d i r
h o m e p a t h
a p p d a t a
T e r m i n a t e
s y s t e m d r i v e
J a n u a r y
F e b r u a r y
A u g u s t
S e p t e m b e r
O c t o b e r
N o v e m b e r
D e c e m b e r
c m d / c R E G A D D H K L M \ S y s t e m \ C u r r e n t C o n t r o l S e t \ S e r v i c e s \ S h a r e d A c c e s s \ P a r a m e t e r s \ F i r e w a l l P o l i c y \ S t a n d a r d P r o f i l e / v " D o N o t A l l o w E x c e p t i o n s " / t R E G _ D W O R D / d " 0 " / f
w i n m g m t s :
E x e c Q u e r y
c m d / c R E G A D D H K L M \ S y s t e m \ C u r r e n t C o n t r o l S e t \ S e r v i c e s \ S h a r e d A c c e s s \ P a r a m e t e r s \ F i r e w a l l P o l i c y \ S t a n d a r d P r o f i l e \ A u t h o r i z e d A p p l i c a t i o n s \ L i s t / v "
" / t R E G _ S Z / d "
: * : E n a b l e d : W i n d o w s M e s s a n g e r " / f
S e l e c t N a m e f r o m W i n 3 2 _ P r o c e s s W h e r e N a m e = '
S e l e c t * f r o m W i n 3 2 _ P r o c e s s
P r i o r i t y
R e a l t i m e
A b o v e H i g h
N o r m a l
B e l o w N o r m a l
P r o c e s s I d
C a p t i o n
E x e c u t a b l e P a t h
T h r e a d C o u n t
W o r k i n g S e t S i z e
w i n m g m t s : { i m p e r s o n a t i o n L e v e l = I m p e r s o n a t e } ! \ \ . \ r o o t \ c i m v 2
S E L E C T * F R O M W i n 3 2 _ S e r v i c e
D i s p l a y N a m e
P a t h N a m e
S t a r t M o d e
C L O S E D
L I S T E N I N G
S Y N _ S E N T
S Y N _ R C V D
E S T A B L I S H E D
F I N _ W A I T 1
F I N _ W A I T 2
C L O S E _ W A I T
C L O S I N G
L A S T _ A C K
T I M E _ W A I T
0 0 0 0 0 0 0 0
w i n m g m t s : \ \ . \ r o o t \ c i m v 2
S e l e c t * f r o m W i n 3 2 _ C o m p u t e r S y s t e m
/ R e s p o n s e
< L a t i t u d e >
S e l e c t * f r o m W i n 3 2 _ P O T S M o d e m
S e l e c t * f r o m W i n 3 2 _ S o u n d D e v i c e
S e l e c t * f r o m W i n 3 2 _ V i d e o C o n t r o l l e r
S e l e c t * f r o m W i n 3 2 _ D e s k t o p M o n i t o r
S e l e c t * f r o m W i n 3 2 _ I D E C o n t r o l l e r
S e l e c t * f r o m W i n 3 2 _ 1 3 9 4 C o n t r o l l e r
C o n n e c t i o n : c l o s e d
S e l e c t * f r o m W i n 3 2 _ P o i n t i n g D e v i c e
S e l e c t * f r o m W i n 3 2 _ C D R O M D r i v e
S e l e c t * f r o m W i n 3 2 _ D i s k D r i v e
S e l e c t * f r o m W i n 3 2 _ K e y b o a r d
D e s c r i p t i o n
S e l e c t * f r o m W i n 3 2 _ U S B C o n t r o l l e r
S e l e c t * f r o m W i n 3 2 _ U S B H u b
U s e r - A g e n t :
S e l e c t * f r o m W i n 3 2 _ P r o c e s s o r
S e l e c t * f r o m W i n 3 2 _ N e t w o r k A d a p t e r
S e l e c t * f r o m W i n 3 2 _ B a t t e r y
D e v i c e I D
a p i . i p i n f o d b . c o m
G E T / v 2 / i p _ q u e r y . p h p ? k e y =
& t i m e z o n e = o f f H T T P / 1 . 1
H o s t : a p i . i p i n f o d b . c o m
C a c h e - C o n t r o l : n o - c a c h e
< L o n g i t u d e >
G E T / v 2 / i p _ q u e r y _ c o u n t r y . p h p ? k e y =
< C o u n t r y N a m e >
U N K N O W N
< R e g i o n N a m e >
< C i t y >
M a x C l o c k S p e e d
M H z -
{ i m p e r s o n a t i o n L e v e l = i m p e r s o n a t e } ! \ \
\ r o o t \ c i m v 2
S e l e c t * f r o m W i n 3 2 _ S y s t e m E n c l o s u r e
C h a s s i s T y p e s
L o w P r o f i l e D e s k t o p
P i z z a B o x
M i n i T o w e r
P o r t a b l e
L a p t o p
N o t e b o o k
H a n d H e l d
D o c k i n g S t a t i o n
A l l i n O n e
S u b N o t e b o o k
S p a c e - S a v i n g
L u n c h B o x
M a i n S y s t e m C h a s s i s
E x p a n s i o n C h a s s i s
S u b C h a s s i s
B u s E x p a n s i o n C h a s s i s
P e r i p h e r a l C h a s s i s
S t o r a g e C h a s s i s
R a c k M o u n t C h a s s i s
S e a l e d - C a s e P C
T o t a l P h y s i c a l M e m o r y
S e l e c t * f r o m W i n 3 2 _ L o g i c a l D i s k
w i n m g m t s : \ \ . \ r o o t \ S e c u r i t y C e n t e r
S e l e c t * f r o m A n t i V i r u s P r o d u c t
C o m p a n y N a m e
( V e r s i o n
v e r s i o n n u m b e r
I s W o w 6 4 P r o c e s s
a b c d e f g h i j k l m n o p q r s t u v w x y z 0 1 2 3 4 5 6 7 8 9
\ w a l l p a p e r . b m p
\ w a l l p a p e r . j p g
S e S h u t d o w n P r i v i l e g e
{ E N T E R }
W S c r i p t . S h e l l
W i n 2 0 0 0 , D a t a C e n t e r
L o c a l P o r t
H K L M \ S Y S T E M \ C u r r e n t C o n t r o l S e t \ C o n t r o l \ S e s s i o n M a n a g e r \ E n v i r o n m e n t \ P R O C E S S O R _ A R C H I T E C T U R E
U n k n o w n ( ? ) | n / a | ?
W i n 9 5 , O S R 2
W i n 9 8 , S E
W i n 2 0 0 0 , A d v a n c e d
W i n 2 0 0 0
W i n S e r v e r 2 0 0 3 , E n t e r p r i s e
W i n S e r v e r 2 0 0 3 , D a t a C e n t e r
W i n S e r v e r 2 0 0 3 , W e b E d i t i o n
W i n S e r v e r 2 0 0 3 , S t a n d a r d
W i n S e r v e r 2 0 0 3
W i n S e r v e r 2 0 0 8
H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ W i n d o w s N T \ C u r r e n t V e r s i o n \ P r o d u c t N a m e
I M W i n d o w C l a s s
{ E N T E R } { E S C }
_ _ o x F r a m e . c l a s s _ _
S c r i p t i n g . F i l e S y s t e m O b j e c t
F i l e E x i s t s
A u t o r u n
A u t o r u n . i n i
{ 5 5 7 C F 4 0 1 - 1 A 0 4 - 1 1 D 3 - 9 A 7 3 - 0 0 0 0 F 8 1 E F 3 2 E }
{ 1 D 5 B E 4 B 5 - F A 4 A - 4 5 2 D - 9 C D D - 5 D B 3 5 1 0 5 E 7 E B }
C a n n o t s a v e t h e i m a g e . G D I + E r r o r :
P e r m i s s i o n d e n i e d .
A d d r e s s a l r e a d y i n u s e .
C a n n o t a s s i g n r e q u e s t e d a d d r e s s .
A d d r e s s f a m i l y n o t s u p p o r t e d b y p r o t o c o l f a m i l y .
O p e r a t i o n a l r e a d y i n p r o g r e s s .
S o f t w a r e c a u s e d c o n n e c t i o n a b o r t .
C o n n e c t i o n r e f u s e d .
C o n n e c t i o n r e s e t b y p e e r .
D e s t i n a t i o n a d d r e s s r e q u i r e d .
B a d a d d r e s s .
N o r o u t e t o h o s t .
O p e r a t i o n n o w i n p r o g r e s s .
I n t e r r u p t e d f u n c t i o n c a l l .
I n v a l i d a r g u m e n t .
S o c k e t i s a l r e a d y c o n n e c t e d .
T o o m a n y o p e n f i l e s .
M e s s a g e t o o l o n g .
N e t w o r k i s d o w n .
N e t w o r k d r o p p e d c o n n e c t i o n o n r e s e t .
S O C K E T _ W I N D O W
N e t w o r k i s u n r e a c h a b l e .
N o b u f f e r s p a c e a v a i l a b l e .
B a d p r o t o c o l o p t i o n .
S o c k e t i s n o t c o n n e c t e d .
S o c k e t o p e r a t i o n o n n o n s o c k e t .
O p e r a t i o n n o t s u p p o r t e d .
P r o t o c o l f a m i l y n o t s u p p o r t e d .
T o o m a n y p r o c e s s e s .
E b M o d e
P r o t o c o l n o t s u p p o r t e d .
P r o t o c o l w r o n g t y p e f o r s o c k e t .
C a n n o t s e n d a f t e r s o c k e t s h u t d o w n .
S o c k e t t y p e n o t s u p p o r t e d .
C o n n e c t i o n t i m e d o u t .
R e s o u r c e t e m p o r a r i l y u n a v a i l a b l e .
H o s t n o t f o u n d .
U n k n o w n e r r o r .
S T A T I C
S u c c e s s f u l W S A S t a r t u p n o t y e t p e r f o r m e d .
V a l i d n a m e , n o d a t a r e c o r d o f r e q u e s t e d t y p e .
T h i s i s a n o n r e c o v e r a b l e e r r o r .
N e t w o r k s u b s y s t e m i s u n a v a i l a b l e .
N o n a u t h o r i t a t i v e h o s t n o t f o u n d .
W i n s o c k . d l l v e r s i o n o u t o f r a n g e .
S e t W i n d o w L o n g A
C a l l W i n d o w P r o c A
W S A C l e a n u p
K i l l T i m e r
C S o c k e t M a s t e r . S o c k e t E x i s t s
C S o c k e t M a s t e r . P o s t S o c k e t
C S o c k e t M a s t e r . C o n n e c t T o I P
5 8 5 0 5 0 5 5 8 9 E 5 5 7 5 3 5 1 5 2 3 1 C 0 F C E B 0 9 E 8 x x x x x 0 1 x 8 5 C 0 7 4 2 5 8 B 4 5 1 0 3 D 0 0 8 0 0 0 0 0 7 4 5 4 3 D 0 1 8 0 0 0 0 0 7 4 6 C E 8 3 1 0 0 0 0 0 0 5 A 5 9 5 B 5 F C 9 C 2 1 4 0 0 E 8 2 4 0 0 0 0 0 0 E B F 1 6 8 x x x x x 0 2 x 6 A F C F F 7 5 0 C E 8 x x x x x 0 3 x E 8 x x x x x 0 4 x 6 8 x x x x x 0 5 x 6 A 0 0 E 8 x x x x x 0 6 x E B C F F F 7 5 1 8 F F 7 5 1 4 F F 7 5 1 0 F F 7 5 0 C 6 8 x x x x x 0 7 x E 8 x x x x x 0 8 x C 3 B B x x x x x 0 9 x 8 B 4 5 1 4 B F x x x x x 0 A x 8 9 D 9 F 2 A F 7 5 A 5 2 9 C B 4 B 8 B 1 C 9 D x x x x x 0 B x E B 1 D B B x x x x x 0 C x 8 B 4 5 1 4 B F x x x x x 0 D x 8 9 D 9 F 2 A F 7 5 8 6 2 9 C B 4 B 8 B 1 C 9 D x x x x x 0 E x 8 9 5 D 0 8 8 B 1 B 8 B 5 B 1 C 8 9 D 8 5 A 5 9 5 B 5 F C 9 F F E 0
C S o c k e t M a s t e r . R e s o l v e I f H o s t n a m e
C S o c k e t M a s t e r . S e n d B u f f e r e d D a t a U D P
C S o c k e t M a s t e r . S e n d B u f f e r e d D a t a
P r o t o c o l
R e m o t e H o s t
R e m o t e P o r t
C o n n e c t i o n w a s u n e x p e c t e d l y c l o s e d .
C o n n e c t i o n r e c e i v e d . (
C r e a t i n g o u t g o i n g s o c k e t . (
L o c a l S o c k i n g F a i l u r e :
L o c a l S o c k e t C l o s e d
S o c k e t E r r o r :
R e m o t e S o c k e t C l o s e d
R e m o t e S o c k i n g F a i l u r e :
C o n n e c t i n g
C o n n e c t e d
C l o s i n g C o n n e c t i o n
C l o s e d C o n n e c t i o n
U s e r I n p u t
R e q u e s t C o m p l e t e
m o z s q l i t e 3 . d l l
s q l i t e 3 . d l l
s q l i t e 3 _ o p e n
s q l i t e 3 _ c l o s e
s q l i t e 3 _ p r e p a r e _ v 2
s q l i t e 3 _ s t e p
s q l i t e 3 _ f i n a l i z e
s q l i t e 3 _ c o l u m n _ t e x t
M i c r o s o f t _ W i n I n e t _ *
a b e 2 8 6 9 f - 9 b 4 7 - 4 c d 9 - a 3 5 8 - c 2 2 9 0 4 d b a 7 f 7
F o r E a c h
/ s t e x t m e s s . d a t
\ m e s s . d a t
/ s t e x t m a i l . d a t
\ m a i l . d a t
A p p l i c a t i o n
P a s s w o r d
S O F T W A R E \ M I C R O S O F T \ W i n d o w s N T \ C u r r e n t V e r s i o n
D i g i t a l P r o d u c t I d
B C D F G H J K M P Q R T V W X Y 2 3 4 6 7 8 9
W i n d o w s
p l c 4 . d l l
S O F T W A R E \ C l a s s e s \ A p p l i c a t i o n s \ i e x p l o r e . e x e \ s h e l l \ o p e n \ c o m m a n d
D L L n o t l o a d e d
F a i l e d t o l o c a t e f u n c t i o n :
T o o m a n y p a r a m e t e r s
\ M o z i l l a F i r e f o x \
m o z c r t 1 9 . d l l
n s p r 4 . d l l
p l d s 4 . d l l
n s s u t i l 3 . d l l
s o f t o k n 3 . d l l
n s s 3 . d l l
\ M o z i l l a \ F i r e f o x \
p r o f i l e s . i n i
P r o f i l e 0
\ s i g n o n s . s q l i t e
s e l e c t * f r o m m o z _ l o g i n s
N S S _ I n i t
P K 1 1 _ G e t I n t e r n a l K e y S l o t
P K 1 1 _ A u t h e n t i c a t e
N S S B a s e 6 4 _ D e c o d e B u f f e r
P K 1 1 S D R _ D e c r y p t
P K 1 1 _ F r e e S l o t
N S S _ S h u t d o w n
( D e f a u l t )
( v a l u e n o t s e t )
h t t p \ s h e l l \ o p e n \ c o m m a n d
1 2 7 . 0 . 0 . 1
C r e a t e F i l e W
C r e a t e F i l e M a p p i n g A
M a p V i e w O f F i l e
V i r t u a l P r o t e c t
U n m a p V i e w O f F i l e
C l o s e H a n d l e
G e t M o d u l e F i l e N a m e A
C o n v e r t S t r i n g S e c u r i t y D e s c r i p t o r T o S e c u r i t y D e s c r i p t o r W
R t l A d j u s t P r i v i l e g e
S e t K e r n e l O b j e c t S e c u r i t y
c l o s e a l l
o p e n n e w T y p e w a v e a u d i o A l i a s r e c s o u n d
s e t r e c s o u n d t i m e f o r m a t m s
s e t r e c s o u n d f o r m a t t a g p c m
s e t r e c s o u n d c h a n n e l s
s e t r e c s o u n d s a m p l e s p e r s e c & s S a m p l e s
s e t r e c s o u n d b i t s p e r s a m p l e
s e t r e c s o u n d a l i g n m e n t
r e c o r d r e c s o u n d
s t o p r e c s o u n d
s a v e r e c s o u n d
c l o s e r e c s o u n d
s t a t u s r e c s o u n d c h a n n e l s
s t e r e o
s t a t u s r e c s o u n d b i t s p e r s a m p l e
s t a t u s r e c s o u n d s a m p l e s p e r s e c
s t a t u s r e c s o u n d b y t e s p e r s e c
P l e a s e w a i t . . .
S h o w h i j a c k e d f i l e s
\ d u m p . t x t
\ u T o r r e n t \ u T o r r e n t . e x e / D I R E C T O R Y
/ H I D E
R t l M o v e M e m o r y
N t U n m a p V i e w O f S e c t i o n
V i r t u a l A l l o c E x
N t W r i t e V i r t u a l M e m o r y
N t G e t C o n t e x t T h r e a d
N t S e t C o n t e x t T h r e a d
N t R e s u m e T h r e a d
D I S P L A Y
2 5 5 . 2 5 5 . 2 5 5 . 2 5 5
S e D e b u g P r i v i l e g e
e x e c u t a r c o m a n d o s
l i s t a r a r q u i v o s
r e n o m e a r d i r
c r i a r p a s t a
C y b e r G a t e
f i n a l i z a r p r o c e s s o p o r t a s
V a r i a n t o f C y b e r g a t e
C O N N E C T % s : % i H T T P / 1 . 0
S O F T W A R E \ C l a s s e s \ h t t p \ s h e l l \ o p e n \ c o m m a n d
S e r v i c e S t a r t u p C h a n g e d
S o f t w a r e \ M i c r o s o f t \ A c t i v e S e t u p \ I n s t a l l e d C o m p o n e n t s
V a r i a n t o f P o i s o n I v y
S o f t w a r e \ C l a s s e s \ h t t p \ s h e l l \ o p e n \ c o m m a n d
S o f t w a r e \ M i c r o s o f t \ W i n d o w s N T \ C u r r e n t V e r s i o n \ S y s t e m R e s t o r e
T C o n n e c t i o n T h u m b n a i l
S C R E E N T H U M B
- - f r o n t i e r - -
T R e g i s t r y R e s t r i c t i o n s
S o c k s S e r v e r S t o p p e d
U P L O A D S E R V E R
T A u d i o S t r e a m
V a r i a n t o f S o l i t u d e R A T
c o d e . i s . a . w i n n e r
U S B s p r e a d e r r u n n i n g
[ a u t o r u n ]
f l o o d s t o p p e d
S Y N p a c k e t s s e n t
S o f t w a r e \ K a z a a \ L o c a l C o n t e n t
S o f t w a r e \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ U n i n s t a l l \ e M u l e
V a r i a n t o f B f f B O T
H E R E - I S - A C T I V E X - G U I D
S O F T W A R E \ M I C R O S O F T \ W i n d o w s N T \ C u r r e n t V e r s i o n \ D i g i t a l P r o d u c t I d
T C a n v a s
E r r o r E n d i n g P r o c e s s
Y u k l e n e n D i z i n
D o s y a l a r
I n s t a l l e d A p p l i c a t i o n s
A p o c a l y p s e
W i n d o w M a n a g e r
V a r i a n t o f A p o c a l y p s e R A T
b p s 1 . e x e
b h o o k p l . d l l
b n f a . e x e
d r v l o a d n . d l l
d r v l o a d x . d l l
V N C H o o k s . d l l
x r 4 t d w a . e x e
V a r i a n t o f S c h w a r z e S o n n e R A T
S O F T W A R E \ M i c r o s o f t \ A c t i v e S e t u p \ I n s t a l l e d C o m p o n e n t s
s h u t d o w n . e x e
V a r i a n t o f B a n d o o k R A T
M u t e x D e f a u l t
T i m L i s t C a c h e
C a n N O T C h a n g e B a c k g r o u n d
T C n R a w K e y B o a r d
P l u g i n M u t e x
S c h w a r z e S o n n e
H u n t H T T P D o w n l o a d
t e x t o d a m e n s a g e m
c a p C r e a t e C a p t u r e W i n d o w
s o f t w a r e \ K a z a a
s o f t w a r e \ L i m e W i r e
R t l I n i t U n i c o d e S t r i n g
a u t o r u n . i n f
S P Y _ N E T _ R A T M U T E X
V a r i a n t o f S p y N e t R A T
h t t p s : / / o n l i n e e a s t # . b a n k o f a m e r i c a . c o m
G R A B B E D T A N :
C u s t o m e r S e r v i c e M e n u E n t r y P o i n t ? c u s t A c t i o n
w i n l o g o n . e x e
V a r i a n t o f Z e u s B O T
e x p l o r e r . e x e
S O F T W A R E \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ R u n
S o f t w a r e \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ P o l i c i e s \ E x p l o r e r \ r u n
S O F T W A R E \ M i c r o s o f t \ W i n d o w s N T \ C u r r e n t V e r s i o n \ W i n l o g o n
U s e r i n i t
\ s y s t e m 3 2 \ u s e r i n i t . e x e ,
\ s y s t e m 3 2 \
s t e a m . e x e
h l . e x e
1 & ' ( 2 5
_ e x t e n t x
_ e x t e n t y
_ e x t e n t x
_ e x t e n t y
_ e x t e n t x
_ e x t e n t y
_ e x t e n t x
_ e x t e n t y
( ( ( ( ( (
( ( ( ( ( ( ( ( ( ( ( ( ( ( ( E
( ( ( ( ( ( ( ( ( ( (
( ( ( ( ( (
S ( ( ( ( ( ( (
( ( ( ( ( ( ( ( ( ( (
E E E E E E E E E
E E E E E E
E E E E E E
@ F @ @ F @
A F @ A F @
S E T T I N G S
S E T T I N G S
Hosts
| IP |
|---|
| 114.114.114.114 |
| 8.8.8.8 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com |
A 131.107.255.255
A 131.107.255.255 |
131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 61714 | 8.8.8.8 | 53 |
| 192.168.56.101 | 56933 | 8.8.8.8 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 8.8.8.8 | 53 |
| 192.168.56.101 | 57665 | 114.114.114.114 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.