Gen.Trojan.Heur.VP.mmKea8RZ9zai_bd8ddc022c – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

RunDll32.exe:868
RunDll32.exe:516
%original file name%.exe:484

The Trojan injects its code into the following process(es):

FAPCF M.EXE:436

Mutexes

The following mutexes were created/opened:

ZonesLockedCacheCounterMutexZonesCacheCounterMutexZonesCounterMutex_SHuassist.mtxShimCacheMutex

File activity

The process %original file name%.exe:484 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\FAPCF M.EXE (198 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\1.bat (45 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\__tmp_rar_sfx_access_check_831859 (0 bytes)

The process FAPCF M.EXE:436 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jquery-1.7.2.min[1].js (4838 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\popup[1].htm (760 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\29[1].gif (1369 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ajax-loader[1].gif (3987 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\43[1].png (320 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\108[1].png (329 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\fapcf[1].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yllix[1].txt (126 bytes)

Registry activity

The process RunDll32.exe:868 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D0 2E DF 67 D4 B2 52 A7 E1 3B E0 E5 4C 69 69 3F"

The process RunDll32.exe:516 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4B F1 E5 14 BB F1 C5 05 E5 BB 82 36 BF 14 90 87"

The process %original file name%.exe:484 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "62 BD 91 95 A2 41 CF 94 B8 7F D2 6B 18 98 38 6B"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\RarSFX0]
"FAPCF M.EXE" = "FAPCF M"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process FAPCF M.EXE:436 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
"NetHood" = "%Documents and Settings%\%current user%\NetHood"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Templates" = "%Documents and Settings%\%current user%\Templates"

"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"SendTo" = "%Documents and Settings%\%current user%\SendTo"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"PrintHood" = "%Documents and Settings%\%current user%\PrintHood"

"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Fonts" = "%WinDir%\Fonts"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "01 F0 91 59 09 62 7E 9C 7C 61 EB C8 1B 00 75 2E"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Recent" = "%Documents and Settings%\%current user%\Recent"
"Favorites" = "%Documents and Settings%\%current user%\Favorites"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5	File path
2331acefb9e56de795e59286e494fd01	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\RarSFX0\FAPCF M.EXE

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
RunDll32.exe:868
RunDll32.exe:516
%original file name%.exe:484
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\FAPCF M.EXE (198 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\1.bat (45 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jquery-1.7.2.min[1].js (4838 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\popup[1].htm (760 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\29[1].gif (1369 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ajax-loader[1].gif (3987 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\43[1].png (320 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\108[1].png (329 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\fapcf[1].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yllix[1].txt (126 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	152808	153088	4.64164	22ced87f8cfbeec19f10ea768b9f5033
.rdata	159744	20275	20480	3.68225	9aea8072fe8459f1fb075382c5799ef0
.data	180224	136672	5120	1.76573	5aafebbc10957e661762e0e7fadc057b
.rsrc	319488	17140	17408	3.65556	9edf4f20ee7efdd46aca9c65fce682d1

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 1
ce93c0dadcd31837da8ec48bddb16704

Network Activity

URLs

URL	IP
hxxp://version.vinacf.com/fapcf.html	50.62.253.1
hxxp://yllix.com/popup.php?section=General&pub=292352&ga=g	109.105.53.8
hxxp://whos.amung.us/swidget/fapcfone.png	67.202.94.86
hxxp://yllix.com/js/jquery-1.7.2.min.js	109.105.53.8
hxxp://whos.amung.us/swidget/fapcfcomz.png	67.202.94.86
hxxp://widgets.amung.us/small/00/43.png	173.192.170.82
hxxp://widgets.amung.us/small/01/108.png	173.192.170.82
hxxp://animashky.ru/flist/3dprikol/1/29.gif	193.109.247.235
lh4.googleusercontent.com	173.194.112.171
fapcf001.ddns.net

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /popup.php?section=General&pub=292352&ga=g HTTP/1.1

Accept: */*

Referer: hXXp://version.vinacf.com/fapcf.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: yllix.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 12 May 2015 17:32:59 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: close

Vary: Accept-Encoding

X-Powered-By: PHP/5.4.39-0 deb7u2

Expires: Sun, 01 Jan 2014 00:00:00 GMT

Cache-Control: no-store, no-cache, must-revalidate

Cache-Control: post-check=0, pre-check=0

Pragma: no-cache

Set-Cookie: fc_585892=1; expires=Wed, 13-May-2015 01:32:59 GMT; path=/

Content-Encoding: gzip

1cc............eR.n.0.}._a......I.u.5.k^......MS.a....`.B...0.e...}.9....3...T .=.L5O.d.o....Y.nk......'...x.C..6.*..&...../...L.....oZ.=N.<.....Z4.2c.OQ....0UE. KU.2 ..<...|.k|.."N~dq.A......F........$.v...5Z.6...5F.h.@..x6_"....>.xy....K?.xz...7F.^........3......V...U.....!.H...R..g\.o&6U=z.yGw8..!..d...-...8.%e[...F.@.ve.#4!...q.....`..o..[.....x>.y.k.5...;uZ1b. ..:.xi.<V...h_.....&...8.{..RK.o..........!...0.....r%."...\<.npH..W.5......y...[..u......P........0..

GET /flist/3dprikol/1/29.gif HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: animashky.ru

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: uServ/3.2.2

Date: Tue, 12 May 2015 17:34:05 GMT

Content-Type: image/gif

Content-Length: 13678

Last-Modified: Mon, 17 Jan 2011 18:53:37 GMT

Connection: keep-alive

Keep-Alive: timeout=15

ETag: "4d349031-356e"

Accept-Ranges: bytes

GIF89aI.O...............................................f..f..f..ff..............f...........f.f..f..f..ff.f3.3..3..3..3f.33..ff..f..f..f.fff.ff.ff.fffff3ff.f3.f3.f3ff33f3.f..f.ff.33.f3f.3f.3ff3f333.33f33333.3..3.f3.33...3f.33.3...3.....................................................................................................................................................................!..NETSCAPE2.0.....!.....J.,....I.O.........................................................................1.......................'..................;.................,.p.....X.hQ...y."J..!....|.h......8t.ylEH....{.m.....!.i..I.!I.......,b:...CQ.,X@(z4g..?..-.....F...a....FO.`.nj!.,D0...C..,.......C.?..3..A..I.wP.0i..>d..(CG........2...e.X.B...?4.. ....-..M.p.b........=a.:$.......g...c.l.ec..0.P...5..=.8...C.h.s.?.-...Q=oq$@.....{...{.H.....2.$A..I..?......'CJ.tD.H...J......D.8.... `q:...5...['....!.. ..$`......Z^......U#...P.a..$.B.-....-.Ad.gF.G.\)Q..5.0..N......^.C..q@ ..-.WR....B..h......'s.x..;......0.S5q.....#...(..\?!.. a...B..............$..y.>..4@..m....i......._...N@,}...E..%.3.A.l.y...=..XHl.J.?....C=<..\g...z...Yb.....E...5.^.@..`"@..%V..h&.,`.i......lO..Y.~;.....b.QW...WO...l..ebZ.q@H.Xh.%uS[.vf.........(R..W...FL....j..].y....e.2ZI.....5i...].X\cq..:.V..U.).e&.Qg...ie.\1....W2<..Ww..s?$Q..iu%BH....A....j..(.'.d0..@.An[p9M.../..1!e.jq..pb .4.....u....L...MW]bp..@....B.;-|.5...4..'.....3ij:.K.O"m4.b...n.....P....W.%.......k:t...!....43Q*oQ....p..`..=....;.,.H pV.......C...>.....5 .[Q...|.c....

<<< skipped >>>

GET /small/00/43.png HTTP/1.1

Accept: */*

Referer: hXXp://version.vinacf.com/fapcf.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: widgets.amung.us

HTTP/1.1 200 OK

Server: nginx/1.2.4

Date: Tue, 12 May 2015 17:32:59 GMT

Content-Type: image/png

Content-Length: 320

Last-Modified: Sun, 13 Jun 2010 09:48:29 GMT

Connection: keep-alive

Expires: Thu, 11 Jun 2015 17:32:59 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

.PNG........IHDR...P.........D......9PLTE.bM.nX.82.G:................zc.....z.UC..n.'-00/...555...........IDAT8...... .D x.QG..cw.....&2.#....*se...q.:...{Q......{...W..&&`.U};..aD.........m".a.G.\......$..,d...B......u.$H.s...hMk.W...U..>....=,..............b..-.&.{.....|9p):....Dj.C6..;e..)TW.. ...:I.'..w....IEND.B`.HTTP/1.1 200 OK..Server: nginx/1.2.4..Date: Tue, 12 May 2015 17:32:59 GMT..Content-Type: image/png..Content-Length: 320..Last-Modified: Sun, 13 Jun 2010 09:48:29 GMT..Connection: keep-alive..Expires: Thu, 11 Jun 2015 17:32:59 GMT..Cache-Control: max-age=2592000..Accept-Ranges: bytes...PNG........IHDR...P.........D......9PLTE.bM.nX.82.G:................zc.....z.UC..n.'-00/...555...........IDAT8...... .D x.QG..cw.....&2.#....*se...q.:...{Q......{...W..&&`.U};..aD.........m".a.G.\......$..,d...B......u.$H.s...hMk.W...U..>....=,..............b..-.&.{.....|9p):....Dj.C6..;e..)TW.. ...:I.'..w....IEND.B`...

GET /js/jquery-1.7.2.min.js HTTP/1.1

Accept: */*

Referer: hXXp://version.vinacf.com/fapcf.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: yllix.com

Connection: Keep-Alive

Cookie: fc_585892=1

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 12 May 2015 17:32:59 GMT

Content-Type: application/x-javascript

Last-Modified: Sat, 23 Jun 2012 12:39:48 GMT

Transfer-Encoding: chunked

Connection: close

Vary: Accept-Encoding

Expires: Tue, 19 May 2015 17:32:59 GMT

Cache-Control: max-age=604800

Content-Encoding: gzip

87ea...............z.G./..<.Q....$H.....K....{.MK=....W......P.L`..>.}.............."..r...-##..tNf.q[.?.|........{.....dg^...y]..bS.<9..p|....r..*....I.)L..u..]/N..j.s.(.w.8H...X...O.2I.?..^Q...z..Uy....U...[).w....[.Z..N>.....C.>....-.O.H.ap.t.n.,.z.jU....0.T...|........S....../?.a.....`.\..n..At...va~C...2....rN...j.N.e......_/.E.N...*.S<L.j2.&...tO^L......N^.v....:..$D.r.....\..e~..{.~Ry..[W.2.....j.\o....'.....C......v^?.b.X7... @...Q..z..(../.....y..)..1C.P..4\......*)...........2O...q.L.i..0.<....S8.)J.....*.).z4U......t..M3^..dy.d^...6..m5/...0...W.=.lA..y.**.].28.(.N..s.........q..W.z.Y.......7o......-.....*....e..._KZi...... ..i....uUo...i.'~B. y....> [..H......DMUE......T..MR./F.Vs.PK.....p.\.'WU...........ezR-..4I..55...g......f......V.......].~...h..B..(.....>.am.`.=......5..J.;.vz....~....$...ER..#Z........"._%..`.~...,Y..I ........Km.J.Oh......r$.su..~I...ZR...`....?....2.g.fn.._gqz.Y.......|...D......DM...V.-..ejE.'.%.)R...3O..E.G.*\.O......!.6.B.O)p....qc.'...7.%Q..UY...=..!T.B....4>.....&......\.c.!.3.j..#E3.dT`J..i%.5"W.I...n..2%....gg...).:e4.V..4..;=......}'...]Hk..1.Dg..h......VV....p...*.S|...*]#..MRE.Y2.....}..@VL......b8.y.3..TL&..$..|.N?...4A......c..e/e....*_F1........D.(X2y...P.Q.Jn...Y....D.j....0..;..,...\O6,G\.T.Nd......a.B.N.......r.......t...y7..h7.V..<....#..N...>.F...E.. ... .#.F.v......_....XM...1.."6..$..i5..G.v...>..Q..5K....q..Q..8.F...~u5....tj.I.qu2%....H.I....C.'.z4..,...X4.#E.\.k.<..n.....U@..6.Q.2...=@..........f...y.... .....

<<< skipped >>>

GET /fapcf.html HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: version.vinacf.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 12 May 2015 17:32:58 GMT

Server: Apache

Accept-Ranges: bytes

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 737

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: text/html

...........T[S.@.~6.b...Z..JE.t..e.$BDk..!.\4.....;...@Pd..L..9...o.s[...{.wC...x$s.O.P.}d9..!j.....~e.B.6.).i....A.. E.T(..l.").RF....E........q..Y..'.6........ZX.S(s.}.....GA..$...(.X.*,h......v...QQ.......Mp...A...... ..W.kg.W.!V.hY4G.Q.[....cR]...G.......(....7...T.i.@.......... l.,fF8.h..P......lg.K=....*..`..G:Pz.p........\s....?."......*...b"..gP,.... ./HB.U..M....tS..P..c....)..N.fKh5.G5pm..S........`...m..`0....D1......OL....Ma'.5[.wl...q.......R......o.....V..J."......h4...\.V...k%...8...........'.7.c.....P....6;B.SF....?...%.y........1......3.?.r..).........|.....~...".h....~v......y......... ..[.Lk.....,..,..<p<D.U.8F|....1q.k...LO......i!.......a.<.....d.......fJ:G1"V..ds..i}9n.{.... {......-O..."..'N\=.2..e.h.e...HTTP/1.1 200 OK..Date: Tue, 12 May 2015 17:32:58 GMT..Server: Apache..Accept-Ranges: bytes..Vary: Accept-Encoding..Content-Encoding: gzip..Content-Length: 737..Keep-Alive: timeout=5, max=100..Connection: Keep-Alive..Content-Type: text/html.............T[S.@.~6.b...Z..JE.t..e.$BDk..!.\4.....;...@Pd..L..9...o.s[...{.wC...x$s.O.P.}d9..!j.....~e.B.6.).i....A.. E.T(..l.").RF....E........q..Y..'.6........ZX.S(s.}.....GA..$...(.X.*,h......v...QQ.......Mp...A...... ..W.kg.W.!V.hY4G.Q.[....cR]...G.......(....7...T.i.@.......... l.,fF8.h..P......lg.K=....*..`..G:Pz.p........\s....?."......*...b"..gP,.... ./HB.U..M....tS..P..c....)..N.fKh5.G5pm..S........`...m..`0....D1......OL....Ma'.5[.wl...q.......R......o.....V..J."......h4...\.V...k%...8...........'.7.c.....P....6;B.SF....?...%.y......

<<< skipped >>>

GET /small/01/108.png HTTP/1.1

Accept: */*

Referer: hXXp://version.vinacf.com/fapcf.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: widgets.amung.us

HTTP/1.1 200 OK

Server: nginx/1.2.4

Date: Tue, 12 May 2015 17:32:59 GMT

Content-Type: image/png

Content-Length: 329

Last-Modified: Sun, 13 Jun 2010 09:48:29 GMT

Connection: keep-alive

Expires: Thu, 11 Jun 2015 17:32:59 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

.PNG........IHDR...P.........D......9PLTE.bM.nX.82.G:................zc.....z.UC..n.'-00/...555...........IDAT8...... .D........u(.b.......'........q.:.P..N.f..T..{.....1..]...@j.F..p.L.u.l...Y....b.-....IB..B6.C...T..&.v.OE A.8O...HPl.t...]9.7....y.%..,.5.|'.5\.jXvx.r.2m2........|9p.t..!.9W..r..8)S.I....\Y \.I.y.......IEND.B`.HTTP/1.1 200 OK..Server: nginx/1.2.4..Date: Tue, 12 May 2015 17:32:59 GMT..Content-Type: image/png..Content-Length: 329..Last-Modified: Sun, 13 Jun 2010 09:48:29 GMT..Connection: keep-alive..Expires: Thu, 11 Jun 2015 17:32:59 GMT..Cache-Control: max-age=2592000..Accept-Ranges: bytes...PNG........IHDR...P.........D......9PLTE.bM.nX.82.G:................zc.....z.UC..n.'-00/...555...........IDAT8...... .D........u(.b.......'........q.:.P..N.f..T..{.....1..]...@j.F..p.L.u.l...Y....b.-....IB..B6.C...T..&.v.OE A.8O...HPl.t...]9.7....y.%..,.5.|'.5\.jXvx.r.2m2........|9p.t..!.9W..r..8)S.I....\Y \.I.y.......IEND.B`...

GET /swidget/fapcfcomz.png HTTP/1.1

Accept: */*

Referer: hXXp://version.vinacf.com/fapcf.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: whos.amung.us

Connection: Keep-Alive

HTTP/1.1 303 See Other

Date: Tue, 12 May 2015 17:32:59 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: close

Location: hXXp://widgets.amung.us/small/01/108.png

Set-Cookie: uid=CgH9IlVSOUt5CHRs1X6bAg==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=atta; path=/

0..

GET /swidget/fapcfone.png HTTP/1.1

Accept: */*

Referer: hXXp://version.vinacf.com/fapcf.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: whos.amung.us

Connection: Keep-Alive

HTTP/1.1 303 See Other

Date: Tue, 12 May 2015 17:32:59 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: close

Location: hXXp://widgets.amung.us/small/00/43.png

Set-Cookie: uid=CgH9IFVSOUtaI29Goqx4Ag==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=atta; path=/

0..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_484:

.text

`.rdata

@.data

.rsrc

t(j.Xj\f

SSShdxB

^SShq

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

operator

GetProcessWindowStation

USER32.DLL

d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb

COMCTL32.dll

SHLWAPI.dll

GetCPInfo

KERNEL32.dll

USER32.dll

GDI32.dll

COMDLG32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

ADVAPI32.dll

SHFileOperationW

ShellExecuteExW

SHELL32.dll

ole32.dll

OLEAUT32.dll

GetConsoleOutputCP

WINRAR.SFX

c:\%original file name%.exe

version="1.0.0.0"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

Maximum allowed array size (%u) is exceeded

%.*ls(%u)%ls

rtmp%d

Crypt32.dll

GETPASSWORD1

%s %s

%s %s %s

%s%s%d

Software\Microsoft\Windows\CurrentVersion

%s.%d.tmp

winrarsfxmappingfile.tmp

-el -s2 "-d%s" "-p%s" "-sp%s"

__tmp_rar_sfx_access_check_%u

sfxcmd

WaitForMultipleObjects error %d, GetLastError %d

Shell.Explorer

riched20.dll

riched32.dll

KERNEL32.DLL

mscoree.dll

Windows

FAPCF M.EXE_436:

MZKERNEL32.DLL

6/&@@@@@@@@@@@@LLLLLL@@@@@@@@@@@@6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&@@@@@@@@@@@@LLLLLL@@@@@@@@@@@@6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.&5.&6/&6/&6/&6/&6/&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.&5.&5.&5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.&5.&5.&5.&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.'5.'5.'5.'5.&5.&5.&5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.&5.&5.&5.&6/&6/&6/&6/&6/&6/&6/&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&6/&6/&6/&6/&6/&5.&5.&5.&5.&5.&5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.&5.&5.&5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.&5.&5.&5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.'5.'5.'5.'5.'5.'5.'5.'5.'5.&5.&5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.&5.&5.&5.&6/&6/&6/&6/&6/&6/&6/&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.'5.'5.'5.'5.'5.'5.'5.'5.'5.'5.&5.&5.&5.&5.&6/&6/&6/&6/&6/&5.&5.&5.&5.&5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&@@@@@@@@@@@@LLLLLL@@@@@@@@@@@@6/&6/&6/&6/&6/&6/&5.&5.'5.'5.'5.'5.'5.'5.&5.&5.&5.&5.&5.&5.'5.'5.(5.(5.(5.(5.(5.(5.(5.(5.(5.(5.)5.)4.*4.*4.*4.*4.*5.)5.)5.(5.(5.'5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.'5.'5.(5.)5.)5.)5.(5.(5.'5.'5.'5.'5.'5.'5.(5.(5.(5.'5.'5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.'5.'5.(5.)5.)5.)5.(5.(5.'5.'5.'5.'5.'5.'5.(5.(5.(5.(5.(5.(5.(5.(5.(5.)5.)5.)5.)5.)5.)4.*4.*4.*4.*4- 4- 4.*4.*4.*5.)5.(5.'5.&5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.'5.'5.(5.)5.)5.)5.(5.(5.'5.'5.'5.'5.'5.(5.(5.(5.)5.)5.)5.)5.(5.(5.)5.)5.)5.)5.)5.(5.(5.(5.(5.(5.(5.(5.)5.)5.)5.)5.(5.(5.'5.&5.&5.&6/&5.&5.&5.&5.'5.(5.(5.)5.)5.)5.(5.(5.'5.&5.&5.&6/&5.&5.&5.&5.'5.(5.(5.)5.)5.)5.(5.(5.'5.'5.'5.'5.'5.'5.(5.(5.(5.'5.'5.&5.&6/&6/&6/&5.&5.&5.'5.(5.(5.)5.)5.)5.)5.)5.)5.)5.)5.)5.)5.)5.)5.)5.)5.)5.)4.*4.*4.*4.*4.*4.*4- 4- 4- 4- 4- 4- 4.*4.*5.)5.(5.'5.&5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.'5.'5.(5.)5.)5.)5.(5.(5.'5.'5.'5.'5.'5.(5.(5.(5.)5.)5.)5.)5.)5.)5.)5.)5.)5.)5.)4.*4.*4.*4.*4.*4.*4- 4- 4- 4- 4- 4- 4- 4.*4.*4.*4.*5.)5.)5.(5.(5.(5.(5.(5.(5.(5.(5.(5.(5.(5.(5.(5.(5.(5.(5.(5.(5.'5.'5.'5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&@@@@@@@@@@@@LLLLLL@@@@@@@@@@@@6/&6/&6/&6/&5.&5.'5.)4.*4- 4- 4- 4- 4.*5.)5.)5.(5.(5.)4.*4- 4- 4-,4--4--4--4-,4-,4-,4-,4-,4--3-.3,/3,03,03,03,03,03,/3-.4--4-,4- 5.)5.'5.&6/&6/&6/&6/&5.&5.&5.(5.)4.*4- 4--3-.3-.3-.4--4-,4- 4- 4- 4- 4- 4- 4- 4-,4- 4- 4.*5.)5.'5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.&5.(5.)4.*4- 4--3-.3-.3-.4--4-,4- 4- 4- 4- 4- 4- 4-,4-,4--4--4--4--4-,4--4--3-.3-.3-.3-.3,/3,/3,/3,03,03,13,13,13,13,03,/3-.4-,4- 5.)5.(5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.&5.(5.)4.*4- 4--3-.3-.3-.4--4-,4- 4- 4- 4- 4- 4-,4--4--3-.3-.3-.3-.3-.3-.3-.3-.3-.3-.3-.4--4-,4- 4- 4- 4-,4--3-.3-.3-.3-.4--4- 4- 4.*5.(5.(5.'5.(5.(4.*4- 4-,4--3-.3-.3-.4--4-,4- 4.*5.(5.(5.'5.(5.)4.*4- 4-,4--3-.3-.3-.4--4-,4- 4- 4- 4- 4- 4- 4- 4-,4- 4- 4.*5.)5.(5.'5.'5.'5.(5.)4- 4-,4--3-.3-.3-.3-.3-.3-.3-.3-.3-.3-.3-.3-.3-.3-.3-.3,/3,/3,03,03,03,13,13,13,13,13,13,13,13,13,/3-.4-,4- 5.)5.(5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.&5.(5.)4.*4- 4--3-.3-.3-.4--4-,4- 4- 4- 4- 4- 4-,4--4--3-.3-.3-.3-.3-.3-.3,/3,/3,/3,/3,/3,/3,/3,03,03,13,13,13,13,13,13,13,13,13,13,13,03,03,/3-.4--4-,4-,4-,4-,4-,4--4--4--4--4--4-,4-,4-,4-,4-,4-,4-,4- 4- 4.*5.)5.'5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&@@@@@@@@@@@@LLLLLL@@@@@@@@@@@@6/&6/&6/&5.'5.(4- 4--3,03,12,22,23,13,13,/4--4-,4-,4--3,/3,12,32 42 51 62 52 42 42,32 42 51 61 71*81*90*:0*:0*:1*91*81 71 62,33,14--4- 5.(5.'5.&5.&5.&5.'5.)4- 4--3,02,22 51 71 71 71 62 42,23,13,13,13,12,22,32 42,33,13,04--4- 5.(5.'6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.'5.)4- 4--3,02,22 51 71 71 71 62 42,23,13,13,13,12,22 42 52 52 52 52 52 42 51 61 71 71 71 71*81*81*91*90*:0*;0*/)>0*/)A.(B.(B/(B/)A/)?/)?/)@/(B.(C-'F-'H-'H-'I-'I-'I-'I-'H-'F.(B/)>0*:2 53,04-,4.*5.(5.(5.)4- 4--3,11 60*:/)>/(B.(D.(E.(D.(B/)@0)=0*/)?/)@/)?0*/(B.(D.(E.(D.(B/)@0)=0*/)@/(B.(B/(B/(B/)A/)A/)A.(B.(D.(E-'F-'F-'G-'G-'H-'H,'J,&K,&L,&L,&K,'J-'H.(D/)@0*;1 63,14-,5.)5.'6/&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.(4- 4--3,11 60*:/)>/(B.(D.(E.(D.(B/)@0)=0*/)>/)@/(B.(C.(E.(E.(D/(B/)>0*;1 72 42,23,12,22 41 70*;/)>/(B.(D.(D.(D/(B/)>0*;1 72 42,22,22,22 51 70*)?/(B.(D.(E.(D.(B/)@0)=0*/)?/)@/)?0*/(B.(D.(E.(D.(B/)@0)=0*/)>/)?/)@/)@/)?0*0*.(C-'I %O*$T)$V)$V*$T*%R %P %O %P*%S)$W(#Z(#]'"_'"_'"_'"_'"_(#](#Z)$V %O-'H/)?1*83,14--4- 4- 4-,3,02 50*;/)A-'H &N*$T)$X)#Y)#Y)$V*%R &N,&K-'I-'I,&L &N*%R*%S %Q,&M-'G/)?1*83,14-,5.)5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.(4- 3,/2 40*:/)A-'H &N*$T)$X)#Y)#Y)$V*%R &N,&K-'I,'J,&L %O*%S*$U*$U*$U*%S*%R*%R*%S*$T)$W)#Y(#Z(#Z(#Z(#[(#\("^'"_'"a&!b&!c&!b'"`(#])$X %Q-'H/)@1*83,14-,5.(5.&6/&6/&6/&6/&6/&6/&6/&5.&5.(4- 3,/2 40*:/)A-'H &N*$T)$X)#Y)#Y)$V*%R &N,&K-'I,'J,&M %P*$T)$X)#Y(#Z)#Y)$X)$X)$X)$X)#Y(#Z)#Y)#Y*$U*%R %O &N &N %Q*$T)$W)#Y)#Y)$X*$T %O,'J.(D/)@0*

w% h(#Z*%S*%S(#Z% g!

% j*%S/(B1 63-.5.)5.&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.(4- 3,10*;-'H)#Y$

u(#[-'H0*:3,14- 5.'6/&6/&6/&6/&6/&6/&6/&6/&5.&5.)3-.1 6/(B*%S% h

% h %O0)=2,24- 5.'6/&6/&6/&5.&5.)3-.1 6/(B*%S% h

v&!d*%S-'F0*;2,24-,5.(5.&6/&6/&6/&5.'4.*3,10*;-'I'"_

~% g*%S.(B1 73-.5.)5.&6/&6/&5.'4.*3,10*:-'I'"_

x&!d*%S.(C1*83,04- 5.'6/&6/&6/&5.'4- 3,10*

l*%S/(B1 64--5.)5.&6/&6/&5.'4- 2,20)=,&M&!d

o*%S/)A2 44-,5.(6/&6/&5.(4-,2,3/)> %O&!e

% j*%S/(B1 64--5.)5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&1*"%

k*%S/(B2 54--5.(5.&6/&5.'4- 3,10*

% j*%S.(B1 73-.5.)5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&1*"

k*%S/)A2 54--5.(5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&

q)$V.(B1 64--5.)5.&6/&6/&5.&5.)3-.1 7.(B*%S% i

m*%S/)A2 44-,5.(5.&6/&6/&5.&5.(4-,2,20*

% f %O/)>2,34-,5.(6/&6/&6/&5.&5.(4- 3,11*9.(D*%S&!d!

u'"a %O/)@1 63-.5.)5.&6/&6/&6/&6/&6/&5.'4.*3-.2 40*

t% g(#])$V*%S)$V(#\% f"

p% f(#\*%S,&L-'G.(E-'F,&K*%R(#[&!d$

p% f(#\*%S,&L-'G.(E-'G,&L*%S(#\&!e$

72 @@@@@@@@@@@@LLLLLL@@@@@@@@@@@@;71C=55.)4-,3,11*8/)@-'H %Q)$X(#]'"`'"a&!b'"`("^(#Z*$U %P,&L-'I-'I,&L %P*$U)#Y(#$#](#$#Y*$U %P,&L-'I-'I,&L %P*$U)#Y(#]'"_'"_("^(#Z*$U %O-'H.(B0)=0*:1*80*:0*(B-'H,&M*%S)$W)#Y)$X*$T %P,&L-'H-'G-'H,&K %P*$U(#Z("^'"`&!b'"a'"`(#])$X %Q-'I/)A1*83,14-,5.)5.&6/&6/&6/&6/&6/&6/&6/&5.&5.'4.*4--2,21*8/)?-'G,&M*%S)$W)#Y)$X*$T %P,&L-'I-'H-'H,'J &N*%R*$T)$V*$U*%S*%R %Q*%R*$T)$V)#Y)#Y(#Z(#Z(#[(#\("^'"_'"a&!b&!c&!b'"`(#])$X %Q-'H/)@1*83,14-,5.)5.&6/&6/&6/&6/&6/&6/&6/&6/&5.'4.*4--3,11 7/)>.(E,&M*%S)$W)$X)$W*$T %P,&L-'H-'G-'H,&K %P*$U(#Z("^'"`'"a'"`'"_(#Z*$U %O-'H.(B0)=0*:1*90*:0)=.(B-'H &N*%S)$W)$X)$W*%S,&M-'H/(B0*.(E,&M*%S)$W)$X)$W*$T %P,&L-'H-'G-'H,&K %O*%S)$X)#Y(#[(#Z(#Z(#Z(#Z(#\(#](#](#](#\(#\(#[(#\("^'"_'"a&!b&!c&!b'"`("^(#Z*$U %P,&L-'I-'I,&L %P*$U)#Y(#\("^(#](#Z)$W*%S %Q %O %Q*%S)$X(#['"_'"a&!c&!c&!c'"`(#])$X %Q-'I/)A1*83,14-,5.)5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&

SHDocVwCtl.WebBrowser

ieframe.dll

WebBrowser

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

/C:\Windows\System32\ieframe.oca

urlmon

URLDownloadToFileA

Wininet.dll

DeleteUrlCacheEntryA

user32.dll

shell32.dll

ShellExecuteA

ClearWeb

kernel32.dll

PSAPI.DLL

WebADF

ntdll.dll

msvbvm60.dll

VBA6.DLL

advapi32.dll

.cI\:O

ADVAPI32.dll

DCIMAN32.dll

GDI32.dll

KERNEL32.dll

NTDLL.DLL

msvcrt.dll

USER32.dll

DDRAW.dll

.ews7ews

DisableAGPSupport

ForceAGPSupport

D3DIM.DLL

D3DIM700.DLL

FTPSjn

DisableProcessWindowsGhosting

OLE32.DLL

KERNEL32.DLL

CryptCATCatalogInfoFromContext

wintrust.dll

mscat32.dll

RegCreateKeyA

RegOpenKeyExA

RegEnumKeyA

RegCloseKey

RegOpenKeyA

GetAsyncKeyState

GetKeyState

ddraw.pdb

$xsJ%xs{%xs

5%5 515>5

4%5x5

="='=,=2=

: :$:(:,:0:4:8:

? ?$?(?,?0?4?

4I4C4N4n4

31373=3\3`3

4O4Q4W4]4j4r4

5]5H5X9c9i9o9|9

Can't find ordinal import.

MSVCRT.dll

AIN_MSG_DEFINE.msz

REA_MSG_DEFINE.msz

SEA_MSG_DEFINE.msz

NAM_MSG_DEFINE.msz

NES_MSG_DEFINE.msz

/TW_MSG_DEFINE.msz

/RU_MSG_DEFINE.msz

/ID_MSG_DEFINE.msz

/SA_MSG_DEFINE.msz

/EU_MSG_DEFINE.msz

/US_MSG_DEFINE.msz

OFF|KEY: B

OFF|KEY: F

OFF|KEY: R|X1|X2|MAX

[ ]|[ - ]

d3dx9_29.dll

FAPCFLIB.DLL

8 8Â8~8

55]5d5p5

Object.dll

d3d9.dll

Kernel32.dll

EXPLORER.EXE

MSVBVM60.DLL

{%D(G1

%x3~ZqY

/E%f%

rZ%d.$

CZ %.Pc

:ww%d

Ik.PW

o.JV)

@d%X6

%cR"T

UDpK

}V6%U

*.BTI

*%x[\Z

hXXp:///

M*\AE:\DATA G\SYNBOZMAX\DU AN XTRAP MOI\FIX XTRAP 7957\FAPCF MODZ 3.88\Project1.vbp

fapcf001.ddns.net

version.vinacf.com/fapcf.html

font:'Courier New', Courier, monospace;background-color: #000;background-image: url(5000320727_636b010314.jpg);background-repeat: no-repeat;}

.keyclick1 {color: maroon;font-size: 40px;}

.keyclick1:hover {text-decoration: none;color: blue;background: yellow;}

.keyword {font-size: 8px;}

minutes = Math.floor(time / 60);

.box{position:fixed;top:-200px;left:30%;right:30%;background-color: #000;color:#7f7f7f;padding:20px;

a.activator{width:153px;height:150px;position:absolute;top:0px;right:0px;background: url(clickme.png) no-repeat top right;z-index:1;cursor:pointer;}

document.onselectstart=new Function ('return false')

if (window.sidebar){

.overlay{background:transparent url(overlay.png) repeat top left;position:fixed;top:0px;bottom:0px;left:0px;right:0px;z-index:100;}

border:2px solid #ccc;-moz-border-radius: 20px;-webkit-border-radius:20px;-khtml-border-radius:20px;-moz-box-shadow: 0 1px 5px #333;-webkit-box-shadow: 0 1px 5px #333;z-index:101;}

.box h1{border-bottom: 1px dashed #7F7F7F;margin:-20px -20px 0px -20px;padding:10px;background-color:#FF0;color: #000;-moz-border-radius:20px 20px 0px 0px;-webkit-border-top-left-radius: 20px;-webkit-border-top-right-radius: 20px;-khtml-border-top-left-radius: 20px;-khtml-border-top-right-radius: 20px;}

a.boxclose{float:right;width:26px;height:26px;background:transparent url(cancel.png) repeat top left;margin-top:-30px;margin-right:-30px;cursor:pointer;}

.drop { position: absolute; width: 3; filter: flipV(), flipH(); font-size: 40; color: blue }

Document.onmousedown = disableselect

Document.onclick = reEnable}

if (document.all){return false;}}

if(document.layers||(document.getElementById&&!document.all)){

if (e.which==2||e.which==3){

if (document.layers){

document.captureEvents(Event.MOUSEDOWN);

document.onmousedown=nrcNS;

}else{document.onmouseup=nrcNS;document.oncontextmenu=nrcIE;}

document.oncontextmenu=new Function('return false');

var minutes = Math.floor(time / 60);

function stime(){document.getElementById('STATUS').innerHTML = 'AUTO ACTIVE: ' minutes ' MIN ' seconds ' SEC !!'; jgt = jgt - 1;

if(jgt == 0|document.getElementById('KICHHOAT').innerHTML=='100%')

clearInterval(timing);document.getElementById('STATUS').innerHTML='ACTIVE SUCCESS ! PLEASE START GAME NOW !!';

document.getElementById('KICHHOAT').innerHTML='100%';}

AAAAAAF0/SO0MKar_c24/h120/ajax-loader.gif border='0'>

RTHDCPL.EXE

HGWC.exe

XTrap.xt

crossfire.exe

crossfire.dat

EXPLORE.EXE

0123456789

tp://antiweb.zapto.org

\Windows\System32\drivers\etc\hosts

ttp://v.hack-cf.com/anti/anti.php

DDRAW.DLL

crossfire.EXE

crossfire.DAT

HGWC.EXE

VINACF.COM

WEBPOP

ACTIVEWEB

\Windows\System32\drivers\etc\hosts.ics

%System%\RunDll32.exe

RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8

oogle Chorme.lnk

Scripting.FileSystemObject

RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 2

WScript.Shell

WindowStyle

adf.ly/ad/locked

LocationURL

InternetExplorer.Application

adf.ly

sh.st

Windows Internet Explorer

Web Browser

iexplore.exe - Application Error

linkbucks.com

0.0.0.0

hXXp://google.com

Windows 2000

Win32s on Windows 3.1

Windows NT

Windows NT 3.5

Windows NT 4.0

Windows XP

Windows Server 2003

Windows Vista/Server 2008

Windows 7/Server 2008 R2

Windows 8

Windows 95

Windows Me

Windows 98

Unable to identify your version of Windows.

K*\AE:\DATA G\SYNBOZMAX\DU AN XTRAP MOI\FIX XTRAP 7957\FAPCF MODZ 3.88\Project1.vbp

You can change the color depth from the control panel display icon.gYour display driver is not Windows95 compatible.

DirectDraw only supports Windows95 compatible drivers.

FAPCF.COM

0d3d9.dll

EXE.exe

FAPCF M.EXE_436_rwx_00401000_00148000:

6/&@@@@@@@@@@@@LLLLLL@@@@@@@@@@@@6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&@@@@@@@@@@@@LLLLLL@@@@@@@@@@@@6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.&5.&6/&6/&6/&6/&6/&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.&5.&5.&5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.&5.&5.&5.&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.'5.'5.'5.'5.&5.&5.&5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.&5.&5.&5.&6/&6/&6/&6/&6/&6/&6/&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&6/&6/&6/&6/&6/&5.&5.&5.&5.&5.&5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.&5.&5.&5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.&5.&5.&5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.'5.'5.'5.'5.'5.'5.'5.'5.'5.&5.&5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.&5.&5.&5.&6/&6/&6/&6/&6/&6/&6/&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.&5.'5.'5.'5.'5.'5.'5.'5.'5.'5.'5.&5.&5.&5.&5.&6/&6/&6/&6/&6/&5.&5.&5.&5.&5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&@@@@@@@@@@@@LLLLLL@@@@@@@@@@@@6/&6/&6/&6/&6/&6/&5.&5.'5.'5.'5.'5.'5.'5.&5.&5.&5.&5.&5.&5.'5.'5.(5.(5.(5.(5.(5.(5.(5.(5.(5.(5.)5.)4.*4.*4.*4.*4.*5.)5.)5.(5.(5.'5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.'5.'5.(5.)5.)5.)5.(5.(5.'5.'5.'5.'5.'5.'5.(5.(5.(5.'5.'5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.'5.'5.(5.)5.)5.)5.(5.(5.'5.'5.'5.'5.'5.'5.(5.(5.(5.(5.(5.(5.(5.(5.(5.)5.)5.)5.)5.)5.)4.*4.*4.*4.*4- 4- 4.*4.*4.*5.)5.(5.'5.&5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.'5.'5.(5.)5.)5.)5.(5.(5.'5.'5.'5.'5.'5.(5.(5.(5.)5.)5.)5.)5.(5.(5.)5.)5.)5.)5.)5.(5.(5.(5.(5.(5.(5.(5.)5.)5.)5.)5.(5.(5.'5.&5.&5.&6/&5.&5.&5.&5.'5.(5.(5.)5.)5.)5.(5.(5.'5.&5.&5.&6/&5.&5.&5.&5.'5.(5.(5.)5.)5.)5.(5.(5.'5.'5.'5.'5.'5.'5.(5.(5.(5.'5.'5.&5.&6/&6/&6/&5.&5.&5.'5.(5.(5.)5.)5.)5.)5.)5.)5.)5.)5.)5.)5.)5.)5.)5.)5.)5.)4.*4.*4.*4.*4.*4.*4- 4- 4- 4- 4- 4- 4.*4.*5.)5.(5.'5.&5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.'5.'5.(5.)5.)5.)5.(5.(5.'5.'5.'5.'5.'5.(5.(5.(5.)5.)5.)5.)5.)5.)5.)5.)5.)5.)5.)4.*4.*4.*4.*4.*4.*4- 4- 4- 4- 4- 4- 4- 4.*4.*4.*4.*5.)5.)5.(5.(5.(5.(5.(5.(5.(5.(5.(5.(5.(5.(5.(5.(5.(5.(5.(5.(5.'5.'5.'5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&@@@@@@@@@@@@LLLLLL@@@@@@@@@@@@6/&6/&6/&6/&5.&5.'5.)4.*4- 4- 4- 4- 4.*5.)5.)5.(5.(5.)4.*4- 4- 4-,4--4--4--4-,4-,4-,4-,4-,4--3-.3,/3,03,03,03,03,03,/3-.4--4-,4- 5.)5.'5.&6/&6/&6/&6/&5.&5.&5.(5.)4.*4- 4--3-.3-.3-.4--4-,4- 4- 4- 4- 4- 4- 4- 4-,4- 4- 4.*5.)5.'5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.&5.(5.)4.*4- 4--3-.3-.3-.4--4-,4- 4- 4- 4- 4- 4- 4-,4-,4--4--4--4--4-,4--4--3-.3-.3-.3-.3,/3,/3,/3,03,03,13,13,13,13,03,/3-.4-,4- 5.)5.(5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.&5.(5.)4.*4- 4--3-.3-.3-.4--4-,4- 4- 4- 4- 4- 4-,4--4--3-.3-.3-.3-.3-.3-.3-.3-.3-.3-.3-.4--4-,4- 4- 4- 4-,4--3-.3-.3-.3-.4--4- 4- 4.*5.(5.(5.'5.(5.(4.*4- 4-,4--3-.3-.3-.4--4-,4- 4.*5.(5.(5.'5.(5.)4.*4- 4-,4--3-.3-.3-.4--4-,4- 4- 4- 4- 4- 4- 4- 4-,4- 4- 4.*5.)5.(5.'5.'5.'5.(5.)4- 4-,4--3-.3-.3-.3-.3-.3-.3-.3-.3-.3-.3-.3-.3-.3-.3-.3,/3,/3,03,03,03,13,13,13,13,13,13,13,13,13,/3-.4-,4- 5.)5.(5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.&5.(5.)4.*4- 4--3-.3-.3-.4--4-,4- 4- 4- 4- 4- 4-,4--4--3-.3-.3-.3-.3-.3-.3,/3,/3,/3,/3,/3,/3,/3,03,03,13,13,13,13,13,13,13,13,13,13,13,03,03,/3-.4--4-,4-,4-,4-,4-,4--4--4--4--4--4-,4-,4-,4-,4-,4-,4-,4- 4- 4.*5.)5.'5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&@@@@@@@@@@@@LLLLLL@@@@@@@@@@@@6/&6/&6/&5.'5.(4- 4--3,03,12,22,23,13,13,/4--4-,4-,4--3,/3,12,32 42 51 62 52 42 42,32 42 51 61 71*81*90*:0*:0*:1*91*81 71 62,33,14--4- 5.(5.'5.&5.&5.&5.'5.)4- 4--3,02,22 51 71 71 71 62 42,23,13,13,13,12,22,32 42,33,13,04--4- 5.(5.'6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.'5.)4- 4--3,02,22 51 71 71 71 62 42,23,13,13,13,12,22 42 52 52 52 52 52 42 51 61 71 71 71 71*81*81*91*90*:0*;0*/)>0*/)A.(B.(B/(B/)A/)?/)?/)@/(B.(C-'F-'H-'H-'I-'I-'I-'I-'H-'F.(B/)>0*:2 53,04-,4.*5.(5.(5.)4- 4--3,11 60*:/)>/(B.(D.(E.(D.(B/)@0)=0*/)?/)@/)?0*/(B.(D.(E.(D.(B/)@0)=0*/)@/(B.(B/(B/(B/)A/)A/)A.(B.(D.(E-'F-'F-'G-'G-'H-'H,'J,&K,&L,&L,&K,'J-'H.(D/)@0*;1 63,14-,5.)5.'6/&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.(4- 4--3,11 60*:/)>/(B.(D.(E.(D.(B/)@0)=0*/)>/)@/(B.(C.(E.(E.(D/(B/)>0*;1 72 42,23,12,22 41 70*;/)>/(B.(D.(D.(D/(B/)>0*;1 72 42,22,22,22 51 70*)?/(B.(D.(E.(D.(B/)@0)=0*/)?/)@/)?0*/(B.(D.(E.(D.(B/)@0)=0*/)>/)?/)@/)@/)?0*0*.(C-'I %O*$T)$V)$V*$T*%R %P %O %P*%S)$W(#Z(#]'"_'"_'"_'"_'"_(#](#Z)$V %O-'H/)?1*83,14--4- 4- 4-,3,02 50*;/)A-'H &N*$T)$X)#Y)#Y)$V*%R &N,&K-'I-'I,&L &N*%R*%S %Q,&M-'G/)?1*83,14-,5.)5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.(4- 3,/2 40*:/)A-'H &N*$T)$X)#Y)#Y)$V*%R &N,&K-'I,'J,&L %O*%S*$U*$U*$U*%S*%R*%R*%S*$T)$W)#Y(#Z(#Z(#Z(#[(#\("^'"_'"a&!b&!c&!b'"`(#])$X %Q-'H/)@1*83,14-,5.(5.&6/&6/&6/&6/&6/&6/&6/&5.&5.(4- 3,/2 40*:/)A-'H &N*$T)$X)#Y)#Y)$V*%R &N,&K-'I,'J,&M %P*$T)$X)#Y(#Z)#Y)$X)$X)$X)$X)#Y(#Z)#Y)#Y*$U*%R %O &N &N %Q*$T)$W)#Y)#Y)$X*$T %O,'J.(D/)@0*

w% h(#Z*%S*%S(#Z% g!

% j*%S/(B1 63-.5.)5.&6/&6/&6/&6/&6/&6/&6/&6/&5.&5.(4- 3,10*;-'H)#Y$

u(#[-'H0*:3,14- 5.'6/&6/&6/&6/&6/&6/&6/&6/&5.&5.)3-.1 6/(B*%S% h

% h %O0)=2,24- 5.'6/&6/&6/&5.&5.)3-.1 6/(B*%S% h

v&!d*%S-'F0*;2,24-,5.(5.&6/&6/&6/&5.'4.*3,10*;-'I'"_

~% g*%S.(B1 73-.5.)5.&6/&6/&5.'4.*3,10*:-'I'"_

x&!d*%S.(C1*83,04- 5.'6/&6/&6/&5.'4- 3,10*

l*%S/(B1 64--5.)5.&6/&6/&5.'4- 2,20)=,&M&!d

o*%S/)A2 44-,5.(6/&6/&5.(4-,2,3/)> %O&!e

% j*%S/(B1 64--5.)5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&1*"%

k*%S/(B2 54--5.(5.&6/&5.'4- 3,10*

% j*%S.(B1 73-.5.)5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&1*"

k*%S/)A2 54--5.(5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&

q)$V.(B1 64--5.)5.&6/&6/&5.&5.)3-.1 7.(B*%S% i

m*%S/)A2 44-,5.(5.&6/&6/&5.&5.(4-,2,20*

% f %O/)>2,34-,5.(6/&6/&6/&5.&5.(4- 3,11*9.(D*%S&!d!

u'"a %O/)@1 63-.5.)5.&6/&6/&6/&6/&6/&5.'4.*3-.2 40*

t% g(#])$V*%S)$V(#\% f"

p% f(#\*%S,&L-'G.(E-'F,&K*%R(#[&!d$

p% f(#\*%S,&L-'G.(E-'G,&L*%S(#\&!e$

72 @@@@@@@@@@@@LLLLLL@@@@@@@@@@@@;71C=55.)4-,3,11*8/)@-'H %Q)$X(#]'"`'"a&!b'"`("^(#Z*$U %P,&L-'I-'I,&L %P*$U)#Y(#$#](#$#Y*$U %P,&L-'I-'I,&L %P*$U)#Y(#]'"_'"_("^(#Z*$U %O-'H.(B0)=0*:1*80*:0*(B-'H,&M*%S)$W)#Y)$X*$T %P,&L-'H-'G-'H,&K %P*$U(#Z("^'"`&!b'"a'"`(#])$X %Q-'I/)A1*83,14-,5.)5.&6/&6/&6/&6/&6/&6/&6/&5.&5.'4.*4--2,21*8/)?-'G,&M*%S)$W)#Y)$X*$T %P,&L-'I-'H-'H,'J &N*%R*$T)$V*$U*%S*%R %Q*%R*$T)$V)#Y)#Y(#Z(#Z(#[(#\("^'"_'"a&!b&!c&!b'"`(#])$X %Q-'H/)@1*83,14-,5.)5.&6/&6/&6/&6/&6/&6/&6/&6/&5.'4.*4--3,11 7/)>.(E,&M*%S)$W)$X)$W*$T %P,&L-'H-'G-'H,&K %P*$U(#Z("^'"`'"a'"`'"_(#Z*$U %O-'H.(B0)=0*:1*90*:0)=.(B-'H &N*%S)$W)$X)$W*%S,&M-'H/(B0*.(E,&M*%S)$W)$X)$W*$T %P,&L-'H-'G-'H,&K %O*%S)$X)#Y(#[(#Z(#Z(#Z(#Z(#\(#](#](#](#\(#\(#[(#\("^'"_'"a&!b&!c&!b'"`("^(#Z*$U %P,&L-'I-'I,&L %P*$U)#Y(#\("^(#](#Z)$W*%S %Q %O %Q*%S)$X(#['"_'"a&!c&!c&!c'"`(#])$X %Q-'I/)A1*83,14-,5.)5.&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&6/&

SHDocVwCtl.WebBrowser

ieframe.dll

WebBrowser

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

/C:\Windows\System32\ieframe.oca

urlmon

URLDownloadToFileA

Wininet.dll

DeleteUrlCacheEntryA

user32.dll

shell32.dll

ShellExecuteA

ClearWeb

kernel32.dll

PSAPI.DLL

WebADF

ntdll.dll

msvbvm60.dll

VBA6.DLL

advapi32.dll

.cI\:O

ADVAPI32.dll

DCIMAN32.dll

GDI32.dll

KERNEL32.dll

NTDLL.DLL

msvcrt.dll

USER32.dll

DDRAW.dll

.ews7ews

DisableAGPSupport

ForceAGPSupport

D3DIM.DLL

D3DIM700.DLL

FTPSjn

DisableProcessWindowsGhosting

OLE32.DLL

KERNEL32.DLL

CryptCATCatalogInfoFromContext

wintrust.dll

mscat32.dll

RegCreateKeyA

RegOpenKeyExA

RegEnumKeyA

RegCloseKey

RegOpenKeyA

GetAsyncKeyState

GetKeyState

ddraw.pdb

$xsJ%xs{%xs

5%5 515>5

4%5x5

="='=,=2=

: :$:(:,:0:4:8:

? ?$?(?,?0?4?

4I4C4N4n4

31373=3\3`3

4O4Q4W4]4j4r4

5]5H5X9c9i9o9|9

Can't find ordinal import.

MSVCRT.dll

AIN_MSG_DEFINE.msz

REA_MSG_DEFINE.msz

SEA_MSG_DEFINE.msz

NAM_MSG_DEFINE.msz

NES_MSG_DEFINE.msz

/TW_MSG_DEFINE.msz

/RU_MSG_DEFINE.msz

/ID_MSG_DEFINE.msz

/SA_MSG_DEFINE.msz

/EU_MSG_DEFINE.msz

/US_MSG_DEFINE.msz

OFF|KEY: B

OFF|KEY: F

OFF|KEY: R|X1|X2|MAX

[ ]|[ - ]

d3dx9_29.dll

FAPCFLIB.DLL

8 8Â8~8

55]5d5p5

Object.dll

d3d9.dll

Kernel32.dll

EXPLORER.EXE

MSVBVM60.DLL

hXXp:///

M*\AE:\DATA G\SYNBOZMAX\DU AN XTRAP MOI\FIX XTRAP 7957\FAPCF MODZ 3.88\Project1.vbp

fapcf001.ddns.net

version.vinacf.com/fapcf.html

font:'Courier New', Courier, monospace;background-color: #000;background-image: url(5000320727_636b010314.jpg);background-repeat: no-repeat;}

.keyclick1 {color: maroon;font-size: 40px;}

.keyclick1:hover {text-decoration: none;color: blue;background: yellow;}

.keyword {font-size: 8px;}

minutes = Math.floor(time / 60);

.box{position:fixed;top:-200px;left:30%;right:30%;background-color: #000;color:#7f7f7f;padding:20px;

a.activator{width:153px;height:150px;position:absolute;top:0px;right:0px;background: url(clickme.png) no-repeat top right;z-index:1;cursor:pointer;}

document.onselectstart=new Function ('return false')

if (window.sidebar){

.overlay{background:transparent url(overlay.png) repeat top left;position:fixed;top:0px;bottom:0px;left:0px;right:0px;z-index:100;}

border:2px solid #ccc;-moz-border-radius: 20px;-webkit-border-radius:20px;-khtml-border-radius:20px;-moz-box-shadow: 0 1px 5px #333;-webkit-box-shadow: 0 1px 5px #333;z-index:101;}

.box h1{border-bottom: 1px dashed #7F7F7F;margin:-20px -20px 0px -20px;padding:10px;background-color:#FF0;color: #000;-moz-border-radius:20px 20px 0px 0px;-webkit-border-top-left-radius: 20px;-webkit-border-top-right-radius: 20px;-khtml-border-top-left-radius: 20px;-khtml-border-top-right-radius: 20px;}

a.boxclose{float:right;width:26px;height:26px;background:transparent url(cancel.png) repeat top left;margin-top:-30px;margin-right:-30px;cursor:pointer;}

.drop { position: absolute; width: 3; filter: flipV(), flipH(); font-size: 40; color: blue }

Document.onmousedown = disableselect

Document.onclick = reEnable}

if (document.all){return false;}}

if(document.layers||(document.getElementById&&!document.all)){

if (e.which==2||e.which==3){

if (document.layers){

document.captureEvents(Event.MOUSEDOWN);

document.onmousedown=nrcNS;

}else{document.onmouseup=nrcNS;document.oncontextmenu=nrcIE;}

document.oncontextmenu=new Function('return false');

var minutes = Math.floor(time / 60);

function stime(){document.getElementById('STATUS').innerHTML = 'AUTO ACTIVE: ' minutes ' MIN ' seconds ' SEC !!'; jgt = jgt - 1;

if(jgt == 0|document.getElementById('KICHHOAT').innerHTML=='100%')

clearInterval(timing);document.getElementById('STATUS').innerHTML='ACTIVE SUCCESS ! PLEASE START GAME NOW !!';

document.getElementById('KICHHOAT').innerHTML='100%';}

AAAAAAF0/SO0MKar_c24/h120/ajax-loader.gif border='0'>

RTHDCPL.EXE

HGWC.exe

XTrap.xt

crossfire.exe

crossfire.dat

EXPLORE.EXE

0123456789

tp://antiweb.zapto.org

\Windows\System32\drivers\etc\hosts

ttp://v.hack-cf.com/anti/anti.php

DDRAW.DLL

crossfire.EXE

crossfire.DAT

HGWC.EXE

VINACF.COM

WEBPOP

ACTIVEWEB

\Windows\System32\drivers\etc\hosts.ics

%System%\RunDll32.exe

RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8

oogle Chorme.lnk

Scripting.FileSystemObject

RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 2

WScript.Shell

WindowStyle

adf.ly/ad/locked

LocationURL

InternetExplorer.Application

adf.ly

sh.st

Windows Internet Explorer

Web Browser

iexplore.exe - Application Error

linkbucks.com

0.0.0.0

hXXp://google.com

Windows 2000

Win32s on Windows 3.1

Windows NT

Windows NT 3.5

Windows NT 4.0

Windows XP

Windows Server 2003

Windows Vista/Server 2008

Windows 7/Server 2008 R2

Windows 8

Windows 95

Windows Me

Windows 98

Unable to identify your version of Windows.

K*\AE:\DATA G\SYNBOZMAX\DU AN XTRAP MOI\FIX XTRAP 7957\FAPCF MODZ 3.88\Project1.vbp

You can change the color depth from the control panel display icon.gYour display driver is not Windows95 compatible.

DirectDraw only supports Windows95 compatible drivers.

FAPCF.COM

0d3d9.dll

FAPCF M.EXE_436_rwx_00579000_00008000:

*%x[\Z

RunDll32.exe_868:

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

GDI32.dll

USER32.dll

IMAGEHLP.dll

rundll32.pdb

.....eZXnnnnnnnnnnnn3

....eDXnnnnnnnnnnnn3

...eDXnnnnnnnnnnnn,

.eDXnnnnnnnnnnnn,

%Xnnnnnnnnnnnnnnn1

O3$dS7"%U9

.manifest

5.1.2600.5512 (xpsp.080413-2105)

RUNDLL.EXE

Windows

Operating System

5.1.2600.5512

YThere is not enough memory to run the file %s.

Please close other windows and try again.

9The file %s or one of its components could not be opened.

0The file %s or one of its components cannot run.

MThe file %s or one of its components requires a different version of Windows.

UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"

Error in %s

Missing entry:%s

Error loading %s

RunDll32.exe_516:

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

GDI32.dll

USER32.dll

IMAGEHLP.dll

rundll32.pdb

.....eZXnnnnnnnnnnnn3

....eDXnnnnnnnnnnnn3

...eDXnnnnnnnnnnnn,

.eDXnnnnnnnnnnnn,

%Xnnnnnnnnnnnnnnn1

O3$dS7"%U9

.manifest

5.1.2600.5512 (xpsp.080413-2105)

RUNDLL.EXE

Windows

Operating System

5.1.2600.5512

YThere is not enough memory to run the file %s.

Please close other windows and try again.

9The file %s or one of its components could not be opened.

0The file %s or one of its components cannot run.

MThe file %s or one of its components requires a different version of Windows.

UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"

Error in %s

Missing entry:%s

Error loading %s

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps