Static | ZeroBOX

PE Compile Time

2021-07-03 14:44:08

PE Imphash

4b67c182997c6caacb0b141d8d598664

PEiD Signatures

Armadillo v1.71

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x000a6c52 0x000a7000 6.53699231627
.rdata 0x000a8000 0x00413362 0x00414000 7.96587378319
.data 0x004bc000 0x0003e8ca 0x00012000 5.17560530051
.rsrc 0x004fb000 0x00005f68 0x00006000 4.84231033686

Resources

Name Offset Size Language Sub-language File type
TEXTINCLUDE 0x004fbbc0 0x00000151 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED C source, ASCII text, with CRLF line terminators
TEXTINCLUDE 0x004fbbc0 0x00000151 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED C source, ASCII text, with CRLF line terminators
TEXTINCLUDE 0x004fbbc0 0x00000151 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED C source, ASCII text, with CRLF line terminators
RT_CURSOR 0x004fc0b0 0x000000b4 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_CURSOR 0x004fc0b0 0x000000b4 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_CURSOR 0x004fc0b0 0x000000b4 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_CURSOR 0x004fc0b0 0x000000b4 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_BITMAP 0x004fd7b8 0x00000144 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_BITMAP 0x004fd7b8 0x00000144 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_BITMAP 0x004fd7b8 0x00000144 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_BITMAP 0x004fd7b8 0x00000144 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_BITMAP 0x004fd7b8 0x00000144 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_BITMAP 0x004fd7b8 0x00000144 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_BITMAP 0x004fd7b8 0x00000144 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_BITMAP 0x004fd7b8 0x00000144 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_BITMAP 0x004fd7b8 0x00000144 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_BITMAP 0x004fd7b8 0x00000144 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_BITMAP 0x004fd7b8 0x00000144 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_BITMAP 0x004fd7b8 0x00000144 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_BITMAP 0x004fd7b8 0x00000144 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_BITMAP 0x004fd7b8 0x00000144 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_ICON 0x004fdd0c 0x000010a8 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_ICON 0x004fdd0c 0x000010a8 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_ICON 0x004fdd0c 0x000010a8 LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MENU 0x004fedc0 0x00000284 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_MENU 0x004fedc0 0x00000284 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_DIALOG 0x00500008 0x0000018c LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_DIALOG 0x00500008 0x0000018c LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_DIALOG 0x00500008 0x0000018c LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_DIALOG 0x00500008 0x0000018c LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_DIALOG 0x00500008 0x0000018c LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_DIALOG 0x00500008 0x0000018c LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_DIALOG 0x00500008 0x0000018c LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_DIALOG 0x00500008 0x0000018c LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_DIALOG 0x00500008 0x0000018c LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_DIALOG 0x00500008 0x0000018c LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_STRING 0x00500a50 0x00000024 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_STRING 0x00500a50 0x00000024 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_STRING 0x00500a50 0x00000024 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_STRING 0x00500a50 0x00000024 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_STRING 0x00500a50 0x00000024 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_STRING 0x00500a50 0x00000024 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_STRING 0x00500a50 0x00000024 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_STRING 0x00500a50 0x00000024 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_STRING 0x00500a50 0x00000024 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_STRING 0x00500a50 0x00000024 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_STRING 0x00500a50 0x00000024 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_GROUP_CURSOR 0x00500a9c 0x00000022 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED Lotus unknown worksheet or configuration, revision 0x2
RT_GROUP_CURSOR 0x00500a9c 0x00000022 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED Lotus unknown worksheet or configuration, revision 0x2
RT_GROUP_CURSOR 0x00500a9c 0x00000022 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED Lotus unknown worksheet or configuration, revision 0x2
RT_GROUP_ICON 0x00500ae8 0x00000014 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_GROUP_ICON 0x00500ae8 0x00000014 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_GROUP_ICON 0x00500ae8 0x00000014 LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_VERSION 0x00500afc 0x0000029c LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED data
RT_MANIFEST 0x00500d98 0x000001cd LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, ASCII text, with very long lines, with no line terminators

Imports

Library WINMM.dll:
0x4a86a4 midiStreamOut
0x4a86ac midiStreamProperty
0x4a86b0 midiStreamOpen
0x4a86b8 waveOutOpen
0x4a86c4 waveOutWrite
0x4a86c8 waveOutPause
0x4a86cc waveOutReset
0x4a86d0 waveOutClose
0x4a86d4 waveOutGetNumDevs
0x4a86d8 midiStreamStop
0x4a86dc midiOutReset
0x4a86e0 midiStreamClose
0x4a86e4 midiStreamRestart
Library WS2_32.dll:
0x4a86fc WSAAsyncSelect
0x4a8700 closesocket
0x4a8704 send
0x4a8708 WSACleanup
0x4a870c WSAStartup
0x4a8710 inet_ntoa
0x4a8714 recvfrom
0x4a8718 ioctlsocket
0x4a871c recv
0x4a8720 getpeername
0x4a8724 accept
0x4a8728 select
Library RASAPI32.dll:
0x4a83d4 RasHangUpA
Library KERNEL32.dll:
0x4a819c OpenProcess
0x4a81a0 SetLastError
0x4a81a8 TerminateProcess
0x4a81b0 RaiseException
0x4a81b4 GetLocalTime
0x4a81b8 GetSystemTime
0x4a81bc RtlUnwind
0x4a81c0 GetStartupInfoA
0x4a81c4 GetOEMCP
0x4a81c8 GetCPInfo
0x4a81cc GetProcessVersion
0x4a81d0 SetErrorMode
0x4a81d4 GlobalFlags
0x4a81d8 GetCurrentThread
0x4a81dc GetFileTime
0x4a81e0 TlsGetValue
0x4a81e4 LocalReAlloc
0x4a81e8 TlsSetValue
0x4a81ec TlsFree
0x4a81f0 GlobalHandle
0x4a81f4 TlsAlloc
0x4a81f8 LocalAlloc
0x4a81fc lstrcmpA
0x4a8200 GlobalGetAtomNameA
0x4a8204 GlobalAddAtomA
0x4a8208 GlobalFindAtomA
0x4a820c GlobalDeleteAtom
0x4a8210 lstrcmpiA
0x4a8214 SetEndOfFile
0x4a8218 UnlockFile
0x4a821c LockFile
0x4a8220 FlushFileBuffers
0x4a8224 DuplicateHandle
0x4a8228 lstrcpynA
0x4a8230 LocalFree
0x4a823c GetCurrentProcess
0x4a8240 GetFileSize
0x4a8244 SetFilePointer
0x4a824c Process32First
0x4a8250 Process32Next
0x4a8254 CreateSemaphoreA
0x4a8258 ResumeThread
0x4a825c ReleaseSemaphore
0x4a8268 GetProfileStringA
0x4a826c WriteFile
0x4a8274 CreateFileA
0x4a8278 SetEvent
0x4a827c FindResourceA
0x4a8280 LoadResource
0x4a8284 LockResource
0x4a8288 ReadFile
0x4a828c GetModuleFileNameA
0x4a8290 WideCharToMultiByte
0x4a8294 MultiByteToWideChar
0x4a8298 GetCurrentThreadId
0x4a829c ExitProcess
0x4a82a0 GlobalSize
0x4a82a4 GlobalFree
0x4a82b0 lstrcatA
0x4a82b4 lstrlenA
0x4a82b8 WinExec
0x4a82bc lstrcpyA
0x4a82c0 FindNextFileA
0x4a82c4 GlobalReAlloc
0x4a82c8 HeapFree
0x4a82cc HeapReAlloc
0x4a82d0 GetProcessHeap
0x4a82d4 HeapAlloc
0x4a82d8 GetFullPathNameA
0x4a82dc FreeLibrary
0x4a82e0 LoadLibraryA
0x4a82e4 GetLastError
0x4a82e8 GetVersionExA
0x4a82f0 CreateThread
0x4a82f4 CreateEventA
0x4a82f8 Sleep
0x4a82fc GlobalAlloc
0x4a8300 GlobalLock
0x4a8304 GlobalUnlock
0x4a8308 InterlockedExchange
0x4a830c GetTempPathA
0x4a8310 FindFirstFileA
0x4a8314 FindClose
0x4a8318 SetFileAttributesA
0x4a831c GetFileAttributesA
0x4a8320 MoveFileA
0x4a8324 DeleteFileA
0x4a8330 GetModuleHandleA
0x4a8334 GetProcAddress
0x4a8338 MulDiv
0x4a833c GetCommandLineA
0x4a8340 GetTickCount
0x4a8344 CreateProcessA
0x4a8348 WaitForSingleObject
0x4a834c CloseHandle
0x4a8350 HeapSize
0x4a8354 GetACP
0x4a8358 SetStdHandle
0x4a835c GetFileType
0x4a8374 SetHandleCount
0x4a8378 GetStdHandle
0x4a8380 HeapDestroy
0x4a8384 HeapCreate
0x4a8388 VirtualFree
0x4a8390 LCMapStringA
0x4a8394 LCMapStringW
0x4a8398 VirtualAlloc
0x4a839c IsBadWritePtr
0x4a83a4 GetStringTypeA
0x4a83a8 GetStringTypeW
0x4a83ac CompareStringA
0x4a83b0 CompareStringW
0x4a83b4 IsBadReadPtr
0x4a83b8 IsBadCodePtr
0x4a83bc GetVersion
Library USER32.dll:
0x4a83f8 SetFocus
0x4a83fc GetActiveWindow
0x4a8400 GetWindow
0x4a8408 SetWindowRgn
0x4a840c GetSysColorBrush
0x4a8410 IsWindowEnabled
0x4a8414 ShowWindow
0x4a841c LoadImageA
0x4a8424 ClientToScreen
0x4a8428 EnableMenuItem
0x4a842c GetSubMenu
0x4a8430 GetDlgCtrlID
0x4a8438 CreateMenu
0x4a843c ModifyMenuA
0x4a8440 AppendMenuA
0x4a8444 CreatePopupMenu
0x4a8448 DrawIconEx
0x4a8458 SetRectEmpty
0x4a845c DispatchMessageA
0x4a8460 GetMessageA
0x4a8464 WindowFromPoint
0x4a8468 GetMessagePos
0x4a846c ScreenToClient
0x4a8474 CopyRect
0x4a8478 LoadBitmapA
0x4a847c WinHelpA
0x4a8480 KillTimer
0x4a8484 SetTimer
0x4a8488 ReleaseCapture
0x4a848c GetCapture
0x4a8490 SetCapture
0x4a8494 GetScrollRange
0x4a8498 SetScrollRange
0x4a849c SetScrollPos
0x4a84a0 SetRect
0x4a84a4 InflateRect
0x4a84a8 IntersectRect
0x4a84ac DestroyIcon
0x4a84b0 PtInRect
0x4a84b4 LoadStringA
0x4a84b8 DrawFocusRect
0x4a84bc GetMenuState
0x4a84c0 SetMenuItemBitmaps
0x4a84c4 CheckMenuItem
0x4a84c8 MoveWindow
0x4a84cc IsDialogMessageA
0x4a84d0 ScrollWindowEx
0x4a84d4 SendDlgItemMessageA
0x4a84d8 MapWindowPoints
0x4a84dc AdjustWindowRectEx
0x4a84e0 IsIconic
0x4a84e4 GetScrollPos
0x4a84e8 RegisterClassA
0x4a84ec GetMenuItemCount
0x4a84f0 GetMenuItemID
0x4a84f4 SetWindowsHookExA
0x4a84f8 CallNextHookEx
0x4a84fc GetClassLongA
0x4a8500 SetPropA
0x4a8504 UnhookWindowsHookEx
0x4a8508 GetPropA
0x4a850c RemovePropA
0x4a8510 GetMessageTime
0x4a8514 GetLastActivePopup
0x4a8518 GetForegroundWindow
0x4a8520 GetWindowPlacement
0x4a8524 GetNextDlgTabItem
0x4a8528 OffsetRect
0x4a852c IsWindowVisible
0x4a8530 EnableWindow
0x4a8534 RedrawWindow
0x4a8538 GetWindowLongA
0x4a853c SetWindowLongA
0x4a8540 GetSysColor
0x4a8544 SetActiveWindow
0x4a8548 SetCursorPos
0x4a854c LoadCursorA
0x4a8550 SetCursor
0x4a8554 GetDC
0x4a8558 FillRect
0x4a855c IsRectEmpty
0x4a8560 ReleaseDC
0x4a8564 IsChild
0x4a8568 DestroyMenu
0x4a856c SetForegroundWindow
0x4a8570 GetWindowRect
0x4a8574 EqualRect
0x4a8578 UpdateWindow
0x4a857c ValidateRect
0x4a8580 InvalidateRect
0x4a8584 GetClientRect
0x4a8588 GetFocus
0x4a858c GetParent
0x4a8590 GetTopWindow
0x4a8594 PostMessageA
0x4a8598 IsWindow
0x4a859c SetParent
0x4a85a0 DestroyCursor
0x4a85a4 SendMessageA
0x4a85a8 SetWindowPos
0x4a85ac MessageBoxA
0x4a85b0 GetCursorPos
0x4a85b4 GetSystemMetrics
0x4a85b8 EmptyClipboard
0x4a85bc SetClipboardData
0x4a85c0 OpenClipboard
0x4a85c4 GetClipboardData
0x4a85c8 CloseClipboard
0x4a85cc wsprintfA
0x4a85d0 WaitForInputIdle
0x4a85d4 PeekMessageA
0x4a85d8 SetMenu
0x4a85dc GetMenu
0x4a85e0 DeleteMenu
0x4a85e4 GetSystemMenu
0x4a85e8 DefWindowProcA
0x4a85ec GetClassInfoA
0x4a85f0 IsZoomed
0x4a85f4 DrawEdge
0x4a85f8 DrawFrameControl
0x4a85fc TranslateMessage
0x4a8600 LoadIconA
0x4a8604 UnregisterClassA
0x4a8608 GetDesktopWindow
0x4a860c GetClassNameA
0x4a8614 FindWindowA
0x4a8618 GetDlgItem
0x4a861c GetWindowTextA
0x4a8620 SetWindowTextA
0x4a8624 CallWindowProcA
0x4a8628 CreateWindowExA
0x4a862c RegisterHotKey
0x4a8630 UnregisterHotKey
0x4a8634 PostQuitMessage
0x4a863c GetKeyState
0x4a864c CharUpperA
0x4a8650 GetWindowDC
0x4a8654 BeginPaint
0x4a8658 EndPaint
0x4a865c TabbedTextOutA
0x4a8660 DrawTextA
0x4a8664 GrayStringA
0x4a8668 DestroyWindow
0x4a8670 EndDialog
Library GDI32.dll:
0x4a8048 ExtSelectClipRgn
0x4a804c LineTo
0x4a8050 MoveToEx
0x4a8054 ExcludeClipRect
0x4a8058 GetStockObject
0x4a805c CreateFontIndirectA
0x4a8060 EndPage
0x4a8064 EndDoc
0x4a8068 DeleteDC
0x4a806c StartDocA
0x4a8070 StartPage
0x4a8074 BitBlt
0x4a8078 CreateCompatibleDC
0x4a807c Ellipse
0x4a8080 Rectangle
0x4a8084 LPtoDP
0x4a8088 DPtoLP
0x4a808c GetCurrentObject
0x4a8090 RoundRect
0x4a8098 GetDeviceCaps
0x4a80a0 CreateDIBitmap
0x4a80a4 DeleteObject
0x4a80a8 SelectClipRgn
0x4a80ac CreatePolygonRgn
0x4a80b0 GetClipRgn
0x4a80b4 SetStretchBltMode
0x4a80bc SetBkColor
0x4a80c0 CreateFontA
0x4a80c8 GetClipBox
0x4a80cc ScaleWindowExtEx
0x4a80d0 SetWindowExtEx
0x4a80d4 SetWindowOrgEx
0x4a80d8 ScaleViewportExtEx
0x4a80dc SetViewportExtEx
0x4a80e0 OffsetViewportOrgEx
0x4a80e4 SetViewportOrgEx
0x4a80e8 SetMapMode
0x4a80ec SetTextColor
0x4a80f0 SetROP2
0x4a80f4 GetViewportExtEx
0x4a80f8 PtVisible
0x4a80fc RectVisible
0x4a8100 TextOutA
0x4a8104 ExtTextOutA
0x4a8108 Escape
0x4a810c GetTextMetricsA
0x4a8110 CreateSolidBrush
0x4a8114 FillRgn
0x4a8118 CreateRectRgn
0x4a811c CombineRgn
0x4a8120 PatBlt
0x4a8124 CreatePen
0x4a8128 GetObjectA
0x4a812c SelectObject
0x4a8130 CreateBitmap
0x4a8134 CreateDCA
0x4a813c GetPolyFillMode
0x4a8140 SetPolyFillMode
0x4a8144 SetBkMode
0x4a8148 RestoreDC
0x4a814c SaveDC
0x4a8150 GetStretchBltMode
0x4a8154 GetROP2
0x4a8158 GetBkColor
0x4a815c GetBkMode
0x4a8160 GetTextColor
0x4a8164 CreateRoundRectRgn
0x4a8168 CreateEllipticRgn
0x4a816c PathToRegion
0x4a8170 EndPath
0x4a8174 BeginPath
0x4a8178 GetWindowOrgEx
0x4a817c GetViewportOrgEx
0x4a8180 GetWindowExtEx
0x4a8184 GetDIBits
0x4a8188 RealizePalette
0x4a818c SelectPalette
0x4a8190 StretchBlt
0x4a8194 CreatePalette
Library WINSPOOL.DRV:
0x4a86ec OpenPrinterA
0x4a86f0 DocumentPropertiesA
0x4a86f4 ClosePrinter
Library ADVAPI32.dll:
0x4a8000 RegOpenKeyExA
0x4a8004 RegSetValueExA
0x4a8008 RegCreateKeyA
0x4a800c RegQueryValueA
0x4a8010 RegCreateKeyExA
0x4a8014 RegCloseKey
Library SHELL32.dll:
0x4a83e0 DragAcceptFiles
0x4a83e4 DragFinish
0x4a83e8 DragQueryFileA
0x4a83ec ShellExecuteA
0x4a83f0 Shell_NotifyIconA
Library ole32.dll:
0x4a8744 CLSIDFromString
0x4a8748 OleInitialize
0x4a874c OleUninitialize
Library OLEAUT32.dll:
0x4a83c4 LoadTypeLib
0x4a83c8 RegisterTypeLib
0x4a83cc UnRegisterTypeLib
Library COMCTL32.dll:
0x4a801c ImageList_Add
0x4a8020 ImageList_BeginDrag
0x4a8024 ImageList_Create
0x4a8028 ImageList_Destroy
0x4a802c ImageList_DragEnter
0x4a8030 ImageList_DragLeave
0x4a8034 ImageList_DragMove
0x4a803c ImageList_EndDrag
0x4a8040 None
Library WININET.dll:
0x4a867c InternetCrackUrlA
0x4a8680 HttpOpenRequestA
0x4a8684 HttpSendRequestA
0x4a8688 HttpQueryInfoA
0x4a868c InternetConnectA
0x4a8690 InternetSetOptionA
0x4a8694 InternetOpenA
0x4a8698 InternetCloseHandle
0x4a869c InternetReadFile
Library comdlg32.dll:
0x4a8730 ChooseColorA
0x4a8734 GetFileTitleA
0x4a8738 GetSaveFileNameA
0x4a873c GetOpenFileNameA

!This program cannot be run in DOS mode.
`.rdata
@.data
uRFGHt
000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF
3E 3E(1E
t(ENEN;
L$$_^]
T$$_^]
D$$_^]
D$0UVW
L$$_^]d
D$4SUV
L$89l$8}
D$(t,;
L$(CH;
D$8SUV
T$$RUS
8\$$tC
T$0RPQ
D$$~9+
F\_^][
L$$_^d
L$@^[d
D$PQRP
L$pPQR
D$hRQP
9L$x~k
L$T_^][d
L$lRVQ
D$hQRP
D$hQRP
T$pPQR
\$8UVW
L$DPQj
\$8UVW
L$DPQj
L$ _^d
W9^du-
L$ PQh
L$L_^][d
L$D_^][d
L$@RUQ
L$|_^][d
L$|_^][d
L$|_^][d
T$0VRPSQ
L$4_^[d
V#D$,WPQ
D$@UPQ
T$XUSR
T$HQRP
L$x_^d
D$(SUV
T$8RWj
L$ _^][d
l$<VWj
L$(VQVj
L$(UUh
t$LUPh
o0SSSSU
D$dSUVW
D$@WPS
L$`_^][d
D$,RVh
L$TQVSh8
|$XSSW
T$TQRPh
D$`QRP
D$hSUV3
D$,Pj<j
L$h_^][d
L$X_^d
t$ 90t
T$LRUj
D$89Vdu
FpHt&Ht
D$LUSWP
L$$_^][d
L$,_[3
L$,_[3
L$(WQR
QQUWSS
L$P_]^[d
T$hQRWW
t]9|$<tW
L$x_^]
L$<SQR
T$<RVW
9|$8tt
T$<WRh
T$lPRh
T$ SRh
9l$xtU9
u29l$xu,
L$XSQh
D$,SPh
T$,SRh
T$,SRh
T$,SRh
t$(SSh
t$$RVP
|$,RPQ
L$H][d
L$HSUVWP
D$XPQU
D$8VPQ
T$ SWRP
L$L_^]3
t%RSQP
XY[Z[]
~'PSQR
\$<VW3
L$4_^3
D$XQRWP
D$dQUWRP
D$0WPQ
T$$+D$4
L$L^[d
D$4h4L
D$dh L
9^xu5j
L$X_^]3
h9n`u;
D$8RPj
T$DQRU
D$PRPQ
L$TSWQ
T$DhHR
l$HQRVU
D$H_^][
\$lUV3
L$h_^]3
T$\jdSR
L$Hj&Q
;t$Xu";\$\u
L$DSVQ
L$,_^]3
L$$_^][d
L$0PQS
L$ ]_^
L$ QSR
D$TVPW
D$TRPW
WWVQRWWS
D$$QRP
T$,PQR
D$$RSSP
D$8WVRPQ
L$XRQP
l$@VW3
L$8_^][d
u"8D$yu
D$(_^][
8MThdu
~P9~Pun
t&9^$t
F(9V8tQ
F<_^][
F<_^][
|$@ Wu
|$D UV
L$8^]_3
@;l$\~Z
L$X;L$
uh9^8uX
F89^8u&j
L$T_^][d
L$L_^][d
D$,;\$|
L$0PQR
PQj WUS
T$dPQR
L$l_^][d
L$8WPQR
T$DQSR
D$49D$$}
T$\;D$Xu
L$(PQR
T$,RQP
T$(PQR
L$x_^][d
L$l_^][d
L$TPQR
L$dPQRV
u+\$l
L$4SUV
L$4WPQR
D$ |2;
L$@_^][d
u._^][
L$ WPQ
T$,RQP
L$\_^][d
L$@RQj
D$@RPQj
L$T_^]d
FD uy9D$$}s
FD@ul9L$(}f
L$P_^d
L$\_^][d
;D$xt&
9D$$t+
L$D_]d
L$ ^][d
D$$QUP
L$|_^][d
L$$hDT
L$t][d
D$$SUV
D$DURP
RVPUSQ
L$$_^][d
j VUPWQ
T$(QVURWP
L$,_^][d
D$$_^[
D$$_^[
L$4VQUP
L$$_^][d
L$4UQWP
L$$_^][d
T$0SUV
L$(_^][d
T$8QRP
L$(_^][d
L$8_^][d
|$LtE;
t$PPVS
L$8_^][d
T$\WVR
jBWVSSQ
D$(_^]
\$ PQV
L$$_^][d
L$H_^][d
SWVVVRPV
L$$^]d
L$D_^[d
D$(hd`
D$ hH`
T$,hD`
T$(QhD`
T$(QhD`
T$(QhD`
L$,hD`
T$,hD`
T$DWRh
D$,QRPS
L$$RPQS
L$<_^][d
L$(RPQ
NTRPQj
L$(RPQ
T$(PQR
D$(QRP
T$DPQRW
L$<RPQW
L$T_^]
Nh;NX|
Vh;VX|
Fxt_;FTu@
Nh;NX|
P$RWPh
L$$h b
D$0QVRP
L$$PVh
D$4RPQ
D$ PQR
=pscat
=YARGtD= BGRt
h BGRUPV
hYARGUQV
=lcmnw_tQ=tsbat-=knilt
=rtnmto
hknilUPV
htsbaUQV
=rtrpt =rncst
=capst
= baLt = ZYXt
^tt!h4h
TADIut
tkPUSV
ETLPuF
D$8QVRPU
QRVWPU
D$$SPh
3;L$4s
T$8QRU
T$Xhlm
D$XhHm
L$Xh`[
T$Xh m
T$,SRW
T$0;t$
PPPQSG
D$ EJ;
D$4SUVW
L$$QWV
D$,Hx;@
D$(CM;
D$Hvm3
L$Lvj3
D$(FO;
L$t_^d
D$ RPUhD
L$l_^][d
L$$^[d
L$(WSR
T$0PQR
WjdjdPQh
|z;^<}uWS
L$D_^][d
L$\_^][d
It#Iu%
^l_^][
tI;Ftr
tL9~HvG;
~(9~$u
D/ VPS
L$<RWUQV
L$$j QV
L$(VQU
hPCCiU
L$(RPVQWU
l$,WuAS
|$ VurU
D$@QRPU
T$ PQW
Ht&HtcI
D$(SUW
=TADIt
TADIu"
hTADIV
Ht]Ht2Ht
HtfHt;Ht
t$,u%:D$<u
:L$<t;
\$$u9f;
\$@QUR
;=3333v
HtHHuz
V,_^[Y
D$ _^][
EHPWVS
u]9B uX
uR9BxuM
'9A`u"9
tq9~Dt
nd9~dt
tS9~@uN
T$LPQR
|$HPWS
L$(RPQ
T$DPVS
T$LRWS
Fdf+Fh
D$(8D*
tRHt}H
NH_^][
T$LWUQVR
L$4WQUVS
;l$ }:
|$$}$WP
\$\}-j
O(_^][
T$H} VP
T$$PRV
D$(QPW
L$,SUV
L$0SUV@W
NX9NXu
QPSWVR
T$PQRP
D$$SUV
D$(;l$
\$(UVW
D$,_^]
D$(CUSWP
9o4u'V
9t$0v8
T$,RWV
T$,RWV
T$,RWV
L$,QWV
T$,RWV
L$ RUPj
9t$Tu
T+3x%A
;D$<s!
T$,PQh
|$ WUSV
D$$SUV
L$(SUV
N4_^]3
BRPj+S
@PVj,S
\$4t|Ht@H
T$ QRP
F$@;F(v
F$@@;F(v
QQSVWj
QQSVWd
t.;t$$t(
B 02CV
C =02CVu
VC20XC00U
PPPPPPPP
^}%95P
uRFGHt
YHYtLHt9
tn<%t2
HHtiHtGH
HtHHt(
HtOHt)H
HtHt&Ht
8t9UW
SS@SSPVSS
t#SSUP
t$$VSS
_^][YY
t/WWUPj
QQSVW3
sO;>|C;~
"WWSh8
HHtpHHtl
tFGQPS
HSVHWtgHHtF
<]t_G<-uA
PPPPPPPP
PPPPPPPP
QQSVWj
>:uNFV
>:u#FV
t+Ht$Ht
HtHHt
+ttHHtd
nt2Ht#Ht
F\jLSP
u$SShe
Wj(_Wj
hWj@_;
PQQQQQ
PPPPhd
tvWWWWU
F,_^][
(wqt\HHtS
t>Ht Ht
QSUVWj
n0SSSSU
_SSSSU
Ph_^][Y
tD9_Pt?
Ht#HHt
@t4Ht1Ht_Ht
^$_^[]
F(_+F$^[;E
<A|2<Z
<A|@<Z
+tJHt:Ht*
P<PuWSV
VWtp9E
HtTHtFHt8Ht*Ht
PWVWWW
SVWh+0J
9^0u/j
F09^4u*j
F49^8u&j
^,_^][
kernel32
wininet.dll
wininet.dll
wininet.dll
wininet.dll
wininet.dll
wininet.dll
wininet.dll
wininet.dll
user32
user32
user32.dll
user32
user32.dll
kernel32
kernel32.dll
advapi32.dll
advapi32.dll
advapi32.dll
kernel32.dll
ntdll.dll
KERNEL32.DLL
kernel32.dll
Kernel32.dll
Kernel32.dll
psapi.dll
kernel32.dll
ntdll.dll
ntdll.dll
ntdll.dll
NTDLL.DLL
ntdll.dll
kernel32
kernel32.dll
user32
user32.dll
user32.dll
kernel32.dll
kernel32
kernel32
kernel32.dll
kernel32.dll
kernel32.dll
kernel32.dll
kernel32.dll
ntdll.dll
ntdll.dll
ntdll.dll
kernel32.dll
kernel32.dll
kernel32.dll
kernel32
wsock32.dll
wsock32.dll
wsock32.dll
wsock32.dll
wsock32.dll
wsock32.dll
wsock32.dll
wsock32.dll
wsock32.dll
wsock32.dll
wsock32.dll
wsock32.dll
wsock32.dll
wsock32.dll
wsock32.dll
wsock32.dll
wsock32.dll
wsock32.dll
wsock32.dll
wsock32.dll
wsock32.dll
wsock32.dll
wsock32.dll
wsock32.dll
KERNEL32.DLL
kernel32.dll
KERNEL32.DLL
Kernel32
kernel32.dll
user32.dll
user32.dll
user32.dll
kernel32.dll
user32.dll
user32
Kernel32.dll
kernel32.dll
kernel32.dll
wsock32.dll
wsock32.dll
CreateWaitableTimerA
SetWaitableTimer
MsgWaitForMultipleObjects
CloseHandle
CreateToolhelp32Snapshot
Process32First
Process32Next
InternetOpenA
InternetCloseHandle
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
HttpSendRequestA
InternetReadFile
HttpQueryInfoA
CreateWaitableTimerA
SetWaitableTimer
MsgWaitForMultipleObjects
CloseHandle
FindWindowExA
IsWindow
IsWindowVisible
GetWindowThreadProcessId
GetWindowTextLengthA
GetWindowTextA
GetClassNameA
GetCurrentProcessId
OpenProcess
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
CloseHandle
RtlAdjustPrivilege
CreateToolhelp32Snapshot
Module32First
Module32Next
wvsprintfA
ReadProcessMemory
ExitProcess
ReadProcessMemory
OpenProcess
GetProcessImageFileNameA
CloseHandle
ZwOpenProcess
ZwQuerySystemInformation
lstrcpyn
RtlMoveMemory
RtlMoveMemory
ZwDuplicateObject
ZwQueryInformationProcess
ZwClose
GetLogicalDriveStringsA
QueryDosDeviceA
PeekMessageA
TranslateMessage
DispatchMessageA
GetVersionExA
GetModuleHandleA
GetProcAddress
GetCurrentProcess
IsWow64Process
CopyFileA
VirtualAllocEx
WideCharToMultiByte
GetSystemDirectoryA
RtlMoveMemory
RtlMoveMemory
RtlMoveMemory
VirtualFreeEx
GetLogicalDriveStringsA
QueryDosDeviceA
WideCharToMultiByte
GetShortPathNameA
socket
inet_addr
WSASetLastError
gethostbyname
connect
select
WSAFDIsSet
closesocket
lstrcpyn
select
listen
accept
sendto
recvfrom
inet_ntoa
getsockname
getpeername
setsockopt
WSAGetLastError
lstrcpyn
CreateToolhelp32Snapshot
Process32First
Process32Next
CloseHandle
lstrcpyn
lstrcpynA
RtlMoveMemory
RtlMoveMemory
RtlMoveMemory
RtlMoveMemory
VirtualAlloc
RtlMoveMemory
RtlMoveMemory
RtlMoveMemory
RtlMoveMemory
LoadLibraryA
RtlMoveMemory
GetProcAddress
VirtualFree
RtlMoveMemory
GetCurrentProcessId
EnumWindows
GetWindowThreadProcessId
GetAncestor
WriteProcessMemory
RtlMoveMemory
SetWindowLongA
RegisterWindowMessageA
CallWindowProcA
ReadProcessMemory
LoadLibraryExA
FreeLibrary
WSAStartup
WSACleanup
d09f2340818511d396f6aaf844c7e325
5F99C1642A2F4e03850721B4F5D7C3F8
F7FC1AE45C5C4758AF03EF19F18A395D
A512548E76954B6E92C21055517615B0
707ca37322474f6ca841f0e224f4b620
DA19AC3ADD2F4121AAD84AC5FBCAFC71
window
917.933.18.928
100000
000001
svchoss.exe
C:\Windows\svchoss.exe
http://139.155.30.140/mm.txt
http://
HTTP/1.1
Host:
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)
Range: bytes=
Pragma: no-cache
Cache-Control: no-cache
Connection: close
Cookie:
Accept-Language: zh-cn
Connection: Keep-Alive
HTTP/1.1 20
Content-Length:
@QQ.exe
TIM.exe
/u/k.php
&wangming=qq
^@POST
User-Agent:
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 2Pac; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
HTTP/1.1
Referer:
Referer:
Referer:
Accept:
Accept: */*
Accept-Language:
Accept-Language: zh-cn
Content-Type:
Content-Type: application/x-www-form-urlencoded
Cookie:
Location:
Set-Cookie
Set-Cookie:
https://
=deleted
Steam.exe
SteamLogin
/jm/jiemi1.txt
steamui.dll
/jm/jiemi2.txt
SeDebugPrivilege
0123456789ABCDEF
steam.exe
&ssn2=
&ssn2name=
&ssn1=
&ssn1name=
&steamguid=
&steamuid=
&steampwd=
steamname=
/n/getfile1.php
\Device\HarddiskVolume3
\Device\HarddiskVolume2
\Device\HarddiskVolume4
\Device\HarddiskVolume1
Software\Valve\Steam\RememberPassword
ntdll.dll
kernel32
IsWow64Process
user32.dll
gdi32.dll
!This program cannot be run in DOS mode.
`.rdata
@.data
QQHelp0
`QQHelp1
`.reloc
@.rsrc
TlsAlloc
s2@w3k
#x28kr
InvalidateRect
,,]|s+p
GlobalFree
GetProfileStringA
CharUpperBuffW
8}=s-m
GetFileType
LCMapStringA
GetActiveWindow
5v\KeI
BitBlt
ReadFile
DeleteCriticalSection
PostMessageA
t{s)$E
VirtualFree
FindNextFileA
QueryServiceConfigW
EnableWindow
UnhookWindowsHookEx
GetWindowTextA
SetStdHandle
RtlUnwind
zypR=:w
53@5}0&
\LxsBK
`LHasZ
Y8yVQwKN|
e!0)mx
wNEZ3C
m~+x9S\
]\`:_\
i1$1O
MaEdo'y9
!n_A-_
F~vj:g
UoG3uB'
J'd1Cr
geUtKA
n{1at?GM
tV.1'eN
Xiu?m$<
PYo.p+
gcV]%t
^`)Op
"tp:*p
5+$5P&g
zKAhKg
]3,;a]]
eB.Z*K
&]k}}'
VNoaj$H
ISi3M
F%=6'QE/i
Tq:Quk
jL]8z]
))J<L^F
SetViewportOrgEx
SetLastError
ClosePrinter
CloseServiceHandle
SetRect
LeaveCriticalSection
LineTo
GetProcAddress
GetStringTypeA
CloseServiceHandle
GetFileAttributesA
SendDlgItemMessageA
MultiByteToWideChar
CreateIconFromResourceEx
GetThreadLocale
?%!mC3
FillRgn
MdgSLL
GetDesktopWindow
GetStringTypeW
lstrcatA
Y*{t<\j
EnumResourceLanguagesA
V/xO|##
IsBadWritePtr
SetScrollPos
,^0L/4X
nJ?#!sx
SetFilePointer
i^5}0&
CreateDialogIndirectParamA
WindowFromPoint
I1q=31
AppendMenuA
CreatePolygonRgn
DestroyWindow
getClientName
getClientSelfUin
getClientkey
getCookiesByClientKey
getCookiesByHttpKey
getFriendChatHwnd
getFriendList
getGroupChatHwnd
getGroupCode
getGroupList2
getGroupMemCount
getGroupMembersAll
getGroupMembersCount
getGroupMembersList
getGroupName
getGroupUin
getGtk
getHttpkey
getLoginCode
getLoginCodeStatus
getLongUin
getOpenChatCount
getP_Skey
getPidByName
getQzonetoken
getSelfRole
getSkey
getUin
getUserinfo
getVersion
isChatMerge
isChatWindow
isFriend
isInGroup
isInGroupCode
isInGroupEx
isInGroupUin
isOnline
openChatWindow
sendCbMsg
setCbMsg
setRegCode
QQHelp.dll
GetSystemTimeAsFileTime
GetModuleFileNameA
midiStreamStop
ReleaseSemaphore
;=cs9'
GrayStringA
EnterCriticalSection
OleRun
GetFileTitleA
L*x8s3o6
D)i5}0&
SetCursor
SetEvent
WINSPOOL.DRV
WinExec
DocumentPropertiesA
LocalAlloc
X/V[cO
\k1AT(%qP
midiOutReset
CreateToolhelp32Snapshot
OpenThread
GetConsoleOutputCP
GetVersionExA
comdlg32.dll
GlobalGetAtomNameA
GetMessagePos
LoadLibraryW
USER32.dll
Fk|3Grqg
ReadFile
L~th}s
HeapReAlloc
GetSystemTime
IsWindow
SelectPalette
LCMapStringW
5v\KeI
B5v\Ke
GetModuleHandleA
oxs3,v
S:Dz3M
GlobalUnlock
lstrcpyA
SetActiveWindow
RoundRect
"eWws0
5 @o7UL
GetTickCount
GetCurrentObject
EnumResourceTypesA
MulDiv
SendMessageA
RectVisible
SetLastError
CloseHandle
ScaleViewportExtEx
WS2_32.dll
v5}0&
LoadImageA
7NmP^F
3O^s-@
IsDialogMessageA
RegisterClipboardFormatA
!~hsgD
EnumServicesStatusExW
SetBkColor
CreateIconFromResource
FreeLibrary
GetEnvironmentStrings
ExtTextOutA
InitializeCriticalSectionAndSpinCount
UnlockFile
GetStringTypeA
GetOEMCP
OpenSCManagerW
RemoveDirectoryA
TranslateMessage
CreateWindowExA
GlobalHandle
FindFirstFileA
BeginPath
lstrcpynA
RedrawWindow
FileTimeToSystemTime
CreateThread
>/5}0&
SystemParametersInfoA
midiStreamRestart
SetWindowsHookExA
GetCPInfo
E%Col:
ScreenToClient
DuplicateHandle
FreeLibrary
EnumResourceNamesW
DrawIconEx
GetNextDlgTabItem
ExtSelectClipRgn
RegOpenKeyExA
TabbedTextOutA
LN:7\3o
ReleaseDC
GetForegroundWindow
3hs]aG1
Elqs3l
+*Q.Qz
vvtyM+
7l'2N!
q(NN1;i
epc+N|
j\pq.g
^7(5|
uy'I|2
5YK lc
mvAC)"
&Vp%ydk
DFe4W \
jp9F07
Z7rn_kN
5U<8ke
@A".y4_2%v
[cQD_J
&7FH2eE
X`V-(+k
h:D AO
[/M<'wt
.c3H)
URe.8P
xo}nOe
Gz~Zv2tC
4:E.bhM
se,z!L
eY%x@28
De /T=u
>B7|y5
}^$O5<
T_p3[M
iD(;Hl
%dz5j^NP
'RnV|M
40o0-F
39vyb"
&w[xoE
v$R]N,
kv\r^c
nKa4d*
Y[Ef:=
JOP\]~
.R.aMY
Y82yA;
/+c7f};h`;
}[EG,?
F`|hk:mm
{Jm9lg
,Z9dWNu
OXx`C5vP
xF$oJN
1j0a3I
g{+j]h
^?aV>(
=Wo7F17\
K%.KYL
@X>e2BB
'l 8[\o
U(,~5K
Be:<pg
4^X{1]-
IGC$9|
Fj{9Qq=
%>s@'>4
y"$z7C
,0Z^s
O?B"m<ba
*y3&]`
o'SC`m
P?chx9%5
3Rw>wM
;Ao%y^
ZW{|"VV
LH6=f
)6o.Mg
$;h_J'
~lex4lc?
WZcc*`=Q
I}Yk2ixA
etzAQ9
`h/UHp
k`g_rA
oG$t*S
1ppOJl&
^GG,v8
`woo@)Esy7;{,Z
gN`!N^w
:\I;[@kzS
n*vyu{
9lF.5R
E4\7P2{
rBxIxh
ik'u@;
f8;,! (S
+$8s'S
Y%/PaJw2(r
j'P0Gx
*UMZ2(J`
q(YCiO
kVMD^?
F?9aC-
OR3Ms8
;;E@MD
KIheS]^v
jF{HX4A)
V!e$j7!
(FV(g&
/x^g:e
F~{+>x
B'd#7U
$&dCH`
y3W~D%~
&o21zP
VFnp4d
TmRnk?
ITNrSx
o9V2"i
JH;MjY
Az>,GW
PUN*2=
uD|oMdlB
5%0{Hph
J~^es
n@LsMx
RcZG^_
1DI)}eq
X'IB,T
=0mMlM
jcJxOa
\H$pD^
xR|3=h
bSO'AjP
OB"6WT
+d;'c*
fC~}z-
ze[LQy
Jyx.w|
{2:#7f
6=V|}O
DJ51,y
blR";meO
$M4@/R
p{q+/"8%
'/t,g0Z=
}j_7IRw
9!b(R}#
~8%8yzX
AOt2%as
dc-~l
4!$Ax1^
^x]5Nh
A|t"G7
T*_EM=
@Q7DF[
x8N(-/
SQZ8*(
b:$8IT&
x71$vs
e+Dp'H
I;o):v
db*ra\M
A.LO+=E~BuC9
.F9^z$
VDTh>G
iB]`nj
>n'QXi
IP?f/,VB
pHJq]\$
vNu5Ae
wHa_.2
L9Vz T
_i{Ttl
&|-!%|
2`G %yW;
*d s:
%$?0#(1
Y}^;EV
6B`dd(
*ao5^]
Lqq*g[
tywbiI
S*fdbI
ev6hI!d
tZm)>+
gyPH#3
NOqUi2
SCyosR
_q .hw?s
8QP/Sl
5!>VHS
F!>,'h}
/$.z QY]
6x9E_9
VZmf#
e#QX=B`
7-&xiDk
D=o5.ws
U%e,NC
TJ':Oj
4<K9#;|
/VFRNZ
K2I^6@
iqAd~>I-DJ
XK< rp
&A@Nh4
tfv["xv
W)LT}0cnm
XFeYA)86
TE'8wg
cY8|/&d
[4Kp.}
%s fuo/A
't*A8k
@,[<~cc
u7$K;D
)uIN92@
O~<hIK
HL+iIa
Fp "-V
;4OEK%
Vsh6Kp
_((1;D
-EbdG[
WP'vNz
cu+#8w
vW{p=ll
D??6:>
?:V=`3
DW#lGm
fOU)E$
?q,E&#
hrqx_n'Z
o/F<8M
s(l6jT
d><0Tt
*WVDs*
9T4t'E
t:^|'_e
I'JV!^NU
Ga.4rb~
i%IW<o
o<&,t
7&Y!x|
L@k7qr
&6fjzJ
/RXD$
3c4F47X
wOxpqCJ<
U# esu'+
V!(/^2
3=\"/
PB=Duu}
.fVM=$
xZ[y?}
XdQ;}}
>b\l?4
g5{eZ/z_
}9czDRp
I&T)%F
kDSP$,4`
qQ!c s
Cg#On'
?LCSvQ
~:7v_l
40(i.:
;)<H_z
$j(~NW
jGA1/y
r#W6R*
t{GYfq(
bY$!+^
vB0&yV
Q\p95[1Lq
>1UNX|
=f GxBt
gn<:LT
K<rqjdj
[_G,wB
oPVLio
=:[)!Fc
M~w7%y
g\$x%1
tGdI1l
D!lxcX
DY43_f
u5}/3R)
-@Cq8@
j#nmO)
qgRIT>
og)>[Op
4QJIdre
d\w2eHR
/ngizuE
jDA2tl
ECQ*?`
;xtXz
$wK,FW
Uy>%'B
E8jH2+
[k'@XyrmA
HjYQsi
r&2}Yv
Dd}#D@ad
_V5=OHB^r
nZ2@4#
TtJ^k|
}+WHi:D
4XG!:6SX
/wfSD~_9
HRU#xz
xtaGg
A8{pLV
+Dj BB
e3:[ZM
j~'<8&
|1?*AFC
`7G5IZ
Y9*i.B
c3Dc&(
|(eo#&"
><!vc^
./FA&Ll0
KC].h+
UdCqTi
eEH?DV
j5to2Y
sCM:MY
H3t(Um
~K'cC^
CP/Rk`A
_D%LaSW
;X~q'F+D
cIMUHbc
$Q@(;a
f4breh1F
=wkuSp
s^z::fKb
7kDgT,
+26nxz
>||m#V
{t*4yZ8l
#y@&Z
^3/PGy}t
RR^t29^n
DH8i~X
5SXb0Qz#=
h?yy$hO
Iii5x
e~3{yx
R`^Mg,
]nGG@
KoTc}G
z$5 qv
eFX(xE
TQZmea"i
e`zsn:
983G[f
;R?Ghb
*& AeOc6
z0O(7K{
yo {>T
/YGP6TO
*~0M|A
I~:Q8-
/68uPl
23Zttm9
p%fG`O<
1/b"tm7|
$.YU(R
k8i<-!4*
$}2hMj
aH$Sdey<
@8?A(Q5U
~+:$`[
{y_g.0
k}Q,4Y
MeJe}).
sX46C
xe{RV$
W;h_dt
=; +{a
:Tl$2J&
Vz_q$
<?Lh+3
I%N1~
N(`.@~
dIq*^`
:%-B/
CI)(/I}
2+rBpxo0
<#+;tVok
hdaM6rbe
-S6g6NI
"2-ZtVw
})kkkM
wBVQ,0
-^e-+^
E Fv?-
Zt_I?bK7Olj=
7q<4$|^
.e#gT8
^$y=Rz
wP1E,u
z|?Dt
IYL2Y5
;[lG2P!
S(iwM;
\R(=xv
<a>~l8
l+bwhv
z\Fc{*%
Eu@_`d
NNREtv
y[r\EIi
/DZ7[;
-:ps66<X
_LS~9q
@4T-_$
u-lp)Y
B[T9vya
'P(X5&
r#2SPB
u$EDJ%
v% D!PcV
?cJuIzk
g4u+F:
#4eS{`
1rcg2*
1*0\!]
weo 2w
nB>T}S
RdT3UZ
PT#NT4
<37+g`
!FvCSS
0K4d!;
H_gA\H
!;bSJ
n\c%F3h
\GZpkQ
+c#*wA
iG$T2
e},IvmI
,:mTQ*
K@#Hu$
1nn.B|
/I64g:
kXnda(
R)$Zj+
gHjs<3
~G%D1a.
6~n*i?^/i
[{z)QG
)vbm|\
>JCHtrQ3
+KZ">b
T=>J6X
$M`Mi=
CJ*d.g4
`j8v(f
=u`4o{
+L4hCN[
$F*YM4S<Qq^$,
FNnD[(
QzN38Y
7>&#sNe
lax %!
%'wM+D
lBV_/T
$WjUlV
rAV5d{;
CyV*oO
Q/mVfR
tc3xX
_LU)d
0wR~u*
F-=ZR3
S\Xi )
)!/Ec.]p
|b'39y
F!\%>/
~c"hJ<
OUl4pn
a\&yV2
cXR-P9
;Wn]Os
ZyNz+4
B,FDyD
H/rglX)u
vrrK^:
2$go@b
Vusj-W
R_"##M
-2rJCY
?6J^=7
]ryB]}W
oy1.T&4
<p<Yy}
^y}MTF
'D<Hy]y
:K &jB
|:(-;!
v~7Z1_
0HH:a[$G(
/`jUbI|B
H`rw#M
;B}fKq
@='CK}
W97z`{:8Z
GuRSSj
?$:{\1
=)@6y_
x)E3#.b|S
phdu<u]
u0E0VWv
<3l!We
gKJL_G
-~#38G
4C^k9X
{wcI*K
<fa!0hu
(= w e
p2}0Mlq
_fJdR|
3d9LFA
PqA|~w
@5@_jq
60*)m8
1(U\k
M>/5Y'Md
*g("[h
F{:HW7@k
e+*AX+
)YKft&[Z
G8e%_3
2sTo|Gg
s3E<`
I:7T{}
_mFPo d
0Tkxr~q
F`C|']
'pXo{qy
]+#gZs'
)ZP5M$
vj^MYv
rAvmo1
'x*>1>
8t%x*R
4E`r5@s
N|Pq*,_
*:(]'{
Hrf9;I
g9X~5/
@vy(Y7
37Gf>n
5;K&eL
cnkP9|
F \[yvg
*] n@|5j)
AD+}`
nZ~JW@o[J
4)M\H_=S
::e_zAX
yQU2|"Q
?06)TM
vy_|VY
I*09q/]
g=/"{?
C.dpEU
H5.]_r
C;L&9#
}&dC.F
aNA0MYt
G-uS7!
`lb;(o[
kXtt&\
qBu?2jg
P;pjY!
FD#]]Za
`,k10P
zVCZYq
G-[ D6%K
}zR.%!e
C*t0Wd
qNjl[?
>1sy
7 Dacr
vX/|1Sp
#+mxiA
^j8=M)W
>s5}0&
SetPropA
Ut3vBF
FindResourceA
GetSystemInfo
KillTimer
waveOutGetNumDevs
RegCloseKey
MessageBoxW
PtInRect
gOsbgd
!`xsa5
DestroyIcon
OpenClipboard
GetStockObject
bb5}0&
3rct4@
IsValidCodePage
ReleaseCapture
l 5}0&
[/Xy)#(
WoMc0!
GetCapture
EnumResourceNamesA
EqualRect
::*:_:
?6?\?g?
0 0X0c0
7,797q7
7-8A8w8
9<9Q9\9v9
=2>G>R>
?8?M?X?
3(3<3a3
4"474B4{4
8H9S9c9
:K:V:f:
>3?e?z?
0/1:1{1
6$6J6U6}6
8&919!:C:N:h:
:J;U;o;{;
3D4N4h4
5,6A6L6p6
6D7Y7d7
9-:8:q:
?1?Y?d?
3Q3d3o3
7(7H7S7
0<0A0G0a0t0y0
3-33383O3U3o3
4(4;4A4
5>6J629
7E7Z7e7
7-848>8H8R8\8f8p8z8
929F9m9
</<I<d<
<)=>=I=d=
0#0?0g0r0
2V2b2v2
3V4-5A5N5b5
6*6?6^6r6
7 858@8
=4=\=g=
>7>_>j>
?&?1?d?y?
1i1,282M2X2
3)343\3g3
4X4c42;
4)444N4h4s4
6!6<6G6n6z6
7#737n7
<4<H<S<
<5=N=b=m=
=O>h>|>
1,1@1K1
1,2B2V2a2
2B3X3l3w3
6*6>6I6
637L7`7k7
8T: ;N<+>
>/?5?G?Q?\?f?q?{?
0#0.080C0M0G1j1
2-3N3l3
6'6J6V6k6
7/8S8N;$<K<s=
>1>=>n>z>
$0@0_0
4,575Q5
5r6}687
;+<Y<==w=~=
='>A>q>
?+?J?Z?b?j?r?z?
2.292S2
3J3_3j3
5^5s5~5
5 656@6
7<8F8v8
:#;/;D;O;
>;?P?[?y?
0-0U0`0
313Z3o3
4$484X4l4
565J5f5
868V8b8v8
94:b:m:
;o<z<J=o=
3>4X4y4
5$5g5r5o6z6
6A7L7f7
2B3M3w3
2;2F2:5V5u5[8w8
9-989Y9q9
:4:>:x:
576A6v6
>%>O>Z>
>r>w>Q?l?
334A4g4u4
<.<A<T<g<z<
=4=@=V=u=
> ?-?C?v?
0+080N0
2E2O2Y2
2"3/3E3
5+585N5
556G6j6w6
9-9:9P9
:$:4:l:v:
;<;I;_;
=\>l>t>|>
0-050=0p0}0
0#101F1
2:2G2]2
3#4-4P4]4s4
5G5Q5t5
6<6I6_6
7!8.8D8
9'929l9x9
:I;o;|;
2&3`3g3q3{3
404N4l4
6&6`6h6p6z6
>)?D?O?
0+0<0O0
2)2<2D2L2
313;3k3u34|4
5B5W5b5
5*616;6E6O6Y6c6m6w6
7/7C7j7~7
:,:F:a:
:&;;;F;a;
<^<s<~<
> ><>d>o>
0S0_0s0
1S2*3>3K3_3
3'4<4[4o4
;1;Y;d;
<4<\<g<
=#=.=a=v=
545>5f5z5
D0\0{0
2F3Q3a3
8%80888@8H8P8X8`8h8!9
3b3m3}3
45[5f5
2-23c3
6797L7
1'1<2V2i2
6$697S7f7
9&999&:9:&;9;N<h<{<
0+0@1Z1y1
2%2J3d3
4/4T5n5
6#696^7x7
8-8C8h9
92:Q:k:
011K1^1
3U3h3e4
576B6~6
7$8a8l8
9+9]9h9#:`:
<F=`=s=
1#182R2e2
3'4A4T4
5K6^6s7
:U;a;g;
=,>D>^>x>
+070=0W0c0i0
0B1Z1t1
343N3a3
5-595?5m5
606J6]6
2,3n3y3
475B5U5
6$6C7l7
>!?,?Y?
3 3:3Y4
5$6f6q6
==>3?I?
3D5O5M7Y7
<!<`<k<
=(=K=^=
263l3.8W8|8
9=9S9}9
=*=L=o=
=>>R>}>
?&?1?K?
060L0n0
2$2[2q2
4A5M5`5k5
56+6>6I6
7'7l7x7
8J8V8i8t8
:/:C:e:
:C;Y;};
<?=U=r=
8 868d8p8
97:M:r:
0!0+050?0I0S0]0g0q0{0
414A4Q4V4q4v4
5$5>5X5r5
<&<3<B<$=(=,=0=4=
8 9g9x9~9
0<0@0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0
415@5L5v5
7"7:7A7h7s7
9g9q9v9
:&:+:@:
:!;+;0;:;
7O8V8o8
;D;S;m;
;(<I<y<
;,<I<c<
1/1@1V1s1
;,<0<4<8<<<@<D<H<s<
5$5O5D7
9#9<9i9~9
323:3Q3i3r3
2=3#5<5
<"<'<,<3<;<@<E<K<R<Z<_<d<i<n<s<y<
="=)=2=8=I=d=
4X5`5y5
88&8,81868<8C8I8N8S8X8_8d8i8o8v8|8
9 9'9-92979<9C9J9P9U9Z9_9f9m9t9{9
: :%:*:/:6:<:A:F:K:R:X:]:b:g:n:t:y:~:
;!;&;+;2;9;?;
<=&=-=
5,6Y6a6
9&9@9E9f9k9
7!8O9i9
:s;7<B<a<u<
=1>c>h>m>
?(?;?N?a?t?
232M2o2
333R3f3l3}3
3Q4g4}4
415G5]5s5
1M1S1Y1_1
4 4$4(4,4044484<4@4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|4
8-979I94:l:
:K;&=m=
4Q5f5y5
6'616<6B6L6]6
6"7&7+7E7
;E<M<f<
<#=U=v=
>">->4>
1+262T2t2
2]3d3p3
5*5D5m5
:j:q:y:
>)?@?W?
0"1(1q1
3&4L4`4j4
7074787<7@7D7H7L7P7T7X7\7
9I:c:*;
? ?$?(?,?0?4?8?<?@?D?H?L?P?T?X?\?
:Q;"<)<9<
?,?0?4?8?<?@?D?
2E6K6t6
7(797W7
70J0]0
151:1j1s1
1%2c2|2
2#3D3P3
3+4>4Q4
7C8N8}8
8:9F9k9
> >Q>Y>
>D?H?L?P?c?
4%4G4e4$5B5
0 0$0(0,0004080<0
4>5L5j5v5
6B6N6z6
:=:H:t:
;3;G;l;
;R<c<l=s=
112R2x2
6#646Z6m6
<8=\=u=
:":3:o:
6I6_6d6h6l6p6t6x6|6
1I2,3f3r3
616_6m6
7C8G9L93:P:
;N;_;w;
<\=c=i=
0$0G0l0
2$353f3
4'595s5~5
9'9@9Q9^9
5 5$5(5
778F8 9k9
0)0C0\0
4>5P5Y5h5{5
6A6k7q7
<?<S<l<
<Y=6>L>f>
;A;Q;t;
1H1L1P1T1X1\1`1d1v1;2
0'1E1h1
1"2p:}:d;
G0a0l0
0 ;';9;d;
33#3'3+3/333
i0S597
7`8f8t8
;c<B?b?s?
>(>0>C>Y>
191T1)2=2i2
:C:U:h:
3&4;4F4w4
;";-;^;
1:1J1o1
4E5r5x5
6@7Q7o7
7X9i9U:g:x:
1W1t1x1|1
2 2$2(2Y2$3:4'5;5B5|7
:H;\;(<
090@0i0y1
:-:7:`:v:
;9<U<w<
<O=\=h=t=
:0#1I1z1
5 5$5(5,5054585
8 8$8(8,808
4A5V5~5
6#737o7
8'828;8e8t8
:':,:?:K:X:u:
>8>A>v>~>
?+?F?V?
213I3a3y3
4!494Q4i4
5)5A5k5
5!999^9
; ;*;/;T;
<c<y<>=E=]=
0$0`0f0l0x0
22E2k2M3w3
5$5J5Q5
6#676g6p6}6
7)7;7i7r7
=e=u=}=
3G4O4o4{4
6$676=6
9$9A9f9
;E;L;`;
=/>6>_>f>
4080<0@0
0+060B0T0g0
1"1:1O1[1d1
2:2e2v2
5+5R5c5}5
7I7P7b7
8 8*8R8X8c8
9)9B9Y9
<*<8<E<c<n<
>%>C>h>x>~>
?G?U?h?
<5<Q<b<o<
%0F0p1
253T3l3
4 5.5<5B5
052\2^3
3a819;9F9Q9\9g9r9}9
4-474i4
=0=?=H=W=i=
?3?N?i?
0G0a0|0
1$2(2,2024282<2|2
2I3W3g3
4#414A4
4 41666<6
8-8>8P8
;-;D;H;L;P;
=/=7=n=
>-?8?c?k?
1X1\1`1d1h1l1p1t1*3
3h4l4p4t4x4
4f6H8L8P8T8
010J0h0
7+787L7X7e7r7
8 8$8(8,8084888<8@8D8H8L8P8T8X8\8`8d8h8l8p8t8x8|8
;6<Q<#>
4,4044484<4@4D4H4
6D7;8H8y8
:,:S:l:,;C;x;
|0:1A1i1{1
3*3c3z3
3E4S4{4
6%747M7#:
4?5l506k6
7#757r7y7
838i8}8
9'9c9|9
7Y7_7d7n7s7
:3;l;<<\<w<
3 3$3(3,3034383<3
5(6`6l6
;D<\<p<
=-=K=j=
=3>Z>}>X?
0,1M1k1
2K5e5"6S6u6
252S2v2
3V4h4J5
6L6^6w7
454C5I5o5u5
T?X?\?`?d?h?l?p?t?x?|?
<1d2h2l2p2t2x2|2
|0h3o3v3}3
04181<1@1D1
Y0g0m1{1
3C5L5Y5b5
2(2P2c2s2
8C8R8t8
?#?<?e?{?
0O4q4x4
Antivirus Signature
Bkav W32.AIDetect.malware2
Lionic Trojan.Multi.Generic.lwj0
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Zusy.384364
FireEye Generic.mg.99d66cd7da25f37b
CAT-QuickHeal Clean
ALYac Gen:Variant.Zusy.384364
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 005246d51 )
BitDefender Gen:Variant.Zusy.384364
K7GW Trojan ( 005246d51 )
Cybereason malicious.76ebdd
BitDefenderTheta Gen:NN.ZexaF.34126.@t0@aKaDhXpb
Cyren W32/Agent.EW.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Packed.FlyStudio.AA potentially unwanted
Baidu Clean
APEX Malicious
Paloalto generic.ml
ClamAV Win.Malware.Vmprotect-6824127-0
Kaspersky UDS:DangerousObject.Multi.Generic
Alibaba Trojan:Win32/MalwareX.d3293459
NANO-Antivirus Trojan.Win32.Wsgame.ixxbtl
ViRobot Clean
Rising Stealer.Agent!1.D531 (CLASSIC)
Ad-Aware Gen:Variant.Zusy.384364
Sophos Generic PUA KH (PUA)
Comodo TrojWare.Win32.Agent.OSCF@5rs7jr
F-Secure Clean
DrWeb Trojan.PWS.Wsgame.53822
Zillya Trojan.Generic.Win32.1476970
TrendMicro TROJ_GEN.R002C0WH121
McAfee-GW-Edition BehavesLike.Win32.Generic.rc
CMC Clean
Emsisoft Gen:Variant.Zusy.384364 (B)
Ikarus Clean
Jiangmin TrojanDropper.Binder.avs
Webroot Clean
Avira PUA/Agent.ML
MAX malware (ai score=81)
Antiy-AVL Trojan/Generic.ASCommon.FA
Kingsoft Win32.Troj.Generic_a.a.(kcloud)
Gridinsoft Malware.Win32.GenericMC.cc
Arcabit Trojan.Zusy.D5DD6C
SUPERAntiSpyware Clean
ZoneAlarm Clean
GData Win32.Trojan.PSE.19Q2126
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.Black.R439979
Acronis suspicious
McAfee GenericRXAA-FA!99D66CD7DA25
TACHYON Clean
VBA32 BScope.Trojan.Downloader
Malwarebytes Trojan.MalPack.FlyStudio
Panda Trj/GdSda.A
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R002C0WH121
Tencent Clean
Yandex Trojan.Agent!Pg9VsjQ8tI4
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/CoinMiner.ELG!tr.pws
AVG Win32:MalwareX-gen [Trj]
Avast Win32:MalwareX-gen [Trj]
CrowdStrike win/malicious_confidence_60% (D)
No IRMA results available.