HEUR:Trojan.Win32.Generic (Kaspersky), Dropped:Trojan.Generic.20431497 (B) (Emsisoft), Dropped:Trojan.Generic.20431497 (AdAware), WormRebhip.YR, GenericAutorunWorm.YR, GenericInjector.YR (Lavasoft MAS)Behaviour: Trojan, Worm, WormAutorun
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 532af9c75dce2233446404c03553e861
SHA1: 043fff68de94db96335612faa7cae8ee94f7d17f
SHA256: 78088ca86f71a74fb64c9afcf39de365643b50773c2cb71c03ae7d2c01ee7d48
SSDeep: 24576:gWMoZYA9FBpgb73top/e6jJBWjjDpHbGu6f/IYBJAfO:gWMoXcbztop/eHnDpHbGuO/9 fO
Size: 930747 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company:
Created at: 2007-03-31 18:09:55
Analyzed on: Windows7 SP1 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
| Behaviour | Description |
|---|---|
| WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Dropped's file once a user opens a drive's folder in Windows Explorer. |
Process activity
The Dropped creates the following process(es):
svr.exe:1928
svr.exe:2452
chrome.exe:892
chrome.exe:3336
%original file name%.exe:600
net.exe:260
net.exe:3616
The Dropped injects its code into the following process(es):
ForcerX __.exe:848
WerFault.exe:2752
chrome.exe:3948
chrome.exe:2836
iexplore.exe:2856
Explorer.EXE:284
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process svr.exe:1928 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\XX--XX--XX.txt (235 bytes)
C:\Windows\.Explorer\chrome.exe (3361 bytes)
The process svr.exe:2452 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1377F7115F1F126A15360369B165211 (850 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar259A.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\696F3DE637E6DE85B458996D49D759AD (852 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1377F7115F1F126A15360369B165211 (553 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\696F3DE637E6DE85B458996D49D759AD (813 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab2599.tmp (51 bytes)
The Dropped deletes the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab2599.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar259A.tmp (0 bytes)
The process chrome.exe:2836 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Roaming\logs.dat (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat (80 bytes)
C:\Windows\.Explorer\chrome.exe (585 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UuU.uUu (48 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\XxX.xXx (9984 bytes)
The Dropped deletes the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\XX--XX--XX.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\XxX.xXx (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UuU.uUu (0 bytes)
The process chrome.exe:3336 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar33AE.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab33AD.tmp (51 bytes)
The Dropped deletes the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar33AE.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab33AD.tmp (0 bytes)
The process %original file name%.exe:600 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\svr.exe (14887 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\net.exe (11288 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ForcerX __.exe (16751 bytes)
The Dropped deletes the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsxF42D.tmp (0 bytes)
The process net.exe:260 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1377F7115F1F126A15360369B165211 (810 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar25AA.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\696F3DE637E6DE85B458996D49D759AD (852 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1377F7115F1F126A15360369B165211 (553 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab25A9.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\696F3DE637E6DE85B458996D49D759AD (813 bytes)
The Dropped deletes the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab25A9.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar25AA.tmp (0 bytes)
The process net.exe:3616 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):
%Program Files%\Internet Explorer\.Install\iexplore.exe (6238 bytes)
Registry activity
The process WerFault.exe:2752 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug]
"ExceptionRecord" = "52 43 43 E0 01 00 00 00 00 00 00 00 6F D3 99 75"
[HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug\UIHandles]
"FirstLevelConsentDialog" = "Type: REG_QWORD, Length: 8"
[HKCU\Software\Microsoft\Windows\Windows Error Reporting\Debug\UIHandles]
"FirstLevelConsentDialog" = "Type: REG_QWORD, Length: 8"
The process svr.exe:1928 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"Policies" = "C:\Windows\.Explorer\chrome.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
"Policies" = "C:\Windows\.Explorer\chrome.exe"
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{R4HO3P73-3T4D-L24F-8OW1-H303XPIF7875}]
"StubPath" = "C:\Windows\.Explorer\chrome.exe Restart"
To automatically run itself each time Windows is booted, the Dropped adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"HKCU" = "C:\Windows\.Explorer\chrome.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HKLM" = "C:\Windows\.Explorer\chrome.exe"
The process svr.exe:2452 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"
The process chrome.exe:2836 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\OOOO]
"FirstExecution" = "12/02/2017 -- 19:58"
[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"
[HKCU\Software\Google\Chrome\BLBeacon]
"failed_count" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"
[HKCU\Software\Google\Chrome\BLBeacon]
"State" = "2"
[HKCU\Software\OOOO]
"NewIdentification" = "OOOO"
The Dropped deletes the following value(s) in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
The process chrome.exe:3336 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"
The process %original file name%.exe:600 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"
The Dropped deletes the following value(s) in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
The process net.exe:260 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"
Dropped PE files
| MD5 | File path |
|---|---|
| 731ce4c7fd102165ce1b348a221a2d69 | c:\Program Files\Internet Explorer\.Install\iexplore.exe |
| 6ec0daea2389f8702c16005316bab115 | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ForcerX __.exe |
| 731ce4c7fd102165ce1b348a221a2d69 | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\net.exe |
| 1b04f33b5f2cb99c07e8df6a67300fcb | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\svr.exe |
| 1b04f33b5f2cb99c07e8df6a67300fcb | c:\Windows\.Explorer\chrome.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Dropped's file once a user opens a drive's folder in Windows Explorer.
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
svr.exe:1928
svr.exe:2452
chrome.exe:892
chrome.exe:3336
%original file name%.exe:600
net.exe:260
net.exe:3616 - Delete the original Dropped file.
- Delete or disinfect the following files created/modified by the Dropped:
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\XX--XX--XX.txt (235 bytes)
C:\Windows\.Explorer\chrome.exe (3361 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1377F7115F1F126A15360369B165211 (850 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar259A.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\696F3DE637E6DE85B458996D49D759AD (852 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1377F7115F1F126A15360369B165211 (553 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\696F3DE637E6DE85B458996D49D759AD (813 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab2599.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\logs.dat (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat (80 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UuU.uUu (48 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\XxX.xXx (9984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar33AE.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab33AD.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\svr.exe (14887 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\net.exe (11288 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ForcerX __.exe (16751 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar25AA.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab25A9.tmp (51 bytes)
%Program Files%\Internet Explorer\.Install\iexplore.exe (6238 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"HKCU" = "C:\Windows\.Explorer\chrome.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HKLM" = "C:\Windows\.Explorer\chrome.exe" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| .text | 4096 | 23482 | 23552 | 4.48952 | 399636e1cf123faa9dc0c1c1ed9a4a52 |
| .rdata | 28672 | 4592 | 4608 | 3.65683 | f359cd50555a06c1946c9624440c5811 |
| .data | 36864 | 155860 | 1024 | 3.57555 | b6778f27be20a78cfc5e0496758eda32 |
| .ndata | 196608 | 32768 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
| .rsrc | 229376 | 5256 | 5632 | 3.20986 | 3d2e323a5e8cdb1d8dcaa466ba0414d2 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
| URL | IP |
|---|---|
| hxxp://a1363.dscg.akamai.net/pki/crl/products/microsoftrootcert.crl | |
| hxxp://a1363.dscg.akamai.net/pki/crl/products/CodeSigPCA.crl | |
| hxxp://gpla1.wac.v2cdn.net/CRL/Omniroot2025.crl | |
| hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAKQll6RM0DNpmNM7zH3/Qc= | |
| hxxp://cs9.wpc.v0cdn.net/pki/mscorp/crl/MSIT Machine Auth CA 2(1).crl | |
| hxxp://cdp1.public-trust.com/CRL/Omniroot2025.crl | 93.184.220.20 |
| hxxp://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl | 212.30.134.167 |
| hxxp://crl.microsoft.com/pki/crl/products/CodeSigPCA.crl | 212.30.134.167 |
| hxxp://mscrl.microsoft.com/pki/mscorp/crl/MSIT Machine Auth CA 2(1).crl | 93.184.221.200 |
| hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAKQll6RM0DNpmNM7zH3/Qc= | 23.55.155.27 |
| sopranos.info.ve | 91.200.12.44 |
| dns.msftncsi.com | 131.107.255.255 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1
Cache-Control: max-age = 808
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 09 Oct 2013 05:02:17 GMT
If-None-Match: "9c3f3dbaacc4ce1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com
HTTP/1.1 200 OK
Content-Type: application/pkix-crl
Last-Modified: Sun, 05 Feb 2017 06:01:25 GMT
Accept-Ranges: bytes
ETag: "45949148757fd21:0"
Server: Microsoft-IIS/8.5
VTag: 43870257100000000
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Content-Length: 813
Cache-Control: max-age=900
Date: Sun, 12 Feb 2017 17:58:14 GMT
Connection: keep-alive
0..)0......0...*.H........0_1.0.....&...,d....com1.0.....&...,d....microsoft1-0 ..U...$Microsoft Root Certificate Authority..170204214852Z..170506100852Z0.0...a......../..100208014912Z._0]0...U.#..0......`@V'..%..*..S.Y..0... .....7.......0...U......20... .....7......170505215852Z0...*.H.............4..].s.v.m&$.'1..q.Z........V`..,O..<.%S...7.0#.a....[.e..%...r/.pcp.....y.O4X..kH..^...74................h.0^...s...|........)|V).c..hI........]5'}.!.\......._.eB.....)<^u.T.?.c...?$....MI.....z.^.V.H.....6.1.a...o.S.n%.(...I.....S$o ..^.'...ho)..,;..a}...A....p|s.N......i.8M9..6..B.n{.....*p..0.D.....&u....c.`T....{D[.........-..Xtw.b!.pA..a..*..U......~*.....gdY.2"Y}......oz.u...2_.Lo/Hc.[.Y.=.H....Zn...m.....Eza.7.....p.bz....N.*..3.Mh.N...=.&D#}..K..*?h...%...x3....`k...i.`....O<.5.......[N..!k2F....y~HTTP/1.1 200 OK..Content-Type: application/pkix-crl..Last-Modified: Sun, 05 Feb 2017 06:01:25 GMT..Accept-Ranges: bytes..ETag: "45949148757fd21:0"..Server: Microsoft-IIS/8.5..VTag: 43870257100000000..P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Content-Length: 813..Cache-Control: max-age=900..Date: Sun, 12 Feb 2017 17:58:14 GMT..Connection: keep-alive..0..)0......0...*.H........0_1.0.....&...,d....com1.0.....&...,d....microsoft1-0 ..U...$Microsoft Root Certificate Authority..170204214852Z..170506100852Z0.0...a......../..100208014912Z._0]0...U.#..0......`@V'..%..*..S.Y..0... .....7.......0...U......20... .....7..
<<< skipped >>>
GET /pki/crl/products/CodeSigPCA.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com
HTTP/1.1 200 OK
Content-Type: application/pkix-crl
Last-Modified: Wed, 09 Nov 2016 06:00:35 GMT
Accept-Ranges: bytes
ETag: "c155b5964e3ad21:0"
Server: Microsoft-IIS/8.5
VTag: 791406157300000000
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Content-Length: 553
Cache-Control: max-age=900
Date: Sun, 12 Feb 2017 17:58:19 GMT
Connection: keep-alive
0..%0......0...*.H........0y1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1#0!..U....Microsoft Code Signing PCA..161108080000Z0 0)..a.\......5..091029235355Z0.0...U........B0@0...U.#..0...WEt.]...C...T-.2..H.0... .....7.......0...U........0...*.H.............rK.Z...>4.V.V&.iy.k(i\.......[..I...........fAK./..or.._.....I.\..r.,_R.....r.u.]|...G&a...n%...........y...............j.\.y4iT.........i.w.V>.9q.,.o...........X......X....j.-%v]t....L...zJqA..Nu?.........B....G...kZc.I...xUn..bE.;...V.V..WX..!........8k.HTTP/1.1 200 OK..Content-Type: application/pkix-crl..Last-Modified: Wed, 09 Nov 2016 06:00:35 GMT..Accept-Ranges: bytes..ETag: "c155b5964e3ad21:0"..Server: Microsoft-IIS/8.5..VTag: 791406157300000000..P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Content-Length: 553..Cache-Control: max-age=900..Date: Sun, 12 Feb 2017 17:58:19 GMT..Connection: keep-alive..0..%0......0...*.H........0y1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1#0!..U....Microsoft Code Signing PCA..161108080000Z0 0)..a.\......5..091029235355Z0.0...U........B0@0...U.#..0...WEt.]...C...T-.2..H.0... .....7.......0...U........0...*.H.............rK.Z...>4.V.V&.iy.k(i\.......[..I...........fAK./..or.._.....I.\..r.,_R.....r.u.]|...G&a...n%...........y...............j.\.y4iT.........i.w.V>.9q.,.o...........X......X....j.-%v]t....L...zJqA..Nu?.........B....G...kZc.I...
<<< skipped >>>
GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1
Cache-Control: max-age = 808
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 09 Oct 2013 05:02:17 GMT
If-None-Match: "9c3f3dbaacc4ce1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com
HTTP/1.1 200 OK
Content-Type: application/pkix-crl
Last-Modified: Sun, 05 Feb 2017 06:01:25 GMT
Accept-Ranges: bytes
ETag: "45949148757fd21:0"
Server: Microsoft-IIS/8.5
VTag: 43870257100000000
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Content-Length: 813
Cache-Control: max-age=900
Date: Sun, 12 Feb 2017 17:58:14 GMT
Connection: keep-alive
0..)0......0...*.H........0_1.0.....&...,d....com1.0.....&...,d....microsoft1-0 ..U...$Microsoft Root Certificate Authority..170204214852Z..170506100852Z0.0...a......../..100208014912Z._0]0...U.#..0......`@V'..%..*..S.Y..0... .....7.......0...U......20... .....7......170505215852Z0...*.H.............4..].s.v.m&$.'1..q.Z........V`..,O..<.%S...7.0#.a....[.e..%...r/.pcp.....y.O4X..kH..^...74................h.0^...s...|........)|V).c..hI........]5'}.!.\......._.eB.....)<^u.T.?.c...?$....MI.....z.^.V.H.....6.1.a...o.S.n%.(...I.....S$o ..^.'...ho)..,;..a}...A....p|s.N......i.8M9..6..B.n{.....*p..0.D.....&u....c.`T....{D[.........-..Xtw.b!.pA..a..*..U......~*.....gdY.2"Y}......oz.u...2_.Lo/Hc.[.Y.=.H....Zn...m.....Eza.7.....p.bz....N.*..3.Mh.N...=.&D#}..K..*?h...%...x3....`k...i.`....O<.5.......[N..!k2F....y~HTTP/1.1 200 OK..Content-Type: application/pkix-crl..Last-Modified: Sun, 05 Feb 2017 06:01:25 GMT..Accept-Ranges: bytes..ETag: "45949148757fd21:0"..Server: Microsoft-IIS/8.5..VTag: 43870257100000000..P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Content-Length: 813..Cache-Control: max-age=900..Date: Sun, 12 Feb 2017 17:58:14 GMT..Connection: keep-alive..0..)0......0...*.H........0_1.0.....&...,d....com1.0.....&...,d....microsoft1-0 ..U...$Microsoft Root Certificate Authority..170204214852Z..170506100852Z0.0...a......../..100208014912Z._0]0...U.#..0......`@V'..%..*..S.Y..0... .....7.......0...U......20... .....7..
<<< skipped >>>
GET /pki/crl/products/CodeSigPCA.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com
HTTP/1.1 200 OK
Content-Type: application/pkix-crl
Last-Modified: Wed, 09 Nov 2016 06:00:35 GMT
Accept-Ranges: bytes
ETag: "c155b5964e3ad21:0"
Server: Microsoft-IIS/8.5
VTag: 791406157300000000
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Content-Length: 553
Cache-Control: max-age=900
Date: Sun, 12 Feb 2017 17:58:19 GMT
Connection: keep-alive
0..%0......0...*.H........0y1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1#0!..U....Microsoft Code Signing PCA..161108080000Z0 0)..a.\......5..091029235355Z0.0...U........B0@0...U.#..0...WEt.]...C...T-.2..H.0... .....7.......0...U........0...*.H.............rK.Z...>4.V.V&.iy.k(i\.......[..I...........fAK./..or.._.....I.\..r.,_R.....r.u.]|...G&a...n%...........y...............j.\.y4iT.........i.w.V>.9q.,.o...........X......X....j.-%v]t....L...zJqA..Nu?.........B....G...kZc.I...xUn..bE.;...V.V..WX..!........8k.HTTP/1.1 200 OK..Content-Type: application/pkix-crl..Last-Modified: Wed, 09 Nov 2016 06:00:35 GMT..Accept-Ranges: bytes..ETag: "c155b5964e3ad21:0"..Server: Microsoft-IIS/8.5..VTag: 791406157300000000..P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Content-Length: 553..Cache-Control: max-age=900..Date: Sun, 12 Feb 2017 17:58:19 GMT..Connection: keep-alive..0..%0......0...*.H........0y1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1#0!..U....Microsoft Code Signing PCA..161108080000Z0 0)..a.\......5..091029235355Z0.0...U........B0@0...U.#..0...WEt.]...C...T-.2..H.0... .....7.......0...U........0...*.H.............rK.Z...>4.V.V&.iy.k(i\.......[..I...........fAK./..or.._.....I.\..r.,_R.....r.u.]|...G&a...n%...........y...............j.\.y4iT.........i.w.V>.9q.,.o...........X......X....j.-%v]t....L...zJqA..Nu?.........B....G...kZc.I...
<<< skipped >>>
GET /pki/mscorp/crl/MSIT Machine Auth CA 2(1).crl HTTP/1.1
Cache-Control: max-age = 6793
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Mon, 18 Nov 2013 23:37:31 GMT
If-None-Match: "b61f5b26b7e4ce1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: mscrl.microsoft.com
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=6468
Content-Type: application/pkix-crl
Date: Sun, 12 Feb 2017 17:59:06 GMT
Etag: "ad925b8a3c1d11:0"
Last-Modified: Wed, 08 Jun 2016 16:35:08 GMT
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Server: ECAcc (arn/46C8)
VTag: 438712557400000000
X-Cache: HIT
X-Powered-By: ASP.NET
Content-Length: 163018
0..|.0..{....0...*.H........0..1.0.....&...,d....com1.0.....&...,d....microsoft1.0.....&...,d....corp1.0.....&...,d....redmond1.0...U....MSIT Machine Auth CA 2..160608162453Z..160616164453Z0..z.0)....=.........130522112904Z0.0...U.......0).....3........130522112904Z0.0...U.......0)..M.\.........130522100146Z0.0...U.......0)....K.........130522100145Z0.0...U.......0)...........Z..130522100145Z0.0...U.......0).....j.....I..130522100145Z0.0...U.......0)....q.....q...130522094611Z0.0...U.......0).....C....q=..130522055646Z0.0...U.......0)..P.......j...130522055646Z0.0...U.......0)..c.......:...130522053344Z0.0...U.......0)..[..x....F0..130521142635Z0.0...U.......0)..[.......F...130521142635Z0.0...U.......0)..`.ii....9...130521142635Z0.0...U.......0)..`.X.....9...130521142635Z0.0...U.......0)..[.......F/..130521142143Z0.0...U.......0).....9....p...130520132837Z0.0...U.......0)..Q.4u....]...130520115050Z0.0...U.......0).....p....p...130520110806Z0.0...U.......0)...z......fQ..130520094526Z0.0...U.......0)..........e...130520094526Z0.0...U.......0)..........e...130520094526Z0.0...U.......0)... K.....p...130520094519Z0.0...U.......0)... H.....p...130520094519Z0.0...U.......0)...zF,....o...130520070955Z0.0...U.......0)..f..E....P...130518074816Z0.0...U.......0...\,jN....FD..130402211200Z0...../w....U...130328232900Z0...p.R.....G1..130226223400Z0....e......?...130220163500Z0....[......*...121221223500Z0...A......."...121206221900Z0...A......."...121206221900Z0...A......."...121206221800Z0...A..\...."...121206221700Z0...A.
<<< skipped >>>
GET /CRL/Omniroot2025.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Sat, 16 Nov 2013 06:15:02 GMT
If-None-Match: "200da-5b6-4eb453c33260e"
User-Agent: Microsoft-CryptoAPI/6.1
Host: cdp1.public-trust.com
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/x-pkcs7-crl
Date: Sun, 12 Feb 2017 17:58:55 GMT
Etag: "200c0-cba-548094327bc45"
Last-Modified: Wed, 08 Feb 2017 18:45:02 GMT
Server: ECS (arn/45A4)
X-Cache: HIT
Content-Length: 3258
0...0......0...*.H........0Z1.0...U....IE1.0...U....Baltimore1.0...U....CyberTrust1"0 ..U....Baltimore CyberTrust Root..170208173500Z..170506173500Z0...0....'k...120111220757Z0....'k...120111220847Z0....'.C..130130174530Z0....'....130807173059Z0....'....140122185220Z0....'....140212185542Z0....'yr..150701184507Z0....'#...100303201301Z0....''q..100414175202Z0....'L...110224181251Z0....'Pn..110309142119Z0....'....100216203312Z0....'#...100303201213Z0....'3#..100908172555Z0....''n..101208175627Z0....''m..101208175749Z0....''p..101208175916Z0....'H...110114162156Z0#...'X>..110815145134Z0.0...U.......0#...'Z2..110818184101Z0.0...U.......0....'g...120111164333Z0....'g...120111164409Z0....'g...120111164519Z0....'....100216213519Z0....''s..100414175225Z0....''k..100414181839Z0....'3"..100908172705Z0....'3$..100908172728Z0....''o..101208175645Z0....''l..101208175727Z0....'H...110119195142Z0....'Nz..110302154045Z0....'c...111207220933Z0....'g...120111164445Z0....''r..100414175143Z0....'8...101012182723Z0....'e...120111163041Z0....'VJ..110714160903Z0....'s...130123162633Z0....'....130904190524Z0....'....131024214319Z0....'....140129172435Z0....'....140129172453Z0....'....131024214310Z0....'....131101204601Z0....'....140219171632Z0....'.^..140409155638Z0....'i...140709171930Z0....'/:..141119193302Z0....'J...150603184605Z0....'k...150603185020Z0....'k...150603185058Z0....'k...150603185131Z0....'k...120111220827Z0....'8...140716191203Z0....'....131219195909Z0....'....140219171545Z0....'k...151105070000Z0....'q...160126173
<<< skipped >>>
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAKQll6RM0DNpmNM7zH3/Qc= HTTP/1.1
Cache-Control: max-age = 547348
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Tue, 19 Nov 2013 21:12:41 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com
HTTP/1.1 200 OK
Server: nginx/1.10.2
Content-Type: application/ocsp-response
Content-Length: 1664
content-transfer-encoding: binary
Cache-Control: max-age=578891, public, no-transform, must-revalidate
Last-Modified: Sun, 12 Feb 2017 10:44:04 GMT
Expires: Sun, 19 Feb 2017 10:44:04 GMT
Date: Sun, 12 Feb 2017 17:59:01 GMT
Connection: keep-alive
0..|......u0..q.. .....0.....b0..^0.............V.m......E!....20170212104404Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5..........^.3@..cL.1.......20170212104404Z....20170219104404Z0...*.H....................1A_...._.....l0 F/.3v....D....U.....Wz..3.._I?.a.w..]?*.....o..A.|W3./.r.-...&,.V.r.Gu......"...h..`'rga.'..K.Q.....C... .......M'.m .q0U.H..".->P.........7.*/I2..EG2By.V.k.k...d.....v....z.B......Oe..W...Tr.Q..y.D|o.h..-..B.k.9..@....MlcKY.. Ex........0...0...0..................[Df..{.,0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at https://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code Signing 2009-2 CA0...161213000000Z..211231235959Z0F1D0B..U...;Symantec Class 3 Code Signing 2009-2 CA SHA1 OCSP Responder0.."0...*.H.............0.............2q..J..:...3....X.?.....9K.G....,......e.c,..9YI...z.qA 0....9...CG......6.qX>.Xo.....g..=..B.E.......qB..W.|..>.qT.4Z|....H. m...m..qy]Gi...0N.T.....N,.U.WJ5.f...r..@..8.b.......=..G.0.....y4N"mK.J...."..".......ju.....k...x........P.]S=t....*..'.............0...0...U.......0.0f..U. ._0]0[..`.H...E....0L0#.. .........hXXps://d.symcb.com/cps0%.. .......0...hXXps://d.symcb.com/rpa0...U.%..0... .......0...U...........0... .....0......0"..U....0...0.1.0...U....TGV-OFF-640...U.............V.m......E!..0...U.#..0.....k.&p..?...-.5.....0...*.H.............C.....S>F ..u.=KA5..@...`........a0s.M......JH.X.Y..E........CX../......f5j..a......k...:.r/.J5..G...h...~.".A.]...2
<<< skipped >>>
Map
The Dropped connects to the servers at the folowing location(s):
Strings from Dumps
svchost.exe_348:
.text
.text
`.data
`.data
.rsrc
.rsrc
@.reloc
@.reloc
msvcrt.dll
msvcrt.dll
API-MS-Win-Core-ProcessThreads-L1-1-0.dll
API-MS-Win-Core-ProcessThreads-L1-1-0.dll
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
API-MS-Win-Security-Base-L1-1-0.dll
API-MS-Win-Security-Base-L1-1-0.dll
API-MS-WIN-Service-Core-L1-1-0.dll
API-MS-WIN-Service-Core-L1-1-0.dll
API-MS-WIN-Service-winsvc-L1-1-0.dll
API-MS-WIN-Service-winsvc-L1-1-0.dll
RPCRT4.dll
RPCRT4.dll
ole32.dll
ole32.dll
ntdll.dll
ntdll.dll
_amsg_exit
_amsg_exit
RegCloseKey
RegCloseKey
RegOpenKeyExW
RegOpenKeyExW
GetProcessHeap
GetProcessHeap
svchost.pdb
svchost.pdb
version="5.1.0.0"
version="5.1.0.0"
name="Microsoft.Windows.Services.SvcHost"
name="Microsoft.Windows.Services.SvcHost"
Host Process for Windows Services
Host Process for Windows Services
Software\Microsoft\Windows NT\CurrentVersion\Svchost
Software\Microsoft\Windows NT\CurrentVersion\Svchost
Software\Microsoft\Windows NT\CurrentVersion\MgdSvchost
Software\Microsoft\Windows NT\CurrentVersion\MgdSvchost
\PIPE\
\PIPE\
Host Process for Windows Services
Host Process for Windows Services
6.1.7600.16385 (win7_rtm.090713-1255)
6.1.7600.16385 (win7_rtm.090713-1255)
svchost.exe
svchost.exe
Windows
Windows
Operating System
Operating System
6.1.7600.16385
6.1.7600.16385
WerFault.exe_2752:
.text
.text
`.data
`.data
.rsrc
.rsrc
@.reloc
@.reloc
ADVAPI32.dll
ADVAPI32.dll
ntdll.DLL
ntdll.DLL
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
msvcrt.dll
msvcrt.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
SHLWAPI.dll
SHLWAPI.dll
IMM32.dll
IMM32.dll
wer.dll
wer.dll
COMCTL32.dll
COMCTL32.dll
faultrep.dll
faultrep.dll
Starting kernel vertical - %S
Starting kernel vertical - %S
rundll32.exe
rundll32.exe
NtQueryInformationProcess failed with status: 0x%x
NtQueryInformationProcess failed with status: 0x%x
Reporting never started for process id %u
Reporting never started for process id %u
StringCchPrintf failed with 0x%x
StringCchPrintf failed with 0x%x
NtWow64QueryInformationProcess64 failed with 0x%x
NtWow64QueryInformationProcess64 failed with 0x%x
NtWow64ReadVirtualMemory64 failed with 0x%x
NtWow64ReadVirtualMemory64 failed with 0x%x
NtQueryInformationProcess failed with status 0x%x
NtQueryInformationProcess failed with status 0x%x
WerpNtWow64QueryInformationProcess64 failed with status 0x%x
WerpNtWow64QueryInformationProcess64 failed with status 0x%x
StringCchCopy failed with 0x%x
StringCchCopy failed with 0x%x
Invalid arg in %s
Invalid arg in %s
wdi.dll
wdi.dll
dbgeng.dll
dbgeng.dll
dbghelp.dll
dbghelp.dll
SETUPAPI.dll
SETUPAPI.dll
SHELL32.dll
SHELL32.dll
VERSION.dll
VERSION.dll
WTSAPI32.dll
WTSAPI32.dll
WerFault.pdb
WerFault.pdb
PSShD
PSShD
tSSh,
tSSh,
t.PSj6
t.PSj6
t5SSh
t5SSh
SShx`
SShx`
tsShxc
tsShxc
t.Ph0j
t.Ph0j
_amsg_exit
_amsg_exit
RegCloseKey
RegCloseKey
RegCreateKeyExW
RegCreateKeyExW
RegOpenKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegQueryInfoKeyW
GetProcessHeap
GetProcessHeap
GetWindowsDirectoryW
GetWindowsDirectoryW
RegDeleteKeyW
RegDeleteKeyW
ReportEventW
ReportEventW
RegOpenKeyW
RegOpenKeyW
RegSetKeyValueW
RegSetKeyValueW
GetProcessWindowStation
GetProcessWindowStation
EnumWindows
EnumWindows
NtAlpcSendWaitReceivePort
NtAlpcSendWaitReceivePort
NtAlpcConnectPort
NtAlpcConnectPort
ShipAssert
ShipAssert
ntdll.dll
ntdll.dll
RegisterErrorReportingDialog
RegisterErrorReportingDialog
WerReportSubmit
WerReportSubmit
WerReportAddFile
WerReportAddFile
WerReportCreate
WerReportCreate
WerReportCloseHandle
WerReportCloseHandle
WerReportSetUIOption
WerReportSetUIOption
WerpGetReportConsent
WerpGetReportConsent
WerpSetIntegratorReportId
WerpSetIntegratorReportId
WerpReportCancel
WerpReportCancel
WerpAddRegisteredDataToReport
WerpAddRegisteredDataToReport
WerReportAddDump
WerReportAddDump
WerpCreateIntegratorReportId
WerpCreateIntegratorReportId
WerpSetReportFlags
WerpSetReportFlags
WerpGetReportFlags
WerpGetReportFlags
WerpIsTransportAvailable
WerpIsTransportAvailable
WerReportSetParameter
WerReportSetParameter
WerpInitiateCrashReporting
WerpInitiateCrashReporting
version="1.0.0.0"
version="1.0.0.0"
name="Microsoft.Windows.Feedback.Watson"
name="Microsoft.Windows.Feedback.Watson"
name="Microsoft.Windows.Common-Controls"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
publicKeyToken="6595b64144ccf1df"
ÃCD0
ÃCD0
#$$$3355
#$$$3355
##$$$335566
##$$$335566
% "#$$$3355666=
% "#$$$3355666=
"#$$33555666
"#$$33555666
!.DQ$
!.DQ$
.Py>o
.Py>o
Kÿg
Kÿg
.ib:?
.ib:?
T3%X_
T3%X_
a,M.cbd
a,M.cbd
KEYW8
KEYW8
KEYWH
KEYWH
? ?$?(?,?0?4?8?
? ?$?(?,?0?4?8?
1 2$2(2,20242
1 2$2(2,20242
>,?0?4?8?@?
>,?0?4?8?@?
?%?5?:?|?
?%?5?:?|?
5'565^5{5
5'565^5{5
3#3(353_3
3#3(353_3
=#='= =/=3=7=;=?=
=#='= =/=3=7=;=?=
=#=(=>=]=
=#=(=>=]=
>!>&>3>}>
>!>&>3>}>
1!1&131[1
1!1&131[1
Microsoft\Windows\WindowsErrorReporting\WerFault
Microsoft\Windows\WindowsErrorReporting\WerFault
%s %s
%s %s
Global\WerKernelVerticalReporting
Global\WerKernelVerticalReporting
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl
CrashDumpEnabled.Old
CrashDumpEnabled.Old
CrashDumpEnabled.New
CrashDumpEnabled.New
%SystemRoot%\MEMORY.DMP
%SystemRoot%\MEMORY.DMP
LiveKernelReports
LiveKernelReports
Software\Microsoft\Windows\Windows Error Reporting\LiveKernelReports
Software\Microsoft\Windows\Windows Error Reporting\LiveKernelReports
LiveKernelReportsPath
LiveKernelReportsPath
BCCode=%x&BCP1=%p&BCP2=%p&BCP3=%p&BCP4=%p&OS Version=%u_%u_%u&Service Pack=%u_%u&Product=%u_%u
BCCode=%x&BCP1=%p&BCP2=%p&BCP3=%p&BCP4=%p&OS Version=%u_%u_%u&Service Pack=%u_%u&Product=%u_%u
*WerKernelReporting
*WerKernelReporting
%SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq
%SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
SOFTWARE\Microsoft\Windows\Windows Error Reporting\KernelFaults\Queue
SOFTWARE\Microsoft\Windows\Windows Error Reporting\KernelFaults\Queue
sysdata.xml
sysdata.xml
%s -k -q
%s -k -q
SOFTWARE\Microsoft\Windows NT\CurrentVersion
SOFTWARE\Microsoft\Windows NT\CurrentVersion
%u.%u.%u %u.%u
%u.%u.%u %u.%u
%u
%u
%u
%u
%u
%u
%u
%u
d-d-d d:d:d
d-d-d d:d:d
%s
%s
%s
%s
Failed at Step: %s with error 0x%x
Failed at Step: %s with error 0x%x
%sDrivers\%s.sys
%sDrivers\%s.sys
%s>
%s>
%s%s>
%s%s>
%u.%u.%u.%u
%u.%u.%u.%u
*.mrk
*.mrk
WER-%u-%u.sysdata.xml
WER-%u-%u.sysdata.xml
Software\Microsoft\Windows\CurrentVersion\CEIPRole\RolesInWER
Software\Microsoft\Windows\CurrentVersion\CEIPRole\RolesInWER
SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability\MemoryDiagnostic
SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability\MemoryDiagnostic
Web Server
Web Server
Software\Microsoft\Windows\Windows Error Reporting\Debug
Software\Microsoft\Windows\Windows Error Reporting\Debug
%SystemRoot%\Minidump
%SystemRoot%\Minidump
0xx (0xx, 0xx, 0xx, 0xx)
0xx (0xx, 0xx, 0xx, 0xx)
%s\%2.2d%2.2d%2.2d-%u-%2.2d.dmp
%s\%2.2d%2.2d%2.2d-%u-%2.2d.dmp
*.dmp
*.dmp
Software\Microsoft\Windows\Windows Error Reporting
Software\Microsoft\Windows\Windows Error Reporting
Software\Policies\Microsoft\Windows\Windows Error Reporting
Software\Policies\Microsoft\Windows\Windows Error Reporting
\KernelObjects\SystemErrorPortReady
\KernelObjects\SystemErrorPortReady
%s\%s
%s\%s
Microsoft.Windows.Setup
Microsoft.Windows.Setup
\WindowsErrorReportingServicePort
\WindowsErrorReportingServicePort
(0x%x): %s
(0x%x): %s
%u %s
%u %s
WindowsNTVersion
WindowsNTVersion
%u.%u
%u.%u
ErrorPort
ErrorPort
\StringFileInfo\xx\%s
\StringFileInfo\xx\%s
HKEY_USERS\
HKEY_USERS\
HKEY_CURRENT_CONFIG\
HKEY_CURRENT_CONFIG\
HKEY_CLASSES_ROOT\
HKEY_CLASSES_ROOT\
HKEY_LOCAL_MACHINE\
HKEY_LOCAL_MACHINE\
HKEY_CURRENT_USER\
HKEY_CURRENT_USER\
%s="%s"
%s="%s"
%s.%s
%s.%s
%s %d
%s %d
Software\Microsoft\Windows\Windows Error Reporting\Hangs
Software\Microsoft\Windows\Windows Error Reporting\Hangs
_NT_EXECUTABLE_IMAGE_PATH
_NT_EXECUTABLE_IMAGE_PATH
wxmu.dmp
wxmu.dmp
wxhu.dmp
wxhu.dmp
axmu.dmp
axmu.dmp
axhu.dmp
axhu.dmp
hu.kdmp
hu.kdmp
mu.kdmp
mu.kdmp
hu.dmp
hu.dmp
mu.dmp
mu.dmp
Software\Microsoft\.NETFramework
Software\Microsoft\.NETFramework
NOT_TCPIP
NOT_TCPIP
sos.dll
sos.dll
version.xml
version.xml
.version.xml
.version.xml
%s.xml
%s.xml
memory.hdmp
memory.hdmp
minidump.mdmp
minidump.mdmp
Local\WERReportingForProcess%d
Local\WERReportingForProcess%d
atk.kdmp
atk.kdmp
Software\Microsoft\Windows\Windows Error Reporting\Hangs\NHRTimes
Software\Microsoft\Windows\Windows Error Reporting\Hangs\NHRTimes
%i|%d|%d
%i|%d|%d
xxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxx
xx
xx
%d.%d.%d.%d
%d.%d.%d.%d
D:P(A;;GA;;;BA)(A;;GA;;;SY)(A;;GA;;;%s)
D:P(A;;GA;;;BA)(A;;GA;;;SY)(A;;GA;;;%s)
D:P(A;;GA;;;BA)(A;;GA;;;SY)(A;;GA;;;%s)S:(ML;;NR;;;HI)
D:P(A;;GA;;;BA)(A;;GA;;;SY)(A;;GA;;;%s)S:(ML;;NR;;;HI)
dc.noreflect
dc.noreflect
dc.xpmemdump
dc.xpmemdump
dc.xpdata
dc.xpdata
dc.CustomDump
dc.CustomDump
dc.expmodmem
dc.expmodmem
dc.expmoddata
dc.expmoddata
dc.OnDemandKdmp
dc.OnDemandKdmp
dc.xpmodmem
dc.xpmodmem
dc.xpmoddata
dc.xpmoddata
default=%s
default=%s
memory=%s
memory=%s
module=%s
module=%s
.dbgcfg.ini
.dbgcfg.ini
ElevatedDataCollectionStatus.txt
ElevatedDataCollectionStatus.txt
Open process failed unexpectedly: 0X%X
Open process failed unexpectedly: 0X%X
Attempting to cross-proc reporting process!
Attempting to cross-proc reporting process!
Elevation:Administrator!new:%s
Elevation:Administrator!new:%s
Reflection attempt failed: 0X%X
Reflection attempt failed: 0X%X
Attempting to reflect reporting process!
Attempting to reflect reporting process!
Could not collect dump for reflection cross process: 0x%x
Could not collect dump for reflection cross process: 0x%x
Could not collect xproc for reflection: 0x%x
Could not collect xproc for reflection: 0x%x
CollectFile for reflection failed: 0x%x
CollectFile for reflection failed: 0x%x
Could not collect dump for cross process: 0x%x
Could not collect dump for cross process: 0x%x
CollectReflectionDump failed with: 0x%x
CollectReflectionDump failed with: 0x%x
0 processes found for xproc module: %s
0 processes found for xproc module: %s
Could not collect cross dump from module: 0x%x
Could not collect cross dump from module: 0x%x
CollectCrossProcessModuleDumps failed: 0x%x
CollectCrossProcessModuleDumps failed: 0x%x
CollectCrossProcessDumps failed: 0x%x
CollectCrossProcessDumps failed: 0x%x
KernelDump failed: 0x%x
KernelDump failed: 0x%x
ProcessHandle
ProcessHandle
%s|%s
%s|%s
rpcrt4
rpcrt4
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebugProtected\AutoExclusionList
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebugProtected\AutoExclusionList
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug\AutoExclusionList
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug\AutoExclusionList
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebugProtected
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebugProtected
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug
sntdll.dll
sntdll.dll
WerDiagController.dll
WerDiagController.dll
Software\Microsoft\Windows\Windows Error Reporting\Plugins
Software\Microsoft\Windows\Windows Error Reporting\Plugins
Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
Software\Microsoft\Windows\Windows Error Reporting\Plugins\FDR\CurrentSession
Software\Microsoft\Windows\Windows Error Reporting\Plugins\FDR\CurrentSession
%s\%s\%u-%u.etl
%s\%s\%u-%u.etl
%s\%s\%u-%u.etl_%d
%s\%s\%u-%u.etl_%d
Microsoft\Windows\FDR
Microsoft\Windows\FDR
%s-%d
%s-%d
Software\Microsoft\Windows\Windows Error Reporting\Plugins\DriverVerifier
Software\Microsoft\Windows\Windows Error Reporting\Plugins\DriverVerifier
Software\Microsoft\Windows\Windows Error Reporting\Plugins\AppRecorder
Software\Microsoft\Windows\Windows Error Reporting\Plugins\AppRecorder
%d-AppRecorderEnabled
%d-AppRecorderEnabled
%s /stop
%s /stop
psr.exe
psr.exe
Software\Microsoft\Windows\Windows Error Reporting\RuntimeExceptionHelperModules
Software\Microsoft\Windows\Windows Error Reporting\RuntimeExceptionHelperModules
verifier.dll
verifier.dll
nVerifier.dll
nVerifier.dll
Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\%s
Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\%s
Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
lsvchost.exe
lsvchost.exe
"%s" "%s" "%s"
"%s" "%s" "%s"
%s\system32\cofire.exe
%s\system32\cofire.exe
psapi.dll
psapi.dll
sfc_os.dll
sfc_os.dll
werfault.exe
werfault.exe
%s\%s-(PID-%u)-%u
%s\%s-(PID-%u)-%u
%s\%s-(PID-%u).dmp
%s\%s-(PID-%u).dmp
%s\*-(PID-*)-*
%s\*-(PID-*)-*
SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\%s
SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\%s
SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit
SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit
kernel32.dll
kernel32.dll
kernelbase.dll
kernelbase.dll
ReportingMode
ReportingMode
WinShipAssert
WinShipAssert
WindowsMessageReportingB1
WindowsMessageReportingB1
Windows
Windows
ws2_32.dll
ws2_32.dll
Software\Microsoft\SQMClient\%s\AdaptiveSqm\ManifestInfo
Software\Microsoft\SQMClient\%s\AdaptiveSqm\ManifestInfo
%s\Sqm%d.bin
%s\Sqm%d.bin
CorporateWerPortNumber
CorporateWerPortNumber
BypassDataThrottling
BypassDataThrottling
Software\Microsoft\Windows\Windows Error Reporting\Consent
Software\Microsoft\Windows\Windows Error Reporting\Consent
Windows Problem Reporting
Windows Problem Reporting
6.1.7600.16385 (win7_rtm.090713-1255)
6.1.7600.16385 (win7_rtm.090713-1255)
WerFault.exe
WerFault.exe
Windows
Windows
Operating System
Operating System
6.1.7600.16385
6.1.7600.16385
Microsoft-Windows-WER-Diag/Operational
Microsoft-Windows-WER-Diag/Operational
chrome.exe_892:
.text
.text
`.rdata
`.rdata
@.data
@.data
.gfids
.gfids
@.tls
@.tls
.rsrc
.rsrc
@.reloc
@.reloc
D$,j.Xf
D$,j.Xf
j.Yf;
j.Yf;
_tcPVj@
_tcPVj@
.PjRW
.PjRW
ole32.dll
ole32.dll
POWRPROF.dll
POWRPROF.dll
address family not supported
address family not supported
broken pipe
broken pipe
function not supported
function not supported
inappropriate io control operation
inappropriate io control operation
not supported
not supported
operation canceled
operation canceled
operation in progress
operation in progress
operation not permitted
operation not permitted
operation not supported
operation not supported
operation would block
operation would block
protocol not supported
protocol not supported
InitOnceExecuteOnce
InitOnceExecuteOnce
operator
operator
operator ""
operator ""
?#%X.y
?#%X.y
%S#[k
%S#[k
?OLEAUT32.dll
?OLEAUT32.dll
user32.dll
user32.dll
c:\b\build\slave\win-pgo\build\src\chrome\app\chrome_exe_main_win.cc
c:\b\build\slave\win-pgo\build\src\chrome\app\chrome_exe_main_win.cc
c:\b\build\slave\win-pgo\build\src\chrome\app\main_dll_loader_win.cc
c:\b\build\slave\win-pgo\build\src\chrome\app\main_dll_loader_win.cc
Failed to load Chrome DLL from
Failed to load Chrome DLL from
ChromeMain
ChromeMain
RelaunchChromeBrowserWithNewCommandLineIfNeeded
RelaunchChromeBrowserWithNewCommandLineIfNeeded
Could not find exported function
Could not find exported function
%s: option `%s' is ambiguous (could be `--%s' or `--%s')
%s: option `%s' is ambiguous (could be `--%s' or `--%s')
%s: invalid option -- `-%c'
%s: invalid option -- `-%c'
%s: argument required for option `
%s: argument required for option `
--%s'
--%s'
0.8.0
0.8.0
%ls (%s) %s
%ls (%s) %s
hXXps://crashpad.chromium.org/
hXXps://crashpad.chromium.org/
hXXps://crashpad.chromium.org/bug/new
hXXps://crashpad.chromium.org/bug/new
Report %ls bugs to
Report %ls bugs to
%s home page:
%s home page:
%ls: %s
%ls: %s
(0x%X)
(0x%X)
Error (0x%X) while retrieving error. (0x%X)
Error (0x%X) while retrieving error. (0x%X)
PlatformFile.UnknownErrors.Windows
PlatformFile.UnknownErrors.Windows
c:\b\build\slave\win-pgo\build\src\base\threading\thread_local_win.cc
c:\b\build\slave\win-pgo\build\src\base\threading\thread_local_win.cc
0123456789
0123456789
(flags = 0x%x)
(flags = 0x%x)
Histogram: %s recorded %d samples
Histogram: %s recorded %d samples
.syzygy
.syzygy
.thunks
.thunks
Windows NT
Windows NT
Histogram.InconsistentCountHigh
Histogram.InconsistentCountHigh
Histogram.InconsistentCountLow
Histogram.InconsistentCountLow
c:\b\build\slave\win-pgo\build\src\base\metrics\persistent_memory_allocator.cc
c:\b\build\slave\win-pgo\build\src\base\metrics\persistent_memory_allocator.cc
(%d = %3.1f%%)
(%d = %3.1f%%)
UMA.CreatePersistentHistogram.Result
UMA.CreatePersistentHistogram.Result
Dictionary keys must be quoted.
Dictionary keys must be quoted.
Unsupported encoding. JSON must be UTF-8.
Unsupported encoding. JSON must be UTF-8.
Line: %i, column: %i, %s
Line: %i, column: %i, %s
widevinecdmadapter.dll
widevinecdmadapter.dll
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\google_update_settings.cc
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\google_update_settings.cc
Failed to write to application's ClientState key
Failed to write to application's ClientState key
Removed incremental installer failure key; switching to channel:
Removed incremental installer failure key; switching to channel:
Removed multi-install failure key; switching to channel:
Removed multi-install failure key; switching to channel:
CHROME_PROBED_PROGRAM_FILES_PATH
CHROME_PROBED_PROGRAM_FILES_PATH
chrome-sxs
chrome-sxs
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\google_chrome_distribution.cc
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\google_chrome_distribution.cc
iexplore.exe
iexplore.exe
googlechrome
googlechrome
googlechromeframe
googlechromeframe
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\channel_info.cc
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\channel_info.cc
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\language_selector.cc
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\language_selector.cc
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\app_commands.cc
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\app_commands.cc
Cannot initialize AppCommands from an invalid key.
Cannot initialize AppCommands from an invalid key.
Skipping over key "
Skipping over key "
Failed to open key "
Failed to open key "
Cannot initialize an AppCommand from an invalid key.
Cannot initialize an AppCommand from an invalid key.
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\app_command.cc
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\app_command.cc
CHROME_MAIN_TICKS
CHROME_MAIN_TICKS
user_experience_metrics.reporting_enabled
user_experience_metrics.reporting_enabled
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\settings.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\settings.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\numeric\in_range_cast.h
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\numeric\in_range_cast.h
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc
x-x-x-xx-xxxxxx
x-x-x-xx-xxxxxx
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\misc\uuid.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\misc\uuid.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_io.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_io.cc
--annotation=KEY=VALUE set a process annotation in each crash report
--annotation=KEY=VALUE set a process annotation in each crash report
--database=PATH store the crash report database at PATH
--database=PATH store the crash report database at PATH
create a new pipe and send its name via HANDLE
create a new pipe and send its name via HANDLE
--pipe-name=PIPE communicate with the client over PIPE
--pipe-name=PIPE communicate with the client over PIPE
--url=URL send crash reports to this Breakpad server URL,
--url=URL send crash reports to this Breakpad server URL,
pipe-name
pipe-name
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\handler_main.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\handler_main.cc
duplicate key
duplicate key
--annotation requires KEY=VALUE
--annotation requires KEY=VALUE
--handshake-handle and --pipe-name are incompatible
--handshake-handle and --pipe-name are incompatible
--handshake-handle or --pipe-name is required
--handshake-handle or --pipe-name is required
SetProcessShutdownParameters
SetProcessShutdownParameters
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\crash_report_upload_thread.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\crash_report_upload_thread.cc
reserved key
reserved key
FinishedWritingCrashReport failed
FinishedWritingCrashReport failed
PrepareNewCrashReport failed
PrepareNewCrashReport failed
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\win\crash_report_exception_handler.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\win\crash_report_exception_handler.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_file_writer.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_file_writer.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_writer_util.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_writer_util.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_writable.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_writable.cc
%s.%s,%s,%s
%s.%s,%s,%s
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_context_writer.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_context_writer.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\process_snapshot_minidump.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\process_snapshot_minidump.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_snapshot_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_snapshot_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\crashpad_info_client_options.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\crashpad_info_client_options.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\minidump_simple_string_dictionary_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\minidump_simple_string_dictionary_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\module_snapshot_minidump.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\module_snapshot_minidump.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\exception_snapshot_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\exception_snapshot_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\module_snapshot_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\module_snapshot_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\system_snapshot_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\system_snapshot_win.cc
%s %d.%d.%d.%s%s
%s %d.%d.%d.%s%s
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_reader_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_reader_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\minidump_string_list_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\minidump_string_list_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\capture_memory.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\capture_memory.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\cpu_context_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\cpu_context_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_annotations_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_annotations_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_subrange_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_subrange_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_resource_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_resource_reader.cc
kernel32.dll
kernel32.dll
c:\b\build\slave\win-pgo\build\src\sandbox\win\src\sandbox_policy_base.cc
c:\b\build\slave\win-pgo\build\src\sandbox\win\src\sandbox_policy_base.cc
NtOpenKey
NtOpenKey
NtCreateKey
NtCreateKey
GetCertificateSize
GetCertificateSize
GetCertificate
GetCertificate
GetCertificateSizeByHandle
GetCertificateSizeByHandle
GetCertificateByHandle
GetCertificateByHandle
SetOPMSigningKeyAndSequenceNumbers
SetOPMSigningKeyAndSequenceNumbers
CreateNamedPipeW
CreateNamedPipeW
NtOpenKeyEx
NtOpenKeyEx
PruneCrashReportDatabase: Failed to get pending reports
PruneCrashReportDatabase: Failed to get pending reports
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\prune_crash_reports.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\prune_crash_reports.cc
PruneCrashReportDatabase: Failed to get completed reports
PruneCrashReportDatabase: Failed to get completed reports
Database Pruning: Failed to remove report
Database Pruning: Failed to remove report
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\exception_handler_server.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\exception_handler_server.cc
::GetNamedPipeClientProcessId
::GetNamedPipeClientProcessId
\\.\pipe\crashpad_%d_
\\.\pipe\crashpad_%d_
ImpersonateNamedPipeClient
ImpersonateNamedPipeClient
ConnectNamedPipe
ConnectNamedPipe
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\net\http_transport_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\net\http_transport_win.cc
WinHttpCrackUrl
WinHttpCrackUrl
WinHttpConnect
WinHttpConnect
WinHttpOpenRequest
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpCloseHandle
Crashpad/0.8.0
Crashpad/0.8.0
WinHttpOpen
WinHttpOpen
WinHttpSetTimeouts
WinHttpSetTimeouts
WinHttpReceiveResponse
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpQueryHeaders
HTTP status %d
HTTP status %d
WinHttpReadData
WinHttpReadData
WinHttpAddRequestHeaders
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpSendRequest
%%x
%%x
--%s%sContent-Disposition: form-data; name="%s"
--%s%sContent-Disposition: form-data; name="%s"
; filename="%s"%s
; filename="%s"%s
Content-Type: %s%s
Content-Type: %s%s
multipart/form-data; boundary=%s
multipart/form-data; boundary=%s
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\scoped_process_suspend.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\scoped_process_suspend.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_seeker.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_seeker.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\process_info.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\process_info.cc
Reading x64 process from x86 process not supported
Reading x64 process from x86 process not supported
0x%llx 0x%llx (%s)
0x%llx 0x%llx (%s)
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\module_version.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\module_version.cc
(0xx)
(0xx)
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\scoped_local_alloc.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\scoped_local_alloc.cc
SetNamedPipeHandleState
SetNamedPipeHandleState
WaitNamedPipe
WaitNamedPipe
TransactNamedPipe: expected
TransactNamedPipe: expected
TransactNamedPipe
TransactNamedPipe
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\registration_protocol_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\registration_protocol_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\net\http_body.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\net\http_body.cc
InvokeMainViaCRT
InvokeMainViaCRT
ExitMainViaCRT
ExitMainViaCRT
Microsoft.CRTProvider
Microsoft.CRTProvider
C:\b\build\slave\win-pgo\build\src\out\Release\initialexe\chrome.exe.pdb
C:\b\build\slave\win-pgo\build\src\out\Release\initialexe\chrome.exe.pdb
.text$di
.text$di
.text$mn
.text$mn
.text$x
.text$x
.text$yd
.text$yd
.idata$5
.idata$5
.CRT$XCA
.CRT$XCA
.CRT$XCAA
.CRT$XCAA
.CRT$XCC
.CRT$XCC
.CRT$XCL
.CRT$XCL
.CRT$XCU
.CRT$XCU
.CRT$XCZ
.CRT$XCZ
.CRT$XIA
.CRT$XIA
.CRT$XIAA
.CRT$XIAA
.CRT$XIAC
.CRT$XIAC
.CRT$XIC
.CRT$XIC
.CRT$XIZ
.CRT$XIZ
.CRT$XLA
.CRT$XLA
.CRT$XLB
.CRT$XLB
.CRT$XLZ
.CRT$XLZ
.CRT$XPA
.CRT$XPA
.CRT$XPX
.CRT$XPX
.CRT$XPXA
.CRT$XPXA
.CRT$XPZ
.CRT$XPZ
.CRT$XTA
.CRT$XTA
.CRT$XTZ
.CRT$XTZ
.rdata
.rdata
.rdata$T
.rdata$T
.rdata$r
.rdata$r
.rdata$sxdata
.rdata$sxdata
.rdata$zETW0
.rdata$zETW0
.rdata$zETW1
.rdata$zETW1
.rdata$zETW2
.rdata$zETW2
.rdata$zETW9
.rdata$zETW9
.rdata$zzzdbg
.rdata$zzzdbg
.rtc$IAA
.rtc$IAA
.rtc$IZZ
.rtc$IZZ
.rtc$TAA
.rtc$TAA
.rtc$TZZ
.rtc$TZZ
.xdata$x
.xdata$x
.didat$2
.didat$2
.didat$3
.didat$3
.didat$4
.didat$4
.didat$6
.didat$6
.didat$7
.didat$7
.edata
.edata
.idata$2
.idata$2
.idata$3
.idata$3
.idata$4
.idata$4
.idata$6
.idata$6
.data
.data
.data$r
.data$r
.didat$5
.didat$5
.gfids$x
.gfids$x
.gfids$y
.gfids$y
.tls$ZZZ
.tls$ZZZ
.rsrc$01
.rsrc$01
.rsrc$02
.rsrc$02
chrome.exe
chrome.exe
SignalChromeElf
SignalChromeElf
chrome_elf.dll
chrome_elf.dll
RegOpenKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegEnumKeyExW
RegCreateKeyExW
RegCreateKeyExW
RegQueryInfoKeyW
RegQueryInfoKeyW
RegCloseKey
RegCloseKey
ADVAPI32.dll
ADVAPI32.dll
CreateIoCompletionPort
CreateIoCompletionPort
GetWindowsDirectoryW
GetWindowsDirectoryW
GetProcessHandleCount
GetProcessHandleCount
KERNEL32.dll
KERNEL32.dll
ShellExecuteExW
ShellExecuteExW
SHELL32.dll
SHELL32.dll
CloseWindowStation
CloseWindowStation
CreateWindowStationW
CreateWindowStationW
GetProcessWindowStation
GetProcessWindowStation
SetProcessWindowStation
SetProcessWindowStation
USER32.dll
USER32.dll
VERSION.dll
VERSION.dll
WINMM.dll
WINMM.dll
WTSAPI32.dll
WTSAPI32.dll
RPCRT4.dll
RPCRT4.dll
GetCPInfo
GetCPInfo
GetProcessHeap
GetProcessHeap
PeekNamedPipe
PeekNamedPipe
DisconnectNamedPipe
DisconnectNamedPipe
WaitNamedPipeW
WaitNamedPipeW
WINHTTP.dll
WINHTTP.dll
.?AU_Crt_new_delete@std@@
.?AU_Crt_new_delete@std@@
a.IDATx
a.IDATx
%F?????????3
%F?????????3
ÿFFFFFFFFFFFFFFF?B%
ÿFFFFFFFFFFFFFFF?B%
:1----16
:1----16
Rhgf^rrrr( ?NOCdhgfrrrr...DlEBScjhg^rr,001k>985Tnhherr-12
Rhgf^rrrr( ?NOCdhgfrrrr...DlEBScjhg^rr,001k>985Tnhherr-12
:BBBBBBBBBB>>-.jdddcccca
:BBBBBBBBBB>>-.jdddcccca
3 3*363@3
3 3*363@3
6 6%6-646
6 6%6-646
-0F3K4U4g4m4r4}4
-0F3K4U4g4m4r4}4
1$3 303{3
1$3 303{3
081?1_1?3
081?1_1?3
4!4%4)4{4
4!4%4)4{4
9—9d9
9—9d9
;
;
=~=
=~=
? ?$?(?,?
? ?$?(?,?
5 5$5(5,5
5 5$5(5,5
5 5$5(5,5054585
5 5$5(5,5054585
9,9094989
9,9094989
4 4
4 4
5 5
5 5
KERNEL32.DLL
KERNEL32.DLL
mscoree.dll
mscoree.dll
ext-ms-win-ntuser-windowstation-l1-1-0
ext-ms-win-ntuser-windowstation-l1-1-0
portuguese-brazilian
portuguese-brazilian
Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
nchrome_watcher.dll
nchrome_watcher.dll
PreReadChromeChildInBrowser
PreReadChromeChildInBrowser
${windows}
${windows}
Ndebug.log
Ndebug.log
\StringFileInfo\xx\%ls
\StringFileInfo\xx\%ls
ntdll.dll
ntdll.dll
shell32.dll
shell32.dll
resources.pak
resources.pak
script.log
script.log
chrome
chrome
pepflashplayer.dll
pepflashplayer.dll
Browse the web
Browse the web
Software\Microsoft\Windows\CurrentVersion\Uninstall\Chromium
Software\Microsoft\Windows\CurrentVersion\Uninstall\Chromium
{7D2B3E1D-D096-4594-9D8F-A6667F12E0AC}
{7D2B3E1D-D096-4594-9D8F-A6667F12E0AC}
{A2DF06F9-A21A-44A8-8A99-8B9C84F29160}
{A2DF06F9-A21A-44A8-8A99-8B9C84F29160}
Chrome
Chrome
chrome_child.dll
chrome_child.dll
chrome.dll
chrome.dll
Google Chrome Canary
Google Chrome Canary
{4ea16ac7-fd5a-47c3-875b-dbf4a2008c20}
{4ea16ac7-fd5a-47c3-875b-dbf4a2008c20}
ChromeCanary
ChromeCanary
Chrome Canary HTML Document
Chrome Canary HTML Document
ChromeSSHTM
ChromeSSHTM
{1BEAC3E3-B852-44F4-B468-8906C062422E}
{1BEAC3E3-B852-44F4-B468-8906C062422E}
{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}
{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}
Google Chrome binaries
Google Chrome binaries
hXXps://support.google.com/chrome/contact/chromeuninstall3?hl=$1
hXXps://support.google.com/chrome/contact/chromeuninstall3?hl=$1
Google Chrome
Google Chrome
%d.%d.%d
%d.%d.%d
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
7ChromeHTML
7ChromeHTML
Chrome HTML Document
Chrome HTML Document
{8A69D345-D564-463c-AFF1-A69D9E530F96}
{8A69D345-D564-463c-AFF1-A69D9E530F96}
{5C65F4B0-3651-4514-B207-D10CB699B14B}
{5C65F4B0-3651-4514-B207-D10CB699B14B}
Google Chrome Frame
Google Chrome Frame
Chrome in a Frame.
Chrome in a Frame.
Google\Chrome Frame
Google\Chrome Frame
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame
{8BA986DA-5100-405E-AA35-86F34A02ACBF}
{8BA986DA-5100-405E-AA35-86F34A02ACBF}
WebAccessible
WebAccessible
-chromeframe
-chromeframe
-chrome
-chrome
lSOFTWARE\Policies\Google\Chrome
lSOFTWARE\Policies\Google\Chrome
reports
reports
settings.dat
settings.dat
;kernel32.dll
;kernel32.dll
ALPC Port
ALPC Port
\Sessions\%d\AppContainerNamedObjects\%ls
\Sessions\%d\AppContainerNamedObjects\%ls
sHKEY_USERS
sHKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_PERFORMANCE_DATA
HKEY_PERFORMANCE_TEXT
HKEY_PERFORMANCE_TEXT
HKEY_PERFORMANCE_NLSTEXT
HKEY_PERFORMANCE_NLSTEXT
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
HKEY_DYN_DATA
HKEY_DYN_DATA
pipe\
pipe\
egdi32.dll
egdi32.dll
tntdll.dll
tntdll.dll
xntdll.dll
xntdll.dll
Chrome_MessageWindow
Chrome_MessageWindow
Failed to create directory %ls, last error is %d
Failed to create directory %ls, last error is %d
Chrome SxS\Application
Chrome SxS\Application
=winhttp.dll
=winhttp.dll
%Program Files%\Google\Chrome\Application\chrome.exe
%Program Files%\Google\Chrome\Application\chrome.exe
54.0.2840.59
54.0.2840.59
chrome_exe
chrome_exe
iexplore.exe_2856:
.text
.text
0`.data
0`.data
.idata
.idata
?u'<.up>
?u'<.up>
ÂmgM
ÂmgM
%Program Files%\Internet Explorer\.Instal\.Logs\
%Program Files%\Internet Explorer\.Instal\.Logs\
{12I2VEEH-T133-AX05-I330-K5JA2408GG5Q}
{12I2VEEH-T133-AX05-I330-K5JA2408GG5Q}
iexplore.exe
iexplore.exe
%Program Files%\Internet Explorer\.Install\iexplore.exe
%Program Files%\Internet Explorer\.Install\iexplore.exe
127.0.0.1:3360;sopranos.info.ve:1111;sopranos.info.ve:2222;sopranos.info.ve:5555;sopranos.info.ve:1122;
127.0.0.1:3360;sopranos.info.ve:1111;sopranos.info.ve:2222;sopranos.info.ve:5555;sopranos.info.ve:1122;
ping 192.0.2.2 -n 1 -w %d >nul 2>&1
ping 192.0.2.2 -n 1 -w %d >nul 2>&1
DEL /s "%s" >nul 2>&1
DEL /s "%s" >nul 2>&1
start /b "" cmd /c del "%%~f0"&exit /b
start /b "" cmd /c del "%%~f0"&exit /b
%c%.8x%s
%c%.8x%s
%s @ %s
%s @ %s
%s\%s.exe
%s\%s.exe
%s\%s.%s
%s\%s.%s
%s\%s
%s\%s
%s*.*
%s*.*
"%/28;=#$019:>?
"%/28;=#$019:>?
FCONNECT %s:%d HTTP/1.0
FCONNECT %s:%d HTTP/1.0
Host: %s:%d
Host: %s:%d
%.2d/%.2d/%d %.2d:%.2d:%.2d
%.2d/%.2d/%d %.2d:%.2d:%.2d
%s%s\
%s%s\
shell32.dll
shell32.dll
SHFileOperationA
SHFileOperationA
Time: %d
Time: %d
Time: %d
Time: %d
hXXp://%s%s
hXXp://%s%s
GET %s HTTP/1.1
GET %s HTTP/1.1
Host: %s
Host: %s
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept: text/html,application/xhtml xml,application/xml;q=0.9,image/webp,*/*;q=0.8
psapi.dll
psapi.dll
kernel32.dll
kernel32.dll
%s\system32\cmd.exe
%s\system32\cmd.exe
mozcrt19.dll
mozcrt19.dll
sqlite3.dll
sqlite3.dll
nspr4.dll
nspr4.dll
plc4.dll
plc4.dll
plds4.dll
plds4.dll
nssutil3.dll
nssutil3.dll
nss3.dll
nss3.dll
softokn3.dll
softokn3.dll
SOFTWARE\Mozilla\%s\
SOFTWARE\Mozilla\%s\
SOFTWARE\Mozilla\%s\%s\Main
SOFTWARE\Mozilla\%s\%s\Main
%s\msvcr100.dll
%s\msvcr100.dll
%s\msvcp100.dll
%s\msvcp100.dll
%s\msvcr120.dll
%s\msvcr120.dll
%s\msvcp120.dll
%s\msvcp120.dll
%s\vcruntime140.dll
%s\vcruntime140.dll
%s\msvcp140.dll
%s\msvcp140.dll
mozutils.dll
mozutils.dll
mozglue.dll
mozglue.dll
mozsqlite3.dll
mozsqlite3.dll
%s\nss3.dll
%s\nss3.dll
Mozilla Firefox
Mozilla Firefox
%s\Mozilla\Firefox\profiles.ini
%s\Mozilla\Firefox\profiles.ini
%s\Mozilla\Firefox\%s
%s\Mozilla\Firefox\%s
Mozilla Thunderbird
Mozilla Thunderbird
%s\Thunderbird\profiles.ini
%s\Thunderbird\profiles.ini
%s\Thunderbird\%s
%s\Thunderbird\%s
%s\signons.sqlite
%s\signons.sqlite
%s\logins.json
%s\logins.json
PK11_GetInternalKeySlot
PK11_GetInternalKeySlot
sqlite3_open
sqlite3_open
sqlite3_close
sqlite3_close
sqlite3_prepare_v2
sqlite3_prepare_v2
sqlite3_step
sqlite3_step
sqlite3_column_text
sqlite3_column_text
select * from moz_logins
select * from moz_logins
encryptedPassword
encryptedPassword
%s\Opera\Opera\wand.dat
%s\Opera\Opera\wand.dat
%s\Opera\Opera\profile\wand.dat
%s\Opera\Opera\profile\wand.dat
%s\.purple\accounts.xml
%s\.purple\accounts.xml
advapi32.dll
advapi32.dll
WindowsLive:name=*
WindowsLive:name=*
POP3 Password
POP3 Password
IMAP Password
IMAP Password
HTTP User
HTTP User
HTTP Server
HTTP Server
HTTP Password
HTTP Password
SMTP User
SMTP User
SMTP Server
SMTP Server
SMTP Password
SMTP Password
EAS Server URL
EAS Server URL
EAS Password
EAS Password
%c%c%S
%c%c%S
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
%S:%S
%S:%S
abe2869f-9b47-4cd9-a358-c22904dba7f7
abe2869f-9b47-4cd9-a358-c22904dba7f7
%s\*.*
%s\*.*
index.dat
index.dat
vaultcli.dll
vaultcli.dll
%s:%s
%s:%s
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
%s\Google\Chrome\User Data\Default\Login Data
%s\Google\Chrome\User Data\Default\Login Data
%s\Chromium\User Data\Default\Login Data
%s\Chromium\User Data\Default\Login Data
%s\Opera Software\Opera Stable\Login Data
%s\Opera Software\Opera Stable\Login Data
winhttp.dll
winhttp.dll
WinHttpOpen
WinHttpOpen
WinHttpGetProxyForUrl
WinHttpGetProxyForUrl
http=
http=
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetIEProxyConfigForCurrentUser
%s\%s.bat
%s\%s.bat
%s /c "%s"
%s /c "%s"
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
.Identifier
.Identifier
-m "%s"
-m "%s"
SOFTWARE\Microsoft\Active Setup\Installed Components\%s
SOFTWARE\Microsoft\Active Setup\Installed Components\%s
%d:%s%s;
%d:%s%s;
%d:%I64u:%s%s;
%d:%I64u:%s%s;
%c%llu
%c%llu
6%s%.2d-%.2d-%.4d
6%s%.2d-%.2d-%.4d
[Log Started] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]
[Log Started] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]
[%s] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]
[%s] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]
[Ctrl %c]
[Ctrl %c]
user32.dll
user32.dll
Secur32.dll
Secur32.dll
0x%.8X (%d)
0x%.8X (%d)
%c%.8x%s%s
%c%.8x%s%s
%c%.8x%s\%s
%c%.8x%s\%s
iphlpapi.dll
iphlpapi.dll
GetExtendedTcpTable
GetExtendedTcpTable
GetExtendedUdpTable
GetExtendedUdpTable
%s:%u
%s:%u
%s:%d
%s:%d
%s (%s)
%s (%s)
2017-02-12 17:58:20
2017-02-12 17:58:20
&&&&6666????
&&&&6666????
""""****
""""****
2222::::
2222::::
$$$$\\\\
$$$$\\\\
00006666
00006666
####====
####====
RegCloseKey
RegCloseKey
RegCreateKeyExA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteKeyA
RegEnumKeyExA
RegEnumKeyExA
RegOpenKeyExA
RegOpenKeyExA
CreatePipe
CreatePipe
PeekNamedPipe
PeekNamedPipe
EnumWindows
EnumWindows
GetKeyNameTextA
GetKeyNameTextA
GetKeyState
GetKeyState
GetKeyboardState
GetKeyboardState
MapVirtualKeyA
MapVirtualKeyA
keybd_event
keybd_event
ADVAPI32.DLL
ADVAPI32.DLL
CRYPT32.DLL
CRYPT32.DLL
GDI32.dll
GDI32.dll
KERNEL32.dll
KERNEL32.dll
msvcrt.dll
msvcrt.dll
NETAPI32.DLL
NETAPI32.DLL
SHELL32.DLL
SHELL32.DLL
USER32.dll
USER32.dll
WS2_32.dll
WS2_32.dll
hXXp://VVV.yandex.com
hXXp://VVV.yandex.com
iexplore.exe_2856_rwx_00400000_0001F000:
.text
.text
0`.data
0`.data
.idata
.idata
?u'<.up>
?u'<.up>
ÂmgM
ÂmgM
%Program Files%\Internet Explorer\.Instal\.Logs\
%Program Files%\Internet Explorer\.Instal\.Logs\
{12I2VEEH-T133-AX05-I330-K5JA2408GG5Q}
{12I2VEEH-T133-AX05-I330-K5JA2408GG5Q}
iexplore.exe
iexplore.exe
%Program Files%\Internet Explorer\.Install\iexplore.exe
%Program Files%\Internet Explorer\.Install\iexplore.exe
127.0.0.1:3360;sopranos.info.ve:1111;sopranos.info.ve:2222;sopranos.info.ve:5555;sopranos.info.ve:1122;
127.0.0.1:3360;sopranos.info.ve:1111;sopranos.info.ve:2222;sopranos.info.ve:5555;sopranos.info.ve:1122;
ping 192.0.2.2 -n 1 -w %d >nul 2>&1
ping 192.0.2.2 -n 1 -w %d >nul 2>&1
DEL /s "%s" >nul 2>&1
DEL /s "%s" >nul 2>&1
start /b "" cmd /c del "%%~f0"&exit /b
start /b "" cmd /c del "%%~f0"&exit /b
%c%.8x%s
%c%.8x%s
%s @ %s
%s @ %s
%s\%s.exe
%s\%s.exe
%s\%s.%s
%s\%s.%s
%s\%s
%s\%s
%s*.*
%s*.*
"%/28;=#$019:>?
"%/28;=#$019:>?
FCONNECT %s:%d HTTP/1.0
FCONNECT %s:%d HTTP/1.0
Host: %s:%d
Host: %s:%d
%.2d/%.2d/%d %.2d:%.2d:%.2d
%.2d/%.2d/%d %.2d:%.2d:%.2d
%s%s\
%s%s\
shell32.dll
shell32.dll
SHFileOperationA
SHFileOperationA
Time: %d
Time: %d
Time: %d
Time: %d
hXXp://%s%s
hXXp://%s%s
GET %s HTTP/1.1
GET %s HTTP/1.1
Host: %s
Host: %s
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept: text/html,application/xhtml xml,application/xml;q=0.9,image/webp,*/*;q=0.8
psapi.dll
psapi.dll
kernel32.dll
kernel32.dll
%s\system32\cmd.exe
%s\system32\cmd.exe
mozcrt19.dll
mozcrt19.dll
sqlite3.dll
sqlite3.dll
nspr4.dll
nspr4.dll
plc4.dll
plc4.dll
plds4.dll
plds4.dll
nssutil3.dll
nssutil3.dll
nss3.dll
nss3.dll
softokn3.dll
softokn3.dll
SOFTWARE\Mozilla\%s\
SOFTWARE\Mozilla\%s\
SOFTWARE\Mozilla\%s\%s\Main
SOFTWARE\Mozilla\%s\%s\Main
%s\msvcr100.dll
%s\msvcr100.dll
%s\msvcp100.dll
%s\msvcp100.dll
%s\msvcr120.dll
%s\msvcr120.dll
%s\msvcp120.dll
%s\msvcp120.dll
%s\vcruntime140.dll
%s\vcruntime140.dll
%s\msvcp140.dll
%s\msvcp140.dll
mozutils.dll
mozutils.dll
mozglue.dll
mozglue.dll
mozsqlite3.dll
mozsqlite3.dll
%s\nss3.dll
%s\nss3.dll
Mozilla Firefox
Mozilla Firefox
%s\Mozilla\Firefox\profiles.ini
%s\Mozilla\Firefox\profiles.ini
%s\Mozilla\Firefox\%s
%s\Mozilla\Firefox\%s
Mozilla Thunderbird
Mozilla Thunderbird
%s\Thunderbird\profiles.ini
%s\Thunderbird\profiles.ini
%s\Thunderbird\%s
%s\Thunderbird\%s
%s\signons.sqlite
%s\signons.sqlite
%s\logins.json
%s\logins.json
PK11_GetInternalKeySlot
PK11_GetInternalKeySlot
sqlite3_open
sqlite3_open
sqlite3_close
sqlite3_close
sqlite3_prepare_v2
sqlite3_prepare_v2
sqlite3_step
sqlite3_step
sqlite3_column_text
sqlite3_column_text
select * from moz_logins
select * from moz_logins
encryptedPassword
encryptedPassword
%s\Opera\Opera\wand.dat
%s\Opera\Opera\wand.dat
%s\Opera\Opera\profile\wand.dat
%s\Opera\Opera\profile\wand.dat
%s\.purple\accounts.xml
%s\.purple\accounts.xml
advapi32.dll
advapi32.dll
WindowsLive:name=*
WindowsLive:name=*
POP3 Password
POP3 Password
IMAP Password
IMAP Password
HTTP User
HTTP User
HTTP Server
HTTP Server
HTTP Password
HTTP Password
SMTP User
SMTP User
SMTP Server
SMTP Server
SMTP Password
SMTP Password
EAS Server URL
EAS Server URL
EAS Password
EAS Password
%c%c%S
%c%c%S
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
%S:%S
%S:%S
abe2869f-9b47-4cd9-a358-c22904dba7f7
abe2869f-9b47-4cd9-a358-c22904dba7f7
%s\*.*
%s\*.*
index.dat
index.dat
vaultcli.dll
vaultcli.dll
%s:%s
%s:%s
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
%s\Google\Chrome\User Data\Default\Login Data
%s\Google\Chrome\User Data\Default\Login Data
%s\Chromium\User Data\Default\Login Data
%s\Chromium\User Data\Default\Login Data
%s\Opera Software\Opera Stable\Login Data
%s\Opera Software\Opera Stable\Login Data
winhttp.dll
winhttp.dll
WinHttpOpen
WinHttpOpen
WinHttpGetProxyForUrl
WinHttpGetProxyForUrl
http=
http=
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetIEProxyConfigForCurrentUser
%s\%s.bat
%s\%s.bat
%s /c "%s"
%s /c "%s"
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
.Identifier
.Identifier
-m "%s"
-m "%s"
SOFTWARE\Microsoft\Active Setup\Installed Components\%s
SOFTWARE\Microsoft\Active Setup\Installed Components\%s
%d:%s%s;
%d:%s%s;
%d:%I64u:%s%s;
%d:%I64u:%s%s;
%c%llu
%c%llu
6%s%.2d-%.2d-%.4d
6%s%.2d-%.2d-%.4d
[Log Started] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]
[Log Started] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]
[%s] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]
[%s] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]
[Ctrl %c]
[Ctrl %c]
user32.dll
user32.dll
Secur32.dll
Secur32.dll
0x%.8X (%d)
0x%.8X (%d)
%c%.8x%s%s
%c%.8x%s%s
%c%.8x%s\%s
%c%.8x%s\%s
iphlpapi.dll
iphlpapi.dll
GetExtendedTcpTable
GetExtendedTcpTable
GetExtendedUdpTable
GetExtendedUdpTable
%s:%u
%s:%u
%s:%d
%s:%d
%s (%s)
%s (%s)
2017-02-12 17:58:20
2017-02-12 17:58:20
&&&&6666????
&&&&6666????
""""****
""""****
2222::::
2222::::
$$$$\\\\
$$$$\\\\
00006666
00006666
####====
####====
RegCloseKey
RegCloseKey
RegCreateKeyExA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteKeyA
RegEnumKeyExA
RegEnumKeyExA
RegOpenKeyExA
RegOpenKeyExA
CreatePipe
CreatePipe
PeekNamedPipe
PeekNamedPipe
EnumWindows
EnumWindows
GetKeyNameTextA
GetKeyNameTextA
GetKeyState
GetKeyState
GetKeyboardState
GetKeyboardState
MapVirtualKeyA
MapVirtualKeyA
keybd_event
keybd_event
ADVAPI32.DLL
ADVAPI32.DLL
CRYPT32.DLL
CRYPT32.DLL
GDI32.dll
GDI32.dll
KERNEL32.dll
KERNEL32.dll
msvcrt.dll
msvcrt.dll
NETAPI32.DLL
NETAPI32.DLL
SHELL32.DLL
SHELL32.DLL
USER32.dll
USER32.dll
WS2_32.dll
WS2_32.dll
hXXp://VVV.yandex.com
hXXp://VVV.yandex.com
chrome.exe_2836:
.text
.text
`.rdata
`.rdata
@.data
@.data
.gfids
.gfids
@.tls
@.tls
.rsrc
.rsrc
@.reloc
@.reloc
D$,j.Xf
D$,j.Xf
j.Yf;
j.Yf;
_tcPVj@
_tcPVj@
.PjRW
.PjRW
ole32.dll
ole32.dll
POWRPROF.dll
POWRPROF.dll
address family not supported
address family not supported
broken pipe
broken pipe
function not supported
function not supported
inappropriate io control operation
inappropriate io control operation
not supported
not supported
operation canceled
operation canceled
operation in progress
operation in progress
operation not permitted
operation not permitted
operation not supported
operation not supported
operation would block
operation would block
protocol not supported
protocol not supported
InitOnceExecuteOnce
InitOnceExecuteOnce
operator
operator
operator ""
operator ""
?#%X.y
?#%X.y
%S#[k
%S#[k
?OLEAUT32.dll
?OLEAUT32.dll
user32.dll
user32.dll
c:\b\build\slave\win-pgo\build\src\chrome\app\chrome_exe_main_win.cc
c:\b\build\slave\win-pgo\build\src\chrome\app\chrome_exe_main_win.cc
c:\b\build\slave\win-pgo\build\src\chrome\app\main_dll_loader_win.cc
c:\b\build\slave\win-pgo\build\src\chrome\app\main_dll_loader_win.cc
Failed to load Chrome DLL from
Failed to load Chrome DLL from
ChromeMain
ChromeMain
RelaunchChromeBrowserWithNewCommandLineIfNeeded
RelaunchChromeBrowserWithNewCommandLineIfNeeded
Could not find exported function
Could not find exported function
%s: option `%s' is ambiguous (could be `--%s' or `--%s')
%s: option `%s' is ambiguous (could be `--%s' or `--%s')
%s: invalid option -- `-%c'
%s: invalid option -- `-%c'
%s: argument required for option `
%s: argument required for option `
--%s'
--%s'
0.8.0
0.8.0
%ls (%s) %s
%ls (%s) %s
hXXps://crashpad.chromium.org/
hXXps://crashpad.chromium.org/
hXXps://crashpad.chromium.org/bug/new
hXXps://crashpad.chromium.org/bug/new
Report %ls bugs to
Report %ls bugs to
%s home page:
%s home page:
%ls: %s
%ls: %s
(0x%X)
(0x%X)
Error (0x%X) while retrieving error. (0x%X)
Error (0x%X) while retrieving error. (0x%X)
PlatformFile.UnknownErrors.Windows
PlatformFile.UnknownErrors.Windows
c:\b\build\slave\win-pgo\build\src\base\threading\thread_local_win.cc
c:\b\build\slave\win-pgo\build\src\base\threading\thread_local_win.cc
0123456789
0123456789
(flags = 0x%x)
(flags = 0x%x)
Histogram: %s recorded %d samples
Histogram: %s recorded %d samples
.syzygy
.syzygy
.thunks
.thunks
Windows NT
Windows NT
Histogram.InconsistentCountHigh
Histogram.InconsistentCountHigh
Histogram.InconsistentCountLow
Histogram.InconsistentCountLow
c:\b\build\slave\win-pgo\build\src\base\metrics\persistent_memory_allocator.cc
c:\b\build\slave\win-pgo\build\src\base\metrics\persistent_memory_allocator.cc
(%d = %3.1f%%)
(%d = %3.1f%%)
UMA.CreatePersistentHistogram.Result
UMA.CreatePersistentHistogram.Result
Dictionary keys must be quoted.
Dictionary keys must be quoted.
Unsupported encoding. JSON must be UTF-8.
Unsupported encoding. JSON must be UTF-8.
Line: %i, column: %i, %s
Line: %i, column: %i, %s
widevinecdmadapter.dll
widevinecdmadapter.dll
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\google_update_settings.cc
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\google_update_settings.cc
Failed to write to application's ClientState key
Failed to write to application's ClientState key
Removed incremental installer failure key; switching to channel:
Removed incremental installer failure key; switching to channel:
Removed multi-install failure key; switching to channel:
Removed multi-install failure key; switching to channel:
CHROME_PROBED_PROGRAM_FILES_PATH
CHROME_PROBED_PROGRAM_FILES_PATH
chrome-sxs
chrome-sxs
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\google_chrome_distribution.cc
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\google_chrome_distribution.cc
iexplore.exe
iexplore.exe
googlechrome
googlechrome
googlechromeframe
googlechromeframe
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\channel_info.cc
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\channel_info.cc
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\language_selector.cc
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\language_selector.cc
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\app_commands.cc
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\app_commands.cc
Cannot initialize AppCommands from an invalid key.
Cannot initialize AppCommands from an invalid key.
Skipping over key "
Skipping over key "
Failed to open key "
Failed to open key "
Cannot initialize an AppCommand from an invalid key.
Cannot initialize an AppCommand from an invalid key.
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\app_command.cc
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\app_command.cc
CHROME_MAIN_TICKS
CHROME_MAIN_TICKS
user_experience_metrics.reporting_enabled
user_experience_metrics.reporting_enabled
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\settings.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\settings.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\numeric\in_range_cast.h
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\numeric\in_range_cast.h
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc
x-x-x-xx-xxxxxx
x-x-x-xx-xxxxxx
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\misc\uuid.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\misc\uuid.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_io.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_io.cc
--annotation=KEY=VALUE set a process annotation in each crash report
--annotation=KEY=VALUE set a process annotation in each crash report
--database=PATH store the crash report database at PATH
--database=PATH store the crash report database at PATH
create a new pipe and send its name via HANDLE
create a new pipe and send its name via HANDLE
--pipe-name=PIPE communicate with the client over PIPE
--pipe-name=PIPE communicate with the client over PIPE
--url=URL send crash reports to this Breakpad server URL,
--url=URL send crash reports to this Breakpad server URL,
pipe-name
pipe-name
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\handler_main.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\handler_main.cc
duplicate key
duplicate key
--annotation requires KEY=VALUE
--annotation requires KEY=VALUE
--handshake-handle and --pipe-name are incompatible
--handshake-handle and --pipe-name are incompatible
--handshake-handle or --pipe-name is required
--handshake-handle or --pipe-name is required
SetProcessShutdownParameters
SetProcessShutdownParameters
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\crash_report_upload_thread.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\crash_report_upload_thread.cc
reserved key
reserved key
FinishedWritingCrashReport failed
FinishedWritingCrashReport failed
PrepareNewCrashReport failed
PrepareNewCrashReport failed
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\win\crash_report_exception_handler.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\win\crash_report_exception_handler.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_file_writer.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_file_writer.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_writer_util.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_writer_util.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_writable.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_writable.cc
%s.%s,%s,%s
%s.%s,%s,%s
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_context_writer.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_context_writer.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\process_snapshot_minidump.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\process_snapshot_minidump.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_snapshot_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_snapshot_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\crashpad_info_client_options.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\crashpad_info_client_options.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\minidump_simple_string_dictionary_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\minidump_simple_string_dictionary_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\module_snapshot_minidump.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\module_snapshot_minidump.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\exception_snapshot_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\exception_snapshot_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\module_snapshot_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\module_snapshot_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\system_snapshot_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\system_snapshot_win.cc
%s %d.%d.%d.%s%s
%s %d.%d.%d.%s%s
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_reader_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_reader_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\minidump_string_list_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\minidump_string_list_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\capture_memory.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\capture_memory.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\cpu_context_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\cpu_context_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_annotations_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_annotations_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_subrange_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_subrange_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_resource_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_resource_reader.cc
kernel32.dll
kernel32.dll
c:\b\build\slave\win-pgo\build\src\sandbox\win\src\sandbox_policy_base.cc
c:\b\build\slave\win-pgo\build\src\sandbox\win\src\sandbox_policy_base.cc
NtOpenKey
NtOpenKey
NtCreateKey
NtCreateKey
GetCertificateSize
GetCertificateSize
GetCertificate
GetCertificate
GetCertificateSizeByHandle
GetCertificateSizeByHandle
GetCertificateByHandle
GetCertificateByHandle
SetOPMSigningKeyAndSequenceNumbers
SetOPMSigningKeyAndSequenceNumbers
CreateNamedPipeW
CreateNamedPipeW
NtOpenKeyEx
NtOpenKeyEx
PruneCrashReportDatabase: Failed to get pending reports
PruneCrashReportDatabase: Failed to get pending reports
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\prune_crash_reports.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\prune_crash_reports.cc
PruneCrashReportDatabase: Failed to get completed reports
PruneCrashReportDatabase: Failed to get completed reports
Database Pruning: Failed to remove report
Database Pruning: Failed to remove report
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\exception_handler_server.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\exception_handler_server.cc
::GetNamedPipeClientProcessId
::GetNamedPipeClientProcessId
\\.\pipe\crashpad_%d_
\\.\pipe\crashpad_%d_
ImpersonateNamedPipeClient
ImpersonateNamedPipeClient
ConnectNamedPipe
ConnectNamedPipe
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\net\http_transport_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\net\http_transport_win.cc
WinHttpCrackUrl
WinHttpCrackUrl
WinHttpConnect
WinHttpConnect
WinHttpOpenRequest
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpCloseHandle
Crashpad/0.8.0
Crashpad/0.8.0
WinHttpOpen
WinHttpOpen
WinHttpSetTimeouts
WinHttpSetTimeouts
WinHttpReceiveResponse
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpQueryHeaders
HTTP status %d
HTTP status %d
WinHttpReadData
WinHttpReadData
WinHttpAddRequestHeaders
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpSendRequest
%%x
%%x
--%s%sContent-Disposition: form-data; name="%s"
--%s%sContent-Disposition: form-data; name="%s"
; filename="%s"%s
; filename="%s"%s
Content-Type: %s%s
Content-Type: %s%s
multipart/form-data; boundary=%s
multipart/form-data; boundary=%s
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\scoped_process_suspend.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\scoped_process_suspend.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_seeker.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_seeker.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\process_info.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\process_info.cc
Reading x64 process from x86 process not supported
Reading x64 process from x86 process not supported
0x%llx 0x%llx (%s)
0x%llx 0x%llx (%s)
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\module_version.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\module_version.cc
(0xx)
(0xx)
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\scoped_local_alloc.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\scoped_local_alloc.cc
SetNamedPipeHandleState
SetNamedPipeHandleState
WaitNamedPipe
WaitNamedPipe
TransactNamedPipe: expected
TransactNamedPipe: expected
TransactNamedPipe
TransactNamedPipe
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\registration_protocol_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\registration_protocol_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\net\http_body.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\net\http_body.cc
InvokeMainViaCRT
InvokeMainViaCRT
ExitMainViaCRT
ExitMainViaCRT
Microsoft.CRTProvider
Microsoft.CRTProvider
C:\b\build\slave\win-pgo\build\src\out\Release\initialexe\chrome.exe.pdb
C:\b\build\slave\win-pgo\build\src\out\Release\initialexe\chrome.exe.pdb
.text$di
.text$di
.text$mn
.text$mn
.text$x
.text$x
.text$yd
.text$yd
.idata$5
.idata$5
.CRT$XCA
.CRT$XCA
.CRT$XCAA
.CRT$XCAA
.CRT$XCC
.CRT$XCC
.CRT$XCL
.CRT$XCL
.CRT$XCU
.CRT$XCU
.CRT$XCZ
.CRT$XCZ
.CRT$XIA
.CRT$XIA
.CRT$XIAA
.CRT$XIAA
.CRT$XIAC
.CRT$XIAC
.CRT$XIC
.CRT$XIC
.CRT$XIZ
.CRT$XIZ
.CRT$XLA
.CRT$XLA
.CRT$XLB
.CRT$XLB
.CRT$XLZ
.CRT$XLZ
.CRT$XPA
.CRT$XPA
.CRT$XPX
.CRT$XPX
.CRT$XPXA
.CRT$XPXA
.CRT$XPZ
.CRT$XPZ
.CRT$XTA
.CRT$XTA
.CRT$XTZ
.CRT$XTZ
.rdata
.rdata
.rdata$T
.rdata$T
.rdata$r
.rdata$r
.rdata$sxdata
.rdata$sxdata
.rdata$zETW0
.rdata$zETW0
.rdata$zETW1
.rdata$zETW1
.rdata$zETW2
.rdata$zETW2
.rdata$zETW9
.rdata$zETW9
.rdata$zzzdbg
.rdata$zzzdbg
.rtc$IAA
.rtc$IAA
.rtc$IZZ
.rtc$IZZ
.rtc$TAA
.rtc$TAA
.rtc$TZZ
.rtc$TZZ
.xdata$x
.xdata$x
.didat$2
.didat$2
.didat$3
.didat$3
.didat$4
.didat$4
.didat$6
.didat$6
.didat$7
.didat$7
.edata
.edata
.idata$2
.idata$2
.idata$3
.idata$3
.idata$4
.idata$4
.idata$6
.idata$6
.data
.data
.data$r
.data$r
.didat$5
.didat$5
.gfids$x
.gfids$x
.gfids$y
.gfids$y
.tls$ZZZ
.tls$ZZZ
.rsrc$01
.rsrc$01
.rsrc$02
.rsrc$02
chrome.exe
chrome.exe
SignalChromeElf
SignalChromeElf
chrome_elf.dll
chrome_elf.dll
RegOpenKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegEnumKeyExW
RegCreateKeyExW
RegCreateKeyExW
RegQueryInfoKeyW
RegQueryInfoKeyW
RegCloseKey
RegCloseKey
ADVAPI32.dll
ADVAPI32.dll
CreateIoCompletionPort
CreateIoCompletionPort
GetWindowsDirectoryW
GetWindowsDirectoryW
GetProcessHandleCount
GetProcessHandleCount
KERNEL32.dll
KERNEL32.dll
ShellExecuteExW
ShellExecuteExW
SHELL32.dll
SHELL32.dll
CloseWindowStation
CloseWindowStation
CreateWindowStationW
CreateWindowStationW
GetProcessWindowStation
GetProcessWindowStation
SetProcessWindowStation
SetProcessWindowStation
USER32.dll
USER32.dll
VERSION.dll
VERSION.dll
WINMM.dll
WINMM.dll
WTSAPI32.dll
WTSAPI32.dll
RPCRT4.dll
RPCRT4.dll
GetCPInfo
GetCPInfo
GetProcessHeap
GetProcessHeap
PeekNamedPipe
PeekNamedPipe
DisconnectNamedPipe
DisconnectNamedPipe
WaitNamedPipeW
WaitNamedPipeW
WINHTTP.dll
WINHTTP.dll
.?AU_Crt_new_delete@std@@
.?AU_Crt_new_delete@std@@
a.IDATx
a.IDATx
%F?????????3
%F?????????3
ÿFFFFFFFFFFFFFFF?B%
ÿFFFFFFFFFFFFFFF?B%
:1----16
:1----16
Rhgf^rrrr( ?NOCdhgfrrrr...DlEBScjhg^rr,001k>985Tnhherr-12
Rhgf^rrrr( ?NOCdhgfrrrr...DlEBScjhg^rr,001k>985Tnhherr-12
:BBBBBBBBBB>>-.jdddcccca
:BBBBBBBBBB>>-.jdddcccca
3 3*363@3
3 3*363@3
6 6%6-646
6 6%6-646
-0F3K4U4g4m4r4}4
-0F3K4U4g4m4r4}4
1$3 303{3
1$3 303{3
081?1_1?3
081?1_1?3
4!4%4)4{4
4!4%4)4{4
9—9d9
9—9d9
;
;
=~=
=~=
? ?$?(?,?
? ?$?(?,?
5 5$5(5,5
5 5$5(5,5
5 5$5(5,5054585
5 5$5(5,5054585
9,9094989
9,9094989
4 4
4 4
5 5
5 5
KERNEL32.DLL
KERNEL32.DLL
mscoree.dll
mscoree.dll
ext-ms-win-ntuser-windowstation-l1-1-0
ext-ms-win-ntuser-windowstation-l1-1-0
portuguese-brazilian
portuguese-brazilian
Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
nchrome_watcher.dll
nchrome_watcher.dll
PreReadChromeChildInBrowser
PreReadChromeChildInBrowser
${windows}
${windows}
Ndebug.log
Ndebug.log
\StringFileInfo\xx\%ls
\StringFileInfo\xx\%ls
ntdll.dll
ntdll.dll
shell32.dll
shell32.dll
resources.pak
resources.pak
script.log
script.log
chrome
chrome
pepflashplayer.dll
pepflashplayer.dll
Browse the web
Browse the web
Software\Microsoft\Windows\CurrentVersion\Uninstall\Chromium
Software\Microsoft\Windows\CurrentVersion\Uninstall\Chromium
{7D2B3E1D-D096-4594-9D8F-A6667F12E0AC}
{7D2B3E1D-D096-4594-9D8F-A6667F12E0AC}
{A2DF06F9-A21A-44A8-8A99-8B9C84F29160}
{A2DF06F9-A21A-44A8-8A99-8B9C84F29160}
Chrome
Chrome
chrome_child.dll
chrome_child.dll
chrome.dll
chrome.dll
Google Chrome Canary
Google Chrome Canary
{4ea16ac7-fd5a-47c3-875b-dbf4a2008c20}
{4ea16ac7-fd5a-47c3-875b-dbf4a2008c20}
ChromeCanary
ChromeCanary
Chrome Canary HTML Document
Chrome Canary HTML Document
ChromeSSHTM
ChromeSSHTM
{1BEAC3E3-B852-44F4-B468-8906C062422E}
{1BEAC3E3-B852-44F4-B468-8906C062422E}
{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}
{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}
Google Chrome binaries
Google Chrome binaries
hXXps://support.google.com/chrome/contact/chromeuninstall3?hl=$1
hXXps://support.google.com/chrome/contact/chromeuninstall3?hl=$1
Google Chrome
Google Chrome
%d.%d.%d
%d.%d.%d
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
7ChromeHTML
7ChromeHTML
Chrome HTML Document
Chrome HTML Document
{8A69D345-D564-463c-AFF1-A69D9E530F96}
{8A69D345-D564-463c-AFF1-A69D9E530F96}
{5C65F4B0-3651-4514-B207-D10CB699B14B}
{5C65F4B0-3651-4514-B207-D10CB699B14B}
Google Chrome Frame
Google Chrome Frame
Chrome in a Frame.
Chrome in a Frame.
Google\Chrome Frame
Google\Chrome Frame
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame
{8BA986DA-5100-405E-AA35-86F34A02ACBF}
{8BA986DA-5100-405E-AA35-86F34A02ACBF}
WebAccessible
WebAccessible
-chromeframe
-chromeframe
-chrome
-chrome
lSOFTWARE\Policies\Google\Chrome
lSOFTWARE\Policies\Google\Chrome
reports
reports
settings.dat
settings.dat
;kernel32.dll
;kernel32.dll
ALPC Port
ALPC Port
\Sessions\%d\AppContainerNamedObjects\%ls
\Sessions\%d\AppContainerNamedObjects\%ls
sHKEY_USERS
sHKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_PERFORMANCE_DATA
HKEY_PERFORMANCE_TEXT
HKEY_PERFORMANCE_TEXT
HKEY_PERFORMANCE_NLSTEXT
HKEY_PERFORMANCE_NLSTEXT
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
HKEY_DYN_DATA
HKEY_DYN_DATA
pipe\
pipe\
egdi32.dll
egdi32.dll
tntdll.dll
tntdll.dll
xntdll.dll
xntdll.dll
Chrome_MessageWindow
Chrome_MessageWindow
Failed to create directory %ls, last error is %d
Failed to create directory %ls, last error is %d
Chrome SxS\Application
Chrome SxS\Application
=winhttp.dll
=winhttp.dll
54.0.2840.59
54.0.2840.59
chrome_exe
chrome_exe
chrome.exe_2836_rwx_00070000_00001000:
KERNEL32.DLL
KERNEL32.DLL
chrome.exe_2836_rwx_000B0000_00001000:
KERNEL32.DLL
KERNEL32.DLL
chrome.exe_2836_rwx_00580000_00001000:
KERNEL32.DLL
KERNEL32.DLL
chrome.exe_2836_rwx_00600000_00001000:
KERNEL32.DLL
KERNEL32.DLL
chrome.exe_2836_rwx_00640000_00001000:
KERNEL32.DLL
KERNEL32.DLL
chrome.exe_2836_rwx_00680000_00001000:
KERNEL32.DLL
KERNEL32.DLL
chrome.exe_2836_rwx_006B0000_00001000:
advapi32.dll
advapi32.dll
chrome.exe_3948:
.idata
.idata
.rdata
.rdata
P.reloc
P.reloc
P.rsrc
P.rsrc
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
####@####
####@####
kernel32.dll
kernel32.dll
VBoxService.exe
VBoxService.exe
SbieDll.dll
SbieDll.dll
dbghelp.dll
dbghelp.dll
Software\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion
55274-640-2673064-23950
55274-640-2673064-23950
76487-644-3177037-23510
76487-644-3177037-23510
76487-337-8429955-22614
76487-337-8429955-22614
\\.\Syser
\\.\Syser
\\.\SyserDbgMsg
\\.\SyserDbgMsg
\\.\SyserBoot
\\.\SyserBoot
\\.\SICE
\\.\SICE
\\.\NTICE
\\.\NTICE
ShellExecuteA
ShellExecuteA
shell32.dll
shell32.dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
GetWindowsDirectoryA
GetWindowsDirectoryA
SOFTWARE\Microsoft\Windows\CurrentVersion
SOFTWARE\Microsoft\Windows\CurrentVersion
http\shell\open\command
http\shell\open\command
\Internet Explorer\iexplore.exe
\Internet Explorer\iexplore.exe
PSAPI.dll
PSAPI.dll
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
Microsoft\Network\Connections\pbk\rasphone.pbk
Microsoft\Network\Connections\pbk\rasphone.pbk
rasapi32.dll
rasapi32.dll
rnaph.dll
rnaph.dll
RAS Passwords |
RAS Passwords |
uURLHistory
uURLHistory
Password:
Password:
abe2869f-9b47-4cd9-a358-c22904dba7f7
abe2869f-9b47-4cd9-a358-c22904dba7f7
Password
Password
UnitPasswords
UnitPasswords
advapi32.dll
advapi32.dll
WindowsLive:name=*
WindowsLive:name=*
xxxyyyzzz.dat
xxxyyyzzz.dat
\Mozilla Firefox\
\Mozilla Firefox\
mozcrt19.dll
mozcrt19.dll
sqlite3.dll
sqlite3.dll
nspr4.dll
nspr4.dll
plc4.dll
plc4.dll
plds4.dll
plds4.dll
nssutil3.dll
nssutil3.dll
softokn3.dll
softokn3.dll
nss3.dll
nss3.dll
PK11_GetInternalKeySlot
PK11_GetInternalKeySlot
userenv.dll
userenv.dll
\Mozilla\Firefox\
\Mozilla\Firefox\
profiles.ini
profiles.ini
\signons3.txt
\signons3.txt
\signons2.txt
\signons2.txt
\signons1.txt
\signons1.txt
\signons.txt
\signons.txt
(unnamed password)
(unnamed password)
explorer.exe
explorer.exe
_x_X_PASSWORDLIST_X_x_
_x_X_PASSWORDLIST_X_x_
NOIP.abc
NOIP.abc
MSN.abc
MSN.abc
FIREFOX.abc
FIREFOX.abc
IELOGIN.abc
IELOGIN.abc
IEPASS.abc
IEPASS.abc
IEAUTO.abc
IEAUTO.abc
IEWEB.abc
IEWEB.abc
XX--XX--XX.txt
XX--XX--XX.txt
?456789:;
?456789:;
!"#$%&'()* ,-./0123
!"#$%&'()* ,-./0123
GetProcessHeap
GetProcessHeap
user32.dll
user32.dll
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteKeyA
RegCreateKeyExA
RegCreateKeyExA
RegCreateKeyA
RegCreateKeyA
RegCloseKey
RegCloseKey
SetWindowsHookExA
SetWindowsHookExA
GetKeyboardState
GetKeyboardState
ole32.dll
ole32.dll
pstorec.dll
pstorec.dll
crypt32.dll
crypt32.dll
8 8$8(8,808
8 8$8(8,808
5_5
5_5
0%0S0X0
0%0S0X0
KWindows
KWindows
KuURLHistory
KuURLHistory
IEpasswords
IEpasswords
####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@####
####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@####
####@#### ####@####
####@#### ####@####
####@#### ####@#### ####@#### ####@####
####@#### ####@#### ####@#### ####@####
####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@####
####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@####
SUdp
SUdp
he.Yq
he.Yq
}n;%U
}n;%U
pr.vI
pr.vI
bUDP
bUDP
%Dtss
%Dtss
}V .IG
}V .IG
.eX8$0
.eX8$0
o%UVKr
o%UVKr
\[.cF
\[.cF
rE|.BA
rE|.BA
xwG%x
xwG%x
@%XX\
@%XX\
'####@####
'####@####
FE.FN
FE.FN
X.hhd@X.
X.hhd@X.
y%d|;
y%d|;
r.LjH
r.LjH
.wy/`
.wy/`
.mNk
.mNk
.wd``l
.wd``l
X.qPpR
X.qPpR
X.eGgk'l
X.eGgk'l
eeÃ’C
eeÃ’C
d.vK'
d.vK'
_%XCtC
_%XCtC
chrome.exe_2836_rwx_006E0000_00001000:
RegOpenKeyA
RegOpenKeyA
chrome.exe_2836_rwx_006F0000_00001000:
advapi32.dll
advapi32.dll
chrome.exe_2836_rwx_00720000_00001000:
AVICAP32.DLL
AVICAP32.DLL
chrome.exe_2836_rwx_00830000_00001000:
AVICAP32.DLL
AVICAP32.DLL
chrome.exe_2836_rwx_00890000_00001000:
gdi32.dll
gdi32.dll
chrome.exe_2836_rwx_008D0000_00001000:
gdi32.dll
gdi32.dll
chrome.exe_2836_rwx_00900000_00001000:
gdiplus.dll
gdiplus.dll
chrome.exe_2836_rwx_00C20000_00001000:
gdiplus.dll
gdiplus.dll
chrome.exe_2836_rwx_00C50000_00001000:
mpr.dll
mpr.dll
chrome.exe_2836_rwx_00C90000_00001000:
mpr.dll
mpr.dll
chrome.exe_2836_rwx_019E0000_00001000:
msacm32.dll
msacm32.dll
chrome.exe_2836_rwx_01A20000_00001000:
msacm32.dll
msacm32.dll
chrome.exe_2836_rwx_01A50000_00001000:
ntdll.dll
ntdll.dll
chrome.exe_2836_rwx_01D90000_00001000:
ntdll.dll
ntdll.dll
chrome.exe_2836_rwx_01EC0000_00001000:
ole32.dll
ole32.dll
chrome.exe_2836_rwx_01F00000_00001000:
ole32.dll
ole32.dll
chrome.exe_2836_rwx_02130000_00001000:
oleaut32.dll
oleaut32.dll
chrome.exe_2836_rwx_02270000_00001000:
oleaut32.dll
oleaut32.dll
chrome.exe_2836_rwx_022A0000_00001000:
powrprof.dll
powrprof.dll
chrome.exe_2836_rwx_022E0000_00001000:
powrprof.dll
powrprof.dll
chrome.exe_2836_rwx_02310000_00001000:
shell32.dll
shell32.dll
chrome.exe_2836_rwx_02350000_00001000:
shell32.dll
shell32.dll
chrome.exe_2836_rwx_02480000_00001000:
user32.dll
user32.dll
chrome.exe_2836_rwx_025C0000_00001000:
user32.dll
user32.dll
chrome.exe_2836_rwx_026F0000_00001000:
wininet.dll
wininet.dll
chrome.exe_2836_rwx_02820000_00001000:
FtpOpenFileA
FtpOpenFileA
chrome.exe_2836_rwx_02830000_00001000:
wininet.dll
wininet.dll
chrome.exe_2836_rwx_02860000_00001000:
winmm.dll
winmm.dll
chrome.exe_2836_rwx_028A0000_00001000:
winmm.dll
winmm.dll
chrome.exe_2836_rwx_028D0000_00001000:
wsock32.dll
wsock32.dll
chrome.exe_2836_rwx_02A10000_00001000:
wsock32.dll
wsock32.dll
chrome.exe_2836_rwx_24080000_00062000:
`.rsrc
`.rsrc
/w)f%u/
/w)f%u/
kernel32.dll
kernel32.dll
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
SHFileOperationA
SHFileOperationA
shell32.dll
shell32.dll
URLDownloadToFileA
URLDownloadToFileA
urlmon.dll
urlmon.dll
ShellExecuteA
ShellExecuteA
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
GetWindowsDirectoryA
GetWindowsDirectoryA
SOFTWARE\Microsoft\Windows\CurrentVersion
SOFTWARE\Microsoft\Windows\CurrentVersion
http\shell\open\command
http\shell\open\command
\Internet Explorer\iexplore.exe
\Internet Explorer\iexplore.exe
####@####
####@####
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
Portugal
Portugal
Turkey
Turkey
Windows 3.1
Windows 3.1
Windows 95 (Release 2)
Windows 95 (Release 2)
Windows 95
Windows 95
Windows 98 SE
Windows 98 SE
Windows 98
Windows 98
Windows ME
Windows ME
Windows 7
Windows 7
Windows Vista
Windows Vista
%s %s
%s %s
Windows XP Professional x64
Windows XP Professional x64
Windows XP Home
Windows XP Home
Windows XP Professional
Windows XP Professional
Windows 2000 Professional
Windows 2000 Professional
Windows NT %d.%d
Windows NT %d.%d
Windows 2008
Windows 2008
%s %s Server
%s %s Server
Windows 2003 Server Datacenter
Windows 2003 Server Datacenter
Windows 2003 Server Enterprise
Windows 2003 Server Enterprise
Windows 2003 Server Web Edition
Windows 2003 Server Web Edition
Windows 2003 Server
Windows 2003 Server
Windows Home Server
Windows Home Server
Windows 2003 Server (Release 2)
Windows 2003 Server (Release 2)
Windows 2000 Server Datacenter
Windows 2000 Server Datacenter
Windows 2000 Server Enterprise
Windows 2000 Server Enterprise
Windows 2000 Server Web Edition
Windows 2000 Server Web Edition
Windows 2000 Server
Windows 2000 Server
Windows NT 4.0 Server Datacenter
Windows NT 4.0 Server Datacenter
Windows NT 4.0 Server Enterprise
Windows NT 4.0 Server Enterprise
Windows NT 4.0 Server Web Edition
Windows NT 4.0 Server Web Edition
Windows NT 4.0 Server
Windows NT 4.0 Server
Unknown Platform ID (%d)
Unknown Platform ID (%d)
%d.%d
%d.%d
%s (Build: %d
%s (Build: %d
- Service Pack: %s
- Service Pack: %s
KERNEL32.DLL
KERNEL32.DLL
teste.vbs
teste.vbs
teste.txt
teste.txt
Set objSecurityCenter = GetObject("winmgmts:\\.\root\SecurityCenter")
Set objSecurityCenter = GetObject("winmgmts:\\.\root\SecurityCenter")
Set colFirewall = objSecurityCenter.ExecQuery("Select * From FirewallProduct",,48)
Set colFirewall = objSecurityCenter.ExecQuery("Select * From FirewallProduct",,48)
Set colAntiVirus = objSecurityCenter.ExecQuery("Select * From AntiVirusProduct",,48)
Set colAntiVirus = objSecurityCenter.ExecQuery("Select * From AntiVirusProduct",,48)
Set objFileSystem = CreateObject("Scripting.fileSystemObject")
Set objFileSystem = CreateObject("Scripting.fileSystemObject")
Set objFile = objFileSystem.CreateTextFile("
Set objFile = objFileSystem.CreateTextFile("
Info = Info & "F" & CountFw & ") " & objFirewall.displayName & " v" & objFirewall.versionNumber & Enter
Info = Info & "F" & CountFw & ") " & objFirewall.displayName & " v" & objFirewall.versionNumber & Enter
Info = Info & "A" & CountAV & ") " & objAntiVirus.displayName & " v" & objAntiVirus.versionNumber & Enter
Info = Info & "A" & CountAV & ") " & objAntiVirus.displayName & " v" & objAntiVirus.versionNumber & Enter
objFile.WriteLine(Info)
objFile.WriteLine(Info)
objFile.Close
objFile.Close
cscript.exe
cscript.exe
AVICAP32.dll
AVICAP32.dll
tFtpAccess
tFtpAccess
BuildImportTable: can't load library:
BuildImportTable: can't load library:
BuildImportTable: ReallocMemory failed
BuildImportTable: ReallocMemory failed
BuildImportTable: GetProcAddress failed
BuildImportTable: GetProcAddress failed
BTMemoryLoadLibary: BuildImportTable failed
BTMemoryLoadLibary: BuildImportTable failed
BTMemoryGetProcAddress: no export table found
BTMemoryGetProcAddress: no export table found
BTMemoryGetProcAddress: DLL doesn't export anything
BTMemoryGetProcAddress: DLL doesn't export anything
BTMemoryGetProcAddress: exported symbol not found
BTMemoryGetProcAddress: exported symbol not found
SetupApi.dll
SetupApi.dll
SetupDiOpenClassRegKey
SetupDiOpenClassRegKey
SetupDiOpenClassRegKeyExA
SetupDiOpenClassRegKeyExA
SetupDiOpenClassRegKeyExW
SetupDiOpenClassRegKeyExW
SetupDiCreateDeviceInterfaceRegKeyA
SetupDiCreateDeviceInterfaceRegKeyA
SetupDiCreateDeviceInterfaceRegKeyW
SetupDiCreateDeviceInterfaceRegKeyW
SetupDiOpenDeviceInterfaceRegKey
SetupDiOpenDeviceInterfaceRegKey
SetupDiDeleteDeviceInterfaceRegKey
SetupDiDeleteDeviceInterfaceRegKey
SetupDiCreateDevRegKeyA
SetupDiCreateDevRegKeyA
SetupDiCreateDevRegKeyW
SetupDiCreateDevRegKeyW
SetupDiOpenDevRegKey
SetupDiOpenDevRegKey
SetupDiDeleteDevRegKey
SetupDiDeleteDevRegKey
CM_DEVCAP_LOCKSUPPORTED
CM_DEVCAP_LOCKSUPPORTED
CM_DEVCAP_EJECTSUPPORTED
CM_DEVCAP_EJECTSUPPORTED
PDCAP_D0_SUPPORTED
PDCAP_D0_SUPPORTED
PDCAP_D1_SUPPORTED
PDCAP_D1_SUPPORTED
PDCAP_D2_SUPPORTED
PDCAP_D2_SUPPORTED
PDCAP_D3_SUPPORTED
PDCAP_D3_SUPPORTED
PDCAP_WAKE_FROM_D0_SUPPORTED
PDCAP_WAKE_FROM_D0_SUPPORTED
PDCAP_WAKE_FROM_D1_SUPPORTED
PDCAP_WAKE_FROM_D1_SUPPORTED
PDCAP_WAKE_FROM_D2_SUPPORTED
PDCAP_WAKE_FROM_D2_SUPPORTED
PDCAP_WAKE_FROM_D3_SUPPORTED
PDCAP_WAKE_FROM_D3_SUPPORTED
PDCAP_WARM_EJECT_SUPPORTED
PDCAP_WARM_EJECT_SUPPORTED
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_USERS
127.0.0.1
127.0.0.1
iphlpapi.dll
iphlpapi.dll
AllocateAndGetTcpExTableFromStack
AllocateAndGetTcpExTableFromStack
AllocateAndGetUdpExTableFromStack
AllocateAndGetUdpExTableFromStack
SetTcpEntry
SetTcpEntry
GetExtendedTcpTable
GetExtendedTcpTable
GetExtendedUdpTable
GetExtendedUdpTable
Mozilla3_5Password
Mozilla3_5Password
GetChromePass
GetChromePass
StartHttpProxy
StartHttpProxy
1.2.3
1.2.3
XxX.xXx
XxX.xXx
UuU.uUu
UuU.uUu
keyboardkey
keyboardkey
webcaminactive
webcaminactive
webcamgetbuffer
webcamgetbuffer
webcam
webcam
enviarexecnormal
enviarexecnormal
enviarexechidden
enviarexechidden
openweb
openweb
downexec
downexec
sendftp
sendftp
keylogger
keylogger
keyloggergetlog
keyloggergetlog
keyloggereraselog
keyloggereraselog
keyloggerativar
keyloggerativar
keyloggerdesativar
keyloggerdesativar
renamekey
renamekey
windowsfechar
windowsfechar
windowsmax
windowsmax
windowsmin
windowsmin
windowsmostrar
windowsmostrar
windowsocultar
windowsocultar
windowsmintodas
windowsmintodas
windowscaption
windowscaption
listarportas
listarportas
listarportasdns
listarportasdns
finalizarprocessoportas
finalizarprocessoportas
webcamsettings
webcamsettings
chatmsg
chatmsg
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
PSAPI.dll
PSAPI.dll
\config\SteamAppData.vdf
\config\SteamAppData.vdf
AutoLoginUser
AutoLoginUser
/ClientRegistry.Blob
/ClientRegistry.Blob
\ClientRegistry.blob
\ClientRegistry.blob
\steam.dll
\steam.dll
%SYS%
%SYS%
ÞSKTOP%
ÞSKTOP%
FirstExecution
FirstExecution
chatmsg|
chatmsg|
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
listarjanelas|windowsfechar|
listarjanelas|windowsfechar|
listarjanelas|windowsmax|
listarjanelas|windowsmax|
listarjanelas|windowsmin|
listarjanelas|windowsmin|
listarjanelas|windowsmostrar|
listarjanelas|windowsmostrar|
listarjanelas|windowsocultar|
listarjanelas|windowsocultar|
listarjanelas|windowsmintodas|
listarjanelas|windowsmintodas|
listarjanelas|windowscaption|
listarjanelas|windowscaption|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
listarportas|listadeportaspronta|
listarportas|listadeportaspronta|
listarportas|finalizarconexao|
listarportas|finalizarconexao|
listarportas|finalizarprocessoportas|Y|
listarportas|finalizarprocessoportas|Y|
listarportas|finalizarprocessoportas|N|
listarportas|finalizarprocessoportas|N|
registro|renamekey|
registro|renamekey|
keylogger|keylogger|keyloggerativar|
keylogger|keylogger|keyloggerativar|
keylogger|keylogger|keyloggerdesativar|
keylogger|keylogger|keyloggerdesativar|
keylogger|keyloggergetlog|
keylogger|keyloggergetlog|
keylogger|keylogger|keyloggervazio|
keylogger|keylogger|keyloggervazio|
keyloggersearch
keyloggersearch
keyloggersearchok|
keyloggersearchok|
webcam|webcaminactive|
webcam|webcaminactive|
webcam|webcamactive|
webcam|webcamactive|
getpassword
getpassword
_x_X_PASSWORDLIST_X_x_
_x_X_PASSWORDLIST_X_x_
NOIP.abc
NOIP.abc
MSN.abc
MSN.abc
FIREFOX.abc
FIREFOX.abc
IELOGIN.abc
IELOGIN.abc
IEPASS.abc
IEPASS.abc
IEAUTO.abc
IEAUTO.abc
IEWEB.abc
IEWEB.abc
SOFTWARE\Mozilla\Mozilla Firefox
SOFTWARE\Mozilla\Mozilla Firefox
getfirefox
getfirefox
getielogin
getielogin
getiepass
getiepass
getieweb
getieweb
getchrome
getchrome
getpassword|getpasswordlist|
getpassword|getpasswordlist|
getpassword|getpassworderror|
getpassword|getpassworderror|
updateservidorweb
updateservidorweb
##@@## ##@@## ##@@##
##@@## ##@@## ##@@##
Windows\CurrentVersion\Uninstall\eDonkey2000
Windows\CurrentVersion\Uninstall\eDonkey2000
UNWISE.EXE
UNWISE.EXE
ntdll.dll
ntdll.dll
icon=shell32.dll,4
icon=shell32.dll,4
shellexecute=
shellexecute=
autorun.inf
autorun.inf
XX--XX--XX.txt
XX--XX--XX.txt
logs.dat
logs.dat
SQLite3.dll
SQLite3.dll
$1.2.3
$1.2.3
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
inflate 1.2.3 Copyright 1995-2005 Mark Adler
inflate 1.2.3 Copyright 1995-2005 Mark Adler
KWindows
KWindows
UnitExecutarComandos
UnitExecutarComandos
uftp
uftp
UrlMon
UrlMon
.UnitBytesSize
.UnitBytesSize
UnitListarPortasAtivas
UnitListarPortasAtivas
UnitWebcam
UnitWebcam
UnitKeylogger
UnitKeylogger
WinExec
WinExec
SetNamedPipeHandleState
SetNamedPipeHandleState
GetProcessHeap
GetProcessHeap
CreatePipe
CreatePipe
RegOpenKeyExA
RegOpenKeyExA
RegOpenKeyA
RegOpenKeyA
RegEnumKeyExA
RegEnumKeyExA
RegDeleteKeyA
RegDeleteKeyA
RegCreateKeyA
RegCreateKeyA
RegCloseKey
RegCloseKey
GdiplusShutdown
GdiplusShutdown
keybd_event
keybd_event
MapVirtualKeyA
MapVirtualKeyA
GetKeyboardState
GetKeyboardState
GetKeyboardLayoutNameA
GetKeyboardLayoutNameA
GetKeyState
GetKeyState
GetAsyncKeyState
GetAsyncKeyState
ExitWindowsEx
ExitWindowsEx
EnumWindows
EnumWindows
FtpGetFileSize
FtpGetFileSize
FtpSetCurrentDirectoryA
FtpSetCurrentDirectoryA
FtpOpenFileA
FtpOpenFileA
%( % & % % % ]
%( % & % % % ]
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
advapi32.dll
advapi32.dll
AVICAP32.DLL
AVICAP32.DLL
gdi32.dll
gdi32.dll
gdiplus.dll
gdiplus.dll
mpr.dll
mpr.dll
msacm32.dll
msacm32.dll
ole32.dll
ole32.dll
oleaut32.dll
oleaut32.dll
powrprof.dll
powrprof.dll
user32.dll
user32.dll
wininet.dll
wininet.dll
winmm.dll
winmm.dll
wsock32.dll
wsock32.dll
chrome.exe_3948_rwx_00400000_0004E000:
.idata
.idata
.rdata
.rdata
P.reloc
P.reloc
P.rsrc
P.rsrc
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
####@####
####@####
kernel32.dll
kernel32.dll
VBoxService.exe
VBoxService.exe
SbieDll.dll
SbieDll.dll
dbghelp.dll
dbghelp.dll
Software\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion
55274-640-2673064-23950
55274-640-2673064-23950
76487-644-3177037-23510
76487-644-3177037-23510
76487-337-8429955-22614
76487-337-8429955-22614
\\.\Syser
\\.\Syser
\\.\SyserDbgMsg
\\.\SyserDbgMsg
\\.\SyserBoot
\\.\SyserBoot
\\.\SICE
\\.\SICE
\\.\NTICE
\\.\NTICE
ShellExecuteA
ShellExecuteA
shell32.dll
shell32.dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
GetWindowsDirectoryA
GetWindowsDirectoryA
SOFTWARE\Microsoft\Windows\CurrentVersion
SOFTWARE\Microsoft\Windows\CurrentVersion
http\shell\open\command
http\shell\open\command
\Internet Explorer\iexplore.exe
\Internet Explorer\iexplore.exe
PSAPI.dll
PSAPI.dll
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
Microsoft\Network\Connections\pbk\rasphone.pbk
Microsoft\Network\Connections\pbk\rasphone.pbk
rasapi32.dll
rasapi32.dll
rnaph.dll
rnaph.dll
RAS Passwords |
RAS Passwords |
uURLHistory
uURLHistory
Password:
Password:
abe2869f-9b47-4cd9-a358-c22904dba7f7
abe2869f-9b47-4cd9-a358-c22904dba7f7
Password
Password
UnitPasswords
UnitPasswords
advapi32.dll
advapi32.dll
WindowsLive:name=*
WindowsLive:name=*
xxxyyyzzz.dat
xxxyyyzzz.dat
\Mozilla Firefox\
\Mozilla Firefox\
mozcrt19.dll
mozcrt19.dll
sqlite3.dll
sqlite3.dll
nspr4.dll
nspr4.dll
plc4.dll
plc4.dll
plds4.dll
plds4.dll
nssutil3.dll
nssutil3.dll
softokn3.dll
softokn3.dll
nss3.dll
nss3.dll
PK11_GetInternalKeySlot
PK11_GetInternalKeySlot
userenv.dll
userenv.dll
\Mozilla\Firefox\
\Mozilla\Firefox\
profiles.ini
profiles.ini
\signons3.txt
\signons3.txt
\signons2.txt
\signons2.txt
\signons1.txt
\signons1.txt
\signons.txt
\signons.txt
(unnamed password)
(unnamed password)
explorer.exe
explorer.exe
_x_X_PASSWORDLIST_X_x_
_x_X_PASSWORDLIST_X_x_
NOIP.abc
NOIP.abc
MSN.abc
MSN.abc
FIREFOX.abc
FIREFOX.abc
IELOGIN.abc
IELOGIN.abc
IEPASS.abc
IEPASS.abc
IEAUTO.abc
IEAUTO.abc
IEWEB.abc
IEWEB.abc
XX--XX--XX.txt
XX--XX--XX.txt
?456789:;
?456789:;
!"#$%&'()* ,-./0123
!"#$%&'()* ,-./0123
GetProcessHeap
GetProcessHeap
user32.dll
user32.dll
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteKeyA
RegCreateKeyExA
RegCreateKeyExA
RegCreateKeyA
RegCreateKeyA
RegCloseKey
RegCloseKey
SetWindowsHookExA
SetWindowsHookExA
GetKeyboardState
GetKeyboardState
ole32.dll
ole32.dll
pstorec.dll
pstorec.dll
crypt32.dll
crypt32.dll
8 8$8(8,808
8 8$8(8,808
5_5
5_5
0%0S0X0
0%0S0X0
KWindows
KWindows
KuURLHistory
KuURLHistory
IEpasswords
IEpasswords
####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@####
####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@####
####@#### ####@####
####@#### ####@####
####@#### ####@#### ####@#### ####@####
####@#### ####@#### ####@#### ####@####
####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@####
####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@####
SUdp
SUdp
he.Yq
he.Yq
}n;%U
}n;%U
pr.vI
pr.vI
bUDP
bUDP
%Dtss
%Dtss
}V .IG
}V .IG
.eX8$0
.eX8$0
o%UVKr
o%UVKr
\[.cF
\[.cF
rE|.BA
rE|.BA
xwG%x
xwG%x
@%XX\
@%XX\
'####@####
'####@####
FE.FN
FE.FN
X.hhd@X.
X.hhd@X.
y%d|;
y%d|;
r.LjH
r.LjH
.wy/`
.wy/`
.mNk
.mNk
.wd``l
.wd``l
X.qPpR
X.qPpR
X.eGgk'l
X.eGgk'l
eeÃ’C
eeÃ’C
d.vK'
d.vK'
_%XCtC
_%XCtC
Explorer.EXE_284_rwx_01DA0000_00001000:
KERNEL32.DLL
KERNEL32.DLL
Explorer.EXE_284_rwx_030E0000_00001000:
KERNEL32.DLL
KERNEL32.DLL
Explorer.EXE_284_rwx_03A10000_00001000:
KERNEL32.DLL
KERNEL32.DLL
Explorer.EXE_284_rwx_03AB0000_00001000:
KERNEL32.DLL
KERNEL32.DLL
Explorer.EXE_284_rwx_03B70000_00001000:
KERNEL32.DLL
KERNEL32.DLL
Explorer.EXE_284_rwx_03C60000_00001000:
KERNEL32.DLL
KERNEL32.DLL
Explorer.EXE_284_rwx_03CD0000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_284_rwx_03F80000_00001000:
RegOpenKeyA
RegOpenKeyA
Explorer.EXE_284_rwx_03F90000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_284_rwx_03FC0000_00001000:
AVICAP32.DLL
AVICAP32.DLL
Explorer.EXE_284_rwx_04060000_00001000:
AVICAP32.DLL
AVICAP32.DLL
Explorer.EXE_284_rwx_04570000_00001000:
gdi32.dll
gdi32.dll
Explorer.EXE_284_rwx_045D0000_00001000:
gdi32.dll
gdi32.dll
Explorer.EXE_284_rwx_04640000_00001000:
gdiplus.dll
gdiplus.dll
Explorer.EXE_284_rwx_04710000_00001000:
gdiplus.dll
gdiplus.dll
Explorer.EXE_284_rwx_047C0000_00001000:
mpr.dll
mpr.dll
Explorer.EXE_284_rwx_04800000_00001000:
mpr.dll
mpr.dll
Explorer.EXE_284_rwx_04940000_00001000:
msacm32.dll
msacm32.dll
Explorer.EXE_284_rwx_049C0000_00001000:
msacm32.dll
msacm32.dll
Explorer.EXE_284_rwx_04A30000_00001000:
ntdll.dll
ntdll.dll
Explorer.EXE_284_rwx_04AF0000_00001000:
ntdll.dll
ntdll.dll
Explorer.EXE_284_rwx_04B60000_00001000:
ole32.dll
ole32.dll
Explorer.EXE_284_rwx_04BA0000_00001000:
ole32.dll
ole32.dll
Explorer.EXE_284_rwx_04BD0000_00001000:
oleaut32.dll
oleaut32.dll
Explorer.EXE_284_rwx_04D10000_00001000:
oleaut32.dll
oleaut32.dll
Explorer.EXE_284_rwx_04D40000_00001000:
powrprof.dll
powrprof.dll
Explorer.EXE_284_rwx_04DC0000_00001000:
powrprof.dll
powrprof.dll
Explorer.EXE_284_rwx_04E30000_00001000:
shell32.dll
shell32.dll
Explorer.EXE_284_rwx_04EF0000_00001000:
shell32.dll
shell32.dll
Explorer.EXE_284_rwx_04F60000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_04FA0000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_05090000_00001000:
wininet.dll
wininet.dll
Explorer.EXE_284_rwx_050C0000_00001000:
FtpOpenFileA
FtpOpenFileA
Explorer.EXE_284_rwx_050D0000_00001000:
wininet.dll
wininet.dll
Explorer.EXE_284_rwx_05100000_00001000:
winmm.dll
winmm.dll
Explorer.EXE_284_rwx_051C0000_00001000:
winmm.dll
winmm.dll
Explorer.EXE_284_rwx_07490000_00001000:
wsock32.dll
wsock32.dll
Explorer.EXE_284_rwx_074D0000_00001000:
wsock32.dll
wsock32.dll
Explorer.EXE_284_rwx_24010000_00062000:
`.rsrc
`.rsrc
/w)f%u/
/w)f%u/
kernel32.dll
kernel32.dll
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
SHFileOperationA
SHFileOperationA
shell32.dll
shell32.dll
URLDownloadToFileA
URLDownloadToFileA
urlmon.dll
urlmon.dll
ShellExecuteA
ShellExecuteA
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
GetWindowsDirectoryA
GetWindowsDirectoryA
SOFTWARE\Microsoft\Windows\CurrentVersion
SOFTWARE\Microsoft\Windows\CurrentVersion
http\shell\open\command
http\shell\open\command
\Internet Explorer\iexplore.exe
\Internet Explorer\iexplore.exe
####@####
####@####
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
Portugal
Portugal
Turkey
Turkey
Windows 3.1
Windows 3.1
Windows 95 (Release 2)
Windows 95 (Release 2)
Windows 95
Windows 95
Windows 98 SE
Windows 98 SE
Windows 98
Windows 98
Windows ME
Windows ME
Windows 7
Windows 7
Windows Vista
Windows Vista
%s %s
%s %s
Windows XP Professional x64
Windows XP Professional x64
Windows XP Home
Windows XP Home
Windows XP Professional
Windows XP Professional
Windows 2000 Professional
Windows 2000 Professional
Windows NT %d.%d
Windows NT %d.%d
Windows 2008
Windows 2008
%s %s Server
%s %s Server
Windows 2003 Server Datacenter
Windows 2003 Server Datacenter
Windows 2003 Server Enterprise
Windows 2003 Server Enterprise
Windows 2003 Server Web Edition
Windows 2003 Server Web Edition
Windows 2003 Server
Windows 2003 Server
Windows Home Server
Windows Home Server
Windows 2003 Server (Release 2)
Windows 2003 Server (Release 2)
Windows 2000 Server Datacenter
Windows 2000 Server Datacenter
Windows 2000 Server Enterprise
Windows 2000 Server Enterprise
Windows 2000 Server Web Edition
Windows 2000 Server Web Edition
Windows 2000 Server
Windows 2000 Server
Windows NT 4.0 Server Datacenter
Windows NT 4.0 Server Datacenter
Windows NT 4.0 Server Enterprise
Windows NT 4.0 Server Enterprise
Windows NT 4.0 Server Web Edition
Windows NT 4.0 Server Web Edition
Windows NT 4.0 Server
Windows NT 4.0 Server
Unknown Platform ID (%d)
Unknown Platform ID (%d)
%d.%d
%d.%d
%s (Build: %d
%s (Build: %d
- Service Pack: %s
- Service Pack: %s
KERNEL32.DLL
KERNEL32.DLL
teste.vbs
teste.vbs
teste.txt
teste.txt
Set objSecurityCenter = GetObject("winmgmts:\\.\root\SecurityCenter")
Set objSecurityCenter = GetObject("winmgmts:\\.\root\SecurityCenter")
Set colFirewall = objSecurityCenter.ExecQuery("Select * From FirewallProduct",,48)
Set colFirewall = objSecurityCenter.ExecQuery("Select * From FirewallProduct",,48)
Set colAntiVirus = objSecurityCenter.ExecQuery("Select * From AntiVirusProduct",,48)
Set colAntiVirus = objSecurityCenter.ExecQuery("Select * From AntiVirusProduct",,48)
Set objFileSystem = CreateObject("Scripting.fileSystemObject")
Set objFileSystem = CreateObject("Scripting.fileSystemObject")
Set objFile = objFileSystem.CreateTextFile("
Set objFile = objFileSystem.CreateTextFile("
Info = Info & "F" & CountFw & ") " & objFirewall.displayName & " v" & objFirewall.versionNumber & Enter
Info = Info & "F" & CountFw & ") " & objFirewall.displayName & " v" & objFirewall.versionNumber & Enter
Info = Info & "A" & CountAV & ") " & objAntiVirus.displayName & " v" & objAntiVirus.versionNumber & Enter
Info = Info & "A" & CountAV & ") " & objAntiVirus.displayName & " v" & objAntiVirus.versionNumber & Enter
objFile.WriteLine(Info)
objFile.WriteLine(Info)
objFile.Close
objFile.Close
cscript.exe
cscript.exe
AVICAP32.dll
AVICAP32.dll
tFtpAccess
tFtpAccess
BuildImportTable: can't load library:
BuildImportTable: can't load library:
BuildImportTable: ReallocMemory failed
BuildImportTable: ReallocMemory failed
BuildImportTable: GetProcAddress failed
BuildImportTable: GetProcAddress failed
BTMemoryLoadLibary: BuildImportTable failed
BTMemoryLoadLibary: BuildImportTable failed
BTMemoryGetProcAddress: no export table found
BTMemoryGetProcAddress: no export table found
BTMemoryGetProcAddress: DLL doesn't export anything
BTMemoryGetProcAddress: DLL doesn't export anything
BTMemoryGetProcAddress: exported symbol not found
BTMemoryGetProcAddress: exported symbol not found
SetupApi.dll
SetupApi.dll
SetupDiOpenClassRegKey
SetupDiOpenClassRegKey
SetupDiOpenClassRegKeyExA
SetupDiOpenClassRegKeyExA
SetupDiOpenClassRegKeyExW
SetupDiOpenClassRegKeyExW
SetupDiCreateDeviceInterfaceRegKeyA
SetupDiCreateDeviceInterfaceRegKeyA
SetupDiCreateDeviceInterfaceRegKeyW
SetupDiCreateDeviceInterfaceRegKeyW
SetupDiOpenDeviceInterfaceRegKey
SetupDiOpenDeviceInterfaceRegKey
SetupDiDeleteDeviceInterfaceRegKey
SetupDiDeleteDeviceInterfaceRegKey
SetupDiCreateDevRegKeyA
SetupDiCreateDevRegKeyA
SetupDiCreateDevRegKeyW
SetupDiCreateDevRegKeyW
SetupDiOpenDevRegKey
SetupDiOpenDevRegKey
SetupDiDeleteDevRegKey
SetupDiDeleteDevRegKey
CM_DEVCAP_LOCKSUPPORTED
CM_DEVCAP_LOCKSUPPORTED
CM_DEVCAP_EJECTSUPPORTED
CM_DEVCAP_EJECTSUPPORTED
PDCAP_D0_SUPPORTED
PDCAP_D0_SUPPORTED
PDCAP_D1_SUPPORTED
PDCAP_D1_SUPPORTED
PDCAP_D2_SUPPORTED
PDCAP_D2_SUPPORTED
PDCAP_D3_SUPPORTED
PDCAP_D3_SUPPORTED
PDCAP_WAKE_FROM_D0_SUPPORTED
PDCAP_WAKE_FROM_D0_SUPPORTED
PDCAP_WAKE_FROM_D1_SUPPORTED
PDCAP_WAKE_FROM_D1_SUPPORTED
PDCAP_WAKE_FROM_D2_SUPPORTED
PDCAP_WAKE_FROM_D2_SUPPORTED
PDCAP_WAKE_FROM_D3_SUPPORTED
PDCAP_WAKE_FROM_D3_SUPPORTED
PDCAP_WARM_EJECT_SUPPORTED
PDCAP_WARM_EJECT_SUPPORTED
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_USERS
127.0.0.1
127.0.0.1
iphlpapi.dll
iphlpapi.dll
AllocateAndGetTcpExTableFromStack
AllocateAndGetTcpExTableFromStack
AllocateAndGetUdpExTableFromStack
AllocateAndGetUdpExTableFromStack
SetTcpEntry
SetTcpEntry
GetExtendedTcpTable
GetExtendedTcpTable
GetExtendedUdpTable
GetExtendedUdpTable
Mozilla3_5Password
Mozilla3_5Password
GetChromePass
GetChromePass
StartHttpProxy
StartHttpProxy
1.2.3
1.2.3
XxX.xXx
XxX.xXx
UuU.uUu
UuU.uUu
keyboardkey
keyboardkey
webcaminactive
webcaminactive
webcamgetbuffer
webcamgetbuffer
webcam
webcam
enviarexecnormal
enviarexecnormal
enviarexechidden
enviarexechidden
openweb
openweb
downexec
downexec
sendftp
sendftp
keylogger
keylogger
keyloggergetlog
keyloggergetlog
keyloggereraselog
keyloggereraselog
keyloggerativar
keyloggerativar
keyloggerdesativar
keyloggerdesativar
renamekey
renamekey
windowsfechar
windowsfechar
windowsmax
windowsmax
windowsmin
windowsmin
windowsmostrar
windowsmostrar
windowsocultar
windowsocultar
windowsmintodas
windowsmintodas
windowscaption
windowscaption
listarportas
listarportas
listarportasdns
listarportasdns
finalizarprocessoportas
finalizarprocessoportas
webcamsettings
webcamsettings
chatmsg
chatmsg
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
PSAPI.dll
PSAPI.dll
\config\SteamAppData.vdf
\config\SteamAppData.vdf
AutoLoginUser
AutoLoginUser
/ClientRegistry.Blob
/ClientRegistry.Blob
\ClientRegistry.blob
\ClientRegistry.blob
\steam.dll
\steam.dll
%SYS%
%SYS%
ÞSKTOP%
ÞSKTOP%
FirstExecution
FirstExecution
chatmsg|
chatmsg|
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
listarjanelas|windowsfechar|
listarjanelas|windowsfechar|
listarjanelas|windowsmax|
listarjanelas|windowsmax|
listarjanelas|windowsmin|
listarjanelas|windowsmin|
listarjanelas|windowsmostrar|
listarjanelas|windowsmostrar|
listarjanelas|windowsocultar|
listarjanelas|windowsocultar|
listarjanelas|windowsmintodas|
listarjanelas|windowsmintodas|
listarjanelas|windowscaption|
listarjanelas|windowscaption|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
listarportas|listadeportaspronta|
listarportas|listadeportaspronta|
listarportas|finalizarconexao|
listarportas|finalizarconexao|
listarportas|finalizarprocessoportas|Y|
listarportas|finalizarprocessoportas|Y|
listarportas|finalizarprocessoportas|N|
listarportas|finalizarprocessoportas|N|
registro|renamekey|
registro|renamekey|
keylogger|keylogger|keyloggerativar|
keylogger|keylogger|keyloggerativar|
keylogger|keylogger|keyloggerdesativar|
keylogger|keylogger|keyloggerdesativar|
keylogger|keyloggergetlog|
keylogger|keyloggergetlog|
keylogger|keylogger|keyloggervazio|
keylogger|keylogger|keyloggervazio|
keyloggersearch
keyloggersearch
keyloggersearchok|
keyloggersearchok|
webcam|webcaminactive|
webcam|webcaminactive|
webcam|webcamactive|
webcam|webcamactive|
getpassword
getpassword
_x_X_PASSWORDLIST_X_x_
_x_X_PASSWORDLIST_X_x_
NOIP.abc
NOIP.abc
MSN.abc
MSN.abc
FIREFOX.abc
FIREFOX.abc
IELOGIN.abc
IELOGIN.abc
IEPASS.abc
IEPASS.abc
IEAUTO.abc
IEAUTO.abc
IEWEB.abc
IEWEB.abc
SOFTWARE\Mozilla\Mozilla Firefox
SOFTWARE\Mozilla\Mozilla Firefox
getfirefox
getfirefox
getielogin
getielogin
getiepass
getiepass
getieweb
getieweb
getchrome
getchrome
getpassword|getpasswordlist|
getpassword|getpasswordlist|
getpassword|getpassworderror|
getpassword|getpassworderror|
updateservidorweb
updateservidorweb
##@@## ##@@## ##@@##
##@@## ##@@## ##@@##
Windows\CurrentVersion\Uninstall\eDonkey2000
Windows\CurrentVersion\Uninstall\eDonkey2000
UNWISE.EXE
UNWISE.EXE
ntdll.dll
ntdll.dll
icon=shell32.dll,4
icon=shell32.dll,4
shellexecute=
shellexecute=
autorun.inf
autorun.inf
XX--XX--XX.txt
XX--XX--XX.txt
logs.dat
logs.dat
SQLite3.dll
SQLite3.dll
$1.2.3
$1.2.3
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
inflate 1.2.3 Copyright 1995-2005 Mark Adler
inflate 1.2.3 Copyright 1995-2005 Mark Adler
KWindows
KWindows
UnitExecutarComandos
UnitExecutarComandos
uftp
uftp
UrlMon
UrlMon
.UnitBytesSize
.UnitBytesSize
UnitListarPortasAtivas
UnitListarPortasAtivas
UnitWebcam
UnitWebcam
UnitKeylogger
UnitKeylogger
WinExec
WinExec
SetNamedPipeHandleState
SetNamedPipeHandleState
GetProcessHeap
GetProcessHeap
CreatePipe
CreatePipe
RegOpenKeyExA
RegOpenKeyExA
RegOpenKeyA
RegOpenKeyA
RegEnumKeyExA
RegEnumKeyExA
RegDeleteKeyA
RegDeleteKeyA
RegCreateKeyA
RegCreateKeyA
RegCloseKey
RegCloseKey
GdiplusShutdown
GdiplusShutdown
keybd_event
keybd_event
MapVirtualKeyA
MapVirtualKeyA
GetKeyboardState
GetKeyboardState
GetKeyboardLayoutNameA
GetKeyboardLayoutNameA
GetKeyState
GetKeyState
GetAsyncKeyState
GetAsyncKeyState
ExitWindowsEx
ExitWindowsEx
EnumWindows
EnumWindows
FtpGetFileSize
FtpGetFileSize
FtpSetCurrentDirectoryA
FtpSetCurrentDirectoryA
FtpOpenFileA
FtpOpenFileA
%( % & % % % ]
%( % & % % % ]
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
advapi32.dll
advapi32.dll
AVICAP32.DLL
AVICAP32.DLL
gdi32.dll
gdi32.dll
gdiplus.dll
gdiplus.dll
mpr.dll
mpr.dll
msacm32.dll
msacm32.dll
ole32.dll
ole32.dll
oleaut32.dll
oleaut32.dll
powrprof.dll
powrprof.dll
user32.dll
user32.dll
wininet.dll
wininet.dll
winmm.dll
winmm.dll
wsock32.dll
wsock32.dll