1.4
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.79
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:CoinminerX-gen [Trj] | 20200212 | 18.4.3895.0 |
| Baidu | None | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (W) | 20190702 | 1.0 |
| Kingsoft | None | 20200212 | 2013.8.14.323 |
| McAfee | Trojan-FRUQ!C4DADE55981B | 20200212 | 6.0.6.653 |
| Tencent | Win32.Trojan-downloader.Dofoil.Szve | 20200212 | 1.0.0.1 |
静态指标
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(5 个事件)
| section | .voj |
| section | .sijok |
| section | .putus |
| section | .hulo |
| section | .wiz |
动态指标
分配可读-可写-可执行内存（通常用于自解压）
(2 个事件)
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(2 个事件)
| section | {'name': '.text', 'virtual_address': '0x00001000', 'virtual_size': '0x0001f5d6', 'size_of_data': '0x0001f600', 'entropy': 7.283630806733757} | entropy | 7.283630806733757 | description | 发现高熵的节 | |||||||||
| entropy | 0.6322418136020151 | description | 此PE文件的整体熵值较高 | |||||||||||
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 44 个反病毒引擎识别为恶意
(44 个事件)
| ALYac | Gen:Variant.Midie.70431 |
| APEX | Malicious |
| AVG | Win32:CoinminerX-gen [Trj] |
| Acronis | suspicious |
| Ad-Aware | Gen:Variant.Midie.70431 |
| AhnLab-V3 | Win-Trojan/MalPe37.Suspicious.X2050 |
| Avast | Win32:CoinminerX-gen [Trj] |
| Avira | TR/AD.Dofoil.jmmg |
| BitDefender | Gen:Variant.Midie.70431 |
| BitDefenderTheta | Gen:NN.ZexaF.34090.mOW@aix1xXlG |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cylance | Unsafe |
| DrWeb | Trojan.DownLoader32.63862 |
| ESET-NOD32 | a variant of Win32/Kryptik.HAYR |
| Emsisoft | Gen:Variant.Midie.70431 (B) |
| Endgame | malicious (high confidence) |
| F-Secure | Trojan.TR/AD.Dofoil.jmmg |
| FireEye | Generic.mg.c4dade55981b9d31 |
| Fortinet | W32/Kryptik.HAYL!tr |
| GData | Gen:Variant.Midie.70431 |
| Invincea | heuristic |
| Jiangmin | TrojanDownloader.Agent.fvrw |
| K7AntiVirus | Trojan ( 005603e11 ) |
| K7GW | Trojan ( 005603e11 ) |
| Kaspersky | Trojan-Downloader.Win32.Dofoil.cgyr |
| MAX | malware (ai score=85) |
| Malwarebytes | Trojan.MalPack.GS |
| McAfee | Trojan-FRUQ!C4DADE55981B |
| McAfee-GW-Edition | BehavesLike.Win32.Generic.ch |
| MicroWorld-eScan | Gen:Variant.Midie.70431 |
| Microsoft | Trojan:Win32/Gapined.DSK!MTB |
| Paloalto | generic.ml |
| Panda | Trj/GdSda.A |
| Rising | Trojan.Kryptik!1.C0F7 (CLASSIC) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Mal/Generic-S |
| Symantec | ML.Attribute.HighConfidence |
| Tencent | Win32.Trojan-downloader.Dofoil.Szve |
| Trapmine | malicious.high.ml.score |
| TrendMicro | TROJ_GEN.R02DC0DBB20 |
| TrendMicro-HouseCall | TROJ_GEN.R02DC0DBB20 |
| ZoneAlarm | Trojan-Downloader.Win32.Dofoil.cgyr |
| eGambit | Unsafe.AI_Score_77% |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2019-08-12 20:48:12
PE Imphash
6ad89e41042551f084c1277bab12224d
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x0001f5d6 | 0x0001f600 | 7.283630806733757 |
| .rdata | 0x00021000 | 0x000066a0 | 0x00006800 | 5.802949746736809 |
| .data | 0x00028000 | 0x00006a2c | 0x00001e00 | 3.5800467481533462 |
| .voj | 0x0002f000 | 0x00002800 | 0x00002800 | 0.0 |
| .sijok | 0x00032000 | 0x00000400 | 0x00000400 | 0.0 |
| .putus | 0x00033000 | 0x00000357 | 0x00000400 | 0.0 |
| .hulo | 0x00034000 | 0x0000015a | 0x00000200 | 0.0 |
| .wiz | 0x00035000 | 0x00001157 | 0x00000400 | 0.0 |
| .rsrc | 0x00037000 | 0x000049e0 | 0x00004a00 | 5.976650612229064 |
| .reloc | 0x0003c000 | 0x00001d72 | 0x00001e00 | 5.06952274298497 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x000388b0 | 0x000025a8 | LANG_GAELIC | SUBLANG_GAELIC_SCOTTISH | None |
| RT_ICON | 0x000388b0 | 0x000025a8 | LANG_GAELIC | SUBLANG_GAELIC_SCOTTISH | None |
| RT_ICON | 0x000388b0 | 0x000025a8 | LANG_GAELIC | SUBLANG_GAELIC_SCOTTISH | None |
| RT_STRING | 0x0003b8c0 | 0x0000011e | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x0003b8c0 | 0x0000011e | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x0003b8c0 | 0x0000011e | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x0003b8c0 | 0x0000011e | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x0003b8c0 | 0x0000011e | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x0003b8c0 | 0x0000011e | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x0003b8c0 | 0x0000011e | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x0003b8c0 | 0x0000011e | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x0003b8c0 | 0x0000011e | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x0003b8c0 | 0x0000011e | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_GROUP_ICON | 0x0003ae58 | 0x00000030 | LANG_GAELIC | SUBLANG_GAELIC_SCOTTISH | None |
| RT_VERSION | 0x0003ae88 | 0x000001a4 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
Imports
Library KERNEL32.dll:
• 0x421010 lstrlenA
• 0x421014 RtlCaptureContext
• 0x421018 DeleteVolumeMountPointA
• 0x42101c SetConsoleTextAttribute
• 0x421020 SetThreadExecutionState
• 0x421024 FindFirstFileExW
• 0x421028 GetTickCount
• 0x42102c GetCommConfig
• 0x421030 GlobalAlloc
• 0x421034 WideCharToMultiByte
• 0x421038 SizeofResource
• 0x42103c GetSystemWindowsDirectoryA
• 0x421040 WriteConsoleOutputCharacterW
• 0x421044 GetAtomNameW
• 0x421048 IsDBCSLeadByte
• 0x42104c CompareStringW
• 0x421050 DisconnectNamedPipe
• 0x421054 EnumSystemCodePagesW
• 0x421058 LoadLibraryA
• 0x42105c ProcessIdToSessionId
• 0x421060 IsWow64Process
• 0x421064 BuildCommDCBAndTimeoutsW
• 0x421068 VirtualProtect
• 0x42106c PurgeComm
• 0x421070 GetCurrentProcessId
• 0x421074 IsBadStringPtrW
• 0x421078 SetupComm
• 0x42107c FindNextVolumeW
• 0x421080 HeapReAlloc
• 0x421084 InterlockedIncrement
• 0x421088 InterlockedDecrement
• 0x42108c EncodePointer
• 0x421090 DecodePointer
• 0x421094 Sleep
• 0x421098 InitializeCriticalSection
• 0x42109c DeleteCriticalSection
• 0x4210a0 EnterCriticalSection
• 0x4210a4 LeaveCriticalSection
• 0x4210a8 GetLastError
• 0x4210ac HeapFree
• 0x4210b0 GetCommandLineA
• 0x4210b4 HeapSetInformation
• 0x4210b8 GetStartupInfoW
• 0x4210bc RaiseException
• 0x4210c0 RtlUnwind
• 0x4210c4 HeapAlloc
• 0x4210c8 LCMapStringW
• 0x4210cc MultiByteToWideChar
• 0x4210d0 GetCPInfo
• 0x4210d4 TerminateProcess
• 0x4210d8 GetCurrentProcess
• 0x4210dc UnhandledExceptionFilter
• 0x4210e0 SetUnhandledExceptionFilter
• 0x4210e4 IsDebuggerPresent
• 0x4210e8 HeapCreate
• 0x4210ec InitializeCriticalSectionAndSpinCount
• 0x4210f0 IsProcessorFeaturePresent
• 0x4210f4 SetFilePointer
• 0x4210f8 CloseHandle
• 0x4210fc GetProcAddress
• 0x421100 GetModuleHandleW
• 0x421104 ExitProcess
• 0x421108 WriteFile
• 0x42110c GetStdHandle
• 0x421110 GetModuleFileNameW
• 0x421114 GetModuleFileNameA
• 0x421118 FreeEnvironmentStringsW
• 0x42111c GetEnvironmentStringsW
• 0x421120 SetHandleCount
• 0x421124 GetFileType
• 0x421128 TlsAlloc
• 0x42112c TlsGetValue
• 0x421130 TlsSetValue
• 0x421134 TlsFree
• 0x421138 SetLastError
• 0x42113c GetCurrentThreadId
• 0x421140 QueryPerformanceCounter
• 0x421144 GetSystemTimeAsFileTime
• 0x421148 GetLocaleInfoW
• 0x42114c HeapSize
• 0x421150 GetACP
• 0x421154 GetOEMCP
• 0x421158 IsValidCodePage
• 0x42115c GetUserDefaultLCID
• 0x421160 GetLocaleInfoA
• 0x421164 EnumSystemLocalesA
• 0x421168 IsValidLocale
• 0x42116c GetStringTypeW
• 0x421170 CreateFileA
• 0x421174 SetStdHandle
• 0x421178 GetConsoleCP
• 0x42117c GetConsoleMode
• 0x421180 FlushFileBuffers
• 0x421184 LoadLibraryW
• 0x421188 SetEndOfFile
• 0x42118c GetProcessHeap
• 0x421190 ReadFile
• 0x421194 WriteConsoleW
• 0x421198 CreateFileW
Library ADVAPI32.dll:
• 0x421000 EnumServicesStatusA
• 0x421004 RegisterEventSourceW
• 0x421008 RegQueryValueExW
Exports
| Ordinal | Address | Name |
|---|---|---|
| 1 | 0x401990 | @mctraxer@0 |
| 2 | 0x4019a0 | @shutting@0 |
L!This program cannot be run in DOS mode.
/{/{/{Y
/{/z/{Y
/{Rich/{
`.rdata
@.data
.sijok
.putus
@.reloc
^YQVWj
_^YP40
33V8D$
(SVt$43
t(D$<W
t"-hXB
A Q$A
_ _$_(_,
iG0^[Y^_0[YV
W8D$`D$
D$py7D$du
UUUUUUUU
T$lD$tu
vD$8yTD$X]GiD$ j=D$DW
kD$$mj|D$L0
olD$<NXND$TP8D$\=@D$PtBD$(j%#LD$H"
9D$4!{D$,<uD$
kTD$8>rl$8t
LD$ _kqD$ MD$0^
rK&D$X*
D$@NgHD$8
% D$@*d7_l$DA
GD$88vkD$@
=nD$@9
b6l$X^{lD$8>
l$@|'Q$D$
/?|l$0
6+ND$L
l$X7Fl$
]l$X:GH
'.l$\')D$D
l$<lD$X-8~fD$\
pD$8jl$@AY
l$Xg:i
D$P_s;D$
o,(l$P1WDD$(
LD$(ual$$qD$L,
l$T.D$,\
^ l$He
_-D$\ol$(r2D$4
7D$@sX%D$X=:+-+D$tl$
UUUUUU
$D$0vx%a
tlD$xNg
B)D$poLD$hp5D$ HV@
~D$DJi&
D$|dtD$\%rD$<
_!XED$
uYtD$$!
5D$`4$D$Tcu\
kD$l!g
rwD$LoB
E%D$XDX
%D$8{4
$Qj@RP
u/|$ "
QRRRRT$ j
QT$ Rj
_^[33f%
S3VWL$
fT$(D$
T$ SRND
D$$^][
G+W=PNDt33333
f@~<_QSW
PQSVW B
Y_^[]E 8@
^^VW'D$
N(V,F$N0V4W33
333_QSVL$
P8SVW B
RJEqEUE3t
+SV5?W}
3;unVM
u;uKj
]8 u a:
jEPh B
R<$tmf<$
YWM\hkB
YY]jXh0fB
tAt2t$
r)$`W@
DDDDDDDDDDDDDD
^_UWVu
DDDDDDDDDDDDDD
$UQQSVWd5
SVWE3PPPuu
E_^[E]
UQSVW}
SVW( B
3PuEEd
SVW( B
3PeuEEd
Y__^[]Q
YYF$;u
v$PWV%
SSSSS`-
;r>Pu#
USW339]
|^_[]SSSSS+
SSSSSZ+
.t|PVj@u
@sh_tcPE
k_^[]3PPPPP=USVu
]SSSSS2*
vP3YFTt
FP~HZ3PPPPP
vPYFT;t
vTYFh^T^L^P^H_[
3PPPPP'
YP;s,Vh24
lPSP=|
@PVWXU
VVVVV3M_^3[
S\PPPh
3M_3[f
YYltCHphD
Pd8P>F
d|-tt#
Yt1hlCHHYX
Y3PPPPPr#
uTlh=xxPtYt
VVVVV!
3xSSSh
;t\~Ht57xP
3M_^3[|j
woVW=B
t3@_^]
=RCCt =MOCt
=csmu*
8csmu8x
t*9csmu"A
Nj,hHgB
EPYYYE3C
>csmuB~
YYtaSV
NYYPV/
YYt)SVj
Ht Hu4j
=MOCt*=RCCt#u$u u
EPEPVu WgM
ESx;7|G;p
@u%u$u
E;Mr[_^
Yu\39 ~
EPEPuu W$M
EGE~rF
.u$}u ]uE
u$u uSu
tR99u2y
u$Vu u
Q 3@_^[]
S3VW;~ E
@;u+H;}
39](SSu
]9]tWuu
};~Bj3X
3;t?uWuuu
t"SS9] u
EWYuEYe_^[M3
u(Eu$u u
PESPa8
~.8]t)E
WPEW@Ph
~U8]tPMM
uYouuuux3
3M_^3[e1
YYu,9E
<at,<rt"<wt
F> t>=unF> tj
Y]3u;5 B
ffffffE
YM_3['
3PPPPP
+SVW B
1E3PeuEEEEd
Y__^[]Q
E_^[]E
9csmu)=X
URPQQhP@
t;T$4t
;v.4v\
UVWS33333[_^]
33333USVWj
_^[]Ul$
U(3EE9
tWItHIt9It
EYY" uES
W>+~,WPVYP
Y/V|Yt
Y}3u;5 B
tVPVYY3BU
CB;r]}
t*f u!f t
ZmZ,$Z
8csmu*x
YYuTVWh
3]j hhB
3PPPPP_V
@Y<v*V
^SSSSSyj
;tFtA3
S^`N`H
j$Y~\d9
QY^`[_^]
t.t$<"u
GWYY=B
S3V+>=YX
t?VSP^
3Y[_^5B
3PPPPP
FA>\t>"u&
uUEPSS}
=?sJMsB
;r6PY;t)UEP
3wf93t
f90uW=4
VVV+V@PSVVE
YE;t*VVuPuSVV
j@j ^V
;rSWf9M
j@j eYYtQ
0YYt:V5B
P-YF,t
P YF4t
YF\=@B
~lt#WE
`YYt0V5B
E3E3;u
zuxVVu
ptXFVPYYtHptSu
3YY;u!9tt
S2YM_^3[j
SY3WWWWW
FGIuX^_]
VW_^]M
S3VW9]
3_^[];t
B:t"Ou
Pj1SEj
Pj2SEj
Pj3SEj
Pj4SEj
Pj5SEj
Pj6SEj
F Pj*SEj
F$Pj+Sj
F(Pj,SEj
F,Pj-SEj
F0Pj.SEj
F4Pj/SEj
Pj0SEj
F8PjDSEj
F<PjESEj
F@PjFSEj
FDPjGSEj
FHPjHSEj
FLPjISEj
FPPjJSEj
FTPjKSEj
FXPjLSEj
F\PjMSEj
F`PjNSEj
FdPjOSEj
FhPj8SEj
FlPj9SEj
FpPj:SEj
FtPj;SEj
FxPj<SEj
F|Pj=SEj
Pj>SEj
Pj?SEj
Pj@SEj
PjASEj
PjBSEj
PjCSEj
Pj(SEj
Pj)SEj
Pj uEj
Pj uEj
Pj1SEj
Pj2SEj
Pj3SEj
Pj4SEj
Pj5SEj
Pj6SEj
Pj7SEj
Pj*SEj
Pj+SEj
Pj,SEj
Pj-SEj
Pj.SEj
Pj/SEj
Pj0SEj
PjDSEj
PjESEj
PjFSEj
PjGSEj
PjHSEj
PjISEj
PjJSEj
PjKSEj
PjLSEj
PjMSEj
PjNSEj
Pj8SEj
Pj9SEj
Pj:SEj
Pj;SEj
Pj<SEj
Pj=SEj
Pj>SEj
Pj?SEj
Pj@SEj
PjASEj
PjBSEj
PjCSEj
Pj(SEj
Pj uESP
Pj uESP`
vlwvpovtgvx_v|W@
P5YF0;
P#Yv4;5B
W3u}9~
3FSwuoYYD
YvL;5B
W3}u}9~
S~Y89~
C PjPVEj
C$PjQVEj
C*PjTVEj
C+PjUVEj
C,PjVVEj
C-PjWVEj
C.PjRVEj
C/PjSVEj
CHPjPVEj
CLPjQVEj
t$SS|u|u|
@4MC43@3
3W;to=B
yYY~PE
PuyY9_t
uVOyY_^[]
t4V0;t(W8jYt
Fpt"~l
lVYYYEE
F$|3@_^
F3G}39
WPWPWv
M_3[rj
j 9YFj
whu;5PB
VBtYPB
8]tEMap<u
TM_^3[oj
%M*}_hu
qY^hS=
`Y%u (B
3_^]UV3PPPPPPPPU
U3S3@9]
|FVWt>E
tKh@PB
YYt:h<PB
r3@]3]
V3 AB<
3);ut!}
0WVytY;_t3@^
tEP69X
t,PEP6MY
Y3Yu0N
t<6rY;F
t/EP6EW
M_^3[h
@\EP6V
VP?YYt
Wj@hhMB
u hDPB
3PPPPP
t,j@C@Ph
3uP;Qtu
tP;Qtu
eP;Qtu
MP;Qtu
?P;Qtu
0P;Qtu
(P;Qtu
{P;Qtu
mP;Qtu
^P;Qtu
uP;Qtu
ES3VW]9]
39] SSu
EYe_^[M3AO
rustnM
tR:QuMPt<:Qu7Pt&:Qu!Pt
@FA;r3^[
+UV3PPPPPPPPU
EPQEPEj
3pY]Vu
MY3MW0u
Y+t"+t
+tY+uC
Uw\]Yp
u>OdMGd
u wdSUY
_};= B
tCHt(Ht E
Y+t7+t*+t
3t(;t$;t
t$;t)c
uEPuuu
uEuPuuu
$ MeHMu~
JWWW64
[+PD=P6p
EVSSSSS
9}t(9}t
Mfr39]
MfMf;u!f;t
E`p3^_[
H8]tMapUj
E`p3^[_
B(;r3_^[]
Ujh jB
1E3PEd
Y_^[]USVWUj
P(RP$R
t:|$,t
;t$,v-4v
UQPXY]Y[
X 9} E
AP _^[]
;}"+]t
|3Et^E
EE EE$h
/$]lqh
u+t's C
YYM33][
Vf#^f;u
S3VW;|[;
t6<0t0=B
AsM3}j
DY3C]~
u}uyG,j@j ,hYYEta
W34809}
4 3,9E
P4UM`8
DQP C@
,PVEP$
3+4H;M
(PVHP$
(PVHP$
r3VVhU
QH++PPVh
(P+P5P$
\,+48;E
c0?DcY1$
8+0[M_3^{&j
Fu^8Mt
MT3;u"_j
E`p^[9M
_j"W8M
E`p33PPPPPe
[SMQMQp
M_^3[
;u#[]j
E`p3[_^
MNNu#Yj
&@PVS*
&@PVSy*E
E`p3_^[
^VMQMQp
X0B`lS]
X0*`S;t
_WMQMQp
tS]3K}-
et_EtZfu
VVVVV]^
HWxtRHtCHt4Ht%HtFHHt
QP|xPEP
6YM_3^|
Eu}hhXB
3M_^3[
ft'Ou"+
jPfDJXdf
^0Y_^]
3;tuSu
t VV9u
e_^[M3
KuZUUU
;t_+^]
VSMYY1+W
E`p]Ex
tAMap8+
;t+3_^[
USV3;u
^0*Tu39]
G;r3_^[]
WVEY;u
jXEU;u
Ht%CT1
PEYME;E
L1$!_^[u
M#7E9X
P-YYt}E
fMapZA
E`p;39]
RQMQVp
M3EP3SSSSWEPEP
E`p3M_^3[~
M2EP3SSSSWEPEPe
E`p3M_^3[
PEP"YYEPj
^3[3PPPPPBWVU33D$
u+9uv&e8E
E`p3_[^
]UWVSM
[^_3PPj
u'339\u
JBtj 3Y+@M
}99}r"9U
JBj Y+3B\M
3+BL1<
Jy3^j Y+
u'339\u
JBtj 3Y+@M
}99}r"9U
JBj Y+3B\M
3+BL1<
Jy3^j Y+
FWE}MuMMMMMMM9M$u
<+t"<-t
h<+t<-tk}
+t HHt
B:t,1<
+JMtHHt
B:}QMEO?
tEPuEP;
}M]U3EE
3f;u AE
f;u!AC
u4}u+e
f;r#33f9EE
[M_3^2
EAV#f}
W]EEE?E
S3PPPPP+3f9Ut
EfUu}M
3f;u GE
90t!uuE
EMuUm
HuMu9Et
u4}u+e
33f9EE
UUUUU3##
f;wK3EE9
}fEEEEEf}Z33f9u
Ea3f;u
f~7}x+EMe
EM}Um
H}Mu9Et
u4}u+e
f;r#33f9EE
ufEEEEEfu
~(E]Mm
0K;]sE;]s
EM_^3[D
K;sE;s3f
SVW}f]3
S3VWEN@
tfM_^fH
!w{%"]uu;
?Pk^OCg(a
ByZ|uM^5
>R2}!)V
8g;tqS-| DM.
=) AvP
]/`=:T"
~BY3Pw
x?Ar#1[Bv8[
`"Tq7Mk#E~$
-trR(:2
+x8P\BM QK
akhX8(:2
9!I3)
G)lpgc;mbRM
u"ypw3x4
Me>s36B
36w> Ut/+"cv
Q_gl#P=q3Pw
x?A)Jy
RWt;ku3Pw
x?AgFl
{(>l-4tb>I+
pQwf(:2
zr]c;mb&')\
:B,mGW5M8u
@FZ lF5E
-;C!UHGr'=6_
AO!A}H
:5PN"L
M$Ht>~
?g:kI`S^
A9\Mzq
X$}S72DA\1%)gO_P
u0S!0+
BGY3WzL5
<+(sg@$S<
{;|KRr
_}%>[K
CVV{'iZ^ A*ZLimI+
[+FK09k\A
F]3"'15K:v
S;+WiTEiv]ckr>q$BN
;x<OvHzf/
-2giF{$ A A A A A AL_
@H8pHk
gLBe7I1
P 'xzS C@a
[o'I5^
^0L4zh' |z@
"f[ kT_#
}-'><`R*.
:kvN&1]l/{@
=?N/^@SXxS
K5h^NeEwe5sz^
/G,#;M
b|y#7>tF>ZP\FR}=F
pqdRt0
_Jn!}7-="s:]gb
6"vrc7
Bw!ZbEGa3(c;(Gd
~%@voEw_kFefNMO
bxxMK)'P1o8sKM
^I ;~{2ZgO1\S
|QRZ2r2
?A?W#;
9K4}P_
u@ ![ht
o)pewg4`K
Ma"#C@@h
qnAXW3"n
c)Tj6c)
GS3`N[$'KFG@(v[pX(
Ma\u80*
;Kl{h0
*Fgj?Ug
5}W#)S
,+Na3T3
>Qh7^~
Z.`fMI>
uWjVm4
cY~*U~N~
o`:]~W0
c3OnO&Qowb&
[ts|<n>%s"
svj$gF,c
L|^BZtz
h@9E)6&
vcn>}`
? C0oP-m
OQN<20
|nwGY3/1<^nd
7Kq0KF
x}|Jg8s-;dr[&n%
?:dI%thheFtf
0Y8"VSspFx>
^uZC`oh
)}%+tf 7H
f`0{2&It3
_0;3Lh?.
99h%lX
vBdJU_9
,1Tw#|Ht
l4PX0'TU^r
^\A^)
;BP?i/u n0sUH~
7s`0UK
^vA">1bSP
Hx=cpF
b7r6ed
rkYl%t
]fh#[;WoY
qDqm RZ2Y
;L%npKn3>)&
o0C >Wsl7
2XSBIL!q=
,=z+vj
"Ghrvb4R^
9xlQzvjPB
iQgq1_`0
%L5Yf_8X
Al3YR#|
q^RsucF%kEk X<n:P
q1&i>&**bMt-DJm
9R29wG,pg
ac`PQr
@yOR?vC6
_kzmtQ>D
[?-@4,Vp
niZb6S?
F'fyQZ
6Y7-j'
0xG l%\+
jPH|wD^xP
!;^fGcr
2\L,Nqt
=MHaBY
D`0AY$DQ
#,bnk/E
%8{BHb'CG^jJr
Qg&Gyf
H 3xem
oUqgS$tS"k
")"c\c$b.aY{
jxnDgI
]CjT=5\
Ec3[G&'
(Fv lbR
"I"X\eT
uWu8cCJ
W?Bb1]
!1|(/6B
mVU1$k
5tAx<Z
5"gm1x{
zl%c-@Jg7sO
R& ,oW
1pt,Gk
{@KT};j
S+L`W$:
x~3E)<eX) -
a6}:Bj
Z#~+:|
@zo!d IjP
C:H;fB=~3
%p@';Y
v0{4`b
GZ7,DneF
Co=~lc
7<zwTXa
1FvmXc
>uH{]( E
jmfsL7xYK
):~*r&TgNbh
d<\wQ0|
Cn07T e
&h0xFz
,DEt?0
wV`8tA`
dU_%;,-o
-[-w0[{
J4dwN?
K-MM$$@|
n0-r.[
r|&%dIE9H7#
qG[*0>#l
-:DgWX-5^}kqP?5
lg\I_e
j6]<MYCcgz
b1xP};h
x6Xh3eh"
TtGKiYz'
>Dm6c|=Z=}
_>~F.
"JK99f
]<:xy_
W-:P"Y\
+\ R.6
"$ u/4M
*8>Rv@M
E~E~=AVk
6&mLGtP|/D
`:\H}znWr
$Y>{-?
-DSC<@
!!150{b
,yzlu^h
dfma siif
p-C~=@F_WPN
JeGta[
Nxs!C^_
5t#H=)
n?^9]KB
K-WEgf@
H!ufH//
V!<oz"
v+yK#b.
t!3r.(&xHlpA7
}o9?)0?k$QyNbUBx11(
wM#n}B
%bM#)q
47D8rV
C# #;46M,;
.n(R>"
"fC-EF[R1
}S fL~UY/
;pV[A!
=3Bfz["i%#H~x
M;[t,_bf;L$
&EfGqPP
uA'Z5mz
}b;i Xs
8+BGb^$:
"XA(U~
d&\}|A
9-8($H*]
>V4^?9(IYEY
[O*:!B7C
qIU}$qy
c{e,)6
y"=F |/V
'T!EB$=Fu
^70@fZj|`YB|
rUwsPNWu
| r+>E|@/}e
:VbCy^
02F.\Sg
Nt@a+ t
ngQ78]eJ
x1CG#wPj
x!B1inPP`{@
o{m<(%iG
2hq m([62E,D
F\.vq#dXx
]=`4JR
b,$Okb8rA
f*~&M\
[5ydF
P).KuP|K>8~
tQcl}.U
r-'5VL;m
5>)wXOQ$[fq.
gjV2'CX
B8j`-Ey<
3S1}@1UM'<
N6]?pb=h# n@
3%Mh0Qf
Vbb3+BmM-
AEc-#!kSR)1M
bTEZA//
z! }bx"i0mMY
_Hf&Tv+d>^'(Y%>X\s[
^VlJrUE]/
c&0?|ZXDO
oQ/!'D=
^/Vy_V
l"(G/8f
;hl8:_<:7+
XK>T,*K
+zG=lB
ecW{B1c
p2e"I;
9XIl+ER
O,0q{p.
K |lZ/Kf`0N
d)1[i02o
w-4O)5>p`Ae
, 1`JW
(;4^vClxijCj <
9v:d1VY
fm'1-t\/c
A7H"dg9)qhP)X=(07xOT
MTUf v-+{
9[gm'/aF
&qy@&j1
11}5eu
ivu"wf
e]4^P/W#Uq
;@p$,N
N~. =w
,.TW%|+kE:0t
Pl5U %cO-q
>K) ey
EH5XYXG
|5D+d\8*#X]<
1s9~ot
m2,`^BY
{s2YZPM
b7j)\$N0
J/M{c3&M}
+"z@?R
foy\aJc
(A!c:wA
)9\K}hpZ
,]FB@&^.c/@j"0
5!_,DL,P
z}&Oo7'3\bi
z3[Kv8
0YgIQC q!t
=j0e4!rj
u'&RRB
Eq]-c= <-
<M)T3)},
0#6mEHu^
A87U%=
2P@d@w.lzX
Ecj}>kS}fG
3RRM9y.
nh&yWRhfp6RSv,q-
@"T>p%Z
(V#_'{<
.d$dS&h5
;8E?/nyP
y`kobo
;\P/g*K
?%\Z0f*
wG5|HK2J)g
sD@{S~D
[xw0gu34
gE2XD;x+ Us
t-8w26N25/
&[ ZTNu
D{{]p9
4Az5"K;+
F^e~-13
ja7aaJaaGq
##ZP?H
gH\q/"@}
O_@mRfc
at|.2
5t$/QIo8e@
dQ^GzA
SFUx [J
T|9BF\
*^5O|?R2^K
@L$R5(
Y<#1(3
?NmIz76XefR
K)0++b
S;K"m7VT
f4b$$'9
y!9gr}P'y
+%3Po6P.=F&6o^Rp,
'cYQ'u
p"bPJc5^4
N_>pet$
xPr:;B2
lc]"-Q
)y(?\319CL[$J
}L5B.A&
,RQ}fWC
Ko_f/F
?OYd+G
^X){GZ]
;HKwk7y
6e{Dh@He`
CR(.qT
Z/:9}w
N*t!c4
BbBeGkf^>
GZ\vGy X,$IX^*3wFV
8mXe)9
eS%-,Z
1Qg52>
sU.w\lB>`
AT@ynQ7k
3"5my4
e(tkiZ^
{kOQ>-
np<Q9kI^4Kcot("
\ .[j(elm
c(}oooJ
PPgfRuIpqB3@
Cgx!i=L8
HQhFMI5
a}F]zIT_}
@BD@;J
,7 (WN
e<Ht4g
'0WmA&g52|2
mKvwmE[(fJdil
w49dEB
;e3m s
=m,YhC.Z
%2.US{&0V
Vv|K4ZZb9e].3
>S8Q,D
Gt;VZu;q*F!x
#xx_rp
AH^.|oi-/%\8w
$9^Cisk*P
+NXu3[]NmS}H?#
x+V#:R
u"!bb*&cr18
~OF-G(
o?U|d=
0.}zg.0i
S.3P~p.EP
Ay,u5`
lc{rQz&
Or&Nc);y5<6}^
|(B}w#
|^R\>BM<"
UuhgT`^e.Q(
6 "d `?1
AigW+!NB
(<{Pbf%wI
9R@c:9p
|wB3,r
xRT*'-lb{
?n%F0CiFv
K3<%)2eN
IxI"WA[
b,&KBf
)=dasrFIrDD|M
fRwq3]Oo@Q
PX*mLLK2E
x*LAp5
[jZx^iFm!suHw>F
f5-4h!kYo
{M0 LU
HQqt~$3
W}Qrpo:
H?W=[l'?6dE
wNdoO@
lXsi(vdB<C}
9xiH/g
pG^A}Yjl=
u/YOXgE'-oc
w8:$k@
[)Tid0
Rj60?A.
!#TY}YF
a7K5FnK
mK0z^.UO
_XAoqg4
C/V.0FZ(V w
W$([3z^e
B*{XWw8!%
nPJrDtxV(
Yl#{ 5
m$l+4&om{YL'a
Lf;^ X>R8O
I<HWqA O
"b\OoJoq
(|Se[Y&"
_V<dAW2%N]$hT
uVo 9#F
Vb%O?tC;h*{u
gh#?Q/&
vf G%xd
@j8G:b
8/ 6S
1_"ekYg'4
pusBjr|z
E q3{X
9lq/&rXnTZh81 Wt
TV(_8U.)cdm
'un')Y
\F$e]0zP
$q7Gf0
I1IMJ;6
,^7`O.x_
|FH^WV7&aG-'
V=jmr|
Mp"lT*
svU`;4En
!x<x5(2fD6C=
Ev|hR ]Y
0$+>ey'|
W*L>_C
SKGwj
fV^F_mvO2
ZDI-RaU`
.cu0;A5nlG\
khGNk`TQ
.E3P`a
n^|@:fp
2Xe*$;
}WA^~k
eL98V=}lTa
-*B%Kgs
E{dlk~
wtr:`
s&>3>{
7>7<$,
&>{#OEo4'
@ r2*-
wTw`y{IP
Mo1{B3s6
/.5A R;fBMnR5*.7pSe
I)/pO;y
oo]UX\
N#2Kl.Q
(._&~.3T{
x$o<CV
,^xe4D~
hz,v[D
Fn'SPbY52v}}-rUEx`-
vLIsM'?Y
|laa/j"
jxiY~Je
-sUIS~s
*F/F~R,
Uh7p# >(c
FGarb ,{
|nhJM*
[Y$ik:
VyI+ r
8tM=*N "<l
X.IT}7l
kgnCp$zx
9}hQ .
_c:^tF_kI
{|bej;
`>[0X$FB\Hh
{Gtxv'/Rnazm2yd[Y5Mj4)
d<I/HcA[eBz/KW9J
894srcn2
bWCiri.VO
+!&3g8
C8Q tW)
M$ki1kL#
,bu]`Ry26X[X,
a2~kPP
:N[H0(~6G9~c%
j{K#]eUy
:ePgQM|
LU5zOc2
3Ti1\tR_"<Z
^~*S=5
d]0.;A6Nh
Vv$Z`e"U!SG P
/AH50zA"b
>X$1h[M
7p)OKVMY!oL&5]L*5
6esNOt>Cs] sI
-%DbNjh
rp<V~
^GQx>n>
p1}3%z1ugM
nGN[X);/
'=L{UYp
"{>y^m{Q]
x2,UzJ+X*
pRva7WM*]@Y#@q
x7iP+3[_9
C}isCon
"UMMi
#"?X#(
![aOlV2#
F_S4scH
#j&2MGf
b}8pB\s)dy
ij]K't
u)gy{"E!\2Gir*
Rox[7?!lJ|
7dgc4XzS0h
,fN|7"5
,z4ELO
^GkW@[
^XYf)Q=f
0qc-k5
`DC!hG5
F21Y+~i`R
CE{2'IZW
f'Hm0hOsD
x}T|3"
Kp!;x,
J25I`{Z5y}#jg
9g%X&o
-Mg9;bf>
>?@BVX{4
M??An;jv
{Cwh?'
F&*rPF
vm:!qi6[
AGJ9]gz%\
e~^ j46z
dJT7r2?! Mq6t'0:D9$
UG:v6`T
t{^qVLS9
~)nF.$
~(_L\|h>
=C3>L"E
W[6h*G
?z%3lF8,:
rN_5G5
f]fNzxDwZt3
[/UdbW
HTBH;|D
2mO82A"Y&zB
H$rvYwNpbwC
4:tQKC
miJD&P
rFZ.A3
3poj#Vd
l6T}1c
kT-uu4zeV*6-=
R#AR@0BW
y@MUscCkzpV ;"uO3
PWH$dE
rNWbj4{
ebstW"
Z#7j0 yW
h4p~nUpN
8JM<xa>o#]]y2SWEt2{YMY(
8zE=fy^w
kw$_%N]A2y1a\!F
Nus@/:
b|;zUU
Ncl _@{@)
LnJX7_3y :l-?F
?{a<9Xo
n5p0|(-!9,@.P
IC~B48X
C8_PJ.
jF: =})MP}$QZh#C
N:aKI+*uL
&Ti2?`2nEE
@h_az8i6Jr
.A8pl/$Pa
A5d{Vkb
,:f'Xt
K&A|z_~ph29Smxhf_
)=d']Z&y>r
FAe3'Nxngd X
DT{`T3|*
o51i_|q0
lN^`*[8
6+q"tY$W
g)|//|l
D?8GA0'
iRF\u?zF
8ir0PM
.=0]tS
gq9c?pFVt_
{,dIv @h/
G%h5>e <
nINEa+
:-e =LRqKV:KQ
G;Lf]u]4zg
$Y*U;9
*KIz~d
"I=l*72
I7/XMJ|e
NYS(HP
Lr.Q)p
|55g.}
qkWvud
UM';PnJZ
;?9wK^1PQZ
#d\nTD
+{4KM][iz|
T_CgdHW
wi+uz,
{_|=I4
i>W(wX,%kp
<7{R">
*\N]5\Tl
K iB-
b*;:r>I)(E9
BhDB+/
u$J5d+e
$4yG8dq?
q^d?\!
_:a5d|z
4GYN[p#o
I/{yr#`
Zff1gJb7
U`e\%M
~7sH]xJZ
(}5.mMoY
3yx5|Ye
\g[v&o+T>
?MB>O[
?QW8&08y
P|"dO*-
y op|?
LX1)@S
&w>)!uBi
kIj'Zg
@bm.d5le5S>SFs5
x}qymW
&P%lJAza
{@lFBCS)m]
m(.Q@w,UV
EYZs0A LP<_pw9
Yhi?64&h
jJ<J3|~@
~(,#Q;p
}>pk\YQfi
eGdVgwh
#qCqgGxN
l<8Rs>*_n"
i$u6v;A
^kS?l7H,pS
iR8H]`01D/_w
^!F'}9,:G!=
rH)q]7<
d:M1)..#k/Q
upa0*jm_u
ASO\6$Se
VI=dr&MtW M S5r J5_
@KX,fzj
941$LIer{}&+-<5)
'Bm!cC Fi
e/A1Fi9(
J3G8dB
J3nGdB
zYMBT$
J3KGdB
)YMlBT$
J3F gB
J3F8lB
generic
iostream
system
string too long
invalid string position
iostream stream error
Unknown exception
bad allocation
Visual C++ CRT: Not enough memory to complete call to strerror.
LC_TIME
LC_NUMERIC
LC_MONETARY
LC_CTYPE
LC_COLLATE
LC_ALL
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
bad exception
!"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
UTF-16LE
UNICODE
Y ntan
nu?cv5
8Ud?|}}?<
?)0>B<
sl?ecb~q<
oX?F.K;<
4lkQg?;+U<
:@Xh?,n@4`<
G^*?m(<<
+?NibzP<
l? %X<
Y?]@_}<
En?T(+<
'?ju!4<
qw?_W<
w*I?n'$<
R*?)R<
H?Zxgf<
a?_"C<
]hNp?b
4{#s?Ug
*Ow5?.@<
W?W0e)<
J]?V:e:<
b;SO?4Td
U?\z#<
aX;[?Y']<
|a?B<$<
?+XUG<
._p?1S<
'4?/t><
&?5SmT4<
@ic?%[9
3?*+xi(<
?{!mB<
2?cMyoG
Vsw?8K
l?e/?B6!F
u0wu?M
G"zI?$}Tw5<
e?M]-e<
) ]?h<
'7?y]h
=e?:Q]D\<
?FnHAY<
)RQ?{<
dN{?c1
=.q?+`
iQi?v7
?ZEM-'^
!?:Zn=
eP5?+}ZI
Dwb?(,x
Q/?qq)=
o\l?)T&=
?|6??#DZ9?
?/.?>6)}?, ,
?x%q? ?/xbJ?
?(Z ?t?{}2F??_2
?>T^?u
?;E<?fSOs?JQ?zL?
?{yK+;?
h?F?-(?n?@F
J?CSi?
?89l!?f
:?1(>?
2:@?>?@@?"Ir?64?
?765@Z?&+-?w'?
Q?Gpt?2&?X9
?Mj$?3?s
?I@ |?P
?}>v?H|As?#
F)Z?2V
V?f\S?B?}
4P?VL?{
uB?1<>?(b;?
7?]o-4?
\%?f,!?
?a?9y?9
9R?%R?F
?@_o?7
?D<xZu?`\@j?)]Gq`?
LcU?JupJ?CY??
?#em? -F
R?VDD?oWsg6?UJ
?1_?$*2
)?V?l$G~
?+6?tF4
,~?"n?
L?l6;?6**?|59
?HK?s7
?I-?$z?9\?>|.~?
-W?^\sY0?:Rp7
?mbzA?G4's?Iy
C\2?Ou
M?nw?KK'F?l
?}6lw?
?$ f?e')lW?zD@
J?F<?Q'J`?xe_
?"Sr?xw
S/?yx|o?P6 d!?
T?!z? {
I^?A;?wC?JG7&?'
?,"Q?/
b?PV3 2?
p?Va"?
UUUUUU?333333?m
.?333333?q
?UUUUUU?ON
?$rxxx??
CorExitProcess
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
Illegal byte sequence
Directory not empty
Function not implemented
No locks available
Filename too long
Resource deadlock avoided
Result too large
Domain error
Broken pipe
Too many links
Read-only file system
Invalid seek
No space left on device
File too large
Inappropriate I/O control operation
Too many open files
Too many open files in system
Invalid argument
Is a directory
Not a directory
No such device
Improper link
File exists
Resource device
Unknown error
Bad address
Permission denied
Not enough space
Resource temporarily unavailable
No child processes
Bad file descriptor
Exec format error
Arg list too long
No such device or address
Input/output error
Interrupted function call
No such process
No such file or directory
Operation not permitted
No error
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
united-states
united-kingdom
trinidad & tobago
south-korea
south-africa
south korea
south africa
slovak
puerto-rico
pr-china
pr china
new-zealand
hong-kong
holland
great britain
england
britain
america
swedish-finland
spanish-venezuela
spanish-uruguay
spanish-puerto rico
spanish-peru
spanish-paraguay
spanish-panama
spanish-nicaragua
spanish-modern
spanish-mexican
spanish-honduras
spanish-guatemala
spanish-el salvador
spanish-ecuador
spanish-dominican republic
spanish-costa rica
spanish-colombia
spanish-chile
spanish-bolivia
spanish-argentina
portuguese-brazilian
norwegian-nynorsk
norwegian-bokmal
norwegian
italian-swiss
irish-english
german-swiss
german-luxembourg
german-lichtenstein
german-austrian
french-swiss
french-luxembourg
french-canadian
french-belgian
english-usa
english-us
english-uk
english-trinidad y tobago
english-south africa
english-nz
english-jamaica
english-ire
english-caribbean
english-can
english-belize
english-aus
english-american
dutch-belgian
chinese-traditional
chinese-singapore
chinese-simplified
chinese-hongkong
chinese
canadian
belgian
australian
american-english
american english
american
Norwegian-Nynorsk
_nextafter
_hypot
Complete Object Locator'
Class Hierarchy Descriptor'
Base Class Array'
Base Class Descriptor at (
Type Descriptor'
`local static thread guard'
`managed vector copy constructor iterator'
`vector vbase copy constructor iterator'
`vector copy constructor iterator'
`dynamic atexit destructor for '
`dynamic initializer for '
`eh vector vbase copy constructor iterator'
`eh vector copy constructor iterator'
`managed vector destructor iterator'
`managed vector constructor iterator'
`placement delete[] closure'
`placement delete closure'
`omni callsig'
delete[]
new[]
`local vftable constructor closure'
`local vftable'
`udt returning'
`copy constructor closure'
`eh vector vbase constructor iterator'
`eh vector destructor iterator'
`eh vector constructor iterator'
`virtual displacement map'
`vector vbase constructor iterator'
`vector destructor iterator'
`vector constructor iterator'
`scalar deleting destructor'
`default constructor closure'
`vector deleting destructor'
`vbase destructor'
`string'
`local static guard'
`typeof'
`vcall'
`vbtable'
`vftable'
operator
delete
__unaligned
__restrict
__ptr64
__eabi
__clrcall
__fastcall
__thiscall
__stdcall
__pascal
__cdecl
__based(
GetProcessWindowStation
GetUserObjectInformationW
GetLastActivePopup
GetActiveWindow
MessageBoxW
1#QNAN
1#SNAN
bad locale name
ios_base::badbit set
ios_base::failbit set
ios_base::eofbit set
kernel32.dll
bad cast
HeapReAlloc
SetupComm
IsBadStringPtrW
WriteConsoleOutputCharacterW
lstrlenA
RtlCaptureContext
DeleteVolumeMountPointA
SetConsoleTextAttribute
SetThreadExecutionState
FindFirstFileExW
GetTickCount
GetCommConfig
GlobalAlloc
WideCharToMultiByte
SizeofResource
GetSystemWindowsDirectoryA
FindNextVolumeW
GetAtomNameW
IsDBCSLeadByte
CompareStringW
DisconnectNamedPipe
EnumSystemCodePagesW
LoadLibraryA
ProcessIdToSessionId
IsWow64Process
BuildCommDCBAndTimeoutsW
VirtualProtect
PurgeComm
GetCurrentProcessId
KERNEL32.dll
RegisterEventSourceW
EnumServicesStatusA
RegQueryValueExW
ADVAPI32.dll
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
HeapFree
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RaiseException
RtlUnwind
HeapAlloc
LCMapStringW
MultiByteToWideChar
GetCPInfo
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
SetFilePointer
CloseHandle
GetProcAddress
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetLocaleInfoW
HeapSize
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
CreateFileA
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LoadLibraryW
SetEndOfFile
GetProcessHeap
ReadFile
WriteConsoleW
CreateFileW
fakulut.exe
@mctraxer@0
@shutting@0
.?AVerror_category@std@@
.?AV_Generic_error_category@std@@
.?AV_Iostream_error_category@std@@
.?AV_System_error_category@std@@
.?AV_Locimp@locale@std@@
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVout_of_range@std@@
Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.
.?AVtype_info@@
.?AVbad_exception@std@@
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
I x@oGAkU'9p|B
~QCv)/&D(
uuvHMXB
9;5SM]=];Z] T7aZ%]g']
?Zd;On
7?3=Bz
;1az?aUY~S|
D?$?9'
*?}d|FU>c{
zc%C1<!8G
u7.:3q
#2IZ9W
,%I-64OSk%Y
.?AV?$ctype@D@std@@
.?AUctype_base@std@@
.?AVfacet@locale@std@@
.?AV?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AV?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AV?$basic_iostream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ostream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_istream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_streambuf@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ios@DU?$char_traits@D@std@@@std@@
.?AV?$_Iosb@H@std@@
.?AVios_base@std@@
.?AVruntime_error@std@@
.?AVexception@std@@
.?AVfailure@ios_base@std@@
.?AVsystem_error@std@@
?-n9a,
.?AVbad_cast@std@@
.?AVbad_alloc@std@@
%D\\\_
eeerrrr
lR1jkk
wwwwwwwr
sPetl'
"[[[[["Hr@PsJShm
/<<<----""9"""["HN@
W*----99
-"-"""RP(w
E66c^swL20((d;uxc'+++sssssLww
h ]6tw02
6wwdHHOL
5|- \%
!wO``u&
***pLLc] K}}Z
CKv$h34!w
}K5ZC}ZC3
&(00w&
K}}KK5}}
x\?JlN@2(
]c]cc5K=n
*Tu**^cW]]]F3
u^u*TIg
\3]Khuy*Q^^^uQhhn*Ign
G=}u*uQ^^TI QIp7,7 g
n TTQuTT*^QQy7 c
^T p ppn}GA
p p 7,,p
hpp ,pQj
Q9jU11Q
jj1UUj1
naQQ1j
Qj2911jjjQpcG$
aEgU1j[ )
11 6GA
V'55>{L
%[gOBTw\wEt d
|tAzXx
d82J@::k@k=ghOO)F[~4~RQ6
6g;uQRC
???u(iL5v(
o<oqinrukp|yzvyrumrxoutpsyzrtplrxtvnqqutwsznqzwjotl
}_]uqu}
|zxq{vk
qmvnto
ntjvwslturqwsuqlnuosvqpvmt
`wqwrvo`m8t:tknww{|to
{lpyvsuxvvoxtp
srylqy
|igurwu|mwus}otuv
u{rtnw
qtoxvz
ssyumsomqsknqppqonrtmnyw
@FEF\qouvzrr
1H<=8CFGyjowsuk
;=>UWWW|ov~{ww|yyuqv
Luvsqmqrrtmyrtuustrzptuwmp|o}xwysnsqvptutnsqvvpywvvmrypqwtuuztsmqwq}}wxtqsotirurssywvmpz3
sG8h}|~soowoprTZSVR]|Xj4q
@;5yyvlxjowu
785=8:==
bx:5<o|r
rvslwr9>48?588k
A67;stonvunxowuxqttorruso{pv|vu1EI7=8<8/8.5?h
m85<6wyznstyo
v{pv{stz>7?94?::5144/lq
#]923;nznxrm
wnw61147559;2545CBr
?\:3:=xwq{utxkmqtrzytumu1:.00/3159
Bt9369yvtoppzottxjvwvzowuvpoqm5
/.0,981-.
A5-Oxvsyvq-,14
03309411(:
|||vh40<-24=9:8&4?F
ztpQ>FBB<
z}ou}xqnxzwpsnorksuqswwrjxunszrrvtqvupxxwqZEMEHLRSWLO
^WUU[QRPZU
aaad]|
O0b0 111/2B2V2^2d2i2v2
4M44657t777777s88/9P99999
:&:::@:J:O:a:r:
::::::::
;j>y>>>>>>>
2222222
3-3=33333333
4!4w4444444444
5 5/585>5C5H5P5Z5`5555555
666:7H7
:1:7:::::
1u1}1224t6677798]88":i:w::::u<<
> >8>Z>|>>?
00M22=3N33333333344T4e4
5/5[5i555555
6=6J6T6Y6u6}6666666669
:::`:k:::
;!;*;1;7;>;J;\;l;|;;;;;:<<<<<<
=>=[=a=s==
>r>>>W?q?z??
222222
3>3D3I3Q3a3k3q333333333
4)4p4u4
4485>5
6L6d6k6s6x6|66666666
7Z7`7d7h7l77777
8-8W888888888888
999999999
:?:]:d:h:l:p:t:x:|:::::::B;M;h;o;t;x;|;;;;
<f<l<p<t<x<<
=k=$><>A>
2 2'222222222
5s5y555555\6607-88:
<x<<<<
?'?2?????
1$2.3w3
<X=`=u===
>>p???
c0o000a1m11s2 444
5;5C5a5i5555555/686D6m66666666666666
7!7-767;7A7K7T7_7k7p7777777 8<8_8r88888888
9%919>9b9t999999
:6:e:t:
<D<c<<<
='=2=h=x========>>P>0?:?G???????
1$1<1W11112$3,3239333
4$4H4T4`4l444444
5$5-595E5Q5Z5c55555555555555555b66
7$7>7p778
9999K::_;
;;o<<<<<)=Q=
>&>>>>>>U?f???????
i0u0}000
1C1r1z1112223
5;5@5F5J5P5T5Z5^5d5h5m5s5w5}555555[6\7l7}7777777&8,898?8H8O8q888
9#9-929N9X9n9y9999999
:6:=:W:^::+;>;P;;;;;;;;$<1<F<w<<<
=~>>>>>
?(?i?t?~???
Z1k1s1y1~1111
2:222222
3G3N3c33333
494i4{444444
52595E5K5W5]5f5l5u555555555555
6+6k6q6666666u77777+818G8L8T8Z8a8g8n8t8|88888888888888888
9!9(979<9B9K9k9q99999999
:,:4:I::b;;;<
=Z=e=k======>>
;,;c;<<<<<<B=T=f=x========
0:1K11112y223364P4a444444
5>5E5^5r5x55555L6l66
7)788888
9P9[9e9~99999+:>:::
<#<6<H<c<k<s<<<<<<<<<
=;=L=@>
?=?f?z???
6000 12
4b4444
5d5w555:
; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\;`;d;h;t;;0<
???????
0J0P0X000000000
1j1s1y11
2$2-2T2a2f2t2@44+5>5]5o5555588#9J9j9t9999:>>>
?!?'??
00002V4q4444
666!7p7999999):]:p:::::
<6<A<o<}<<<<
=9=F=n====,>>.?N?
>0g00.2
5N5v55
6:6p6z6G999C?
011112&353X3c3i3y3~33333333333333394S4m4o6v6|6
= ===)>0>>>1?b?
011[2j22233m445555l66$7G7I9w9 :-<
e0l0000
1 1122P31444p5v55 676q667789
: ::::q;;;E<
e2i2m2q2u2y2}2222222`3333
4%4H4v444444
5 5,585B5N5X5d5q5u5|555555555555
1111111111111111
2 2$2(24282<2@2D2H2L2P2T2X2h2l2p2t2x2|222222222222
3 3$3(3,3034383<3@3X3\3`333x44444444444444444X5\5`5d5==
6????????????????
0$0,0h=p=x=================
> >(>0>8>@>H>P>X>`>h>p>x>>>>>>>>>>>>>>>>>
? ?(?0?8?@?H?P?X?`?h?p?x?????????????????
0 0x6|666666666666666666666666666666666
7 7$7(7,7074787<7@7D7H7L7P7T7X7\7`7d7h7l7p7t7x7|77777777777777777777777777777777$9(9,90989<9@9D9H9L9P9T9X9\9`9d9h9l9p9t9x9|99999999999999999999999999999
: :$:(:,:l:p:x:|:::::::::::::
; ;0;4;D;H;L;T;l;|;;;;;;;;;;;;;;
<,<0<4<<<T<d<h<x<|<<<<<<<<<<<<<
=,=0=4=<=T=d=h=x=|============
>$><>L>P>`>d>h>l>t>>>>>>>>>>>>
?(?8?<?L?P?X?p??????????????????
0(080<0L0P0T0\0t00000000000000000
1 1$1(1,141L1\1`1p1t1x1|1111111111
2$2<2L2P2`2d2h2l2t222222222222
3(383<3L3P3T3\3t33333
4@4H4l444444444
5 5@5T5\5d5l5p5t5|5555555555
6(6D6H6h6666666666
7(707`7h7l77777777777
8 8@8L8h8888888
94989X9x99999
:4:8:T:X:x:::::::
; ;$;,;4;<;P;X;l;t;x;|;;;;;;;;;;;;;;;
< <4<@<H<x<<<<
0$0P0|0000000000
101111
2336666666666666666666666666666
7 7$7(7,7074787<7H7L7P7T7X7\7`7d7h7l7p7t7x7|777777777777777777777777777777
8 8$8(8,8084888<8@8D8H8L8P8T8X8\8`8d8h8l8p8t8x8|888888888888
9(989H9l9x9|999999999999999999999999
l0t0|00000000000000000
1$1,141<1D1L11111111111555
6h66607l7777
888T8x8;;
( ( ( ( ( H
h ( ( ( ( H
H
m s c o r e e . d l l
r u n t i m e e r r o r
T L O S S e r r o r
S I N G e r r o r
D O M A I N e r r o r
- A t t e m p t t o u s e M S I L c o d e f r o m t h i s a s s e m b l y d u r i n g n a t i v e c o d e i n i t i a l i z a t i o n
T h i s i n d i c a t e s a b u g i n y o u r a p p l i c a t i o n . I t i s m o s t l i k e l y t h e r e s u l t o f c a l l i n g a n M S I L - c o m p i l e d ( / c l r ) f u n c t i o n f r o m a n a t i v e c o n s t r u c t o r o r f r o m D l l M a i n .
- n o t e n o u g h s p a c e f o r l o c a l e i n f o r m a t i o n
- A t t e m p t t o i n i t i a l i z e t h e C R T m o r e t h a n o n c e .
T h i s i n d i c a t e s a b u g i n y o u r a p p l i c a t i o n .
- C R T n o t i n i t i a l i z e d
- u n a b l e t o i n i t i a l i z e h e a p
- n o t e n o u g h s p a c e f o r l o w i o i n i t i a l i z a t i o n
- n o t e n o u g h s p a c e f o r s t d i o i n i t i a l i z a t i o n
- p u r e v i r t u a l f u n c t i o n c a l l
- n o t e n o u g h s p a c e f o r _ o n e x i t / a t e x i t t a b l e
- u n a b l e t o o p e n c o n s o l e d e v i c e
- u n e x p e c t e d h e a p e r r o r
- u n e x p e c t e d m u l t i t h r e a d l o c k e r r o r
- n o t e n o u g h s p a c e f o r t h r e a d d a t a
- a b o r t ( ) h a s b e e n c a l l e d
- n o t e n o u g h s p a c e f o r e n v i r o n m e n t
- n o t e n o u g h s p a c e f o r a r g u m e n t s
- f l o a t i n g p o i n t s u p p o r t n o t l o a d e d
B M i c r o s o f t V i s u a l C + + R u n t i m e L i b r a r y
< p r o g r a m n a m e u n k n o w n >
R u n t i m e E r r o r !
P r o g r a m :
K E R N E L 3 2 . D L L
H H : m m : s s
d d d d , M M M M d d , y y y y
M M / d d / y y
D e c e m b e r
N o v e m b e r
O c t o b e r
S e p t e m b e r
A u g u s t
F e b r u a r y
J a n u a r y
S a t u r d a y
F r i d a y
T h u r s d a y
W e d n e s d a y
T u e s d a y
M o n d a y
S u n d a y
W U S E R 3 2 . D L L
C O N O U T $
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 8 6 7 0 4 b 0
F i l e V e r s i o n F u l l
I n t e r n a l S e r v i c e N a m e
s f s g v s d g . e x e
C o p y r i g h t
C o p y r i g h t ( C ) 2 0 2 0 , t a i l
V a r F i l e
T r a n s l a t i o n
1 X o d m u d u l e b o t e v o r i c u h u f a z i c a w a x i x u l o g i j i p e k a l i
N e k o w e w o
X o r i p a l o p e j i r o n u l u v u d e b a v o + X e j a j o s i j i x i m u p y a k a v h e g u c e x u y o h u r h o m o r i
L i g e p a p o d a d i j o y u v 6 D u m t a j u l o s i j a v i p e y e c o z e c o y u n e m i b a d i h e t j i y e y u n i h i c u
B e b e x u
K a r e r i k e m a x e y l a y i m i c i h i f a p e x
S o j o k e c i n u f a k e l
X o g i d a j a x e j o x i * M a m u r o s i r u w u s u p a w o g i b o b a w o m o z n i z o y e r a d e " B e f i l n i h o h u x i z a s u g u c c e b o h u c u g o t - X a g a s u w o t u d u c i f u s a c e x o x j i h i c o g i p e g h u y u n u d u ' H u d o x c a y o r e s o d p e t i j i x u f o b b e b o v a c u j a r
! W u j i t i w o n u w a x i s w u c f u p e g u x u c o d i d
P a l u l a f e x u k u j o f u j e r e s o p
K i s e p o g a r i s z a d o w i v o r i h u x u l 0 Y o r u m i s e r e l u v s o y e c u b e g i t u v a h e v a m u r m o n o y u s u k o b ' Y u k i r a d e l a b u v a y o n a v u j e y u y e g j o b a c a y u l ( M e f e g e m o l a d e f e f e b u g e x e f i g o v e l o h u j i k o p
M i j o w i r o
J e t u j o k i r
/ L i v i p e h u t o j e p e d w e n i t a s o z i f u c e c e c e w a w h a l o t a n a # K u z i z u f i f a t i t e f a b i z a c i h x a s o d i w o y
N a s e c e r o r u f a b
R i h o c o l u f a c i g e y
% Y u y i r k o w e c o k i z i h u t u r e t a l o c i j a n u w o ( M u v e l o x e f o z u h m o d k a j u y k e j u y i m i m i t e c i x 7 F o s u v o f o j u l o h i f u b e w a y a j u t a s u v e s o s h a y a j o l u c u y i m u z w i k
V a n u c o d u r a z a n i m e l o b i h u v e w
G o h e t e s a t i k e g u s a x a t i 7 T a s o z u s a c e c u r r i p e y i w u t u z e y s e y z e s a b o z i p e d u p o p b e w u w a z
2 Z o t o t a s e j i w i c u k u m a b o c e g e s f u k i m i g a b o l e j a n u w a l u t
Process Tree
- 0334f5f4690416b41c48e16b02e9aab6ec13e8dd2735d6850c347bec21f8759a.exe (2400) "C:\Users\Administrator\AppData\Local\Temp\0334f5f4690416b41c48e16b02e9aab6ec13e8dd2735d6850c347bec21f8759a.exe"
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.