3dd8b9e95696b98e5450e5c117a7a73f09e9ca2be59caf8f98c68ee64c31edf5

HOSTILE

3dd8b9e95696b98e5450e5c117a7a73f09e9ca2be59caf8f98c68ee64c31edf5 · 92%

AI Known malware with persistence and evasion

Mal-ecule

K(Mc)O₄(PEr₂IDy)H₆(CmDb₂F₂Hf₃Os₇Po₅)Md₃(Bi₃Pa)

Size 208.0 KB download

First seen 15 days ago

Analyzed 14 days ago

Source virussign.com

Also detected by 3 sources

Virus.Hijack Agent DCBC locker: virussign.com_a17ab77f9a93c96a7d6d53b1f360af40.vir:0x25010

Self-copy into Windows system directory: virussign.com_a17ab77f9a93c96a7d6d53b1f360af40.vir:0x25010

Agent DCBC stop-adw marker: virussign.com_a17ab77f9a93c96a7d6d53b1f360af40.vir:0x287f8

virussign.com_a17ab77f9a93c96a7d6d53b1f360af40.vir pe

0xfc0	00000000000000000000000000000000	................
0xfd0	00000000000000000000000000000000	................
0xfe0	00000000000000000000000000000000	................
0xff0	00000000000000000000000000000000	................
0x1000	aac576a8c4a67ec5a67e7490000000c5	..v...~..~t.....
0x1010	a204c170803a84c5a67ea87428000000	...p.:...~.t(...
0x1020	c5a27ec5f2ae61020066666666666666	..~...a..fffffff
0x1030	aac576a8c4a67ec5a67e743d830000c5	..v...~..~t=....
0x1040	f2aee166666666666666666666666666	...fffffffffffff
0x1050	aac576a8c4a67ec5a67e74240c0000c5	..v...~..~t$....
0x1060	f2aee166666666666666666666666666	...fffffffffffff
0x1070	aac576c5a204287441020000c16202ae	..v...(tA....b..
0x1080	61020066666666666666666666666666	a..fffffffffffff
0x1090	aac576a8c4a67ec5a67e74d8ffffffc5	..v...~..~t.....
0x10a0	a204c170803a84c5a67ea87460ffff	...p.:...~.t`..

0x24f90	00000000000000000000000000000000	................
0x24fa0	00000000000000000000000000000000	................
0x24fb0	00000000000000000000000000000000	................
0x24fc0	00000000000000000000000000000000	................
0x24fd0	00000000000000000000000000000000	................
0x24fe0	00000000000000000000000000000000	................
0x24ff0	00000000000000000000000000000000	................
0x25000	30ca020022ca020012ca020000ca0200	0..."...........
0x25010	f0c90200dcc90200cec90200bcc90200	................Self-copy into Windows system directory
0x25020	aec90200000000000cc902001ec90200	................Virus.Hijack Agent DCBC locker
0x25030	32c902003ec9020050c9020090c80200	2...>...P.......
0x25040	f6c80200e2c80200ccc80200b8c80200	................
0x25050	a8c80200fcc70200ecc7020084c80200	................
0x25060	76c802006ac802005ac802004cc80200	v...j...Z...L...
0x25070	40c8020036c8020028c802001ac80200	@...6...(.......
0x25080	0ac802009ec80200000000005cbe0200	............\...
0x25090	68be020078be020092be02009ebe0200	h...x...........
0x250a0	aabe0200babe0200c8be0200dabe0200	................
0x250b0	ecbe0200febe02000abf020018bf0200	................
0x250c0	2abf020036bf02004abf020050be0200	*...6...J...P...
0x250d0	84bf020098bf0200aabf0200babf0200	................
0x250e0	c8bf0200d6bf0200e4bf0200f2bf0200	................
0x250f0	0cc0020024c002003ec0020058c00200	....$...>...X...
0x25100	72c002007cc002008cc002009ec00200	r...\|...........
0x25110	aec00200bec00200cec00200e0c00200	................
0x25120	f2c0020002c1020018c102003ebe0200	............>...
0x25130	2ebe02001abe020008be0200f0bd0200	................
0x25140	e6bd0200cebd0200bebd0200b0bd0200	................
0x25150	a4bd020088bd020078bd020068bd0200	........x...h...
0x25160	50bd020042bd02002abd02001cbd0200	P...B...*.......
0x25170	0ebd0200fcbc0200f0bc0200e6bc0200	................
0x25180	d0bc0200bebc0200b2bc0200a2bc0200	................
0x25190	8abc020074bc020064bc020052bc0200	....t...d...R...
0x251a0	42bc020034bc020024bc020006bc0200	B...4...$.......
0x251b0	f2bb0200dcbb0200c4bb0200aabb0200	................
0x251c0	98bb020088bb020078bb020068bb0200	........x...h...
0x251d0	58bb020046bb020038bb02002cbb0200	X...F...8...,...
0x251e0	1ebb020010bb0200fcba0200eeba0200	................
0x251f0	dcba0200ccba0200b6ba0200a0ba0200	................
0x25200	8aba02007eba020076ba020062ba0200	....~...v...b...
0x25210	50ba020044ba020036ba020020ba0200	P...D...6... ...
0x25220	0cba020004ba0200eeb90200e0b90200	................
0x25230	d4b90200c6b90200bab90200acb90200	................
0x25240	a0b902008eb902007eb9020066bf0200	........~...f...
0x25250	00000000090000800c00008008000080	................
0x25260	000000005eb9020046b9020030b90200	....^...F...0...
0x25270	20b902000000000060ca020050ca0200	.......`...P...
0x25280	0000000096ca020080ca020000000000	................

0x25588	00000000000000000000000000000000	................
0x25598	44656163746976617465416374437478	DeactivateActCtx
0x255a8	00000000416374697661746541637443	....ActivateActC
0x255b8	7478000052656c656173654163744374	tx..ReleaseActCt
0x255c8	78000000437265617465416374437478	x...CreateActCtx
0x255d8	410000004b45524e454c333200000000	A...KERNEL32....
0x255e8	536f6674776172655c4d6963726f736f	Software\MicrosoLocks Explorer network and dialog policies
0x255f8	66745c57696e646f77735c4375727265	ft\Windows\Curre
0x25608	6e7456657273696f6e5c506f6c696369	ntVersion\Polici
0x25618	65735c4578706c6f726572004e6f5275	es\Explorer.NoRu
0x25628	6e0000004e6f44726976657300000000	n...NoDrives....
0x25638	526573747269637452756e004e6f4e65	RestrictRun.NoNe
0x25648	74436f6e6e656374446973636f6e6e65	tConnectDisconne
0x25658	637400004e6f526563656e74446f6373	ct..NoRecentDocs
0x25668	486973746f7279004e6f436c6f736500	History.NoClose.
0x25678	536f6674776172655c4d6963726f736f	Software\Microso
0x25688	66745c57696e646f77735c4375727265	ft\Windows\Curre
0x25698	6e7456657273696f6e5c506f6c696369	ntVersion\Polici
0x256a8	65735c4e6574776f726b00004e6f456e	es\Network..NoEn
0x256b8	746972654e6574776f726b00536f6674	tireNetwork.Soft
0x256c8	776172655c4d6963726f736f66745c57	ware\Microsoft\W
0x256d8	696e646f77735c43757272656e745665	indows\CurrentVe
0x256e8	7273696f6e5c506f6c69636965735c43	rsion\Policies\C
0x256f8	6f6d646c673332004e6f506c61636573	omdlg32.NoPlaces
0x25708	426172004e6f4261636b427574746f6e	Bar.NoBackButton
0x25718	000000004e6f46696c654d7275000000	....NoFileMru...
0x25728	b88c4200051b4000da1d400010134000	..B...@...@...@.
0x25738	c233400002354000dc34400034354000	.3@..5@..4@.45@.
0x25748	9239400092394000e234400061154000	.9@..9@..4@.a.@.
0x25758	3f354000f034400039354000fc344000	?5@..4@.95@..4@.
0x25768	f6344000303540003435400034354000	.4@.05@.45@.45@.
0x25778	34354000fb1d4000331e40007f3c4000	45@...@.3.@..<@.
0x25788	903e4000031a4000723c400007194000	.>@...@.r<@...@.
0x25798	84194000633d40008c3c400084394000	..@.c=@..<@..9@.
0x257a8	be3f4000303540003442400043444000	.?@.05@.4B@.CD@.
0x257b8	20444000791740000e44400031484000	D@.y.@..D@.1H@.
0x257c8	9443400084444000541e4000911e4000	.C@..D@.T.@...@.
0x257d8	ce1e400022234000f61d40004c4f4300	..@."#@...@.LOC.
0x257e8	6e74646c6c2e646c6c00000025780000	ntdll.dll...%x..
0x257f8	436f6e74726f6c2050616e656c5c4465	Control Panel\De
0x25808	736b746f705c5265736f757263654c6f	sktop\ResourceLo
0x25818	63616c65000000004765745379737465	cale....GetSyste
0x25828	6d44656661756c7455494c616e677561	mDefaultUILangua
0x25838	67650000476574557365724465666175	ge..GetUserDefau
0x25848	6c7455494c616e677561676500000000	ltUILanguage....
0x25858	6b65726e656c33322e646c6c00000000	kernel32.dll....
0x25868	25732e646c6c0000736f667477617265	%s.dll..software
0x25878	0000000025640000434469616c6f6700	....%d..CDialog.

0x28690	6f3cd211817b00c04f797ab700000000	o<...{..Oyz.....
0x286a0	4f4c454143432e646c6c000011010000	OLEACC.dll......
0x286b0	0000000046e1000046e1000038000000	....F...F...8...
0x286c0	1b154000000000000000000000000000	..@.............
0x286d0	00000000000000000000000061154000	............a.@.
0x286e0	ac864200496e76616c69642044617465	..B.Invalid Date
0x286f0	54696d6500000000496e76616c696420	Time....Invalid
0x28700	4461746554696d655370616e00000000	DateTimeSpan....
0x28710	433a5c77696e646f77735c2573000000	C:\windows\%s...Self-copy into Windows system directory
0x28720	433a5c77696e646f77735c7379737465	C:\windows\syste
0x28730	6d33325c25730000433a5c77696e646f	m32\%s..C:\windo
0x28740	77735c73797374656d5c257300000000	ws\system\%s....
0x28750	7762000073746172742025730a000000	wb..start %s....
0x28760	64656c2025730a006f70656e00000000	del %s..open....
0x28770	4861204861204841202100005374696c	Ha Ha HA !..Stil
0x28780	6c20747279696e672020210057686174	l trying !.What
0x28790	60732074686520706f696e7420210000	`s the point !..
0x287a0	49606d20736f20636f6f6c203a290000	I`m so cool :)..
0x287b0	59656170202c2069606d206120626164	Yeap , i`m a bad
0x287c0	206d6f74686572206675636b65722021	mother fucker !
0x287d0	000000005c2573005c2573004e745265	....\%s.\%s.NtRe
0x287e0	73756d6550726f63657373006e74646c	sumeProcess.ntdl
0x287f0	6c2e646c6c000000633a5c73746f702d	l.dll...c:\stop-Agent DCBC stop-adw marker
0x28800	6164772e7478740025780000534f4654	adw.txt.%x..SOFT
0x28810	574152455c4d6963726f736f66745c57	WARE\Microsoft\W
0x28820	696e646f77735c43757272656e745665	indows\CurrentVe
0x28830	7273696f6e5c52756e5c0000534f4654	rsion\Run\..SOFT
0x28840	574152455c4d6963726f736f66745c57	WARE\Microsoft\W
0x28850	696e646f77735c43757272656e745665	indows\CurrentVe
0x28860	7273696f6e5c52756e5c000063616c63	rsion\Run\..calc
0x28870	2e657865000000006f70656e00000000	.exe....open....
0x28880	6e6f74657061642e657865006f70656e	notepad.exe.open
0x28890	000000006d737061696e742e65786500	....mspaint.exe.
0x288a0	6f70656e0000000077726974652e6578	open....write.ex
0x288b0	650000006f70656e00000000596f7520	e...open....You
0x288c0	7375636b00000000596f75207265616c	suck....You realAgent DCBC taunt message cluster
0x288d0	79207468696e6b20796f752063616e20	y think you can
0x288e0	657363617065206d650000004d657373	escape me...Mess
0x288f0	2077697468207468652062657374202c	with the best ,
0x28900	20646965206c696b6520746865207265	die like the re
0x28910	737400004920616d20746865206f6e65	st..I am the one
0x28920	20616e64206f6e6c7900000048412048	and only...HA H
0x28930	4120484100000000436f6d606f6e202c	A HA....Com`on ,
0x28940	20746861746073207468652062657374	that`s the best
0x28950	20796f752063616e20646f0049606d20	you can do.I`m
0x28960	76657279206469737361706f696e7465	very dissapointe
0x28970	64207769746820796f75722070657266	d with your perf
0x28980	6f726d61636500004e6f626164792063	ormace..Nobady c

0x3355e	01000100340100000d00000002000100	....4...........
0x3356e	2000400001000100340100000f000000	.@.....4.......
0x3357e	02000100200040000100010034010000	.... .@.....4...
0x3358e	10000000020001002000400001000100	........ .@.....
0x3359e	34010000110000000100010020200000	4........... ..
0x335ae	01001800a80c00000100300334000000	..........0.4...
0x335be	560053005f0056004500520053004900	V.S._.V.E.R.S.I.
0x335ce	4f004e005f0049004e0046004f000000	O.N._.I.N.F.O...
0x335de	0000bd04effe00000100000001000100	................
0x335ee	000000000100010000003f0000000000	..........?.....
0x335fe	00000400000001000000000000000000	................
0x3360e	00000000000090020000010053007400	............S.t.
0x3361e	720069006e006700460069006c006500	r.i.n.g.F.i.l.e.
0x3362e	49006e0066006f0000006c0200000100	I.n.f.o...l.....
0x3363e	30003400300039003000340065003400	0.4.0.9.0.4.e.4.
0x3364e	00004a001500010043006f006d007000	..J.....C.o.m.p.
0x3365e	61006e0079004e0061006d0065000000	a.n.y.N.a.m.e...
0x3366e	000054004f0044004f003a0020003c00	..T.O.D.O.:. .<.
0x3367e	43006f006d00700061006e0079002000	C.o.m.p.a.n.y. .
0x3368e	6e0061006d0065003e00000000005a00	n.a.m.e.>.....Z.
0x3369e	19000100460069006c00650044006500	....F.i.l.e.D.e.
0x336ae	73006300720069007000740069006f00	s.c.r.i.p.t.i.o.
0x336be	6e000000000054004f0044004f003a00	n.....T.O.D.O.:.
0x336ce	20003c00460069006c00650020006400	.<.F.i.l.e. .d.
0x336de	65007300630072006900700074006900	e.s.c.r.i.p.t.i.
0x336ee	6f006e003e0000000000300008000100	o.n.>.....0.....
0x336fe	460069006c0065005600650072007300	F.i.l.e.V.e.r.s.
0x3370e	69006f006e000000000031002e003000	i.o.n.....1...0.
0x3371e	2e0030002e003100000038000c000100	..0...1...8.....
0x3372e	49006e007400650072006e0061006c00	I.n.t.e.r.n.a.l.
0x3373e	4e0061006d0065000000410064007700	N.a.m.e...A.d.w.
0x3374e	54006500730074002e00650078006500	T.e.s.t...e.x.e.
0x3375e	00008400300001004c00650067006100	....0...L.e.g.a.
0x3376e	6c0043006f0070007900720069006700	l.C.o.p.y.r.i.g.
0x3377e	68007400000054004f0044004f003a00	h.t...T.O.D.O.:.
0x3378e	200028006300290020003c0043006f00	.(.c.). .<.C.o.
0x3379e	6d00700061006e00790020006e006100	m.p.a.n.y. .n.a.
0x337ae	6d0065003e002e002000200041006c00	m.e.>... . .A.l.
0x337be	6c002000720069006700680074007300	l. .r.i.g.h.t.s.
0x337ce	20007200650073006500720076006500	.r.e.s.e.r.v.e.
0x337de	64002e00000040000c0001004f007200	d.....@.....O.r.
0x337ee	6900670069006e0061006c0046006900	i.g.i.n.a.l.F.i.
0x337fe	6c0065006e0061006d00650000004100	l.e.n.a.m.e...A.
0x3380e	6400770054006500730074002e006500	d.w.T.e.s.t...e.
0x3381e	7800650000004a001500010050007200	x.e...J.....P.r.
0x3382e	6f0064007500630074004e0061006d00	o.d.u.c.t.N.a.m.
0x3383e	65000000000054004f0044004f003a00	e.....T.O.D.O.:.
0x3384e	20003c00500072006f00640075006300	.<.P.r.o.d.u.c.

Well-known

0x28690	6f3cd211817b00c04f797ab700000000	o<...{..Oyz.....
0x286a0	4f4c454143432e646c6c000011010000	OLEACC.dll......
0x286b0	0000000046e1000046e1000038000000	....F...F...8...
0x286c0	1b154000000000000000000000000000	..@.............
0x286d0	00000000000000000000000061154000	............a.@.
0x286e0	ac864200496e76616c69642044617465	..B.Invalid Date
0x286f0	54696d6500000000496e76616c696420	Time....Invalid
0x28700	4461746554696d655370616e00000000	DateTimeSpan....
0x28710	433a5c77696e646f77735c2573000000	C:\windows\%s...
0x28720	433a5c77696e646f77735c7379737465	C:\windows\syste
0x28730	6d33325c25730000433a5c77696e646f	m32\%s..C:\windo
0x28740	77735c73797374656d5c257300000000	ws\system\%s....
0x28750	7762000073746172742025730a000000	wb..start %s....
0x28760	64656c2025730a006f70656e00000000	del %s..open....
0x28770	4861204861204841202100005374696c	Ha Ha HA !..Stil
0x28780	6c20747279696e672020210057686174	l trying !.What
0x28790	60732074686520706f696e7420210000	`s the point !..
0x287a0	49606d20736f20636f6f6c203a290000	I`m so cool :)..
0x287b0	59656170202c2069606d206120626164	Yeap , i`m a bad
0x287c0	206d6f74686572206675636b65722021	mother fucker !
0x287d0	000000005c2573005c2573004e745265	....\%s.\%s.NtRe
0x287e0	73756d6550726f63657373006e74646c	sumeProcess.ntdl
0x287f0	6c2e646c6c000000633a5c73746f702d	l.dll...c:\stop-
0x28800	6164772e7478740025780000534f4654	adw.txt.%x..SOFT
0x28810	574152455c4d6963726f736f66745c57	WARE\Microsoft\W
0x28820	696e646f77735c43757272656e745665	indows\CurrentVe
0x28830	7273696f6e5c52756e5c0000534f4654	rsion\Run\..SOFT
0x28840	574152455c4d6963726f736f66745c57	WARE\Microsoft\W
0x28850	696e646f77735c43757272656e745665	indows\CurrentVe
0x28860	7273696f6e5c52756e5c000063616c63	rsion\Run\..calc
0x28870	2e657865000000006f70656e00000000	.exe....open....
0x28880	6e6f74657061642e657865006f70656e	notepad.exe.open
0x28890	000000006d737061696e742e65786500	....mspaint.exe.
0x288a0	6f70656e0000000077726974652e6578	open....write.ex
0x288b0	650000006f70656e00000000596f7520	e...open....You
0x288c0	7375636b00000000596f75207265616c	suck....You real
0x288d0	79207468696e6b20796f752063616e20	y think you can
0x288e0	657363617065206d650000004d657373	escape me...Mess
0x288f0	2077697468207468652062657374202c	with the best ,
0x28900	20646965206c696b6520746865207265	die like the re
0x28910	737400004920616d20746865206f6e65	st..I am the one
0x28920	20616e64206f6e6c7900000048412048	and only...HA H
0x28930	4120484100000000436f6d606f6e202c	A HA....Com`on ,
0x28940	20746861746073207468652062657374	that`s the best
0x28950	20796f752063616e20646f0049606d20	you can do.I`m
0x28960	76657279206469737361706f696e7465	very dissapointe
0x28970	64207769746820796f75722070657266	d with your perf
0x28980	6f726d61636500004e6f626164792063	ormace..Nobady c

0x24f90	00000000000000000000000000000000	................
0x24fa0	00000000000000000000000000000000	................
0x24fb0	00000000000000000000000000000000	................
0x24fc0	00000000000000000000000000000000	................
0x24fd0	00000000000000000000000000000000	................
0x24fe0	00000000000000000000000000000000	................
0x24ff0	00000000000000000000000000000000	................
0x25000	30ca020022ca020012ca020000ca0200	0..."...........
0x25010	f0c90200dcc90200cec90200bcc90200	................
0x25020	aec90200000000000cc902001ec90200	................
0x25030	32c902003ec9020050c9020090c80200	2...>...P.......
0x25040	f6c80200e2c80200ccc80200b8c80200	................
0x25050	a8c80200fcc70200ecc7020084c80200	................
0x25060	76c802006ac802005ac802004cc80200	v...j...Z...L...
0x25070	40c8020036c8020028c802001ac80200	@...6...(.......
0x25080	0ac802009ec80200000000005cbe0200	............\...
0x25090	68be020078be020092be02009ebe0200	h...x...........
0x250a0	aabe0200babe0200c8be0200dabe0200	................
0x250b0	ecbe0200febe02000abf020018bf0200	................
0x250c0	2abf020036bf02004abf020050be0200	*...6...J...P...
0x250d0	84bf020098bf0200aabf0200babf0200	................
0x250e0	c8bf0200d6bf0200e4bf0200f2bf0200	................
0x250f0	0cc0020024c002003ec0020058c00200	....$...>...X...
0x25100	72c002007cc002008cc002009ec00200	r...\|...........
0x25110	aec00200bec00200cec00200e0c00200	................
0x25120	f2c0020002c1020018c102003ebe0200	............>...
0x25130	2ebe02001abe020008be0200f0bd0200	................
0x25140	e6bd0200cebd0200bebd0200b0bd0200	................
0x25150	a4bd020088bd020078bd020068bd0200	........x...h...
0x25160	50bd020042bd02002abd02001cbd0200	P...B...*.......
0x25170	0ebd0200fcbc0200f0bc0200e6bc0200	................
0x25180	d0bc0200bebc0200b2bc0200a2bc0200	................
0x25190	8abc020074bc020064bc020052bc0200	....t...d...R...
0x251a0	42bc020034bc020024bc020006bc0200	B...4...$.......
0x251b0	f2bb0200dcbb0200c4bb0200aabb0200	................
0x251c0	98bb020088bb020078bb020068bb0200	........x...h...
0x251d0	58bb020046bb020038bb02002cbb0200	X...F...8...,...
0x251e0	1ebb020010bb0200fcba0200eeba0200	................
0x251f0	dcba0200ccba0200b6ba0200a0ba0200	................
0x25200	8aba02007eba020076ba020062ba0200	....~...v...b...
0x25210	50ba020044ba020036ba020020ba0200	P...D...6... ...
0x25220	0cba020004ba0200eeb90200e0b90200	................
0x25230	d4b90200c6b90200bab90200acb90200	................
0x25240	a0b902008eb902007eb9020066bf0200	........~...f...
0x25250	00000000090000800c00008008000080	................
0x25260	000000005eb9020046b9020030b90200	....^...F...0...
0x25270	20b902000000000060ca020050ca0200	.......`...P...
0x25280	0000000096ca020080ca020000000000	................

Objectives

0x24f90	00000000000000000000000000000000	................
0x24fa0	00000000000000000000000000000000	................
0x24fb0	00000000000000000000000000000000	................
0x24fc0	00000000000000000000000000000000	................
0x24fd0	00000000000000000000000000000000	................
0x24fe0	00000000000000000000000000000000	................
0x24ff0	00000000000000000000000000000000	................
0x25000	30ca020022ca020012ca020000ca0200	0..."...........
0x25010	f0c90200dcc90200cec90200bcc90200	................
0x25020	aec90200000000000cc902001ec90200	................
0x25030	32c902003ec9020050c9020090c80200	2...>...P.......
0x25040	f6c80200e2c80200ccc80200b8c80200	................
0x25050	a8c80200fcc70200ecc7020084c80200	................
0x25060	76c802006ac802005ac802004cc80200	v...j...Z...L...
0x25070	40c8020036c8020028c802001ac80200	@...6...(.......
0x25080	0ac802009ec80200000000005cbe0200	............\...
0x25090	68be020078be020092be02009ebe0200	h...x...........
0x250a0	aabe0200babe0200c8be0200dabe0200	................
0x250b0	ecbe0200febe02000abf020018bf0200	................
0x250c0	2abf020036bf02004abf020050be0200	*...6...J...P...
0x250d0	84bf020098bf0200aabf0200babf0200	................
0x250e0	c8bf0200d6bf0200e4bf0200f2bf0200	................
0x250f0	0cc0020024c002003ec0020058c00200	....$...>...X...
0x25100	72c002007cc002008cc002009ec00200	r...\|...........
0x25110	aec00200bec00200cec00200e0c00200	................
0x25120	f2c0020002c1020018c102003ebe0200	............>...
0x25130	2ebe02001abe020008be0200f0bd0200	................
0x25140	e6bd0200cebd0200bebd0200b0bd0200	................
0x25150	a4bd020088bd020078bd020068bd0200	........x...h...
0x25160	50bd020042bd02002abd02001cbd0200	P...B...*.......
0x25170	0ebd0200fcbc0200f0bc0200e6bc0200	................
0x25180	d0bc0200bebc0200b2bc0200a2bc0200	................
0x25190	8abc020074bc020064bc020052bc0200	....t...d...R...
0x251a0	42bc020034bc020024bc020006bc0200	B...4...$.......
0x251b0	f2bb0200dcbb0200c4bb0200aabb0200	................
0x251c0	98bb020088bb020078bb020068bb0200	........x...h...
0x251d0	58bb020046bb020038bb02002cbb0200	X...F...8...,...
0x251e0	1ebb020010bb0200fcba0200eeba0200	................
0x251f0	dcba0200ccba0200b6ba0200a0ba0200	................
0x25200	8aba02007eba020076ba020062ba0200	....~...v...b...
0x25210	50ba020044ba020036ba020020ba0200	P...D...6... ...
0x25220	0cba020004ba0200eeb90200e0b90200	................
0x25230	d4b90200c6b90200bab90200acb90200	................
0x25240	a0b902008eb902007eb9020066bf0200	........~...f...
0x25250	00000000090000800c00008008000080	................
0x25260	000000005eb9020046b9020030b90200	....^...F...0...
0x25270	20b902000000000060ca020050ca0200	.......`...P...
0x25280	0000000096ca020080ca020000000000	................

0x28690	6f3cd211817b00c04f797ab700000000	o<...{..Oyz.....
0x286a0	4f4c454143432e646c6c000011010000	OLEACC.dll......
0x286b0	0000000046e1000046e1000038000000	....F...F...8...
0x286c0	1b154000000000000000000000000000	..@.............
0x286d0	00000000000000000000000061154000	............a.@.
0x286e0	ac864200496e76616c69642044617465	..B.Invalid Date
0x286f0	54696d6500000000496e76616c696420	Time....Invalid
0x28700	4461746554696d655370616e00000000	DateTimeSpan....
0x28710	433a5c77696e646f77735c2573000000	C:\windows\%s...
0x28720	433a5c77696e646f77735c7379737465	C:\windows\syste
0x28730	6d33325c25730000433a5c77696e646f	m32\%s..C:\windo
0x28740	77735c73797374656d5c257300000000	ws\system\%s....
0x28750	7762000073746172742025730a000000	wb..start %s....
0x28760	64656c2025730a006f70656e00000000	del %s..open....
0x28770	4861204861204841202100005374696c	Ha Ha HA !..Stil
0x28780	6c20747279696e672020210057686174	l trying !.What
0x28790	60732074686520706f696e7420210000	`s the point !..
0x287a0	49606d20736f20636f6f6c203a290000	I`m so cool :)..
0x287b0	59656170202c2069606d206120626164	Yeap , i`m a bad
0x287c0	206d6f74686572206675636b65722021	mother fucker !
0x287d0	000000005c2573005c2573004e745265	....\%s.\%s.NtRe
0x287e0	73756d6550726f63657373006e74646c	sumeProcess.ntdl
0x287f0	6c2e646c6c000000633a5c73746f702d	l.dll...c:\stop-
0x28800	6164772e7478740025780000534f4654	adw.txt.%x..SOFT
0x28810	574152455c4d6963726f736f66745c57	WARE\Microsoft\W
0x28820	696e646f77735c43757272656e745665	indows\CurrentVe
0x28830	7273696f6e5c52756e5c0000534f4654	rsion\Run\..SOFT
0x28840	574152455c4d6963726f736f66745c57	WARE\Microsoft\W
0x28850	696e646f77735c43757272656e745665	indows\CurrentVe
0x28860	7273696f6e5c52756e5c000063616c63	rsion\Run\..calc
0x28870	2e657865000000006f70656e00000000	.exe....open....
0x28880	6e6f74657061642e657865006f70656e	notepad.exe.open
0x28890	000000006d737061696e742e65786500	....mspaint.exe.
0x288a0	6f70656e0000000077726974652e6578	open....write.ex
0x288b0	650000006f70656e00000000596f7520	e...open....You
0x288c0	7375636b00000000596f75207265616c	suck....You real
0x288d0	79207468696e6b20796f752063616e20	y think you can
0x288e0	657363617065206d650000004d657373	escape me...Mess
0x288f0	2077697468207468652062657374202c	with the best ,
0x28900	20646965206c696b6520746865207265	die like the re
0x28910	737400004920616d20746865206f6e65	st..I am the one
0x28920	20616e64206f6e6c7900000048412048	and only...HA H
0x28930	4120484100000000436f6d606f6e202c	A HA....Com`on ,
0x28940	20746861746073207468652062657374	that`s the best
0x28950	20796f752063616e20646f0049606d20	you can do.I`m
0x28960	76657279206469737361706f696e7465	very dissapointe
0x28970	64207769746820796f75722070657266	d with your perf
0x28980	6f726d61636500004e6f626164792063	ormace..Nobady c

0x3355e	01000100340100000d00000002000100	....4...........
0x3356e	2000400001000100340100000f000000	.@.....4.......
0x3357e	02000100200040000100010034010000	.... .@.....4...
0x3358e	10000000020001002000400001000100	........ .@.....
0x3359e	34010000110000000100010020200000	4........... ..
0x335ae	01001800a80c00000100300334000000	..........0.4...
0x335be	560053005f0056004500520053004900	V.S._.V.E.R.S.I.
0x335ce	4f004e005f0049004e0046004f000000	O.N._.I.N.F.O...
0x335de	0000bd04effe00000100000001000100	................
0x335ee	000000000100010000003f0000000000	..........?.....
0x335fe	00000400000001000000000000000000	................
0x3360e	00000000000090020000010053007400	............S.t.
0x3361e	720069006e006700460069006c006500	r.i.n.g.F.i.l.e.
0x3362e	49006e0066006f0000006c0200000100	I.n.f.o...l.....
0x3363e	30003400300039003000340065003400	0.4.0.9.0.4.e.4.
0x3364e	00004a001500010043006f006d007000	..J.....C.o.m.p.
0x3365e	61006e0079004e0061006d0065000000	a.n.y.N.a.m.e...
0x3366e	000054004f0044004f003a0020003c00	..T.O.D.O.:. .<.
0x3367e	43006f006d00700061006e0079002000	C.o.m.p.a.n.y. .
0x3368e	6e0061006d0065003e00000000005a00	n.a.m.e.>.....Z.
0x3369e	19000100460069006c00650044006500	....F.i.l.e.D.e.
0x336ae	73006300720069007000740069006f00	s.c.r.i.p.t.i.o.
0x336be	6e000000000054004f0044004f003a00	n.....T.O.D.O.:.
0x336ce	20003c00460069006c00650020006400	.<.F.i.l.e. .d.
0x336de	65007300630072006900700074006900	e.s.c.r.i.p.t.i.
0x336ee	6f006e003e0000000000300008000100	o.n.>.....0.....
0x336fe	460069006c0065005600650072007300	F.i.l.e.V.e.r.s.
0x3370e	69006f006e000000000031002e003000	i.o.n.....1...0.
0x3371e	2e0030002e003100000038000c000100	..0...1...8.....
0x3372e	49006e007400650072006e0061006c00	I.n.t.e.r.n.a.l.
0x3373e	4e0061006d0065000000410064007700	N.a.m.e...A.d.w.
0x3374e	54006500730074002e00650078006500	T.e.s.t...e.x.e.
0x3375e	00008400300001004c00650067006100	....0...L.e.g.a.
0x3376e	6c0043006f0070007900720069006700	l.C.o.p.y.r.i.g.
0x3377e	68007400000054004f0044004f003a00	h.t...T.O.D.O.:.
0x3378e	200028006300290020003c0043006f00	.(.c.). .<.C.o.
0x3379e	6d00700061006e00790020006e006100	m.p.a.n.y. .n.a.
0x337ae	6d0065003e002e002000200041006c00	m.e.>... . .A.l.
0x337be	6c002000720069006700680074007300	l. .r.i.g.h.t.s.
0x337ce	20007200650073006500720076006500	.r.e.s.e.r.v.e.
0x337de	64002e00000040000c0001004f007200	d.....@.....O.r.
0x337ee	6900670069006e0061006c0046006900	i.g.i.n.a.l.F.i.
0x337fe	6c0065006e0061006d00650000004100	l.e.n.a.m.e...A.
0x3380e	6400770054006500730074002e006500	d.w.T.e.s.t...e.
0x3381e	7800650000004a001500010050007200	x.e...J.....P.r.
0x3382e	6f0064007500630074004e0061006d00	o.d.u.c.t.N.a.m.
0x3383e	65000000000054004f0044004f003a00	e.....T.O.D.O.:.
0x3384e	20003c00500072006f00640075006300	.<.P.r.o.d.u.c.

0x25588	00000000000000000000000000000000	................
0x25598	44656163746976617465416374437478	DeactivateActCtx
0x255a8	00000000416374697661746541637443	....ActivateActC
0x255b8	7478000052656c656173654163744374	tx..ReleaseActCt
0x255c8	78000000437265617465416374437478	x...CreateActCtx
0x255d8	410000004b45524e454c333200000000	A...KERNEL32....
0x255e8	536f6674776172655c4d6963726f736f	Software\Microso
0x255f8	66745c57696e646f77735c4375727265	ft\Windows\Curre
0x25608	6e7456657273696f6e5c506f6c696369	ntVersion\Polici
0x25618	65735c4578706c6f726572004e6f5275	es\Explorer.NoRu
0x25628	6e0000004e6f44726976657300000000	n...NoDrives....
0x25638	526573747269637452756e004e6f4e65	RestrictRun.NoNe
0x25648	74436f6e6e656374446973636f6e6e65	tConnectDisconne
0x25658	637400004e6f526563656e74446f6373	ct..NoRecentDocs
0x25668	486973746f7279004e6f436c6f736500	History.NoClose.
0x25678	536f6674776172655c4d6963726f736f	Software\Microso
0x25688	66745c57696e646f77735c4375727265	ft\Windows\Curre
0x25698	6e7456657273696f6e5c506f6c696369	ntVersion\Polici
0x256a8	65735c4e6574776f726b00004e6f456e	es\Network..NoEn
0x256b8	746972654e6574776f726b00536f6674	tireNetwork.Soft
0x256c8	776172655c4d6963726f736f66745c57	ware\Microsoft\W
0x256d8	696e646f77735c43757272656e745665	indows\CurrentVe
0x256e8	7273696f6e5c506f6c69636965735c43	rsion\Policies\C
0x256f8	6f6d646c673332004e6f506c61636573	omdlg32.NoPlaces
0x25708	426172004e6f4261636b427574746f6e	Bar.NoBackButton
0x25718	000000004e6f46696c654d7275000000	....NoFileMru...
0x25728	b88c4200051b4000da1d400010134000	..B...@...@...@.
0x25738	c233400002354000dc34400034354000	.3@..5@..4@.45@.
0x25748	9239400092394000e234400061154000	.9@..9@..4@.a.@.
0x25758	3f354000f034400039354000fc344000	?5@..4@.95@..4@.
0x25768	f6344000303540003435400034354000	.4@.05@.45@.45@.
0x25778	34354000fb1d4000331e40007f3c4000	45@...@.3.@..<@.
0x25788	903e4000031a4000723c400007194000	.>@...@.r<@...@.
0x25798	84194000633d40008c3c400084394000	..@.c=@..<@..9@.
0x257a8	be3f4000303540003442400043444000	.?@.05@.4B@.CD@.
0x257b8	20444000791740000e44400031484000	D@.y.@..D@.1H@.
0x257c8	9443400084444000541e4000911e4000	.C@..D@.T.@...@.
0x257d8	ce1e400022234000f61d40004c4f4300	..@."#@...@.LOC.
0x257e8	6e74646c6c2e646c6c00000025780000	ntdll.dll...%x..
0x257f8	436f6e74726f6c2050616e656c5c4465	Control Panel\De
0x25808	736b746f705c5265736f757263654c6f	sktop\ResourceLo
0x25818	63616c65000000004765745379737465	cale....GetSyste
0x25828	6d44656661756c7455494c616e677561	mDefaultUILangua
0x25838	67650000476574557365724465666175	ge..GetUserDefau
0x25848	6c7455494c616e677561676500000000	ltUILanguage....
0x25858	6b65726e656c33322e646c6c00000000	kernel32.dll....
0x25868	25732e646c6c0000736f667477617265	%s.dll..software
0x25878	0000000025640000434469616c6f6700	....%d..CDialog.

0x24f90	00000000000000000000000000000000	................
0x24fa0	00000000000000000000000000000000	................
0x24fb0	00000000000000000000000000000000	................
0x24fc0	00000000000000000000000000000000	................
0x24fd0	00000000000000000000000000000000	................
0x24fe0	00000000000000000000000000000000	................
0x24ff0	00000000000000000000000000000000	................
0x25000	30ca020022ca020012ca020000ca0200	0..."...........
0x25010	f0c90200dcc90200cec90200bcc90200	................
0x25020	aec90200000000000cc902001ec90200	................
0x25030	32c902003ec9020050c9020090c80200	2...>...P.......
0x25040	f6c80200e2c80200ccc80200b8c80200	................
0x25050	a8c80200fcc70200ecc7020084c80200	................
0x25060	76c802006ac802005ac802004cc80200	v...j...Z...L...
0x25070	40c8020036c8020028c802001ac80200	@...6...(.......
0x25080	0ac802009ec80200000000005cbe0200	............\...
0x25090	68be020078be020092be02009ebe0200	h...x...........
0x250a0	aabe0200babe0200c8be0200dabe0200	................
0x250b0	ecbe0200febe02000abf020018bf0200	................
0x250c0	2abf020036bf02004abf020050be0200	*...6...J...P...
0x250d0	84bf020098bf0200aabf0200babf0200	................
0x250e0	c8bf0200d6bf0200e4bf0200f2bf0200	................
0x250f0	0cc0020024c002003ec0020058c00200	....$...>...X...
0x25100	72c002007cc002008cc002009ec00200	r...\|...........
0x25110	aec00200bec00200cec00200e0c00200	................
0x25120	f2c0020002c1020018c102003ebe0200	............>...
0x25130	2ebe02001abe020008be0200f0bd0200	................
0x25140	e6bd0200cebd0200bebd0200b0bd0200	................
0x25150	a4bd020088bd020078bd020068bd0200	........x...h...
0x25160	50bd020042bd02002abd02001cbd0200	P...B...*.......
0x25170	0ebd0200fcbc0200f0bc0200e6bc0200	................
0x25180	d0bc0200bebc0200b2bc0200a2bc0200	................
0x25190	8abc020074bc020064bc020052bc0200	....t...d...R...
0x251a0	42bc020034bc020024bc020006bc0200	B...4...$.......
0x251b0	f2bb0200dcbb0200c4bb0200aabb0200	................
0x251c0	98bb020088bb020078bb020068bb0200	........x...h...
0x251d0	58bb020046bb020038bb02002cbb0200	X...F...8...,...
0x251e0	1ebb020010bb0200fcba0200eeba0200	................
0x251f0	dcba0200ccba0200b6ba0200a0ba0200	................
0x25200	8aba02007eba020076ba020062ba0200	....~...v...b...
0x25210	50ba020044ba020036ba020020ba0200	P...D...6... ...
0x25220	0cba020004ba0200eeb90200e0b90200	................
0x25230	d4b90200c6b90200bab90200acb90200	................
0x25240	a0b902008eb902007eb9020066bf0200	........~...f...
0x25250	00000000090000800c00008008000080	................
0x25260	000000005eb9020046b9020030b90200	....^...F...0...
0x25270	20b902000000000060ca020050ca0200	.......`...P...
0x25280	0000000096ca020080ca020000000000	................

0x24f90	00000000000000000000000000000000	................
0x24fa0	00000000000000000000000000000000	................
0x24fb0	00000000000000000000000000000000	................
0x24fc0	00000000000000000000000000000000	................
0x24fd0	00000000000000000000000000000000	................
0x24fe0	00000000000000000000000000000000	................
0x24ff0	00000000000000000000000000000000	................
0x25000	30ca020022ca020012ca020000ca0200	0..."...........
0x25010	f0c90200dcc90200cec90200bcc90200	................
0x25020	aec90200000000000cc902001ec90200	................
0x25030	32c902003ec9020050c9020090c80200	2...>...P.......
0x25040	f6c80200e2c80200ccc80200b8c80200	................
0x25050	a8c80200fcc70200ecc7020084c80200	................
0x25060	76c802006ac802005ac802004cc80200	v...j...Z...L...
0x25070	40c8020036c8020028c802001ac80200	@...6...(.......
0x25080	0ac802009ec80200000000005cbe0200	............\...
0x25090	68be020078be020092be02009ebe0200	h...x...........
0x250a0	aabe0200babe0200c8be0200dabe0200	................
0x250b0	ecbe0200febe02000abf020018bf0200	................
0x250c0	2abf020036bf02004abf020050be0200	*...6...J...P...
0x250d0	84bf020098bf0200aabf0200babf0200	................
0x250e0	c8bf0200d6bf0200e4bf0200f2bf0200	................
0x250f0	0cc0020024c002003ec0020058c00200	....$...>...X...
0x25100	72c002007cc002008cc002009ec00200	r...\|...........
0x25110	aec00200bec00200cec00200e0c00200	................
0x25120	f2c0020002c1020018c102003ebe0200	............>...
0x25130	2ebe02001abe020008be0200f0bd0200	................
0x25140	e6bd0200cebd0200bebd0200b0bd0200	................
0x25150	a4bd020088bd020078bd020068bd0200	........x...h...
0x25160	50bd020042bd02002abd02001cbd0200	P...B...*.......
0x25170	0ebd0200fcbc0200f0bc0200e6bc0200	................
0x25180	d0bc0200bebc0200b2bc0200a2bc0200	................
0x25190	8abc020074bc020064bc020052bc0200	....t...d...R...
0x251a0	42bc020034bc020024bc020006bc0200	B...4...$.......
0x251b0	f2bb0200dcbb0200c4bb0200aabb0200	................
0x251c0	98bb020088bb020078bb020068bb0200	........x...h...
0x251d0	58bb020046bb020038bb02002cbb0200	X...F...8...,...
0x251e0	1ebb020010bb0200fcba0200eeba0200	................
0x251f0	dcba0200ccba0200b6ba0200a0ba0200	................
0x25200	8aba02007eba020076ba020062ba0200	....~...v...b...
0x25210	50ba020044ba020036ba020020ba0200	P...D...6... ...
0x25220	0cba020004ba0200eeb90200e0b90200	................
0x25230	d4b90200c6b90200bab90200acb90200	................
0x25240	a0b902008eb902007eb9020066bf0200	........~...f...
0x25250	00000000090000800c00008008000080	................
0x25260	000000005eb9020046b9020030b90200	....^...F...0...
0x25270	20b902000000000060ca020050ca0200	.......`...P...
0x25280	0000000096ca020080ca020000000000	................

0x3355e	01000100340100000d00000002000100	....4...........
0x3356e	2000400001000100340100000f000000	.@.....4.......
0x3357e	02000100200040000100010034010000	.... .@.....4...
0x3358e	10000000020001002000400001000100	........ .@.....
0x3359e	34010000110000000100010020200000	4........... ..
0x335ae	01001800a80c00000100300334000000	..........0.4...
0x335be	560053005f0056004500520053004900	V.S._.V.E.R.S.I.
0x335ce	4f004e005f0049004e0046004f000000	O.N._.I.N.F.O...
0x335de	0000bd04effe00000100000001000100	................
0x335ee	000000000100010000003f0000000000	..........?.....
0x335fe	00000400000001000000000000000000	................
0x3360e	00000000000090020000010053007400	............S.t.
0x3361e	720069006e006700460069006c006500	r.i.n.g.F.i.l.e.
0x3362e	49006e0066006f0000006c0200000100	I.n.f.o...l.....
0x3363e	30003400300039003000340065003400	0.4.0.9.0.4.e.4.
0x3364e	00004a001500010043006f006d007000	..J.....C.o.m.p.
0x3365e	61006e0079004e0061006d0065000000	a.n.y.N.a.m.e...
0x3366e	000054004f0044004f003a0020003c00	..T.O.D.O.:. .<.
0x3367e	43006f006d00700061006e0079002000	C.o.m.p.a.n.y. .
0x3368e	6e0061006d0065003e00000000005a00	n.a.m.e.>.....Z.
0x3369e	19000100460069006c00650044006500	....F.i.l.e.D.e.
0x336ae	73006300720069007000740069006f00	s.c.r.i.p.t.i.o.
0x336be	6e000000000054004f0044004f003a00	n.....T.O.D.O.:.
0x336ce	20003c00460069006c00650020006400	.<.F.i.l.e. .d.
0x336de	65007300630072006900700074006900	e.s.c.r.i.p.t.i.
0x336ee	6f006e003e0000000000300008000100	o.n.>.....0.....
0x336fe	460069006c0065005600650072007300	F.i.l.e.V.e.r.s.
0x3370e	69006f006e000000000031002e003000	i.o.n.....1...0.
0x3371e	2e0030002e003100000038000c000100	..0...1...8.....
0x3372e	49006e007400650072006e0061006c00	I.n.t.e.r.n.a.l.
0x3373e	4e0061006d0065000000410064007700	N.a.m.e...A.d.w.
0x3374e	54006500730074002e00650078006500	T.e.s.t...e.x.e.
0x3375e	00008400300001004c00650067006100	....0...L.e.g.a.
0x3376e	6c0043006f0070007900720069006700	l.C.o.p.y.r.i.g.
0x3377e	68007400000054004f0044004f003a00	h.t...T.O.D.O.:.
0x3378e	200028006300290020003c0043006f00	.(.c.). .<.C.o.
0x3379e	6d00700061006e00790020006e006100	m.p.a.n.y. .n.a.
0x337ae	6d0065003e002e002000200041006c00	m.e.>... . .A.l.
0x337be	6c002000720069006700680074007300	l. .r.i.g.h.t.s.
0x337ce	20007200650073006500720076006500	.r.e.s.e.r.v.e.
0x337de	64002e00000040000c0001004f007200	d.....@.....O.r.
0x337ee	6900670069006e0061006c0046006900	i.g.i.n.a.l.F.i.
0x337fe	6c0065006e0061006d00650000004100	l.e.n.a.m.e...A.
0x3380e	6400770054006500730074002e006500	d.w.T.e.s.t...e.
0x3381e	7800650000004a001500010050007200	x.e...J.....P.r.
0x3382e	6f0064007500630074004e0061006d00	o.d.u.c.t.N.a.m.
0x3383e	65000000000054004f0044004f003a00	e.....T.O.D.O.:.
0x3384e	20003c00500072006f00640075006300	.<.P.r.o.d.u.c.

Micro-behaviors

0x24f90	00000000000000000000000000000000	................
0x24fa0	00000000000000000000000000000000	................
0x24fb0	00000000000000000000000000000000	................
0x24fc0	00000000000000000000000000000000	................
0x24fd0	00000000000000000000000000000000	................
0x24fe0	00000000000000000000000000000000	................
0x24ff0	00000000000000000000000000000000	................
0x25000	30ca020022ca020012ca020000ca0200	0..."...........
0x25010	f0c90200dcc90200cec90200bcc90200	................
0x25020	aec90200000000000cc902001ec90200	................
0x25030	32c902003ec9020050c9020090c80200	2...>...P.......
0x25040	f6c80200e2c80200ccc80200b8c80200	................
0x25050	a8c80200fcc70200ecc7020084c80200	................
0x25060	76c802006ac802005ac802004cc80200	v...j...Z...L...
0x25070	40c8020036c8020028c802001ac80200	@...6...(.......
0x25080	0ac802009ec80200000000005cbe0200	............\...
0x25090	68be020078be020092be02009ebe0200	h...x...........
0x250a0	aabe0200babe0200c8be0200dabe0200	................
0x250b0	ecbe0200febe02000abf020018bf0200	................
0x250c0	2abf020036bf02004abf020050be0200	*...6...J...P...
0x250d0	84bf020098bf0200aabf0200babf0200	................
0x250e0	c8bf0200d6bf0200e4bf0200f2bf0200	................
0x250f0	0cc0020024c002003ec0020058c00200	....$...>...X...
0x25100	72c002007cc002008cc002009ec00200	r...\|...........
0x25110	aec00200bec00200cec00200e0c00200	................
0x25120	f2c0020002c1020018c102003ebe0200	............>...
0x25130	2ebe02001abe020008be0200f0bd0200	................
0x25140	e6bd0200cebd0200bebd0200b0bd0200	................
0x25150	a4bd020088bd020078bd020068bd0200	........x...h...
0x25160	50bd020042bd02002abd02001cbd0200	P...B...*.......
0x25170	0ebd0200fcbc0200f0bc0200e6bc0200	................
0x25180	d0bc0200bebc0200b2bc0200a2bc0200	................
0x25190	8abc020074bc020064bc020052bc0200	....t...d...R...
0x251a0	42bc020034bc020024bc020006bc0200	B...4...$.......
0x251b0	f2bb0200dcbb0200c4bb0200aabb0200	................
0x251c0	98bb020088bb020078bb020068bb0200	........x...h...
0x251d0	58bb020046bb020038bb02002cbb0200	X...F...8...,...
0x251e0	1ebb020010bb0200fcba0200eeba0200	................
0x251f0	dcba0200ccba0200b6ba0200a0ba0200	................
0x25200	8aba02007eba020076ba020062ba0200	....~...v...b...
0x25210	50ba020044ba020036ba020020ba0200	P...D...6... ...
0x25220	0cba020004ba0200eeb90200e0b90200	................
0x25230	d4b90200c6b90200bab90200acb90200	................
0x25240	a0b902008eb902007eb9020066bf0200	........~...f...
0x25250	00000000090000800c00008008000080	................
0x25260	000000005eb9020046b9020030b90200	....^...F...0...
0x25270	20b902000000000060ca020050ca0200	.......`...P...
0x25280	0000000096ca020080ca020000000000	................

0x24f90	00000000000000000000000000000000	................
0x24fa0	00000000000000000000000000000000	................
0x24fb0	00000000000000000000000000000000	................
0x24fc0	00000000000000000000000000000000	................
0x24fd0	00000000000000000000000000000000	................
0x24fe0	00000000000000000000000000000000	................
0x24ff0	00000000000000000000000000000000	................
0x25000	30ca020022ca020012ca020000ca0200	0..."...........
0x25010	f0c90200dcc90200cec90200bcc90200	................
0x25020	aec90200000000000cc902001ec90200	................
0x25030	32c902003ec9020050c9020090c80200	2...>...P.......
0x25040	f6c80200e2c80200ccc80200b8c80200	................
0x25050	a8c80200fcc70200ecc7020084c80200	................
0x25060	76c802006ac802005ac802004cc80200	v...j...Z...L...
0x25070	40c8020036c8020028c802001ac80200	@...6...(.......
0x25080	0ac802009ec80200000000005cbe0200	............\...
0x25090	68be020078be020092be02009ebe0200	h...x...........
0x250a0	aabe0200babe0200c8be0200dabe0200	................
0x250b0	ecbe0200febe02000abf020018bf0200	................
0x250c0	2abf020036bf02004abf020050be0200	*...6...J...P...
0x250d0	84bf020098bf0200aabf0200babf0200	................
0x250e0	c8bf0200d6bf0200e4bf0200f2bf0200	................
0x250f0	0cc0020024c002003ec0020058c00200	....$...>...X...
0x25100	72c002007cc002008cc002009ec00200	r...\|...........
0x25110	aec00200bec00200cec00200e0c00200	................
0x25120	f2c0020002c1020018c102003ebe0200	............>...
0x25130	2ebe02001abe020008be0200f0bd0200	................
0x25140	e6bd0200cebd0200bebd0200b0bd0200	................
0x25150	a4bd020088bd020078bd020068bd0200	........x...h...
0x25160	50bd020042bd02002abd02001cbd0200	P...B...*.......
0x25170	0ebd0200fcbc0200f0bc0200e6bc0200	................
0x25180	d0bc0200bebc0200b2bc0200a2bc0200	................
0x25190	8abc020074bc020064bc020052bc0200	....t...d...R...
0x251a0	42bc020034bc020024bc020006bc0200	B...4...$.......
0x251b0	f2bb0200dcbb0200c4bb0200aabb0200	................
0x251c0	98bb020088bb020078bb020068bb0200	........x...h...
0x251d0	58bb020046bb020038bb02002cbb0200	X...F...8...,...
0x251e0	1ebb020010bb0200fcba0200eeba0200	................
0x251f0	dcba0200ccba0200b6ba0200a0ba0200	................
0x25200	8aba02007eba020076ba020062ba0200	....~...v...b...
0x25210	50ba020044ba020036ba020020ba0200	P...D...6... ...
0x25220	0cba020004ba0200eeb90200e0b90200	................
0x25230	d4b90200c6b90200bab90200acb90200	................
0x25240	a0b902008eb902007eb9020066bf0200	........~...f...
0x25250	00000000090000800c00008008000080	................
0x25260	000000005eb9020046b9020030b90200	....^...F...0...
0x25270	20b902000000000060ca020050ca0200	.......`...P...
0x25280	0000000096ca020080ca020000000000	................

0x2c3be	56697369626c6500a100446973706174	Visible...Dispat
0x2c3ce	63684d657373616765410000aa025472	chMessageA....Tr
0x2c3de	616e736c6174654d6573736167650000	anslateMessage..
0x2c3ee	3a014765744d65737361676541001a00	:.GetMessageA...
0x2c3fe	43616c6c4e657874486f6f6b45780000	CallNextHookEx..
0x2c40e	8a0253657457696e646f7773486f6f6b	..SetWindowsHook
0x2c41e	457841004d02536574437572736f7200	ExA.M.SetCursor.
0x2c42e	df014d657373616765426f7841002801	..MessageBoxA.(.
0x2c43e	4765744c617374416374697665506f70	GetLastActivePop
0x2c44e	757000007b0147657457696e646f7754	up..{.GetWindowT
0x2c45e	687265616450726f6365737349640000	hreadProcessId..
0x2c46e	ae02556e686f6f6b57696e646f777348	..UnhookWindowsH
0x2c47e	6f6f6b4578006a0147657457696e646f	ookEx.j.GetWindo
0x2c48e	7700740147657457696e646f77526563	w.t.GetWindowRec
0x2c49e	7400730147657457696e646f77506c61	t.s.GetWindowPla
0x2c4ae	63656d656e740000990253797374656d	cement....System
0x2c4be	506172616d6574657273496e666f4100	ParametersInfoA.
0x2c4ce	830253657457696e646f77506f730000	..SetWindowPos..
0x2c4de	800253657457696e646f774c6f6e6741	..SetWindowLongA
0x2c4ee	00001b0043616c6c57696e646f775072	....CallWindowPr
0x2c4fe	6f6341008e0044656657696e646f7750	ocA...DefWindowP
0x2c50e	726f634100001001476574446c674374	rocA....GetDlgCt
0x2c51e	726c494400000c025074496e52656374	rlID....PtInRect
0x2c52e	00004a00436f70795265637400000200	..J.CopyRect....
0x2c53e	41646a75737457696e646f7752656374	AdjustWindowRect
0x2c54e	457800005a01476574537973436f6c6f	Ex..Z.GetSysColo
0x2c55e	720016	r..

0x24f90	00000000000000000000000000000000	................
0x24fa0	00000000000000000000000000000000	................
0x24fb0	00000000000000000000000000000000	................
0x24fc0	00000000000000000000000000000000	................
0x24fd0	00000000000000000000000000000000	................
0x24fe0	00000000000000000000000000000000	................
0x24ff0	00000000000000000000000000000000	................
0x25000	30ca020022ca020012ca020000ca0200	0..."...........
0x25010	f0c90200dcc90200cec90200bcc90200	................
0x25020	aec90200000000000cc902001ec90200	................
0x25030	32c902003ec9020050c9020090c80200	2...>...P.......
0x25040	f6c80200e2c80200ccc80200b8c80200	................
0x25050	a8c80200fcc70200ecc7020084c80200	................
0x25060	76c802006ac802005ac802004cc80200	v...j...Z...L...
0x25070	40c8020036c8020028c802001ac80200	@...6...(.......
0x25080	0ac802009ec80200000000005cbe0200	............\...
0x25090	68be020078be020092be02009ebe0200	h...x...........
0x250a0	aabe0200babe0200c8be0200dabe0200	................
0x250b0	ecbe0200febe02000abf020018bf0200	................
0x250c0	2abf020036bf02004abf020050be0200	*...6...J...P...
0x250d0	84bf020098bf0200aabf0200babf0200	................
0x250e0	c8bf0200d6bf0200e4bf0200f2bf0200	................
0x250f0	0cc0020024c002003ec0020058c00200	....$...>...X...
0x25100	72c002007cc002008cc002009ec00200	r...\|...........
0x25110	aec00200bec00200cec00200e0c00200	................
0x25120	f2c0020002c1020018c102003ebe0200	............>...
0x25130	2ebe02001abe020008be0200f0bd0200	................
0x25140	e6bd0200cebd0200bebd0200b0bd0200	................
0x25150	a4bd020088bd020078bd020068bd0200	........x...h...
0x25160	50bd020042bd02002abd02001cbd0200	P...B...*.......
0x25170	0ebd0200fcbc0200f0bc0200e6bc0200	................
0x25180	d0bc0200bebc0200b2bc0200a2bc0200	................
0x25190	8abc020074bc020064bc020052bc0200	....t...d...R...
0x251a0	42bc020034bc020024bc020006bc0200	B...4...$.......
0x251b0	f2bb0200dcbb0200c4bb0200aabb0200	................
0x251c0	98bb020088bb020078bb020068bb0200	........x...h...
0x251d0	58bb020046bb020038bb02002cbb0200	X...F...8...,...
0x251e0	1ebb020010bb0200fcba0200eeba0200	................
0x251f0	dcba0200ccba0200b6ba0200a0ba0200	................
0x25200	8aba02007eba020076ba020062ba0200	....~...v...b...
0x25210	50ba020044ba020036ba020020ba0200	P...D...6... ...
0x25220	0cba020004ba0200eeb90200e0b90200	................
0x25230	d4b90200c6b90200bab90200acb90200	................
0x25240	a0b902008eb902007eb9020066bf0200	........~...f...
0x25250	00000000090000800c00008008000080	................
0x25260	000000005eb9020046b9020030b90200	....^...F...0...
0x25270	20b902000000000060ca020050ca0200	.......`...P...
0x25280	0000000096ca020080ca020000000000	................

0x2b908	64c20200000000006ac902007ac90200	d.......j...z...
0x2b918	90c90200000000000500456e756d5072	..........EnumPr
0x2b928	6f636573736573000400456e756d5072	ocesses...EnumPr
0x2b938	6f636573734d6f64756c657300000e00	ocessModules....
0x2b948	4765744d6f64756c6546696c654e616d	GetModuleFileNam
0x2b958	6545784100000c004765744d6f64756c	eExA....GetModul
0x2b968	65426173654e616d6541000050534150	eBaseNameA..PSAP
0x2b978	492e444c4c00df014765745469636b43	I.DLL...GetTickC
0x2b988	6f756e740000d20046696e6446697273	ount....FindFirs
0x2b998	7446696c65410000ce0046696e64436c	tFileA....FindCl
0x2b9a8	6f736500530043726561746546696c65	ose.S.CreateFile
0x2b9b8	4100a403577269746546696c65003400	A...WriteFile.4.
0x2b9c8	436c6f736548616e646c65004300436f	CloseHandle.C.Co
0x2b9d8	707946696c65410086024f70656e5072	pyFileA...OpenPr
0x2b9e8	6f636573730043014765744375727265	ocess.C.GetCurre
0x2b9f8	6e7450726f636573734964005603536c	ntProcessId.V.Sl
0x2ba08	65657000420147657443757272656e74	eep.B.GetCurrent
0x2ba18	50726f63657373007d014765744d6f64	Process.}.GetMod
0x2ba28	756c6546696c654e616d654100006301	uleFileNameA..c.
0x2ba38	47657446696c6553697a6500b5025265	GetFileSize...Re
0x2ba48	616446696c650000a00147657450726f	adFile....GetPro
0x2ba58	634164647265737300007f014765744d	cAddress....GetM
0x2ba68	6f64756c6548616e646c654100001f00	oduleHandleA....
0x2ba78	426565700000cc036c7374726c656e41	Beep....lstrlenA
0x2ba88	000094035769646543686172546f4d75	....WideCharToMu
0x2ba98	6c7469427974650075024d756c746942	ltiByte.u.MultiB
0x2baa8	797465546f5769646543686172002902	yteToWideChar.).
0x2bab8	496e7465726c6f63	Interloc

0x24f90	00000000000000000000000000000000	................
0x24fa0	00000000000000000000000000000000	................
0x24fb0	00000000000000000000000000000000	................
0x24fc0	00000000000000000000000000000000	................
0x24fd0	00000000000000000000000000000000	................
0x24fe0	00000000000000000000000000000000	................
0x24ff0	00000000000000000000000000000000	................
0x25000	30ca020022ca020012ca020000ca0200	0..."...........
0x25010	f0c90200dcc90200cec90200bcc90200	................
0x25020	aec90200000000000cc902001ec90200	................
0x25030	32c902003ec9020050c9020090c80200	2...>...P.......
0x25040	f6c80200e2c80200ccc80200b8c80200	................
0x25050	a8c80200fcc70200ecc7020084c80200	................
0x25060	76c802006ac802005ac802004cc80200	v...j...Z...L...
0x25070	40c8020036c8020028c802001ac80200	@...6...(.......
0x25080	0ac802009ec80200000000005cbe0200	............\...
0x25090	68be020078be020092be02009ebe0200	h...x...........
0x250a0	aabe0200babe0200c8be0200dabe0200	................
0x250b0	ecbe0200febe02000abf020018bf0200	................
0x250c0	2abf020036bf02004abf020050be0200	*...6...J...P...
0x250d0	84bf020098bf0200aabf0200babf0200	................
0x250e0	c8bf0200d6bf0200e4bf0200f2bf0200	................
0x250f0	0cc0020024c002003ec0020058c00200	....$...>...X...
0x25100	72c002007cc002008cc002009ec00200	r...\|...........
0x25110	aec00200bec00200cec00200e0c00200	................
0x25120	f2c0020002c1020018c102003ebe0200	............>...
0x25130	2ebe02001abe020008be0200f0bd0200	................
0x25140	e6bd0200cebd0200bebd0200b0bd0200	................
0x25150	a4bd020088bd020078bd020068bd0200	........x...h...
0x25160	50bd020042bd02002abd02001cbd0200	P...B...*.......
0x25170	0ebd0200fcbc0200f0bc0200e6bc0200	................
0x25180	d0bc0200bebc0200b2bc0200a2bc0200	................
0x25190	8abc020074bc020064bc020052bc0200	....t...d...R...
0x251a0	42bc020034bc020024bc020006bc0200	B...4...$.......
0x251b0	f2bb0200dcbb0200c4bb0200aabb0200	................
0x251c0	98bb020088bb020078bb020068bb0200	........x...h...
0x251d0	58bb020046bb020038bb02002cbb0200	X...F...8...,...
0x251e0	1ebb020010bb0200fcba0200eeba0200	................
0x251f0	dcba0200ccba0200b6ba0200a0ba0200	................
0x25200	8aba02007eba020076ba020062ba0200	....~...v...b...
0x25210	50ba020044ba020036ba020020ba0200	P...D...6... ...
0x25220	0cba020004ba0200eeb90200e0b90200	................
0x25230	d4b90200c6b90200bab90200acb90200	................
0x25240	a0b902008eb902007eb9020066bf0200	........~...f...
0x25250	00000000090000800c00008008000080	................
0x25260	000000005eb9020046b9020030b90200	....^...F...0...
0x25270	20b902000000000060ca020050ca0200	.......`...P...
0x25280	0000000096ca020080ca020000000000	................

0x24f90	00000000000000000000000000000000	................
0x24fa0	00000000000000000000000000000000	................
0x24fb0	00000000000000000000000000000000	................
0x24fc0	00000000000000000000000000000000	................
0x24fd0	00000000000000000000000000000000	................
0x24fe0	00000000000000000000000000000000	................
0x24ff0	00000000000000000000000000000000	................
0x25000	30ca020022ca020012ca020000ca0200	0..."...........
0x25010	f0c90200dcc90200cec90200bcc90200	................
0x25020	aec90200000000000cc902001ec90200	................
0x25030	32c902003ec9020050c9020090c80200	2...>...P.......
0x25040	f6c80200e2c80200ccc80200b8c80200	................
0x25050	a8c80200fcc70200ecc7020084c80200	................
0x25060	76c802006ac802005ac802004cc80200	v...j...Z...L...
0x25070	40c8020036c8020028c802001ac80200	@...6...(.......
0x25080	0ac802009ec80200000000005cbe0200	............\...
0x25090	68be020078be020092be02009ebe0200	h...x...........
0x250a0	aabe0200babe0200c8be0200dabe0200	................
0x250b0	ecbe0200febe02000abf020018bf0200	................
0x250c0	2abf020036bf02004abf020050be0200	*...6...J...P...
0x250d0	84bf020098bf0200aabf0200babf0200	................
0x250e0	c8bf0200d6bf0200e4bf0200f2bf0200	................
0x250f0	0cc0020024c002003ec0020058c00200	....$...>...X...
0x25100	72c002007cc002008cc002009ec00200	r...\|...........
0x25110	aec00200bec00200cec00200e0c00200	................
0x25120	f2c0020002c1020018c102003ebe0200	............>...
0x25130	2ebe02001abe020008be0200f0bd0200	................
0x25140	e6bd0200cebd0200bebd0200b0bd0200	................
0x25150	a4bd020088bd020078bd020068bd0200	........x...h...
0x25160	50bd020042bd02002abd02001cbd0200	P...B...*.......
0x25170	0ebd0200fcbc0200f0bc0200e6bc0200	................
0x25180	d0bc0200bebc0200b2bc0200a2bc0200	................
0x25190	8abc020074bc020064bc020052bc0200	....t...d...R...
0x251a0	42bc020034bc020024bc020006bc0200	B...4...$.......
0x251b0	f2bb0200dcbb0200c4bb0200aabb0200	................
0x251c0	98bb020088bb020078bb020068bb0200	........x...h...
0x251d0	58bb020046bb020038bb02002cbb0200	X...F...8...,...
0x251e0	1ebb020010bb0200fcba0200eeba0200	................
0x251f0	dcba0200ccba0200b6ba0200a0ba0200	................
0x25200	8aba02007eba020076ba020062ba0200	....~...v...b...
0x25210	50ba020044ba020036ba020020ba0200	P...D...6... ...
0x25220	0cba020004ba0200eeb90200e0b90200	................
0x25230	d4b90200c6b90200bab90200acb90200	................
0x25240	a0b902008eb902007eb9020066bf0200	........~...f...
0x25250	00000000090000800c00008008000080	................
0x25260	000000005eb9020046b9020030b90200	....^...F...0...
0x25270	20b902000000000060ca020050ca0200	.......`...P...
0x25280	0000000096ca020080ca020000000000	................

0x2c930	00008c0044656c65746544430000a501	....DeleteDC....
0x2c940	47657453746f636b4f626a6563740000	GetStockObject..
0x2c950	6b014765744465766963654361707300	k.GetDeviceCaps.
0x2c960	47444933322e646c6c001b00436c6f73	GDI32.dll...Clos
0x2c970	655072696e74657200004600446f6375	ePrinter..F.Docu
0x2c980	6d656e7450726f706572746965734100	mentPropertiesA.
0x2c990	7d004f70656e5072696e746572410000	}.OpenPrinterA..
0x2c9a0	57494e53504f4f4c2e4452560000eb01	WINSPOOL.DRV....
0x2c9b0	5265674f70656e4b6579410004025265	RegOpenKeyA...Re
0x2c9c0	6753657456616c75654578410000cb01	gSetValueExA....
0x2c9d0	526567436c6f73654b657900f7015265	RegCloseKey...Re
0x2c9e0	67517565727956616c75654578410000	gQueryValueExA..
0x2c9f0	ec015265674f70656e4b657945784100	..RegOpenKeyExA.
0x2ca00	d1015265674372656174654b65794578	..RegCreateKeyEx
0x2ca10	4100d40152656744656c6574654b6579	A...RegDeleteKey
0x2ca20	4100dd01526567456e756d4b65794100	A...RegEnumKeyA.
0x2ca30	f601526567517565727956616c756541	..RegQueryValueA
0x2ca40	000041445641504933322e646c6c0000	..ADVAPI32.dll..
0x2ca50	07015368656c6c457865637574654100	..ShellExecuteA.
0x2ca60	af005348476574466f6c646572506174	..SHGetFolderPat
0x2ca70	684100005348454c4c33322e646c6c00	hA..SHELL32.dll.
0x2ca80	2f005061746846696e64457874656e73	/.PathFindExtens
0x2ca90	696f6e41000031005061746846696e64	ionA..1.PathFind
0x2caa0	46696c654e616d65410053484c574150	FileNameA.SHLWAP
0x2cab0	492e646c6c004f4c4541555433322e64	I.dll.OLEAUT32.d
0x2cac0	6c6c0000000000000000000000000000	ll..............
0x2cad0	00000000000000000000000000000000	................
0x2cae0	00000000000000000000000000000000	................
0x2caf0	00000000000000000000000000000000	................
0x2cb00	0000	..

0x28690	6f3cd211817b00c04f797ab700000000	o<...{..Oyz.....
0x286a0	4f4c454143432e646c6c000011010000	OLEACC.dll......
0x286b0	0000000046e1000046e1000038000000	....F...F...8...
0x286c0	1b154000000000000000000000000000	..@.............
0x286d0	00000000000000000000000061154000	............a.@.
0x286e0	ac864200496e76616c69642044617465	..B.Invalid Date
0x286f0	54696d6500000000496e76616c696420	Time....Invalid
0x28700	4461746554696d655370616e00000000	DateTimeSpan....
0x28710	433a5c77696e646f77735c2573000000	C:\windows\%s...
0x28720	433a5c77696e646f77735c7379737465	C:\windows\syste
0x28730	6d33325c25730000433a5c77696e646f	m32\%s..C:\windo
0x28740	77735c73797374656d5c257300000000	ws\system\%s....
0x28750	7762000073746172742025730a000000	wb..start %s....
0x28760	64656c2025730a006f70656e00000000	del %s..open....
0x28770	4861204861204841202100005374696c	Ha Ha HA !..Stil
0x28780	6c20747279696e672020210057686174	l trying !.What
0x28790	60732074686520706f696e7420210000	`s the point !..
0x287a0	49606d20736f20636f6f6c203a290000	I`m so cool :)..
0x287b0	59656170202c2069606d206120626164	Yeap , i`m a bad
0x287c0	206d6f74686572206675636b65722021	mother fucker !
0x287d0	000000005c2573005c2573004e745265	....\%s.\%s.NtRe
0x287e0	73756d6550726f63657373006e74646c	sumeProcess.ntdl
0x287f0	6c2e646c6c000000633a5c73746f702d	l.dll...c:\stop-
0x28800	6164772e7478740025780000534f4654	adw.txt.%x..SOFT
0x28810	574152455c4d6963726f736f66745c57	WARE\Microsoft\W
0x28820	696e646f77735c43757272656e745665	indows\CurrentVe
0x28830	7273696f6e5c52756e5c0000534f4654	rsion\Run\..SOFT
0x28840	574152455c4d6963726f736f66745c57	WARE\Microsoft\W
0x28850	696e646f77735c43757272656e745665	indows\CurrentVe
0x28860	7273696f6e5c52756e5c000063616c63	rsion\Run\..calc
0x28870	2e657865000000006f70656e00000000	.exe....open....
0x28880	6e6f74657061642e657865006f70656e	notepad.exe.open
0x28890	000000006d737061696e742e65786500	....mspaint.exe.
0x288a0	6f70656e0000000077726974652e6578	open....write.ex
0x288b0	650000006f70656e00000000596f7520	e...open....You
0x288c0	7375636b00000000596f75207265616c	suck....You real
0x288d0	79207468696e6b20796f752063616e20	y think you can
0x288e0	657363617065206d650000004d657373	escape me...Mess
0x288f0	2077697468207468652062657374202c	with the best ,
0x28900	20646965206c696b6520746865207265	die like the re
0x28910	737400004920616d20746865206f6e65	st..I am the one
0x28920	20616e64206f6e6c7900000048412048	and only...HA H
0x28930	4120484100000000436f6d606f6e202c	A HA....Com`on ,
0x28940	20746861746073207468652062657374	that`s the best
0x28950	20796f752063616e20646f0049606d20	you can do.I`m
0x28960	76657279206469737361706f696e7465	very dissapointe
0x28970	64207769746820796f75722070657266	d with your perf
0x28980	6f726d61636500004e6f626164792063	ormace..Nobady c

0x28690	6f3cd211817b00c04f797ab700000000	o<...{..Oyz.....
0x286a0	4f4c454143432e646c6c000011010000	OLEACC.dll......
0x286b0	0000000046e1000046e1000038000000	....F...F...8...
0x286c0	1b154000000000000000000000000000	..@.............
0x286d0	00000000000000000000000061154000	............a.@.
0x286e0	ac864200496e76616c69642044617465	..B.Invalid Date
0x286f0	54696d6500000000496e76616c696420	Time....Invalid
0x28700	4461746554696d655370616e00000000	DateTimeSpan....
0x28710	433a5c77696e646f77735c2573000000	C:\windows\%s...
0x28720	433a5c77696e646f77735c7379737465	C:\windows\syste
0x28730	6d33325c25730000433a5c77696e646f	m32\%s..C:\windo
0x28740	77735c73797374656d5c257300000000	ws\system\%s....
0x28750	7762000073746172742025730a000000	wb..start %s....
0x28760	64656c2025730a006f70656e00000000	del %s..open....
0x28770	4861204861204841202100005374696c	Ha Ha HA !..Stil
0x28780	6c20747279696e672020210057686174	l trying !.What
0x28790	60732074686520706f696e7420210000	`s the point !..
0x287a0	49606d20736f20636f6f6c203a290000	I`m so cool :)..
0x287b0	59656170202c2069606d206120626164	Yeap , i`m a bad
0x287c0	206d6f74686572206675636b65722021	mother fucker !
0x287d0	000000005c2573005c2573004e745265	....\%s.\%s.NtRe
0x287e0	73756d6550726f63657373006e74646c	sumeProcess.ntdl
0x287f0	6c2e646c6c000000633a5c73746f702d	l.dll...c:\stop-
0x28800	6164772e7478740025780000534f4654	adw.txt.%x..SOFT
0x28810	574152455c4d6963726f736f66745c57	WARE\Microsoft\W
0x28820	696e646f77735c43757272656e745665	indows\CurrentVe
0x28830	7273696f6e5c52756e5c0000534f4654	rsion\Run\..SOFT
0x28840	574152455c4d6963726f736f66745c57	WARE\Microsoft\W
0x28850	696e646f77735c43757272656e745665	indows\CurrentVe
0x28860	7273696f6e5c52756e5c000063616c63	rsion\Run\..calc
0x28870	2e657865000000006f70656e00000000	.exe....open....
0x28880	6e6f74657061642e657865006f70656e	notepad.exe.open
0x28890	000000006d737061696e742e65786500	....mspaint.exe.
0x288a0	6f70656e0000000077726974652e6578	open....write.ex
0x288b0	650000006f70656e00000000596f7520	e...open....You
0x288c0	7375636b00000000596f75207265616c	suck....You real
0x288d0	79207468696e6b20796f752063616e20	y think you can
0x288e0	657363617065206d650000004d657373	escape me...Mess
0x288f0	2077697468207468652062657374202c	with the best ,
0x28900	20646965206c696b6520746865207265	die like the re
0x28910	737400004920616d20746865206f6e65	st..I am the one
0x28920	20616e64206f6e6c7900000048412048	and only...HA H
0x28930	4120484100000000436f6d606f6e202c	A HA....Com`on ,
0x28940	20746861746073207468652062657374	that`s the best
0x28950	20796f752063616e20646f0049606d20	you can do.I`m
0x28960	76657279206469737361706f696e7465	very dissapointe
0x28970	64207769746820796f75722070657266	d with your perf
0x28980	6f726d61636500004e6f626164792063	ormace..Nobady c

0x24f90	00000000000000000000000000000000	................
0x24fa0	00000000000000000000000000000000	................
0x24fb0	00000000000000000000000000000000	................
0x24fc0	00000000000000000000000000000000	................
0x24fd0	00000000000000000000000000000000	................
0x24fe0	00000000000000000000000000000000	................
0x24ff0	00000000000000000000000000000000	................
0x25000	30ca020022ca020012ca020000ca0200	0..."...........
0x25010	f0c90200dcc90200cec90200bcc90200	................
0x25020	aec90200000000000cc902001ec90200	................
0x25030	32c902003ec9020050c9020090c80200	2...>...P.......
0x25040	f6c80200e2c80200ccc80200b8c80200	................
0x25050	a8c80200fcc70200ecc7020084c80200	................
0x25060	76c802006ac802005ac802004cc80200	v...j...Z...L...
0x25070	40c8020036c8020028c802001ac80200	@...6...(.......
0x25080	0ac802009ec80200000000005cbe0200	............\...
0x25090	68be020078be020092be02009ebe0200	h...x...........
0x250a0	aabe0200babe0200c8be0200dabe0200	................
0x250b0	ecbe0200febe02000abf020018bf0200	................
0x250c0	2abf020036bf02004abf020050be0200	*...6...J...P...
0x250d0	84bf020098bf0200aabf0200babf0200	................
0x250e0	c8bf0200d6bf0200e4bf0200f2bf0200	................
0x250f0	0cc0020024c002003ec0020058c00200	....$...>...X...
0x25100	72c002007cc002008cc002009ec00200	r...\|...........
0x25110	aec00200bec00200cec00200e0c00200	................
0x25120	f2c0020002c1020018c102003ebe0200	............>...
0x25130	2ebe02001abe020008be0200f0bd0200	................
0x25140	e6bd0200cebd0200bebd0200b0bd0200	................
0x25150	a4bd020088bd020078bd020068bd0200	........x...h...
0x25160	50bd020042bd02002abd02001cbd0200	P...B...*.......
0x25170	0ebd0200fcbc0200f0bc0200e6bc0200	................
0x25180	d0bc0200bebc0200b2bc0200a2bc0200	................
0x25190	8abc020074bc020064bc020052bc0200	....t...d...R...
0x251a0	42bc020034bc020024bc020006bc0200	B...4...$.......
0x251b0	f2bb0200dcbb0200c4bb0200aabb0200	................
0x251c0	98bb020088bb020078bb020068bb0200	........x...h...
0x251d0	58bb020046bb020038bb02002cbb0200	X...F...8...,...
0x251e0	1ebb020010bb0200fcba0200eeba0200	................
0x251f0	dcba0200ccba0200b6ba0200a0ba0200	................
0x25200	8aba02007eba020076ba020062ba0200	....~...v...b...
0x25210	50ba020044ba020036ba020020ba0200	P...D...6... ...
0x25220	0cba020004ba0200eeb90200e0b90200	................
0x25230	d4b90200c6b90200bab90200acb90200	................
0x25240	a0b902008eb902007eb9020066bf0200	........~...f...
0x25250	00000000090000800c00008008000080	................
0x25260	000000005eb9020046b9020030b90200	....^...F...0...
0x25270	20b902000000000060ca020050ca0200	.......`...P...
0x25280	0000000096ca020080ca020000000000	................

0x2bf46	737300006e03556e68616e646c656445	ss..n.UnhandledE
0x2bf56	7863657074696f6e46696c7465720000	xceptionFilter..
0x2bf66	4a03536574556e68616e646c65644578	J.SetUnhandledEx
0x2bf76	63657074696f6e46696c746572003902	ceptionFilter.9.
0x2bf86	4973446562756767657250726573656e	IsDebuggerPresen
0x2bf96	7400240353657448616e646c65436f75	t.$.SetHandleCou
0x2bfa6	6e740000b90147657453746448616e64	nt....GetStdHand
0x2bfb6	6c650000660147657446696c65547970	le..f.GetFileTyp
0x2bfc6	650014024865617044657374726f7900	e...HeapDestroy.
0x2bfd6	12024865617043726561746500008303	..HeapCreate....
0x2bfe6	5669727475616c4672656500f6004672	VirtualFree...Fr
0x2bff6	6565456e7669726f6e6d656e74537472	eeEnvironmentStr
0x2c006	696e677341005501476574456e766972	ingsA.U.GetEnvir
0x2c016	6f	o

0x24f90	00000000000000000000000000000000	................
0x24fa0	00000000000000000000000000000000	................
0x24fb0	00000000000000000000000000000000	................
0x24fc0	00000000000000000000000000000000	................
0x24fd0	00000000000000000000000000000000	................
0x24fe0	00000000000000000000000000000000	................
0x24ff0	00000000000000000000000000000000	................
0x25000	30ca020022ca020012ca020000ca0200	0..."...........
0x25010	f0c90200dcc90200cec90200bcc90200	................
0x25020	aec90200000000000cc902001ec90200	................
0x25030	32c902003ec9020050c9020090c80200	2...>...P.......
0x25040	f6c80200e2c80200ccc80200b8c80200	................
0x25050	a8c80200fcc70200ecc7020084c80200	................
0x25060	76c802006ac802005ac802004cc80200	v...j...Z...L...
0x25070	40c8020036c8020028c802001ac80200	@...6...(.......
0x25080	0ac802009ec80200000000005cbe0200	............\...
0x25090	68be020078be020092be02009ebe0200	h...x...........
0x250a0	aabe0200babe0200c8be0200dabe0200	................
0x250b0	ecbe0200febe02000abf020018bf0200	................
0x250c0	2abf020036bf02004abf020050be0200	*...6...J...P...
0x250d0	84bf020098bf0200aabf0200babf0200	................
0x250e0	c8bf0200d6bf0200e4bf0200f2bf0200	................
0x250f0	0cc0020024c002003ec0020058c00200	....$...>...X...
0x25100	72c002007cc002008cc002009ec00200	r...\|...........
0x25110	aec00200bec00200cec00200e0c00200	................
0x25120	f2c0020002c1020018c102003ebe0200	............>...
0x25130	2ebe02001abe020008be0200f0bd0200	................
0x25140	e6bd0200cebd0200bebd0200b0bd0200	................
0x25150	a4bd020088bd020078bd020068bd0200	........x...h...
0x25160	50bd020042bd02002abd02001cbd0200	P...B...*.......
0x25170	0ebd0200fcbc0200f0bc0200e6bc0200	................
0x25180	d0bc0200bebc0200b2bc0200a2bc0200	................
0x25190	8abc020074bc020064bc020052bc0200	....t...d...R...
0x251a0	42bc020034bc020024bc020006bc0200	B...4...$.......
0x251b0	f2bb0200dcbb0200c4bb0200aabb0200	................
0x251c0	98bb020088bb020078bb020068bb0200	........x...h...
0x251d0	58bb020046bb020038bb02002cbb0200	X...F...8...,...
0x251e0	1ebb020010bb0200fcba0200eeba0200	................
0x251f0	dcba0200ccba0200b6ba0200a0ba0200	................
0x25200	8aba02007eba020076ba020062ba0200	....~...v...b...
0x25210	50ba020044ba020036ba020020ba0200	P...D...6... ...
0x25220	0cba020004ba0200eeb90200e0b90200	................
0x25230	d4b90200c6b90200bab90200acb90200	................
0x25240	a0b902008eb902007eb9020066bf0200	........~...f...
0x25250	00000000090000800c00008008000080	................
0x25260	000000005eb9020046b9020030b90200	....^...F...0...
0x25270	20b902000000000060ca020050ca0200	.......`...P...
0x25280	0000000096ca020080ca020000000000	................

0x2b908	64c20200000000006ac902007ac90200	d.......j...z...
0x2b918	90c90200000000000500456e756d5072	..........EnumPr
0x2b928	6f636573736573000400456e756d5072	ocesses...EnumPr
0x2b938	6f636573734d6f64756c657300000e00	ocessModules....
0x2b948	4765744d6f64756c6546696c654e616d	GetModuleFileNam
0x2b958	6545784100000c004765744d6f64756c	eExA....GetModul
0x2b968	65426173654e616d6541000050534150	eBaseNameA..PSAP
0x2b978	492e444c4c00df014765745469636b43	I.DLL...GetTickC
0x2b988	6f756e740000d20046696e6446697273	ount....FindFirs
0x2b998	7446696c65410000ce0046696e64436c	tFileA....FindCl
0x2b9a8	6f736500530043726561746546696c65	ose.S.CreateFile
0x2b9b8	4100a403577269746546696c65003400	A...WriteFile.4.
0x2b9c8	436c6f736548616e646c65004300436f	CloseHandle.C.Co
0x2b9d8	707946696c65410086024f70656e5072	pyFileA...OpenPr
0x2b9e8	6f636573730043014765744375727265	ocess.C.GetCurre
0x2b9f8	6e7450726f636573734964005603536c	ntProcessId.V.Sl
0x2ba08	65657000420147657443757272656e74	eep.B.GetCurrent
0x2ba18	50726f63657373007d014765744d6f64	Process.}.GetMod
0x2ba28	756c6546696c654e616d654100006301	uleFileNameA..c.
0x2ba38	47657446696c6553697a6500b5025265	GetFileSize...Re
0x2ba48	616446696c650000a00147657450726f	adFile....GetPro
0x2ba58	634164647265737300007f014765744d	cAddress....GetM
0x2ba68	6f64756c6548616e646c654100001f00	oduleHandleA....
0x2ba78	426565700000cc036c7374726c656e41	Beep....lstrlenA
0x2ba88	000094035769646543686172546f4d75	....WideCharToMu
0x2ba98	6c7469427974650075024d756c746942	ltiByte.u.MultiB
0x2baa8	797465546f5769646543686172002902	yteToWideChar.).
0x2bab8	496e7465726c6f63	Interloc

0x24f90	00000000000000000000000000000000	................
0x24fa0	00000000000000000000000000000000	................
0x24fb0	00000000000000000000000000000000	................
0x24fc0	00000000000000000000000000000000	................
0x24fd0	00000000000000000000000000000000	................
0x24fe0	00000000000000000000000000000000	................
0x24ff0	00000000000000000000000000000000	................
0x25000	30ca020022ca020012ca020000ca0200	0..."...........
0x25010	f0c90200dcc90200cec90200bcc90200	................
0x25020	aec90200000000000cc902001ec90200	................
0x25030	32c902003ec9020050c9020090c80200	2...>...P.......
0x25040	f6c80200e2c80200ccc80200b8c80200	................
0x25050	a8c80200fcc70200ecc7020084c80200	................
0x25060	76c802006ac802005ac802004cc80200	v...j...Z...L...
0x25070	40c8020036c8020028c802001ac80200	@...6...(.......
0x25080	0ac802009ec80200000000005cbe0200	............\...
0x25090	68be020078be020092be02009ebe0200	h...x...........
0x250a0	aabe0200babe0200c8be0200dabe0200	................
0x250b0	ecbe0200febe02000abf020018bf0200	................
0x250c0	2abf020036bf02004abf020050be0200	*...6...J...P...
0x250d0	84bf020098bf0200aabf0200babf0200	................
0x250e0	c8bf0200d6bf0200e4bf0200f2bf0200	................
0x250f0	0cc0020024c002003ec0020058c00200	....$...>...X...
0x25100	72c002007cc002008cc002009ec00200	r...\|...........
0x25110	aec00200bec00200cec00200e0c00200	................
0x25120	f2c0020002c1020018c102003ebe0200	............>...
0x25130	2ebe02001abe020008be0200f0bd0200	................
0x25140	e6bd0200cebd0200bebd0200b0bd0200	................
0x25150	a4bd020088bd020078bd020068bd0200	........x...h...
0x25160	50bd020042bd02002abd02001cbd0200	P...B...*.......
0x25170	0ebd0200fcbc0200f0bc0200e6bc0200	................
0x25180	d0bc0200bebc0200b2bc0200a2bc0200	................
0x25190	8abc020074bc020064bc020052bc0200	....t...d...R...
0x251a0	42bc020034bc020024bc020006bc0200	B...4...$.......
0x251b0	f2bb0200dcbb0200c4bb0200aabb0200	................
0x251c0	98bb020088bb020078bb020068bb0200	........x...h...
0x251d0	58bb020046bb020038bb02002cbb0200	X...F...8...,...
0x251e0	1ebb020010bb0200fcba0200eeba0200	................
0x251f0	dcba0200ccba0200b6ba0200a0ba0200	................
0x25200	8aba02007eba020076ba020062ba0200	....~...v...b...
0x25210	50ba020044ba020036ba020020ba0200	P...D...6... ...
0x25220	0cba020004ba0200eeb90200e0b90200	................
0x25230	d4b90200c6b90200bab90200acb90200	................
0x25240	a0b902008eb902007eb9020066bf0200	........~...f...
0x25250	00000000090000800c00008008000080	................
0x25260	000000005eb9020046b9020030b90200	....^...F...0...
0x25270	20b902000000000060ca020050ca0200	.......`...P...
0x25280	0000000096ca020080ca020000000000	................

Metadata

0x25588	00000000000000000000000000000000	................
0x25598	44656163746976617465416374437478	DeactivateActCtx
0x255a8	00000000416374697661746541637443	....ActivateActC
0x255b8	7478000052656c656173654163744374	tx..ReleaseActCt
0x255c8	78000000437265617465416374437478	x...CreateActCtx
0x255d8	410000004b45524e454c333200000000	A...KERNEL32....
0x255e8	536f6674776172655c4d6963726f736f	Software\Microso
0x255f8	66745c57696e646f77735c4375727265	ft\Windows\Curre
0x25608	6e7456657273696f6e5c506f6c696369	ntVersion\Polici
0x25618	65735c4578706c6f726572004e6f5275	es\Explorer.NoRu
0x25628	6e0000004e6f44726976657300000000	n...NoDrives....
0x25638	526573747269637452756e004e6f4e65	RestrictRun.NoNe
0x25648	74436f6e6e656374446973636f6e6e65	tConnectDisconne
0x25658	637400004e6f526563656e74446f6373	ct..NoRecentDocs
0x25668	486973746f7279004e6f436c6f736500	History.NoClose.
0x25678	536f6674776172655c4d6963726f736f	Software\Microso
0x25688	66745c57696e646f77735c4375727265	ft\Windows\Curre
0x25698	6e7456657273696f6e5c506f6c696369	ntVersion\Polici
0x256a8	65735c4e6574776f726b00004e6f456e	es\Network..NoEn
0x256b8	746972654e6574776f726b00536f6674	tireNetwork.Soft
0x256c8	776172655c4d6963726f736f66745c57	ware\Microsoft\W
0x256d8	696e646f77735c43757272656e745665	indows\CurrentVe
0x256e8	7273696f6e5c506f6c69636965735c43	rsion\Policies\C
0x256f8	6f6d646c673332004e6f506c61636573	omdlg32.NoPlaces
0x25708	426172004e6f4261636b427574746f6e	Bar.NoBackButton
0x25718	000000004e6f46696c654d7275000000	....NoFileMru...
0x25728	b88c4200051b4000da1d400010134000	..B...@...@...@.
0x25738	c233400002354000dc34400034354000	.3@..5@..4@.45@.
0x25748	9239400092394000e234400061154000	.9@..9@..4@.a.@.
0x25758	3f354000f034400039354000fc344000	?5@..4@.95@..4@.
0x25768	f6344000303540003435400034354000	.4@.05@.45@.45@.
0x25778	34354000fb1d4000331e40007f3c4000	45@...@.3.@..<@.
0x25788	903e4000031a4000723c400007194000	.>@...@.r<@...@.
0x25798	84194000633d40008c3c400084394000	..@.c=@..<@..9@.
0x257a8	be3f4000303540003442400043444000	.?@.05@.4B@.CD@.
0x257b8	20444000791740000e44400031484000	D@.y.@..D@.1H@.
0x257c8	9443400084444000541e4000911e4000	.C@..D@.T.@...@.
0x257d8	ce1e400022234000f61d40004c4f4300	..@."#@...@.LOC.
0x257e8	6e74646c6c2e646c6c00000025780000	ntdll.dll...%x..
0x257f8	436f6e74726f6c2050616e656c5c4465	Control Panel\De
0x25808	736b746f705c5265736f757263654c6f	sktop\ResourceLo
0x25818	63616c65000000004765745379737465	cale....GetSyste
0x25828	6d44656661756c7455494c616e677561	mDefaultUILangua
0x25838	67650000476574557365724465666175	ge..GetUserDefau
0x25848	6c7455494c616e677561676500000000	ltUILanguage....
0x25858	6b65726e656c33322e646c6c00000000	kernel32.dll....
0x25868	25732e646c6c0000736f667477617265	%s.dll..software
0x25878	0000000025640000434469616c6f6700	....%d..CDialog.

0x25cfc	6c6733322e646c6c00000000408f4200	lg32.dll....@.B.
0x25d0c	ff4c400043576e640000000000000000	.L@.CWnd........
0x25d1c	ffffffff416678576e64383073000000	....AfxWnd80s...
0x25d2c	416678436f6e74726f6c426172383073	AfxControlBar80s
0x25d3c	000000004166784d44494672616d6538	....AfxMDIFrame8
0x25d4c	307300004166784672616d654f725669	0s..AfxFrameOrVi
0x25d5c	65773830730000004166784f6c65436f	ew80s...AfxOleCo
0x25d6c	6e74726f6c383073000000004166784f	ntrol80s....AfxO
0x25d7c	6c64576e6450726f6334323300000000	ldWndProc423....
0x25d8c	685b4200185d4200105d420054000000	h[B..]B..]B.T...
0x25d9c	ffff00005d7340009c5b420000000000	....]s@..[B.....
0x25dac	00000000456e756d446973706c617944	....EnumDisplayD
0x25dbc	65766963657341004765744d6f6e6974	evicesA.GetMonit
0x25dcc	6f72496e66	orInf

0x24f90	00000000000000000000000000000000	................
0x24fa0	00000000000000000000000000000000	................
0x24fb0	00000000000000000000000000000000	................
0x24fc0	00000000000000000000000000000000	................
0x24fd0	00000000000000000000000000000000	................
0x24fe0	00000000000000000000000000000000	................
0x24ff0	00000000000000000000000000000000	................
0x25000	30ca020022ca020012ca020000ca0200	0..."...........
0x25010	f0c90200dcc90200cec90200bcc90200	................
0x25020	aec90200000000000cc902001ec90200	................
0x25030	32c902003ec9020050c9020090c80200	2...>...P.......
0x25040	f6c80200e2c80200ccc80200b8c80200	................
0x25050	a8c80200fcc70200ecc7020084c80200	................
0x25060	76c802006ac802005ac802004cc80200	v...j...Z...L...
0x25070	40c8020036c8020028c802001ac80200	@...6...(.......
0x25080	0ac802009ec80200000000005cbe0200	............\...
0x25090	68be020078be020092be02009ebe0200	h...x...........
0x250a0	aabe0200babe0200c8be0200dabe0200	................
0x250b0	ecbe0200febe02000abf020018bf0200	................
0x250c0	2abf020036bf02004abf020050be0200	*...6...J...P...
0x250d0	84bf020098bf0200aabf0200babf0200	................
0x250e0	c8bf0200d6bf0200e4bf0200f2bf0200	................
0x250f0	0cc0020024c002003ec0020058c00200	....$...>...X...
0x25100	72c002007cc002008cc002009ec00200	r...\|...........
0x25110	aec00200bec00200cec00200e0c00200	................
0x25120	f2c0020002c1020018c102003ebe0200	............>...
0x25130	2ebe02001abe020008be0200f0bd0200	................
0x25140	e6bd0200cebd0200bebd0200b0bd0200	................
0x25150	a4bd020088bd020078bd020068bd0200	........x...h...
0x25160	50bd020042bd02002abd02001cbd0200	P...B...*.......
0x25170	0ebd0200fcbc0200f0bc0200e6bc0200	................
0x25180	d0bc0200bebc0200b2bc0200a2bc0200	................
0x25190	8abc020074bc020064bc020052bc0200	....t...d...R...
0x251a0	42bc020034bc020024bc020006bc0200	B...4...$.......
0x251b0	f2bb0200dcbb0200c4bb0200aabb0200	................
0x251c0	98bb020088bb020078bb020068bb0200	........x...h...
0x251d0	58bb020046bb020038bb02002cbb0200	X...F...8...,...
0x251e0	1ebb020010bb0200fcba0200eeba0200	................
0x251f0	dcba0200ccba0200b6ba0200a0ba0200	................
0x25200	8aba02007eba020076ba020062ba0200	....~...v...b...
0x25210	50ba020044ba020036ba020020ba0200	P...D...6... ...
0x25220	0cba020004ba0200eeb90200e0b90200	................
0x25230	d4b90200c6b90200bab90200acb90200	................
0x25240	a0b902008eb902007eb9020066bf0200	........~...f...
0x25250	00000000090000800c00008008000080	................
0x25260	000000005eb9020046b9020030b90200	....^...F...0...
0x25270	20b902000000000060ca020050ca0200	.......`...P...
0x25280	0000000096ca020080ca020000000000	................

0x25ab8	13000000de2840000000000000000000	.....(@.........
0x25ac8	00000000000000000000000000000000	................
0x25ad8	4d53205368656c6c20446c6700000000	MS Shell Dlg....
0x25ae8	43436d64546172676574000000000000	CCmdTarget......
0x25af8	ffffffff000000000000000000000000	................
0x25b08	00000000ffffffff0000000000000000	................
0x25b18	f45a4200acd04200b0d0420000000000	.ZB...B...B.....
0x25b28	ffffffff000000000000000000000000	................
0x25b38	00000000ffffffff00000000ffffffff	................
0x25b48	ffffffff00000000245b	........$[

binary/anomaly PE mismatch beyond architecture suffix

20 of 37 traits shown

Identity

SHA-256	3dd8b9e95696b98e5450e5c117a7a73f09e9ca2be59caf8f98c68ee64c31edf5
Filename	virussign.com_a17ab77f9a93c96a7d6d53b1f360af40.vir
Package	3dd8b9e95696b98e5450e5c117a7a73f09e9ca2be59caf8f98c68ee64c31edf5

Origin

Source	harvest
Feed	virussign
Domain	virussign.com

Timeline

First seen	9 Aug 2026 13:11 UTC
First analyzed	10 Aug 2026 08:04 UTC
Last analyzed	10 Aug 2026 08:04 UTC
Last updated	10 Aug 2026 08:04 UTC

Labeling

Label	bad
Label source	harvest
Traits version	46d16

Not seeing what you expected? Let us know

0x26a20	ffff0000000000004469420000000000	........DiB.....
0x26a30	0000000054974200edad4000c5ae4000	....T.B...@...@.
0x26a40	101340002eac40006bae400033ac4000	..@...@.k.@.3.@.
0x26a50	434f626a6563740044656c6574650000	CObject.Delete..
0x26a60	4e6f52656d6f766500000000466f7263	NoRemove....Forc
0x26a70	6552656d6f76650056616c0042000000	eRemove.Val.B...
0x26a80	440000004d00000053000000886a4200	D...M...S....jB.
0x26a90	846a4200806a42007c6a4200786a4200	.jB..jB.\|jB.xjB.
0x26aa0	6c6a4200606a4200586a4200506a4200	ljB.`jB.XjB.PjB.
0x26ab0	04000000ffff00000000000000000000	................
0x26ac0	0000000000000000a49742003cb74000	..........B.<.@.
0x26ad0	f0974200e1b940001cba400029ba4000	..B...@...@.).@.
0x26ae0	7eba400058ba400053797374656d0000	~.@.X.@.System..
0x26af0	70984200b3c340	p.B...@