0.9
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.78
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:MalwareX-gen [Trj] | 20200925 | 18.4.3895.0 |
| Baidu | None | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_80% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200925 | 2013.8.14.323 |
| McAfee | Trojan-FKME!77726358720A | 20200924 | 6.0.6.653 |
| Tencent | Trojan.Win32.Agent.antnoa | 20200925 | 1.0.0.1 |
静态指标
动态指标
网络通信
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
文件已被 VirusTotal 上 56 个反病毒引擎识别为恶意
(50 out of 56 个事件)
| ALYac | Trojan.Agent.CQST |
| APEX | Malicious |
| AVG | Win32:MalwareX-gen [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.Agent.CQST |
| AhnLab-V3 | Trojan/Win32.Agent.R136020 |
| Antiy-AVL | Trojan/Win32.Agent.WTK |
| Arcabit | Trojan.Agent.CQST |
| Avast | Win32:MalwareX-gen [Trj] |
| Avira | TR/Crypt.ZPACK.Gen7 |
| BitDefender | Trojan.Agent.CQST |
| BitDefenderTheta | Gen:NN.ZexaF.34254.nq0@aiRt5@ai |
| Bkav | W32.AIDetectVM.malware2 |
| CAT-QuickHeal | Trojan.Mauvaise.SL1 |
| ClamAV | Win.Malware.Zusy-9759517-0 |
| Comodo | TrojWare.Win32.Agent.A@5j9hfe |
| CrowdStrike | win/malicious_confidence_80% (D) |
| Cylance | Unsafe |
| Cynet | Malicious (score: 100) |
| Cyren | W32/Agent.BSH.gen!Eldorado |
| DrWeb | Trojan.MulDrop5.42246 |
| ESET-NOD32 | a variant of Win32/Agent.WTK |
| Elastic | malicious (high confidence) |
| Emsisoft | Trojan.Agent.CQST (B) |
| F-Secure | Trojan.TR/Crypt.ZPACK.Gen7 |
| FireEye | Generic.mg.77726358720aa947 |
| Fortinet | W32/Agent.WTK!tr |
| GData | Win32.Application.BadJoke.J |
| Ikarus | Trojan.Win32.Agent |
| Invincea | ML/PE-A + Troj/Agent-AOHK |
| Jiangmin | Trojan.Agent.cqea |
| K7AntiVirus | Trojan ( 0040fa391 ) |
| K7GW | Trojan ( 0040fa391 ) |
| Kaspersky | Trojan.Win32.Agent.antno |
| MAX | malware (ai score=88) |
| Malwarebytes | JokeTool.Agent |
| McAfee | Trojan-FKME!77726358720A |
| McAfee-GW-Edition | BehavesLike.Win32.Trojan.dh |
| MicroWorld-eScan | Trojan.Agent.CQST |
| Microsoft | Trojan:Win32/Aenjaris.AL!bit |
| NANO-Antivirus | Trojan.Win32.Patched.foubml |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM19.1.294F.Malware.Gen |
| Rising | Trojan.Agent!1.A728 (CLASSIC) |
| SUPERAntiSpyware | Trojan.Agent/Gen-MulDrop |
| Sangfor | Malware |
| SentinelOne | DFI - Suspicious PE |
| Sophos | Troj/Agent-AOHK |
| Symantec | ML.Attribute.HighConfidence |
| TACHYON | Trojan/W32.Agent.212992.AYB |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2007-06-02 14:27:43
PE Imphash
03ae0108c7455c49c94d2d60afa1e57a
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x000231ab | 0x00024000 | 6.574281676030834 |
| .rdata | 0x00025000 | 0x00007ac4 | 0x00008000 | 4.988844347514809 |
| .data | 0x0002d000 | 0x00005a7c | 0x00002000 | 3.8481414389614104 |
| .rsrc | 0x00033000 | 0x00004940 | 0x00005000 | 3.9249368515190204 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_CURSOR | 0x00034c64 | 0x00000134 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_CURSOR | 0x00034c64 | 0x00000134 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_CURSOR | 0x00034c64 | 0x00000134 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_CURSOR | 0x00034c64 | 0x00000134 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_CURSOR | 0x00034c64 | 0x00000134 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_CURSOR | 0x00034c64 | 0x00000134 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_CURSOR | 0x00034c64 | 0x00000134 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_CURSOR | 0x00034c64 | 0x00000134 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_CURSOR | 0x00034c64 | 0x00000134 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_CURSOR | 0x00034c64 | 0x00000134 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_CURSOR | 0x00034c64 | 0x00000134 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_CURSOR | 0x00034c64 | 0x00000134 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_CURSOR | 0x00034c64 | 0x00000134 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_CURSOR | 0x00034c64 | 0x00000134 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_CURSOR | 0x00034c64 | 0x00000134 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_CURSOR | 0x00034c64 | 0x00000134 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_BITMAP | 0x00034e50 | 0x00000144 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_BITMAP | 0x00034e50 | 0x00000144 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_ICON | 0x00034f94 | 0x00000ca8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_DIALOG | 0x00035d64 | 0x00000034 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_DIALOG | 0x00035d64 | 0x00000034 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_DIALOG | 0x00035d64 | 0x00000034 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_STRING | 0x00037424 | 0x00000042 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_STRING | 0x00037424 | 0x00000042 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_STRING | 0x00037424 | 0x00000042 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_STRING | 0x00037424 | 0x00000042 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_STRING | 0x00037424 | 0x00000042 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_STRING | 0x00037424 | 0x00000042 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_STRING | 0x00037424 | 0x00000042 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_STRING | 0x00037424 | 0x00000042 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_STRING | 0x00037424 | 0x00000042 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_STRING | 0x00037424 | 0x00000042 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_STRING | 0x00037424 | 0x00000042 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_STRING | 0x00037424 | 0x00000042 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_STRING | 0x00037424 | 0x00000042 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_CURSOR | 0x00037590 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_CURSOR | 0x00037590 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_CURSOR | 0x00037590 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_CURSOR | 0x00037590 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_CURSOR | 0x00037590 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_CURSOR | 0x00037590 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_CURSOR | 0x00037590 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_CURSOR | 0x00037590 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_CURSOR | 0x00037590 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_CURSOR | 0x00037590 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_CURSOR | 0x00037590 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_CURSOR | 0x00037590 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_CURSOR | 0x00037590 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_CURSOR | 0x00037590 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_CURSOR | 0x00037590 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x000375a4 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_VERSION | 0x000375b8 | 0x00000330 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_MANIFEST | 0x000378e8 | 0x00000056 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library PSAPI.DLL:
• 0x425264 GetModuleBaseNameA
• 0x425268 GetModuleFileNameExA
• 0x42526c EnumProcessModules
• 0x425270 EnumProcesses
Library KERNEL32.dll:
• 0x42508c GetOEMCP
• 0x425090 SetErrorMode
• 0x425094 GetSystemTimeAsFileTime
• 0x425098 HeapFree
• 0x42509c HeapAlloc
• 0x4250a0 VirtualAlloc
• 0x4250a4 HeapReAlloc
• 0x4250a8 GetCommandLineA
• 0x4250ac GetProcessHeap
• 0x4250b0 GetStartupInfoA
• 0x4250b4 RtlUnwind
• 0x4250b8 ExitProcess
• 0x4250bc RaiseException
• 0x4250c0 HeapSize
• 0x4250c4 TerminateProcess
• 0x4250c8 UnhandledExceptionFilter
• 0x4250cc GetCPInfo
• 0x4250d0 IsDebuggerPresent
• 0x4250d4 SetHandleCount
• 0x4250d8 GetStdHandle
• 0x4250dc GetFileType
• 0x4250e0 HeapDestroy
• 0x4250e4 HeapCreate
• 0x4250e8 VirtualFree
• 0x4250ec FreeEnvironmentStringsA
• 0x4250f0 GetEnvironmentStrings
• 0x4250f4 FreeEnvironmentStringsW
• 0x4250f8 GetEnvironmentStringsW
• 0x4250fc QueryPerformanceCounter
• 0x425100 GetACP
• 0x425104 GetConsoleCP
• 0x425108 GetConsoleMode
• 0x42510c SetStdHandle
• 0x425110 LCMapStringA
• 0x425114 LCMapStringW
• 0x425118 GetStringTypeA
• 0x42511c GetStringTypeW
• 0x425120 WriteConsoleA
• 0x425124 GetConsoleOutputCP
• 0x425128 WriteConsoleW
• 0x42512c GetThreadLocale
• 0x425130 SetEndOfFile
• 0x425134 FlushFileBuffers
• 0x425138 SetFilePointer
• 0x42513c InterlockedIncrement
• 0x425140 TlsFree
• 0x425144 DeleteCriticalSection
• 0x425148 LocalReAlloc
• 0x42514c TlsSetValue
• 0x425150 TlsAlloc
• 0x425154 InitializeCriticalSection
• 0x425158 GlobalHandle
• 0x42515c GlobalReAlloc
• 0x425160 EnterCriticalSection
• 0x425164 TlsGetValue
• 0x425168 LeaveCriticalSection
• 0x42516c LocalAlloc
• 0x425170 GlobalFlags
• 0x425174 FormatMessageA
• 0x425178 LocalFree
• 0x42517c MulDiv
• 0x425180 GlobalGetAtomNameA
• 0x425184 GlobalFindAtomA
• 0x425188 lstrcmpW
• 0x42518c GetVersionExA
• 0x425190 InterlockedDecrement
• 0x425194 GetModuleFileNameW
• 0x425198 SetLastError
• 0x42519c GlobalAddAtomA
• 0x4251a0 GlobalUnlock
• 0x4251a4 GlobalFree
• 0x4251a8 FreeResource
• 0x4251ac WritePrivateProfileStringA
• 0x4251b0 GetCurrentThread
• 0x4251b4 GetCurrentThreadId
• 0x4251b8 ConvertDefaultLocale
• 0x4251bc EnumResourceLanguagesA
• 0x4251c0 GetLocaleInfoA
• 0x4251c4 LoadLibraryA
• 0x4251c8 FindResourceA
• 0x4251cc LoadResource
• 0x4251d0 LockResource
• 0x4251d4 SizeofResource
• 0x4251d8 GlobalLock
• 0x4251dc lstrcmpA
• 0x4251e0 GlobalAlloc
• 0x4251e4 FreeLibrary
• 0x4251e8 GlobalDeleteAtom
• 0x4251ec GetVersion
• 0x4251f0 CompareStringA
• 0x4251f4 GetLastError
• 0x4251f8 InterlockedExchange
• 0x4251fc MultiByteToWideChar
• 0x425200 WideCharToMultiByte
• 0x425204 lstrlenA
• 0x425208 Beep
• 0x42520c GetModuleHandleA
• 0x425210 GetProcAddress
• 0x425214 ReadFile
• 0x425218 GetFileSize
• 0x42521c GetModuleFileNameA
• 0x425220 GetCurrentProcess
• 0x425224 Sleep
• 0x425228 GetCurrentProcessId
• 0x42522c OpenProcess
• 0x425230 CopyFileA
• 0x425234 CloseHandle
• 0x425238 WriteFile
• 0x42523c CreateFileA
• 0x425240 FindClose
• 0x425244 FindFirstFileA
• 0x425248 GetTickCount
• 0x42524c SetUnhandledExceptionFilter
Library USER32.dll:
• 0x425290 LoadCursorA
• 0x425294 ShowWindow
• 0x425298 SetWindowTextA
• 0x42529c IsDialogMessageA
• 0x4252a0 EndPaint
• 0x4252a4 BeginPaint
• 0x4252a8 ReleaseDC
• 0x4252ac GetDC
• 0x4252b0 ClientToScreen
• 0x4252b4 GrayStringA
• 0x4252b8 DrawTextExA
• 0x4252bc TabbedTextOutA
• 0x4252c0 RegisterWindowMessageA
• 0x4252c4 SendDlgItemMessageA
• 0x4252c8 WinHelpA
• 0x4252cc GetCapture
• 0x4252d0 GetClassLongA
• 0x4252d4 GetClassNameA
• 0x4252d8 SetPropA
• 0x4252dc GetPropA
• 0x4252e0 RemovePropA
• 0x4252e4 SetFocus
• 0x4252e8 GetWindowTextA
• 0x4252ec GetTopWindow
• 0x4252f0 GetMessagePos
• 0x4252f4 MapWindowPoints
• 0x4252f8 SetForegroundWindow
• 0x4252fc UpdateWindow
• 0x425300 GetMenu
• 0x425304 GetSubMenu
• 0x425308 GetMenuItemID
• 0x42530c GetMenuItemCount
• 0x425310 CreateWindowExA
• 0x425314 GetClassInfoExA
• 0x425318 GetClassInfoA
• 0x42531c RegisterClassA
• 0x425320 GetSysColor
• 0x425324 AdjustWindowRectEx
• 0x425328 CopyRect
• 0x42532c PtInRect
• 0x425330 GetDlgCtrlID
• 0x425334 DefWindowProcA
• 0x425338 CallWindowProcA
• 0x42533c SetWindowLongA
• 0x425340 SetWindowPos
• 0x425344 SystemParametersInfoA
• 0x425348 GetWindowPlacement
• 0x42534c GetWindowRect
• 0x425350 GetWindow
• 0x425354 UnhookWindowsHookEx
• 0x425358 GetWindowThreadProcessId
• 0x42535c GetLastActivePopup
• 0x425360 MessageBoxA
• 0x425364 LoadIconA
• 0x425368 keybd_event
• 0x42536c GetForegroundWindow
• 0x425370 GetClientRect
• 0x425374 DrawTextA
• 0x425378 SetTimer
• 0x42537c SetCursor
• 0x425380 SetWindowsHookExA
• 0x425384 CallNextHookEx
• 0x425388 GetMessageA
• 0x42538c TranslateMessage
• 0x425390 DispatchMessageA
• 0x425394 IsWindowVisible
• 0x425398 GetKeyState
• 0x42539c PeekMessageA
• 0x4253a0 GetCursorPos
• 0x4253a4 ValidateRect
• 0x4253a8 SetMenuItemBitmaps
• 0x4253ac GetMenuCheckMarkDimensions
• 0x4253b0 DestroyMenu
• 0x4253b4 UnregisterClassA
• 0x4253b8 GetSysColorBrush
• 0x4253bc GetMessageTime
• 0x4253c0 IsIconic
• 0x4253c4 SendMessageA
• 0x4253c8 GetSystemMetrics
• 0x4253cc DrawIcon
• 0x4253d0 SetSysColors
• 0x4253d4 KillTimer
• 0x4253d8 EnableWindow
• 0x4253dc PostMessageA
• 0x4253e0 PostQuitMessage
• 0x4253e4 EndDialog
• 0x4253e8 GetNextDlgTabItem
• 0x4253ec GetParent
• 0x4253f0 IsWindowEnabled
• 0x4253f4 GetDlgItem
• 0x4253f8 LoadBitmapA
• 0x4253fc GetFocus
• 0x425400 ModifyMenuA
• 0x425404 GetMenuState
• 0x425408 EnableMenuItem
• 0x42540c CheckMenuItem
• 0x425410 GetDesktopWindow
• 0x425414 GetActiveWindow
• 0x425418 SetActiveWindow
• 0x42541c CreateDialogIndirectParamA
• 0x425420 DestroyWindow
• 0x425424 IsWindow
• 0x425428 GetWindowLongA
Library GDI32.dll:
• 0x425028 SetWindowExtEx
• 0x42502c ScaleWindowExtEx
• 0x425030 DeleteDC
• 0x425034 GetStockObject
• 0x425038 GetDeviceCaps
• 0x42503c ExtTextOutA
• 0x425040 ScaleViewportExtEx
• 0x425044 SetViewportExtEx
• 0x425048 OffsetViewportOrgEx
• 0x42504c SetViewportOrgEx
• 0x425050 SelectObject
• 0x425054 GetClipBox
• 0x425058 CreateBitmap
• 0x42505c TextOutA
• 0x425060 RectVisible
• 0x425064 PtVisible
• 0x425068 DeleteObject
• 0x42506c SetMapMode
• 0x425070 RestoreDC
• 0x425074 SaveDC
• 0x425078 GetObjectA
• 0x42507c SetBkColor
• 0x425080 SetTextColor
• 0x425084 Escape
Library WINSPOOL.DRV:
• 0x425430 ClosePrinter
• 0x425434 DocumentPropertiesA
• 0x425438 OpenPrinterA
Library ADVAPI32.dll:
• 0x425000 RegQueryValueA
• 0x425004 RegEnumKeyA
• 0x425008 RegDeleteKeyA
• 0x42500c RegCreateKeyExA
• 0x425010 RegOpenKeyExA
• 0x425014 RegQueryValueExA
• 0x425018 RegCloseKey
• 0x42501c RegSetValueExA
• 0x425020 RegOpenKeyA
L!This program cannot be run in DOS mode.
.rdata
@.data
]UQMMH
]UQMMd
ME]UQME
UQMEH Q
UQMEM@
]UQMEM@
UQME]UQM]
E}Pw!M
EPE]%pRB
LMQMQMQWPu
z^3_@[
F3Ch`iB
UQVFtW3;
udWEPu
tSFp;t
3QQQQt$
t$ t$ P
VudhWB
3_[M3^
3_@^V~
VWn3;u
VW13;u
W9t.9Q
UQQSV1^
PMuEh XB
PEPWWuE
j [SEWP
tU;tQWP
_w!MQM+QP
~D~|~d~h~T~`
WqYYMS
QWSPuM
S&3_@[^
x+s;_u
YPV5_^
SVWEP3
VWhpXB
u7EPEPWVWWWsT
EPEPEWVWWWphu9}5
E_^[UQQV3Wu^;u
3%EPEPVh
t0WtIj
vhEPSW
u3_^[]
@ NlQP
H<t2Fpt+VdPt
MQWWVR
MQWWVR
^_VFdt
3@^UQSVW
G\w`Et
3Ct2f~
_^[Vt$
PMEPEPVE
t4;u4j*
};t?VMX
@ Whm(@
EHDm/@
uF`EF\E
39^Xt
3;t9F<
WWWWWz
EHD>1@
u]39}t
P`9~Xt
E S3Ct
u3^[_]
3;t39^
SSj(p
%;N sSv
_j X;~
EMuEPj
W339|$
`lVW3~ ~$~,~0
x4xTLP
~@~<_F(
3QQSUVWZ
0UUUUW
SUVWL$
P(39.tX\$
;UUs Pv
9.u3_^][Y
F WPh>
3@%t 7:
PXyVt$
3@^3^SW1
CT3@_[^F
3PPPw0V
VPp*h:@
+WtrHHt
tA9wht<GE9p t-SYu
E9p$tyC
Y}uN$l
F,^SU39l$
t.G ;t'P
U3FVSw Wf=
VVUVSw 4@
g9n t_;t[9
_^[]UQSVu
YPV-_^
URPQM}
PM`EPuE
Et EPW;t
9}u9~T
MGvTM}=h\B
EPEPvhE
MM3@Md
3VEYEPV
sEEEPE
P4PTHLPPVF,W=TSB
Y_^VN<W
HDHLHH@
~ ~$~(~,~0~4~8~<~@~D~H~L~P~T~X~\~`~d~h~l~p~t~x~|
~ ~$~(~,~0~4~8~<~@~D~H~L~P~T~X~\~`
~$~(~@~DNP}~T~h~lE
3Nxjd]
VWh4^B
VWu*t$
3;t`;(r[VEPVj0
j h<^B
3;VWfUu
uuuPSQX
uVuEf8
SP$*M
QSP |%E f
UQS39]
F 3F$F,F8F<F@FDFHFLFP^
UVF@u"
t3>(r.C N
A(VWt$
t$ t$(PQ@_^
t$$PQT_^
PQX_^]
A(VWt$
t$ t$(PQ\_^
t03f9E
3uS?;t
3?]u4u0u,u(u$u u
3uSn;t
F F$F,F(F8F<F@FDFHFLFP^Vt$
+W+PRVu
S\_^[]
S\_^[]
|3_^[]
U`VWu:
PUP5(SB
EPEPVEPW
W PEPEP
jjVQMj
SUV3WC3D$$
rWWWWt$(
v 3D$$
u8te;t%D$
WWWWt$(
f<FD_^][
A<3PPPq
38}EPF
FpNlFX^Vh:@
_^Vh:@
3^3@^VNLt
^.U0SVW'3;t39w u&z8X
_ 9w$u
_$NH;t
PP^HNL3Ct
^<tIWx<t=
t7j0Ej
F =(TB
[F jP;u
_^[VF W3;u
@\MQ-2
3@Vh:@
pdp`p\
SVW=SB
UQWEP3@x
PuVEPv
{\CdUu
EPV#EXPu
{XYu=y
WuMh:@
O 9Htu
3VW=SB
v P^u_^
u^UVWu
@LtWH$bG
t$$PQ$_^
t$$PQ(_^
t$$PQ,_^
t$$PQ0_^
t$$PQ4_^
t$$PQ8_^
t$$PQ<_^
9M tu @
PQ@_^]
t$$PQD_^
t$$PQP_^
t$ t$(PQT_^
PQX_^]$
PQ\_^]
t$ PQd_^
P3VWt$
u8h\bB
3<hPbB
;F tSu
Ot'@ "jV
PuVC^V
v ^WV@
P'YYt
R;t*G Eu
F EEPu
tzbtQ-
WEPEPVu
uEEPV!Eh
EEPuyME
u:j0^Vj
YYtLjS
Et<=RB
EE EE$EE(E
uuuuuuuuuuuu0
3SSj v j
SSj v ;u
SSj v j
SSj v
SSj P_^[jp9B
PWuGLtMxt
Et!5EMX
;VwltB+
/vq9tlNu}u
uE3VEP
WEEP3Vh
WW}WOE
vdp "u
F,ujEP%|pe
V4RV0RF,
uMVfYu
Y3}MVM
3PPPPhd
SVWj(3EWP3I\
EPEd]B
t!EP}E,]B
SUVW339|$
Uu$u u
EnY3;t
kmj`tmY
3MSF kF \M
SVP`_^[
`tVfF<
3;t;9\$
QSUVWL$
uRWw;uL$
u WE;UuD$
p _^][YVFdt =
pP6u_^
;w%PPS
M_^3[3
YY3@^U$B
EVPjYYM
3E][_^
U_YYPj
U_YYPS
_^][Y3VF
UQS3Vu
3;WtD|$
PCb;YYu
SSOWVQ
@@fuf8u
@@fuUS]
@@fuf8u
w_^+[]t$
]EE39EY
}|j EPjuj
U|]SY39Mt
9Mt#fv
3AQPQV}
E+PURP
3@^[M3_%
ESV54PB
tHMQj<P
MPS M_^3[
WYPWupVt$
jZh3@^VW= SB
F$_F ^SVW=SB
jXWjZWF
_^[SVW
^$>=RB
_^P^D^[
SVW=DQB
|_^[W|$
F\~T@4
Et7W~8EPEPEP
PDOEVt$
UQS39E
;sUQSX
V0tlWu Q
;r>u(F
^UQVW}
PWu/9F
EP~48kB
EPVEP~PME
:M]QE9XuTj
u"F,;W=TSB
^,F(;t
DIj`MIY
u?;u<W
?u3_^[
VWMP8G
KFPu-h
F(W~,+;s
]F0EuN$u
F,P~0Wv j
RPW(F,IS39^
+PRS8';t
N$U)SS+Pj
V,RWv j
[_F(^UQQSVF
EusF0;
WR+QPF0
S~0Wv j
+F(_;E^[s
F(@@;F,v
wF(fL$
+@@PtF(f
EPf}@s$
uVEP;u
3M_3^#
N(F,+;Wr
F,P~0Wv j
F(;^ r
:F(;F0uSu
^(_^[]
UQVEPf}t
EPE^VW6
ODMD3@
P8<YL$
V1QB<Yu^
;YUSVW}
|)jP39~
PSBG;~
;3VGD$
2UQSVu
<A|0<Z
<A|S<Z
@PW?E)E
@8YUSVW}
wW7WSPF
+u_^][
93VED$
3C3tj9~8u@j
F8N8W38^49}
F4k9~8uDj
F8F89x
N8SO8t-
W&UlV?bN8SN4
F4_]^[
#EPrf}
3MF<N<}S8}0F4j
SN4N8P0
1P:N<e
WXbN8SW
S5>P-S_.
]u;N8A
u;tb9]
WN4N8Pc
l1YUSVW}
QSUVW5l*C
;YYr|+
;r;Pt$
3_^][YVj
tAt2t$
+U S39]
;tVEEE
SSSSSO
]8 u d
SSSSSN
Yt.VLX
Yt"V@X
SSSSSM
M9]u#VT
Y}V.YEE
YUQQEP
!NbQPY
3;v.jX3;E
WWWWWK
8_^[]Ud
@@fu+D$
wIVSP?^
YE;t'CH;r
9}uH;u
E;t CH;r
Yt vVb
V3;v)j3X;D$
$UQQSVWd5
SVWE3PPPuu
E_^[E]Vt$
^U8S}
E[UQSE
k 3@[UQSVW}
u@3VZ0
3PuEEd
3PeuEEd
3PEuEEd
Y__^[]Q
6YYuTVWh]A
;r=t*C
uG5l*C
S3;VWt
^0SSSSSF=
3_^[UVu
^0WWWWW<
X_^]UE
VW3;tG9}
^0WWWWWh<
3=VWSwFV;YYt SVW
UUUUUh9
3_^][QL$
u.SSSSS
;u.MSSSSS
f;u8]t
E`p3_^[
H8]tMapj
vP;Qt}
XP;Qt}
9P;Qt}
xP;Qt}
ZP;Qt~
lP;Qt}
NP;Qt~
/fPf;Q
iP;Qt}
KP;Qt}
,P;Qt}
1E3PeuEEEEd
Y__^[]Q
S\$ UVs
8lD$(@
L$ St^Dm
L$(9csmu*=sB
3_^[];t
^0SSSSS
U V39u
2VVVVV
U S39]
u SSSSS
t4;|"Mx
HH_^[US39]
UQS39]
u \SSSSS
uL8"ue8\
SSSSSl
_^[U E
EPeuEEEEd
S3;VWt
^0SSSSSB
WWWWWP
9}uO;u
WWWWWR
;u(SSSSS
E`p3c9]
Map^[j
;u(SSSSS
E`p3c9]
Map^[j
WVS3D$
yYP5$B
YYt:V5 B
P|YF\=B
~lt#Wc
YYt4V5 B
3^_VW3t$
_^VW3j
u_^VW3t$
|YYu-9D$
u_^VW3t$
QPzYYu
uu'9uu-@VVVV
ItFht8lt
HHt@HHt
UM@9u]
itYnt o
EGEEPu
u}PuESP5B
YYY}gu
YYY;-u
0@2If90t
@@;u+E ;u
]+]+]E
EtQ~Mu
3PPPPP#}
]|ux}tf
f]pfElfehfmd
<at9<rt,<wt /SSSSS
J9]u:eE
"SSSSS
Y]3u;5`*C
4V~YY@
YSVWT$
URPQQh =A
t;T$4t
;v.4v\
UVWS33333[_^]
33333USVWj
_^[]Ul$
YYt{L ;u
<@;u_3@
_3[@^3^
Ej(j ^VYY;
3FRj(j IYYtM
;rF9=(
6VVVVV
WWWWW%
W>+~,WPV
Y}3u;5`*C
tVPVYY3BU@
YSVD$
UQQVE3Puu
VVVVVm
VVVVVR
F$|3@_^
03G}39
_^UQQM
MOI;|9 M
3@_^[U
SI VW}
HD9#U#
MLD3#u
]#\D\D
3@3QS\$
3PPPPPF
V"@<Yv8V
3VVVVV
;t%t j
6bYP6U
]_^[Yj
*YYUWVu
r*$tUA
DDDDDDDDDDDDDD
^_UQQVu
EYF`[_^VW39=p*C
t.t$<"u
u_^S39
GW+;YY=4
U@V}E>=Yt/j
SSSSSf
3Y]_^[54
FA>\t>"u&
Pt#JYt
uUEPSS}
=?sJMsB
;r6P<;Yt)UEP
_^[QQ8
SUVW=PB
SSS+S@PVSSD$4
;t2Ue;YD$
t#SSUPt$$VSS
u+@U;Yu
_^][YYVWXB
;r_^VW`B
E3E3;u
QR;YYt
=csmu+
8csmu8x
t*9csmu"A
EP2YYE
>csmuB~
YYtaSVe
YYt)SVWe
Ht Hu4j
S(EF3@
VPu]UQQVu
t+>MOCt#u$u u
EPEPVu WNE
;Es[S;7|G;w
@u"u$u
;Er[_^U,M
Yu\39 ~
EPEPuu W
(u$]u E
u$u uSu
_^[Vt$
tR99u2y
u$Vu u
Q 3@_^[]j
eE}hjA
VW_^]M
(;r3_^[j
RsYt=E
+PRYYt+@$
Y+t"+t
+td+uD
3PPPPPa
u@OdMGd
u wdSUY
hY;uSEP
t!hXXB
r*$TqA
DDDDDDDDDDDDDD
Pu,JYY
Yu[U$l
VYt.VYt"Vv
uVIYt.V=Yt"V1
LubExN
JdtEit@ot;xt6Xu
*ht lt
> n}t8ct
GEMtHE
PCS}uQ
GEMtHEM
PCS}u0
GEMtHEM
EEPEE?
EPEP0R
iUdF<-uEtA
]t:F:s
}u+u Mu
t>Xt9xE
C]SFPM
xtQptL
xt.pt)
uEFuJUE
t9Map0}
3PPPPPY
_^3[cb
ANu_^][U$d
j xrYAj
whu;5B
S3SMNx
8]tEMap<u
E`p[U B
Zf1Af0A@@Ju
@;vFF~
M_^3[]j
PBcY^hS=<QB
3SUVt$
3;Wto=B
;t^9(uZ
;tD9(u@
7%aYYj
KuV`Y_^][SUVt$
P_^][Vt$
SUW=QB
t7t3V0;t(W8Yt
VxY^3j
Fpt"~l
j bkY+j
uu"q9uu-;oVVVV
uugYt6uYYt(uKu
3MEEEE
ItFht8lt
HHtAHHt
GEGEEPu
u}PuESP5B
YYY}gu
YYY;-u
C]StuM!s
RPSW{
0@3If8
@@u+E u
]+]+]E
EtQ~Mu
WSj Ey
3PPPPP
_^3[>O
]|ux}tf
f]pfElfehfmd
8csmu*x
^SSSSS0
^SSSSS0
@G:t Ju
u5x;}r
M9us+E
E`pjPX
bj"^SSSSS0
gbj*X
E`p3_^[
B:t6t:t't
0;u,FaWWWWW
u,9uv'_E
E`p3[_^U39
_UV3PPPPPPPPU
$r ^UV3PPPPPPPPU
Fu8M^t
3@3UQQ}
Mx^3;u+\j
_VVVVV8z
F80t.G
E`p3_^[U,B
^VMQMQp
[SSSSS0
M_^3[CUj
]U$VWu
;u+!Zj
^WWWWW0
SQRP>:
E`p3[_^U
MNXu-Vj
^03PPPPP
(Wj0V[V
E`p3_^[U,B
^VMQMQp
USSSSS0
M_^3[a>U0B
_WMQMQp
TSSSSS8
EHE3}-
M_^3[i=UE
et_EtZfu
VVVVVs
]EuMm]]
3@3hUB
EU_^j
r!Q8nQ
WWWWWW
u&GQ8-Q
;u'vP0\PVVVVV
P30OVVVVV
z@l39H
FE3PPj
MQPuFEu
M3+ME;(
@@FF}f
++PPVh
GE+E;(
EEuV}39ut j
+uRKY'
IVVVVV
^SSSSS0
Map_^[;t.;w(Hj"^SSSSS0
8]tE`pu
0E`p$M
cWSVIH
_};=`*C
YU(SV3E
EP%BYt
t>Ht2Ht&E
^SSSSS0
+t5+t(+t
>t3;t/=
$ MeHM
tSSS6t#
E+PD=P6
_8VVVVV{
9ut(9ut
?VVVVV
;u/>VVVVV
u$EPSRt-
f;u,ft<U
E`p3_[^j
u.<SSSSS
;u.v<SSSSS
3f;u!f;t
E`p3^_[
H8]tMapj
USVWUj
H3h$Uh
P(RP$R
t:|$,t
;t$,v-4v
UQPXY]Y[
S3;VW|[;
t58t0=B
V3;|";
908VVVVV
6Y3C]~
E}uyG&j(j vdYYEta
SSSSS*r
`YU SVW]39
W;tPB]
EP51YYt
SSSSSo
u;tm95
]Y;t%MQj
u3EP0Yt
SSSSSdo
;t(P\Y;
p\Y_^[
^3VVVVV
Iuu}]U
+EPRQL
]u}]S\$
FV#YYG
Wt1t'P
GW>#YYF
3SEEESX5
PZ+t Q3
.WWWWW
uOV-tYt.V!tYt"V
_^SUVt$
t.VysYt"Vms
uAVCs;Yt.V8sYt"V,s
@$t!I-3WWWWW
Mt.E9X
PYYt}E
eMapY+
E`p:39]
Wu8SS3GWh
39]$SSu
;~Ej3X
3;tAuVWuu
EVYuEYY
3;tuSW(
PWu uW
e_^[M3(
M)u(Mu$u u
MapUQQB
SV3;Wu:EP3FVh
39] SSu
ESEYu39]
e_^[M3-
M'u$Mu u
MapVt$
Wru{vnM
tR:QuMPt<:Qu7Pt&:Qu!Pt
@AE9]r3_[
+UV3PPPPPPPPU
$sF ^U
EPQEPEj
RQMQVp
M3"EP3SSSSWEPEPd
E`p3M_^3[
M!EP3SSSSWEPEP
E`p3M_^3[V
^0SSSSSZ
3_^[]UQU
3PPPPP<X
WVU33D$
%#Vt1W}
_VVVVV8W
YY3^]U
EV395 B
tVURPEPQ
jX;EUu
WWWWWFS
j3[_^j
WWWWW=O
;t_+^U
@YY4VE
;t+^8]t
Map_[U
EP63YM38U4B
umYF;~[
w//;t8
-WWuuj
t`][9}
WWWWVuWu
#<;YYEt+WWVPVuWu
uYEe_^[M3U,E
WMEu'339\u
JB|j 3Y+@M
JBj Y+3B\M
3+BL1<
}3^j Y+
WMEu'339\u
JB|j 3Y+@M
JBj Y+3B\M
3+BL1<
}3^j Y+
S3V3EE
F39]$WE}]u]]]]]]]u
<+t(<-t$:t<C
]<+t<-t`}
+t HHt
B:t,1<
+JMtHHt
B:}OMEO?
tEPuEPB
3f;u!GC
]FFEM}
u3}u*e
M_^3[q
]EEEEEEEEEEEE?E
u}u.u*u&f!;f;
;u0u,hLB
VVVVV6
VVVVV6
`;fUu}fEM
3##EEEE
f;u$U@B
u-U}ue
EU}um
u3}u*e
fUfUUUU
3f;~<E
u.U]ue
EU]um
H]Uu39Et
u1}u(}Eu
M36fEfEEEE
fE[E}Me
~(E}Mm
0K;]s;]Es
EM_^3[
SUVW|$
t$(L$$##
"PD$,7
\$(D$(3
P^UWVSM
M_^3[j
/3F F$F(^Vt$
tD,uW39~$~!S^ W
G;~$|[N VF
3F0F4F8^VF
Mt3^/xV5
mSVW$'=t$
PTX_^[
|\EMTXUEMT
E]UQMEM
MGEE;E
RMEEEM
MMT@EH
M}EEE}
PMQURMEE
UREPM`E}
MMEEMQU
JBREPME}
JBREPME}
IAQURME}
IAQURMkE}
UREPME}u
IAQURMJE}
2#MQMU
MPj'|j
EMMQ|Mx+E
+EMB+E
PMQURMM
PMWMQj
PjfM^E
t4}t.j
]Ujha=B
tVPhTB
YM3]U,
M3<]U8B
REPh<B
wpE$4B
MzIh8B
Mk:h\B
]UQM]Ujh.=B
\dH dQE
hM4wMt@
%MK*T$
7M;MnM
DMznT$
FM8;T$
43h7AB
]3hKAB
|YhkAB
pYhvAB
CWinApp
Settings
PreviewPages
DeactivateActCtx
ActivateActCtx
ReleaseActCtx
CreateActCtxA
KERNEL32
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoDrives
RestrictRun
NoNetConnectDisconnect
NoRecentDocsHistory
NoClose
Software\Microsoft\Windows\CurrentVersion\Policies\Network
NoEntireNetwork
Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32
NoPlacesBar
NoBackButton
NoFileMru
ntdll.dll
Control Panel\Desktop\ResourceLocale
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
kernel32.dll
%s.dll
software
CDialog
MS Shell Dlg
CCmdTarget
CWinThread
Software\
CreateActCtxW
comctl32.dll
comdlg32.dll
AfxWnd80s
AfxControlBar80s
AfxMDIFrame80s
AfxFrameOrView80s
AfxOleControl80s
AfxOldWndProc423
EnumDisplayDevicesA
GetMonitorInfoA
EnumDisplayMonitors
MonitorFromPoint
MonitorFromRect
MonitorFromWindow
GetSystemMetrics
USER32
DISPLAY
@1%hiB
InitCommonControls
InitCommonControlsEx
HtmlHelpA
hhctrl.ocx
F#32768
%s (%s:%d)
%s (%s:%d)
Exception thrown in destructor
f:\rtm\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
commctrl_DragListMsg
CGdiObject
CPaintDC
CUserException
CResourceException
CInvalidArgException
CNotSupportedException
CMemoryException
CException
COleException
CObject
Delete
NoRemove
ForceRemove
System
CMapPtrToPtr
MSWHEEL_ROLLMSG
NotifyWinEvent
user32.dll
CArchiveException
CObArray
CByteArray
CPtrArray
bad allocation
CorExitProcess
mscoree.dll
EncodePointer
KERNEL32.DLL
DecodePointer
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
(null)
`h````
xpxxxx
UTF-16LE
UNICODE
runtime error
TLOSS error
SING error
DOMAIN error
An application has made an attempt to load the C runtime library incorrectly.
Please contact the application's support team for more information.
- Attempt to use MSIL code from this assembly during native code initialization
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
- not enough space for locale information
- Attempt to initialize the CRT more than once.
This indicates a bug in your application.
- CRT not initialized
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
This application has requested the Runtime to terminate it in an unusual way.
Please contact the application's support team for more information.
- not enough space for environment
- not enough space for arguments
- floating point not loaded
Microsoft Visual C++ Runtime Library
<program name unknown>
Runtime Error!
Program:
bad exception
InitializeCriticalSectionAndSpinCount
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
`h`hhh
xppwpp
GAIsProcessorFeaturePresent
SunMonTueWedThuFriSat
JanFebMarAprMayJunJulAugSepOctNovDec
Complete Object Locator'
Class Hierarchy Descriptor'
Base Class Array'
Base Class Descriptor at (
Type Descriptor'
`local static thread guard'
`managed vector copy constructor iterator'
`vector vbase copy constructor iterator'
`vector copy constructor iterator'
`dynamic atexit destructor for '
`dynamic initializer for '
`eh vector vbase copy constructor iterator'
`eh vector copy constructor iterator'
`managed vector destructor iterator'
`managed vector constructor iterator'
`placement delete[] closure'
`placement delete closure'
`omni callsig'
delete[]
new[]
`local vftable constructor closure'
`local vftable'
`udt returning'
`copy constructor closure'
`eh vector vbase constructor iterator'
`eh vector destructor iterator'
`eh vector constructor iterator'
`virtual displacement map'
`vector vbase constructor iterator'
`vector destructor iterator'
`vector constructor iterator'
`scalar deleting destructor'
`default constructor closure'
`vector deleting destructor'
`vbase destructor'
`string'
`local static guard'
`typeof'
`vcall'
`vbtable'
`vftable'
operator
delete
__unaligned
__restrict
__ptr64
__clrcall
__fastcall
__thiscall
__stdcall
__pascal
__cdecl
__based(
GetProcessWindowStation
GetUserObjectInformationA
GetLastActivePopup
GetActiveWindow
MessageBoxA
USER32.DLL
Unknown exception
!"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
1#QNAN
1#SNAN
CONOUT$
OLEACC.dll
Invalid DateTime
Invalid DateTimeSpan
C:\windows\%s
C:\windows\system32\%s
C:\windows\system\%s
start %s
del %s
Ha Ha HA !
Still trying !
What`s the point !
I`m so cool :)
Yeap , i`m a bad mother fucker !
NtResumeProcess
ntdll.dll
c:\stop-adw.txt
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
calc.exe
notepad.exe
mspaint.exe
write.exe
You suck
You realy think you can escape me
Mess with the best , die like the rest
I am the one and only
HA HA HA
Com`on , that`s the best you can do
I`m very dissapointed with your performace
Nobady can distroy me
I rule
How lame can u be ?
Local AppWizard-Generated Applications
CreateStdAccessibleObject
LresultFromObject
EnumProcesses
EnumProcessModules
GetModuleFileNameExA
GetModuleBaseNameA
PSAPI.DLL
GetTickCount
FindFirstFileA
FindClose
CreateFileA
WriteFile
CloseHandle
CopyFileA
OpenProcess
GetCurrentProcessId
GetCurrentProcess
GetModuleFileNameA
GetFileSize
ReadFile
GetProcAddress
GetModuleHandleA
lstrlenA
WideCharToMultiByte
MultiByteToWideChar
InterlockedExchange
GetLastError
CompareStringA
GetVersion
GlobalDeleteAtom
FreeLibrary
GlobalAlloc
lstrcmpA
GlobalLock
SizeofResource
LockResource
LoadResource
FindResourceA
LoadLibraryA
GetLocaleInfoA
EnumResourceLanguagesA
ConvertDefaultLocale
GetCurrentThreadId
GetCurrentThread
WritePrivateProfileStringA
FreeResource
GlobalFree
GlobalUnlock
GlobalAddAtomA
SetLastError
GetModuleFileNameW
InterlockedDecrement
GetVersionExA
lstrcmpW
GlobalFindAtomA
GlobalGetAtomNameA
MulDiv
LocalFree
FormatMessageA
GlobalFlags
LocalAlloc
LeaveCriticalSection
TlsGetValue
EnterCriticalSection
GlobalReAlloc
GlobalHandle
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
DeleteCriticalSection
TlsFree
InterlockedIncrement
SetFilePointer
FlushFileBuffers
SetEndOfFile
GetThreadLocale
GetCPInfo
GetOEMCP
SetErrorMode
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
VirtualAlloc
HeapReAlloc
GetCommandLineA
GetProcessHeap
GetStartupInfoA
RtlUnwind
ExitProcess
RaiseException
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetACP
GetConsoleCP
GetConsoleMode
SetStdHandle
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
KERNEL32.dll
LoadIconA
keybd_event
GetForegroundWindow
GetClientRect
DrawTextA
SetTimer
IsIconic
SendMessageA
GetSystemMetrics
DrawIcon
SetSysColors
KillTimer
EnableWindow
PostMessageA
PostQuitMessage
EndDialog
GetNextDlgTabItem
GetParent
IsWindowEnabled
GetDlgItem
GetWindowLongA
IsWindow
DestroyWindow
CreateDialogIndirectParamA
SetActiveWindow
GetActiveWindow
GetDesktopWindow
CheckMenuItem
EnableMenuItem
GetMenuState
ModifyMenuA
GetFocus
LoadBitmapA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
ValidateRect
GetCursorPos
PeekMessageA
GetKeyState
IsWindowVisible
DispatchMessageA
TranslateMessage
GetMessageA
CallNextHookEx
SetWindowsHookExA
SetCursor
MessageBoxA
GetLastActivePopup
GetWindowThreadProcessId
UnhookWindowsHookEx
GetWindow
GetWindowRect
GetWindowPlacement
SystemParametersInfoA
SetWindowPos
SetWindowLongA
CallWindowProcA
DefWindowProcA
GetDlgCtrlID
PtInRect
CopyRect
AdjustWindowRectEx
GetSysColor
RegisterClassA
GetClassInfoA
GetClassInfoExA
CreateWindowExA
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenu
UpdateWindow
SetForegroundWindow
MapWindowPoints
GetMessagePos
GetMessageTime
GetTopWindow
GetWindowTextA
SetFocus
RemovePropA
GetPropA
SetPropA
GetClassNameA
GetClassLongA
GetCapture
WinHelpA
SendDlgItemMessageA
RegisterWindowMessageA
TabbedTextOutA
DrawTextExA
GrayStringA
ClientToScreen
ReleaseDC
BeginPaint
EndPaint
IsDialogMessageA
SetWindowTextA
ShowWindow
LoadCursorA
GetSysColorBrush
UnregisterClassA
DestroyMenu
USER32.dll
CreateBitmap
GetClipBox
SetTextColor
SetBkColor
GetObjectA
SaveDC
RestoreDC
SetMapMode
DeleteObject
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
GetStockObject
GetDeviceCaps
GDI32.dll
ClosePrinter
DocumentPropertiesA
OpenPrinterA
WINSPOOL.DRV
RegOpenKeyA
RegSetValueExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyA
RegQueryValueA
ADVAPI32.dll
ShellExecuteA
SHGetFolderPathA
SHELL32.dll
PathFindExtensionA
PathFindFileNameA
SHLWAPI.dll
OLEAUT32.dll
.PAVCException@@
.?AVCCmdUI@@
.PAVCMemoryException@@
.?AV_AFX_THREAD_STATE@@
.?AVCNoTrackObject@@
.?AVAFX_MODULE_THREAD_STATE@@
.?AVAFX_MODULE_STATE@@
.?AVCDllIsolationWrapperBase@@
.?AVCComCtlWrapper@@
.?AVCCommDlgWrapper@@
.?AV_AFX_BASE_MODULE_STATE@@
xwvutsrqponmlkjihgf
.?AVXAccessible@CWnd@@
.?AVXAccessibleServer@CWnd@@
.?AVCTestCmdUI@@
.?AV_AFX_HTMLHELP_STATE@@
.PAVCUserException@@
.?AV?$IAccessibleProxyImpl@VCAccessibleProxy@ATL@@@ATL@@
.?AUIAccessible@@
.?AUIDispatch@@
.?AUIUnknown@@
.?AUIAccessibleProxy@@
.?AV?$CMFCComObject@VCAccessibleProxy@ATL@@@@
.?AVCAccessibleProxy@ATL@@
.?AV?$CComObjectRootEx@VCComSingleThreadModel@ATL@@@ATL@@
.?AVCComObjectRootBase@ATL@@
.?AUIOleWindow@@
.PAVCResourceException@@
.PAVCSimpleException@@
.PAVCObject@@
.?AVCResourceException@@
.?AVCSimpleException@@
.?AVCException@@
.?AVCUserException@@
.?AVCGdiObject@@
.?AVCDC@@
.?AVCPaintDC@@
.PAVCNotSupportedException@@
.PAVCInvalidArgException@@
.?AVCMemoryException@@
.?AVCNotSupportedException@@
.?AVCInvalidArgException@@
.?AVCOleException@@
.PAVCOleException@@
.?AUCThreadData@@
.?AVCAfxStringMgr@@
.?AUIAtlStringMgr@ATL@@
.?AVCHandleMap@@
.?AVCMapPtrToPtr@@
.?AVCMenu@@
.?AVCObArray@@
.PAVCArchiveException@@
.?AVCArchiveException@@
.?AVCByteArray@@
.?AVCPtrArray@@
.?AVtype_info@@
.?AVbad_exception@std@@
.?AVexception@std@@
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
I x@oGAkU'9p|B
~QCv)/&D(
uuvHMXB
9;5SM]=];Z] T7aZ%]g']
?Zd;On
7?3=Bz
;1az?aUY~S|
D?$?9'
*?}d|FU>c{
zc%C1<!8G
u7.:3q
#2IZ9W
,%I-64OSk%Y
.?AVCObject@@
.?AVCCmdTarget@@
.?AVCWinThread@@
.?AVCWinApp@@
.?AVCAdwTestApp@@
.?AVCWnd@@
.?AVCDialog@@
.?AVCAdwTestDlg@@
??>| <<
>| ???
>|?<< << >|??
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
</assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
@ @ @ @ @ @ @ @
Y a c c P a r e n t
a c c C h i l d C o u n t
a c c C h i l d
a c c N a m e
a c c V a l u e
a c c D e s c r i p t i o n
a c c R o l e
a c c S t a t e
a c c H e l p
a c c H e l p T o p i c
a c c K e y b o a r d S h o r t c u t
a c c F o c u s
a c c S e l e c t i o n
a c c D e f a u l t A c t i o n
a c c S e l e c t
a c c L o c a t i o n
a c c N a v i g a t e
a c c H i t T e s t
a c c D o D e f a u l t A c t i o n
@ @ @ @ @ @
( n u l l )
( ( ( ( ( H
h ( ( ( ( H
H
A A A A A A A A A A
B B B B B B B B B
M S S h e l l D l g
M S S h e l l D l g
C a n c e l
F & H e l p
M S S h e l l D l g
S a v e A s
A l l F i l e s ( * . * )
U n t i t l e d
a n u n n a m e d f i l e
N o e r r o r m e s s a g e i s a v a i l a b l e . ' A n u n s u p p o r t e d o p e r a t i o n w a s a t t e m p t e d . $ A r e q u i r e d r e s o u r c e w a s u n a v a i l a b l e .
O u t o f m e m o r y .
A n u n k n o w n e r r o r h a s o c c u r r e d . $ A n i n v a l i d a r g u m e n t w a s e n c o u n t e r e d .
I n v a l i d f i l e n a m e .
F a i l e d t o o p e n d o c u m e n t .
F a i l e d t o s a v e d o c u m e n t .
S a v e c h a n g e s t o % 1 ? F a i l e d t o c r e a t e e m p t y d o c u m e n t .
T h e f i l e i s t o o l a r g e t o o p e n .
C o u l d n o t s t a r t p r i n t j o b .
F a i l e d t o l a u n c h h e l p .
I n t e r n a l a p p l i c a t i o n e r r o r .
C o m m a n d f a i l e d . ) I n s u f f i c i e n t m e m o r y t o p e r f o r m o p e r a t i o n . P S y s t e m r e g i s t r y e n t r i e s h a v e b e e n r e m o v e d a n d t h e I N I f i l e ( i f a n y ) w a s d e l e t e d . B N o t a l l o f t h e s y s t e m r e g i s t r y e n t r i e s ( o r I N I f i l e ) w e r e r e m o v e d . F T h i s p r o g r a m r e q u i r e s t h e f i l e % s , w h i c h w a s n o t f o u n d o n t h i s s y s t e m . t T h i s p r o g r a m i s l i n k e d t o t h e m i s s i n g e x p o r t % s i n t h e f i l e % s . T h i s m a c h i n e m a y h a v e a n i n c o m p a t i b l e v e r s i o n o f % s .
P l e a s e e n t e r a n i n t e g e r .
P l e a s e e n t e r a n u m b e r . * P l e a s e e n t e r a n i n t e g e r b e t w e e n % 1 a n d % 2 . ( P l e a s e e n t e r a n u m b e r b e t w e e n % 1 a n d % 2 . ( P l e a s e e n t e r n o m o r e t h a n % 1 c h a r a c t e r s .
P l e a s e s e l e c t a b u t t o n . * P l e a s e e n t e r a n i n t e g e r b e t w e e n 0 a n d 2 5 5 . P l e a s e e n t e r a p o s i t i v e i n t e g e r . P l e a s e e n t e r a d a t e a n d / o r t i m e .
P l e a s e e n t e r a c u r r e n c y .
P l e a s e e n t e r a G U I D .
P l e a s e e n t e r a t i m e .
P l e a s e e n t e r a d a t e .
U n e x p e c t e d f i l e f o r m a t . V % 1
C a n n o t f i n d t h i s f i l e .
P l e a s e v e r i f y t h a t t h e c o r r e c t p a t h a n d f i l e n a m e a r e g i v e n . D e s t i n a t i o n d i s k d r i v e i s f u l l . 5 U n a b l e t o r e a d f r o m % 1 , i t i s o p e n e d b y s o m e o n e e l s e . A U n a b l e t o w r i t e t o % 1 , i t i s r e a d - o n l y o r o p e n e d b y s o m e o n e e l s e . . A n u n e x p e c t e d e r r o r o c c u r r e d w h i l e r e a d i n g % 1 . . A n u n e x p e c t e d e r r o r o c c u r r e d w h i l e w r i t i n g % 1 .
% 1 : % 2
C o n t i n u e r u n n i n g s c r i p t ?
D i s p a t c h e x c e p t i o n : % 1
# U n a b l e t o r e a d w r i t e - o n l y p r o p e r t y . # U n a b l e t o w r i t e r e a d - o n l y p r o p e r t y .
# U n a b l e t o l o a d m a i l s y s t e m s u p p o r t .
M a i l s y s t e m D L L i s i n v a l i d . ! S e n d M a i l f a i l e d t o s e n d m e s s a g e .
N o e r r o r o c c u r r e d . - A n u n k n o w n e r r o r o c c u r r e d w h i l e a c c e s s i n g % 1 .
% 1 w a s n o t f o u n d .
% 1 c o n t a i n s a n i n v a l i d p a t h . = % 1 c o u l d n o t b e o p e n e d b e c a u s e t h e r e a r e t o o m a n y o p e n f i l e s .
A c c e s s t o % 1 w a s d e n i e d . . A n i n v a l i d f i l e h a n d l e w a s a s s o c i a t e d w i t h % 1 . < % 1 c o u l d n o t b e r e m o v e d b e c a u s e i t i s t h e c u r r e n t d i r e c t o r y . 6 % 1 c o u l d n o t b e c r e a t e d b e c a u s e t h e d i r e c t o r y i s f u l l .
S e e k f a i l e d o n % 1 5 A h a r d w a r e I / O e r r o r w a s r e p o r t e d w h i l e a c c e s s i n g % 1 . 0 A s h a r i n g v i o l a t i o n o c c u r r e d w h i l e a c c e s s i n g % 1 . 0 A l o c k i n g v i o l a t i o n o c c u r r e d w h i l e a c c e s s i n g % 1 .
D i s k f u l l w h i l e a c c e s s i n g % 1 . . A n a t t e m p t w a s m a d e t o a c c e s s % 1 p a s t i t s e n d .
N o e r r o r o c c u r r e d . - A n u n k n o w n e r r o r o c c u r r e d w h i l e a c c e s s i n g % 1 . / A n a t t e m p t w a s m a d e t o w r i t e t o t h e r e a d i n g % 1 . . A n a t t e m p t w a s m a d e t o a c c e s s % 1 p a s t i t s e n d . 0 A n a t t e m p t w a s m a d e t o r e a d f r o m t h e w r i t i n g % 1 .
% 1 h a s a b a d f o r m a t . " % 1 c o n t a i n e d a n u n e x p e c t e d o b j e c t . % 1 c o n t a i n s a n i n c o r r e c t s c h e m a .
p i x e l s
U n c h e c k
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 4 0 9 0 4 e 4
C o m p a n y N a m e
T O D O : < C o m p a n y n a m e >
F i l e D e s c r i p t i o n
T O D O : < F i l e d e s c r i p t i o n >
F i l e V e r s i o n
1 . 0 . 0 . 1
I n t e r n a l N a m e
A d w T e s t . e x e
L e g a l C o p y r i g h t
T O D O : ( c ) < C o m p a n y n a m e > . A l l r i g h t s r e s e r v e d .
O r i g i n a l F i l e n a m e
A d w T e s t . e x e
P r o d u c t N a m e
T O D O : < P r o d u c t n a m e >
P r o d u c t V e r s i o n
1 . 0 . 0 . 1
V a r F i l e I n f o
T r a n s l a t i o n
Hosts
| IP |
|---|
| 114.114.114.114 |
| 8.8.8.8 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 61714 | 8.8.8.8 | 53 |
| 192.168.56.101 | 56933 | 8.8.8.8 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 8.8.8.8 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.