2.3
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.79
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:GenMalicious-HVT [Trj] | 20200622 | 18.4.3895.0 |
| Baidu | Win32.Backdoor.Agent.i | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200622 | 2013.8.14.323 |
| Tencent | Trojan.Win32.Agent.acf | 20200622 | 1.0.0.1 |
静态指标
观察到命令行控制台输出
(12 个事件)
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(7 个事件)
| section | CODE |
| section | DATA |
| section | BSS |
| section | .aspack |
| section | .adata |
| section | ExeS |
| section |
动态指标
在文件系统上创建可执行文件
(2 个事件)
| file | c:\$$$$$.bat |
| file | C:\Windows\System32\svchosts.exe |
将可执行文件投放到用户的 AppData 文件夹
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\018377ce3c65254ee9d9375dea576dcdb146800758c63488850113480a2608d0.exe |
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(2 个事件)
| section | {'name': '.rsrc', 'virtual_address': '0x00031000', 'virtual_size': '0x0000a000', 'size_of_data': '0x00009800', 'entropy': 6.928504988659096} | entropy | 6.928504988659096 | description | 发现高熵的节 | |||||||||
| section | {'name': 'ExeS', 'virtual_address': '0x0003d000', 'virtual_size': '0x00002000', 'size_of_data': '0x00000e00', 'entropy': 7.547976435746731} | entropy | 7.547976435746731 | description | 发现高熵的节 | |||||||||
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
在 Windows 启动时自我安装以实现自动运行
(1 个事件)
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\SvcHosts32 | reg_value | C:\Windows\system32\svchosts.exe " | ||||||
从磁盘删除已执行的文件
(1 个事件)
| file | c:\$$$$$.bat |
文件已被 VirusTotal 上 65 个反病毒引擎识别为恶意
(50 out of 65 个事件)
| ALYac | Trojan.Generic.3298027 |
| APEX | Malicious |
| AVG | Win32:GenMalicious-HVT [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.Generic.3298027 |
| AhnLab-V3 | Trojan/Win32.Reconyc.R336927 |
| Antiy-AVL | Trojan[Backdoor]/Win32.IRCBot |
| Arcabit | Trojan.Generic.D3252EB |
| Avast | Win32:GenMalicious-HVT [Trj] |
| Avira | WORM/IRCBot.86875 |
| Baidu | Win32.Backdoor.Agent.i |
| BitDefender | Trojan.Generic.3298027 |
| BitDefenderTheta | AI:Packer.335D69251D |
| Bkav | W32.FamVT.DropperAATTc.Worm |
| CAT-QuickHeal | Backdoor.IrcbotPMF.S13476549 |
| ClamAV | Win.Worm.Specx-6854420-0 |
| Comodo | TrojWare.Win32.TrojanDropper.Loring.~A@2lp5q |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.705486 |
| Cylance | Unsafe |
| Cynet | Malicious (score: 100) |
| Cyren | W32/Sdbot.JNAQ-2938 |
| DrWeb | Trojan.MulDrop5.7150 |
| ESET-NOD32 | Win32/Specx.H |
| Emsisoft | Trojan.Generic.3298027 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Sdbot.LHA |
| F-Secure | Worm.WORM/IRCBot.86875 |
| FireEye | Generic.mg.778efbb7054861b7 |
| Fortinet | W32/QQPass.FQ!tr.pws |
| GData | Win32.Trojan.IRCBot.L |
| Ikarus | Trojan-Dropper.Win32.Loring |
| Invincea | heuristic |
| Jiangmin | TrojanDropper.PeStaple.i |
| K7AntiVirus | Trojan ( 004f064f1 ) |
| K7GW | Trojan ( 004f064f1 ) |
| Kaspersky | Trojan.Win32.Reconyc.gunk |
| MAX | malware (ai score=82) |
| Malwarebytes | Backdoor.IRCBot |
| McAfee-GW-Edition | BehavesLike.Win32.Sdbot.hz |
| MicroWorld-eScan | Trojan.Generic.3298027 |
| Microsoft | Backdoor:Win32/IRCbot |
| NANO-Antivirus | Trojan.Win32.IRCBot.dpvlrd |
| Panda | Trj/Dropper.AAP |
| Qihoo-360 | QVM41.1.Malware.Gen |
| Rising | Trojan.Loring!1.A1A2 (RDMK:cmRtazoKn/U+9SYrqA24+n/xzWfO) |
| SUPERAntiSpyware | Trojan.Keygen/Crack[Payload] |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | W32/Sdbot-Gen |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
1992-06-20 06:22:17
PE Imphash
d91adc8b0bbe064a5d31cc207c0180f7
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| CODE | 0x00001000 | 0x00028000 | 0x00028000 | 6.408613864337617 |
| DATA | 0x00029000 | 0x00001000 | 0x00000600 | 3.9446897366261013 |
| BSS | 0x0002a000 | 0x00001000 | 0x00000000 | 0.0 |
| .idata | 0x0002b000 | 0x00001000 | 0x00000c00 | 4.815777321208263 |
| .tls | 0x0002c000 | 0x00001000 | 0x00000000 | 0.0 |
| .rdata | 0x0002d000 | 0x00001000 | 0x00000200 | 0.2044881574398449 |
| .reloc | 0x0002e000 | 0x00003000 | 0x00000000 | 0.0 |
| .rsrc | 0x00031000 | 0x0000a000 | 0x00009800 | 6.928504988659096 |
| .aspack | 0x0003b000 | 0x00001000 | 0x00001000 | 6.1460667020825515 |
| .adata | 0x0003c000 | 0x00001000 | 0x00000000 | 0.0 |
| ExeS | 0x0003d000 | 0x00002000 | 0x00000e00 | 7.547976435746731 |
| 0x0003f000 | 0x00001000 | 0x00000c00 | 4.414216787022435 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x00031654 | 0x00000128 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_ICON | 0x00031654 | 0x00000128 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00032494 | 0x000002a0 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00032494 | 0x000002a0 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00032494 | 0x000002a0 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00032494 | 0x000002a0 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00032494 | 0x000002a0 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00032494 | 0x000002a0 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00032494 | 0x000002a0 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_RCDATA | 0x000327e0 | 0x00007b5b | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_RCDATA | 0x000327e0 | 0x00007b5b | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_RCDATA | 0x000327e0 | 0x00007b5b | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_GROUP_ICON | 0x0003a33c | 0x00000022 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_VERSION | 0x0003a360 | 0x000002bc | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
Imports
Library kernel32.dll:
• 0x42b0dc DeleteCriticalSection
• 0x42b0e0 LeaveCriticalSection
• 0x42b0e4 EnterCriticalSection
• 0x42b0e8 InitializeCriticalSection
• 0x42b0ec VirtualFree
• 0x42b0f0 VirtualAlloc
• 0x42b0f4 LocalFree
• 0x42b0f8 LocalAlloc
• 0x42b0fc GetVersion
• 0x42b100 GetCurrentThreadId
• 0x42b104 InterlockedDecrement
• 0x42b108 InterlockedIncrement
• 0x42b10c VirtualQuery
• 0x42b110 WideCharToMultiByte
• 0x42b114 MultiByteToWideChar
• 0x42b118 lstrlenA
• 0x42b11c lstrcpynA
• 0x42b120 LoadLibraryExA
• 0x42b124 GetThreadLocale
• 0x42b128 GetStartupInfoA
• 0x42b12c GetProcAddress
• 0x42b130 GetModuleHandleA
• 0x42b134 GetModuleFileNameA
• 0x42b138 GetLocaleInfoA
• 0x42b13c GetLastError
• 0x42b140 GetCommandLineA
• 0x42b144 FreeLibrary
• 0x42b148 FindFirstFileA
• 0x42b14c FindClose
• 0x42b150 ExitProcess
• 0x42b154 WriteFile
• 0x42b158 UnhandledExceptionFilter
• 0x42b15c SetFilePointer
• 0x42b160 SetEndOfFile
• 0x42b164 RtlUnwind
• 0x42b168 ReadFile
• 0x42b16c RaiseException
• 0x42b170 GetStdHandle
• 0x42b174 GetFileSize
• 0x42b178 GetFileType
• 0x42b17c CreateFileA
• 0x42b180 CloseHandle
Library user32.dll:
• 0x42b188 GetKeyboardType
• 0x42b18c LoadStringA
• 0x42b190 MessageBoxA
• 0x42b194 CharNextA
Library oleaut32.dll:
• 0x42b1ac SysFreeString
• 0x42b1b0 SysReAllocStringLen
• 0x42b1b4 SysAllocStringLen
Library kernel32.dll:
• 0x42b1bc TlsSetValue
• 0x42b1c0 TlsGetValue
• 0x42b1c4 LocalAlloc
• 0x42b1c8 GetModuleHandleA
Library kernel32.dll:
• 0x42b1e0 lstrlenA
• 0x42b1e4 WriteFile
• 0x42b1e8 WaitForSingleObject
• 0x42b1ec VirtualQuery
• 0x42b1f0 SizeofResource
• 0x42b1f4 SetFilePointer
• 0x42b1f8 SetEvent
• 0x42b1fc SetEndOfFile
• 0x42b200 ResetEvent
• 0x42b204 ReadFile
• 0x42b208 LockResource
• 0x42b20c LoadResource
• 0x42b210 LeaveCriticalSection
• 0x42b214 InitializeCriticalSection
• 0x42b218 GetVersionExA
• 0x42b21c GetThreadLocale
• 0x42b220 GetSystemDirectoryA
• 0x42b224 GetStringTypeExA
• 0x42b228 GetStdHandle
• 0x42b22c GetProcAddress
• 0x42b230 GetModuleHandleA
• 0x42b234 GetModuleFileNameA
• 0x42b238 GetLocaleInfoA
• 0x42b23c GetLocalTime
• 0x42b240 GetLastError
• 0x42b244 GetFullPathNameA
• 0x42b248 GetDiskFreeSpaceA
• 0x42b24c GetDateFormatA
• 0x42b250 GetCurrentThreadId
• 0x42b254 GetCPInfo
• 0x42b258 GetACP
• 0x42b25c FormatMessageA
• 0x42b260 FindResourceA
• 0x42b264 FindFirstFileA
• 0x42b268 FindClose
• 0x42b26c FileTimeToLocalFileTime
• 0x42b270 FileTimeToDosDateTime
• 0x42b274 EnumCalendarInfoA
• 0x42b278 EnterCriticalSection
• 0x42b27c DeleteCriticalSection
• 0x42b280 CreateProcessA
• 0x42b284 CreateMutexA
• 0x42b288 CreateFileA
• 0x42b28c CreateEventA
• 0x42b290 CreateDirectoryA
• 0x42b294 CopyFileA
• 0x42b298 CompareStringA
• 0x42b29c CloseHandle
Library user32.dll:
• 0x42b2a4 MessageBoxA
• 0x42b2a8 LoadStringA
• 0x42b2ac GetSystemMetrics
• 0x42b2b0 CharNextA
• 0x42b2b4 CharToOemA
Library kernel32.dll:
• 0x42b2bc Sleep
Library oleaut32.dll:
• 0x42b2c4 SafeArrayPtrOfIndex
• 0x42b2c8 SafeArrayGetUBound
• 0x42b2cc SafeArrayGetLBound
• 0x42b2d0 SafeArrayCreate
• 0x42b2d4 VariantChangeType
• 0x42b2d8 VariantCopy
• 0x42b2dc VariantClear
• 0x42b2e0 VariantInit
L!This program must be run under Win32
.idata
.rdata
.reloc
.aspack
.adata
StringX
TObjectd
TObjectX
System
IInterface
System
TInterfacedObject%B
Z]_^[SVWU
;u3YZ]_^[
SVWUL$
]_^[SVWUL$
uZ]_^[
YZ]_^[
_^[U3Uh^
d2d"=EB
u3ZYYd
#_^[SVWU
SVW<$L$
]_^[USVW
d1d!=EB
2E3ZYYd
E_^[YY]
UQSVW3B
d1d!=EB
E3ZYYd
E_^[Y]
YZ]_^[
3UhU&@
d2d"=EB
}3ZYYd
E_^[Y]
_^SVWU
< v;"u
3C<"u1ST
>3Q<"u8S
< w]_^[
Ht Ht.g
RPFHP3
6Huv=L
1^6'fF
f=r/f=w)f%f=u
SVWPtl11
-tb+t_$t_xtZXtU0u
FxtHXtCt
~KxI[)G
Y12_^[
PRQYZXt5x
YXYX_^
@~d@PQ@
YXYX
@aQYR@
b@"E@|oe@p+
BkU'9p|B0<RB~QC/j\
Cv)/&D
dEJzEb
9;5S]=];Z T7aZ%]g']
R`%uYnb
uM3Uh3@
EP3ZYYd
f%fUf?f
SOFTWARE\Borland\Delphi\RTL
FPUMaskValue
Iu9u_^[
]U3Uh5@
_^[YY]SV
PRQQTj
ZPR=$B
YZXtpH
S1VWUd
SPRQT$(j
ZTUWVSPRTj
UZd$,1Yd
t=HtN`
r6t0R=
t/=t&,*&"
USVW0B
3Uh2<@
USVW8B
d2d";~
P'v_^[]
aS1WV<
Ou^_[SVWlB
SVWU0B
^v]_^[
XRH<ZX
PQQZXSVW
ISVWRP1L
JyZ_^[X$
thtkFW)w
9uXJt
8uAJt
t8JIt2S
PHXHI|
St-Xt&J|
t@t1SVW
1Z)_^[
K)QY[e
9trtQtTFW)w
9uAJt
f f9u!
Mu]_^[
USVWME]
3mEE;Et
u5];}}
MO|"GE
SVWUEEEh
EPPEPi"
E8\u8Ex
PPP]ttVHPS
@PpPl@
VEPPEPBE_^[]kernel32.dll
GetLongPathNameA
3Uh1Q@
PEPxt"EPEPj
+PEPSnj
+PEPS6j
Software\Borland\Locales
Software\Borland\Delphi\Locales
USVWE8B
t93UhgS@
d0d ]ES
u_^[YY]
UQE3UhS@
d2d"E@
t3ZYYd
USVMU3
;ur;ur
USVMUE}
2Ftl;u
r@EE^[]
SV3UhW@
d0d 03t^
@EPE@PPEYZ~
SV3Uh3X@
d0d t]
@PPEYZ~
U3ZYYd
EF0^[Y]
SV3UhX@
d0d EaE3ZYYd
U3UhNY@
33ZYYd
[]U3UhY@
U3Uh[@
U3Uh[@
Exceptiona@
EHeapException,b@
EOutOfMemory@
EInOutErrorb@
EExternal8c@
EExternalExceptionc@
EIntErrorc@
EDivByZeroHd@
ERangeErrord@
EIntOverflow@
EMathErrorTe@
EInvalidOpe@
EZeroDivide
EOverflow\f@
EUnderflowf@
EInvalidPointer
EInvalidCast@
EConvertErrorg@
EAccessViolation@
EPrivilegeh@
EStackOverflowh@
EControlC4i@
EVariantErrori@
EAssertionFailed@
EAbstractErrorLj@
EIntfCastErrorj@
EOSError@
ESafecallException
SysUtils<k@
SysUtils
TThreadLocalCounter
$TMultiReadExclusiveWriteSynchronizer@
BFKu_^[
BFKu_^[
9t*^ar
| v;}
N|7 vU+A
RV1N0:r
uYZ))v
UV 1P1
UQSVWE
NuE_^[Y]
P;P_^[
PWVSsu
$Z_^[SVWQj
$Z_^[USV
EVEPEPS-EEU^[YY]
u%EPPEPEPEPu
3URURURURP
EUE3RPEUM
E3RPEUjM
1t!F<ar
)t[^_
D$ D$$
3(_^[S
9t<%t^]E<-u
ZYuG1<*t"<0r=<9w9i
uSPE]X[_^[[]
t't#PE
}&EPEPE
lEPEPE
INFNAN
M[YCVut
N^$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)]
00fJu2}
< tN11
EEBN11
[^_]USj
sMf<sGf<sAf
E+EMf`V
f;\Fwb
E_^[YY]
USVMUE]
}EPEf8f}
fMfEfkEdf
fLNfMfMf;Mr
fMf)M@
EZY^[]
d0d !E
f@fEET@
PE{PEPj
U;YU`YE
t%HtIHtm
UYU,YE
UYU2Y}
U>YUY}
UqYuN@
u2UVYE
t _^[USVWMUE
]E3Uh@
_^[YY]
)D>$,Dt
SVWUQ3
$Z]_^[
d0d 3fE
pE3E=B
t"t:Rf}EEfEfEfEfE6f}EEfEfEfEfE
f}EEfEfEfEfE}
;~5fd/\}
fEfEfEfE
fEfEfEfE
@t*EPB
uEPfMfUE3ZYYd
Z_^[UQSVWM]
a_^[Y]
U3QQQQQQSVW3UhK@
JCDHyYU
JC8HVYUC
JE*YUpC
u3ZYYd
t C<DB
SV3Uh@
t,C<`B
EDf^[Y]
d0d EP
U3QQQQQSVW3Uh@
E"E_^[]
D$DPD$HP
PD$LtPD$PPjGP
PD$LPj
d0d EPU
d0d EPU
_^[YY]
TErrorRec
TExceptRec
]]3Uhl@
43ZYYd
t<HtHU
r3t7G=
SV3E3Uh
d0d Ew%
T%tPD$
SV3=DB
SVW3~Ex;
_^[USVWMU
;u|;uu#;]}
J6K;\$
$YZ^[SV
$~F';~
$YZ^[S
SVWU3/P'Z
+G]_^[
YZ]_^[
u^[SVW
_^[US3
U3Uh@@
X@3ZYYd
UQSVW}
tPV3)D7
u_^[Y]
U>Y_^[]
IuS3Uh
d0d i=DB
EJEBEP
m/d/yy
mmmm d, yyyy
:mm:ss
US3E3UhL@
j3ZYYd
kernel32.dll
GetDiskFreeSpaceExA
UQgfEE2E$
Y]SVWUQ
$(Z]_^[
P4F {~
;w$t|o(
Z]_^[SQ
u 3C$C
;F$t=u9$F
;C$t4C
U3UhQ@
d0d -B
YX3ZYYd
E_~x[Y]
S3UhN@
E}w[Y]
S3Uh&@
}=w[Y]
E|v[Y]
US3E3Uh
E0|Rv[YY]
X33ZYYd
E{u[Y]
33ZYYd
EM{ou[Y]
t33ZYYd
Ezt[Y]
Y]oleaut32.dll
VariantChangeTypeEx
VarNeg
VarNot
VarAdd
VarSub
VarMul
VarDiv
VarIdiv
VarMod
VarAnd
VarXor
VarCmp
VarI4FromStr
VarR4FromStr
VarR8FromStr
VarDateFromStr
VarCyFromStr
VarBoolFromStr
VarBstrFromCy
VarBstrFromDate
VarBstrFromBool
TCustomVariantType
TCustomVariantType@
Variants
EVariantInvalidOpError@
EVariantTypeCastError@@
EVariantOverflowError@
EVariantInvalidArgError
EVariantBadVarTypeErrorl@
EVariantBadIndexError@
EVariantArrayLockedError@
EVariantArrayCreateError@
EVariantNotImplError@
EVariantOutOfMemoryError@
EVariantUnexpectedError@
EVariantDispatchErrorUj
d0d UB
-k3ZYYd
q1kY]USV3
MMM3Uh@
d0d U}
j3ZYYd
pj^[]Uj
d0d UxB
=j3ZYYd
E pAjY]USV3
MMM3Uh@
j3ZYYd
oi^[]Uj
d0d UXB
Mi3ZYYd
E/oQiY]U
IuS3Uha@
t?Htbk
Lgg3ZYYd
d0d UB
ef3ZYYd
EGlifY]USM
PP<'PG
KuUKLYt*P
k_^[]SVQf3f
KuUK#YtLP
SP6}_^[]
U3QQQQSV
d0d kPj
gEU*Ul
KeI_^[]
MM3Uh@
d0d EP3Uh@
EPEUkE
g3ZYYd
E^3ZYYd
j|^^[]USV
tQEP3Uh@
EUc3ZYYd
E]E[]U
0EhU2b)
X>UU^(^
UnU^3ZYYd
R^PX^[]USV3
d0d EP3Uh@
e3ZYYd
EW3ZYYd
EcW^[]
EP'3Uh.@
E[5W^[]
d0d Uf
tdEP3Uh@
EPEUcE
d3ZYYd
EV3ZYYd
EboVE[]
<$EgU1`H
d>UtU](]
UJU]3ZYYd
Smallint
Integer
Single
Double
Currency
OleStr
Dispatch
Boolean
Variant
Unknown
Decimal
ShortInt
LongWord
3W3ZYYd
3TUN_^[]
String
Array
ByRef
VariantsUSV
HKu3ZYYd
LqbM^[]U
Z_^[USVWU
_^[YY]
UQSVWEP
JUEh B
Io3Uh{@
d2d"Ef@
oKUEF}
E3ZYYd
anwJE_^[Y]U3Uhk@
?3ZYYd
I]U3Uh
=m3ZYYd
U3Uh*@
4W3ZYYd
U3Uha@
EStreamError@
EFileStreamError@
EFCreateError@
EFOpenError0@
EFilerError@
EReadError@
EWriteError8@
EListError@
EStringListError@
TListT@
TThreadList@
TPersistent@
TPersistent@
Classes
IStringsAdapter
Classes
TStrings @
TStrings@
Classes
TStringItem
TStringListX@
TStringList@
Classes
TStream8@
THandleStream@
TFileStream$@
TRegGroup|@
TRegGroupsUQSVWt
QHKu_^[
R:]_^[
Ku]_^[
c;[]SV9
{9^[SVW
SV3Uh@
d0d UYU
Ee@:^[Y]SV
U6UEEc
d0d E@
4UE33ZYYd
Ee6YY]
}73ZYYd
Eg=7^[]
1g?f$4t3f
@3ZYYd
E<6_^[]
S`]_^[
MUE3Uh
d0d E&
EZ8W<CNu3ZYYd
53ZYYd
En;5_^[]
Q@3ZYYd
USUEEPh
Strings
MMUE3Uh
;u;N|0F3
93E_^[]
[v3YZ^[
SVW3Uhx
d0d U:RU
E82_^[Y]
d0d E3Uh>
S$3ZYYd
E%23ZYYd
E8<n3ZYYd
E71[Y]
MMMUE3Uh
7uN|2FE
EuN|XFE
]ENu3ZYYd
60_^[]
MU3Uhp
ENuE3ZYYd
E5/E_^[]
MMMU3UhG
H|g@EE
EMuE3ZYYd
FKu]_^[UQSVWMM
S$_^[Y]
Ql3ZYYd
E)_.^Y]
d0d ED3Uh
Q,3ZYYd
E-3ZYYd
E3-^[YY]
d0d ;tdE3Uh@
Sd3ZYYd
E#-3ZYYd
-_^[YY]
SdZ]_^[
MUE3UhH
t3ZYYd
Qx3ZYYd
E&+^Y]
EH1j+^[Y]
d0d E2U
Q,3ZYYd
E0*^[Y]
d0d E3Uh'
u3ZYYd
<*3ZYYd
E/ *[YY]
MUE3Uh
d0d E^
K| C3M
Ew/)_^[]
3F F$3F(F,
$Z]_^[
SVWUL$
Sd^[USVW
_^[USVMUE]uE
]CN;};u~
UE|];]|^[]
USVfME]EE
EUEU^[YY]
!ZEUEUYY]
d0d fuiU
UaZEEE
}HUYEEE
USVWUE=\B
Ku3ZYYd
_^[YY]
UQSVWE=\B
Ku3ZYYd
_^[Y]S
)3!SVQ
$0Z^[USV3
U#S3EP
M3ZYYd
SV3Uh/ A
d0d <,
U,(w3E
c3ZYYd
S3Uh A
d0d U}
u3ZYYd
UE3Uh!A
uYwEmU
]Y_UYV
Y3ZYYd
S3Uh%"A
d0d UX=3ZYYd
$Z_^[Uj
SV3Uh#A
d0d U4M
93ZYYd
USVWPB
|3Uh$A
FKu3ZYYd
U3UhP%A
Z33E\B
.3ZYYd
U3Uh%A
d0d -LB
USVWEE
PV7tWS`B
7W53ZYYd
_^[YY]
3UhP'A
EPh\'A
EP4EP43ZYYd
SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
SvcHosts32
U3Uh'A
d0d 3ZYYd
IuSVW'A
3UhA7B
d0d hT7B
P|3r|'
PD3sD(
Pd3wd,
P,3x,-
PL3|L1
_LP3~3Pu
xPt3t~P
apNPl3l5Pw
h|h$OB
Pd37dP.
`3`POB
`P\3\P
XsPT3TZP
=P*PL3\L
b8OP4346Px
P,38,P/
(4(P@B
(P$3$P
PP37Py
dQP38Pz
eRP39P{
xwPt3t^P
Ap.Pl3`l
`P\3\P
fXSPT3T:P|
PL3<LP3
HPD3DP
@xP<3<_P
B8/P43a4
0]0(VB
(P$3$P
hUP3<P~
iVP3=P
jxWPt3t>P
Pl3@lP7
hPd3dP
`|P\3\cP
FX3PT3eT
HPD3DPj
k@XP<3<?Pj
P43A4P8j
0=0H\B
0P,3,Pj
(}P$3$dPj
P3BP9j
~P3ePj
mZP3APj
P3CP:j
n[P3BPj
P3DP;j
P|3|gPj
Jx7Pt3it
pPl3 lP
hPd3dPj
o`\P\3\CPj
PT3ETP<j
PPL3LPj
HPD3DhPj
K@8P<3j< Paj
8f8dbB
8P43!4P
0P,3,Pj
p(]P$3$DPj
q^P3EPj
P3GP>j
M:P3l!Pcj
P3HP?j
N;P3m"Pdj
Pt3ItP@j
pEpHhB
O`<P\3n\#Pej
XPT3%TP
P!P4iB
tHaPD3
P<3J<PAj
P(=P$3o$$Pfj
Q>P3p%Pgj
R?P3q&Phj
P3(P j
S@P|3r|'Pij
xnx8pB
xPt3)tP j
p%plpB
pPl3lPj
xhePd3
XJX4qB
THAPD3sD(Pjj
@P<3*<P!j
8&8HrB
8P434Pj
y0fP,3
VCP3u*Plj
P3,P#j
WDP3v+Pmj
P3-P$j
3 P|3R|
xNx<wB
pPl3luPj
XhEPd3wd,Pnj
`P\3.\P%j
X*X$xB
XPT3TPj
}PjPL3
4H!PD3SD
8P434vPj
Y0FP,3x,-Poj
(t(dyB
(P$3/$P&j
ZGP3y.Ppj
P30P'j
[HP3z/Pqj
P31P(j
\IP3{0Prj
P|32|P)j
8h%Pd3Wd
`S`d~B
]PJPL3|L1Psj
PD33DP*j
90&P,3X,
_LP3~3Puj
P35P,j
P36P-j
apNPl3
Pd37dP.j
=P*PL3\L
b8OP43
P,38,P/j
P39P0j
P3:P1j
P3;P2j
Ap.Pl3`l
fXSPT3
PL3<LP3j
B8/P43a4
RPrx;jK\
RP[w$jKE
RPvjjK
RPuSjKt
RP-ujK
RPst<jK]
RP\s%jKF
RPrgjK
RPqJjKk
RP"qjK
RPdp-jKN
RPoojK
RPnRjKs
RP*njK
RPlm5jKV
RPlwjK
RPk\jK}
RP6kjK
RP|jEjKf
NtPP@B
RPci,jKM
RPhpjK
RPgYjKz
RP3gjK
RPwf@jKa
RP\e%jKF
RPdgjK
p4P(DB
RPcLjKm
RP$cjK
RPfb/jKP
RP`~jKj
RP`T~jKuj
RP,`}jK
RP_}jKj
RPn_7}jKXj
RP^}|jKj
RPW^ |jKAj
RP]{jKj
RP]f{jKj
RP\zjKj
RP\KzjKlj
RP%\yjK
RP[yjKj
RPk[4yjKUj
RPZzxjKj
RPYwjKj
RPYcwjKj
RPXvjKj
XHvjKij
RP XujK
RPWujKj
RPbW+ujKLj
RPVotjKj
RPUsjKj
RPURsjKsj
RP*UrjK
RPTrjKj
RPlT5rjKVj
RPSwqjKj
!~xPMB
RPRpjKj
RPRZpjK{j
c}pP@NB
RP2RojK
}lPlNB
RPQojKj
RPtQ=ojK^j
F|dPNB
{\P$OB
RPWP njKAj
){XPPOB
RPOmjKj
RPOdmjKj
RPNljKj
RPNMljKnj
VyDHPB
RP'NkjK
RPMkjKj
x<PP@B
RPkM4kjKUj
RPLzjjKj
&w,8QB
RPKijKj
RPKcijKj
lv$PQB
RPJhjKj
RPJJhjKkj
RP$JgjK
RPIgjKj
RPjI3gjKTj
RPHyfjKj
RPGejKj
RPG^ejK
RP6GdjK j
RPFdjKj
RPxFAdjKbj
RPEcjKj
RP[E$cjKEj
RPDbjKj
RPDfbjKj
RPCajKj
RPCIajKjj
RP!C`jK
RPB`jKj
RPcB,`jKMj
5mP(VB
RPAn_jKj
RP@^jKj
RP@Q^jKrj
RP)@]jK
RP?]jKj
RPm?6]jKWj
RP>z\jKj
RP=[jKj
RP=c[jKj
RP<ZjKj
RP<LZjKmj
RP&<YjK
RP;YjKj
RPl;5YjKVj
RP:{XjKj
'ehxZB
RP9WjKj
RP9dWjKj
RP8VjKj
cXP<[B
RP8IVjKjj
RcTPh[B
RP!8UjK
RP7UjKj
RPc7,UjKMj
5bHP[B
RP6nTjKj
wa@PH\B
a<Pp\B
RP5SjKj
RP5QSjKrj
Z`4P\B
RP)5RjK
RP4RjKj
_,P ]B
RPk44RjKUj
=_(PL]B
^$Px]B
RP3vQjKj
RP2PjKj
RP2YPjKzj
RP12OjK
RP1OjKj
RPs1<OjK]j
RP0~NjKj
RPV0 NjK@j
RP/MjKj
RP/eMjKj
RP.LjKj
RP.NLjKoj
RP(.KjK
RP-KjKj
RPn-7KjKXj
RP,}JjKj
RPW, JjKAj
RP+IjKj
RP+fIjKj
RP*HjKj
RP*OHjKpj
RP)*GjK
RP)GjKj
RPm)6GjKWj
RP(xFjKj
"SP@dB
RP'EjKj
RP'[EjK|j
RP3'DjK
RP&DjKj
RPu&>DjK_j
GQP@eB
RP%CjKj
RPX%!CjKBj
RP$BjKj
RP$cBjKj
lO|PfB
RP#AjKj
RP}#FAjKgj
ONpPLgB
RP"@jKj
RPd"-@jKNj
RP!s?jKj
RP >jK
RP \>jK}j
eKP4iB
RP6 =jK j
RP =jK
RP| E=jKfj
RP <jK
.<jKOj
7I8PjB
{H0P<kB
U:jKvj
^G$P$lB
F PhlB
89jKYj
]7jK~j
B6jKcj
'5jKHj
V3jKwj
?2jK`j
&1jKGj
Q/jKrj
4.jKUj
=;PHtB
Y,jKzj
b9P\uB
<+jK]j
7|P,vB
7xPPcB
*jK@j
(7tP\vB
j6lPvB
5dP<wB
D(jKej
M5`twB
-'jKNj
64T$xB
3HPxB
Z%jK{j
c2@0yB
C$jKdj
,#jKMj
50(`zB
W!jKxj
> jK_j
! jKBj
*,Pp|B
O*Px}B
2)P0~B
M pPPB
Pn&3ZYYd
svchostsx
\drivers32
svchosts.exe
\drivers32\
Twist.exe
\drivers32\Half-Life 2 No-Cd Crack.exe
\drivers32\Half-Life No-Cd Crack.exe
\drivers32\Half-Life II No-Cd Crack.exe
\drivers32\Knights of the Temple No-Cd Crack.exe
\drivers32\Tomb Raider - The Angel of Darkness No-Cd Crack.exe
\drivers32\Age of Mythology - The Titans No-Cd Crack.exe
\drivers32\Sniper Elite - Berlin 1943 No-Cd Crack.exe
\drivers32\Chrome No-Cd Crack.exe
\drivers32\Etherlords II No-Cd Crack.exe
\drivers32\Halo No-Cd Crack.exe
\drivers32\Dark Age of Camelot - Trials of Atlantis No-Cd Crack.exe
\drivers32\Lords of EverQuest No-Cd Crack.exe
\drivers32\FireStarter No-Cd Crack.exe
\drivers32\Unreal Tournament 2004 No-Cd Crack.exe
\drivers32\Unreal Tournament 2003 No-Cd Crack.exe
\drivers32\UT 2004 No-Cd Crack.exe
\drivers32\UT 2003 No-Cd Crack.exe
\drivers32\Kings of War No-Cd Crack.exe
\drivers32\Xenus No-Cd Crack.exe
\drivers32\Black & White 2 No-Cd Crack.exe
\drivers32\FIFA Soccer 2004 No-Cd Crack.exe
\drivers32\FIFA Soccer 2003 No-Cd Crack.exe
\drivers32\Commandos 3 - Destination Berlin No-Cd Crack.exe
\drivers32\Train Simulator 2 No-Cd Crack.exe
\drivers32\Flight Simulator - Century of Flight No-Cd Crack.exe
\drivers32\Need for Speed Underground No-Cd Crack.exe
\drivers32\Metal Gear Solid No-Cd Crack.exe
\drivers32\Metal Gear Solid 2 No-Cd Crack.exe
\drivers32\Raven Shield No-Cd Crack.exe
\drivers32\Rainbow Six 3 - Raven Shield No-Cd Crack.exe
\drivers32\Delta Force - Black Hawk Down No-Cd Crack.exe
\drivers32\Praetorians No-Cd Crack.exe
\drivers32\NASCAR Racing 2003 No-Cd Crack.exe
\drivers32\Splinter Cell No-Cd Crack.exe
\drivers32\Command & Conquer Generals No-Cd Crack.exe
\drivers32\SimCity 4 No-Cd Crack.exe
\drivers32\Battlefield 1942 - The Road to Rome No-Cd Crack.exe
\drivers32\Elder Scrolls III - Tribunal No-Cd Crack.exe
\drivers32\NBA Live 2003 No-Cd Crack.exe
\drivers32\NBA Live 2004 No-Cd Crack.exe
\drivers32\IL-2 Sturmovik - Forgotten Battles No-Cd Crack.exe
\drivers32\Warcraft III - The Frozen Throne No-Cd Crack.exe
\drivers32\Warcraft III No-Cd Crack.exe
\drivers32\Warcraft 3 No-Cd Crack.exe
\drivers32\Grand Theft Auto - Vice City No-Cd Crack.exe
\drivers32\Return to Castle Wolfenstein Enemy Territory No-Cd Crack.exe
\drivers32\Return to Castle Wolfenstein No-Cd Crack.exe
\drivers32\Star Trek - Elite Force II No-Cd Crack.exe
\drivers32\Neverwinter Nights - Shadows of Undrentide No-Cd Crack.exe
\drivers32\The Sims Superstar No-Cd Crack.exe
\drivers32\Tony Hawks Pro Skater 4 No-Cd Crack.exe
\drivers32\Counter-Strike - Condition Zero No-Cd Crack.exe
\drivers32\Age of Wonders II - Shadow Magic No-Cd Crack.exe
\drivers32\ICUII 5.x.exe
\drivers32\NASCAR Thunder 2004 No-Cd Crack.exe
\drivers32\Lords of the Realm III No-Cd Crack.exe
\drivers32\Civilization III - Conquest No-Cd Crack.exe
\drivers32\Conflict - Desert Storm II - Back to Baghdad No-Cd Crack.exe
\drivers32\Harry Potter - Quidditch World Cup No-Cd Crack.exe
\drivers32\Railroad Tycoon III No-Cd Crack.exe
\drivers32\Battlefield 1942 - Secret Weapons of World War II No-Cd Crack.exe
\drivers32\DOOM 3 No-Cd Crack.exe
\drivers32\DOOM III No-Cd Crack.exe
\drivers32\EverQuest 2 No-Cd Crack.exe
\drivers32\Freedom - Soldiers of Liberty No-Cd Crack.exe
\drivers32\Lord of the Rings - The Two Towers No-Cd Crack.exe
\drivers32\Max Payne 2 - The Fall of Max Payne No-Cd Crack.exe
\drivers32\Medal of Honor - Allied Assault Breakthrough No-Cd Crack.exe
\drivers32\Silent Hill 3 No-Cd Crack.exe
\drivers32\Silent Hill III No-Cd Crack.exe
\drivers32\SimCity 4 Rush Hour No-Cd Crack.exe
\drivers32\SimCity IV No-Cd Crack.exe
\drivers32\Star Wars Jedi Knight - Jedi Academy No-Cd Crack.exe
\drivers32\Star Wars - Knights of the Old Republic No-Cd Crack.exe
\drivers32\Train Simulator II No-Cd Crack.exe
\drivers32\Soul Reaver 3 No-Cd Crack.exe
\drivers32\Soul Reaver III No-Cd Crack.exe
\drivers32\Warlords IV - Heroes of Etheria No-Cd Crack.exe
\drivers32\Warlords 4 No-Cd Crack.exe
\drivers32\World War II - Frontline Command No-Cd Crack.exe
\drivers32\Lord of the Rings - War of the Ring No-Cd Crack.exe
\drivers32\Metal Gear Solid 3 No-Cd Crack.exe
\drivers32\Metal Gear Solid III No-Cd Crack.exe
\drivers32\Hitman 3 No-Cd Crack.exe
\drivers32\Hitman III No-Cd Crack.exe
\drivers32\Hitman 2 No-Cd Crack.exe
\drivers32\Hitman II No-Cd Crack.exe
\drivers32\Trinity No-Cd Crack.exe
\drivers32\MechWarrior 5 No-Cd Crack.exe
\drivers32\MechWarrior 4 No-Cd Crack.exe
\drivers32\MechWarrior 3 No-Cd Crack.exe
\drivers32\MechWarrior V No-Cd Crack.exe
\drivers32\MechWarrior IV No-Cd Crack.exe
\drivers32\MechWarrior III No-Cd Crack.exe
\drivers32\Midtown Madness III No-Cd Crack.exe
\drivers32\Midtown Madness 3 No-Cd Crack.exe
\drivers32\Midtown Madness 2 No-Cd Crack.exe
\drivers32\Midtown Madness II No-Cd Crack.exe
\drivers32\Quake IV No-Cd Crack.exe
\drivers32\Quake 4 No-Cd Crack.exe
\drivers32\Quake 3 No-Cd Crack.exe
\drivers32\Quake III No-Cd Crack.exe
\drivers32\Shrek 2 No-Cd Crack.exe
\drivers32\Shrek II No-Cd Crack.exe
\drivers32\Thief III No-Cd Crack.exe
\drivers32\Thief II No-Cd Crack.exe
\drivers32\Thief 3 No-Cd Crack.exe
\drivers32\Thief 2 No-Cd Crack.exe
\drivers32\MVP Baseball 2003 No-Cd Crack.exe
\drivers32\Madden NFL 2004 No-Cd Crack.exe
\drivers32\Madden NFL 2003 No-Cd Crack.exe
\drivers32\NCAA Football 2004 No-Cd Crack.exe
\drivers32\NCAA Football 2003 No-Cd Crack.exe
\drivers32\Tiger Woods PGA TOUR 2003 No-Cd Crack.exe
\drivers32\Tiger Woods PGA TOUR 2002 No-Cd Crack.exe
\drivers32\NHL 2003 No-Cd Crack.exe
\drivers32\NHL 2002 No-Cd Crack.exe
\drivers32\F1 2002 No-Cd Crack.exe
\drivers32\NASCAR Thunder 2003 No-Cd Crack.exe
\drivers32\WinZip 8.1 Crack.exe
\drivers32\WinZip 8.0 Crack.exe
\drivers32\Ad-aware 6.0 Crack.exe
\drivers32\Download Accelerator Plus 5.3 Crack.exe
\drivers32\DAP Plus 5.3 Crack.exe
\drivers32\WinRAR 3.11 Crack.exe
\drivers32\WinRAR 3.12 Crack.exe
\drivers32\RealOne Player 2.0 Crack.exe
\drivers32\Divx 5.x Crack.exe
\drivers32\ZoneAlarm 3.7.143 Crack.exe
\drivers32\ZoneAlarm 3.8 Crack.exe
\drivers32\ZoneAlarm 3.x Crack.exe
\drivers32\Adobe Acrobat 5.x Crack.exe
\drivers32\WS_FTP 5.x Crack.exe
\drivers32\SolSuite 2003 Crack.exe
\drivers32\QuickTime 6.x Crack.exe
\drivers32\Winamp 2.91 Crack.exe
\drivers32\Winamp 3.x Crack.exe
\drivers32\Easy CD-DA Extractor 5.1 Crack.exe
\drivers32\Easy CD-DA Extractor 5.x Crack.exe
\drivers32\MusicMatch Jukebox 8.0 Crack.exe
\drivers32\MusicMatch Jukebox 8.x Crack.exe
\drivers32\Internet Download Manager 3.15 Crack.exe
\drivers32\Internet Download Manager 3.x Crack.exe
\drivers32\WinZip 9.x Crack.exe
\drivers32\PhotoShow 2.0 Crack.exe
\drivers32\PhotoShow 2.x Crack.exe
\drivers32\SWiSH 2.0 Crack.exe
\drivers32\SWiSH 2.x Crack.exe
\drivers32\ACDSee 2.4.x Crack.exe
\drivers32\Paint Shop Pro 8.x Crack.exe
\drivers32\Adobe Photoshop 7.x Crack.exe
\drivers32\Adobe Photoshop 8.x Crack.exe
\drivers32\Paint Shop Pro 9.x Crack.exe
\drivers32\Macromedia Flash MX 6.x Crack.exe
\drivers32\Ulead PhotoImpact 8.x Crack.exe
\drivers32\Ulead PhotoImpact 9.x Crack.exe
\drivers32\Ulead GIF Animator 5.x Crack.exe
\drivers32\Ulead GIF Animator 6.x Crack.exe
\drivers32\Nero Burning ROM 5.5.x Crack.exe
\drivers32\Nero Burning ROM 6.x Crack.exe
\drivers32\Network Cable e ADSL Speed 1.x Crack.exe
\drivers32\Network Cable e ADSL Speed 1.0.6 Crack.exe
\drivers32\NetPumper 1.03 Crack.exe
\drivers32\Internet Turbo 2003 5.4 Crack.exe
\drivers32\Internet Turbo 2003 5.x Crack.exe
\drivers32\KaZaA Speedup 3.03 Crack.exe
\drivers32\KaZaA Speedup 3.x Crack.exe
\drivers32\GetRight 5.0 Crack.exe
\drivers32\GetRight 5.x Crack.exe
\drivers32\GetRight 6.x Crack.exe
\drivers32\mIRC 6.03 Crack.exe
\drivers32\mIRC 6.x Crack.exe
\drivers32\Alpha Communicator 5.0 Crack.exe
\drivers32\Direct Connect 1.x Crack.exe
\drivers32\ICUII 5.7 Crack.exe
\drivers32\GeoWhere 2.11 Crack.exe
\drivers32\GeoWhere 2.x Crack.exe
\drivers32\LingoWare 3.0 Crack.exe
\drivers32\FlashGet 1.3 Crack.exe
\drivers32\FlashGet 1.x Crack.exe
\drivers32\SnagIt 6.2.2 Crack.exe
\drivers32\Hex Workshop Hex Editor 4.1 Crack.exe
\drivers32\UltraEdit-32 10.00b Crack.exe
\drivers32\UltraEdit-32 10.x Crack.exe
\drivers32\Armor2net Personal Firewall 3.1 Crack.exe
\drivers32\WinAce 2.2 Crack.exe
\drivers32\WinAce 2.x Crack.exe
\drivers32\CloneCD 4.x Crack.exe
\drivers32\CloneCD 5.0 Crack.exe
\drivers32\FlashFXP 1.4 Crack.exe
\drivers32\FlashFXP 1.x Crack.exe
\drivers32\WindowBlinds 4.0 Crack.exe
\drivers32\WindowBlinds 4.x Crack.exe
\drivers32\IconPackager 2.12 Crack.exe
\drivers32\IconPackager 2.x Crack.exe
\drivers32\Microangelo 5.58 Crack.exe
\drivers32\Microangelo 5.x Crack.exe
\drivers32\Microangelo 6.x Crack.exe
\drivers32\Soul Reaver 3 Serial Generator.exe
\drivers32\Half-Life Serial Generator.exe
\drivers32\Half-Life II Serial Generator.exe
\drivers32\Knights of the Temple Serial Generator.exe
\drivers32\Tomb Raider - The Angel of Darkness Serial Generator.exe
\drivers32\Age of Mythology - The Titans Serial Generator.exe
\drivers32\Sniper Elite - Berlin 1943 Serial Generator.exe
\drivers32\Chrome Serial Generator.exe
\drivers32\Etherlords II Serial Generator.exe
\drivers32\Halo Serial Generator.exe
\drivers32\Dark Age of Camelot - Trials of Atlantis Serial Generator.exe
\drivers32\Lords of EverQuest Serial Generator.exe
\drivers32\FireStarter Serial Generator.exe
\drivers32\Unreal Tournament 2004 Serial Generator.exe
\drivers32\Unreal Tournament 2003 Serial Generator.exe
\drivers32\UT 2004 Serial Generator.exe
\drivers32\UT 2003 Serial Generator.exe
\drivers32\Kings of War Serial Generator.exe
\drivers32\Xenus Serial Generator.exe
\drivers32\Black & White 2 Serial Generator.exe
\drivers32\FIFA Soccer 2004 Serial Generator.exe
\drivers32\FIFA Soccer 2003 Serial Generator.exe
\drivers32\Commandos 3 - Destination Berlin Serial Generator.exe
\drivers32\Train Simulator 2 Serial Generator.exe
\drivers32\Flight Simulator - Century of Flight Serial Generator.exe
\drivers32\Need for Speed Underground Serial Generator.exe
\drivers32\Metal Gear Solid Serial Generator.exe
\drivers32\Metal Gear Solid 2 Serial Generator.exe
\drivers32\Raven Shield Serial Generator.exe
\drivers32\Rainbow Six 3 - Raven Shield Serial Generator.exe
\drivers32\Delta Force - Black Hawk Down Serial Generator.exe
\drivers32\Praetorians Serial Generator.exe
\drivers32\NASCAR Racing 2003 Serial Generator.exe
\drivers32\Splinter Cell Serial Generator.exe
\drivers32\Command & Conquer Generals Serial Generator.exe
\drivers32\SimCity 4 Serial Generator.exe
\drivers32\Battlefield 1942 - The Road to Rome Serial Generator.exe
\drivers32\Elder Scrolls III - Tribunal Serial Generator.exe
\drivers32\NBA Live 2003 Serial Generator.exe
\drivers32\NBA Live 2004 Serial Generator.exe
\drivers32\IL-2 Sturmovik - Forgotten Battles Serial Generator.exe
\drivers32\Warcraft III - The Frozen Throne Serial Generator.exe
\drivers32\Warcraft III Serial Generator.exe
\drivers32\Warcraft 3 Serial Generator.exe
\drivers32\Grand Theft Auto - Vice City Serial Generator.exe
\drivers32\Return to Castle Wolfenstein Enemy Territory Serial Generator.exe
\drivers32\Return to Castle Wolfenstein Serial Generator.exe
\drivers32\Star Trek - Elite Force II Serial Generator.exe
\drivers32\Neverwinter Nights - Shadows of Undrentide Serial Generator.exe
\drivers32\The Sims Superstar Serial Generator.exe
\drivers32\Tony Hawks Pro Skater 4 Serial Generator.exe
\drivers32\Counter-Strike - Condition Zero Serial Generator.exe
\drivers32\Age of Wonders II - Shadow Magic Serial Generator.exe
\drivers32\Alpha Communicator 5.0 Serial Generator.exe
\drivers32\NASCAR Thunder 2004 Serial Generator.exe
\drivers32\Lords of the Realm III Serial Generator.exe
\drivers32\Civilization III - Conquest Serial Generator.exe
\drivers32\Conflict - Desert Storm II - Back to Baghdad Serial Generator.exe
\drivers32\Harry Potter - Quidditch World Cup Serial Generator.exe
\drivers32\Railroad Tycoon III Serial Generator.exe
\drivers32\Battlefield 1942 - Secret Weapons of World War II Serial Generator.exe
\drivers32\DOOM 3 Serial Generator.exe
\drivers32\DOOM III Serial Generator.exe
\drivers32\EverQuest 2 Serial Generator.exe
\drivers32\Freedom - Soldiers of Liberty Serial Generator.exe
\drivers32\Lord of the Rings - The Two Towers Serial Generator.exe
\drivers32\Max Payne 2 - The Fall of Max Payne Serial Generator.exe
\drivers32\Medal of Honor - Allied Assault Breakthrough Serial Generator.exe
\drivers32\Silent Hill 3 Serial Generator.exe
\drivers32\Silent Hill III Serial Generator.exe
\drivers32\SimCity 4 Rush Hour Serial Generator.exe
\drivers32\SimCity IV Serial Generator.exe
\drivers32\Star Wars Jedi Knight - Jedi Academy Serial Generator.exe
\drivers32\Star Wars - Knights of the Old Republic Serial Generator.exe
\drivers32\Train Simulator II Serial Generator.exe
\drivers32\Soul Reaver III Serial Generator.exe
\drivers32\Warlords IV - Heroes of Etheria Serial Generator.exe
\drivers32\Warlords 4 Serial Generator.exe
\drivers32\World War II - Frontline Command Serial Generator.exe
\drivers32\Lord of the Rings - War of the Ring Serial Generator.exe
\drivers32\Metal Gear Solid 3 Serial Generator.exe
\drivers32\Metal Gear Solid III Serial Generator.exe
\drivers32\Hitman 3 Serial Generator.exe
\drivers32\Hitman III Serial Generator.exe
\drivers32\Hitman 2 Serial Generator.exe
\drivers32\Hitman II Serial Generator.exe
\drivers32\Trinity Serial Generator.exe
\drivers32\MechWarrior 5 Serial Generator.exe
\drivers32\MechWarrior 4 Serial Generator.exe
\drivers32\MechWarrior 3 Serial Generator.exe
\drivers32\MechWarrior V Serial Generator.exe
\drivers32\MechWarrior IV Serial Generator.exe
\drivers32\MechWarrior III Serial Generator.exe
\drivers32\Midtown Madness 3 Serial Generator.exe
\drivers32\Midtown Madness III Serial Generator.exe
\drivers32\Midtown Madness 2 Serial Generator.exe
\drivers32\Midtown Madness II Serial Generator.exe
\drivers32\Quake IV Serial Generator.exe
\drivers32\Quake 4 Serial Generator.exe
\drivers32\Quake 3 Serial Generator.exe
\drivers32\Quake III Serial Generator.exe
\drivers32\Shrek 2 Serial Generator.exe
\drivers32\Shrek II Serial Generator.exe
\drivers32\Thief III Serial Generator.exe
\drivers32\Thief II Serial Generator.exe
\drivers32\Thief 3 Serial Generator.exe
\drivers32\Thief 2 Serial Generator.exe
\drivers32\MVP Baseball 2003 Serial Generator.exe
\drivers32\Madden NFL 2004 Serial Generator.exe
\drivers32\Madden NFL 2003 Serial Generator.exe
\drivers32\NCAA Football 2004 Serial Generator.exe
\drivers32\NCAA Football 2003 Serial Generator.exe
\drivers32\Tiger Woods PGA TOUR 2003 Serial Generator.exe
\drivers32\Tiger Woods PGA TOUR 2002 Serial Generator.exe
\drivers32\NHL 2003 Serial Generator.exe
\drivers32\NHL 2002 Serial Generator.exe
\drivers32\F1 2002 Serial Generator.exe
\drivers32\NASCAR Thunder 2003 Serial Generator.exe
\drivers32\WinZip 8.1 Serial Generator.exe
\drivers32\WinZip 8.0 Serial Generator.exe
\drivers32\Ad-aware 6.0 Serial Generator.exe
\drivers32\Download Accelerator Plus 5.3 Serial Generator.exe
\drivers32\DAP Plus 5.3 Serial Generator.exe
\drivers32\WinRAR 3.11 Serial Generator.exe
\drivers32\WinRAR 3.12 Serial Generator.exe
\drivers32\RealOne Player 2.0 Serial Generator.exe
\drivers32\Divx 5.x Serial Generator.exe
\drivers32\ZoneAlarm 3.7.143 Serial Generator.exe
\drivers32\ZoneAlarm 3.8x Serial Generator.exe
\drivers32\ZoneAlarm 3.x Serial Generator.exe
\drivers32\Adobe Acrobat 5.x Serial Generator.exe
\drivers32\WS_FTP 5.x Serial Generator.exe
\drivers32\SolSuite 2003 Serial Generator.exe
\drivers32\QuickTime 6.x Serial Generator.exe
\drivers32\Winamp 2.91 Serial Generator.exe
\drivers32\Winamp 3.x Serial Generator.exe
\drivers32\Easy CD-DA Extractor 5.1 Serial Generator.exe
\drivers32\Easy CD-DA Extractor 5.x Serial Generator.exe
\drivers32\MusicMatch Jukebox 8.0 Serial Generator.exe
\drivers32\MusicMatch Jukebox 8.x Serial Generator.exe
\drivers32\Internet Download Manager 3.15 Serial Generator.exe
\drivers32\Internet Download Manager 3.x Serial Generator.exe
\drivers32\WinZip 9.x Serial Generator.exe
\drivers32\PhotoShow 2.0 Serial Generator.exe
\drivers32\PhotoShow 2.x Serial Generator.exe
\drivers32\SWiSH 2.0 Serial Generator.exe
\drivers32\SWiSH 2.x Serial Generator.exe
\drivers32\ACDSee 2.4.x Serial Generator.exe
\drivers32\Paint Shop Pro 8.x Serial Generator.exe
\drivers32\Adobe Photoshop 7.x Serial Generator.exe
\drivers32\Adobe Photoshop 8.x Serial Generator.exe
\drivers32\Paint Shop Pro 9.x Serial Generator.exe
\drivers32\Macromedia Flash MX 6.x Serial Generator.exe
\drivers32\Ulead PhotoImpact 8.x Serial Generator.exe
\drivers32\Ulead PhotoImpact 9.x Serial Generator.exe
\drivers32\Ulead GIF Animator 5.x Serial Generator.exe
\drivers32\Ulead GIF Animator 6.x Serial Generator.exe
\drivers32\Nero Burning ROM 5.5.x Serial Generator.exe
\drivers32\Nero Burning ROM 6.x Serial Generator.exe
\drivers32\Network Cable e ADSL Speed 1.x Serial Generator.exe
\drivers32\Network Cable e ADSL Speed 1.0.6 Serial Generator.exe
\drivers32\NetPumper 1.03 Serial Generator.exe
\drivers32\Internet Turbo 2003 5.4 Serial Generator.exe
\drivers32\Internet Turbo 2003 5.x Serial Generator.exe
\drivers32\KaZaA Speedup 3.03 Serial Generator.exe
\drivers32\KaZaA Speedup 3.x Serial Generator.exe
\drivers32\GetRight 5.0 Serial Generator.exe
\drivers32\GetRight 5.x Serial Generator.exe
\drivers32\GetRight 6.x Serial Generator.exe
\drivers32\mIRC 6.03 Serial Generator.exe
\drivers32\mIRC 6.x Serial Generator.exe
\drivers32\Direct Connect 1.x Serial Generator.exe
\drivers32\ICUII 5.7 Serial Generator.exe
\drivers32\ICUII 5.x.exe.exe
\drivers32\GeoWhere 2.11 Serial Generator.exe
\drivers32\GeoWhere 2.x Serial Generator.exe
\drivers32\LingoWare 3.0 Serial Generator.exe
\drivers32\FlashGet 1.3 Serial Generator.exe
\drivers32\FlashGet 1.x Serial Generator.exe
\drivers32\SnagIt 6.2.2 Serial Generator.exe
\drivers32\Hex Workshop Hex Editor 4.1 Serial Generator.exe
\drivers32\UltraEdit-32 10.00b Serial Generator.exe
\drivers32\UltraEdit-32 10.x Serial Generator.exe
\drivers32\Armor2net Personal Firewall 3.1 Serial Generator.exe
\drivers32\WinAce 2.2 Serial Generator.exe
\drivers32\WinAce 2.x Serial Generator.exe
\drivers32\CloneCD 4.x Serial Generator.exe
\drivers32\CloneCD 5.0 Serial Generator.exe
\drivers32\FlashFXP 1.4 Serial Generator.exe
\drivers32\FlashFXP 1.x Serial Generator.exe
\drivers32\WindowBlinds 4.0 Serial Generator.exe
\drivers32\WindowBlinds 4.x Serial Generator.exe
\drivers32\IconPackager 2.12 Serial Generator.exe
\drivers32\IconPackager 2.x Serial Generator.exe
\drivers32\Microangelo 5.58 Serial Generator.exe
\drivers32\Microangelo 5.x Serial Generator.exe
\drivers32\Microangelo 6.x Serial Generator.exe
\drivers32\Half-Life 2 Serial Generator.exe
$$$$$.bat
:start
if exist "
goto start
Runtime error at 00000000
0123456789ABCDEF
%.*d_@
kernel32.dll
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLastError
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
WriteFile
UnhandledExceptionFilter
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle
user32.dll
GetKeyboardType
LoadStringA
MessageBoxA
CharNextA
advapi32.dll
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
oleaut32.dll
SysFreeString
SysReAllocStringLen
SysAllocStringLen
kernel32.dll
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
advapi32.dll
RegSetValueExA
RegOpenKeyA
RegCloseKey
kernel32.dll
lstrlenA
WriteFile
WaitForSingleObject
VirtualQuery
SizeofResource
SetFilePointer
SetEvent
SetEndOfFile
ResetEvent
ReadFile
LockResource
LoadResource
LeaveCriticalSection
InitializeCriticalSection
GetVersionExA
GetThreadLocale
GetSystemDirectoryA
GetStringTypeExA
GetStdHandle
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetDiskFreeSpaceA
GetDateFormatA
GetCurrentThreadId
GetCPInfo
GetACP
FormatMessageA
FindResourceA
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
EnumCalendarInfoA
EnterCriticalSection
DeleteCriticalSection
CreateProcessA
CreateMutexA
CreateFileA
CreateEventA
CreateDirectoryA
CopyFileA
CompareStringA
CloseHandle
user32.dll
MessageBoxA
LoadStringA
GetSystemMetrics
CharNextA
CharToOemA
kernel32.dll
oleaut32.dll
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
wwwwwwx
fffffffff`
wwwwwwx
Install
QTypInfo
"RTLConsts
System
SysInit
SysConst
CVariants
KWindows
UTypes
$VarUtils
SysUtils
sActiveX
3Messages
^Classes
L!This program cannot be run in DOS mode.
.idata
.aspack
.adata
_ 6r 1>
]{G&j>1
w0}>QX
qC.<<R\iC
bvB 1U7
OK*i(qP
$pAA{+
;.sW}AHe2wM
x6vG`14
ef]JcpKR
{t[sJ"
WVC.K(RjUE;-purz
EOW*?LI\S-7S
$@}c{b{d1
N#2tCiZI4SuM%
ei8Q4RIX
E%m%[xfk
GtN\of=G
X/ {&fM83c;
R5ZX~b+Sjx
{nH'"~xe<gwt:
d=uotu|
".k-,QTO
R:q:%`~
d@s4t;<?O~6+m
EE&ThkXY_Q
c`E1I5>B^r
6VCR ^4p
s3WcQ?Gc?: ~/+
ZVOGmmX)*k:I
wI9:F YmLd
G:I.rA
AbvVs~
oT'lIK
hOQwuzR
Z&UVI0
/)X7}7
Iz:+F%
EtT(a9h
P%1%5h5 Zz
VmQpKWej
5KG R^
T)J}Z-&&
2-FI>Z
&?z}j&
~G58*|
(h7drBF
.?X.@/!
IABC2mm?z
(UV6LpF
hQNPv\E SHRI<[<bK;q\
$:at?tx
.[pOZ3
z@ HE |XETo
(nL{zs:q[d
i,gfWy
8BV/@:X#
Oa!<ML7UX9w
1x|P=!r)C1>ldNv|dRc|
/J\3*am
M?y0S<2+
A-abpa
!/&s"I.t
.bn6m8p(
!0lnF'7
sG zu""|JY
W?i:DL~
W^,&zy?(^
Pu9J;V*
GO+^J,e @XV
Sd_p@}
pz\PVAY
68p:HE|
l~>6.$r
;z,,\M
sOy+CAh
i %rRB
RAd+E0
)L9MJRL
!gmNGs
^LOri{D
R[kP{COj_WIft2
mj^11UI!mKn_
]Y&85)8,^6
E(T=c:#&
/go"v=+cb
8*ePL~8
noB.Ah
y~ei<V7
=ojyrO
q-k=ej>Yz
8=T7KI
Kg1\YLXw0%2
+htqMl
9@F:(X'
!mOmp,5
zn5D"<9
~zbmLD%Mm
^<=~@1
xo68BgKy
IS1-0gX}!
P]7*/vS
gpzH@4BT
m3a3ci$
#%4C8
-#vF-r
^cMGCsALD
$;;N{4kk
6#=c6n3
[`bxhczC)
CtJ=,m
} '=+2(6l!$f
xXcX"?z\b8>z}
R2,Z5!:b
]^oo#i
rG1'}s7F!Oi?y
uADRexxF
BJL0Bwj
B7.,03<l
el\O30
SFqT.jq
8O}WJ1
059v>J'G^N _
Cx;^N6
%A)m+r:{]x6G
D*}s GcgC
SteO)_}\SbP
~JDA1[
@KGfq68U!/
~KJ9ObY
p|?bG|W=!
c1{g3g3DH,
7 x1#P
tC'lGC'c
N/$*\,
!VQOu/mNY}
Z4E8#a
;vWbklIw*
S@#b?]o
1gnX[ ~6%C,T
Ag05As4M0
Syzeu%
hfXI=Y+6o1'J9]\e5
1?^4}cE:H
ge`QP#*6K
"te,D7t
&=||s@Z"Yxl[\
}UFa5c
<:hfsSExCj
[];T2)
S{(N]]lW
!SdSc~RZ
!EUrM/^>
YLfcc]
<O2v8k
!(f8{P[:=
E@8pQO
2O.::X(ej=|0
%MmvszKv
J!;nr\
(#! B\
Znqo8j\
-?2fJO
q(dTy%r
L0,C~;*
V f:^oZ]P
t!c;O)`P}y/5@n
rPP4W:
Q,&[ImnExAH
3^T;'xu
e|wTUB
M?I8t 7
c"'4m+ag:i
Fe1K#A
D!*Z;]
mqdn]^
mrVUbWkNwD`:
?L5lnCbH
o q.UtOY
uW$z|t2zgoGPmouw|
b@R+#S5S82!
QQ<kM=X]f
{+`q't
fFpPu#C
l@dfzpVZ+KNdWmdjt=Np`Li 6
"mK.Q_
^S@Pth
tW[Y*d)L/3/2R
b}O[kD5Y
E6("o5
"O_>o2=?ZDii
+KEJc&
d3f#ZF\
yqMhu>OV^!Px'nDJu
yGfa,w
E|^ja|Do
[:,=,Y;f
g9N?J<N
lc&wUY5
J67DE-3^UQ
# kuB/2
lMI-.W52O@s0Y=vZxZ_+
V|!md"g&$X-$|
4+>TbTW{
C@!5{3Q#Qk
(Szp&$
b2[0_V,O|F@)^n\
IK*vw'&
njHjr?u
'hKsg$D/K'
Jx hH3gBb:]
.8[`P";E3k
tOTj2_qMf
Oy[1XB<sVR
2i,IP<CCG
XB7<;nh
j}tc8~F-B
I<e:w]SZy
rw1V+FwQ\N"a
:Y8,e\>#
ibd<&=cU%ls@
PrC8Wmjz
SzD?0K~>
S\%:UyVR^CN
QS$/n<A[{3
73Ay;N
CM4+)Ki
Yga-J\W
E6>Z6Mi
iI{QVX-`+
%Q3Vei
R S#"o!,
79=9:8
####################################################################################################################################################################################################################################################################################################################7##
BFsl%!gkEgG62";J
*zp @.i
)J2P<<<
+#OQL.6
Y?YzUQ
&xw{sw4_u/K1
+.P4TYfN P!9$
. &|M3
-]a^;b
@1tI1JE6m9r&?LM,r*B7%p
~4~ )I
D*sY:j
y}>Mvug{x
W=V*u,~
76/3z+'G
e<? `2
per=>O
mp}F6:fp
CA@g 6'
9S|k)OXg
5V1~n'_:hzGz'Z k2$E%
4uH{9HA|
N l|X"@!
3~)rb4
S]}/9KQ?
n! [w}GLgOC
i@|"u*[
X[K#-+ml@4
> ]"a#x[7Z
+[rF6w[%C?@
d9.YPiN
KC[NfK)D
,@%xjf
D"yr{{
"05cP,
pT[ _h
hkiGF)
VH1sDe
0?q3Xs,5`=]AN
GNpeS0~9u&I'L0N%@
&%7BxiW
A;Tv$
,DQNakNOj#
CmiC2)1Uu9@
+WT]A
LN,V+v[Q^M
]C'ppD
tS? f8
8J`xS'ow
~2Tl2(^5ke5b'_
ut=O[zYA
z]d3,-M
N,">Rh.//
g=zc}G5
rUQJdPl<Vb
6ujG^f8Q
nV~T,ZG\d4
f8A_Yz@
dG#scG
s%5-?y
###########################################################################################################################################################################################################################################################################################################################################################################################################################################################7NN;##"
o)68{[/[n
38EsW!
^+SWx{
*]cT]Hv
(y'UJv=S9"G
"a;Z/Z
TOtNM:.;dXGEy
2H__>\
7Z_2F9
Q]n!'u
kq93YW
$F,^N_
TcrO*^5
VL v!WN
uj#xa+
4B} <Ej
>]DiXo
rIg\e\'
CX.(ZA};@\x
KS################################################################################################################################################################################################################################################################
\;. V5-2P3'HN1$FS5)8S6-,P3,
T.&1V6*_X:0L0$L/$P3&P2'~K,"[N.#:W1&&X,,
qjdC9C'
L+"R0#tQ-"KO.!1S- R)
xvSL`6+I)
@\1$PE|v
kbl=1L*
Bt>/[Lwo
xO@f4&N)
rQ.##Z,
gVb4$L.!Q0'0S1!
u:'gwl
yp[<2T9,0`@0
{qkK.%jO2(:M3"
m{qsrvy
zweB;9
J,#G+ ;L/
x9$zAD?=>?A
Km^aejkur}x
mjZ90;
i\`]WK>/!
krtqk`RC3
|oaO<'
uuqqts8
}}uvcb9
?c?m =
{{tt{{ji:
xxzzji:
uugf:
nnookkvvwwdc:
7=752
mmjjggjjdc;
8"E'O UWWeT0Z
xxhgD&
13 L1`;nHt<qy
hgI+ 4E'
ge]YZkKH3\=1 U+
=%P?pb
#_Gxvvn
rm~|kieVjH?)O5,
)ITmu/eDE
z|ZxIJLLB3
jpjg^4
o###!o###<<<#+"#2!###2!##
*)---#
*###)>
#a##.!/#;##/#7##.#<##
!4##.!/#;##
o$###c#,m###
2!##<X<
?########_
q,/#c##.#<
##<##X?
<<</#c##.#<
##<####)?
##2!##
##[)Bo;
##2!##
2!##X?(
=)=")0)3
<##(!(
<##(94(
<##9#(4<X"RIv2!##
C)>Bg((\#
"#2!##j
=Ca>##BW
<##C<##
######2!##8C
##7|;f
ar######c!V<<<<
##<##C###c
w###<<<
;X92!##<<G
2!##O##?G###B=#/####
!##!##
!##,!##
<##<[A;.
/!##.#<##.<<##############*$-
'#+*$)(#
*3$)*3+$)33-
3$3)/3
$3-$3-
3$3)/3
$3-$3-
Ft1uM>C)9
[K?n8jv
##########################################################;######3"#K###
"#S=##########################################################################################################################################################################################################################
oO##}1
1=o!##aC>_<A
1=oo##aC>_<A
##B;##"!8?>=4;9753
+csCS########""""!!!!####""!!88??>>==44;;::::::::
!*\g<<<"~7
?%1=S?<###&!
?%1;To7###
<<<#o*!,B!#
1?a###
###!b}######B?#mw###
###Na###C%1
`E1M###d
)1/<)15
17.?)19
Sg<###%11t###
15F}###d;T<###
~W~)15)19S;("^
<<<<###),
CAw###B!#ba###C I1M###~!aC)2F
###<###
a/=C~!%a/
ba###_*],KAw###B!#
1=?R<###^
!Bg ?^
??###^o
9p}###_;~5
F=###9
ZB4!f!5p7###
ZC/"##0
o"##~}
/"##o <<
.5s###o
"##,"##B!#
;bs###b
##bC##C###b
"##^No!###B?#m=##
!.oe<<C4
"#####N`.!o=e<<
oce<<aC,A=##
`oQ<<g;
"##~9"[cR
."o<<CC|
g4.ox<<C=.o'<<CC|"##X
C"##}<<<
o<<aC,A=##a1"##s###
o<<aC,A=##}1##
##o<<aC,A=##X
"###CcE!##?
"##)11"##q,KA=##o###{,d
11<C%1;x"##
;oe<<###4
44%1;"##["##"###<<<oS
19y###ts###o
o<<<~u
17?R<###^
n7###|?R<<<#n
o<<<~}
"##uD/"##Z
oV<<~y
#,aCf) <*
15<###g[g?
?|=?###_7###
?<<<#t
##o<<5g|??*
13<###g[g?
=?###^o7###
<<<#oW
"##8%199
1;gTo<<aC)5%1
,KA9B?#,
CA9B?#############################?###"#~"#"#####@
XX###)
9###A`0
09#&&&&&################################################################
kernel32.dll
LoadLibraryA
GetProcAddress
6666dl8
d$#$$$$
d$m>$$c"$$
d$)t`=)`
q|yb^@$#=)`9
@(@p?#C
d$9d(?$$$<9
$$$1)d$
)d$p$$$/)d$+)d$Y$$$
)d${)d$r$$$O)d$K)d$c$$$`)d$\)d$
$$$S)d$o)d$
$$$)d$)d$6$$$)d$
d$ttN=
d$4$$$p%`=/
Z$=1)d$k4j<=o:r@bt$4$$
d$MP)d$tZ@s=
d$<$$$
$$$\@#$$)d$EZ$=/)d$Z$\$$$Z9Z$Z#\$$$E=
)d$=o@)SZ$E=)d$?NZd=O)d$1o"zZ$)d$tNIE=S)d$IE4$$$
d$t)))59buI=`)d$tE=)d$L
d$#$$$<$$$
d$t9($$$)&RiRYo?
$$$&R_Xmo?
R_Xo?$$$&Vm_io"j&
l_Io"T&
_`Co"^f
$p>f4$o"LDv41o8n
9~==:n89"$$$%0I
#0+0w0
d$5H 4
d$9($$$$p
d$y<$$$$$
d$1p7!)d$p?
$$$p{N)d$)
d$@c@*$o8f@$o)?$$$tZ$=O)d$1o?
@C5u@Fb#$$
d$<$$$
@}$o]FI=
d$@$$$p6
d$t|"$$Av<1o9v@9
d$$$$#$$$oq#"9
===LrstI=
d$1o5KJ
$$$KJD
d$@$$$p6(
d$t#$$C"
$$$tI=
d$ppKJ"
$$$TR<===en6
:$$$i"
EN)d$e@
~#u@?F]@@+$
0===8f@$
==)d#p"C
d$"$$$p
d$9(MP
d$m>$$#
d$)p<#
d$$$$)0k
WhY8Boo:LQ'qCm/)c8e_zG
]Fs}~{>(M
L/;bDy
32 6-
SG+D]I!Id~29!Fw
`@$$d,$oOE
d$$$$$$$$$$@$$$$$$$]OE
d$$$$$$$$$$$$$$$$$$]$$d$#T"$'$$$$$$$$$$$$$$$X"$H"$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$q_RV_X)
`XX$$$$$u_pwm`oX_|CV`X_c$$$$$N[RpoCXtRmp_Yp$$$$$u_pwm`oX_~[X_vCW_c$$$$$yR_Cp_~[X_c$$$$$uXmBCXcXXmY$$$$$uXmBCX~R__$$$$$r_C`~[X_$$$$$u_p~[X_I[j_$$$$$yXmi_|CV`X_$$$$${i_BoUU_RtR_i_Vp$
EwVirtualAlloc
VirtualFree
t.x,<t
kernel32.dll
ExitProcess
user32.dll
MessageBoxA
wsprintfA
LOADER ERROR
The procedure entry point %s could not be located in the dynamic link library %s
The ordinal %u could not be located in the dynamic link library %s
(08@P`p
8\(L(C@;
rDt$h3t$
E@D4l|Mu
1|hDhG8
A;r_^]
YSVW33h
T4$F`u(j
}RL4#HL4$F
D$$W3|$
3V5:@D
D$,8_^]
kernel32.dll
GetProcAddress
GetModuleHandleA
LoadLibraryA
%2%2%2%2%2
kernel32.dll
LoadLibraryA
GetProcAddress
,x S,i*
J|CJ6!
_-gs q
6+%K4-A[
xFVi7"_(U5E
V4S'IVC/^rN~1
MR=xybsZ-c
[J9p/M+
:zf3`Pm!
Kho>M[k
qi4=hF
ae*RjP'
Q&}CV#Z#INb
B<TI/4\{1be
m|KB1bC# ("
WJK:)2c
a|zODTO
yfO^-0
rO^jf`
%qO^-f
J;i/m[J5
1zU&VV
pRT@og
K(2!nxqCB`1
m312als{Ri
\o1{pF
lr{J@h
1{R1C#}e3B
:,3:19P|cjY
id*,],
vY3:Bu
Vh5BQ [(~m[k9(
Da^gA"
Kt#V(4
ixGV%4
ixGV%4
~dSB1
dsBQ /
dpBQ /
~m[J9(
ixFV$3
ixGV(4
ixGV%4
ixGV%4
~dSB1
dsBQ /
dpBQ /
~m[J9(
ixFV$3
ixGV(4
ixGV%4
ixGV%4
~dSB1
dsBQ /
dpBQ /
~m[J9(
ixFV$3
ixGV(4
ixGV%4
ixGV%4
~dSB1
dsBQ /
dpBQ /
~m[J9(
ixFV$3
ixGV(4
ixGV%4
ixGV%4
~dSB1
I{Sb-<Er
ixFVWvK
8zXg5:
ixeFRY
C2 ixGVo%
kernel32.dll
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLastError
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
WriteFile
UnhandledExceptionFilter
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle
user32.dll
GetKeyboardType
LoadStringA
MessageBoxA
CharNextA
advapi32.dll
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
oleaut32.dll
SysFreeString
SysReAllocStringLen
SysAllocStringLen
kernel32.dll
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
advapi32.dll
RegSetValueExA
RegOpenKeyA
RegCloseKey
kernel32.dll
lstrlenA
WriteFile
WaitForSingleObject
VirtualQuery
SizeofResource
SetFilePointer
SetEvent
SetEndOfFile
ResetEvent
ReadFile
LockResource
LoadResource
LeaveCriticalSection
InitializeCriticalSection
GetVersionExA
GetThreadLocale
GetSystemDirectoryA
GetStringTypeExA
GetStdHandle
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetDiskFreeSpaceA
GetDateFormatA
GetCurrentThreadId
GetCPInfo
GetACP
FormatMessageA
FindResourceA
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
EnumCalendarInfoA
EnterCriticalSection
DeleteCriticalSection
CreateProcessA
CreateMutexA
CreateFileA
CreateEventA
CreateDirectoryA
CopyFileA
CompareStringA
CloseHandle
user32.dll
MessageBoxA
LoadStringA
GetSystemMetrics
CharNextA
CharToOemA
kernel32.dll
oleaut32.dll
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
@ @ @ @ @ @
@ @ @ @ @ @
@ @ @ @ @ @
@ @ @ @ @ @ @ @ @ @ @
@ @ @ @ @ @ @ @
@ @ @ @ @ @ @
D V C L A L
P A C K A G E I N F O
I D A P P L I C O N
L i s t c o u n t o u t o f b o u n d s ( % d )
L i s t i n d e x o u t o f b o u n d s ( % d )
S t r e a m r e a d e r r o r
% s . S e e k n o t i m p l e m e n t e d $ O p e r a t i o n n o t a l l o w e d o n s o r t e d l i s t
S t r e a m w r i t e e r r o r
S u n d a y
M o n d a y
T u e s d a y
W e d n e s d a y
T h u r s d a y
F r i d a y
S a t u r d a y
C a n n o t a s s i g n a % s t o a % s % S t r i n g l i s t d o e s n o t a l l o w d u p l i c a t e s
C a n n o t c r e a t e f i l e " % s " . % s
C a n n o t o p e n f i l e " % s " . % s
I n v a l i d p r o p e r t y v a l u e L i s t c a p a c i t y o u t o f b o u n d s ( % d )
J a n u a r y
F e b r u a r y
A u g u s t
S e p t e m b e r
O c t o b e r
N o v e m b e r
D e c e m b e r
A b s t r a c t E r r o r ? A c c e s s v i o l a t i o n a t a d d r e s s % p i n m o d u l e ' % s ' . % s o f a d d r e s s % p
S y s t e m E r r o r . C o d e : % d .
% s A c a l l t o a n O S f u n c t i o n f a i l e d
V a r i a n t o r s a f e a r r a y i s l o c k e d I n v a l i d v a r i a n t t y p e c o n v e r s i o n
I n v a l i d v a r i a n t o p e r a t i o n % I n v a l i d v a r i a n t o p e r a t i o n ( % s % . 8 x )
% s 5 C o u l d n o t c o n v e r t v a r i a n t o f t y p e ( % s ) i n t o t y p e ( % s ) = O v e r f l o w w h i l e c o n v e r t i n g v a r i a n t o f t y p e ( % s ) i n t o t y p e ( % s )
V a r i a n t o v e r f l o w
I n v a l i d a r g u m e n t
I n v a l i d v a r i a n t t y p e
O p e r a t i o n n o t s u p p o r t e d
U n e x p e c t e d v a r i a n t e r r o r
E x t e r n a l e x c e p t i o n % x
A s s e r t i o n f a i l e d
I n t e r f a c e n o t s u p p o r t e d
E x c e p t i o n i n s a f e c a l l m e t h o d
% s ( % s , l i n e % d )
I n v a l i d p o i n t e r o p e r a t i o n
I n v a l i d c l a s s t y p e c a s t 0 A c c e s s v i o l a t i o n a t a d d r e s s % p . % s o f a d d r e s s % p
A c c e s s v i o l a t i o n
S t a c k o v e r f l o w
C o n t r o l - C h i t
P r i v i l e g e d i n s t r u c t i o n ( E x c e p t i o n % s i n m o d u l e % s a t % p .
A p p l i c a t i o n E r r o r 1 F o r m a t ' % s ' i n v a l i d o r i n c o m p a t i b l e w i t h a r g u m e n t
N o a r g u m e n t f o r f o r m a t ' % s ' " V a r i a n t m e t h o d c a l l s n o t s u p p o r t e d
W r i t e $ E r r o r c r e a t i n g v a r i a n t o r s a f e a r r a y ) V a r i a n t o r s a f e a r r a y i n d e x o u t o f b o u n d s
O u t o f m e m o r y
I / O e r r o r % d
F i l e n o t f o u n d
I n v a l i d f i l e n a m e
T o o m a n y o p e n f i l e s
F i l e a c c e s s d e n i e d
R e a d b e y o n d e n d o f f i l e
D i s k f u l l
I n v a l i d n u m e r i c i n p u t
D i v i s i o n b y z e r o
R a n g e c h e c k e r r o r
I n t e g e r o v e r f l o w I n v a l i d f l o a t i n g p o i n t o p e r a t i o n F l o a t i n g p o i n t d i v i s i o n b y z e r o
F l o a t i n g p o i n t o v e r f l o w
F l o a t i n g p o i n t u n d e r f l o w
A P P I C O N
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 4 0 9 0 4 B 0
C o m p a n y N a m e
M i c r o s o f t C o r p o r a t i o n
F i l e D e s c r i p t i o n
G e n e r i c H o s t P r o c e s s f o r W i n 3 2 S e r v i c e s
F i l e V e r s i o n
5 . 1 . 2 7 0 0 . 0 ( N T c l i e n t . 0 1 0 8 1 6 - 1 1 4 3 )
I n t e r n a l N a m e
s v c h o s t s . e x e
L e g a l C o p y r i g h t
M i c r o s o f t C o r p o r a t i o n . A l l r i g h t s r e s e r v e d .
O r i g i n a l F i l e n a m e
s v c h o s t s . e x e
P r o d u c t N a m e
M i c r o s o f t
W i n d o w s
O p e r a t i n g S y s t e m
P r o d u c t V e r s i o n
5 . 1 . 2 7 0 0 . 0
V a r F i l e I n f o
T r a n s l a t i o n
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 4 0 9 0 4 B 0
F i l e D e s c r i p t i o n
C r a c k s W a r e O r i g i n a l C r a c k s .
I n t e r n a l N a m e
L e g a l C o p y r i g h t
C r a c k s W a r e C o r p o r a t i o n . A l l r i g h t s r e s e r v e d . (
O r i g i n a l F i l e n a m e
C o m p a n y N a m e
C r a c k s
P r o d u c t N a m e
P r o d u c t V e r s i o n
5 . 1 . 2 7 0 0 . 0 4
F i l e V e r s i o n
5 . 1 . 2 7 0 0 . 0 D
V a r F i l e I n f o
T r a n s l a t i o n
Process Tree
-
018377ce3c65254ee9d9375dea576dcdb146800758c63488850113480a2608d0.exe (1848)
"C:\Users\Administrator\AppData\Local\Temp\018377ce3c65254ee9d9375dea576dcdb146800758c63488850113480a2608d0.exe"
- cmd.exe (600) cmd /c c:\$$$$$.bat
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | e2cd20ddd88c6e41_$$$$$.bat |
|---|---|
| Filepath | C:\$$$$$.bat |
| Size | 280.0B |
| Processes | 1848 (018377ce3c65254ee9d9375dea576dcdb146800758c63488850113480a2608d0.exe) 600 (cmd.exe) |
| Type | ASCII text, with CRLF line terminators |
| MD5 | 8df0107f48d6254267ca59e1a2aa5302 |
| SHA1 | 10f0d154c5b79a172911c514d3778810749a69c8 |
| SHA256 | e2cd20ddd88c6e41c076b4ed9361953956d0c698ffdd7addc2bd50cb21ba8cbd |
| CRC32 | B36FE377 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 018377ce3c65254e_018377ce3c65254ee9d9375dea576dcdb146800758c63488850113480a2608d0.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\018377ce3c65254ee9d9375dea576dcdb146800758c63488850113480a2608d0.exe |
| Size | 543.6KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | 778efbb7054861b7532dfea3d0602571 |
| SHA1 | 04bf5bb415a2f4409128a4e15a633889ae25f94c |
| SHA256 | 018377ce3c65254ee9d9375dea576dcdb146800758c63488850113480a2608d0 |
| CRC32 | 1A25B8DC |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 3c18c1970a9a5827_svchosts.exe |
|---|---|
| Filepath | C:\Windows\SysWOW64\svchosts.exe |
| Size | 30.8KB |
| Processes | 1848 (018377ce3c65254ee9d9375dea576dcdb146800758c63488850113480a2608d0.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | c68822bee0a9091abb64a1e20fba238a |
| SHA1 | aa7b77b8973fbb62637de7ddec0617434a4534af |
| SHA256 | 3c18c1970a9a58271716173e594504765d41199991e7035bc1f34bfa16c160ec |
| CRC32 | 08CA9DD7 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.