Offset	Size	Type	String
01b0	00000005	A	.text
01d7	00000007	A	`.rdata
01ff	00000006	A	@.data
0228	00000006	A	.reloc
1236	00000005	A	PhoQ@
126d	00000005	A	PhdQ@
18f9	00000005	A	Ph'Q@
1912	00000005	A	Ph0Q@
1c52	00000007	A	SWVh:Q@
294a	0000000f	A	CreateWindowExA
295c	0000000e	A	DefWindowProcA
296e	00000010	A	DispatchMessageA
2982	0000000b	A	EnumWindows
2990	0000000d	A	GetClassNameA
29a0	0000000b	A	GetMessageA
29ae	0000000e	A	GetWindowTextA
29c0	00000018	A	GetWindowThreadProcessId
29dc	0000000b	A	LoadCursorA
29ea	00000009	A	LoadIconA
29f6	0000000e	A	RegisterClassA
2a08	0000000c	A	SendMessageA
2a18	0000000a	A	ShowWindow
2a26	00000010	A	TranslateMessage
2a3a	0000000c	A	UpdateWindow
2a4a	00000009	A	wsprintfA
2a54	0000000a	A	user32.dll
2a62	0000000b	A	CloseHandle
2a70	0000000c	A	CreateEventA
2a80	0000000b	A	CreateFileA
2a8e	0000000c	A	CreateMutexA
2a9e	0000000c	A	CreateThread
2aae	0000000b	A	DeleteFileA
2abc	0000000b	A	ExitProcess
2aca	00000014	A	FileTimeToSystemTime
2ae2	0000000f	A	GetCommandLineA
2af4	0000000f	A	GetCommandLineW
2b06	00000011	A	GetCurrentProcess
2b1a	00000013	A	GetCurrentProcessId
2b30	0000000c	A	GetLocalTime
2b40	00000012	A	GetModuleFileNameA
2b56	00000010	A	GetModuleHandleA
2b6a	0000000e	A	GetProcAddress
2b7c	0000000c	A	GetTempPathA
2b8c	00000015	A	GetVolumeInformationA
2ba4	0000000a	A	LocalAlloc
2bb2	00000009	A	LocalFree
2bbe	0000000a	A	OpenMutexA
2bcc	0000000b	A	OpenProcess
2bda	00000008	A	SetEvent
2be6	0000000e	A	SetFilePointer
2bf8	00000005	A	Sleep
2c00	00000014	A	SystemTimeToFileTime
2c18	0000000c	A	VirtualAlloc
2c28	0000000b	A	VirtualFree
2c36	00000013	A	WaitForSingleObject
2c4c	00000009	A	WriteFile
2c56	0000000c	A	kernel32.dll
2c66	00000012	A	GetSidSubAuthority
2c7c	00000013	A	GetTokenInformation
2c92	00000010	A	OpenProcessToken
2ca4	0000000c	A	advapi32.dll
2cb4	0000000a	A	WSACleanup
2cc2	0000000a	A	WSAStartup
2cd0	0000000b	A	closesocket
2cde	00000007	A	connect
2ce8	00000005	A	htons
2cf0	0000000b	A	ioctlsocket
2d06	00000006	A	select
2d18	0000000a	A	setsockopt
2d26	00000008	A	shutdown
2d32	00000006	A	socket
2d3a	0000000b	A	wsock32.dll
2d48	00000012	A	CommandLineToArgvW
2d5c	0000000b	A	shell32.dll
2d6a	00000008	A	WSAIoctl
2d76	0000000c	A	freeaddrinfo
2d86	0000000b	A	getaddrinfo
2d92	0000000a	A	ws2_32.dll
2da0	00000010	A	CoCreateInstance
2db4	0000000c	A	CoInitialize
2dc4	0000000e	A	CoUninitialize
2dd4	00000009	A	ole32.dll
2de0	0000000e	A	GetUserNameExA
2df2	0000000e	A	GetUserNameExW
2e02	0000000b	A	secur32.dll
2e10	00000014	A	GetModuleFileNameExA
2e26	00000009	A	psapi.dll
3000	00000009	A	BEGINDATA
300a	00000010	A	HOST1:babama.wtf
303d	0000000e	A	HOST2:shops.gt
304c	00000005	A	3.202
3070	0000000a	A	PORT1:4224
310a	00000006	A	Fwow64
3111	00000005	A	start
3117	0000000f	A	ALLUSERSPROFILE
3127	00000008	A	win32app
3130	00000009	A	Microsoft
313a	0000000c	A	kernel32.dll
3147	0000000e	A	IsWow64Process
3156	0000000d	A	RtlGetVersion
3164	0000000a	A	powershell
316f	00000026	A	-WindowStyle Hidden -ep bypass -file "
3196	00000009	A	ntdll.dll
31a0	0000000a	A	LdrLoadDll
3445	00000007	A	=8>o>d?
