Trojan.Win32.Llac.lftm (Kaspersky), Gen:Variant.Kazy.51389 (B) (Emsisoft), Gen:Variant.Kazy.51389 (AdAware), WormRebhip.YR, GenericAutorunWorm.YR, GenericInjector.YR (Lavasoft MAS)Behaviour: Trojan, Worm, WormAutorun
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: a0adfabc592d6d8b55c45a229d4054ff
SHA1: 5a612914bcdd40942001c32f15d70346733dccc0
SHA256: 5b760125514253899df1c4f276d07d86ab6aa43793a6e923474ff171ba4bf988
SSDeep: 12288:qczgwp8Vui4A1ruz UfQxeezwa3xFCCCqoTXIdkkmlHNn6ccf:f9phi4wuzWeeX3bb9/svn6ccf
Size: 614400 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6
Company: no certificate found
Created at: 2017-01-09 01:13:32
Analyzed on: Windows7 SP1 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer. |
Process activity
The Trojan creates the following process(es):
msconfig.exe:1024
msconfig.exe:5616
msconfig.exe:3032
%original file name%.exe:1976
chrome.exe:3196
svhost.exe:5584
The Trojan injects its code into the following process(es):
msconfig.exe:5688
chrome.exe:2172
iexplore.exe:1652
iexplore.exe:3800
SearchProtocolHost.exe:3136
SearchFilterHost.exe:3104
iexplore.exe:5680
taskhost.exe:252
Explorer.EXE:284
csrss.exe:316
wininit.exe:356
csrss.exe:368
winlogon.exe:416
services.exe:460
lsass.exe:468
lsm.exe:476
Dwm.exe:528
svchost.exe:580
svchost.exe:648
svchost.exe:700
svchost.exe:820
svchost.exe:860
svchost.exe:1032
svchost.exe:1132
spoolsv.exe:1244
svchost.exe:1280
TPAutoConnSvc.exe:1624
svchost.exe:1736
TPAutoConnect.exe:2068
conhost.exe:2076
SearchIndexer.exe:2136
wmiprvse.exe:2360
svchost.exe:2884
conhost.exe:3448
taskhost.exe:3500
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process msconfig.exe:1024 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\RoamingMicrosoft\System\Services\18.exe (4185 bytes)
C:\Windows\System32\drivers\etc\hosts (421 bytes)
The process msconfig.exe:5616 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Windows\System32\drivers\etc\hosts (421 bytes)
The process msconfig.exe:3032 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\XX--XX--XX.txt (619 bytes)
C:\Windows\SystemWindows\svhost.exe (4185 bytes)
The process %original file name%.exe:1976 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Roaming\msconfig.exe (4799 bytes)
The process chrome.exe:3196 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Roaming\logs.dat (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat (80 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UuU.uUu (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\XxX.xXx (6184 bytes)
The Trojan deletes the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\XX--XX--XX.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UuU.uUu (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\XxX.xXx (0 bytes)
Registry activity
The process msconfig.exe:1024 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\DDECache\IExplore\WWW_OpenURL]
"processname" = "iexplore.exe"
"WindowClassName" = "DDEMLMom"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"18.exe" = "C:\Users\"%CurrentUserName%"\AppData\RoamingMicrosoft\System\Services\18.exe"
The process msconfig.exe:5616 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"18.exe" = "C:\Users\"%CurrentUserName%"\AppData\RoamingMicrosoft\System\Services\18.exe"
The process msconfig.exe:3032 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"Policies" = "C:\Windows\SystemWindows\svhost.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
"Policies" = "C:\Windows\SystemWindows\svhost.exe"
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{3SHX672F-471C-11UF-ET7N-85Q378VHK1M2}]
"StubPath" = "C:\Windows\SystemWindows\svhost.exe Restart"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"system32" = "C:\Windows\SystemWindows\svhost.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"system32" = "C:\Windows\SystemWindows\svhost.exe"
The process %original file name%.exe:1976 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"
The Trojan deletes the following value(s) in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
The process chrome.exe:3196 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKLM\SOFTWARE\Microsoft\Tracing\chrome_RASMANCS]
"FileDirectory" = "%windir%\tracing"
"MaxFileSize" = "1048576"
[HKLM\SOFTWARE\Microsoft\Tracing\chrome_RASAPI32]
"MaxFileSize" = "1048576"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\chrome_RASAPI32]
"EnableConsoleTracing" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\chrome_RASMANCS]
"FileTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\Tracing\chrome_RASAPI32]
"ConsoleTracingMask" = "4294901760"
"FileTracingMask" = "4294901760"
[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"
[HKCU\Software\Google\Chrome\BLBeacon]
"failed_count" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\chrome_RASMANCS]
"ConsoleTracingMask" = "4294901760"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 40 00 00 00 09 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Tracing\chrome_RASMANCS]
"EnableFileTracing" = "0"
[HKCU\Software\vÃÂÂtima]
"FirstExecution" = "12/01/2017 -- 01:37"
[HKLM\SOFTWARE\Microsoft\Tracing\chrome_RASAPI32]
"FileDirectory" = "%windir%\tracing"
[HKLM\SOFTWARE\Microsoft\Tracing\chrome_RASMANCS]
"EnableConsoleTracing" = "0"
[HKCU\Software\Microsoft]
"PIDprocess" = "3196"
[HKCU\Software\Google\Chrome\BLBeacon]
"State" = "2"
[HKCU\Software\vÃÂÂtima]
"NewIdentification" = "vÃÂÂtima"
[HKLM\SOFTWARE\Microsoft\Tracing\chrome_RASAPI32]
"EnableFileTracing" = "0"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"
The process svhost.exe:5584 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"
The Trojan deletes the following value(s) in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
Dropped PE files
There are no dropped PE files.
HOSTS file anomalies
The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 421 bytes in size. The following strings are added to the hosts file listed below:
virscan.org | |
virustotal.com | |
virusscan.jotti.org | |
vscan.novirusthanks.org | |
free.avg.com | |
avg.com | |
norton.com | |
www.norton.com | |
avast.com | |
trendmicro.com | |
pctools.com | |
kaskersky.com | |
www.kaspersky.com | |
bullguard.com | |
secunia.com | |
community.norton.com | |
av-comparatives.org | |
computerhope.com | |
nl.clamwin.com | |
clamwin.com | |
mac-forums.com | |
mcafee.com | |
barracudanetworks.com | |
stopzilla.com | |
free-av.com | |
symantec.com | |
eset.com |
Rootkit activity
No anomalies have been detected.
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
msconfig.exe:1024
msconfig.exe:5616
msconfig.exe:3032
%original file name%.exe:1976
chrome.exe:3196
svhost.exe:5584 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
C:\Users\"%CurrentUserName%"\AppData\RoamingMicrosoft\System\Services\18.exe (4185 bytes)
C:\Windows\System32\drivers\etc\hosts (421 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\XX--XX--XX.txt (619 bytes)
C:\Windows\SystemWindows\svhost.exe (4185 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\msconfig.exe (4799 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\logs.dat (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat (80 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UuU.uUu (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\XxX.xXx (6184 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"18.exe" = "C:\Users\"%CurrentUserName%"\AppData\RoamingMicrosoft\System\Services\18.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"system32" = "C:\Windows\SystemWindows\svhost.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"system32" = "C:\Windows\SystemWindows\svhost.exe" - Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
- Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.
Static Analysis
VersionInfo
Company Name: x3S5NtHe
Product Name: w2X0FbK
Product Version: 30.37.21.3
Legal Copyright: e9Y8NwCz0
Legal Trademarks: g3X4Nfr1AY
Original Filename: swwup0fn.exe
Internal Name: swwup0fn.exe
File Version: 30.37.21.3
File Description: Nomad Server
Comments: Xc87Awf5HD
Language: Language Neutral
Company Name: x3S5NtHeProduct Name: w2X0FbKProduct Version: 30.37.21.3Legal Copyright: e9Y8NwCz0Legal Trademarks: g3X4Nfr1AYOriginal Filename: swwup0fn.exeInternal Name: swwup0fn.exeFile Version: 30.37.21.3File Description: Nomad ServerComments: Xc87Awf5HDLanguage: Language Neutral
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 8192 | 528804 | 532480 | 5.47979 | 84a9772283d5ff9abef3492b13747528 |
.sdata | 540672 | 100 | 4096 | 0.169443 | ae710f237713d330aa5386c53c123afa |
.rsrc | 548864 | 68744 | 69632 | 3.77227 | 3962f4a1861a1fd0d729ab4742ebe42b |
.reloc | 622592 | 12 | 4096 | 0.011373 | 5b57ab3ea9e3117a0a08453cdec11d29 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://www.shafou.com/ | 104.28.12.66 |
hxxp://www.shafou.com/js.js | 104.28.12.66 |
hxxp://www.shafou.com/favicon.ico | 104.28.12.66 |
hxxp://e6845.dscb1.akamaiedge.net/crls/secureca.crl | |
hxxp://e8218.dscb1.akamaiedge.net/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6kg== | |
hxxp://www-google-analytics.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCBiAg+LLzED5 | |
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCBiAg+LLzED5 | |
hxxp://www3.l.google.com/GIAG2.crl | |
hxxp://www-google-analytics.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEg0aOXToYEC | |
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEg0aOXToYEC | |
hxxp://clients.l.google.com/GIAG2.crl | |
hxxp://gpla1.wac.v2cdn.net/CRL/Omniroot2025.crl | |
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCBiAg+LLzED5 | 216.58.209.46 |
hxxp://pki.google.com/GIAG2.crl | 216.58.209.78 |
hxxp://crl.geotrust.com/crls/secureca.crl | 23.43.133.163 |
hxxp://cdp1.public-trust.com/CRL/Omniroot2025.crl | 93.184.220.20 |
hxxp://g.symcd.com/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6kg== | 23.43.139.27 |
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEg0aOXToYEC | 216.58.209.46 |
stats.g.doubleclick.net | 108.177.14.157 |
www.server.com | 52.8.126.80 |
www.google-analytics.com | 173.194.113.196 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6kg== HTTP/1.1
Cache-Control: max-age = 564348
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 12 Oct 2016 22:33:53 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: g.symcd.com
HTTP/1.1 200 OK
Server: nginx/1.10.2
Content-Type: application/ocsp-response
Content-Length: 1377
content-transfer-encoding: binary
Cache-Control: max-age=468888, public, no-transform, must-revalidate
Last-Modified: Tue, 10 Jan 2017 09:50:52 GMT
Expires: Tue, 17 Jan 2017 09:50:52 GMT
Date: Wed, 11 Jan 2017 23:38:04 GMT
Connection: keep-alive
0..]......V0..R.. .....0.....C0..?0......V.T'S...q..."...zr.*..20170110095052Z0f0d0<0... ..........9.....yP..`...<.......*.A.....>U....... ...:.....20170110095052Z....20170117095052Z0...*.H.............\A#...A!w......U..w.q........=.u.>.~2.&.`t6.......%.R...u..Dl..ToT.9:,...I<h..s...?............P..M.k".x..N}....AJ.P.8~."B....Y.n...9L...PH....E....._.."./..q..B<.JV.{0m.........O...Q....@l.U...A.#.tsmI;...7.p.l...^=..........@...<5.o.'.G..pW.b..[g0..tu.......0...0...0..s............ ...y..^..g0...*.H........0B1.0...U....US1.0...U....GeoTrust Inc.1.0...U....GeoTrust Global CA0...161208112535Z..171214112535Z02100...U...'GeoTrust Global CA TGV OCSP Responder 50.."0...*.H.............0...............S....!....,.t.?....d...M@.._.=.S..,."......Gdv._c..D1..N'E.:.....a2.......{/rD. .c.2..P...!.....Xn..}....{{.zI9.Y....../.....;.......fu..,...B._o..B..g....o........?Y\.?...y.H*..]yi.....3.......F.6.....Q.........{B..19..Kz...\z...P..._...-!.....'.Ym........0..0...U.#..0....z.h.....d..}.}e...N0... .....0......0...U.%..0... .......0...U...........0...U.......0.0"..U....0...0.1.0...U....TGV-OFF-570...*.H..............md.....yV{......y:5..@l#..5.......o..X....,r}......i..3..o.e...e5..@..H/Q..;.vd..?.j.m....../hv..A.......g.......a.....G..\.'*.b..>.....L.Y.To<.@>...&1..9.w.....N*Au.e.....b..K...PO47.J.....{.C\....G..0/.a.Eo.`z.<;IA... #.''.CG..K@7z..7.\_..'.]q.f._.WN....
<<< skipped >>>
GET /js.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.shafou.com/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
Accept-Encoding: gzip, deflate
Host: VVV.shafou.com
Connection: Keep-Alive
Cookie: __cfduid=d28f08602a5d694bfbd2ebb404016d4301484177871
HTTP/1.1 200 OK
Date: Wed, 11 Jan 2017 23:37:52 GMT
Content-Type: application/javascript; charset=utf-8
Content-Length: 145378
Connection: keep-alive
Last-Modified: Sat, 07 Jan 2017 05:48:55 GMT
Access-Control-Allow-Origin: *
Expires: Wed, 11 Jan 2017 07:46:48 GMT
Cache-Control: max-age=600
Content-Encoding: gzip
X-GitHub-Request-Id: B91F1124:6B71:2C9EC20:58709BBF
Via: 1.1 varnish
X-Served-By: cache-fra1220-FRA
X-Cache: MISS
X-Cache-Hits: 0
X-Timer: S1483774912.099556,VS0,VE104
X-Fastly-Request-ID: 2e6fc8f87f11d84231071c0a49cb0fccb1e19f90
CF-Cache-Status: REVALIDATED
Accept-Ranges: bytes
Server: cloudflare-nginx
CF-RAY: 31fc32f491d9292c-OTP
............iW.;.6.._a.d.m,.mf...$$..v..!.Y=y.Ox.......*.[.6....>k.....X*.J.R...............2......h.2.Ry=...k...Q./..e..[..Cf0..Z.0s......,..%D.u3n........5C..S8..3.z.,....0.k.F......}..u..^g........:9..9..1p..y..3n7.........N.....u...........(i.{p..... .U......a..u=4....p.....].i...0.f....Q.F.R4{.Q.5..{...4\......n..u.!c>s..5.....A........;.4j..........u...5.G.A7s.k......O.s...S~.....a......l..;............8...I....V...h...T{.@..5.5G.A.-..nc.\X..T|.U....Z~>.i......\9^..........I...._O*.a....f....n.5...*.8..>...0......C?....V=..y..}.q.<>.>.E..Gn..d{......f]..R.D...D'.x.9.#....7.Q..Q.l4hu.E.m.Q..p).d...A......6.["..C...G......|.6E=..w.....Av>...........Cf.p4|........t...\V......5.P..n.....a...HTT............;F......D ....R..t..a.=.z.....8...~R.Y..q.T..x... =..Oj.9..!S.E.O.53....C..Hy=3...O.ffB.....Y-...n..`..y.....yR.. .b..\.QE..o?.......A.4.....N.D....Qs........x8V..|z(..1ssx.Y.yH#I.dS.....X..p...?_K..w.....*.*pu.........Um..A.gc.I..Q. 3^.v.2......EFl-./"m89....#.<.^.f.....u5.gz.r..D7.]..;.......TK...).......L........w.......w..y..."f...1....7p0/./.v....Z=.5.8ri.Y....S..L.U..P.7/o.*WN...........2.....Z.s.;Z.0.d1W..........-p.%..osHl....s.W..o2........io...F..K(n.|...?UgF..~..........O..U.1z{..P.,..C..y...$....We..N...GaC.k.....5.Ac......w..? [v.{. !....a~............".'f.,d.....5.N.=.:n.T....q.........ny:y......9.....'..T..cy.. ..\gy.=;.s....;x....y.._x..I..u..Kz_....u..~...,.Y.~.^...w._=z..k.^.........u..#z.......H....{./D|.`<Tv....'.G......s?9..AA..a..s.2....j....k>...q0.5...
<<< skipped >>>
GET /MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6kg== HTTP/1.1
Cache-Control: max-age = 468888
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Tue, 10 Jan 2017 09:50:52 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: g.symcd.com
HTTP/1.1 304 Not Modified
Content-Type: application/ocsp-response
Expires: Tue, 17 Jan 2017 09:50:52 GMT
Last-Modified: Tue, 10 Jan 2017 09:50:52 GMT
Cache-Control: max-age=468888, public, no-transform, must-revalidate
Date: Wed, 11 Jan 2017 23:38:08 GMT
Connection: keep-alive
HTTP/1.1 304 Not Modified..Content-Type: application/ocsp-response..Expires: Tue, 17 Jan 2017 09:50:52 GMT..Last-Modified: Tue, 10 Jan 2017 09:50:52 GMT..Cache-Control: max-age=468888, public, no-transform, must-revalidate..Date: Wed, 11 Jan 2017 23:38:08 GMT..Connection: keep-alive..
GET / HTTP/1.1
Accept: text/html, application/xhtml xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
Accept-Encoding: gzip, deflate
Host: VVV.shafou.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 11 Jan 2017 23:37:52 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 36209
Connection: keep-alive
Set-Cookie: __cfduid=d28f08602a5d694bfbd2ebb404016d4301484177871; expires=Thu, 11-Jan-18 23:37:51 GMT; path=/; domain=.shafou.com; HttpOnly
Last-Modified: Sat, 07 Jan 2017 05:48:55 GMT
Access-Control-Allow-Origin: *
Expires: Wed, 11 Jan 2017 04:41:08 GMT
Cache-Control: max-age=600
Content-Encoding: gzip
X-GitHub-Request-Id: B91F111C:6ED7:7B0325C:5875B509
Accept-Ranges: bytes
Via: 1.1 varnish
Age: 0
X-Served-By: cache-fra1245-FRA
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1484177871.907086,VS0,VE94
Vary: Accept-Encoding
X-Fastly-Request-ID: 64a18c84cf4cb68d04cc24d99a1ea1314f98e647
Server: cloudflare-nginx
CF-RAY: 31fc32f224fa2914-OTP
...........|Y..Zr.......*.A.t....b........A......u9..V.9.$.`o6. .Z....lH.s...............oU.g../...o}....U</..._.Z.....7U.:.5..z.......Wv..x.....G:.....I........Z.].oK...........;..rI.z\..9...Z..zm.=..._.,s.._........v....<...b9..8..................%...b.......o........_....J..-gx..C7..~......v..]......_.a..?..}....B......E.....u....$....k........"..y>/...E.............C.G./..t...7./l...}....M....._...nXC..|]........L.a0.A..y...~...o./..x.k8._................<.,^c8......H.K....|.(.5........1..b..:.(.....[?.....'..z..v....Qt..gl..O...S\.......C....$.....:..~...H..l..&.......o[.........r.$...a.u.V.~c.8......9...x...?...........;.......h.7.6.6...f...#.ii...4mYO..qxi.<.....Fs..&........5.%..?C.X.h.ao.......R.W.xZH.?.w..b....W.-..}....].m. E..Y2......4-Y..Ytq..g...............T0f..6.....`.5xWb....1...|..M....m..%...:.#.. ]...K_.r.....8.?.......2=...k.'..5a....(............V..9pI'..9mJ.....\....\ ;3j|h]w"...pz.q'..@IOEy...$.....)...d..'\.o.9...(..'...)..\X."&.NEUp..;..[D.J.. Px.,....i8O..N.b..E...((:.|...9._.. .ra.`...*..yb\.2[7k......%..4.;.>...9x.M.....Q...lt..XB...P">.C.N ._e/6.E@G..p..RO.~%.|1=..6...hUt-.}./1..2....,... .X.#.l..6.z.:.O.{As.... .R.......K).....qq....N&c......eT>0)....6..M4u.......2............&C.".....]..;.......9..G@.2...~.UJ....=..Z.j....1Q.......|\i.......au.....k`..b.s....`^.9u)....0.,..3.KyR.:.h...$..W.x.Ni../u...#.:.^_.'.....Qr..&L....!..Um8ZZJ.4..|...9M.4.Q.8.K....dDL........d!.G>...d..L.Jx.......FU..j...q.Vw.........]...q2?2?].9..Z.......8^r..c...IF_V.#....$.....
<<< skipped >>>
GET /favicon.ico HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
Host: VVV.shafou.com
Connection: Keep-Alive
Cookie: __cfduid=d28f08602a5d694bfbd2ebb404016d4301484177871
HTTP/1.1 404 Not Found
Date: Wed, 11 Jan 2017 23:37:53 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 87
Connection: keep-alive
ETag: W/"58708147-43"
Access-Control-Allow-Origin: *
Content-Encoding: gzip
X-GitHub-Request-Id: B91F1118:1618F:7DD4A5F:5876C1D0
Via: 1.1 varnish
X-Served-By: cache-fra1249-FRA
X-Cache: MISS
X-Cache-Hits: 0
X-Timer: S1484177872.919471,VS0,VE93
X-Fastly-Request-ID: 909bd132a5df652c8afd13a23c3b6d2dad53b52e
CF-Cache-Status: EXPIRED
Server: cloudflare-nginx
CF-RAY: 31fc32f966f22914-OTP
.......... H-.M.....R.710..(.....M-IT.()).M-,.,.U*JM J-.PRH.. I. .U2..-...W.....k..C...HTTP/1.1 404 Not Found..Date: Wed, 11 Jan 2017 23:37:53 GMT..Content-Type: text/html; charset=utf-8..Content-Length: 87..Connection: keep-alive..ETag: W/"58708147-43"..Access-Control-Allow-Origin: *..Content-Encoding: gzip..X-GitHub-Request-Id: B91F1118:1618F:7DD4A5F:5876C1D0..Via: 1.1 varnish..X-Served-By: cache-fra1249-FRA..X-Cache: MISS..X-Cache-Hits: 0..X-Timer: S1484177872.919471,VS0,VE93..X-Fastly-Request-ID: 909bd132a5df652c8afd13a23c3b6d2dad53b52e..CF-Cache-Status: EXPIRED..Server: cloudflare-nginx..CF-RAY: 31fc32f966f22914-OTP............ H-.M.....R.710..(.....M-IT.()).M-,.,.U*JM J-.PRH.. I. .U2..-...W.....k..C.....
GET /GIAG2.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: pki.google.com
HTTP/1.1 200 OK
Content-Type: application/pkix-crl
Date: Wed, 11 Jan 2017 22:56:54 GMT
Expires: Wed, 11 Jan 2017 23:56:54 GMT
Last-Modified: Wed, 11 Jan 2017 02:15:00 GMT
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 499
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=3600
Age: 2484
0...0.....0...*.H........0I1.0...U....US1.0...U....Google Inc1%0#..U....Google Internet Authority G2..170111010002Z..170121010002Z0)0'..1.3..*....160915202213Z0.0...U........00.0...U.#..0...J......h.v....b..Z./0...U.......g0...*.H......................@..z.d.9y'....:.Z.9K...3..f.......[.QEE:....E.r~..5.y.q6X..}.....D:. ;{#2...\...p.Z.,*....b...|....D..e..>.o3._l.uX.......H'..P"A..\.].."......X'..#./3...'{.d.}.S'...x.(3u..... ..#R..2..D.&cXZ.y.f.L.........G.].2.'BK ...HC...=.E..7....q......W....HTTP/1.1 200 OK..Content-Type: application/pkix-crl..Date: Wed, 11 Jan 2017 22:56:54 GMT..Expires: Wed, 11 Jan 2017 23:56:54 GMT..Last-Modified: Wed, 11 Jan 2017 02:15:00 GMT..X-Content-Type-Options: nosniff..Server: sffe..Content-Length: 499..X-XSS-Protection: 1; mode=block..Cache-Control: public, max-age=3600..Age: 2484..0...0.....0...*.H........0I1.0...U....US1.0...U....Google Inc1%0#..U....Google Internet Authority G2..170111010002Z..170121010002Z0)0'..1.3..*....160915202213Z0.0...U........00.0...U.#..0...J......h.v....b..Z./0...U.......g0...*.H......................@..z.d.9y'....:.Z.9K...3..f.......[.QEE:....E.r~..5.y.q6X..}.....D:. ;{#2...\...p.Z.,*....b...|....D..e..>.o3._l.uX.......H'..P"A..\.].."......X'..#./3...'{.d.}.S'...x.(3u..... ..#R..2..D.&cXZ.y.f.L.........G.].2.'BK ...HC...=.E..7....q......W......
<<< skipped >>>
GET /MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6kg== HTTP/1.1
Cache-Control: max-age = 564348
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 12 Oct 2016 22:33:53 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: g.symcd.com
HTTP/1.1 200 OK
Server: nginx/1.10.2
Content-Type: application/ocsp-response
Content-Length: 1377
content-transfer-encoding: binary
Cache-Control: max-age=468888, public, no-transform, must-revalidate
Last-Modified: Tue, 10 Jan 2017 09:50:52 GMT
Expires: Tue, 17 Jan 2017 09:50:52 GMT
Date: Wed, 11 Jan 2017 23:38:04 GMT
Connection: keep-alive
0..]......V0..R.. .....0.....C0..?0......V.T'S...q..."...zr.*..20170110095052Z0f0d0<0... ..........9.....yP..`...<.......*.A.....>U....... ...:.....20170110095052Z....20170117095052Z0...*.H.............\A#...A!w......U..w.q........=.u.>.~2.&.`t6.......%.R...u..Dl..ToT.9:,...I<h..s...?............P..M.k".x..N}....AJ.P.8~."B....Y.n...9L...PH....E....._.."./..q..B<.JV.{0m.........O...Q....@l.U...A.#.tsmI;...7.p.l...^=..........@...<5.o.'.G..pW.b..[g0..tu.......0...0...0..s............ ...y..^..g0...*.H........0B1.0...U....US1.0...U....GeoTrust Inc.1.0...U....GeoTrust Global CA0...161208112535Z..171214112535Z02100...U...'GeoTrust Global CA TGV OCSP Responder 50.."0...*.H.............0...............S....!....,.t.?....d...M@.._.=.S..,."......Gdv._c..D1..N'E.:.....a2.......{/rD. .c.2..P...!.....Xn..}....{{.zI9.Y....../.....;.......fu..,...B._o..B..g....o........?Y\.?...y.H*..]yi.....3.......F.6.....Q.........{B..19..Kz...\z...P..._...-!.....'.Ym........0..0...U.#..0....z.h.....d..}.}e...N0... .....0......0...U.%..0... .......0...U...........0...U.......0.0"..U....0...0.1.0...U....TGV-OFF-570...*.H..............md.....yV{......y:5..@l#..5.......o..X....,r}......i..3..o.e...e5..@..H/Q..;.vd..?.j.m....../hv..A.......g.......a.....G..\.'*.b..>.....L.Y.To<.@>...&1..9.w.....N*Au.e.....b..K...PO47.J.....{.C\....G..0/.a.Eo.`z.<;IA... #.''.CG..K@7z..7.\_..'.]q.f._.WN....
<<< skipped >>>
GET /GIAG2.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: pki.google.com
HTTP/1.1 200 OK
Content-Type: application/pkix-crl
Date: Wed, 11 Jan 2017 23:09:24 GMT
Expires: Thu, 12 Jan 2017 00:09:24 GMT
Last-Modified: Wed, 11 Jan 2017 02:15:00 GMT
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 499
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=3600
Age: 1730
0...0.....0...*.H........0I1.0...U....US1.0...U....Google Inc1%0#..U....Google Internet Authority G2..170111010002Z..170121010002Z0)0'..1.3..*....160915202213Z0.0...U........00.0...U.#..0...J......h.v....b..Z./0...U.......g0...*.H......................@..z.d.9y'....:.Z.9K...3..f.......[.QEE:....E.r~..5.y.q6X..}.....D:. ;{#2...\...p.Z.,*....b...|....D..e..>.o3._l.uX.......H'..P"A..\.].."......X'..#./3...'{.d.}.S'...x.(3u..... ..#R..2..D.&cXZ.y.f.L.........G.].2.'BK ...HC...=.E..7....q......W....HTTP/1.1 200 OK..Content-Type: application/pkix-crl..Date: Wed, 11 Jan 2017 23:09:24 GMT..Expires: Thu, 12 Jan 2017 00:09:24 GMT..Last-Modified: Wed, 11 Jan 2017 02:15:00 GMT..X-Content-Type-Options: nosniff..Server: sffe..Content-Length: 499..X-XSS-Protection: 1; mode=block..Cache-Control: public, max-age=3600..Age: 1730..0...0.....0...*.H........0I1.0...U....US1.0...U....Google Inc1%0#..U....Google Internet Authority G2..170111010002Z..170121010002Z0)0'..1.3..*....160915202213Z0.0...U........00.0...U.#..0...J......h.v....b..Z./0...U.......g0...*.H......................@..z.d.9y'....:.Z.9K...3..f.......[.QEE:....E.r~..5.y.q6X..}.....D:. ;{#2...\...p.Z.,*....b...|....D..e..>.o3._l.uX.......H'..P"A..\.].."......X'..#./3...'{.d.}.S'...x.(3u..... ..#R..2..D.&cXZ.y.f.L.........G.].2.'BK ...HC...=.E..7....q......W......
<<< skipped >>>
GET /MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6kg== HTTP/1.1
Cache-Control: max-age = 468888
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Tue, 10 Jan 2017 09:50:52 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: g.symcd.com
HTTP/1.1 304 Not Modified
Content-Type: application/ocsp-response
Expires: Tue, 17 Jan 2017 09:50:52 GMT
Last-Modified: Tue, 10 Jan 2017 09:50:52 GMT
Cache-Control: max-age=468888, public, no-transform, must-revalidate
Date: Wed, 11 Jan 2017 23:38:08 GMT
Connection: keep-alive
HTTP/1.1 304 Not Modified..Content-Type: application/ocsp-response..Expires: Tue, 17 Jan 2017 09:50:52 GMT..Last-Modified: Tue, 10 Jan 2017 09:50:52 GMT..Cache-Control: max-age=468888, public, no-transform, must-revalidate..Date: Wed, 11 Jan 2017 23:38:08 GMT..Connection: keep-alive..
GET /favicon.ico HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
Host: VVV.shafou.com
Connection: Keep-Alive
Cookie: __cfduid=d28f08602a5d694bfbd2ebb404016d4301484177871
HTTP/1.1 404 Not Found
Date: Wed, 11 Jan 2017 23:37:58 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 87
Connection: keep-alive
ETag: W/"58708147-43"
Access-Control-Allow-Origin: *
Content-Encoding: gzip
X-GitHub-Request-Id: B91F1118:1618F:7DD4A5F:5876C1D0
Via: 1.1 varnish
X-Served-By: cache-fra1249-FRA
X-Cache: MISS
X-Cache-Hits: 0
X-Timer: S1484177872.919471,VS0,VE93
X-Fastly-Request-ID: 909bd132a5df652c8afd13a23c3b6d2dad53b52e
CF-Cache-Status: HIT
Server: cloudflare-nginx
CF-RAY: 31fc3319d368291a-OTP
.......... H-.M.....R.710..(.....M-IT.()).M-,.,.U*JM J-.PRH.. I. .U2..-...W.....k..C...HTTP/1.1 404 Not Found..Date: Wed, 11 Jan 2017 23:37:58 GMT..Content-Type: text/html; charset=utf-8..Content-Length: 87..Connection: keep-alive..ETag: W/"58708147-43"..Access-Control-Allow-Origin: *..Content-Encoding: gzip..X-GitHub-Request-Id: B91F1118:1618F:7DD4A5F:5876C1D0..Via: 1.1 varnish..X-Served-By: cache-fra1249-FRA..X-Cache: MISS..X-Cache-Hits: 0..X-Timer: S1484177872.919471,VS0,VE93..X-Fastly-Request-ID: 909bd132a5df652c8afd13a23c3b6d2dad53b52e..CF-Cache-Status: HIT..Server: cloudflare-nginx..CF-RAY: 31fc3319d368291a-OTP............ H-.M.....R.710..(.....M-IT.()).M-,.,.U*JM J-.PRH.. I. .U2..-...W.....k..C.....
GET /crls/secureca.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 13 Oct 2016 09:30:22 GMT
If-None-Match: "b6a46da3cf1aa70c10b101b12c9733f4:1476351022"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.geotrust.com
HTTP/1.1 200 OK
Server: Apache
ETag: "d954908e185ce1325b225d2331db3819:1484177421"
Last-Modified: Wed, 11 Jan 2017 23:30:21 GMT
Date: Wed, 11 Jan 2017 23:37:59 GMT
Content-Length: 325
Connection: keep-alive
Content-Type: application/pkix-crl
0..A0..0...*.H........0N1.0...U....US1.0...U....Equifax1-0 ..U...$Equifax Secure Certificate Authority..170111232300Z..170121232300Z0,0....%...020514181157Z0.....3..020515130611Z0...*.H............t.B.%s.[.J.<!....`.^.t.B..<...\*%.:....0a. ...y.q0.09l.X.?..{Az#..P........s7.qYx........U1......=W..ak.............Gv5.........HTTP/1.1 200 OK..Server: Apache..ETag: "d954908e185ce1325b225d2331db3819:1484177421"..Last-Modified: Wed, 11 Jan 2017 23:30:21 GMT..Date: Wed, 11 Jan 2017 23:37:59 GMT..Content-Length: 325..Connection: keep-alive..Content-Type: application/pkix-crl..0..A0..0...*.H........0N1.0...U....US1.0...U....Equifax1-0 ..U...$Equifax Secure Certificate Authority..170111232300Z..170121232300Z0,0....%...020514181157Z0.....3..020515130611Z0...*.H............t.B.%s.[.J.<!....`.^.t.B..<...\*%.:....0a. ...y.q0.09l.X.?..{Az#..P........s7.qYx........U1......=W..ak.............Gv5...........
GET /GIAG2.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: pki.google.com
HTTP/1.1 200 OK
Content-Type: application/pkix-crl
Date: Wed, 11 Jan 2017 23:09:24 GMT
Expires: Thu, 12 Jan 2017 00:09:24 GMT
Last-Modified: Wed, 11 Jan 2017 02:15:00 GMT
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 499
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=3600
Age: 1729
0...0.....0...*.H........0I1.0...U....US1.0...U....Google Inc1%0#..U....Google Internet Authority G2..170111010002Z..170121010002Z0)0'..1.3..*....160915202213Z0.0...U........00.0...U.#..0...J......h.v....b..Z./0...U.......g0...*.H......................@..z.d.9y'....:.Z.9K...3..f.......[.QEE:....E.r~..5.y.q6X..}.....D:. ;{#2...\...p.Z.,*....b...|....D..e..>.o3._l.uX.......H'..P"A..\.].."......X'..#./3...'{.d.}.S'...x.(3u..... ..#R..2..D.&cXZ.y.f.L.........G.].2.'BK ...HC...=.E..7....q......W....HTTP/1.1 200 OK..Content-Type: application/pkix-crl..Date: Wed, 11 Jan 2017 23:09:24 GMT..Expires: Thu, 12 Jan 2017 00:09:24 GMT..Last-Modified: Wed, 11 Jan 2017 02:15:00 GMT..X-Content-Type-Options: nosniff..Server: sffe..Content-Length: 499..X-XSS-Protection: 1; mode=block..Cache-Control: public, max-age=3600..Age: 1729..0...0.....0...*.H........0I1.0...U....US1.0...U....Google Inc1%0#..U....Google Internet Authority G2..170111010002Z..170121010002Z0)0'..1.3..*....160915202213Z0.0...U........00.0...U.#..0...J......h.v....b..Z./0...U.......g0...*.H......................@..z.d.9y'....:.Z.9K...3..f.......[.QEE:....E.r~..5.y.q6X..}.....D:. ;{#2...\...p.Z.,*....b...|....D..e..>.o3._l.uX.......H'..P"A..\.].."......X'..#./3...'{.d.}.S'...x.(3u..... ..#R..2..D.&cXZ.y.f.L.........G.].2.'BK ...HC...=.E..7....q......W......
<<< skipped >>>
GET /GIAG2.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: pki.google.com
HTTP/1.1 200 OK
Content-Type: application/pkix-crl
Date: Wed, 11 Jan 2017 23:36:33 GMT
Expires: Thu, 12 Jan 2017 00:36:33 GMT
Last-Modified: Wed, 11 Jan 2017 02:15:00 GMT
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 499
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=3600
Age: 105
0...0.....0...*.H........0I1.0...U....US1.0...U....Google Inc1%0#..U....Google Internet Authority G2..170111010002Z..170121010002Z0)0'..1.3..*....160915202213Z0.0...U........00.0...U.#..0...J......h.v....b..Z./0...U.......g0...*.H......................@..z.d.9y'....:.Z.9K...3..f.......[.QEE:....E.r~..5.y.q6X..}.....D:. ;{#2...\...p.Z.,*....b...|....D..e..>.o3._l.uX.......H'..P"A..\.].."......X'..#./3...'{.d.}.S'...x.(3u..... ..#R..2..D.&cXZ.y.f.L.........G.].2.'BK ...HC...=.E..7....q......W....HTTP/1.1 200 OK..Content-Type: application/pkix-crl..Date: Wed, 11 Jan 2017 23:36:33 GMT..Expires: Thu, 12 Jan 2017 00:36:33 GMT..Last-Modified: Wed, 11 Jan 2017 02:15:00 GMT..X-Content-Type-Options: nosniff..Server: sffe..Content-Length: 499..X-XSS-Protection: 1; mode=block..Cache-Control: public, max-age=3600..Age: 105..0...0.....0...*.H........0I1.0...U....US1.0...U....Google Inc1%0#..U....Google Internet Authority G2..170111010002Z..170121010002Z0)0'..1.3..*....160915202213Z0.0...U........00.0...U.#..0...J......h.v....b..Z./0...U.......g0...*.H......................@..z.d.9y'....:.Z.9K...3..f.......[.QEE:....E.r~..5.y.q6X..}.....D:. ;{#2...\...p.Z.,*....b...|....D..e..>.o3._l.uX.......H'..P"A..\.].."......X'..#./3...'{.d.}.S'...x.(3u..... ..#R..2..D.&cXZ.y.f.L.........G.].2.'BK ...HC...=.E..7....q......W......
<<< skipped >>>
GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCBiAg+LLzED5 HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 10 Jan 2017 15:14:06 GMT
Expires: Sat, 14 Jan 2017 15:14:06 GMT
Server: ocsp_responder
Content-Length: 463
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Cache-Control: public, max-age=345600
Age: 116643
0..........0..... .....0......0...0......J......h.v....b..Z./..20170110070712Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./........@.....20170110070712Z....20170117070712Z0...*.H..............8<...am.e)8...Y<.....g.....c...Mx...n.U.......5.gW(.LE...k...U$..^u...>...k.p0......s...G ..W.g`.....&.....j....-..GW.%.......].*..$....-h........O...bHthVS..e....o..>P.C..........Y.9ud..*7...........16.....eTD..e.o..".r...iq....>.\2z.;.,......_aI.1.3P..,HTTP/1.1 200 OK..Content-Type: application/ocsp-response..Date: Tue, 10 Jan 2017 15:14:06 GMT..Expires: Sat, 14 Jan 2017 15:14:06 GMT..Server: ocsp_responder..Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Cache-Control: public, max-age=345600..Age: 116643..0..........0..... .....0......0...0......J......h.v....b..Z./..20170110070712Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./........@.....20170110070712Z....20170117070712Z0...*.H..............8<...am.e)8...Y<.....g.....c...Mx...n.U.......5.gW(.LE...k...U$..^u...>...k.p0......s...G ..W.g`.....&.....j....-..GW.%.......].*..$....-h........O...bHthVS..e....o..>P.C..........Y.9ud..*7...........16.....eTD..e.o..".r...iq....>.\2z.;.,......_aI.1.3P..,....
<<< skipped >>>
GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEg0aOXToYEC HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 10 Jan 2017 12:34:07 GMT
Expires: Sat, 14 Jan 2017 12:34:07 GMT
Server: ocsp_responder
Content-Length: 463
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Cache-Control: public, max-age=345600
Age: 126249
0..........0..... .....0......0...0......J......h.v....b..Z./..20170110071335Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..H4h.........20170110071335Z....20170117071335Z0...*.H..............,..P...<...0..2.j@Z6..Z.....0..3..'...)O.......A.2.....9_.i.@. 4.aq..tb.I../=...1 ....o..3.e..`.k......)....US.q-3.....L.t......p^AM..i..u.....a.Ln[.nCc............/....ys.R.0.p`.M|hU;U}^.-.j.O..8..$.............S>...(b....&....V..yU'..V.....dh.._^D.<..-eHTTP/1.1 200 OK..Content-Type: application/ocsp-response..Date: Tue, 10 Jan 2017 12:34:07 GMT..Expires: Sat, 14 Jan 2017 12:34:07 GMT..Server: ocsp_responder..Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Cache-Control: public, max-age=345600..Age: 126249..0..........0..... .....0......0...0......J......h.v....b..Z./..20170110071335Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..H4h.........20170110071335Z....20170117071335Z0...*.H..............,..P...<...0..2.j@Z6..Z.....0..3..'...)O.......A.2.....9_.i.@. 4.aq..tb.I../=...1 ....o..3.e..`.k......)....US.q-3.....L.t......p^AM..i..u.....a.Ln[.nCc............/....ys.R.0.p`.M|hU;U}^.-.j.O..8..$.............S>...(b....&....V..yU'..V.....dh.._^D.<..-e..
GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCBiAg+LLzED5 HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 10 Jan 2017 12:47:14 GMT
Expires: Sat, 14 Jan 2017 12:47:14 GMT
Server: ocsp_responder
Content-Length: 463
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Cache-Control: public, max-age=345600
Age: 125455
0..........0..... .....0......0...0......J......h.v....b..Z./..20170110070712Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./........@.....20170110070712Z....20170117070712Z0...*.H..............8<...am.e)8...Y<.....g.....c...Mx...n.U.......5.gW(.LE...k...U$..^u...>...k.p0......s...G ..W.g`.....&.....j....-..GW.%.......].*..$....-h........O...bHthVS..e....o..>P.C..........Y.9ud..*7...........16.....eTD..e.o..".r...iq....>.\2z.;.,......_aI.1.3P..,HTTP/1.1 200 OK..Content-Type: application/ocsp-response..Date: Tue, 10 Jan 2017 12:47:14 GMT..Expires: Sat, 14 Jan 2017 12:47:14 GMT..Server: ocsp_responder..Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Cache-Control: public, max-age=345600..Age: 125455..0..........0..... .....0......0...0......J......h.v....b..Z./..20170110070712Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./........@.....20170110070712Z....20170117070712Z0...*.H..............8<...am.e)8...Y<.....g.....c...Mx...n.U.......5.gW(.LE...k...U$..^u...>...k.p0......s...G ..W.g`.....&.....j....-..GW.%.......].*..$....-h........O...bHthVS..e....o..>P.C..........Y.9ud..*7...........16.....eTD..e.o..".r...iq....>.\2z.;.,......_aI.1.3P..,....
<<< skipped >>>
GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEg0aOXToYEC HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 10 Jan 2017 12:31:47 GMT
Expires: Sat, 14 Jan 2017 12:31:47 GMT
Server: ocsp_responder
Content-Length: 463
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Cache-Control: public, max-age=345600
Age: 126389
0..........0..... .....0......0...0......J......h.v....b..Z./..20170110071335Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..H4h.........20170110071335Z....20170117071335Z0...*.H..............,..P...<...0..2.j@Z6..Z.....0..3..'...)O.......A.2.....9_.i.@. 4.aq..tb.I../=...1 ....o..3.e..`.k......)....US.q-3.....L.t......p^AM..i..u.....a.Ln[.nCc............/....ys.R.0.p`.M|hU;U}^.-.j.O..8..$.............S>...(b....&....V..yU'..V.....dh.._^D.<..-eHTTP/1.1 200 OK..Content-Type: application/ocsp-response..Date: Tue, 10 Jan 2017 12:31:47 GMT..Expires: Sat, 14 Jan 2017 12:31:47 GMT..Server: ocsp_responder..Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Cache-Control: public, max-age=345600..Age: 126389..0..........0..... .....0......0...0......J......h.v....b..Z./..20170110071335Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..H4h.........20170110071335Z....20170117071335Z0...*.H..............,..P...<...0..2.j@Z6..Z.....0..3..'...)O.......A.2.....9_.i.@. 4.aq..tb.I../=...1 ....o..3.e..`.k......)....US.q-3.....L.t......p^AM..i..u.....a.Ln[.nCc............/....ys.R.0.p`.M|hU;U}^.-.j.O..8..$.............S>...(b....&....V..yU'..V.....dh.._^D.<..-e..
GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCBiAg+LLzED5 HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 10 Jan 2017 15:14:06 GMT
Expires: Sat, 14 Jan 2017 15:14:06 GMT
Server: ocsp_responder
Content-Length: 463
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Cache-Control: public, max-age=345600
Age: 116648
0..........0..... .....0......0...0......J......h.v....b..Z./..20170110070712Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./........@.....20170110070712Z....20170117070712Z0...*.H..............8<...am.e)8...Y<.....g.....c...Mx...n.U.......5.gW(.LE...k...U$..^u...>...k.p0......s...G ..W.g`.....&.....j....-..GW.%.......].*..$....-h........O...bHthVS..e....o..>P.C..........Y.9ud..*7...........16.....eTD..e.o..".r...iq....>.\2z.;.,......_aI.1.3P..,HTTP/1.1 200 OK..Content-Type: application/ocsp-response..Date: Tue, 10 Jan 2017 15:14:06 GMT..Expires: Sat, 14 Jan 2017 15:14:06 GMT..Server: ocsp_responder..Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Cache-Control: public, max-age=345600..Age: 116648..0..........0..... .....0......0...0......J......h.v....b..Z./..20170110070712Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./........@.....20170110070712Z....20170117070712Z0...*.H..............8<...am.e)8...Y<.....g.....c...Mx...n.U.......5.gW(.LE...k...U$..^u...>...k.p0......s...G ..W.g`.....&.....j....-..GW.%.......].*..$....-h........O...bHthVS..e....o..>P.C..........Y.9ud..*7...........16.....eTD..e.o..".r...iq....>.\2z.;.,......_aI.1.3P..,..
<<< skipped >>>
GET /crls/secureca.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 11 Jan 2017 23:30:21 GMT
If-None-Match: "d954908e185ce1325b225d2331db3819:1484177421"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.geotrust.com
HTTP/1.1 304 Not Modified
Last-Modified: Wed, 11 Jan 2017 23:30:21 GMT
ETag: "d954908e185ce1325b225d2331db3819:1484177421"
Date: Wed, 11 Jan 2017 23:38:03 GMT
Connection: keep-alive
Content-Type: application/pkix-crl
GET /crls/secureca.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 11 Jan 2017 23:30:21 GMT
If-None-Match: "d954908e185ce1325b225d2331db3819:1484177421"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.geotrust.com
HTTP/1.1 304 Not Modified
Last-Modified: Wed, 11 Jan 2017 23:30:21 GMT
ETag: "d954908e185ce1325b225d2331db3819:1484177421"
Date: Wed, 11 Jan 2017 23:38:03 GMT
Connection: keep-alive
Content-Type: application/pkix-crl
HTTP/1.1 304 Not Modified..Last-Modified: Wed, 11 Jan 2017 23:30:21 GMT..ETag: "d954908e185ce1325b225d2331db3819:1484177421"..Date: Wed, 11 Jan 2017 23:38:03 GMT..Connection: keep-alive..Content-Type: application/pkix-crl..
GET /CRL/Omniroot2025.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Sat, 16 Nov 2013 06:15:02 GMT
If-None-Match: "200da-5b6-4eb453c33260e"
User-Agent: Microsoft-CryptoAPI/6.1
Host: cdp1.public-trust.com
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/x-pkcs7-crl
Date: Wed, 11 Jan 2017 23:38:47 GMT
Etag: "200da-ca3-54535e764bc17"
Last-Modified: Tue, 03 Jan 2017 19:45:01 GMT
Server: ECS (arn/45CB)
X-Cache: HIT
Content-Length: 3235
0...0......0...*.H........0Z1.0...U....IE1.0...U....Baltimore1.0...U....CyberTrust1"0 ..U....Baltimore CyberTrust Root..170103190202Z..170331190202Z0...0....'k...120111220757Z0....'k...120111220847Z0....'.C..130130174530Z0....'....130807173059Z0....'....140122185220Z0....'....140212185542Z0....'yr..150701184507Z0....'#...100303201301Z0....''q..100414175202Z0....'L...110224181251Z0....'Pn..110309142119Z0....'....100216203312Z0....'#...100303201213Z0....'3#..100908172555Z0....''n..101208175627Z0....''m..101208175749Z0....''p..101208175916Z0....'H...110114162156Z0#...'X>..110815145134Z0.0...U.......0#...'Z2..110818184101Z0.0...U.......0....'g...120111164333Z0....'g...120111164409Z0....'g...120111164519Z0....'....100216213519Z0....''s..100414175225Z0....''k..100414181839Z0....'3"..100908172705Z0....'3$..100908172728Z0....''o..101208175645Z0....''l..101208175727Z0....'H...110119195142Z0....'Nz..110302154045Z0....'c...111207220933Z0....'g...120111164445Z0....''r..100414175143Z0....'8...101012182723Z0....'e...120111163041Z0....'VJ..110714160903Z0....'s...130123162633Z0....'....130904190524Z0....'....131024214319Z0....'....140129172435Z0....'....140129172453Z0....'....131024214310Z0....'....131101204601Z0....'....140219171632Z0....'.^..140409155638Z0....'i...140709171930Z0....'/:..141119193302Z0....'J...150603184605Z0....'k...150603185020Z0....'k...150603185058Z0....'k...150603185131Z0....'k...120111220827Z0....'8...140716191203Z0....'....131219195909Z0....'....140219171545Z0....'k...151105070000Z0....'q...160126173
<<< skipped >>>
GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCBiAg+LLzED5 HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 10 Jan 2017 15:14:06 GMT
Expires: Sat, 14 Jan 2017 15:14:06 GMT
Server: ocsp_responder
Content-Length: 463
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Cache-Control: public, max-age=345600
Age: 116648
0..........0..... .....0......0...0......J......h.v....b..Z./..20170110070712Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./........@.....20170110070712Z....20170117070712Z0...*.H..............8<...am.e)8...Y<.....g.....c...Mx...n.U.......5.gW(.LE...k...U$..^u...>...k.p0......s...G ..W.g`.....&.....j....-..GW.%.......].*..$....-h........O...bHthVS..e....o..>P.C..........Y.9ud..*7...........16.....eTD..e.o..".r...iq....>.\2z.;.,......_aI.1.3P..,HTTP/1.1 200 OK..Content-Type: application/ocsp-response..Date: Tue, 10 Jan 2017 15:14:06 GMT..Expires: Sat, 14 Jan 2017 15:14:06 GMT..Server: ocsp_responder..Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Cache-Control: public, max-age=345600..Age: 116648..0..........0..... .....0......0...0......J......h.v....b..Z./..20170110070712Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./........@.....20170110070712Z....20170117070712Z0...*.H..............8<...am.e)8...Y<.....g.....c...Mx...n.U.......5.gW(.LE...k...U$..^u...>...k.p0......s...G ..W.g`.....&.....j....-..GW.%.......].*..$....-h........O...bHthVS..e....o..>P.C..........Y.9ud..*7...........16.....eTD..e.o..".r...iq....>.\2z.;.,......_aI.1.3P..,..
<<< skipped >>>
GET /crls/secureca.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 13 Oct 2016 09:30:22 GMT
If-None-Match: "b6a46da3cf1aa70c10b101b12c9733f4:1476351022"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.geotrust.com
HTTP/1.1 200 OK
Server: Apache
ETag: "d954908e185ce1325b225d2331db3819:1484177421"
Last-Modified: Wed, 11 Jan 2017 23:30:21 GMT
Date: Wed, 11 Jan 2017 23:37:59 GMT
Content-Length: 325
Connection: keep-alive
Content-Type: application/pkix-crl
0..A0..0...*.H........0N1.0...U....US1.0...U....Equifax1-0 ..U...$Equifax Secure Certificate Authority..170111232300Z..170121232300Z0,0....%...020514181157Z0.....3..020515130611Z0...*.H............t.B.%s.[.J.<!....`.^.t.B..<...\*%.:....0a. ...y.q0.09l.X.?..{Az#..P........s7.qYx........U1......=W..ak.............Gv5.........HTTP/1.1 200 OK..Server: Apache..ETag: "d954908e185ce1325b225d2331db3819:1484177421"..Last-Modified: Wed, 11 Jan 2017 23:30:21 GMT..Date: Wed, 11 Jan 2017 23:37:59 GMT..Content-Length: 325..Connection: keep-alive..Content-Type: application/pkix-crl..0..A0..0...*.H........0N1.0...U....US1.0...U....Equifax1-0 ..U...$Equifax Secure Certificate Authority..170111232300Z..170121232300Z0,0....%...020514181157Z0.....3..020515130611Z0...*.H............t.B.%s.[.J.<!....`.^.t.B..<...\*%.:....0a. ...y.q0.09l.X.?..{Az#..P........s7.qYx........U1......=W..ak.............Gv5...........
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
iexplore.exe_1652:
.text
.text
`.data
`.data
.rsrc
.rsrc
@.reloc
@.reloc
>.uzf
>.uzf
.us;}
.us;}
IEFRAME.dll
IEFRAME.dll
MLANG.dll
MLANG.dll
iertutil.dll
iertutil.dll
urlmon.dll
urlmon.dll
ole32.dll
ole32.dll
SHELL32.dll
SHELL32.dll
SHLWAPI.dll
SHLWAPI.dll
msvcrt.dll
msvcrt.dll
USER32.dll
USER32.dll
KERNEL32.dll
KERNEL32.dll
ADVAPI32.dll
ADVAPI32.dll
RegOpenKeyExW
RegOpenKeyExW
RegCloseKey
RegCloseKey
GetWindowsDirectoryW
GetWindowsDirectoryW
_amsg_exit
_amsg_exit
_wcmdln
_wcmdln
UrlApplySchemeW
UrlApplySchemeW
PathIsURLW
PathIsURLW
UrlCanonicalizeW
UrlCanonicalizeW
UrlCreateFromPathW
UrlCreateFromPathW
iexplore.pdb
iexplore.pdb
KEYW
KEYW
KEYWh
KEYWh
KEYWD
KEYWD
.ENNNG.
.ENNNG.
a.ry.v
a.ry.v
l.igM4
l.igM4
?1%SGf
?1%SGf
xh.JW^
xh.JW^
.97777"7" " " !
.97777"7" " " !
3.... ))
3.... ))
8888888888888
8888888888888
8888888888
8888888888
.lPV)
.lPV)
úW1
úW1
.ApX/
.ApX/
H.ZAf
H.ZAf
ð[U
ð[U
%s!FK
%s!FK
1YYYY1YY9GEAA=77YRNNNW:.VT1
1YYYY1YY9GEAA=77YRNNNW:.VT1
888777777
888777777
Y.hilkRROMLK=C,
Y.hilkRROMLK=C,
..(((($$
..(((($$
3...((((%
3...((((%
3....(.''$
3....(.''$
3.2...((((%
3.2...((((%
33.2....(,'
33.2....(,'
55323222...
55323222...
(%&'00443445?
(%&'00443445?
00.,,,4(
00.,,,4(
000.,,9(
000.,,9(
0020..9(
0020..9(
003200;(
003200;(
(#'( (''''!'!
(#'( (''''!'!
Microsoft.InternetExplorer.Default
Microsoft.InternetExplorer.Default
user32.dll
user32.dll
Kernel32.DLL
Kernel32.DLL
xfire.exe
xfire.exe
wlmail.exe
wlmail.exe
winamp.exe
winamp.exe
waol.exe
waol.exe
sidebar.exe
sidebar.exe
psocdesigner.exe
psocdesigner.exe
np.exe
np.exe
netscape.exe
netscape.exe
netcaptor.exe
netcaptor.exe
neoplanet.exe
neoplanet.exe
msn.exe
msn.exe
mshtmpad.exe
mshtmpad.exe
mshta.exe
mshta.exe
loader42.exe
loader42.exe
infopath.exe
infopath.exe
iexplore.exe
iexplore.exe
iepreview.exe
iepreview.exe
groove.exe
groove.exe
explorer.exe
explorer.exe
dreamweaver.exe
dreamweaver.exe
contribute.exe
contribute.exe
aol.exe
aol.exe
{28fb17e0-d393-439d-9a21-9474a070473a}
{28fb17e0-d393-439d-9a21-9474a070473a}
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
DShell32.dll
DShell32.dll
Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe
Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe
Software\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}
Software\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}
"%s" %s
"%s" %s
Kernel32.dll
Kernel32.dll
\AppPatch\sysmain.sdb
\AppPatch\sysmain.sdb
-extoff go.microsoft.com/fwlink/?LinkId=106323
-extoff go.microsoft.com/fwlink/?LinkId=106323
-extoff go.microsoft.com/fwlink/?LinkId=106322
-extoff go.microsoft.com/fwlink/?LinkId=106322
-extoff go.microsoft.com/fwlink/?LinkId=106320
-extoff go.microsoft.com/fwlink/?LinkId=106320
kernel32.dll
kernel32.dll
{00000000-0000-0000-0000-000000000000}
{00000000-0000-0000-0000-000000000000}
\\?\Volume
\\?\Volume
shell:%s
shell:%s
Imaging_CreateWebPagePreview_Perftrack
Imaging_CreateWebPagePreview_Perftrack
Browseui_Tabs_Tearoff_BetweenWindows
Browseui_Tabs_Tearoff_BetweenWindows
Frame_URLEntered
Frame_URLEntered
Imaging_CreateWebPagePreview
Imaging_CreateWebPagePreview
WS_ExecuteQuery
WS_ExecuteQuery
Shdocvw_BaseBrowser_FireEvent_WindowStateChanged
Shdocvw_BaseBrowser_FireEvent_WindowStateChanged
IdleTask_Execution_Time
IdleTask_Execution_Time
9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
IEXPLORE.EXE
IEXPLORE.EXE
Windows
Windows
9.00.8112.16421
9.00.8112.16421
iexplore.exe_1652_rwx_01291000_00001000:
Microsoft.InternetExplorer.Default
Microsoft.InternetExplorer.Default
user32.dll
user32.dll
iexplore.exe_1652_rwx_026C0000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800:
.text
.text
`.data
`.data
.rsrc
.rsrc
@.reloc
@.reloc
>.uzf
>.uzf
.us;}
.us;}
IEFRAME.dll
IEFRAME.dll
MLANG.dll
MLANG.dll
iertutil.dll
iertutil.dll
urlmon.dll
urlmon.dll
ole32.dll
ole32.dll
SHELL32.dll
SHELL32.dll
SHLWAPI.dll
SHLWAPI.dll
msvcrt.dll
msvcrt.dll
USER32.dll
USER32.dll
KERNEL32.dll
KERNEL32.dll
ADVAPI32.dll
ADVAPI32.dll
RegOpenKeyExW
RegOpenKeyExW
RegCloseKey
RegCloseKey
GetWindowsDirectoryW
GetWindowsDirectoryW
_amsg_exit
_amsg_exit
_wcmdln
_wcmdln
UrlApplySchemeW
UrlApplySchemeW
PathIsURLW
PathIsURLW
UrlCanonicalizeW
UrlCanonicalizeW
UrlCreateFromPathW
UrlCreateFromPathW
iexplore.pdb
iexplore.pdb
KEYW
KEYW
KEYWh
KEYWh
KEYWD
KEYWD
.ENNNG.
.ENNNG.
a.ry.v
a.ry.v
l.igM4
l.igM4
?1%SGf
?1%SGf
xh.JW^
xh.JW^
.97777"7" " " !
.97777"7" " " !
3.... ))
3.... ))
8888888888888
8888888888888
8888888888
8888888888
.lPV)
.lPV)
úW1
úW1
.ApX/
.ApX/
H.ZAf
H.ZAf
ð[U
ð[U
%s!FK
%s!FK
1YYYY1YY9GEAA=77YRNNNW:.VT1
1YYYY1YY9GEAA=77YRNNNW:.VT1
888777777
888777777
Y.hilkRROMLK=C,
Y.hilkRROMLK=C,
..(((($$
..(((($$
3...((((%
3...((((%
3....(.''$
3....(.''$
3.2...((((%
3.2...((((%
33.2....(,'
33.2....(,'
55323222...
55323222...
(%&'00443445?
(%&'00443445?
00.,,,4(
00.,,,4(
000.,,9(
000.,,9(
0020..9(
0020..9(
003200;(
003200;(
(#'( (''''!'!
(#'( (''''!'!
Microsoft.InternetExplorer.Default
Microsoft.InternetExplorer.Default
user32.dll
user32.dll
Kernel32.DLL
Kernel32.DLL
xfire.exe
xfire.exe
wlmail.exe
wlmail.exe
winamp.exe
winamp.exe
waol.exe
waol.exe
sidebar.exe
sidebar.exe
psocdesigner.exe
psocdesigner.exe
np.exe
np.exe
netscape.exe
netscape.exe
netcaptor.exe
netcaptor.exe
neoplanet.exe
neoplanet.exe
msn.exe
msn.exe
mshtmpad.exe
mshtmpad.exe
mshta.exe
mshta.exe
loader42.exe
loader42.exe
infopath.exe
infopath.exe
iexplore.exe
iexplore.exe
iepreview.exe
iepreview.exe
groove.exe
groove.exe
explorer.exe
explorer.exe
dreamweaver.exe
dreamweaver.exe
contribute.exe
contribute.exe
aol.exe
aol.exe
{28fb17e0-d393-439d-9a21-9474a070473a}
{28fb17e0-d393-439d-9a21-9474a070473a}
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
DShell32.dll
DShell32.dll
Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe
Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe
Software\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}
Software\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}
"%s" %s
"%s" %s
Kernel32.dll
Kernel32.dll
\AppPatch\sysmain.sdb
\AppPatch\sysmain.sdb
-extoff go.microsoft.com/fwlink/?LinkId=106323
-extoff go.microsoft.com/fwlink/?LinkId=106323
-extoff go.microsoft.com/fwlink/?LinkId=106322
-extoff go.microsoft.com/fwlink/?LinkId=106322
-extoff go.microsoft.com/fwlink/?LinkId=106320
-extoff go.microsoft.com/fwlink/?LinkId=106320
kernel32.dll
kernel32.dll
{00000000-0000-0000-0000-000000000000}
{00000000-0000-0000-0000-000000000000}
\\?\Volume
\\?\Volume
shell:%s
shell:%s
Imaging_CreateWebPagePreview_Perftrack
Imaging_CreateWebPagePreview_Perftrack
Browseui_Tabs_Tearoff_BetweenWindows
Browseui_Tabs_Tearoff_BetweenWindows
Frame_URLEntered
Frame_URLEntered
Imaging_CreateWebPagePreview
Imaging_CreateWebPagePreview
WS_ExecuteQuery
WS_ExecuteQuery
Shdocvw_BaseBrowser_FireEvent_WindowStateChanged
Shdocvw_BaseBrowser_FireEvent_WindowStateChanged
IdleTask_Execution_Time
IdleTask_Execution_Time
9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
IEXPLORE.EXE
IEXPLORE.EXE
Windows
Windows
9.00.8112.16421
9.00.8112.16421
iexplore.exe_1652_rwx_02800000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_1652_rwx_02940000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_1652_rwx_02980000_00001000:
kernel32.dll
kernel32.dll
SearchProtocolHost.exe_3136:
.text
.text
`.data
`.data
.rsrc
.rsrc
@.reloc
@.reloc
ADVAPI32.dll
ADVAPI32.dll
ntdll.DLL
ntdll.DLL
KERNEL32.dll
KERNEL32.dll
msvcrt.dll
msvcrt.dll
USER32.dll
USER32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
TQUERY.DLL
TQUERY.DLL
MSSHooks.dll
MSSHooks.dll
IMM32.dll
IMM32.dll
SHLWAPI.dll
SHLWAPI.dll
SrchCollatorCatalogInfo
SrchCollatorCatalogInfo
SrchDSSLogin
SrchDSSLogin
SrchDSSPortManager
SrchDSSPortManager
SrchPHHttp
SrchPHHttp
SrchIndexerQuery
SrchIndexerQuery
SrchIndexerProperties
SrchIndexerProperties
SrchIndexerPlugin
SrchIndexerPlugin
SrchIndexerClient
SrchIndexerClient
SrchIndexerSchema
SrchIndexerSchema
Msidle.dll
Msidle.dll
Failed to get REGKEY_FLTRDMN_MS_TO_IDLE, using default
Failed to get REGKEY_FLTRDMN_MS_TO_IDLE, using default
pfps->psProperty.ulKind is LPWSTR but psProperty.lpwstr is NULL or empty
pfps->psProperty.ulKind is LPWSTR but psProperty.lpwstr is NULL or empty
d:\win7sp1_gdr\enduser\mssearch2\common\utils\crchash.cxx
d:\win7sp1_gdr\enduser\mssearch2\common\utils\crchash.cxx
d:\win7sp1_gdr\enduser\mssearch2\search\search\gather\fltrdmn\fltrdaemon.cxx
d:\win7sp1_gdr\enduser\mssearch2\search\search\gather\fltrdmn\fltrdaemon.cxx
d:\win7sp1_gdr\enduser\mssearch2\search\common\include\secutil.hxx
d:\win7sp1_gdr\enduser\mssearch2\search\common\include\secutil.hxx
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracerhelpers.h
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracerhelpers.h
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\mutex.cpp
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\mutex.cpp
d:\win7sp1_gdr\enduser\mssearch2\common\include\srchxcpt.hxx
d:\win7sp1_gdr\enduser\mssearch2\common\include\srchxcpt.hxx
RegDeleteKeyW
RegDeleteKeyW
RegDeleteKeyExW
RegDeleteKeyExW
8%uiP
8%uiP
Invalid parameter passed to C runtime function.
Invalid parameter passed to C runtime function.
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracersecutil.h
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracersecutil.h
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.cpp
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.cpp
-d-d-d-d-d-d-d-%d
-d-d-d-d-d-d-d-%d
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.h
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.h
0xx=
0xx=
%s(%d)
%s(%d)
tid="0x%x"
tid="0x%x"
pid="0x%x"
pid="0x%x"
tagname="%s"
tagname="%s"
tagid="0x%x"
tagid="0x%x"
el="0x%x"
el="0x%x"
time="d/d/d d:d:d.d"
time="d/d/d d:d:d.d"
logname="%s"
logname="%s"
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\sysimprs.cxx
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\sysimprs.cxx
SHELL32.dll
SHELL32.dll
PROPSYS.dll
PROPSYS.dll
ntdll.dll
ntdll.dll
RegCloseKey
RegCloseKey
RegCreateKeyExW
RegCreateKeyExW
RegOpenKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryInfoKeyW
RegEnumKeyExW
RegEnumKeyExW
ReportEventW
ReportEventW
_amsg_exit
_amsg_exit
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
SearchProtocolHost.pdb
SearchProtocolHost.pdb
2 2(20282|2
2 2(20282|2
4%5S5
4%5S5
Software\Microsoft\Windows Search
Software\Microsoft\Windows Search
https
https
kernel32.dll
kernel32.dll
msTracer.dll
msTracer.dll
msfte.dll
msfte.dll
lX-X-X-XX-XXXXXX
lX-X-X-XX-XXXXXX
SOFTWARE\Microsoft\Windows Search
SOFTWARE\Microsoft\Windows Search
tquery.dll
tquery.dll
%s\%s
%s\%s
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_PERFORMANCE_DATA
HKEY_DYN_DATA
HKEY_DYN_DATA
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
Windows Search Service
Windows Search Service
0xx%p%S%d
0xx%p%S%d
advapi32.dll
advapi32.dll
WAPI-MS-Win-Core-LocalRegistry-L1-1-0.dll
WAPI-MS-Win-Core-LocalRegistry-L1-1-0.dll
winhttp.dll
winhttp.dll
Software\Microsoft\Windows Search\Tracing
Software\Microsoft\Windows Search\Tracing
Software\Microsoft\Windows Search\Tracing\EventThrottleLastReported
Software\Microsoft\Windows Search\Tracing\EventThrottleLastReported
Software\Microsoft\Windows Search\Tracing\EventThrottleState
Software\Microsoft\Windows Search\Tracing\EventThrottleState
%S(%d)
%S(%d)
tagname="%S"
tagname="%S"
logname="%S"
logname="%S"
Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}
Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}
.\%s.mui
.\%s.mui
.\%s\%s.mui
.\%s\%s.mui
%s\%s.mui
%s\%s.mui
%s\%s\%s.mui
%s\%s\%s.mui
Microsoft Windows Search Protocol Host
Microsoft Windows Search Protocol Host
7.00.7601.17610 (win7sp1_gdr.110503-1502)
7.00.7601.17610 (win7sp1_gdr.110503-1502)
SearchProtocolHost.exe
SearchProtocolHost.exe
Windows
Windows
7.00.7601.17610
7.00.7601.17610
iexplore.exe_1652_rwx_029C0000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_1652_rwx_02A40000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_1652_rwx_02D80000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172:
.text
.text
`.rdata
`.rdata
@.data
@.data
.gfids
.gfids
@.tls
@.tls
.rsrc
.rsrc
@.reloc
@.reloc
D$,j.Xf
D$,j.Xf
j.Yf;
j.Yf;
_tcPVj@
_tcPVj@
.PjRW
.PjRW
ole32.dll
ole32.dll
POWRPROF.dll
POWRPROF.dll
address family not supported
address family not supported
broken pipe
broken pipe
function not supported
function not supported
inappropriate io control operation
inappropriate io control operation
not supported
not supported
operation canceled
operation canceled
operation in progress
operation in progress
operation not permitted
operation not permitted
operation not supported
operation not supported
operation would block
operation would block
protocol not supported
protocol not supported
InitOnceExecuteOnce
InitOnceExecuteOnce
operator
operator
operator ""
operator ""
?#%X.y
?#%X.y
%S#[k
%S#[k
?OLEAUT32.dll
?OLEAUT32.dll
user32.dll
user32.dll
c:\b\build\slave\win-pgo\build\src\chrome\app\chrome_exe_main_win.cc
c:\b\build\slave\win-pgo\build\src\chrome\app\chrome_exe_main_win.cc
c:\b\build\slave\win-pgo\build\src\chrome\app\main_dll_loader_win.cc
c:\b\build\slave\win-pgo\build\src\chrome\app\main_dll_loader_win.cc
Failed to load Chrome DLL from
Failed to load Chrome DLL from
ChromeMain
ChromeMain
RelaunchChromeBrowserWithNewCommandLineIfNeeded
RelaunchChromeBrowserWithNewCommandLineIfNeeded
Could not find exported function
Could not find exported function
%s: option `%s' is ambiguous (could be `--%s' or `--%s')
%s: option `%s' is ambiguous (could be `--%s' or `--%s')
%s: invalid option -- `-%c'
%s: invalid option -- `-%c'
%s: argument required for option `
%s: argument required for option `
--%s'
--%s'
0.8.0
0.8.0
%ls (%s) %s
%ls (%s) %s
hXXps://crashpad.chromium.org/
hXXps://crashpad.chromium.org/
hXXps://crashpad.chromium.org/bug/new
hXXps://crashpad.chromium.org/bug/new
Report %ls bugs to
Report %ls bugs to
%s home page:
%s home page:
%ls: %s
%ls: %s
(0x%X)
(0x%X)
Error (0x%X) while retrieving error. (0x%X)
Error (0x%X) while retrieving error. (0x%X)
PlatformFile.UnknownErrors.Windows
PlatformFile.UnknownErrors.Windows
c:\b\build\slave\win-pgo\build\src\base\threading\thread_local_win.cc
c:\b\build\slave\win-pgo\build\src\base\threading\thread_local_win.cc
0123456789
0123456789
(flags = 0x%x)
(flags = 0x%x)
Histogram: %s recorded %d samples
Histogram: %s recorded %d samples
.syzygy
.syzygy
.thunks
.thunks
Windows NT
Windows NT
Histogram.InconsistentCountHigh
Histogram.InconsistentCountHigh
Histogram.InconsistentCountLow
Histogram.InconsistentCountLow
c:\b\build\slave\win-pgo\build\src\base\metrics\persistent_memory_allocator.cc
c:\b\build\slave\win-pgo\build\src\base\metrics\persistent_memory_allocator.cc
(%d = %3.1f%%)
(%d = %3.1f%%)
UMA.CreatePersistentHistogram.Result
UMA.CreatePersistentHistogram.Result
Dictionary keys must be quoted.
Dictionary keys must be quoted.
Unsupported encoding. JSON must be UTF-8.
Unsupported encoding. JSON must be UTF-8.
Line: %i, column: %i, %s
Line: %i, column: %i, %s
widevinecdmadapter.dll
widevinecdmadapter.dll
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\google_update_settings.cc
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\google_update_settings.cc
Failed to write to application's ClientState key
Failed to write to application's ClientState key
Removed incremental installer failure key; switching to channel:
Removed incremental installer failure key; switching to channel:
Removed multi-install failure key; switching to channel:
Removed multi-install failure key; switching to channel:
CHROME_PROBED_PROGRAM_FILES_PATH
CHROME_PROBED_PROGRAM_FILES_PATH
chrome-sxs
chrome-sxs
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\google_chrome_distribution.cc
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\google_chrome_distribution.cc
iexplore.exe
iexplore.exe
googlechrome
googlechrome
googlechromeframe
googlechromeframe
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\channel_info.cc
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\channel_info.cc
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\language_selector.cc
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\language_selector.cc
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\app_commands.cc
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\app_commands.cc
Cannot initialize AppCommands from an invalid key.
Cannot initialize AppCommands from an invalid key.
Skipping over key "
Skipping over key "
Failed to open key "
Failed to open key "
Cannot initialize an AppCommand from an invalid key.
Cannot initialize an AppCommand from an invalid key.
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\app_command.cc
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\app_command.cc
CHROME_MAIN_TICKS
CHROME_MAIN_TICKS
user_experience_metrics.reporting_enabled
user_experience_metrics.reporting_enabled
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\settings.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\settings.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\numeric\in_range_cast.h
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\numeric\in_range_cast.h
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc
x-x-x-xx-xxxxxx
x-x-x-xx-xxxxxx
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\misc\uuid.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\misc\uuid.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_io.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_io.cc
--annotation=KEY=VALUE set a process annotation in each crash report
--annotation=KEY=VALUE set a process annotation in each crash report
--database=PATH store the crash report database at PATH
--database=PATH store the crash report database at PATH
create a new pipe and send its name via HANDLE
create a new pipe and send its name via HANDLE
--pipe-name=PIPE communicate with the client over PIPE
--pipe-name=PIPE communicate with the client over PIPE
--url=URL send crash reports to this Breakpad server URL,
--url=URL send crash reports to this Breakpad server URL,
pipe-name
pipe-name
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\handler_main.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\handler_main.cc
duplicate key
duplicate key
--annotation requires KEY=VALUE
--annotation requires KEY=VALUE
--handshake-handle and --pipe-name are incompatible
--handshake-handle and --pipe-name are incompatible
--handshake-handle or --pipe-name is required
--handshake-handle or --pipe-name is required
SetProcessShutdownParameters
SetProcessShutdownParameters
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\crash_report_upload_thread.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\crash_report_upload_thread.cc
reserved key
reserved key
FinishedWritingCrashReport failed
FinishedWritingCrashReport failed
PrepareNewCrashReport failed
PrepareNewCrashReport failed
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\win\crash_report_exception_handler.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\win\crash_report_exception_handler.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_file_writer.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_file_writer.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_writer_util.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_writer_util.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_writable.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_writable.cc
%s.%s,%s,%s
%s.%s,%s,%s
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_context_writer.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_context_writer.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\process_snapshot_minidump.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\process_snapshot_minidump.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_snapshot_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_snapshot_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\crashpad_info_client_options.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\crashpad_info_client_options.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\minidump_simple_string_dictionary_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\minidump_simple_string_dictionary_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\module_snapshot_minidump.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\module_snapshot_minidump.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\exception_snapshot_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\exception_snapshot_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\module_snapshot_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\module_snapshot_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\system_snapshot_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\system_snapshot_win.cc
%s %d.%d.%d.%s%s
%s %d.%d.%d.%s%s
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_reader_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_reader_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\minidump_string_list_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\minidump_string_list_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\capture_memory.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\capture_memory.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\cpu_context_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\cpu_context_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_annotations_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_annotations_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_subrange_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_subrange_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_resource_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_resource_reader.cc
kernel32.dll
kernel32.dll
c:\b\build\slave\win-pgo\build\src\sandbox\win\src\sandbox_policy_base.cc
c:\b\build\slave\win-pgo\build\src\sandbox\win\src\sandbox_policy_base.cc
NtOpenKey
NtOpenKey
NtCreateKey
NtCreateKey
GetCertificateSize
GetCertificateSize
GetCertificate
GetCertificate
GetCertificateSizeByHandle
GetCertificateSizeByHandle
GetCertificateByHandle
GetCertificateByHandle
SetOPMSigningKeyAndSequenceNumbers
SetOPMSigningKeyAndSequenceNumbers
CreateNamedPipeW
CreateNamedPipeW
NtOpenKeyEx
NtOpenKeyEx
PruneCrashReportDatabase: Failed to get pending reports
PruneCrashReportDatabase: Failed to get pending reports
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\prune_crash_reports.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\prune_crash_reports.cc
PruneCrashReportDatabase: Failed to get completed reports
PruneCrashReportDatabase: Failed to get completed reports
Database Pruning: Failed to remove report
Database Pruning: Failed to remove report
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\exception_handler_server.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\exception_handler_server.cc
::GetNamedPipeClientProcessId
::GetNamedPipeClientProcessId
\\.\pipe\crashpad_%d_
\\.\pipe\crashpad_%d_
ImpersonateNamedPipeClient
ImpersonateNamedPipeClient
ConnectNamedPipe
ConnectNamedPipe
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\net\http_transport_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\net\http_transport_win.cc
WinHttpCrackUrl
WinHttpCrackUrl
WinHttpConnect
WinHttpConnect
WinHttpOpenRequest
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpCloseHandle
Crashpad/0.8.0
Crashpad/0.8.0
WinHttpOpen
WinHttpOpen
WinHttpSetTimeouts
WinHttpSetTimeouts
WinHttpReceiveResponse
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpQueryHeaders
HTTP status %d
HTTP status %d
WinHttpReadData
WinHttpReadData
WinHttpAddRequestHeaders
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpSendRequest
%%x
%%x
--%s%sContent-Disposition: form-data; name="%s"
--%s%sContent-Disposition: form-data; name="%s"
; filename="%s"%s
; filename="%s"%s
Content-Type: %s%s
Content-Type: %s%s
multipart/form-data; boundary=%s
multipart/form-data; boundary=%s
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\scoped_process_suspend.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\scoped_process_suspend.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_seeker.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_seeker.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\process_info.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\process_info.cc
Reading x64 process from x86 process not supported
Reading x64 process from x86 process not supported
0x%llx 0x%llx (%s)
0x%llx 0x%llx (%s)
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\module_version.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\module_version.cc
(0xx)
(0xx)
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\scoped_local_alloc.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\scoped_local_alloc.cc
SetNamedPipeHandleState
SetNamedPipeHandleState
WaitNamedPipe
WaitNamedPipe
TransactNamedPipe: expected
TransactNamedPipe: expected
TransactNamedPipe
TransactNamedPipe
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\registration_protocol_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\registration_protocol_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\net\http_body.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\net\http_body.cc
InvokeMainViaCRT
InvokeMainViaCRT
ExitMainViaCRT
ExitMainViaCRT
Microsoft.CRTProvider
Microsoft.CRTProvider
C:\b\build\slave\win-pgo\build\src\out\Release\initialexe\chrome.exe.pdb
C:\b\build\slave\win-pgo\build\src\out\Release\initialexe\chrome.exe.pdb
.text$di
.text$di
.text$mn
.text$mn
.text$x
.text$x
.text$yd
.text$yd
.idata$5
.idata$5
.CRT$XCA
.CRT$XCA
.CRT$XCAA
.CRT$XCAA
.CRT$XCC
.CRT$XCC
.CRT$XCL
.CRT$XCL
.CRT$XCU
.CRT$XCU
.CRT$XCZ
.CRT$XCZ
.CRT$XIA
.CRT$XIA
.CRT$XIAA
.CRT$XIAA
.CRT$XIAC
.CRT$XIAC
.CRT$XIC
.CRT$XIC
.CRT$XIZ
.CRT$XIZ
.CRT$XLA
.CRT$XLA
.CRT$XLB
.CRT$XLB
.CRT$XLZ
.CRT$XLZ
.CRT$XPA
.CRT$XPA
.CRT$XPX
.CRT$XPX
.CRT$XPXA
.CRT$XPXA
.CRT$XPZ
.CRT$XPZ
.CRT$XTA
.CRT$XTA
.CRT$XTZ
.CRT$XTZ
.rdata
.rdata
.rdata$T
.rdata$T
.rdata$r
.rdata$r
.rdata$sxdata
.rdata$sxdata
.rdata$zETW0
.rdata$zETW0
.rdata$zETW1
.rdata$zETW1
.rdata$zETW2
.rdata$zETW2
.rdata$zETW9
.rdata$zETW9
.rdata$zzzdbg
.rdata$zzzdbg
.rtc$IAA
.rtc$IAA
.rtc$IZZ
.rtc$IZZ
.rtc$TAA
.rtc$TAA
.rtc$TZZ
.rtc$TZZ
.xdata$x
.xdata$x
.didat$2
.didat$2
.didat$3
.didat$3
.didat$4
.didat$4
.didat$6
.didat$6
.didat$7
.didat$7
.edata
.edata
.idata$2
.idata$2
.idata$3
.idata$3
.idata$4
.idata$4
.idata$6
.idata$6
.data
.data
.data$r
.data$r
.didat$5
.didat$5
.gfids$x
.gfids$x
.gfids$y
.gfids$y
.tls$ZZZ
.tls$ZZZ
.rsrc$01
.rsrc$01
.rsrc$02
.rsrc$02
chrome.exe
chrome.exe
SignalChromeElf
SignalChromeElf
chrome_elf.dll
chrome_elf.dll
RegOpenKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegEnumKeyExW
RegCreateKeyExW
RegCreateKeyExW
RegQueryInfoKeyW
RegQueryInfoKeyW
RegCloseKey
RegCloseKey
ADVAPI32.dll
ADVAPI32.dll
CreateIoCompletionPort
CreateIoCompletionPort
GetWindowsDirectoryW
GetWindowsDirectoryW
GetProcessHandleCount
GetProcessHandleCount
KERNEL32.dll
KERNEL32.dll
ShellExecuteExW
ShellExecuteExW
SHELL32.dll
SHELL32.dll
CloseWindowStation
CloseWindowStation
CreateWindowStationW
CreateWindowStationW
GetProcessWindowStation
GetProcessWindowStation
SetProcessWindowStation
SetProcessWindowStation
USER32.dll
USER32.dll
VERSION.dll
VERSION.dll
WINMM.dll
WINMM.dll
WTSAPI32.dll
WTSAPI32.dll
RPCRT4.dll
RPCRT4.dll
GetCPInfo
GetCPInfo
GetProcessHeap
GetProcessHeap
PeekNamedPipe
PeekNamedPipe
DisconnectNamedPipe
DisconnectNamedPipe
WaitNamedPipeW
WaitNamedPipeW
WINHTTP.dll
WINHTTP.dll
.?AU_Crt_new_delete@std@@
.?AU_Crt_new_delete@std@@
a.IDATx
a.IDATx
%F?????????3
%F?????????3
ÿFFFFFFFFFFFFFFF?B%
ÿFFFFFFFFFFFFFFF?B%
:1----16
:1----16
Rhgf^rrrr( ?NOCdhgfrrrr...DlEBScjhg^rr,001k>985Tnhherr-12
Rhgf^rrrr( ?NOCdhgfrrrr...DlEBScjhg^rr,001k>985Tnhherr-12
:BBBBBBBBBB>>-.jdddcccca
:BBBBBBBBBB>>-.jdddcccca
3 3*363@3
3 3*363@3
6 6%6-646
6 6%6-646
-0F3K4U4g4m4r4}4
-0F3K4U4g4m4r4}4
1$3 303{3
1$3 303{3
081?1_1?3
081?1_1?3
4!4%4)4{4
4!4%4)4{4
9—9d9
9—9d9
;
;
=~=
=~=
? ?$?(?,?
? ?$?(?,?
5 5$5(5,5
5 5$5(5,5
5 5$5(5,5054585
5 5$5(5,5054585
9,9094989
9,9094989
4 4
4 4
5 5
5 5
KERNEL32.DLL
KERNEL32.DLL
mscoree.dll
mscoree.dll
ext-ms-win-ntuser-windowstation-l1-1-0
ext-ms-win-ntuser-windowstation-l1-1-0
portuguese-brazilian
portuguese-brazilian
Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
nchrome_watcher.dll
nchrome_watcher.dll
PreReadChromeChildInBrowser
PreReadChromeChildInBrowser
${windows}
${windows}
Ndebug.log
Ndebug.log
\StringFileInfo\xx\%ls
\StringFileInfo\xx\%ls
ntdll.dll
ntdll.dll
shell32.dll
shell32.dll
resources.pak
resources.pak
script.log
script.log
chrome
chrome
pepflashplayer.dll
pepflashplayer.dll
Browse the web
Browse the web
Software\Microsoft\Windows\CurrentVersion\Uninstall\Chromium
Software\Microsoft\Windows\CurrentVersion\Uninstall\Chromium
{7D2B3E1D-D096-4594-9D8F-A6667F12E0AC}
{7D2B3E1D-D096-4594-9D8F-A6667F12E0AC}
{A2DF06F9-A21A-44A8-8A99-8B9C84F29160}
{A2DF06F9-A21A-44A8-8A99-8B9C84F29160}
Chrome
Chrome
chrome_child.dll
chrome_child.dll
chrome.dll
chrome.dll
Google Chrome Canary
Google Chrome Canary
{4ea16ac7-fd5a-47c3-875b-dbf4a2008c20}
{4ea16ac7-fd5a-47c3-875b-dbf4a2008c20}
ChromeCanary
ChromeCanary
Chrome Canary HTML Document
Chrome Canary HTML Document
ChromeSSHTM
ChromeSSHTM
{1BEAC3E3-B852-44F4-B468-8906C062422E}
{1BEAC3E3-B852-44F4-B468-8906C062422E}
{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}
{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}
Google Chrome binaries
Google Chrome binaries
hXXps://support.google.com/chrome/contact/chromeuninstall3?hl=$1
hXXps://support.google.com/chrome/contact/chromeuninstall3?hl=$1
Google Chrome
Google Chrome
%d.%d.%d
%d.%d.%d
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
ChromeHTML
ChromeHTML
Chrome HTML Document
Chrome HTML Document
{8A69D345-D564-463c-AFF1-A69D9E530F96}
{8A69D345-D564-463c-AFF1-A69D9E530F96}
{5C65F4B0-3651-4514-B207-D10CB699B14B}
{5C65F4B0-3651-4514-B207-D10CB699B14B}
Google Chrome Frame
Google Chrome Frame
Chrome in a Frame.
Chrome in a Frame.
Google\Chrome Frame
Google\Chrome Frame
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame
{8BA986DA-5100-405E-AA35-86F34A02ACBF}
{8BA986DA-5100-405E-AA35-86F34A02ACBF}
WebAccessible
WebAccessible
-chromeframe
-chromeframe
-chrome
-chrome
lSOFTWARE\Policies\Google\Chrome
lSOFTWARE\Policies\Google\Chrome
reports
reports
settings.dat
settings.dat
ALPC Port
ALPC Port
\Sessions\%d\AppContainerNamedObjects\%ls
\Sessions\%d\AppContainerNamedObjects\%ls
sHKEY_USERS
sHKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_PERFORMANCE_DATA
HKEY_PERFORMANCE_TEXT
HKEY_PERFORMANCE_TEXT
HKEY_PERFORMANCE_NLSTEXT
HKEY_PERFORMANCE_NLSTEXT
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
HKEY_DYN_DATA
HKEY_DYN_DATA
pipe\
pipe\
egdi32.dll
egdi32.dll
tntdll.dll
tntdll.dll
xntdll.dll
xntdll.dll
Chrome_MessageWindow
Chrome_MessageWindow
Failed to create directory %ls, last error is %d
Failed to create directory %ls, last error is %d
Chrome SxS\Application
Chrome SxS\Application
winhttp.dll
winhttp.dll
%Program Files%\Google\Chrome\Application\chrome.exe
%Program Files%\Google\Chrome\Application\chrome.exe
54.0.2840.59
54.0.2840.59
chrome_exe
chrome_exe
iexplore.exe_1652_rwx_038F0000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_1652_rwx_03930000_00001000:
kernel32.dll
kernel32.dll
SearchFilterHost.exe_3104:
.text
.text
`.data
`.data
.rsrc
.rsrc
@.reloc
@.reloc
ADVAPI32.dll
ADVAPI32.dll
ntdll.DLL
ntdll.DLL
KERNEL32.dll
KERNEL32.dll
msvcrt.dll
msvcrt.dll
USER32.dll
USER32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
TQUERY.DLL
TQUERY.DLL
IMM32.dll
IMM32.dll
MSSHooks.dll
MSSHooks.dll
mscoree.dll
mscoree.dll
SHLWAPI.dll
SHLWAPI.dll
d:\win7sp1_gdr\enduser\mssearch2\search\search\gather\fltrhost\bufstm.cxx
d:\win7sp1_gdr\enduser\mssearch2\search\search\gather\fltrhost\bufstm.cxx
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\mutex.cpp
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\mutex.cpp
RegDeleteKeyW
RegDeleteKeyW
RegDeleteKeyExW
RegDeleteKeyExW
8%uiP
8%uiP
d:\win7sp1_gdr\enduser\mssearch2\common\include\srchxcpt.hxx
d:\win7sp1_gdr\enduser\mssearch2\common\include\srchxcpt.hxx
Invalid parameter passed to C runtime function.
Invalid parameter passed to C runtime function.
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracersecutil.h
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracersecutil.h
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.cpp
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.cpp
-d-d-d-d-d-d-d-%d
-d-d-d-d-d-d-d-%d
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.h
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.h
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\sysimprs.cxx
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\sysimprs.cxx
RegCloseKey
RegCloseKey
RegCreateKeyExW
RegCreateKeyExW
RegOpenKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryInfoKeyW
RegEnumKeyExW
RegEnumKeyExW
ReportEventW
ReportEventW
_amsg_exit
_amsg_exit
SearchFilterHost.pdb
SearchFilterHost.pdb
version="5.1.0.0"
version="5.1.0.0"
name="Microsoft.Windows.Search.MSSFH"
name="Microsoft.Windows.Search.MSSFH"
3 3(30383|3
3 3(30383|3
kernel32.dll
kernel32.dll
Software\Microsoft\Windows Search
Software\Microsoft\Windows Search
SOFTWARE\Microsoft\Windows Search
SOFTWARE\Microsoft\Windows Search
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_PERFORMANCE_DATA
HKEY_DYN_DATA
HKEY_DYN_DATA
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
Windows Search Service
Windows Search Service
tquery.dll
tquery.dll
advapi32.dll
advapi32.dll
API-MS-Win-Core-LocalRegistry-L1-1-0.dll
API-MS-Win-Core-LocalRegistry-L1-1-0.dll
0xx%p%S%d
0xx%p%S%d
Software\Microsoft\Windows Search\Tracing
Software\Microsoft\Windows Search\Tracing
Software\Microsoft\Windows Search\Tracing\EventThrottleLastReported
Software\Microsoft\Windows Search\Tracing\EventThrottleLastReported
Software\Microsoft\Windows Search\Tracing\EventThrottleState
Software\Microsoft\Windows Search\Tracing\EventThrottleState
0xx=
0xx=
%S(%d)
%S(%d)
tid="0x%x"
tid="0x%x"
pid="0x%x"
pid="0x%x"
tagname="%S"
tagname="%S"
tagid="0x%x"
tagid="0x%x"
el="0x%x"
el="0x%x"
time="d/d/d d:d:d.d"
time="d/d/d d:d:d.d"
logname="%S"
logname="%S"
Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}
Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}
.\%s.mui
.\%s.mui
.\%s\%s.mui
.\%s\%s.mui
%s\%s.mui
%s\%s.mui
%s\%s\%s.mui
%s\%s\%s.mui
%s\%s
%s\%s
winhttp.dll
winhttp.dll
Microsoft Windows Search Filter Host
Microsoft Windows Search Filter Host
7.00.7601.17610 (win7sp1_gdr.110503-1502)
7.00.7601.17610 (win7sp1_gdr.110503-1502)
SearchFilterHost.exe
SearchFilterHost.exe
Windows
Windows
7.00.7601.17610
7.00.7601.17610
iexplore.exe_1652_rwx_03970000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_1652_rwx_039B0000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_1652_rwx_03B00000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_1652_rwx_03C40000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_1652_rwx_03C80000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_1652_rwx_03DC0000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_1652_rwx_03E00000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_1652_rwx_03E40000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_1652_rwx_03E80000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_1652_rwx_03EB0000_00001000:
GetProcessHeap
GetProcessHeap
iexplore.exe_1652_rwx_03EC0000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_1652_rwx_03EF0000_00001000:
oleaut32.dll
oleaut32.dll
iexplore.exe_1652_rwx_03F30000_00001000:
oleaut32.dll
oleaut32.dll
iexplore.exe_1652_rwx_03F70000_00001000:
oleaut32.dll
oleaut32.dll
iexplore.exe_1652_rwx_040A0000_00001000:
advapi32.dll
advapi32.dll
iexplore.exe_1652_rwx_040E0000_00001000:
advapi32.dll
advapi32.dll
iexplore.exe_1652_rwx_04110000_00001000:
RegOpenKeyExA
RegOpenKeyExA
iexplore.exe_1652_rwx_04120000_00001000:
advapi32.dll
advapi32.dll
iexplore.exe_1652_rwx_04250000_00001000:
RegCloseKey
RegCloseKey
iexplore.exe_1652_rwx_04260000_00001000:
advapi32.dll
advapi32.dll
iexplore.exe_1652_rwx_04290000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_1652_rwx_042D0000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_1652_rwx_04310000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_1652_rwx_04350000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_1652_rwx_04490000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_1652_rwx_044D0000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_1652_rwx_04510000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_1652_rwx_04550000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_1652_rwx_04590000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_1652_rwx_045D0000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_1652_rwx_04610000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_1652_rwx_04650000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_1652_rwx_04690000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_1652_rwx_046D0000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_1652_rwx_04710000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_1652_rwx_04750000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_1652_rwx_04790000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_1652_rwx_047C0000_00001000:
ntdll.dll
ntdll.dll
iexplore.exe_1652_rwx_04800000_00001000:
ntdll.dll
ntdll.dll
iexplore.exe_1652_rwx_319E0000_00009000:
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
kernel32.dll
Ntdll.dll
Ntdll.dll
NtEnumerateValueKey
NtEnumerateValueKey
NtEnumerateKey
NtEnumerateKey
advapi32.dll
advapi32.dll
GetProcessHeap
GetProcessHeap
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
ntdll.dll
ntdll.dll
KWindows
KWindows
iexplore.exe_3800_rwx_01291000_00001000:
Microsoft.InternetExplorer.Default
Microsoft.InternetExplorer.Default
user32.dll
user32.dll
iexplore.exe_3800_rwx_01786000_00001000:
1.6.0_18
1.6.0_18
jp2ssv.dll
jp2ssv.dll
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
HKEY_DYN_DATA
HKEY_DYN_DATA
HKEY_PERFORMANCE_DATA
HKEY_PERFORMANCE_DATA
HKEY_USERS
HKEY_USERS
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
%s\jp2iexp.dll
%s\jp2iexp.dll
{5852F5ED-8BF4-11D4-A245-0080C6F74284}
{5852F5ED-8BF4-11D4-A245-0080C6F74284}
jpishare.dll
jpishare.dll
NPOJI*.dll
NPOJI*.dll
NPJava*.dll
NPJava*.dll
NPJPI*.dll
NPJPI*.dll
{8AD9C840-044E-11D1-B3E9-00805F499D93}
{8AD9C840-044E-11D1-B3E9-00805F499D93}
{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBB}
{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBB}
%s\ssvagent.exe
%s\ssvagent.exe
-ABCDEFFEDCBA}
-ABCDEFFEDCBA}
%sd-d-d%s
%sd-d-d%s
-ABCDEFFEDCBB}
-ABCDEFFEDCBB}
-ABCDEFFEDCBC}
-ABCDEFFEDCBC}
%sd-d-FFFF%s
%sd-d-FFFF%s
.._d
.._d
..
..
{E19F9331-3110-11D4-991C-005004D3B3DB}
{E19F9331-3110-11D4-991C-005004D3B3DB}
SOFTWARE\Classes\CLSID\%s\InprocServer32
SOFTWARE\Classes\CLSID\%s\InprocServer32
Mozilla
Mozilla
Mozilla Firefox
Mozilla Firefox
mozilla.org
mozilla.org
%s00-d-d%s
%s00-d-d%s
1.3.0_02
1.3.0_02
.*
.*
%s_
%s_
shell32.dll
shell32.dll
iexplore.exe_3800_rwx_06650000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800_rwx_06690000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800_rwx_066D0000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800_rwx_06810000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800_rwx_06850000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800_rwx_06890000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800_rwx_068D0000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800_rwx_06910000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800_rwx_070B0000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800_rwx_078F0000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800_rwx_07B30000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800_rwx_07C70000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800_rwx_07CB0000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800_rwx_07CF0000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800_rwx_08030000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800_rwx_08170000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800_rwx_081B0000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800_rwx_081F0000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800_rwx_08220000_00001000:
GetProcessHeap
GetProcessHeap
iexplore.exe_3800_rwx_08740000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800_rwx_08770000_00001000:
oleaut32.dll
oleaut32.dll
iexplore.exe_3800_rwx_087B0000_00001000:
oleaut32.dll
oleaut32.dll
iexplore.exe_3800_rwx_087F0000_00001000:
oleaut32.dll
oleaut32.dll
iexplore.exe_3800_rwx_08820000_00001000:
advapi32.dll
advapi32.dll
iexplore.exe_3800_rwx_08960000_00001000:
advapi32.dll
advapi32.dll
iexplore.exe_3800_rwx_08E90000_00001000:
RegOpenKeyExA
RegOpenKeyExA
iexplore.exe_3800_rwx_08EA0000_00001000:
advapi32.dll
advapi32.dll
iexplore.exe_3800_rwx_08ED0000_00001000:
RegCloseKey
RegCloseKey
iexplore.exe_3800_rwx_08EE0000_00001000:
advapi32.dll
advapi32.dll
iexplore.exe_3800_rwx_09010000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800_rwx_09050000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800_rwx_09290000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800_rwx_095D0000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800_rwx_09610000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800_rwx_09650000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800_rwx_09690000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800_rwx_096D0000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800_rwx_09810000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800_rwx_09950000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800_rwx_09990000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800_rwx_099D0000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800_rwx_09A10000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800_rwx_09A50000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800_rwx_09B90000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800_rwx_09BD0000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800_rwx_09C10000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_3800_rwx_09C40000_00001000:
ntdll.dll
ntdll.dll
iexplore.exe_3800_rwx_09C80000_00001000:
ntdll.dll
ntdll.dll
iexplore.exe_3800_rwx_319F0000_00009000:
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
kernel32.dll
Ntdll.dll
Ntdll.dll
NtEnumerateValueKey
NtEnumerateValueKey
NtEnumerateKey
NtEnumerateKey
advapi32.dll
advapi32.dll
GetProcessHeap
GetProcessHeap
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
ntdll.dll
ntdll.dll
KWindows
KWindows
iexplore.exe_3800_rwx_69331000_00001000:
[Jw.cRw
[Jw.cRw
iexplore.exe_3800_rwx_6AE31000_00001000:
d3d10d.dll
d3d10d.dll
id3d10ref.dll
id3d10ref.dll
d3d10core.dll
d3d10core.dll
d3d10warp.dll
d3d10warp.dll
The application was compiled against and will only work with D3D10_SDK_VERSION (%d), but the currently installed runtime is version (%d).
The application was compiled against and will only work with D3D10_SDK_VERSION (%d), but the currently installed runtime is version (%d).
#pragma ruledisable 0xx
#pragma ruledisable 0xx
#pragma warning (disable:%d)
#pragma warning (disable:%d)
#pragma warning (error:%d)
#pragma warning (error:%d)
#pragma warning (once:%d)
#pragma warning (once:%d)
#pragma def (%s, %s, %g, %g, %g, %g)
#pragma def (%s, %s, %g, %g, %g, %g)
D3D10PreprocessShader
D3D10PreprocessShader
duplicate attribute %s
duplicate attribute %s
unknown attribute %s, or attribute invalid for this statement
unknown attribute %s, or attribute invalid for this statement
internal error: argument missing context (A%u)
internal error: argument missing context (A%u)
?internal error: operand type mismatch
?internal error: operand type mismatch
invalid register specification, expected '%c' binding
invalid register specification, expected '%c' binding
user defined %s buffers cannot be target specific
user defined %s buffers cannot be target specific
Duplicated input semantics can't change type, size, or layout ('%s').
Duplicated input semantics can't change type, size, or layout ('%s').
array dimension for %s must be %i
array dimension for %s must be %i
register or offset bind %s.%s not valid
register or offset bind %s.%s not valid
Cannot map loop to shader target, target does not support breaks
Cannot map loop to shader target, target does not support breaks
Loop only executes for %d iteration(s), forcing loop to unroll
Loop only executes for %d iteration(s), forcing loop to unroll
Unable to unroll loop, loop does not appear to terminate in a timely manner (%d iteratio
Unable to unroll loop, loop does not appear to terminate in a timely manner (%d iteratio
iexplore.exe_3800_rwx_6AF41000_00001000:
JSCRIPT9.dll
JSCRIPT9.dll
iexplore.exe_3800_rwx_6B101000_00001000:
kInvalid parameter passed to C runtime function.
kInvalid parameter passed to C runtime function.
iexplore.exe_3800_rwx_6D194000_00001000:
mscoree.dll
mscoree.dll
Please contact the application's support team for more information.
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
GetSystemWindowsDirectoryW
GetSystemWindowsDirectoryW
PGORT80.dll
PGORT80.dll
MSCoree.dll
MSCoree.dll
kernel32.dll
kernel32.dll
.mixcrt
.mixcrt
KERNEL32.DLL
KERNEL32.DLL
msvcrt.dll
msvcrt.dll
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
ADVAPI32.DLL
ADVAPI32.DLL
GetProcessWindowStation
GetProcessWindowStation
USER32.DLL
USER32.DLL
setnewh.cpp
setnewh.cpp
Microsoft.VC80.CRT.manifest
Microsoft.VC80.CRT.manifest
msvcr80.dll
msvcr80.dll
iexplore.exe_3800_rwx_6D1D1000_00001000:
'i' is only supported with debug builds.
'i' is only supported with debug builds.
*** %s%ls%sSource: `%ls:%ld`
*** %s%ls%sSource: `%ls:%ld`
vsStageData.Color = Diffuse;
vsStageData.Color = Diffuse;
vsStageData.UV = UV;
vsStageData.UV = UV;
float2 inputUV = vsStageData.UV;
float2 inputUV = vsStageData.UV;
vsStageData.UV.x = inputUV.x*mat3x2TextureTransform0[0] inputUV.y*mat3x2TextureTransform0[1] mat3x2TextureTransform0[2];
vsStageData.UV.x = inputUV.x*mat3x2TextureTransform0[0] inputUV.y*mat3x2TextureTransform0[1] mat3x2TextureTransform0[2];
vsStageData.UV.y = inputUV.x*mat3x2TextureTransform1[0] inputUV.y*mat3x2TextureTransform1[1] mat3x2TextureTransform1[2];
vsStageData.UV.y = inputUV.x*mat3x2TextureTransform1[0] inputUV.y*mat3x2TextureTransform1[1] mat3x2TextureTransform1[2];
vsStageData.Color = Color;
vsStageData.Color = Color;
BlendColor = vsStageData.Color;
BlendColor = vsStageData.Color;
Diffuse = vsStageData.Color;
Diffuse = vsStageData.Color;
uv = vsStageData.UV;
uv = vsStageData.UV;
halfTexelSizeNormalized_and_vCoord = Data_halfTexelSizeNormalized_and_vCoord;
halfTexelSizeNormalized_and_vCoord = Data_halfTexelSizeNormalized_and_vCoord;
halfTexelSizeNormalized_and_vCoord_and_gradientSpanNormalized = Data_halfTexelSizeNormalized_and_vCoord_and_gradientSpanNormalized;
halfTexelSizeNormalized_and_vCoord_and_gradientSpanNormalized = Data_halfTexelSizeNormalized_and_vCoord_and_gradientSpanNormalized;
gradOrigin_and_firstTexelRegionCenter = Data_gradOrigin_and_firstTexelRegionCenter;
gradOrigin_and_firstTexelRegionCenter = Data_gradOrigin_and_firstTexelRegionCenter;
USERProcessHandleQuota
USERProcessHandleQuota
GDIProcessHandleQuota
GDIProcessHandleQuota
kernel32.dll
kernel32.dll
Software\Microsoft\Avalon.Graphics
Software\Microsoft\Avalon.Graphics
d:\win7sp1_gdr\windows\wgi\shared\util\utillib\debugbreak.cpp
d:\win7sp1_gdr\windows\wgi\shared\util\utillib\debugbreak.cpp
iexplore.exe_3800_rwx_6D441000_00001000:
DmD3D10Level9 Error x: (%d@%d) %s
DmD3D10Level9 Error x: (%d@%d) %s
gdi32.dll
gdi32.dll
D3D9 DDI returned %s. Insulating d3d9 driver from further calls...
D3D9 DDI returned %s. Insulating d3d9 driver from further calls...
D3D9 DDI Failed - not reporting (via callback) and returning S_OK
D3D9 DDI Failed - not reporting (via callback) and returning S_OK
D3D9 DDI Failed - not reporting (via callback) and returning E_FAIL
D3D9 DDI Failed - not reporting (via callback) and returning E_FAIL
D3D9 DDI Failed - reporting to runtime (via callback), but ignoring result
D3D9 DDI Failed - reporting to runtime (via callback), but ignoring result
D3D9 DDI Failed following a device removed. Reporting D3DDDIERR_DEVICEREMOVED to runtime and insulating d3d9 driver from further calls.
D3D9 DDI Failed following a device removed. Reporting D3DDDIERR_DEVICEREMOVED to runtime and insulating d3d9 driver from further calls.
UMD DLL %S didn't export OpenAdapter
UMD DLL %S didn't export OpenAdapter
UMD DLL %S could not be loaded
UMD DLL %S could not be loaded
D3DKMTReleaseKeyedMutex
D3DKMTReleaseKeyedMutex
D3DKMTAcquireKeyedMutex
D3DKMTAcquireKeyedMutex
D3DKMTDestroyKeyedMutex
D3DKMTDestroyKeyedMutex
D3DKMTOpenKeyedMutex
D3DKMTOpenKeyedMutex
D3DKMTCreateKeyedMutex
D3DKMTCreateKeyedMutex
10on9 version mismatch, refusing to load driver. 10on9 will work with APIs that use version (== %u, >= %u); but the current APIs use version (%u, %u).
10on9 version mismatch, refusing to load driver. 10on9 will work with APIs that use version (== %u, >= %u); but the current APIs use version (%u, %u).
iexplore.exe_3800_rwx_6E8A1000_00001000:
IEShims.dll
IEShims.dll
GetProcAddressShim
GetProcAddressShim
AcrobatSetWindowsHook
AcrobatSetWindowsHook
SearchProtocolHost.exe_3136_rwx_00130000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172_rwx_000F0000_00001000:
kernel32.dll
kernel32.dll
SearchProtocolHost.exe_3136_rwx_002D0000_00001000:
kernel32.dll
kernel32.dll
SearchProtocolHost.exe_3136_rwx_00310000_00001000:
kernel32.dll
kernel32.dll
SearchProtocolHost.exe_3136_rwx_00620000_00001000:
kernel32.dll
kernel32.dll
SearchProtocolHost.exe_3136_rwx_00750000_00001000:
kernel32.dll
kernel32.dll
SearchProtocolHost.exe_3136_rwx_00840000_00001000:
kernel32.dll
kernel32.dll
SearchProtocolHost.exe_3136_rwx_00880000_00001000:
kernel32.dll
kernel32.dll
SearchProtocolHost.exe_3136_rwx_008C0000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688:
`.rsrc
`.rsrc
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
####@####
####@####
kernel32.dll
kernel32.dll
VBoxService.exe
VBoxService.exe
SbieDll.dll
SbieDll.dll
dbghelp.dll
dbghelp.dll
Software\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion
55274-640-2673064-23950
55274-640-2673064-23950
76487-644-3177037-23510
76487-644-3177037-23510
76487-337-8429955-22614
76487-337-8429955-22614
\\.\Syser
\\.\Syser
\\.\SyserDbgMsg
\\.\SyserDbgMsg
\\.\SyserBoot
\\.\SyserBoot
\\.\SICE
\\.\SICE
\\.\NTICE
\\.\NTICE
ShellExecuteA
ShellExecuteA
shell32.dll
shell32.dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
GetWindowsDirectoryA
GetWindowsDirectoryA
SOFTWARE\Microsoft\Windows\CurrentVersion
SOFTWARE\Microsoft\Windows\CurrentVersion
http\shell\open\command
http\shell\open\command
\Internet Explorer\iexplore.exe
\Internet Explorer\iexplore.exe
PSAPI.dll
PSAPI.dll
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
Microsoft\Network\Connections\pbk\rasphone.pbk
Microsoft\Network\Connections\pbk\rasphone.pbk
rasapi32.dll
rasapi32.dll
rnaph.dll
rnaph.dll
RAS Passwords |
RAS Passwords |
uURLHistory
uURLHistory
Password:
Password:
abe2869f-9b47-4cd9-a358-c22904dba7f7
abe2869f-9b47-4cd9-a358-c22904dba7f7
Password
Password
UnitPasswords
UnitPasswords
advapi32.dll
advapi32.dll
WindowsLive:name=*
WindowsLive:name=*
xxxyyyzzz.dat
xxxyyyzzz.dat
\Mozilla Firefox\
\Mozilla Firefox\
mozcrt19.dll
mozcrt19.dll
sqlite3.dll
sqlite3.dll
nspr4.dll
nspr4.dll
plc4.dll
plc4.dll
plds4.dll
plds4.dll
nssutil3.dll
nssutil3.dll
softokn3.dll
softokn3.dll
nss3.dll
nss3.dll
PK11_GetInternalKeySlot
PK11_GetInternalKeySlot
userenv.dll
userenv.dll
\Mozilla\Firefox\
\Mozilla\Firefox\
profiles.ini
profiles.ini
\signons3.txt
\signons3.txt
\signons2.txt
\signons2.txt
\signons1.txt
\signons1.txt
\signons.txt
\signons.txt
(unnamed password)
(unnamed password)
explorer.exe
explorer.exe
_x_X_PASSWORDLIST_X_x_
_x_X_PASSWORDLIST_X_x_
NOIP.abc
NOIP.abc
MSN.abc
MSN.abc
FIREFOX.abc
FIREFOX.abc
IELOGIN.abc
IELOGIN.abc
IEPASS.abc
IEPASS.abc
IEAUTO.abc
IEAUTO.abc
IEWEB.abc
IEWEB.abc
XX--XX--XX.txt
XX--XX--XX.txt
?456789:;
?456789:;
!"#$%&'()* ,-./0123
!"#$%&'()* ,-./0123
KWindows
KWindows
KuURLHistory
KuURLHistory
IEpasswords
IEpasswords
####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@####
####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@####
####@#### ####@####
####@#### ####@####
####@#### ####@#### ####@#### ####@####
####@#### ####@#### ####@#### ####@####
T%XCC1
T%XCC1
w}-cL}
w}-cL}
XhDq.Tu
XhDq.Tu
.Iu|$p
.Iu|$p
1dH0z.MNJ2
1dH0z.MNJ2
!id%9X%
!id%9X%
kp.vK
kp.vK
.ClT(8
.ClT(8
'.WH*
'.WH*
@.sp&
@.sp&
%XAWW
%XAWW
m.Pm=
m.Pm=
pn.Kqz!
pn.Kqz!
h%X:y
h%X:y
LH.dbL-.
LH.dbL-.
%D=\ptu
%D=\ptu
*v.Cw
*v.Cw
geV%FZq
geV%FZq
%c)*L9
%c)*L9
t`.Ju
t`.Ju
uT.dCC7
uT.dCC7
TRÃŒU
TRÃŒU
TuÃŒU
TuÃŒU
ÃŒUZ
ÃŒUZ
ÃŒU}
ÃŒU}
T_Ì
T_Ì
T%Ì
T%Ì
TB.CCU6
TB.CCU6
Te.CCU
Te.CCU
T3.CCU
T3.CCU
.CCUJ
.CCUJ
.CCUm
.CCUm
TO.CC
TO.CC
Tr.CC
Tr.CC
T8.CC
T8.CC
7o.TW
7o.TW
7o.Tq
7o.Tq
T.CCC7d7
T.CCC7d7
T.FCC8|
T.FCC8|
T.ICC
T.ICC
T.GCC
T.GCC
@T.HAC
@T.HAC
TB.AC
TB.AC
TS.AC
TS.AC
T\.AC
T\.AC
Tm.AC
Tm.AC
T~.AC
T~.AC
TX.AC{
TX.AC{
T%S@CC
T%S@CC
T%X@C
T%X@C
T.SCC79
T.SCC79
|T.DCC1
|T.DCC1
D.TbGCC5
D.TbGCC5
GetProcessHeap
GetProcessHeap
RegOpenKeyExA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteKeyA
RegCreateKeyExA
RegCreateKeyExA
RegCreateKeyA
RegCreateKeyA
RegCloseKey
RegCloseKey
SetWindowsHookExA
SetWindowsHookExA
GetKeyboardState
GetKeyboardState
.idata
.idata
.rdata
.rdata
P.reloc
P.reloc
P.rsrc
P.rsrc
KERNEL32.DLL
KERNEL32.DLL
crypt32.dll
crypt32.dll
ole32.dll
ole32.dll
oleaut32.dll
oleaut32.dll
pstorec.dll
pstorec.dll
user32.dll
user32.dll
SearchProtocolHost.exe_3136_rwx_01980000_00001000:
kernel32.dll
kernel32.dll
SearchProtocolHost.exe_3136_rwx_019C0000_00001000:
kernel32.dll
kernel32.dll
SearchProtocolHost.exe_3136_rwx_01A00000_00001000:
kernel32.dll
kernel32.dll
SearchProtocolHost.exe_3136_rwx_01A40000_00001000:
kernel32.dll
kernel32.dll
SearchProtocolHost.exe_3136_rwx_01A80000_00001000:
kernel32.dll
kernel32.dll
SearchProtocolHost.exe_3136_rwx_01AC0000_00001000:
kernel32.dll
kernel32.dll
SearchProtocolHost.exe_3136_rwx_01B00000_00001000:
kernel32.dll
kernel32.dll
SearchProtocolHost.exe_3136_rwx_01B40000_00001000:
kernel32.dll
kernel32.dll
SearchProtocolHost.exe_3136_rwx_01B80000_00001000:
kernel32.dll
kernel32.dll
SearchProtocolHost.exe_3136_rwx_01BC0000_00001000:
kernel32.dll
kernel32.dll
SearchProtocolHost.exe_3136_rwx_01BF0000_00001000:
GetProcessHeap
GetProcessHeap
SearchProtocolHost.exe_3136_rwx_01C00000_00001000:
kernel32.dll
kernel32.dll
SearchProtocolHost.exe_3136_rwx_01C30000_00001000:
oleaut32.dll
oleaut32.dll
SearchProtocolHost.exe_3136_rwx_01C70000_00001000:
oleaut32.dll
oleaut32.dll
SearchProtocolHost.exe_3136_rwx_01CB0000_00001000:
oleaut32.dll
oleaut32.dll
SearchProtocolHost.exe_3136_rwx_01D20000_00001000:
advapi32.dll
advapi32.dll
SearchProtocolHost.exe_3136_rwx_01D60000_00001000:
advapi32.dll
advapi32.dll
SearchProtocolHost.exe_3136_rwx_01D90000_00001000:
RegOpenKeyExA
RegOpenKeyExA
SearchProtocolHost.exe_3136_rwx_01DA0000_00001000:
advapi32.dll
advapi32.dll
SearchProtocolHost.exe_3136_rwx_01DD0000_00001000:
RegCloseKey
RegCloseKey
SearchProtocolHost.exe_3136_rwx_01DE0000_00001000:
advapi32.dll
advapi32.dll
SearchProtocolHost.exe_3136_rwx_01E10000_00001000:
kernel32.dll
kernel32.dll
SearchProtocolHost.exe_3136_rwx_01E90000_00001000:
kernel32.dll
kernel32.dll
SearchProtocolHost.exe_3136_rwx_01ED0000_00001000:
kernel32.dll
kernel32.dll
SearchProtocolHost.exe_3136_rwx_01F10000_00001000:
kernel32.dll
kernel32.dll
SearchProtocolHost.exe_3136_rwx_01F50000_00001000:
kernel32.dll
kernel32.dll
SearchProtocolHost.exe_3136_rwx_01FD0000_00001000:
kernel32.dll
kernel32.dll
SearchProtocolHost.exe_3136_rwx_02010000_00001000:
kernel32.dll
kernel32.dll
SearchProtocolHost.exe_3136_rwx_02050000_00001000:
kernel32.dll
kernel32.dll
SearchProtocolHost.exe_3136_rwx_02090000_00001000:
kernel32.dll
kernel32.dll
SearchProtocolHost.exe_3136_rwx_020D0000_00001000:
kernel32.dll
kernel32.dll
SearchProtocolHost.exe_3136_rwx_02110000_00001000:
kernel32.dll
kernel32.dll
SearchProtocolHost.exe_3136_rwx_02150000_00001000:
kernel32.dll
kernel32.dll
SearchProtocolHost.exe_3136_rwx_02190000_00001000:
kernel32.dll
kernel32.dll
SearchProtocolHost.exe_3136_rwx_021D0000_00001000:
kernel32.dll
kernel32.dll
SearchProtocolHost.exe_3136_rwx_02210000_00001000:
kernel32.dll
kernel32.dll
SearchProtocolHost.exe_3136_rwx_02250000_00001000:
kernel32.dll
kernel32.dll
SearchProtocolHost.exe_3136_rwx_02290000_00001000:
kernel32.dll
kernel32.dll
SearchProtocolHost.exe_3136_rwx_022C0000_00001000:
ntdll.dll
ntdll.dll
SearchProtocolHost.exe_3136_rwx_02300000_00001000:
ntdll.dll
ntdll.dll
SearchProtocolHost.exe_3136_rwx_31A00000_00009000:
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
kernel32.dll
Ntdll.dll
Ntdll.dll
NtEnumerateValueKey
NtEnumerateValueKey
NtEnumerateKey
NtEnumerateKey
advapi32.dll
advapi32.dll
GetProcessHeap
GetProcessHeap
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
ntdll.dll
ntdll.dll
KWindows
KWindows
chrome.exe_2172_rwx_00130000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172_rwx_00180000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172_rwx_00390000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172_rwx_009B0000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172_rwx_009F0000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172_rwx_00A30000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172_rwx_00C70000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172_rwx_00EB0000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172_rwx_00FF0000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172_rwx_01030000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172_rwx_01070000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172_rwx_010B0000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172_rwx_010F0000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172_rwx_01130000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172_rwx_01170000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172_rwx_011B0000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172_rwx_011F0000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172_rwx_01220000_00001000:
GetProcessHeap
GetProcessHeap
chrome.exe_2172_rwx_01230000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172_rwx_01260000_00001000:
oleaut32.dll
oleaut32.dll
chrome.exe_2172_rwx_012A0000_00001000:
oleaut32.dll
oleaut32.dll
chrome.exe_2172_rwx_012E0000_00001000:
oleaut32.dll
oleaut32.dll
chrome.exe_2172_rwx_01310000_00001000:
advapi32.dll
advapi32.dll
chrome.exe_2172_rwx_013D9000_00001000:
ole32.dll
ole32.dll
POWRPROF.dll
POWRPROF.dll
address family not supported
address family not supported
broken pipe
broken pipe
function not supported
function not supported
inappropriate io control operation
inappropriate io control operation
not supported
not supported
operation canceled
operation canceled
operation in progress
operation in progress
operation not permitted
operation not permitted
operation not supported
operation not supported
operation would block
operation would block
protocol not supported
protocol not supported
KERNEL32.DLL
KERNEL32.DLL
chrome.exe_2172_rwx_02040000_00001000:
advapi32.dll
advapi32.dll
chrome.exe_2172_rwx_02070000_00001000:
RegOpenKeyExA
RegOpenKeyExA
chrome.exe_2172_rwx_02080000_00001000:
advapi32.dll
advapi32.dll
chrome.exe_2172_rwx_020B0000_00001000:
RegCloseKey
RegCloseKey
chrome.exe_2172_rwx_020C0000_00001000:
advapi32.dll
advapi32.dll
chrome.exe_2172_rwx_020F0000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172_rwx_02130000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172_rwx_02370000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172_rwx_023B0000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172_rwx_024F0000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172_rwx_02530000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172_rwx_02570000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172_rwx_025B0000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172_rwx_025F0000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172_rwx_02630000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172_rwx_02670000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172_rwx_026B0000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172_rwx_026F0000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172_rwx_02730000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172_rwx_02770000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172_rwx_027B0000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172_rwx_027F0000_00001000:
kernel32.dll
kernel32.dll
chrome.exe_2172_rwx_02820000_00001000:
ntdll.dll
ntdll.dll
chrome.exe_2172_rwx_02860000_00001000:
ntdll.dll
ntdll.dll
chrome.exe_2172_rwx_31A10000_00009000:
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
kernel32.dll
Ntdll.dll
Ntdll.dll
NtEnumerateValueKey
NtEnumerateValueKey
NtEnumerateKey
NtEnumerateKey
advapi32.dll
advapi32.dll
GetProcessHeap
GetProcessHeap
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
ntdll.dll
ntdll.dll
KWindows
KWindows
chrome.exe_2172_rwx_6ADB2000_00001000:
Microsoft\SystemCertificates
Microsoft\SystemCertificates
Microsoft\Windows\CurrentVersion\App Paths
Microsoft\Windows\CurrentVersion\App Paths
Microsoft\Windows\CurrentVersion\Control Panel\Cursors\Schemes
Microsoft\Windows\CurrentVersion\Control Panel\Cursors\Schemes
Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers
Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers
Microsoft\Windows\CurrentVersion\Explorer\DriveIcons
Microsoft\Windows\CurrentVersion\Explorer\DriveIcons
Microsoft\Windows\CurrentVersion\Explorer\KindMap
Microsoft\Windows\CurrentVersion\Explorer\KindMap
Microsoft\Windows\CurrentVersion\Group Policy
Microsoft\Windows\CurrentVersion\Group Policy
Microsoft\Windows\CurrentVersion\Policies
Microsoft\Windows\CurrentVersion\Policies
Microsoft\Windows\CurrentVersion\PreviewHandlers
Microsoft\Windows\CurrentVersion\PreviewHandlers
Microsoft\Windows\CurrentVersion\Setup
Microsoft\Windows\CurrentVersion\Setup
Microsoft\Windows\CurrentVersion\Telephony\Locations
Microsoft\Windows\CurrentVersion\Telephony\Locations
Microsoft\Windows NT\CurrentVersion\Console
Microsoft\Windows NT\CurrentVersion\Console
Microsoft\Windows NT\CurrentVersion\FontDpi
Microsoft\Windows NT\CurrentVersion\FontDpi
Microsoft\Windows NT\CurrentVersion\FontLink
Microsoft\Windows NT\CurrentVersion\FontLink
Microsoft\Windows NT\CurrentVersion\FontMapper
Microsoft\Windows NT\CurrentVersion\FontMapper
Microsoft\Windows NT\CurrentVersion\Fonts
Microsoft\Windows NT\CurrentVersion\Fonts
Microsoft\Windows NT\CurrentVersion\FontSubstitutes
Microsoft\Windows NT\CurrentVersion\FontSubstitutes
Microsoft\Windows NT\CurrentVersion\Gre_Initialize
Microsoft\Windows NT\CurrentVersion\Gre_Initialize
Microsoft\Windows NT\CurrentVersion\Image File Execution Options
Microsoft\Windows NT\CurrentVersion\Image File Execution Options
Microsoft\Windows NT\CurrentVersion\LanguagePack
Microsoft\Windows NT\CurrentVersion\LanguagePack
Microsoft\Windows NT\CurrentVersion\NetworkCards
Microsoft\Windows NT\CurrentVersion\NetworkCards
Microsoft\Windows NT\CurrentVersion\Perflib
Microsoft\Windows NT\CurrentVersion\Perflib
Microsoft\Windows NT\CurrentVersion\Ports
Microsoft\Windows NT\CurrentVersion\Ports
Microsoft\Windows NT\CurrentVersion\Print
Microsoft\Windows NT\CurrentVersion\Print
Microsoft\Windows NT\CurrentVersion\ProfileList
Microsoft\Windows NT\CurrentVersion\ProfileList
Microsoft\Windows NT\CurrentVersion\Time Zones
Microsoft\Windows NT\CurrentVersion\Time Zones
SearchFilterHost.exe_3104_rwx_00170000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680:
.text
.text
`.data
`.data
.rsrc
.rsrc
@.reloc
@.reloc
>.uzf
>.uzf
.us;}
.us;}
IEFRAME.dll
IEFRAME.dll
MLANG.dll
MLANG.dll
iertutil.dll
iertutil.dll
urlmon.dll
urlmon.dll
ole32.dll
ole32.dll
SHELL32.dll
SHELL32.dll
SHLWAPI.dll
SHLWAPI.dll
msvcrt.dll
msvcrt.dll
USER32.dll
USER32.dll
KERNEL32.dll
KERNEL32.dll
ADVAPI32.dll
ADVAPI32.dll
RegOpenKeyExW
RegOpenKeyExW
RegCloseKey
RegCloseKey
GetWindowsDirectoryW
GetWindowsDirectoryW
_amsg_exit
_amsg_exit
_wcmdln
_wcmdln
UrlApplySchemeW
UrlApplySchemeW
PathIsURLW
PathIsURLW
UrlCanonicalizeW
UrlCanonicalizeW
UrlCreateFromPathW
UrlCreateFromPathW
iexplore.pdb
iexplore.pdb
KEYW
KEYW
KEYWh
KEYWh
KEYWD
KEYWD
.ENNNG.
.ENNNG.
a.ry.v
a.ry.v
l.igM4
l.igM4
?1%SGf
?1%SGf
xh.JW^
xh.JW^
.97777"7" " " !
.97777"7" " " !
3.... ))
3.... ))
8888888888888
8888888888888
8888888888
8888888888
.lPV)
.lPV)
úW1
úW1
.ApX/
.ApX/
H.ZAf
H.ZAf
ð[U
ð[U
%s!FK
%s!FK
1YYYY1YY9GEAA=77YRNNNW:.VT1
1YYYY1YY9GEAA=77YRNNNW:.VT1
888777777
888777777
Y.hilkRROMLK=C,
Y.hilkRROMLK=C,
..(((($$
..(((($$
3...((((%
3...((((%
3....(.''$
3....(.''$
3.2...((((%
3.2...((((%
33.2....(,'
33.2....(,'
55323222...
55323222...
(%&'00443445?
(%&'00443445?
00.,,,4(
00.,,,4(
000.,,9(
000.,,9(
0020..9(
0020..9(
003200;(
003200;(
(#'( (''''!'!
(#'( (''''!'!
Microsoft.InternetExplorer.Default
Microsoft.InternetExplorer.Default
user32.dll
user32.dll
Kernel32.DLL
Kernel32.DLL
xfire.exe
xfire.exe
wlmail.exe
wlmail.exe
winamp.exe
winamp.exe
waol.exe
waol.exe
sidebar.exe
sidebar.exe
psocdesigner.exe
psocdesigner.exe
np.exe
np.exe
netscape.exe
netscape.exe
netcaptor.exe
netcaptor.exe
neoplanet.exe
neoplanet.exe
msn.exe
msn.exe
mshtmpad.exe
mshtmpad.exe
mshta.exe
mshta.exe
loader42.exe
loader42.exe
infopath.exe
infopath.exe
iexplore.exe
iexplore.exe
iepreview.exe
iepreview.exe
groove.exe
groove.exe
explorer.exe
explorer.exe
dreamweaver.exe
dreamweaver.exe
contribute.exe
contribute.exe
aol.exe
aol.exe
{28fb17e0-d393-439d-9a21-9474a070473a}
{28fb17e0-d393-439d-9a21-9474a070473a}
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
DShell32.dll
DShell32.dll
Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe
Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe
Software\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}
Software\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}
"%s" %s
"%s" %s
Kernel32.dll
Kernel32.dll
\AppPatch\sysmain.sdb
\AppPatch\sysmain.sdb
-extoff go.microsoft.com/fwlink/?LinkId=106323
-extoff go.microsoft.com/fwlink/?LinkId=106323
-extoff go.microsoft.com/fwlink/?LinkId=106322
-extoff go.microsoft.com/fwlink/?LinkId=106322
-extoff go.microsoft.com/fwlink/?LinkId=106320
-extoff go.microsoft.com/fwlink/?LinkId=106320
kernel32.dll
kernel32.dll
{00000000-0000-0000-0000-000000000000}
{00000000-0000-0000-0000-000000000000}
\\?\Volume
\\?\Volume
shell:%s
shell:%s
Imaging_CreateWebPagePreview_Perftrack
Imaging_CreateWebPagePreview_Perftrack
Browseui_Tabs_Tearoff_BetweenWindows
Browseui_Tabs_Tearoff_BetweenWindows
Frame_URLEntered
Frame_URLEntered
Imaging_CreateWebPagePreview
Imaging_CreateWebPagePreview
WS_ExecuteQuery
WS_ExecuteQuery
Shdocvw_BaseBrowser_FireEvent_WindowStateChanged
Shdocvw_BaseBrowser_FireEvent_WindowStateChanged
IdleTask_Execution_Time
IdleTask_Execution_Time
9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
IEXPLORE.EXE
IEXPLORE.EXE
Windows
Windows
9.00.8112.16421
9.00.8112.16421
SearchFilterHost.exe_3104_rwx_00400000_00001000:
kernel32.dll
kernel32.dll
SearchFilterHost.exe_3104_rwx_00560000_00001000:
kernel32.dll
kernel32.dll
SearchFilterHost.exe_3104_rwx_00730000_00001000:
kernel32.dll
kernel32.dll
SearchFilterHost.exe_3104_rwx_00770000_00001000:
kernel32.dll
kernel32.dll
SearchFilterHost.exe_3104_rwx_00830000_00001000:
kernel32.dll
kernel32.dll
SearchFilterHost.exe_3104_rwx_008B0000_00001000:
kernel32.dll
kernel32.dll
SearchFilterHost.exe_3104_rwx_00950000_00001000:
kernel32.dll
kernel32.dll
SearchFilterHost.exe_3104_rwx_00990000_00001000:
kernel32.dll
kernel32.dll
SearchFilterHost.exe_3104_rwx_00D60000_00001000:
kernel32.dll
kernel32.dll
SearchFilterHost.exe_3104_rwx_00DA0000_00001000:
kernel32.dll
kernel32.dll
SearchFilterHost.exe_3104_rwx_00DE0000_00001000:
kernel32.dll
kernel32.dll
SearchFilterHost.exe_3104_rwx_00E20000_00001000:
kernel32.dll
kernel32.dll
SearchFilterHost.exe_3104_rwx_00F60000_00001000:
kernel32.dll
kernel32.dll
SearchFilterHost.exe_3104_rwx_00FE0000_00001000:
kernel32.dll
kernel32.dll
SearchFilterHost.exe_3104_rwx_01020000_00001000:
kernel32.dll
kernel32.dll
SearchFilterHost.exe_3104_rwx_01060000_00001000:
kernel32.dll
kernel32.dll
SearchFilterHost.exe_3104_rwx_01160000_00001000:
kernel32.dll
kernel32.dll
SearchFilterHost.exe_3104_rwx_011D0000_00001000:
GetProcessHeap
GetProcessHeap
SearchFilterHost.exe_3104_rwx_011E0000_00001000:
kernel32.dll
kernel32.dll
SearchFilterHost.exe_3104_rwx_01210000_00001000:
oleaut32.dll
oleaut32.dll
SearchFilterHost.exe_3104_rwx_012D0000_00001000:
oleaut32.dll
oleaut32.dll
SearchFilterHost.exe_3104_rwx_01350000_00001000:
oleaut32.dll
oleaut32.dll
SearchFilterHost.exe_3104_rwx_01380000_00001000:
advapi32.dll
advapi32.dll
SearchFilterHost.exe_3104_rwx_01440000_00001000:
advapi32.dll
advapi32.dll
SearchFilterHost.exe_3104_rwx_014F0000_00001000:
RegOpenKeyExA
RegOpenKeyExA
SearchFilterHost.exe_3104_rwx_01540000_00001000:
advapi32.dll
advapi32.dll
SearchFilterHost.exe_3104_rwx_015B0000_00001000:
RegCloseKey
RegCloseKey
SearchFilterHost.exe_3104_rwx_015C0000_00001000:
advapi32.dll
advapi32.dll
SearchFilterHost.exe_3104_rwx_015F0000_00001000:
kernel32.dll
kernel32.dll
SearchFilterHost.exe_3104_rwx_01670000_00001000:
kernel32.dll
kernel32.dll
SearchFilterHost.exe_3104_rwx_016F0000_00001000:
kernel32.dll
kernel32.dll
SearchFilterHost.exe_3104_rwx_017B0000_00001000:
kernel32.dll
kernel32.dll
SearchFilterHost.exe_3104_rwx_01870000_00001000:
kernel32.dll
kernel32.dll
SearchFilterHost.exe_3104_rwx_018B0000_00001000:
kernel32.dll
kernel32.dll
SearchFilterHost.exe_3104_rwx_018F0000_00001000:
kernel32.dll
kernel32.dll
SearchFilterHost.exe_3104_rwx_01970000_00001000:
kernel32.dll
kernel32.dll
SearchFilterHost.exe_3104_rwx_019B0000_00001000:
kernel32.dll
kernel32.dll
SearchFilterHost.exe_3104_rwx_019F0000_00001000:
kernel32.dll
kernel32.dll
SearchFilterHost.exe_3104_rwx_01A70000_00001000:
kernel32.dll
kernel32.dll
SearchFilterHost.exe_3104_rwx_01AF0000_00001000:
kernel32.dll
kernel32.dll
SearchFilterHost.exe_3104_rwx_01B70000_00001000:
kernel32.dll
kernel32.dll
SearchFilterHost.exe_3104_rwx_01C30000_00001000:
kernel32.dll
kernel32.dll
SearchFilterHost.exe_3104_rwx_01D30000_00001000:
kernel32.dll
kernel32.dll
SearchFilterHost.exe_3104_rwx_01DF0000_00001000:
kernel32.dll
kernel32.dll
SearchFilterHost.exe_3104_rwx_01E70000_00001000:
kernel32.dll
kernel32.dll
SearchFilterHost.exe_3104_rwx_01EA0000_00001000:
ntdll.dll
ntdll.dll
SearchFilterHost.exe_3104_rwx_01F20000_00001000:
ntdll.dll
ntdll.dll
SearchFilterHost.exe_3104_rwx_31A20000_00009000:
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
kernel32.dll
Ntdll.dll
Ntdll.dll
NtEnumerateValueKey
NtEnumerateValueKey
NtEnumerateKey
NtEnumerateKey
advapi32.dll
advapi32.dll
GetProcessHeap
GetProcessHeap
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
ntdll.dll
ntdll.dll
KWindows
KWindows
iexplore.exe_5680_rwx_01291000_00001000:
Microsoft.InternetExplorer.Default
Microsoft.InternetExplorer.Default
user32.dll
user32.dll
iexplore.exe_5680_rwx_01836000_00001000:
1.6.0_18
1.6.0_18
jp2ssv.dll
jp2ssv.dll
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
HKEY_DYN_DATA
HKEY_DYN_DATA
HKEY_PERFORMANCE_DATA
HKEY_PERFORMANCE_DATA
HKEY_USERS
HKEY_USERS
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
%s\jp2iexp.dll
%s\jp2iexp.dll
{5852F5ED-8BF4-11D4-A245-0080C6F74284}
{5852F5ED-8BF4-11D4-A245-0080C6F74284}
jpishare.dll
jpishare.dll
NPOJI*.dll
NPOJI*.dll
NPJava*.dll
NPJava*.dll
NPJPI*.dll
NPJPI*.dll
{8AD9C840-044E-11D1-B3E9-00805F499D93}
{8AD9C840-044E-11D1-B3E9-00805F499D93}
{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBB}
{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBB}
%s\ssvagent.exe
%s\ssvagent.exe
-ABCDEFFEDCBA}
-ABCDEFFEDCBA}
%sd-d-d%s
%sd-d-d%s
-ABCDEFFEDCBB}
-ABCDEFFEDCBB}
-ABCDEFFEDCBC}
-ABCDEFFEDCBC}
%sd-d-FFFF%s
%sd-d-FFFF%s
.._d
.._d
..
..
{E19F9331-3110-11D4-991C-005004D3B3DB}
{E19F9331-3110-11D4-991C-005004D3B3DB}
SOFTWARE\Classes\CLSID\%s\InprocServer32
SOFTWARE\Classes\CLSID\%s\InprocServer32
Mozilla
Mozilla
Mozilla Firefox
Mozilla Firefox
mozilla.org
mozilla.org
%s00-d-d%s
%s00-d-d%s
1.3.0_02
1.3.0_02
.*
.*
%s_
%s_
shell32.dll
shell32.dll
iexplore.exe_5680_rwx_054D0000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680_rwx_05510000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680_rwx_05550000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680_rwx_05590000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680_rwx_055D0000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680_rwx_06170000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680_rwx_061B0000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680_rwx_062F0000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680_rwx_06330000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680_rwx_06380000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680_rwx_064C0000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680_rwx_06500000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680_rwx_06640000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680_rwx_06680000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680_rwx_066C0000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680_rwx_06FB0000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680_rwx_06FF0000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680_rwx_07130000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680_rwx_07160000_00001000:
GetProcessHeap
GetProcessHeap
iexplore.exe_5680_rwx_07170000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680_rwx_071A0000_00001000:
oleaut32.dll
oleaut32.dll
iexplore.exe_5680_rwx_073E0000_00001000:
oleaut32.dll
oleaut32.dll
iexplore.exe_5680_rwx_07520000_00001000:
oleaut32.dll
oleaut32.dll
iexplore.exe_5680_rwx_07550000_00001000:
advapi32.dll
advapi32.dll
iexplore.exe_5680_rwx_079D0000_00001000:
advapi32.dll
advapi32.dll
iexplore.exe_5680_rwx_08170000_00001000:
RegOpenKeyExA
RegOpenKeyExA
iexplore.exe_5680_rwx_08180000_00001000:
advapi32.dll
advapi32.dll
iexplore.exe_5680_rwx_081B0000_00001000:
RegCloseKey
RegCloseKey
iexplore.exe_5680_rwx_083C0000_00001000:
advapi32.dll
advapi32.dll
iexplore.exe_5680_rwx_085F0000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680_rwx_08730000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680_rwx_08770000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680_rwx_087B0000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680_rwx_08F00000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680_rwx_09040000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680_rwx_09580000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680_rwx_095C0000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680_rwx_09600000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680_rwx_09640000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680_rwx_09680000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680_rwx_097C0000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680_rwx_09800000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680_rwx_09940000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680_rwx_09980000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680_rwx_09BC0000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680_rwx_09C00000_00001000:
kernel32.dll
kernel32.dll
iexplore.exe_5680_rwx_09C30000_00001000:
ntdll.dll
ntdll.dll
iexplore.exe_5680_rwx_09C70000_00001000:
ntdll.dll
ntdll.dll
iexplore.exe_5680_rwx_31A30000_00009000:
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
kernel32.dll
Ntdll.dll
Ntdll.dll
NtEnumerateValueKey
NtEnumerateValueKey
NtEnumerateKey
NtEnumerateKey
advapi32.dll
advapi32.dll
GetProcessHeap
GetProcessHeap
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
ntdll.dll
ntdll.dll
KWindows
KWindows
iexplore.exe_5680_rwx_69331000_00001000:
[Jw.cRw
[Jw.cRw
iexplore.exe_5680_rwx_6AE31000_00001000:
d3d10d.dll
d3d10d.dll
id3d10ref.dll
id3d10ref.dll
d3d10core.dll
d3d10core.dll
d3d10warp.dll
d3d10warp.dll
The application was compiled against and will only work with D3D10_SDK_VERSION (%d), but the currently installed runtime is version (%d).
The application was compiled against and will only work with D3D10_SDK_VERSION (%d), but the currently installed runtime is version (%d).
#pragma ruledisable 0xx
#pragma ruledisable 0xx
#pragma warning (disable:%d)
#pragma warning (disable:%d)
#pragma warning (error:%d)
#pragma warning (error:%d)
#pragma warning (once:%d)
#pragma warning (once:%d)
#pragma def (%s, %s, %g, %g, %g, %g)
#pragma def (%s, %s, %g, %g, %g, %g)
D3D10PreprocessShader
D3D10PreprocessShader
duplicate attribute %s
duplicate attribute %s
unknown attribute %s, or attribute invalid for this statement
unknown attribute %s, or attribute invalid for this statement
internal error: argument missing context (A%u)
internal error: argument missing context (A%u)
?internal error: operand type mismatch
?internal error: operand type mismatch
invalid register specification, expected '%c' binding
invalid register specification, expected '%c' binding
user defined %s buffers cannot be target specific
user defined %s buffers cannot be target specific
Duplicated input semantics can't change type, size, or layout ('%s').
Duplicated input semantics can't change type, size, or layout ('%s').
array dimension for %s must be %i
array dimension for %s must be %i
register or offset bind %s.%s not valid
register or offset bind %s.%s not valid
Cannot map loop to shader target, target does not support breaks
Cannot map loop to shader target, target does not support breaks
Loop only executes for %d iteration(s), forcing loop to unroll
Loop only executes for %d iteration(s), forcing loop to unroll
Unable to unroll loop, loop does not appear to terminate in a timely manner (%d iteratio
Unable to unroll loop, loop does not appear to terminate in a timely manner (%d iteratio
iexplore.exe_5680_rwx_6AF41000_00001000:
JSCRIPT9.dll
JSCRIPT9.dll
iexplore.exe_5680_rwx_6B101000_00001000:
kInvalid parameter passed to C runtime function.
kInvalid parameter passed to C runtime function.
iexplore.exe_5680_rwx_6D194000_00001000:
mscoree.dll
mscoree.dll
Please contact the application's support team for more information.
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
GetSystemWindowsDirectoryW
GetSystemWindowsDirectoryW
PGORT80.dll
PGORT80.dll
MSCoree.dll
MSCoree.dll
kernel32.dll
kernel32.dll
.mixcrt
.mixcrt
KERNEL32.DLL
KERNEL32.DLL
msvcrt.dll
msvcrt.dll
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
ADVAPI32.DLL
ADVAPI32.DLL
GetProcessWindowStation
GetProcessWindowStation
USER32.DLL
USER32.DLL
setnewh.cpp
setnewh.cpp
Microsoft.VC80.CRT.manifest
Microsoft.VC80.CRT.manifest
msvcr80.dll
msvcr80.dll
iexplore.exe_5680_rwx_6D1D1000_00001000:
'i' is only supported with debug builds.
'i' is only supported with debug builds.
*** %s%ls%sSource: `%ls:%ld`
*** %s%ls%sSource: `%ls:%ld`
vsStageData.Color = Diffuse;
vsStageData.Color = Diffuse;
vsStageData.UV = UV;
vsStageData.UV = UV;
float2 inputUV = vsStageData.UV;
float2 inputUV = vsStageData.UV;
vsStageData.UV.x = inputUV.x*mat3x2TextureTransform0[0] inputUV.y*mat3x2TextureTransform0[1] mat3x2TextureTransform0[2];
vsStageData.UV.x = inputUV.x*mat3x2TextureTransform0[0] inputUV.y*mat3x2TextureTransform0[1] mat3x2TextureTransform0[2];
vsStageData.UV.y = inputUV.x*mat3x2TextureTransform1[0] inputUV.y*mat3x2TextureTransform1[1] mat3x2TextureTransform1[2];
vsStageData.UV.y = inputUV.x*mat3x2TextureTransform1[0] inputUV.y*mat3x2TextureTransform1[1] mat3x2TextureTransform1[2];
vsStageData.Color = Color;
vsStageData.Color = Color;
BlendColor = vsStageData.Color;
BlendColor = vsStageData.Color;
Diffuse = vsStageData.Color;
Diffuse = vsStageData.Color;
uv = vsStageData.UV;
uv = vsStageData.UV;
halfTexelSizeNormalized_and_vCoord = Data_halfTexelSizeNormalized_and_vCoord;
halfTexelSizeNormalized_and_vCoord = Data_halfTexelSizeNormalized_and_vCoord;
halfTexelSizeNormalized_and_vCoord_and_gradientSpanNormalized = Data_halfTexelSizeNormalized_and_vCoord_and_gradientSpanNormalized;
halfTexelSizeNormalized_and_vCoord_and_gradientSpanNormalized = Data_halfTexelSizeNormalized_and_vCoord_and_gradientSpanNormalized;
gradOrigin_and_firstTexelRegionCenter = Data_gradOrigin_and_firstTexelRegionCenter;
gradOrigin_and_firstTexelRegionCenter = Data_gradOrigin_and_firstTexelRegionCenter;
USERProcessHandleQuota
USERProcessHandleQuota
GDIProcessHandleQuota
GDIProcessHandleQuota
kernel32.dll
kernel32.dll
Software\Microsoft\Avalon.Graphics
Software\Microsoft\Avalon.Graphics
d:\win7sp1_gdr\windows\wgi\shared\util\utillib\debugbreak.cpp
d:\win7sp1_gdr\windows\wgi\shared\util\utillib\debugbreak.cpp
iexplore.exe_5680_rwx_6D441000_00001000:
DmD3D10Level9 Error x: (%d@%d) %s
DmD3D10Level9 Error x: (%d@%d) %s
gdi32.dll
gdi32.dll
D3D9 DDI returned %s. Insulating d3d9 driver from further calls...
D3D9 DDI returned %s. Insulating d3d9 driver from further calls...
D3D9 DDI Failed - not reporting (via callback) and returning S_OK
D3D9 DDI Failed - not reporting (via callback) and returning S_OK
D3D9 DDI Failed - not reporting (via callback) and returning E_FAIL
D3D9 DDI Failed - not reporting (via callback) and returning E_FAIL
D3D9 DDI Failed - reporting to runtime (via callback), but ignoring result
D3D9 DDI Failed - reporting to runtime (via callback), but ignoring result
D3D9 DDI Failed following a device removed. Reporting D3DDDIERR_DEVICEREMOVED to runtime and insulating d3d9 driver from further calls.
D3D9 DDI Failed following a device removed. Reporting D3DDDIERR_DEVICEREMOVED to runtime and insulating d3d9 driver from further calls.
UMD DLL %S didn't export OpenAdapter
UMD DLL %S didn't export OpenAdapter
UMD DLL %S could not be loaded
UMD DLL %S could not be loaded
D3DKMTReleaseKeyedMutex
D3DKMTReleaseKeyedMutex
D3DKMTAcquireKeyedMutex
D3DKMTAcquireKeyedMutex
D3DKMTDestroyKeyedMutex
D3DKMTDestroyKeyedMutex
D3DKMTOpenKeyedMutex
D3DKMTOpenKeyedMutex
D3DKMTCreateKeyedMutex
D3DKMTCreateKeyedMutex
10on9 version mismatch, refusing to load driver. 10on9 will work with APIs that use version (== %u, >= %u); but the current APIs use version (%u, %u).
10on9 version mismatch, refusing to load driver. 10on9 will work with APIs that use version (== %u, >= %u); but the current APIs use version (%u, %u).
iexplore.exe_5680_rwx_6E8A1000_00001000:
IEShims.dll
IEShims.dll
GetProcAddressShim
GetProcAddressShim
AcrobatSetWindowsHook
AcrobatSetWindowsHook
msconfig.exe_5688_rwx_000D0000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688_rwx_00210000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688_rwx_00250000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688_rwx_002A0000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688_rwx_002E0000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688_rwx_00400000_000B1000:
`.rsrc
`.rsrc
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
####@####
####@####
kernel32.dll
kernel32.dll
VBoxService.exe
VBoxService.exe
SbieDll.dll
SbieDll.dll
dbghelp.dll
dbghelp.dll
Software\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion
55274-640-2673064-23950
55274-640-2673064-23950
76487-644-3177037-23510
76487-644-3177037-23510
76487-337-8429955-22614
76487-337-8429955-22614
\\.\Syser
\\.\Syser
\\.\SyserDbgMsg
\\.\SyserDbgMsg
\\.\SyserBoot
\\.\SyserBoot
\\.\SICE
\\.\SICE
\\.\NTICE
\\.\NTICE
ShellExecuteA
ShellExecuteA
shell32.dll
shell32.dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
GetWindowsDirectoryA
GetWindowsDirectoryA
SOFTWARE\Microsoft\Windows\CurrentVersion
SOFTWARE\Microsoft\Windows\CurrentVersion
http\shell\open\command
http\shell\open\command
\Internet Explorer\iexplore.exe
\Internet Explorer\iexplore.exe
PSAPI.dll
PSAPI.dll
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
Microsoft\Network\Connections\pbk\rasphone.pbk
Microsoft\Network\Connections\pbk\rasphone.pbk
rasapi32.dll
rasapi32.dll
rnaph.dll
rnaph.dll
RAS Passwords |
RAS Passwords |
uURLHistory
uURLHistory
Password:
Password:
abe2869f-9b47-4cd9-a358-c22904dba7f7
abe2869f-9b47-4cd9-a358-c22904dba7f7
Password
Password
UnitPasswords
UnitPasswords
advapi32.dll
advapi32.dll
WindowsLive:name=*
WindowsLive:name=*
xxxyyyzzz.dat
xxxyyyzzz.dat
\Mozilla Firefox\
\Mozilla Firefox\
mozcrt19.dll
mozcrt19.dll
sqlite3.dll
sqlite3.dll
nspr4.dll
nspr4.dll
plc4.dll
plc4.dll
plds4.dll
plds4.dll
nssutil3.dll
nssutil3.dll
softokn3.dll
softokn3.dll
nss3.dll
nss3.dll
PK11_GetInternalKeySlot
PK11_GetInternalKeySlot
userenv.dll
userenv.dll
\Mozilla\Firefox\
\Mozilla\Firefox\
profiles.ini
profiles.ini
\signons3.txt
\signons3.txt
\signons2.txt
\signons2.txt
\signons1.txt
\signons1.txt
\signons.txt
\signons.txt
(unnamed password)
(unnamed password)
explorer.exe
explorer.exe
_x_X_PASSWORDLIST_X_x_
_x_X_PASSWORDLIST_X_x_
NOIP.abc
NOIP.abc
MSN.abc
MSN.abc
FIREFOX.abc
FIREFOX.abc
IELOGIN.abc
IELOGIN.abc
IEPASS.abc
IEPASS.abc
IEAUTO.abc
IEAUTO.abc
IEWEB.abc
IEWEB.abc
XX--XX--XX.txt
XX--XX--XX.txt
?456789:;
?456789:;
!"#$%&'()* ,-./0123
!"#$%&'()* ,-./0123
KWindows
KWindows
KuURLHistory
KuURLHistory
IEpasswords
IEpasswords
####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@####
####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@####
####@#### ####@####
####@#### ####@####
####@#### ####@#### ####@#### ####@####
####@#### ####@#### ####@#### ####@####
T%XCC1
T%XCC1
w}-cL}
w}-cL}
XhDq.Tu
XhDq.Tu
.Iu|$p
.Iu|$p
1dH0z.MNJ2
1dH0z.MNJ2
!id%9X%
!id%9X%
kp.vK
kp.vK
.ClT(8
.ClT(8
'.WH*
'.WH*
@.sp&
@.sp&
%XAWW
%XAWW
m.Pm=
m.Pm=
pn.Kqz!
pn.Kqz!
h%X:y
h%X:y
LH.dbL-.
LH.dbL-.
%D=\ptu
%D=\ptu
*v.Cw
*v.Cw
geV%FZq
geV%FZq
%c)*L9
%c)*L9
t`.Ju
t`.Ju
uT.dCC7
uT.dCC7
TRÃŒU
TRÃŒU
TuÃŒU
TuÃŒU
ÃŒUZ
ÃŒUZ
ÃŒU}
ÃŒU}
T_Ì
T_Ì
T%Ì
T%Ì
TB.CCU6
TB.CCU6
Te.CCU
Te.CCU
T3.CCU
T3.CCU
.CCUJ
.CCUJ
.CCUm
.CCUm
TO.CC
TO.CC
Tr.CC
Tr.CC
T8.CC
T8.CC
7o.TW
7o.TW
7o.Tq
7o.Tq
T.CCC7d7
T.CCC7d7
T.FCC8|
T.FCC8|
T.ICC
T.ICC
T.GCC
T.GCC
@T.HAC
@T.HAC
TB.AC
TB.AC
TS.AC
TS.AC
T\.AC
T\.AC
Tm.AC
Tm.AC
T~.AC
T~.AC
TX.AC{
TX.AC{
T%S@CC
T%S@CC
T%X@C
T%X@C
T.SCC79
T.SCC79
|T.DCC1
|T.DCC1
D.TbGCC5
D.TbGCC5
GetProcessHeap
GetProcessHeap
RegOpenKeyExA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteKeyA
RegCreateKeyExA
RegCreateKeyExA
RegCreateKeyA
RegCreateKeyA
RegCloseKey
RegCloseKey
SetWindowsHookExA
SetWindowsHookExA
GetKeyboardState
GetKeyboardState
.idata
.idata
.rdata
.rdata
P.reloc
P.reloc
P.rsrc
P.rsrc
KERNEL32.DLL
KERNEL32.DLL
crypt32.dll
crypt32.dll
ole32.dll
ole32.dll
oleaut32.dll
oleaut32.dll
pstorec.dll
pstorec.dll
user32.dll
user32.dll
msconfig.exe_5688_rwx_012C0000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688_rwx_01300000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688_rwx_01340000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688_rwx_01380000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688_rwx_013C0000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688_rwx_01400000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688_rwx_01440000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688_rwx_01480000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688_rwx_014C0000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688_rwx_01500000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688_rwx_01540000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688_rwx_01580000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688_rwx_015C0000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688_rwx_015F0000_00001000:
GetProcessHeap
GetProcessHeap
msconfig.exe_5688_rwx_01600000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688_rwx_01630000_00001000:
oleaut32.dll
oleaut32.dll
msconfig.exe_5688_rwx_01670000_00001000:
oleaut32.dll
oleaut32.dll
msconfig.exe_5688_rwx_016B0000_00001000:
oleaut32.dll
oleaut32.dll
msconfig.exe_5688_rwx_016E0000_00001000:
advapi32.dll
advapi32.dll
msconfig.exe_5688_rwx_01720000_00001000:
advapi32.dll
advapi32.dll
msconfig.exe_5688_rwx_01750000_00001000:
RegOpenKeyExA
RegOpenKeyExA
msconfig.exe_5688_rwx_01760000_00001000:
advapi32.dll
advapi32.dll
msconfig.exe_5688_rwx_01790000_00001000:
RegCloseKey
RegCloseKey
msconfig.exe_5688_rwx_017A0000_00001000:
advapi32.dll
advapi32.dll
msconfig.exe_5688_rwx_017D0000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688_rwx_01810000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688_rwx_01850000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688_rwx_01890000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688_rwx_018D0000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688_rwx_01910000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688_rwx_01950000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688_rwx_01990000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688_rwx_019D0000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688_rwx_01A10000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688_rwx_01A50000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688_rwx_01A90000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688_rwx_01AD0000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688_rwx_01B10000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688_rwx_01B50000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688_rwx_01B90000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688_rwx_01BD0000_00001000:
kernel32.dll
kernel32.dll
msconfig.exe_5688_rwx_01C00000_00001000:
ntdll.dll
ntdll.dll
msconfig.exe_5688_rwx_01C40000_00001000:
ntdll.dll
ntdll.dll
msconfig.exe_5688_rwx_31A40000_00009000:
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
kernel32.dll
Ntdll.dll
Ntdll.dll
NtEnumerateValueKey
NtEnumerateValueKey
NtEnumerateKey
NtEnumerateKey
advapi32.dll
advapi32.dll
GetProcessHeap
GetProcessHeap
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
ntdll.dll
ntdll.dll
KWindows
KWindows
taskhost.exe_252_rwx_01110000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_252_rwx_01200000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_252_rwx_01280000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_252_rwx_012F0000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_252_rwx_01390000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_252_rwx_01410000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_252_rwx_01510000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_252_rwx_01590000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_252_rwx_019A0000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_252_rwx_01EE0000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_252_rwx_01EF0000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_252_rwx_01F30000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_252_rwx_01F70000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_252_rwx_01FB0000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_252_rwx_01FF0000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_252_rwx_02030000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_252_rwx_020B0000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_252_rwx_020F0000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_252_rwx_02130000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_252_rwx_02170000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_252_rwx_021B0000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_252_rwx_021E0000_00001000:
GetProcessHeap
GetProcessHeap
taskhost.exe_252_rwx_021F0000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_252_rwx_02220000_00001000:
oleaut32.dll
oleaut32.dll
taskhost.exe_252_rwx_02260000_00001000:
oleaut32.dll
oleaut32.dll
taskhost.exe_252_rwx_022A0000_00001000:
oleaut32.dll
oleaut32.dll
taskhost.exe_252_rwx_022D0000_00001000:
advapi32.dll
advapi32.dll
taskhost.exe_252_rwx_02350000_00001000:
advapi32.dll
advapi32.dll
taskhost.exe_252_rwx_02380000_00001000:
RegOpenKeyExA
RegOpenKeyExA
taskhost.exe_252_rwx_02390000_00001000:
advapi32.dll
advapi32.dll
taskhost.exe_252_rwx_023C0000_00001000:
RegCloseKey
RegCloseKey
taskhost.exe_252_rwx_023D0000_00001000:
advapi32.dll
advapi32.dll
taskhost.exe_252_rwx_02400000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_252_rwx_02440000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_252_rwx_024C0000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_252_rwx_02500000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_252_rwx_02540000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_252_rwx_02580000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_252_rwx_025C0000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_252_rwx_02600000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_252_rwx_02640000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_252_rwx_026C0000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_252_rwx_02700000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_252_rwx_02740000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_252_rwx_027A0000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_252_rwx_027E0000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_252_rwx_02810000_00001000:
ntdll.dll
ntdll.dll
taskhost.exe_252_rwx_02850000_00001000:
ntdll.dll
ntdll.dll
taskhost.exe_252_rwx_318B0000_00009000:
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
kernel32.dll
Ntdll.dll
Ntdll.dll
NtEnumerateValueKey
NtEnumerateValueKey
NtEnumerateKey
NtEnumerateKey
advapi32.dll
advapi32.dll
GetProcessHeap
GetProcessHeap
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
ntdll.dll
ntdll.dll
KWindows
KWindows
Explorer.EXE_284_rwx_00B10000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_02CD0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_039E0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_03A30000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_03AC0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_03BA0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_03C60000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_03CE0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_04510000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_04590000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_04630000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_04700000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_04780000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_047C0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_04800000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_048D0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_04950000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_04990000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_04A10000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_04A50000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_04B10000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_04BD0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_04C10000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_04C50000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_04C90000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_04D10000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_04D50000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_04DD0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_04E10000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_04E50000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_04E90000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_04ED0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_04F10000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_04F50000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_04F90000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_05010000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_05050000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_05090000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_050D0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_05110000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_05150000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_05190000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_05210000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_074B0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_074F0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_07520000_00001000:
GetProcessHeap
GetProcessHeap
Explorer.EXE_284_rwx_07530000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_08900000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_08940000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_08980000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_089B0000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_284_rwx_089F0000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_284_rwx_08A20000_00001000:
RegOpenKeyExA
RegOpenKeyExA
Explorer.EXE_284_rwx_08A70000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_284_rwx_08AA0000_00001000:
RegCloseKey
RegCloseKey
Explorer.EXE_284_rwx_08AB0000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_284_rwx_08AE0000_00001000:
oleaut32.dll
oleaut32.dll
Explorer.EXE_284_rwx_08B60000_00001000:
oleaut32.dll
oleaut32.dll
Explorer.EXE_284_rwx_08BA0000_00001000:
oleaut32.dll
oleaut32.dll
Explorer.EXE_284_rwx_08BE0000_00001000:
oleaut32.dll
oleaut32.dll
Explorer.EXE_284_rwx_08C10000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_284_rwx_08C50000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_284_rwx_08C90000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_284_rwx_08CC0000_00001000:
RegOpenKeyExA
RegOpenKeyExA
Explorer.EXE_284_rwx_08CD0000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_284_rwx_08D80000_00001000:
RegOpenKeyA
RegOpenKeyA
Explorer.EXE_284_rwx_08D90000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_284_rwx_08DD0000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_284_rwx_08E00000_00001000:
RegEnumKeyExA
RegEnumKeyExA
Explorer.EXE_284_rwx_08E10000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_284_rwx_08E50000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_284_rwx_08E80000_00001000:
RegDeleteKeyA
RegDeleteKeyA
Explorer.EXE_284_rwx_08E90000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_284_rwx_08EC0000_00001000:
RegCreateKeyA
RegCreateKeyA
Explorer.EXE_284_rwx_08ED0000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_284_rwx_08F00000_00001000:
RegCloseKey
RegCloseKey
Explorer.EXE_284_rwx_08F10000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_284_rwx_08F50000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_284_rwx_08F90000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_284_rwx_08FD0000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_284_rwx_09010000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_284_rwx_09040000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_090C0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09100000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09140000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09180000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_091B0000_00001000:
WinExec
WinExec
Explorer.EXE_284_rwx_091C0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09200000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09240000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09280000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_092C0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09300000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09340000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09380000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_093C0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09400000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09440000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09480000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_094C0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09500000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09530000_00001000:
SetNamedPipeHandleState
SetNamedPipeHandleState
Explorer.EXE_284_rwx_09540000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09580000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_095C0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09600000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09640000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09680000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_096C0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09700000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09740000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09780000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_097C0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09800000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09840000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09880000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_098C0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09900000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09940000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09980000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_099C0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09A00000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09A40000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09A80000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09AC0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09B00000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09B40000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09B80000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09BC0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09C00000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09C40000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09C80000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09CC0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09D00000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09D30000_00001000:
GetProcessHeap
GetProcessHeap
Explorer.EXE_284_rwx_09D40000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09D80000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09DC0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09E00000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09E40000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09E80000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09EC0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09F00000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09F40000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09F80000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_09FC0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0A000000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0A040000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0A080000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0A0C0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0A100000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0A140000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0A180000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0A1C0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0A200000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0A240000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0A280000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0A2C0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0A300000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0A340000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0A380000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0A3C0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0A3F0000_00001000:
CreatePipe
CreatePipe
Explorer.EXE_284_rwx_0A400000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0A440000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0A480000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0A4C0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0A500000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0A540000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0A570000_00001000:
mpr.dll
mpr.dll
Explorer.EXE_284_rwx_0A5F0000_00001000:
mpr.dll
mpr.dll
Explorer.EXE_284_rwx_0A630000_00001000:
mpr.dll
mpr.dll
Explorer.EXE_284_rwx_0A670000_00001000:
mpr.dll
mpr.dll
Explorer.EXE_284_rwx_0A6A0000_00001000:
gdi32.dll
gdi32.dll
Explorer.EXE_284_rwx_0A6E0000_00001000:
gdi32.dll
gdi32.dll
Explorer.EXE_284_rwx_0A720000_00001000:
gdi32.dll
gdi32.dll
Explorer.EXE_284_rwx_0A760000_00001000:
gdi32.dll
gdi32.dll
Explorer.EXE_284_rwx_0A7A0000_00001000:
gdi32.dll
gdi32.dll
Explorer.EXE_284_rwx_0A7E0000_00001000:
gdi32.dll
gdi32.dll
Explorer.EXE_284_rwx_0A820000_00001000:
gdi32.dll
gdi32.dll
Explorer.EXE_284_rwx_0A8A0000_00001000:
gdi32.dll
gdi32.dll
Explorer.EXE_284_rwx_0A8E0000_00001000:
gdi32.dll
gdi32.dll
Explorer.EXE_284_rwx_0A920000_00001000:
gdi32.dll
gdi32.dll
Explorer.EXE_284_rwx_0A960000_00001000:
gdi32.dll
gdi32.dll
Explorer.EXE_284_rwx_0A9A0000_00001000:
gdi32.dll
gdi32.dll
Explorer.EXE_284_rwx_0A9E0000_00001000:
gdi32.dll
gdi32.dll
Explorer.EXE_284_rwx_0AA20000_00001000:
gdi32.dll
gdi32.dll
Explorer.EXE_284_rwx_0AA50000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0AA90000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0AAD0000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0AB10000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0AB40000_00001000:
keybd_event
keybd_event
Explorer.EXE_284_rwx_0AB50000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0ABD0000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0AC10000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0AC50000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0AC90000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0ACD0000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0AD10000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0AD50000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0AD90000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0ADD0000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0AE10000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0AE50000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0AE90000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0AED0000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0AF10000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0AF50000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0AF90000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0AFD0000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B010000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B050000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B090000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B0D0000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B110000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B140000_00001000:
MapVirtualKeyA
MapVirtualKeyA
Explorer.EXE_284_rwx_0B150000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B190000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B1D0000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B210000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B250000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B290000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B2D0000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B310000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B350000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B390000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B3D0000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B410000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B450000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B490000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B4D0000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B510000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B550000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B590000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B5C0000_00001000:
GetKeyboardState
GetKeyboardState
Explorer.EXE_284_rwx_0B5D0000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B600000_00001000:
GetKeyboardLayoutNameA
GetKeyboardLayoutNameA
Explorer.EXE_284_rwx_0B610000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B640000_00001000:
GetKeyState
GetKeyState
Explorer.EXE_284_rwx_0B650000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B690000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B6D0000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B710000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B750000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B790000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B7D0000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B810000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B840000_00001000:
GetAsyncKeyState
GetAsyncKeyState
Explorer.EXE_284_rwx_0B850000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B890000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B8D0000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B910000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B940000_00001000:
ExitWindowsEx
ExitWindowsEx
Explorer.EXE_284_rwx_0B950000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B980000_00001000:
EnumWindows
EnumWindows
Explorer.EXE_284_rwx_0B990000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0B9D0000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0BA10000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0BA50000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0BA90000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0BAD0000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0BB10000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0BB50000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0BB90000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0BBD0000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0BC10000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0BC50000_00001000:
user32.dll
user32.dll
Explorer.EXE_284_rwx_0BC80000_00001000:
ntdll.dll
ntdll.dll
Explorer.EXE_284_rwx_0BCC0000_00001000:
ntdll.dll
ntdll.dll
Explorer.EXE_284_rwx_0BD00000_00001000:
ntdll.dll
ntdll.dll
Explorer.EXE_284_rwx_0BD30000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0BD70000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0BDA0000_00001000:
wininet.dll
wininet.dll
Explorer.EXE_284_rwx_0BE20000_00001000:
wininet.dll
wininet.dll
Explorer.EXE_284_rwx_0BEE0000_00001000:
wininet.dll
wininet.dll
Explorer.EXE_284_rwx_0BF20000_00001000:
wininet.dll
wininet.dll
Explorer.EXE_284_rwx_0BF50000_00001000:
wininet.dll
wininet.dll
Explorer.EXE_284_rwx_0BF80000_00001000:
FtpGetFileSize
FtpGetFileSize
Explorer.EXE_284_rwx_0BF90000_00001000:
wininet.dll
wininet.dll
Explorer.EXE_284_rwx_0BFC0000_00001000:
FtpSetCurrentDirectoryA
FtpSetCurrentDirectoryA
Explorer.EXE_284_rwx_0BFD0000_00001000:
wininet.dll
wininet.dll
Explorer.EXE_284_rwx_0C000000_00001000:
FtpOpenFileA
FtpOpenFileA
Explorer.EXE_284_rwx_0C010000_00001000:
wininet.dll
wininet.dll
Explorer.EXE_284_rwx_0C040000_00001000:
wsock32.dll
wsock32.dll
Explorer.EXE_284_rwx_0C080000_00001000:
wsock32.dll
wsock32.dll
Explorer.EXE_284_rwx_0C0C0000_00001000:
wsock32.dll
wsock32.dll
Explorer.EXE_284_rwx_0C100000_00001000:
wsock32.dll
wsock32.dll
Explorer.EXE_284_rwx_0C140000_00001000:
wsock32.dll
wsock32.dll
Explorer.EXE_284_rwx_0C1C0000_00001000:
wsock32.dll
wsock32.dll
Explorer.EXE_284_rwx_0C200000_00001000:
wsock32.dll
wsock32.dll
Explorer.EXE_284_rwx_0C240000_00001000:
wsock32.dll
wsock32.dll
Explorer.EXE_284_rwx_0C280000_00001000:
wsock32.dll
wsock32.dll
Explorer.EXE_284_rwx_0C2C0000_00001000:
wsock32.dll
wsock32.dll
Explorer.EXE_284_rwx_0C300000_00001000:
wsock32.dll
wsock32.dll
Explorer.EXE_284_rwx_0C340000_00001000:
wsock32.dll
wsock32.dll
Explorer.EXE_284_rwx_0C380000_00001000:
wsock32.dll
wsock32.dll
Explorer.EXE_284_rwx_0C3C0000_00001000:
wsock32.dll
wsock32.dll
Explorer.EXE_284_rwx_0C400000_00001000:
wsock32.dll
wsock32.dll
Explorer.EXE_284_rwx_0C440000_00001000:
wsock32.dll
wsock32.dll
Explorer.EXE_284_rwx_0C480000_00001000:
wsock32.dll
wsock32.dll
Explorer.EXE_284_rwx_0C4C0000_00001000:
wsock32.dll
wsock32.dll
Explorer.EXE_284_rwx_0C500000_00001000:
wsock32.dll
wsock32.dll
Explorer.EXE_284_rwx_0C540000_00001000:
wsock32.dll
wsock32.dll
Explorer.EXE_284_rwx_0C570000_00001000:
ole32.dll
ole32.dll
Explorer.EXE_284_rwx_0C5B0000_00001000:
ole32.dll
ole32.dll
Explorer.EXE_284_rwx_0C5F0000_00001000:
ole32.dll
ole32.dll
Explorer.EXE_284_rwx_0C620000_00001000:
ole32.dll
ole32.dll
Explorer.EXE_284_rwx_0C660000_00001000:
ole32.dll
ole32.dll
Explorer.EXE_284_rwx_0C6E0000_00001000:
ole32.dll
ole32.dll
Explorer.EXE_284_rwx_0C720000_00001000:
ole32.dll
ole32.dll
Explorer.EXE_284_rwx_0C750000_00001000:
gdiplus.dll
gdiplus.dll
Explorer.EXE_284_rwx_0C7D0000_00001000:
gdiplus.dll
gdiplus.dll
Explorer.EXE_284_rwx_0C810000_00001000:
gdiplus.dll
gdiplus.dll
Explorer.EXE_284_rwx_0C850000_00001000:
gdiplus.dll
gdiplus.dll
Explorer.EXE_284_rwx_0C8D0000_00001000:
gdiplus.dll
gdiplus.dll
Explorer.EXE_284_rwx_0C910000_00001000:
gdiplus.dll
gdiplus.dll
Explorer.EXE_284_rwx_0C950000_00001000:
gdiplus.dll
gdiplus.dll
Explorer.EXE_284_rwx_0C990000_00001000:
gdiplus.dll
gdiplus.dll
Explorer.EXE_284_rwx_0C9D0000_00001000:
gdiplus.dll
gdiplus.dll
Explorer.EXE_284_rwx_0CA10000_00001000:
gdiplus.dll
gdiplus.dll
Explorer.EXE_284_rwx_0CA50000_00001000:
gdiplus.dll
gdiplus.dll
Explorer.EXE_284_rwx_0CA90000_00001000:
gdiplus.dll
gdiplus.dll
Explorer.EXE_284_rwx_0CAD0000_00001000:
gdiplus.dll
gdiplus.dll
Explorer.EXE_284_rwx_0CB10000_00001000:
gdiplus.dll
gdiplus.dll
Explorer.EXE_284_rwx_0CB50000_00001000:
gdiplus.dll
gdiplus.dll
Explorer.EXE_284_rwx_0CB80000_00001000:
GdiplusShutdown
GdiplusShutdown
Explorer.EXE_284_rwx_0CB90000_00001000:
gdiplus.dll
gdiplus.dll
Explorer.EXE_284_rwx_0CBD0000_00001000:
gdiplus.dll
gdiplus.dll
Explorer.EXE_284_rwx_0CC10000_00001000:
gdiplus.dll
gdiplus.dll
Explorer.EXE_284_rwx_0CC50000_00001000:
gdiplus.dll
gdiplus.dll
Explorer.EXE_284_rwx_0CC80000_00001000:
AVICAP32.DLL
AVICAP32.DLL
Explorer.EXE_284_rwx_0CCC0000_00001000:
AVICAP32.DLL
AVICAP32.DLL
Explorer.EXE_284_rwx_0CD10000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_284_rwx_0CD50000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_284_rwx_0CD90000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_284_rwx_0CDD0000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_284_rwx_0CE10000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_284_rwx_0CE90000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_284_rwx_0CED0000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_284_rwx_0CF10000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_284_rwx_0CF90000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_284_rwx_0CFD0000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_284_rwx_0D000000_00001000:
shell32.dll
shell32.dll
Explorer.EXE_284_rwx_0D040000_00001000:
shell32.dll
shell32.dll
Explorer.EXE_284_rwx_0D080000_00001000:
shell32.dll
shell32.dll
Explorer.EXE_284_rwx_0D0B0000_00001000:
winmm.dll
winmm.dll
Explorer.EXE_284_rwx_0D0F0000_00001000:
winmm.dll
winmm.dll
Explorer.EXE_284_rwx_0D130000_00001000:
winmm.dll
winmm.dll
Explorer.EXE_284_rwx_0D1B0000_00001000:
winmm.dll
winmm.dll
Explorer.EXE_284_rwx_0D1F0000_00001000:
winmm.dll
winmm.dll
Explorer.EXE_284_rwx_0D270000_00001000:
winmm.dll
winmm.dll
Explorer.EXE_284_rwx_0D2B0000_00001000:
winmm.dll
winmm.dll
Explorer.EXE_284_rwx_0D2F0000_00001000:
winmm.dll
winmm.dll
Explorer.EXE_284_rwx_0D330000_00001000:
winmm.dll
winmm.dll
Explorer.EXE_284_rwx_0D360000_00001000:
powrprof.dll
powrprof.dll
Explorer.EXE_284_rwx_0D3A0000_00001000:
powrprof.dll
powrprof.dll
Explorer.EXE_284_rwx_0D3D0000_00001000:
msacm32.dll
msacm32.dll
Explorer.EXE_284_rwx_0D450000_00001000:
msacm32.dll
msacm32.dll
Explorer.EXE_284_rwx_0D4D0000_00001000:
msacm32.dll
msacm32.dll
Explorer.EXE_284_rwx_0D510000_00001000:
msacm32.dll
msacm32.dll
Explorer.EXE_284_rwx_0D550000_00001000:
msacm32.dll
msacm32.dll
Explorer.EXE_284_rwx_0D590000_00001000:
msacm32.dll
msacm32.dll
Explorer.EXE_284_rwx_0D5D0000_00001000:
msacm32.dll
msacm32.dll
Explorer.EXE_284_rwx_0D610000_00001000:
msacm32.dll
msacm32.dll
Explorer.EXE_284_rwx_0D640000_00001000:
ADVAPI32.DLL
ADVAPI32.DLL
Explorer.EXE_284_rwx_0D680000_00001000:
ADVAPI32.DLL
ADVAPI32.DLL
Explorer.EXE_284_rwx_0D6C0000_00001000:
ADVAPI32.DLL
ADVAPI32.DLL
Explorer.EXE_284_rwx_0D700000_00001000:
ADVAPI32.DLL
ADVAPI32.DLL
Explorer.EXE_284_rwx_0D880000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0D9A0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0DA20000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0DA70000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0DAB0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0DB90000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0DBD0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0DC10000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0DC50000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0DCD0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0DD10000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0DD50000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0DD90000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0DDD0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0DE10000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0DE50000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0DE90000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0DEC0000_00001000:
GetProcessHeap
GetProcessHeap
Explorer.EXE_284_rwx_0DED0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0DF00000_00001000:
oleaut32.dll
oleaut32.dll
Explorer.EXE_284_rwx_0DF40000_00001000:
oleaut32.dll
oleaut32.dll
Explorer.EXE_284_rwx_0DF80000_00001000:
oleaut32.dll
oleaut32.dll
Explorer.EXE_284_rwx_0DFB0000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_284_rwx_0DFF0000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_284_rwx_0E020000_00001000:
RegOpenKeyExA
RegOpenKeyExA
Explorer.EXE_284_rwx_0E030000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_284_rwx_0E060000_00001000:
RegCloseKey
RegCloseKey
Explorer.EXE_284_rwx_0E070000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_284_rwx_0E0A0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0E0E0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0E160000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0E1E0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0E260000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0E2A0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0E2E0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0E320000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0E360000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0E3A0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0E3E0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0E420000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0E460000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0E4A0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0E4E0000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0E520000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0E560000_00001000:
kernel32.dll
kernel32.dll
Explorer.EXE_284_rwx_0E590000_00001000:
ntdll.dll
ntdll.dll
Explorer.EXE_284_rwx_0E5D0000_00001000:
ntdll.dll
ntdll.dll
Explorer.EXE_284_rwx_10410000_0005C000:
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
kernel32.dll
kernel32.dll
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
SHFileOperationA
SHFileOperationA
shell32.dll
shell32.dll
URLDownloadToFileA
URLDownloadToFileA
urlmon.dll
urlmon.dll
ShellExecuteA
ShellExecuteA
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
GetWindowsDirectoryA
GetWindowsDirectoryA
SOFTWARE\Microsoft\Windows\CurrentVersion
SOFTWARE\Microsoft\Windows\CurrentVersion
http\shell\open\command
http\shell\open\command
\Internet Explorer\iexplore.exe
\Internet Explorer\iexplore.exe
####@####
####@####
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
Portugal
Portugal
Turkey
Turkey
Windows 3.1
Windows 3.1
Windows 95 (Release 2)
Windows 95 (Release 2)
Windows 95
Windows 95
Windows 98 SE
Windows 98 SE
Windows 98
Windows 98
Windows ME
Windows ME
Windows 7
Windows 7
Windows Vista
Windows Vista
%s %s
%s %s
Windows XP Professional x64
Windows XP Professional x64
Windows XP Home
Windows XP Home
Windows XP Professional
Windows XP Professional
Windows 2000 Professional
Windows 2000 Professional
Windows NT %d.%d
Windows NT %d.%d
Windows 2008
Windows 2008
%s %s Server
%s %s Server
Windows 2003 Server Datacenter
Windows 2003 Server Datacenter
Windows 2003 Server Enterprise
Windows 2003 Server Enterprise
Windows 2003 Server Web Edition
Windows 2003 Server Web Edition
Windows 2003 Server
Windows 2003 Server
Windows Home Server
Windows Home Server
Windows 2003 Server (Release 2)
Windows 2003 Server (Release 2)
Windows 2000 Server Datacenter
Windows 2000 Server Datacenter
Windows 2000 Server Enterprise
Windows 2000 Server Enterprise
Windows 2000 Server Web Edition
Windows 2000 Server Web Edition
Windows 2000 Server
Windows 2000 Server
Windows NT 4.0 Server Datacenter
Windows NT 4.0 Server Datacenter
Windows NT 4.0 Server Enterprise
Windows NT 4.0 Server Enterprise
Windows NT 4.0 Server Web Edition
Windows NT 4.0 Server Web Edition
Windows NT 4.0 Server
Windows NT 4.0 Server
Unknown Platform ID (%d)
Unknown Platform ID (%d)
%d.%d
%d.%d
%s (Build: %d
%s (Build: %d
- Service Pack: %s
- Service Pack: %s
KERNEL32.DLL
KERNEL32.DLL
teste.vbs
teste.vbs
teste.txt
teste.txt
Set objSecurityCenter = GetObject("winmgmts:\\.\root\SecurityCenter")
Set objSecurityCenter = GetObject("winmgmts:\\.\root\SecurityCenter")
Set colFirewall = objSecurityCenter.ExecQuery("Select * From FirewallProduct",,48)
Set colFirewall = objSecurityCenter.ExecQuery("Select * From FirewallProduct",,48)
Set colAntiVirus = objSecurityCenter.ExecQuery("Select * From AntiVirusProduct",,48)
Set colAntiVirus = objSecurityCenter.ExecQuery("Select * From AntiVirusProduct",,48)
Set objFileSystem = CreateObject("Scripting.fileSystemObject")
Set objFileSystem = CreateObject("Scripting.fileSystemObject")
Set objFile = objFileSystem.CreateTextFile("
Set objFile = objFileSystem.CreateTextFile("
Info = Info & "F" & CountFw & ") " & objFirewall.displayName & " v" & objFirewall.versionNumber & Enter
Info = Info & "F" & CountFw & ") " & objFirewall.displayName & " v" & objFirewall.versionNumber & Enter
Info = Info & "A" & CountAV & ") " & objAntiVirus.displayName & " v" & objAntiVirus.versionNumber & Enter
Info = Info & "A" & CountAV & ") " & objAntiVirus.displayName & " v" & objAntiVirus.versionNumber & Enter
objFile.WriteLine(Info)
objFile.WriteLine(Info)
objFile.Close
objFile.Close
cscript.exe
cscript.exe
AVICAP32.dll
AVICAP32.dll
tFtpAccess
tFtpAccess
BuildImportTable: can't load library:
BuildImportTable: can't load library:
BuildImportTable: ReallocMemory failed
BuildImportTable: ReallocMemory failed
BuildImportTable: GetProcAddress failed
BuildImportTable: GetProcAddress failed
BTMemoryLoadLibary: BuildImportTable failed
BTMemoryLoadLibary: BuildImportTable failed
BTMemoryGetProcAddress: no export table found
BTMemoryGetProcAddress: no export table found
BTMemoryGetProcAddress: DLL doesn't export anything
BTMemoryGetProcAddress: DLL doesn't export anything
BTMemoryGetProcAddress: exported symbol not found
BTMemoryGetProcAddress: exported symbol not found
SetupApi.dll
SetupApi.dll
SetupDiOpenClassRegKey
SetupDiOpenClassRegKey
SetupDiOpenClassRegKeyExA
SetupDiOpenClassRegKeyExA
SetupDiOpenClassRegKeyExW
SetupDiOpenClassRegKeyExW
SetupDiCreateDeviceInterfaceRegKeyA
SetupDiCreateDeviceInterfaceRegKeyA
SetupDiCreateDeviceInterfaceRegKeyW
SetupDiCreateDeviceInterfaceRegKeyW
SetupDiOpenDeviceInterfaceRegKey
SetupDiOpenDeviceInterfaceRegKey
SetupDiDeleteDeviceInterfaceRegKey
SetupDiDeleteDeviceInterfaceRegKey
SetupDiCreateDevRegKeyA
SetupDiCreateDevRegKeyA
SetupDiCreateDevRegKeyW
SetupDiCreateDevRegKeyW
SetupDiOpenDevRegKey
SetupDiOpenDevRegKey
SetupDiDeleteDevRegKey
SetupDiDeleteDevRegKey
CM_DEVCAP_LOCKSUPPORTED
CM_DEVCAP_LOCKSUPPORTED
CM_DEVCAP_EJECTSUPPORTED
CM_DEVCAP_EJECTSUPPORTED
PDCAP_D0_SUPPORTED
PDCAP_D0_SUPPORTED
PDCAP_D1_SUPPORTED
PDCAP_D1_SUPPORTED
PDCAP_D2_SUPPORTED
PDCAP_D2_SUPPORTED
PDCAP_D3_SUPPORTED
PDCAP_D3_SUPPORTED
PDCAP_WAKE_FROM_D0_SUPPORTED
PDCAP_WAKE_FROM_D0_SUPPORTED
PDCAP_WAKE_FROM_D1_SUPPORTED
PDCAP_WAKE_FROM_D1_SUPPORTED
PDCAP_WAKE_FROM_D2_SUPPORTED
PDCAP_WAKE_FROM_D2_SUPPORTED
PDCAP_WAKE_FROM_D3_SUPPORTED
PDCAP_WAKE_FROM_D3_SUPPORTED
PDCAP_WARM_EJECT_SUPPORTED
PDCAP_WARM_EJECT_SUPPORTED
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_USERS
127.0.0.1
127.0.0.1
iphlpapi.dll
iphlpapi.dll
AllocateAndGetTcpExTableFromStack
AllocateAndGetTcpExTableFromStack
AllocateAndGetUdpExTableFromStack
AllocateAndGetUdpExTableFromStack
SetTcpEntry
SetTcpEntry
GetExtendedTcpTable
GetExtendedTcpTable
GetExtendedUdpTable
GetExtendedUdpTable
Mozilla3_5Password
Mozilla3_5Password
GetChromePass
GetChromePass
StartHttpProxy
StartHttpProxy
1.2.3
1.2.3
XxX.xXx
XxX.xXx
UuU.uUu
UuU.uUu
keyboardkey
keyboardkey
webcaminactive
webcaminactive
webcamgetbuffer
webcamgetbuffer
webcam
webcam
enviarexecnormal
enviarexecnormal
enviarexechidden
enviarexechidden
openweb
openweb
downexec
downexec
sendftp
sendftp
keylogger
keylogger
keyloggergetlog
keyloggergetlog
keyloggereraselog
keyloggereraselog
keyloggerativar
keyloggerativar
keyloggerdesativar
keyloggerdesativar
renamekey
renamekey
windowsfechar
windowsfechar
windowsmax
windowsmax
windowsmin
windowsmin
windowsmostrar
windowsmostrar
windowsocultar
windowsocultar
windowsmintodas
windowsmintodas
windowscaption
windowscaption
listarportas
listarportas
listarportasdns
listarportasdns
finalizarprocessoportas
finalizarprocessoportas
webcamsettings
webcamsettings
chatmsg
chatmsg
getpassword
getpassword
updateservidorweb
updateservidorweb
keyloggersearch
keyloggersearch
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
PSAPI.dll
PSAPI.dll
\config\SteamAppData.vdf
\config\SteamAppData.vdf
AutoLoginUser
AutoLoginUser
/ClientRegistry.Blob
/ClientRegistry.Blob
\ClientRegistry.blob
\ClientRegistry.blob
\steam.dll
\steam.dll
%SYS%
%SYS%
ÞSKTOP%
ÞSKTOP%
TThreadSearch`%D
TThreadSearch`%D
FirstExecution
FirstExecution
chatmsg|
chatmsg|
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
listarjanelas|windowsfechar|
listarjanelas|windowsfechar|
listarjanelas|windowsmax|
listarjanelas|windowsmax|
listarjanelas|windowsmin|
listarjanelas|windowsmin|
listarjanelas|windowsmostrar|
listarjanelas|windowsmostrar|
listarjanelas|windowsocultar|
listarjanelas|windowsocultar|
listarjanelas|windowsmintodas|
listarjanelas|windowsmintodas|
listarjanelas|windowscaption|
listarjanelas|windowscaption|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
listarportas|listadeportaspronta|
listarportas|listadeportaspronta|
listarportas|finalizarconexao|
listarportas|finalizarconexao|
listarportas|finalizarprocessoportas|Y|
listarportas|finalizarprocessoportas|Y|
listarportas|finalizarprocessoportas|N|
listarportas|finalizarprocessoportas|N|
registro|renamekey|
registro|renamekey|
keylogger|keylogger|keyloggerativar|
keylogger|keylogger|keyloggerativar|
keylogger|keylogger|keyloggerdesativar|
keylogger|keylogger|keyloggerdesativar|
keylogger|keyloggergetlog|
keylogger|keyloggergetlog|
keylogger|keylogger|keyloggervazio|
keylogger|keylogger|keyloggervazio|
keyloggersearchok|
keyloggersearchok|
webcam|webcaminactive|
webcam|webcaminactive|
webcam|webcamactive|
webcam|webcamactive|
_x_X_PASSWORDLIST_X_x_
_x_X_PASSWORDLIST_X_x_
NOIP.abc
NOIP.abc
MSN.abc
MSN.abc
FIREFOX.abc
FIREFOX.abc
IELOGIN.abc
IELOGIN.abc
IEPASS.abc
IEPASS.abc
IEAUTO.abc
IEAUTO.abc
IEWEB.abc
IEWEB.abc
SOFTWARE\Mozilla\Mozilla Firefox
SOFTWARE\Mozilla\Mozilla Firefox
getfirefox
getfirefox
getielogin
getielogin
getiepass
getiepass
getieweb
getieweb
getchrome
getchrome
getpassword|getpasswordlist|
getpassword|getpasswordlist|
getpassword|getpassworderror|
getpassword|getpassworderror|
##@@## ##@@## ##@@##
##@@## ##@@## ##@@##
Windows\CurrentVersion\Uninstall\eDonkey2000
Windows\CurrentVersion\Uninstall\eDonkey2000
UNWISE.EXE
UNWISE.EXE
ntdll.dll
ntdll.dll
icon=shell32.dll,4
icon=shell32.dll,4
shellexecute=
shellexecute=
autorun.inf
autorun.inf
XX--XX--XX.txt
XX--XX--XX.txt
logs.dat
logs.dat
SQLite3.dll
SQLite3.dll
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
inflate 1.2.3 Copyright 1995-2005 Mark Adler
inflate 1.2.3 Copyright 1995-2005 Mark Adler
GetProcessHeap
GetProcessHeap
user32.dll
user32.dll
advapi32.dll
advapi32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
oleaut32.dll
oleaut32.dll
RegOpenKeyA
RegOpenKeyA
RegEnumKeyExA
RegEnumKeyExA
RegDeleteKeyA
RegDeleteKeyA
RegCreateKeyA
RegCreateKeyA
WinExec
WinExec
SetNamedPipeHandleState
SetNamedPipeHandleState
CreatePipe
CreatePipe
mpr.dll
mpr.dll
gdi32.dll
gdi32.dll
keybd_event
keybd_event
MapVirtualKeyA
MapVirtualKeyA
GetKeyboardState
GetKeyboardState
GetKeyboardLayoutNameA
GetKeyboardLayoutNameA
GetKeyState
GetKeyState
GetAsyncKeyState
GetAsyncKeyState
ExitWindowsEx
ExitWindowsEx
EnumWindows
EnumWindows
wininet.dll
wininet.dll
FtpGetFileSize
FtpGetFileSize
FtpSetCurrentDirectoryA
FtpSetCurrentDirectoryA
FtpOpenFileA
FtpOpenFileA
wsock32.dll
wsock32.dll
ole32.dll
ole32.dll
gdiplus.dll
gdiplus.dll
GdiplusShutdown
GdiplusShutdown
AVICAP32.DLL
AVICAP32.DLL
winmm.dll
winmm.dll
powrprof.dll
powrprof.dll
msacm32.dll
msacm32.dll
ADVAPI32.DLL
ADVAPI32.DLL
7-727:7?7
7-727:7?7
4.4 5=5`5|5 6
4.4 5=5`5|5 6
> >$>(>,>
> >$>(>,>
>'>3>]>}>
>'>3>]>}>
040=0^0~0
040=0^0~0
2 2/2]2}2
2 2/2]2}2
:$:6:^:~:
:$:6:^:~:
; ;%;-;5;
; ;%;-;5;
KWindows
KWindows
UnitExecutarComandos
UnitExecutarComandos
uftp
uftp
UrlMon
UrlMon
.UnitBytesSize
.UnitBytesSize
UnitListarPortasAtivas
UnitListarPortasAtivas
UnitWebcam
UnitWebcam
UnitKeylogger
UnitKeylogger
Explorer.EXE_284_rwx_318D0000_00009000:
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
kernel32.dll
Ntdll.dll
Ntdll.dll
NtEnumerateValueKey
NtEnumerateValueKey
NtEnumerateKey
NtEnumerateKey
advapi32.dll
advapi32.dll
GetProcessHeap
GetProcessHeap
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
ntdll.dll
ntdll.dll
KWindows
KWindows
Explorer.EXE_284_rwx_6AAB1000_00001000:
P.txm.t
P.txm.t
/t-O.tGI1t
/t-O.tGI1t
.t,Q.tE
.t,Q.tE
;.tS@.t
;.tS@.t
WERCONCPL.dll
WERCONCPL.dll
Explorer.EXE_284_rwx_6ADE1000_00001000:
Microsoft\Windows\WerCplSupport
Microsoft\Windows\WerCplSupport
Explorer.EXE_284_rwx_6D011000_00001000:
dRegDeleteKeyW
dRegDeleteKeyW
RegDeleteKeyExW
RegDeleteKeyExW
mscoree.dll
mscoree.dll
Invalid parameter passed to C runtime functi
Invalid parameter passed to C runtime functi
Software\Policies\Microsoft\Windows\Network Connections
Software\Policies\Microsoft\Windows\Network Connections
advapi32.dll
advapi32.dll
API-MS-Win-Core-LocalRegistry-L1-1-0.dll
API-MS-Win-Core-LocalRegistry-L1-1-0.dll
hXXp://VVV.microsoft.com/AvailableNetwork/Info
hXXp://VVV.microsoft.com/AvailableNetwork/Info
Floating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CString class.
Floating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CString class.
@%s,-%d
@%s,-%d
xmlns:an='hXXp://VVV.microsoft.com/AvailableNetwork/Info'
xmlns:an='hXXp://VVV.microsoft.com/AvailableNetwork/Info'
support
support
::{7007acc7-3202-11d1-aad2-00805fc1270e}
::{7007acc7-3202-11d1-aad2-00805fc1270e}
shell:::{21ec2020-3aea-1069-a2dd-08002b30309d}
shell:::{21ec2020-3aea-1069-a2dd-08002b30309d}
ekernel32.dll
ekernel32.dll
kernelbase.dll
kernelbase.dll
KERNEL32.DLL
KERNEL32.DLL
KERNELBASE.DLL
KERNELBASE.DLL
Explorer.EXE_284_rwx_6E661000_00001000:
FXSAPI.dll
FXSAPI.dll
FaxEnumPortsA
FaxEnumPortsA
FaxEnumPortsExA
FaxEnumPortsExA
FaxEnumPortsExW
FaxEnumPortsExW
FaxEnumPortsW
FaxEnumPortsW
Explorer.EXE_284_rwx_6E781000_00001000:
Software\Microsoft\Windows NT\CurrentVersion\
Software\Microsoft\Windows NT\CurrentVersion\
6wow32.dll
6wow32.dll
Explorer.EXE_284_rwx_6E7B1000_00001000:
.trp.t
.trp.t
.t%w.trp.t
.t%w.trp.t
@.tL~.trB.tJ,1t3
@.tL~.trB.tJ,1t3
.tl2/t7
.tl2/t7
.t*4.txm.t
.t*4.txm.t
/tu4.tl
/tu4.tl
.tQY/t
.tQY/t
Explorer.EXE_284_rwx_6E881000_00001000:
%d, %ld, %ld, %ld, %d, %d
%d, %ld, %ld, %ld, %d, %d
%s %s - -:d:d M
%s %s - -:d:d M
CreateIoCompletionPort
CreateIoCompletionPort
u:u:u:lu
u:u:u:lu
avicap32.pdb
avicap32.pdb
Version: %d.%d.%d.%d
Version: %d.%d.%d.%d
C:\CAPTURE.AVI
C:\CAPTURE.AVI
open %s shareable alias mciframes
open %s shareable alias mciframes
wow32.dll
wow32.dll
Explorer.EXE_284_rwx_6F451000_00001000:
tiptsf.dll
tiptsf.dll
Explorer.EXE_284_rwx_6F7D1000_00001000:
gameux.dll
gameux.dll
csrss.exe_316_rwx_014F0000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_316_rwx_01770000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_316_rwx_017F0000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_316_rwx_01830000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_316_rwx_01870000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_316_rwx_018B0000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_316_rwx_018F0000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_316_rwx_01930000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_316_rwx_01970000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_316_rwx_019B0000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_316_rwx_019F0000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_316_rwx_01A30000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_316_rwx_01A70000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_316_rwx_01AB0000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_316_rwx_01AF0000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_316_rwx_01B30000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_316_rwx_01B70000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_316_rwx_01BB0000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_316_rwx_01BE0000_00001000:
GetProcessHeap
GetProcessHeap
csrss.exe_316_rwx_01BF0000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_316_rwx_01C20000_00001000:
oleaut32.dll
oleaut32.dll
csrss.exe_316_rwx_01C60000_00001000:
oleaut32.dll
oleaut32.dll
csrss.exe_316_rwx_01CA0000_00001000:
oleaut32.dll
oleaut32.dll
csrss.exe_316_rwx_01CD0000_00001000:
advapi32.dll
advapi32.dll
csrss.exe_316_rwx_01D10000_00001000:
advapi32.dll
advapi32.dll
csrss.exe_316_rwx_01D40000_00001000:
RegOpenKeyExA
RegOpenKeyExA
csrss.exe_316_rwx_01D50000_00001000:
advapi32.dll
advapi32.dll
csrss.exe_316_rwx_01D80000_00001000:
RegCloseKey
RegCloseKey
csrss.exe_316_rwx_01D90000_00001000:
advapi32.dll
advapi32.dll
csrss.exe_316_rwx_01DC0000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_316_rwx_01E00000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_316_rwx_01E40000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_316_rwx_01E80000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_316_rwx_01EC0000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_316_rwx_01F00000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_316_rwx_01F40000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_316_rwx_01F80000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_316_rwx_01FC0000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_316_rwx_02000000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_316_rwx_02040000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_316_rwx_02080000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_316_rwx_020C0000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_316_rwx_02100000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_316_rwx_02140000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_316_rwx_02180000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_316_rwx_021C0000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_316_rwx_021F0000_00001000:
ntdll.dll
ntdll.dll
csrss.exe_316_rwx_02230000_00001000:
ntdll.dll
ntdll.dll
csrss.exe_316_rwx_31780000_00009000:
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
%x`x1
%x`x1
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
kernel32.dll
Ntdll.dll
Ntdll.dll
NtEnumerateValueKey
NtEnumerateValueKey
NtEnumerateKey
NtEnumerateKey
advapi32.dll
advapi32.dll
GetProcessHeap
GetProcessHeap
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
ntdll.dll
ntdll.dll
KWindows
KWindows
wininit.exe_356_rwx_00120000_00001000:
kernel32.dll
kernel32.dll
wininit.exe_356_rwx_004C0000_00001000:
kernel32.dll
kernel32.dll
wininit.exe_356_rwx_00540000_00001000:
kernel32.dll
kernel32.dll
wininit.exe_356_rwx_00600000_00001000:
kernel32.dll
kernel32.dll
wininit.exe_356_rwx_00640000_00001000:
kernel32.dll
kernel32.dll
wininit.exe_356_rwx_00680000_00001000:
kernel32.dll
kernel32.dll
wininit.exe_356_rwx_01300000_00001000:
kernel32.dll
kernel32.dll
wininit.exe_356_rwx_01340000_00001000:
kernel32.dll
kernel32.dll
wininit.exe_356_rwx_01380000_00001000:
kernel32.dll
kernel32.dll
wininit.exe_356_rwx_013C0000_00001000:
kernel32.dll
kernel32.dll
wininit.exe_356_rwx_01400000_00001000:
kernel32.dll
kernel32.dll
wininit.exe_356_rwx_01750000_00001000:
kernel32.dll
kernel32.dll
wininit.exe_356_rwx_01790000_00001000:
kernel32.dll
kernel32.dll
wininit.exe_356_rwx_017D0000_00001000:
kernel32.dll
kernel32.dll
wininit.exe_356_rwx_01810000_00001000:
kernel32.dll
kernel32.dll
wininit.exe_356_rwx_01850000_00001000:
kernel32.dll
kernel32.dll
wininit.exe_356_rwx_01890000_00001000:
kernel32.dll
kernel32.dll
wininit.exe_356_rwx_018D0000_00001000:
kernel32.dll
kernel32.dll
wininit.exe_356_rwx_01900000_00001000:
GetProcessHeap
GetProcessHeap
wininit.exe_356_rwx_01910000_00001000:
kernel32.dll
kernel32.dll
wininit.exe_356_rwx_01940000_00001000:
oleaut32.dll
oleaut32.dll
wininit.exe_356_rwx_01980000_00001000:
oleaut32.dll
oleaut32.dll
wininit.exe_356_rwx_019C0000_00001000:
oleaut32.dll
oleaut32.dll
wininit.exe_356_rwx_019F0000_00001000:
advapi32.dll
advapi32.dll
wininit.exe_356_rwx_01A30000_00001000:
advapi32.dll
advapi32.dll
wininit.exe_356_rwx_01A60000_00001000:
RegOpenKeyExA
RegOpenKeyExA
wininit.exe_356_rwx_01A70000_00001000:
advapi32.dll
advapi32.dll
wininit.exe_356_rwx_01AA0000_00001000:
RegCloseKey
RegCloseKey
wininit.exe_356_rwx_01AB0000_00001000:
advapi32.dll
advapi32.dll
wininit.exe_356_rwx_01AE0000_00001000:
kernel32.dll
kernel32.dll
wininit.exe_356_rwx_01B20000_00001000:
kernel32.dll
kernel32.dll
wininit.exe_356_rwx_01B60000_00001000:
kernel32.dll
kernel32.dll
wininit.exe_356_rwx_01BA0000_00001000:
kernel32.dll
kernel32.dll
wininit.exe_356_rwx_01BE0000_00001000:
kernel32.dll
kernel32.dll
wininit.exe_356_rwx_01C20000_00001000:
kernel32.dll
kernel32.dll
wininit.exe_356_rwx_01C60000_00001000:
kernel32.dll
kernel32.dll
wininit.exe_356_rwx_01CA0000_00001000:
kernel32.dll
kernel32.dll
wininit.exe_356_rwx_01CE0000_00001000:
kernel32.dll
kernel32.dll
wininit.exe_356_rwx_01D20000_00001000:
kernel32.dll
kernel32.dll
wininit.exe_356_rwx_01D60000_00001000:
kernel32.dll
kernel32.dll
wininit.exe_356_rwx_01DA0000_00001000:
kernel32.dll
kernel32.dll
wininit.exe_356_rwx_01DE0000_00001000:
kernel32.dll
kernel32.dll
wininit.exe_356_rwx_01E20000_00001000:
kernel32.dll
kernel32.dll
wininit.exe_356_rwx_01E60000_00001000:
kernel32.dll
kernel32.dll
wininit.exe_356_rwx_01EA0000_00001000:
kernel32.dll
kernel32.dll
wininit.exe_356_rwx_01EE0000_00001000:
kernel32.dll
kernel32.dll
wininit.exe_356_rwx_01F10000_00001000:
ntdll.dll
ntdll.dll
wininit.exe_356_rwx_01F50000_00001000:
ntdll.dll
ntdll.dll
wininit.exe_356_rwx_31790000_00009000:
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
%x`y1
%x`y1
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
kernel32.dll
Ntdll.dll
Ntdll.dll
NtEnumerateValueKey
NtEnumerateValueKey
NtEnumerateKey
NtEnumerateKey
advapi32.dll
advapi32.dll
GetProcessHeap
GetProcessHeap
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
ntdll.dll
ntdll.dll
KWindows
KWindows
csrss.exe_368_rwx_02020000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_368_rwx_02190000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_368_rwx_021D0000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_368_rwx_02210000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_368_rwx_02290000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_368_rwx_022D0000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_368_rwx_02310000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_368_rwx_02350000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_368_rwx_02390000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_368_rwx_023D0000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_368_rwx_02410000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_368_rwx_02450000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_368_rwx_02490000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_368_rwx_024D0000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_368_rwx_02510000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_368_rwx_02550000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_368_rwx_02590000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_368_rwx_025D0000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_368_rwx_02600000_00001000:
GetProcessHeap
GetProcessHeap
csrss.exe_368_rwx_02610000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_368_rwx_02640000_00001000:
oleaut32.dll
oleaut32.dll
csrss.exe_368_rwx_02680000_00001000:
oleaut32.dll
oleaut32.dll
csrss.exe_368_rwx_02700000_00001000:
oleaut32.dll
oleaut32.dll
csrss.exe_368_rwx_02730000_00001000:
advapi32.dll
advapi32.dll
csrss.exe_368_rwx_02770000_00001000:
advapi32.dll
advapi32.dll
csrss.exe_368_rwx_027A0000_00001000:
RegOpenKeyExA
RegOpenKeyExA
csrss.exe_368_rwx_027B0000_00001000:
advapi32.dll
advapi32.dll
csrss.exe_368_rwx_027E0000_00001000:
RegCloseKey
RegCloseKey
csrss.exe_368_rwx_027F0000_00001000:
advapi32.dll
advapi32.dll
csrss.exe_368_rwx_02820000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_368_rwx_02860000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_368_rwx_06370000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_368_rwx_063B0000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_368_rwx_06430000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_368_rwx_064B0000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_368_rwx_064F0000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_368_rwx_06530000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_368_rwx_06570000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_368_rwx_065F0000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_368_rwx_06630000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_368_rwx_06FE0000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_368_rwx_07020000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_368_rwx_07060000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_368_rwx_070A0000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_368_rwx_070E0000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_368_rwx_07120000_00001000:
kernel32.dll
kernel32.dll
csrss.exe_368_rwx_07150000_00001000:
ntdll.dll
ntdll.dll
csrss.exe_368_rwx_07190000_00001000:
ntdll.dll
ntdll.dll
csrss.exe_368_rwx_317A0000_00009000:
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
%x`z1
%x`z1
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
kernel32.dll
Ntdll.dll
Ntdll.dll
NtEnumerateValueKey
NtEnumerateValueKey
NtEnumerateKey
NtEnumerateKey
advapi32.dll
advapi32.dll
GetProcessHeap
GetProcessHeap
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
ntdll.dll
ntdll.dll
KWindows
KWindows
winlogon.exe_416_rwx_000C0000_00001000:
kernel32.dll
kernel32.dll
winlogon.exe_416_rwx_00300000_00001000:
kernel32.dll
kernel32.dll
winlogon.exe_416_rwx_005A0000_00001000:
kernel32.dll
kernel32.dll
winlogon.exe_416_rwx_005E0000_00001000:
kernel32.dll
kernel32.dll
winlogon.exe_416_rwx_006A0000_00001000:
kernel32.dll
kernel32.dll
winlogon.exe_416_rwx_00760000_00001000:
kernel32.dll
kernel32.dll
winlogon.exe_416_rwx_007A0000_00001000:
kernel32.dll
kernel32.dll
winlogon.exe_416_rwx_008A0000_00001000:
kernel32.dll
kernel32.dll
winlogon.exe_416_rwx_009A0000_00001000:
kernel32.dll
kernel32.dll
winlogon.exe_416_rwx_009E0000_00001000:
kernel32.dll
kernel32.dll
winlogon.exe_416_rwx_00A20000_00001000:
kernel32.dll
kernel32.dll
winlogon.exe_416_rwx_00A60000_00001000:
kernel32.dll
kernel32.dll
winlogon.exe_416_rwx_00BE0000_00001000:
kernel32.dll
kernel32.dll
winlogon.exe_416_rwx_00C20000_00001000:
kernel32.dll
kernel32.dll
winlogon.exe_416_rwx_01B70000_00001000:
kernel32.dll
kernel32.dll
winlogon.exe_416_rwx_01BB0000_00001000:
kernel32.dll
kernel32.dll
winlogon.exe_416_rwx_01BF0000_00001000:
kernel32.dll
kernel32.dll
winlogon.exe_416_rwx_01C30000_00001000:
kernel32.dll
kernel32.dll
winlogon.exe_416_rwx_01CA0000_00001000:
GetProcessHeap
GetProcessHeap
winlogon.exe_416_rwx_01CB0000_00001000:
kernel32.dll
kernel32.dll
winlogon.exe_416_rwx_01CE0000_00001000:
oleaut32.dll
oleaut32.dll
winlogon.exe_416_rwx_01D20000_00001000:
oleaut32.dll
oleaut32.dll
winlogon.exe_416_rwx_01D60000_00001000:
oleaut32.dll
oleaut32.dll
winlogon.exe_416_rwx_01D90000_00001000:
advapi32.dll
advapi32.dll
winlogon.exe_416_rwx_01DD0000_00001000:
advapi32.dll
advapi32.dll
winlogon.exe_416_rwx_01E80000_00001000:
RegOpenKeyExA
RegOpenKeyExA
winlogon.exe_416_rwx_01E90000_00001000:
advapi32.dll
advapi32.dll
winlogon.exe_416_rwx_01EC0000_00001000:
RegCloseKey
RegCloseKey
winlogon.exe_416_rwx_01ED0000_00001000:
advapi32.dll
advapi32.dll
winlogon.exe_416_rwx_01F00000_00001000:
kernel32.dll
kernel32.dll
winlogon.exe_416_rwx_01F40000_00001000:
kernel32.dll
kernel32.dll
winlogon.exe_416_rwx_01F80000_00001000:
kernel32.dll
kernel32.dll
winlogon.exe_416_rwx_01FC0000_00001000:
kernel32.dll
kernel32.dll
winlogon.exe_416_rwx_02000000_00001000:
kernel32.dll
kernel32.dll
winlogon.exe_416_rwx_02040000_00001000:
kernel32.dll
kernel32.dll
winlogon.exe_416_rwx_02080000_00001000:
kernel32.dll
kernel32.dll
winlogon.exe_416_rwx_020C0000_00001000:
kernel32.dll
kernel32.dll
winlogon.exe_416_rwx_02140000_00001000:
kernel32.dll
kernel32.dll
winlogon.exe_416_rwx_02180000_00001000:
kernel32.dll
kernel32.dll
winlogon.exe_416_rwx_021C0000_00001000:
kernel32.dll
kernel32.dll
winlogon.exe_416_rwx_02200000_00001000:
kernel32.dll
kernel32.dll
winlogon.exe_416_rwx_02240000_00001000:
kernel32.dll
kernel32.dll
winlogon.exe_416_rwx_02280000_00001000:
kernel32.dll
kernel32.dll
winlogon.exe_416_rwx_022C0000_00001000:
kernel32.dll
kernel32.dll
winlogon.exe_416_rwx_02300000_00001000:
kernel32.dll
kernel32.dll
winlogon.exe_416_rwx_02340000_00001000:
kernel32.dll
kernel32.dll
winlogon.exe_416_rwx_02370000_00001000:
ntdll.dll
ntdll.dll
winlogon.exe_416_rwx_023B0000_00001000:
ntdll.dll
ntdll.dll
winlogon.exe_416_rwx_317B0000_00009000:
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
%x`{1
%x`{1
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
kernel32.dll
Ntdll.dll
Ntdll.dll
NtEnumerateValueKey
NtEnumerateValueKey
NtEnumerateKey
NtEnumerateKey
advapi32.dll
advapi32.dll
GetProcessHeap
GetProcessHeap
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
ntdll.dll
ntdll.dll
KWindows
KWindows
services.exe_460_rwx_001D0000_00001000:
kernel32.dll
kernel32.dll
services.exe_460_rwx_003A0000_00001000:
kernel32.dll
kernel32.dll
services.exe_460_rwx_005C0000_00001000:
kernel32.dll
kernel32.dll
services.exe_460_rwx_00710000_00001000:
kernel32.dll
kernel32.dll
services.exe_460_rwx_007D0000_00001000:
kernel32.dll
kernel32.dll
services.exe_460_rwx_00850000_00001000:
kernel32.dll
kernel32.dll
services.exe_460_rwx_00990000_00001000:
kernel32.dll
kernel32.dll
services.exe_460_rwx_00A10000_00001000:
kernel32.dll
kernel32.dll
services.exe_460_rwx_00AD0000_00001000:
kernel32.dll
kernel32.dll
services.exe_460_rwx_01660000_00001000:
kernel32.dll
kernel32.dll
services.exe_460_rwx_016E0000_00001000:
kernel32.dll
kernel32.dll
services.exe_460_rwx_01A60000_00001000:
kernel32.dll
kernel32.dll
services.exe_460_rwx_01AE0000_00001000:
kernel32.dll
kernel32.dll
services.exe_460_rwx_01B60000_00001000:
kernel32.dll
kernel32.dll
services.exe_460_rwx_01BE0000_00001000:
kernel32.dll
kernel32.dll
services.exe_460_rwx_01C60000_00001000:
kernel32.dll
kernel32.dll
services.exe_460_rwx_01DA0000_00001000:
kernel32.dll
kernel32.dll
services.exe_460_rwx_01DE0000_00001000:
kernel32.dll
kernel32.dll
services.exe_460_rwx_01E50000_00001000:
GetProcessHeap
GetProcessHeap
services.exe_460_rwx_01E60000_00001000:
kernel32.dll
kernel32.dll
services.exe_460_rwx_01ED0000_00001000:
oleaut32.dll
oleaut32.dll
services.exe_460_rwx_01F10000_00001000:
oleaut32.dll
oleaut32.dll
services.exe_460_rwx_01F90000_00001000:
oleaut32.dll
oleaut32.dll
services.exe_460_rwx_02000000_00001000:
advapi32.dll
advapi32.dll
services.exe_460_rwx_02040000_00001000:
advapi32.dll
advapi32.dll
services.exe_460_rwx_02070000_00001000:
RegOpenKeyExA
RegOpenKeyExA
services.exe_460_rwx_02080000_00001000:
advapi32.dll
advapi32.dll
services.exe_460_rwx_020B0000_00001000:
RegCloseKey
RegCloseKey
services.exe_460_rwx_020C0000_00001000:
advapi32.dll
advapi32.dll
services.exe_460_rwx_020F0000_00001000:
kernel32.dll
kernel32.dll
services.exe_460_rwx_02130000_00001000:
kernel32.dll
kernel32.dll
services.exe_460_rwx_02170000_00001000:
kernel32.dll
kernel32.dll
services.exe_460_rwx_021B0000_00001000:
kernel32.dll
kernel32.dll
services.exe_460_rwx_021F0000_00001000:
kernel32.dll
kernel32.dll
services.exe_460_rwx_02230000_00001000:
kernel32.dll
kernel32.dll
services.exe_460_rwx_02270000_00001000:
kernel32.dll
kernel32.dll
services.exe_460_rwx_022B0000_00001000:
kernel32.dll
kernel32.dll
services.exe_460_rwx_022F0000_00001000:
kernel32.dll
kernel32.dll
services.exe_460_rwx_02330000_00001000:
kernel32.dll
kernel32.dll
services.exe_460_rwx_02370000_00001000:
kernel32.dll
kernel32.dll
services.exe_460_rwx_023B0000_00001000:
kernel32.dll
kernel32.dll
services.exe_460_rwx_023F0000_00001000:
kernel32.dll
kernel32.dll
services.exe_460_rwx_02430000_00001000:
kernel32.dll
kernel32.dll
services.exe_460_rwx_02470000_00001000:
kernel32.dll
kernel32.dll
services.exe_460_rwx_024B0000_00001000:
kernel32.dll
kernel32.dll
services.exe_460_rwx_024F0000_00001000:
kernel32.dll
kernel32.dll
services.exe_460_rwx_02520000_00001000:
ntdll.dll
ntdll.dll
services.exe_460_rwx_02560000_00001000:
ntdll.dll
ntdll.dll
services.exe_460_rwx_317C0000_00009000:
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
%x`|1
%x`|1
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
kernel32.dll
Ntdll.dll
Ntdll.dll
NtEnumerateValueKey
NtEnumerateValueKey
NtEnumerateKey
NtEnumerateKey
advapi32.dll
advapi32.dll
GetProcessHeap
GetProcessHeap
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
ntdll.dll
ntdll.dll
KWindows
KWindows
lsass.exe_468_rwx_001E0000_00001000:
kernel32.dll
kernel32.dll
lsass.exe_468_rwx_00770000_00001000:
kernel32.dll
kernel32.dll
lsass.exe_468_rwx_00B40000_00001000:
kernel32.dll
kernel32.dll
lsass.exe_468_rwx_00B80000_00001000:
kernel32.dll
kernel32.dll
lsass.exe_468_rwx_00BC0000_00001000:
kernel32.dll
kernel32.dll
lsass.exe_468_rwx_00D40000_00001000:
kernel32.dll
kernel32.dll
lsass.exe_468_rwx_00E90000_00001000:
kernel32.dll
kernel32.dll
lsass.exe_468_rwx_00ED0000_00001000:
kernel32.dll
kernel32.dll
lsass.exe_468_rwx_00F50000_00001000:
kernel32.dll
kernel32.dll
lsass.exe_468_rwx_01050000_00001000:
kernel32.dll
kernel32.dll
lsass.exe_468_rwx_010D0000_00001000:
kernel32.dll
kernel32.dll
lsass.exe_468_rwx_01110000_00001000:
kernel32.dll
kernel32.dll
lsass.exe_468_rwx_01190000_00001000:
kernel32.dll
kernel32.dll
lsass.exe_468_rwx_011D0000_00001000:
kernel32.dll
kernel32.dll
lsass.exe_468_rwx_01210000_00001000:
kernel32.dll
kernel32.dll
lsass.exe_468_rwx_01250000_00001000:
kernel32.dll
kernel32.dll
lsass.exe_468_rwx_01290000_00001000:
kernel32.dll
kernel32.dll
lsass.exe_468_rwx_012D0000_00001000:
kernel32.dll
kernel32.dll
lsass.exe_468_rwx_01300000_00001000:
GetProcessHeap
GetProcessHeap
lsass.exe_468_rwx_01310000_00001000:
kernel32.dll
kernel32.dll
lsass.exe_468_rwx_01340000_00001000:
oleaut32.dll
oleaut32.dll
lsass.exe_468_rwx_01380000_00001000:
oleaut32.dll
oleaut32.dll
lsass.exe_468_rwx_013C0000_00001000:
oleaut32.dll
oleaut32.dll
lsass.exe_468_rwx_013F0000_00001000:
advapi32.dll
advapi32.dll
lsass.exe_468_rwx_01430000_00001000:
advapi32.dll
advapi32.dll
lsass.exe_468_rwx_01460000_00001000:
RegOpenKeyExA
RegOpenKeyExA
lsass.exe_468_rwx_01470000_00001000:
advapi32.dll
advapi32.dll
lsass.exe_468_rwx_014A0000_00001000:
RegCloseKey
RegCloseKey
lsass.exe_468_rwx_014B0000_00001000:
advapi32.dll
advapi32.dll
lsass.exe_468_rwx_014E0000_00001000:
kernel32.dll
kernel32.dll
lsass.exe_468_rwx_01520000_00001000:
kernel32.dll
kernel32.dll
lsass.exe_468_rwx_01560000_00001000:
kernel32.dll
kernel32.dll
lsass.exe_468_rwx_015A0000_00001000:
kernel32.dll
kernel32.dll
lsass.exe_468_rwx_015E0000_00001000:
kernel32.dll
kernel32.dll
lsass.exe_468_rwx_01620000_00001000:
kernel32.dll
kernel32.dll
lsass.exe_468_rwx_01660000_00001000:
kernel32.dll
kernel32.dll
lsass.exe_468_rwx_016A0000_00001000:
kernel32.dll
kernel32.dll
lsass.exe_468_rwx_016E0000_00001000:
kernel32.dll
kernel32.dll
lsass.exe_468_rwx_01720000_00001000:
kernel32.dll
kernel32.dll
lsass.exe_468_rwx_01760000_00001000:
kernel32.dll
kernel32.dll
lsass.exe_468_rwx_017A0000_00001000:
kernel32.dll
kernel32.dll
lsass.exe_468_rwx_017E0000_00001000:
kernel32.dll
kernel32.dll
lsass.exe_468_rwx_01820000_00001000:
kernel32.dll
kernel32.dll
lsass.exe_468_rwx_01860000_00001000:
kernel32.dll
kernel32.dll
lsass.exe_468_rwx_018A0000_00001000:
kernel32.dll
kernel32.dll
lsass.exe_468_rwx_018E0000_00001000:
kernel32.dll
kernel32.dll
lsass.exe_468_rwx_01910000_00001000:
ntdll.dll
ntdll.dll
lsass.exe_468_rwx_01950000_00001000:
ntdll.dll
ntdll.dll
lsass.exe_468_rwx_317D0000_00009000:
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
%x`}1
%x`}1
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
kernel32.dll
Ntdll.dll
Ntdll.dll
NtEnumerateValueKey
NtEnumerateValueKey
NtEnumerateKey
NtEnumerateKey
advapi32.dll
advapi32.dll
GetProcessHeap
GetProcessHeap
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
ntdll.dll
ntdll.dll
KWindows
KWindows
lsm.exe_476_rwx_00110000_00001000:
kernel32.dll
kernel32.dll
lsm.exe_476_rwx_00150000_00001000:
kernel32.dll
kernel32.dll
lsm.exe_476_rwx_00300000_00001000:
kernel32.dll
kernel32.dll
lsm.exe_476_rwx_00380000_00001000:
kernel32.dll
kernel32.dll
lsm.exe_476_rwx_003C0000_00001000:
kernel32.dll
kernel32.dll
lsm.exe_476_rwx_00720000_00001000:
kernel32.dll
kernel32.dll
lsm.exe_476_rwx_007A0000_00001000:
kernel32.dll
kernel32.dll
lsm.exe_476_rwx_00860000_00001000:
kernel32.dll
kernel32.dll
lsm.exe_476_rwx_00920000_00001000:
kernel32.dll
kernel32.dll
lsm.exe_476_rwx_00960000_00001000:
kernel32.dll
kernel32.dll
lsm.exe_476_rwx_009A0000_00001000:
kernel32.dll
kernel32.dll
lsm.exe_476_rwx_00A20000_00001000:
kernel32.dll
kernel32.dll
lsm.exe_476_rwx_00A60000_00001000:
kernel32.dll
kernel32.dll
lsm.exe_476_rwx_00BA0000_00001000:
kernel32.dll
kernel32.dll
lsm.exe_476_rwx_00C20000_00001000:
kernel32.dll
kernel32.dll
lsm.exe_476_rwx_00C60000_00001000:
kernel32.dll
kernel32.dll
lsm.exe_476_rwx_00CA0000_00001000:
kernel32.dll
kernel32.dll
lsm.exe_476_rwx_00CE0000_00001000:
kernel32.dll
kernel32.dll
lsm.exe_476_rwx_00D10000_00001000:
GetProcessHeap
GetProcessHeap
lsm.exe_476_rwx_00D20000_00001000:
kernel32.dll
kernel32.dll
lsm.exe_476_rwx_00D50000_00001000:
oleaut32.dll
oleaut32.dll
lsm.exe_476_rwx_00D70000_00001000:
oleaut32.dll
oleaut32.dll
lsm.exe_476_rwx_00DD0000_00001000:
oleaut32.dll
oleaut32.dll
lsm.exe_476_rwx_00E00000_00001000:
advapi32.dll
advapi32.dll
lsm.exe_476_rwx_00E40000_00001000:
advapi32.dll
advapi32.dll
lsm.exe_476_rwx_00E70000_00001000:
RegOpenKeyExA
RegOpenKeyExA
lsm.exe_476_rwx_00E80000_00001000:
advapi32.dll
advapi32.dll
lsm.exe_476_rwx_00EB0000_00001000:
RegCloseKey
RegCloseKey
lsm.exe_476_rwx_00EC0000_00001000:
advapi32.dll
advapi32.dll
lsm.exe_476_rwx_00EF0000_00001000:
kernel32.dll
kernel32.dll
lsm.exe_476_rwx_00F30000_00001000:
kernel32.dll
kernel32.dll
lsm.exe_476_rwx_00F70000_00001000:
kernel32.dll
kernel32.dll
lsm.exe_476_rwx_01000000_00001000:
kernel32.dll
kernel32.dll
lsm.exe_476_rwx_01040000_00001000:
kernel32.dll
kernel32.dll
lsm.exe_476_rwx_01080000_00001000:
kernel32.dll
kernel32.dll
lsm.exe_476_rwx_010C0000_00001000:
kernel32.dll
kernel32.dll
lsm.exe_476_rwx_01100000_00001000:
kernel32.dll
kernel32.dll
lsm.exe_476_rwx_01140000_00001000:
kernel32.dll
kernel32.dll
lsm.exe_476_rwx_01160000_00001000:
kernel32.dll
kernel32.dll
lsm.exe_476_rwx_011C0000_00001000:
kernel32.dll
kernel32.dll
lsm.exe_476_rwx_01200000_00001000:
kernel32.dll
kernel32.dll
lsm.exe_476_rwx_01240000_00001000:
kernel32.dll
kernel32.dll
lsm.exe_476_rwx_01280000_00001000:
kernel32.dll
kernel32.dll
lsm.exe_476_rwx_012C0000_00001000:
kernel32.dll
kernel32.dll
lsm.exe_476_rwx_01300000_00001000:
kernel32.dll
kernel32.dll
lsm.exe_476_rwx_01340000_00001000:
kernel32.dll
kernel32.dll
lsm.exe_476_rwx_01370000_00001000:
ntdll.dll
ntdll.dll
lsm.exe_476_rwx_013B0000_00001000:
ntdll.dll
ntdll.dll
lsm.exe_476_rwx_317E0000_00009000:
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
%x`~1
%x`~1
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
kernel32.dll
Ntdll.dll
Ntdll.dll
NtEnumerateValueKey
NtEnumerateValueKey
NtEnumerateKey
NtEnumerateKey
advapi32.dll
advapi32.dll
GetProcessHeap
GetProcessHeap
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
ntdll.dll
ntdll.dll
KWindows
KWindows
Dwm.exe_528_rwx_01040000_00001000:
kernel32.dll
kernel32.dll
Dwm.exe_528_rwx_010D0000_00001000:
kernel32.dll
kernel32.dll
Dwm.exe_528_rwx_01110000_00001000:
kernel32.dll
kernel32.dll
Dwm.exe_528_rwx_01620000_00001000:
kernel32.dll
kernel32.dll
Dwm.exe_528_rwx_01660000_00001000:
kernel32.dll
kernel32.dll
Dwm.exe_528_rwx_016A0000_00001000:
kernel32.dll
kernel32.dll
Dwm.exe_528_rwx_016E0000_00001000:
kernel32.dll
kernel32.dll
Dwm.exe_528_rwx_01720000_00001000:
kernel32.dll
kernel32.dll
Dwm.exe_528_rwx_01760000_00001000:
kernel32.dll
kernel32.dll
Dwm.exe_528_rwx_017E0000_00001000:
kernel32.dll
kernel32.dll
Dwm.exe_528_rwx_01820000_00001000:
kernel32.dll
kernel32.dll
Dwm.exe_528_rwx_01860000_00001000:
kernel32.dll
kernel32.dll
Dwm.exe_528_rwx_018A0000_00001000:
kernel32.dll
kernel32.dll
Dwm.exe_528_rwx_018E0000_00001000:
kernel32.dll
kernel32.dll
Dwm.exe_528_rwx_01920000_00001000:
kernel32.dll
kernel32.dll
Dwm.exe_528_rwx_01960000_00001000:
kernel32.dll
kernel32.dll
Dwm.exe_528_rwx_019A0000_00001000:
kernel32.dll
kernel32.dll
Dwm.exe_528_rwx_019E0000_00001000:
kernel32.dll
kernel32.dll
Dwm.exe_528_rwx_01A10000_00001000:
GetProcessHeap
GetProcessHeap
Dwm.exe_528_rwx_01A20000_00001000:
kernel32.dll
kernel32.dll
Dwm.exe_528_rwx_01A50000_00001000:
oleaut32.dll
oleaut32.dll
Dwm.exe_528_rwx_01AD0000_00001000:
oleaut32.dll
oleaut32.dll
Dwm.exe_528_rwx_01B10000_00001000:
oleaut32.dll
oleaut32.dll
Dwm.exe_528_rwx_01B40000_00001000:
advapi32.dll
advapi32.dll
Dwm.exe_528_rwx_01B80000_00001000:
advapi32.dll
advapi32.dll
Dwm.exe_528_rwx_01BB0000_00001000:
RegOpenKeyExA
RegOpenKeyExA
Dwm.exe_528_rwx_01BC0000_00001000:
advapi32.dll
advapi32.dll
Dwm.exe_528_rwx_01BF0000_00001000:
RegCloseKey
RegCloseKey
Dwm.exe_528_rwx_01C00000_00001000:
advapi32.dll
advapi32.dll
Dwm.exe_528_rwx_01C30000_00001000:
kernel32.dll
kernel32.dll
Dwm.exe_528_rwx_01CB0000_00001000:
kernel32.dll
kernel32.dll
Dwm.exe_528_rwx_01CF0000_00001000:
kernel32.dll
kernel32.dll
Dwm.exe_528_rwx_01D30000_00001000:
kernel32.dll
kernel32.dll
Dwm.exe_528_rwx_01D70000_00001000:
kernel32.dll
kernel32.dll
Dwm.exe_528_rwx_01DB0000_00001000:
kernel32.dll
kernel32.dll
Dwm.exe_528_rwx_01DF0000_00001000:
kernel32.dll
kernel32.dll
Dwm.exe_528_rwx_01E70000_00001000:
kernel32.dll
kernel32.dll
Dwm.exe_528_rwx_01EB0000_00001000:
kernel32.dll
kernel32.dll
Dwm.exe_528_rwx_01EF0000_00001000:
kernel32.dll
kernel32.dll
Dwm.exe_528_rwx_01F30000_00001000:
kernel32.dll
kernel32.dll
Dwm.exe_528_rwx_01F70000_00001000:
kernel32.dll
kernel32.dll
Dwm.exe_528_rwx_01FB0000_00001000:
kernel32.dll
kernel32.dll
Dwm.exe_528_rwx_01FF0000_00001000:
kernel32.dll
kernel32.dll
Dwm.exe_528_rwx_02030000_00001000:
kernel32.dll
kernel32.dll
Dwm.exe_528_rwx_02070000_00001000:
kernel32.dll
kernel32.dll
Dwm.exe_528_rwx_020B0000_00001000:
kernel32.dll
kernel32.dll
Dwm.exe_528_rwx_020E0000_00001000:
ntdll.dll
ntdll.dll
Dwm.exe_528_rwx_02120000_00001000:
ntdll.dll
ntdll.dll
Dwm.exe_528_rwx_318C0000_00009000:
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
kernel32.dll
Ntdll.dll
Ntdll.dll
NtEnumerateValueKey
NtEnumerateValueKey
NtEnumerateKey
NtEnumerateKey
advapi32.dll
advapi32.dll
GetProcessHeap
GetProcessHeap
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
ntdll.dll
ntdll.dll
KWindows
KWindows
svchost.exe_580_rwx_00160000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_580_rwx_00950000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_580_rwx_00970000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_580_rwx_009D0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_580_rwx_00B90000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_580_rwx_00C90000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_580_rwx_00D40000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_580_rwx_00ED0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_580_rwx_00F10000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_580_rwx_00F90000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_580_rwx_010D0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_580_rwx_01100000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_580_rwx_01190000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_580_rwx_011D0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_580_rwx_01210000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_580_rwx_01290000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_580_rwx_012D0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_580_rwx_012F0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_580_rwx_01340000_00001000:
GetProcessHeap
GetProcessHeap
svchost.exe_580_rwx_01350000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_580_rwx_01380000_00001000:
oleaut32.dll
oleaut32.dll
svchost.exe_580_rwx_013C0000_00001000:
oleaut32.dll
oleaut32.dll
svchost.exe_580_rwx_01400000_00001000:
oleaut32.dll
oleaut32.dll
svchost.exe_580_rwx_01430000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_580_rwx_01450000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_580_rwx_014A0000_00001000:
RegOpenKeyExA
RegOpenKeyExA
svchost.exe_580_rwx_014B0000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_580_rwx_014E0000_00001000:
RegCloseKey
RegCloseKey
svchost.exe_580_rwx_014F0000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_580_rwx_01520000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_580_rwx_01560000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_580_rwx_015A0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_580_rwx_015E0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_580_rwx_01620000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_580_rwx_01660000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_580_rwx_016A0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_580_rwx_016E0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_580_rwx_01720000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_580_rwx_01760000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_580_rwx_017A0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_580_rwx_017E0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_580_rwx_01820000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_580_rwx_01860000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_580_rwx_018A0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_580_rwx_018E0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_580_rwx_01920000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_580_rwx_01950000_00001000:
ntdll.dll
ntdll.dll
svchost.exe_580_rwx_01990000_00001000:
ntdll.dll
ntdll.dll
svchost.exe_580_rwx_317F0000_00009000:
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
kernel32.dll
Ntdll.dll
Ntdll.dll
NtEnumerateValueKey
NtEnumerateValueKey
NtEnumerateKey
NtEnumerateKey
advapi32.dll
advapi32.dll
GetProcessHeap
GetProcessHeap
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
ntdll.dll
ntdll.dll
KWindows
KWindows
svchost.exe_648_rwx_00380000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_648_rwx_003C0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_648_rwx_00400000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_648_rwx_00710000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_648_rwx_007D0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_648_rwx_00810000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_648_rwx_00A70000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_648_rwx_00AB0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_648_rwx_00B30000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_648_rwx_00BB0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_648_rwx_00BF0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_648_rwx_00D70000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_648_rwx_00DB0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_648_rwx_00E30000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_648_rwx_00E70000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_648_rwx_00EB0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_648_rwx_00EF0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_648_rwx_00F30000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_648_rwx_00F60000_00001000:
GetProcessHeap
GetProcessHeap
svchost.exe_648_rwx_00F70000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_648_rwx_00FA0000_00001000:
oleaut32.dll
oleaut32.dll
svchost.exe_648_rwx_00FE0000_00001000:
oleaut32.dll
oleaut32.dll
svchost.exe_648_rwx_01020000_00001000:
oleaut32.dll
oleaut32.dll
svchost.exe_648_rwx_01050000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_648_rwx_01090000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_648_rwx_010C0000_00001000:
RegOpenKeyExA
RegOpenKeyExA
svchost.exe_648_rwx_010D0000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_648_rwx_01100000_00001000:
RegCloseKey
RegCloseKey
svchost.exe_648_rwx_01110000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_648_rwx_01140000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_648_rwx_01170000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_648_rwx_011C0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_648_rwx_01200000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_648_rwx_01240000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_648_rwx_01280000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_648_rwx_012C0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_648_rwx_01300000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_648_rwx_01340000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_648_rwx_01380000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_648_rwx_013C0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_648_rwx_01400000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_648_rwx_01440000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_648_rwx_01480000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_648_rwx_014D0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_648_rwx_01500000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_648_rwx_01540000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_648_rwx_01570000_00001000:
ntdll.dll
ntdll.dll
svchost.exe_648_rwx_01590000_00001000:
ntdll.dll
ntdll.dll
svchost.exe_648_rwx_31800000_00009000:
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
kernel32.dll
Ntdll.dll
Ntdll.dll
NtEnumerateValueKey
NtEnumerateValueKey
NtEnumerateKey
NtEnumerateKey
advapi32.dll
advapi32.dll
GetProcessHeap
GetProcessHeap
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
ntdll.dll
ntdll.dll
KWindows
KWindows
svchost.exe_700_rwx_00730000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_700_rwx_00B00000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_700_rwx_00C50000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_700_rwx_00CD0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_700_rwx_00D90000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_700_rwx_00FE0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_700_rwx_01020000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_700_rwx_01060000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_700_rwx_011E0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_700_rwx_01220000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_700_rwx_01730000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_700_rwx_01EC0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_700_rwx_01F40000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_700_rwx_01FD0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_700_rwx_02010000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_700_rwx_02070000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_700_rwx_02110000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_700_rwx_02150000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_700_rwx_02180000_00001000:
GetProcessHeap
GetProcessHeap
svchost.exe_700_rwx_02190000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_700_rwx_021C0000_00001000:
oleaut32.dll
oleaut32.dll
svchost.exe_700_rwx_02200000_00001000:
oleaut32.dll
oleaut32.dll
svchost.exe_700_rwx_02240000_00001000:
oleaut32.dll
oleaut32.dll
svchost.exe_700_rwx_02270000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_700_rwx_022B0000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_700_rwx_02320000_00001000:
RegOpenKeyExA
RegOpenKeyExA
svchost.exe_700_rwx_02330000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_700_rwx_02360000_00001000:
RegCloseKey
RegCloseKey
svchost.exe_700_rwx_02370000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_700_rwx_023A0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_700_rwx_023E0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_700_rwx_02420000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_700_rwx_02460000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_700_rwx_024A0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_700_rwx_024E0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_700_rwx_02520000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_700_rwx_02560000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_700_rwx_025A0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_700_rwx_025E0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_700_rwx_02620000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_700_rwx_02660000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_700_rwx_026A0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_700_rwx_026E0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_700_rwx_02720000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_700_rwx_02750000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_700_rwx_027A0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_700_rwx_027D0000_00001000:
ntdll.dll
ntdll.dll
svchost.exe_700_rwx_02810000_00001000:
ntdll.dll
ntdll.dll
svchost.exe_700_rwx_31810000_00009000:
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
kernel32.dll
Ntdll.dll
Ntdll.dll
NtEnumerateValueKey
NtEnumerateValueKey
NtEnumerateKey
NtEnumerateKey
advapi32.dll
advapi32.dll
GetProcessHeap
GetProcessHeap
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
ntdll.dll
ntdll.dll
KWindows
KWindows
svchost.exe_820_rwx_005E0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_820_rwx_00660000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_820_rwx_00720000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_820_rwx_00770000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_820_rwx_00AC0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_820_rwx_00B40000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_820_rwx_00B80000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_820_rwx_00BC0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_820_rwx_00C00000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_820_rwx_00D80000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_820_rwx_00E40000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_820_rwx_00EC0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_820_rwx_00F00000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_820_rwx_00F80000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_820_rwx_01000000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_820_rwx_01050000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_820_rwx_01110000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_820_rwx_01150000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_820_rwx_011C0000_00001000:
GetProcessHeap
GetProcessHeap
svchost.exe_820_rwx_011D0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_820_rwx_01250000_00001000:
oleaut32.dll
oleaut32.dll
svchost.exe_820_rwx_01310000_00001000:
oleaut32.dll
oleaut32.dll
svchost.exe_820_rwx_01350000_00001000:
oleaut32.dll
oleaut32.dll
svchost.exe_820_rwx_01390000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_820_rwx_014E0000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_820_rwx_01510000_00001000:
RegOpenKeyExA
RegOpenKeyExA
svchost.exe_820_rwx_01670000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_820_rwx_016A0000_00001000:
RegCloseKey
RegCloseKey
svchost.exe_820_rwx_016B0000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_820_rwx_01800000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_820_rwx_01840000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_820_rwx_01880000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_820_rwx_01CE0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_820_rwx_01E20000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_820_rwx_01E60000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_820_rwx_01EA0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_820_rwx_01EE0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_820_rwx_01F20000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_820_rwx_01F60000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_820_rwx_01FA0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_820_rwx_01FE0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_820_rwx_02020000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_820_rwx_02060000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_820_rwx_020A0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_820_rwx_020E0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_820_rwx_02120000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_820_rwx_02150000_00001000:
ntdll.dll
ntdll.dll
svchost.exe_820_rwx_02190000_00001000:
ntdll.dll
ntdll.dll
svchost.exe_820_rwx_31820000_00009000:
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
kernel32.dll
Ntdll.dll
Ntdll.dll
NtEnumerateValueKey
NtEnumerateValueKey
NtEnumerateKey
NtEnumerateKey
advapi32.dll
advapi32.dll
GetProcessHeap
GetProcessHeap
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
ntdll.dll
ntdll.dll
KWindows
KWindows
svchost.exe_860_rwx_00630000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_860_rwx_00BF0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_860_rwx_00DE0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_860_rwx_00EE0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_860_rwx_00FA0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_860_rwx_01060000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_860_rwx_011A0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_860_rwx_011E0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_860_rwx_012A0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_860_rwx_013E0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_860_rwx_01460000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_860_rwx_016A0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_860_rwx_01930000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_860_rwx_019F0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_860_rwx_01AB0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_860_rwx_01BF0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_860_rwx_01C70000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_860_rwx_01D70000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_860_rwx_01DE0000_00001000:
GetProcessHeap
GetProcessHeap
svchost.exe_860_rwx_01DF0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_860_rwx_01E20000_00001000:
oleaut32.dll
oleaut32.dll
svchost.exe_860_rwx_01EA0000_00001000:
oleaut32.dll
oleaut32.dll
svchost.exe_860_rwx_01F60000_00001000:
oleaut32.dll
oleaut32.dll
svchost.exe_860_rwx_01F90000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_860_rwx_020D0000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_860_rwx_02100000_00001000:
RegOpenKeyExA
RegOpenKeyExA
svchost.exe_860_rwx_02110000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_860_rwx_02340000_00001000:
RegCloseKey
RegCloseKey
svchost.exe_860_rwx_02490000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_860_rwx_02500000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_860_rwx_027C0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_860_rwx_02900000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_860_rwx_02990000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_860_rwx_03150000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_860_rwx_035A0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_860_rwx_035D0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_860_rwx_03620000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_860_rwx_03660000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_860_rwx_036A0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_860_rwx_036E0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_860_rwx_03720000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_860_rwx_03760000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_860_rwx_037A0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_860_rwx_037F0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_860_rwx_03820000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_860_rwx_03860000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_860_rwx_03890000_00001000:
ntdll.dll
ntdll.dll
svchost.exe_860_rwx_038D0000_00001000:
ntdll.dll
ntdll.dll
svchost.exe_860_rwx_31830000_00009000:
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
kernel32.dll
Ntdll.dll
Ntdll.dll
NtEnumerateValueKey
NtEnumerateValueKey
NtEnumerateKey
NtEnumerateKey
advapi32.dll
advapi32.dll
GetProcessHeap
GetProcessHeap
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
ntdll.dll
ntdll.dll
KWindows
KWindows
svchost.exe_1032_rwx_00510000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1032_rwx_005D0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1032_rwx_00690000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1032_rwx_006D0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1032_rwx_00710000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1032_rwx_00750000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1032_rwx_00A60000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1032_rwx_00AA0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1032_rwx_00AE0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1032_rwx_00BF0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1032_rwx_00CB0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1032_rwx_00CF0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1032_rwx_00F80000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1032_rwx_01000000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1032_rwx_01080000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1032_rwx_01200000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1032_rwx_01240000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1032_rwx_01280000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1032_rwx_012B0000_00001000:
GetProcessHeap
GetProcessHeap
svchost.exe_1032_rwx_012C0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1032_rwx_01300000_00001000:
oleaut32.dll
oleaut32.dll
svchost.exe_1032_rwx_01340000_00001000:
oleaut32.dll
oleaut32.dll
svchost.exe_1032_rwx_01380000_00001000:
oleaut32.dll
oleaut32.dll
svchost.exe_1032_rwx_013F0000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_1032_rwx_01430000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_1032_rwx_01460000_00001000:
RegOpenKeyExA
RegOpenKeyExA
svchost.exe_1032_rwx_01470000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_1032_rwx_01490000_00001000:
RegCloseKey
RegCloseKey
svchost.exe_1032_rwx_014A0000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_1032_rwx_014E0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1032_rwx_01520000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1032_rwx_01560000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1032_rwx_015E0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1032_rwx_01620000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1032_rwx_01660000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1032_rwx_016A0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1032_rwx_016E0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1032_rwx_01720000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1032_rwx_01760000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1032_rwx_017A0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1032_rwx_017E0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1032_rwx_01800000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1032_rwx_01860000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1032_rwx_018A0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1032_rwx_018E0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1032_rwx_01920000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1032_rwx_01950000_00001000:
ntdll.dll
ntdll.dll
svchost.exe_1032_rwx_01990000_00001000:
ntdll.dll
ntdll.dll
svchost.exe_1032_rwx_31840000_00009000:
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
kernel32.dll
Ntdll.dll
Ntdll.dll
NtEnumerateValueKey
NtEnumerateValueKey
NtEnumerateKey
NtEnumerateKey
advapi32.dll
advapi32.dll
GetProcessHeap
GetProcessHeap
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
ntdll.dll
ntdll.dll
KWindows
KWindows
svchost.exe_1132_rwx_00F50000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1132_rwx_010E0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1132_rwx_01140000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1132_rwx_01260000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1132_rwx_013F0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1132_rwx_01530000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1132_rwx_01570000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1132_rwx_015F0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1132_rwx_02830000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1132_rwx_02930000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1132_rwx_02970000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1132_rwx_029B0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1132_rwx_029F0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1132_rwx_02B70000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1132_rwx_02BB0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1132_rwx_02BF0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1132_rwx_02C30000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1132_rwx_02C70000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1132_rwx_02CA0000_00001000:
GetProcessHeap
GetProcessHeap
svchost.exe_1132_rwx_02CB0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1132_rwx_02CE0000_00001000:
oleaut32.dll
oleaut32.dll
svchost.exe_1132_rwx_02D20000_00001000:
oleaut32.dll
oleaut32.dll
svchost.exe_1132_rwx_02D60000_00001000:
oleaut32.dll
oleaut32.dll
svchost.exe_1132_rwx_02D90000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_1132_rwx_02DD0000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_1132_rwx_02E00000_00001000:
RegOpenKeyExA
RegOpenKeyExA
svchost.exe_1132_rwx_02E10000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_1132_rwx_02E40000_00001000:
RegCloseKey
RegCloseKey
svchost.exe_1132_rwx_02E50000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_1132_rwx_02E80000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1132_rwx_02EC0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1132_rwx_02F00000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1132_rwx_02F20000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1132_rwx_02F80000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1132_rwx_02FC0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1132_rwx_03000000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1132_rwx_03040000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1132_rwx_03080000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1132_rwx_030C0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1132_rwx_03100000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1132_rwx_03140000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1132_rwx_03180000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1132_rwx_031C0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1132_rwx_03200000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1132_rwx_03240000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1132_rwx_03280000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1132_rwx_032B0000_00001000:
ntdll.dll
ntdll.dll
svchost.exe_1132_rwx_032F0000_00001000:
ntdll.dll
ntdll.dll
svchost.exe_1132_rwx_31850000_00009000:
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
kernel32.dll
Ntdll.dll
Ntdll.dll
NtEnumerateValueKey
NtEnumerateValueKey
NtEnumerateKey
NtEnumerateKey
advapi32.dll
advapi32.dll
GetProcessHeap
GetProcessHeap
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
ntdll.dll
ntdll.dll
KWindows
KWindows
spoolsv.exe_1244_rwx_00460000_00001000:
kernel32.dll
kernel32.dll
spoolsv.exe_1244_rwx_006C0000_00001000:
kernel32.dll
kernel32.dll
spoolsv.exe_1244_rwx_00D20000_00001000:
kernel32.dll
kernel32.dll
spoolsv.exe_1244_rwx_01A70000_00001000:
kernel32.dll
kernel32.dll
spoolsv.exe_1244_rwx_01C30000_00001000:
kernel32.dll
kernel32.dll
spoolsv.exe_1244_rwx_01CB0000_00001000:
kernel32.dll
kernel32.dll
spoolsv.exe_1244_rwx_01D50000_00001000:
kernel32.dll
kernel32.dll
spoolsv.exe_1244_rwx_01E80000_00001000:
kernel32.dll
kernel32.dll
spoolsv.exe_1244_rwx_02440000_00001000:
kernel32.dll
kernel32.dll
spoolsv.exe_1244_rwx_02520000_00001000:
kernel32.dll
kernel32.dll
spoolsv.exe_1244_rwx_025A0000_00001000:
kernel32.dll
kernel32.dll
spoolsv.exe_1244_rwx_025E0000_00001000:
kernel32.dll
kernel32.dll
spoolsv.exe_1244_rwx_02610000_00001000:
kernel32.dll
kernel32.dll
spoolsv.exe_1244_rwx_02660000_00001000:
kernel32.dll
kernel32.dll
spoolsv.exe_1244_rwx_026F0000_00001000:
kernel32.dll
kernel32.dll
spoolsv.exe_1244_rwx_02730000_00001000:
kernel32.dll
kernel32.dll
spoolsv.exe_1244_rwx_027B0000_00001000:
kernel32.dll
kernel32.dll
spoolsv.exe_1244_rwx_02830000_00001000:
GetProcessHeap
GetProcessHeap
spoolsv.exe_1244_rwx_02840000_00001000:
kernel32.dll
kernel32.dll
spoolsv.exe_1244_rwx_02870000_00001000:
kernel32.dll
kernel32.dll
spoolsv.exe_1244_rwx_028A0000_00001000:
oleaut32.dll
oleaut32.dll
spoolsv.exe_1244_rwx_028E0000_00001000:
oleaut32.dll
oleaut32.dll
spoolsv.exe_1244_rwx_02920000_00001000:
oleaut32.dll
oleaut32.dll
spoolsv.exe_1244_rwx_02950000_00001000:
advapi32.dll
advapi32.dll
spoolsv.exe_1244_rwx_02990000_00001000:
advapi32.dll
advapi32.dll
spoolsv.exe_1244_rwx_029A0000_00001000:
RegOpenKeyExA
RegOpenKeyExA
spoolsv.exe_1244_rwx_029B0000_00001000:
advapi32.dll
advapi32.dll
spoolsv.exe_1244_rwx_02A00000_00001000:
RegCloseKey
RegCloseKey
spoolsv.exe_1244_rwx_02A10000_00001000:
advapi32.dll
advapi32.dll
spoolsv.exe_1244_rwx_02A40000_00001000:
kernel32.dll
kernel32.dll
spoolsv.exe_1244_rwx_02A80000_00001000:
kernel32.dll
kernel32.dll
spoolsv.exe_1244_rwx_02AC0000_00001000:
kernel32.dll
kernel32.dll
spoolsv.exe_1244_rwx_02B00000_00001000:
kernel32.dll
kernel32.dll
spoolsv.exe_1244_rwx_02B40000_00001000:
kernel32.dll
kernel32.dll
spoolsv.exe_1244_rwx_02B80000_00001000:
kernel32.dll
kernel32.dll
spoolsv.exe_1244_rwx_02BC0000_00001000:
kernel32.dll
kernel32.dll
spoolsv.exe_1244_rwx_02C00000_00001000:
kernel32.dll
kernel32.dll
spoolsv.exe_1244_rwx_02C40000_00001000:
kernel32.dll
kernel32.dll
spoolsv.exe_1244_rwx_02C80000_00001000:
kernel32.dll
kernel32.dll
spoolsv.exe_1244_rwx_02CC0000_00001000:
kernel32.dll
kernel32.dll
spoolsv.exe_1244_rwx_02CF0000_00001000:
kernel32.dll
kernel32.dll
spoolsv.exe_1244_rwx_02D40000_00001000:
kernel32.dll
kernel32.dll
spoolsv.exe_1244_rwx_02D80000_00001000:
kernel32.dll
kernel32.dll
spoolsv.exe_1244_rwx_02DC0000_00001000:
kernel32.dll
kernel32.dll
spoolsv.exe_1244_rwx_02E10000_00001000:
kernel32.dll
kernel32.dll
spoolsv.exe_1244_rwx_02E40000_00001000:
kernel32.dll
kernel32.dll
spoolsv.exe_1244_rwx_02E70000_00001000:
ntdll.dll
ntdll.dll
spoolsv.exe_1244_rwx_02EA0000_00001000:
ntdll.dll
ntdll.dll
spoolsv.exe_1244_rwx_31860000_00009000:
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
kernel32.dll
Ntdll.dll
Ntdll.dll
NtEnumerateValueKey
NtEnumerateValueKey
NtEnumerateKey
NtEnumerateKey
advapi32.dll
advapi32.dll
GetProcessHeap
GetProcessHeap
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
ntdll.dll
ntdll.dll
KWindows
KWindows
svchost.exe_1280_rwx_00550000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1280_rwx_00610000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1280_rwx_00690000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1280_rwx_006D0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1280_rwx_009E0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1280_rwx_00AF0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1280_rwx_00CB0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1280_rwx_00D30000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1280_rwx_00DB0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1280_rwx_00F30000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1280_rwx_00FF0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1280_rwx_011B0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1280_rwx_01240000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1280_rwx_01280000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1280_rwx_01300000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1280_rwx_01340000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1280_rwx_01380000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1280_rwx_013C0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1280_rwx_013F0000_00001000:
GetProcessHeap
GetProcessHeap
svchost.exe_1280_rwx_01400000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1280_rwx_01470000_00001000:
oleaut32.dll
oleaut32.dll
svchost.exe_1280_rwx_014B0000_00001000:
oleaut32.dll
oleaut32.dll
svchost.exe_1280_rwx_014F0000_00001000:
oleaut32.dll
oleaut32.dll
svchost.exe_1280_rwx_01520000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_1280_rwx_01560000_00001000:
RegOpenKeyExA
RegOpenKeyExA
svchost.exe_1280_rwx_01570000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_1280_rwx_015A0000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_1280_rwx_015D0000_00001000:
RegCloseKey
RegCloseKey
svchost.exe_1280_rwx_015E0000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_1280_rwx_01650000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1280_rwx_01690000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1280_rwx_016D0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1280_rwx_01710000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1280_rwx_01C80000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1280_rwx_01CC0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1280_rwx_01D00000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1280_rwx_01D40000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1280_rwx_01D80000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1280_rwx_01DD0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1280_rwx_01E00000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1280_rwx_01E40000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1280_rwx_01E80000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1280_rwx_01EC0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1280_rwx_01F00000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1280_rwx_01F40000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1280_rwx_01F80000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1280_rwx_01FB0000_00001000:
ntdll.dll
ntdll.dll
svchost.exe_1280_rwx_025F0000_00001000:
ntdll.dll
ntdll.dll
svchost.exe_1280_rwx_31870000_00009000:
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
kernel32.dll
Ntdll.dll
Ntdll.dll
NtEnumerateValueKey
NtEnumerateValueKey
NtEnumerateKey
NtEnumerateKey
advapi32.dll
advapi32.dll
GetProcessHeap
GetProcessHeap
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
ntdll.dll
ntdll.dll
KWindows
KWindows
TPAutoConnSvc.exe_1624_rwx_00810000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnSvc.exe_1624_rwx_00850000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnSvc.exe_1624_rwx_00B70000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnSvc.exe_1624_rwx_00FC0000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnSvc.exe_1624_rwx_01000000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnSvc.exe_1624_rwx_01040000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnSvc.exe_1624_rwx_01080000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnSvc.exe_1624_rwx_011D0000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnSvc.exe_1624_rwx_01210000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnSvc.exe_1624_rwx_01250000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnSvc.exe_1624_rwx_01790000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnSvc.exe_1624_rwx_017D0000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnSvc.exe_1624_rwx_01810000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnSvc.exe_1624_rwx_01850000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnSvc.exe_1624_rwx_018A0000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnSvc.exe_1624_rwx_018E0000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnSvc.exe_1624_rwx_01920000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnSvc.exe_1624_rwx_01950000_00001000:
GetProcessHeap
GetProcessHeap
TPAutoConnSvc.exe_1624_rwx_01960000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnSvc.exe_1624_rwx_019A0000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnSvc.exe_1624_rwx_019E0000_00001000:
oleaut32.dll
oleaut32.dll
TPAutoConnSvc.exe_1624_rwx_01A20000_00001000:
oleaut32.dll
oleaut32.dll
TPAutoConnSvc.exe_1624_rwx_01A50000_00001000:
advapi32.dll
advapi32.dll
TPAutoConnSvc.exe_1624_rwx_01A90000_00001000:
advapi32.dll
advapi32.dll
TPAutoConnSvc.exe_1624_rwx_01AC0000_00001000:
RegOpenKeyExA
RegOpenKeyExA
TPAutoConnSvc.exe_1624_rwx_01AD0000_00001000:
oleaut32.dll
oleaut32.dll
TPAutoConnSvc.exe_1624_rwx_01B00000_00001000:
RegCloseKey
RegCloseKey
TPAutoConnSvc.exe_1624_rwx_01B10000_00001000:
advapi32.dll
advapi32.dll
TPAutoConnSvc.exe_1624_rwx_01B40000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnSvc.exe_1624_rwx_01B80000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnSvc.exe_1624_rwx_01BC0000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnSvc.exe_1624_rwx_01C00000_00001000:
advapi32.dll
advapi32.dll
TPAutoConnSvc.exe_1624_rwx_01C40000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnSvc.exe_1624_rwx_01C80000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnSvc.exe_1624_rwx_01CC0000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnSvc.exe_1624_rwx_01D00000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnSvc.exe_1624_rwx_01D30000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnSvc.exe_1624_rwx_01D70000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnSvc.exe_1624_rwx_01DB0000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnSvc.exe_1624_rwx_01DF0000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnSvc.exe_1624_rwx_01E30000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnSvc.exe_1624_rwx_01E70000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnSvc.exe_1624_rwx_01EB0000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnSvc.exe_1624_rwx_01EF0000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnSvc.exe_1624_rwx_01F30000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnSvc.exe_1624_rwx_01F60000_00001000:
ntdll.dll
ntdll.dll
TPAutoConnSvc.exe_1624_rwx_01FB0000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnSvc.exe_1624_rwx_020E0000_00001000:
ntdll.dll
ntdll.dll
TPAutoConnSvc.exe_1624_rwx_31890000_00009000:
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
kernel32.dll
Ntdll.dll
Ntdll.dll
NtEnumerateValueKey
NtEnumerateValueKey
NtEnumerateKey
NtEnumerateKey
advapi32.dll
advapi32.dll
GetProcessHeap
GetProcessHeap
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
ntdll.dll
ntdll.dll
KWindows
KWindows
svchost.exe_1736_rwx_001D0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1736_rwx_002A0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1736_rwx_00420000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1736_rwx_00460000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1736_rwx_00770000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1736_rwx_00840000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1736_rwx_00870000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1736_rwx_00BD0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1736_rwx_00C10000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1736_rwx_00C50000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1736_rwx_00C90000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1736_rwx_00CD0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1736_rwx_00D10000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1736_rwx_00D50000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1736_rwx_00D90000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1736_rwx_00DD0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1736_rwx_00E10000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1736_rwx_00E40000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1736_rwx_00E80000_00001000:
GetProcessHeap
GetProcessHeap
svchost.exe_1736_rwx_00E90000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1736_rwx_00EC0000_00001000:
oleaut32.dll
oleaut32.dll
svchost.exe_1736_rwx_00F00000_00001000:
oleaut32.dll
oleaut32.dll
svchost.exe_1736_rwx_00F40000_00001000:
oleaut32.dll
oleaut32.dll
svchost.exe_1736_rwx_00F70000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_1736_rwx_00FB0000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_1736_rwx_00FE0000_00001000:
RegOpenKeyExA
RegOpenKeyExA
svchost.exe_1736_rwx_00FF0000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_1736_rwx_01020000_00001000:
RegCloseKey
RegCloseKey
svchost.exe_1736_rwx_01030000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_1736_rwx_01060000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1736_rwx_010A0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1736_rwx_010C0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1736_rwx_01120000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1736_rwx_01160000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1736_rwx_011A0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1736_rwx_011E0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1736_rwx_01220000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1736_rwx_01260000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1736_rwx_012A0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1736_rwx_012E0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1736_rwx_01320000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1736_rwx_01360000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1736_rwx_013A0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1736_rwx_013E0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1736_rwx_01420000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1736_rwx_01460000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_1736_rwx_01490000_00001000:
ntdll.dll
ntdll.dll
svchost.exe_1736_rwx_014C0000_00001000:
ntdll.dll
ntdll.dll
svchost.exe_1736_rwx_318A0000_00009000:
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
kernel32.dll
Ntdll.dll
Ntdll.dll
NtEnumerateValueKey
NtEnumerateValueKey
NtEnumerateKey
NtEnumerateKey
advapi32.dll
advapi32.dll
GetProcessHeap
GetProcessHeap
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
ntdll.dll
ntdll.dll
KWindows
KWindows
TPAutoConnect.exe_2068_rwx_00260000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnect.exe_2068_rwx_00446000_00001000:
CCmdTarget
CCmdTarget
t%*.*f
t%*.*f
TPAutoConnect.exe_2068_rwx_00580000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnect.exe_2068_rwx_012E0000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnect.exe_2068_rwx_01320000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnect.exe_2068_rwx_01360000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnect.exe_2068_rwx_013A0000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnect.exe_2068_rwx_013F0000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnect.exe_2068_rwx_01430000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnect.exe_2068_rwx_01B50000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnect.exe_2068_rwx_01B90000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnect.exe_2068_rwx_01BD0000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnect.exe_2068_rwx_01C10000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnect.exe_2068_rwx_01C60000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnect.exe_2068_rwx_01DE0000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnect.exe_2068_rwx_01F30000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnect.exe_2068_rwx_021B0000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnect.exe_2068_rwx_021F0000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnect.exe_2068_rwx_02230000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnect.exe_2068_rwx_02260000_00001000:
GetProcessHeap
GetProcessHeap
TPAutoConnect.exe_2068_rwx_02270000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnect.exe_2068_rwx_022A0000_00001000:
oleaut32.dll
oleaut32.dll
TPAutoConnect.exe_2068_rwx_023E0000_00001000:
oleaut32.dll
oleaut32.dll
TPAutoConnect.exe_2068_rwx_02420000_00001000:
oleaut32.dll
oleaut32.dll
TPAutoConnect.exe_2068_rwx_02450000_00001000:
advapi32.dll
advapi32.dll
TPAutoConnect.exe_2068_rwx_02590000_00001000:
advapi32.dll
advapi32.dll
TPAutoConnect.exe_2068_rwx_025C0000_00001000:
RegOpenKeyExA
RegOpenKeyExA
TPAutoConnect.exe_2068_rwx_025D0000_00001000:
advapi32.dll
advapi32.dll
TPAutoConnect.exe_2068_rwx_02600000_00001000:
RegCloseKey
RegCloseKey
TPAutoConnect.exe_2068_rwx_02610000_00001000:
advapi32.dll
advapi32.dll
TPAutoConnect.exe_2068_rwx_02640000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnect.exe_2068_rwx_02780000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnect.exe_2068_rwx_027C0000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnect.exe_2068_rwx_02800000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnect.exe_2068_rwx_02840000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnect.exe_2068_rwx_02880000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnect.exe_2068_rwx_028C0000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnect.exe_2068_rwx_02900000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnect.exe_2068_rwx_02940000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnect.exe_2068_rwx_02980000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnect.exe_2068_rwx_029C0000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnect.exe_2068_rwx_02A00000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnect.exe_2068_rwx_02A40000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnect.exe_2068_rwx_02A80000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnect.exe_2068_rwx_02AC0000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnect.exe_2068_rwx_02B00000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnect.exe_2068_rwx_02B40000_00001000:
kernel32.dll
kernel32.dll
TPAutoConnect.exe_2068_rwx_02B70000_00001000:
ntdll.dll
ntdll.dll
TPAutoConnect.exe_2068_rwx_02CB0000_00001000:
ntdll.dll
ntdll.dll
TPAutoConnect.exe_2068_rwx_31900000_00009000:
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
kernel32.dll
Ntdll.dll
Ntdll.dll
NtEnumerateValueKey
NtEnumerateValueKey
NtEnumerateKey
NtEnumerateKey
advapi32.dll
advapi32.dll
GetProcessHeap
GetProcessHeap
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
ntdll.dll
ntdll.dll
KWindows
KWindows
TPAutoConnect.exe_2068_rwx_4104B000_00001000:
inflate 1.1.3 Copyright 1995-1998 Mark Adler
inflate 1.1.3 Copyright 1995-1998 Mark Adler
Standard TCP/IP Port
Standard TCP/IP Port
AddPort
AddPort
DeletePort
DeletePort
%*.*f
%*.*f
conhost.exe_2076_rwx_000D0000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_2076_rwx_00110000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_2076_rwx_00220000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_2076_rwx_00260000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_2076_rwx_002B0000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_2076_rwx_00500000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_2076_rwx_00580000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_2076_rwx_005C0000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_2076_rwx_00600000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_2076_rwx_00950000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_2076_rwx_00990000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_2076_rwx_009D0000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_2076_rwx_00A10000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_2076_rwx_00A50000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_2076_rwx_00AD0000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_2076_rwx_01760000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_2076_rwx_017A0000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_2076_rwx_017E0000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_2076_rwx_01810000_00001000:
GetProcessHeap
GetProcessHeap
conhost.exe_2076_rwx_01820000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_2076_rwx_01850000_00001000:
oleaut32.dll
oleaut32.dll
conhost.exe_2076_rwx_01890000_00001000:
oleaut32.dll
oleaut32.dll
conhost.exe_2076_rwx_01910000_00001000:
oleaut32.dll
oleaut32.dll
conhost.exe_2076_rwx_01940000_00001000:
advapi32.dll
advapi32.dll
conhost.exe_2076_rwx_01980000_00001000:
advapi32.dll
advapi32.dll
conhost.exe_2076_rwx_019B0000_00001000:
RegOpenKeyExA
RegOpenKeyExA
conhost.exe_2076_rwx_019C0000_00001000:
advapi32.dll
advapi32.dll
conhost.exe_2076_rwx_019F0000_00001000:
RegCloseKey
RegCloseKey
conhost.exe_2076_rwx_01A00000_00001000:
advapi32.dll
advapi32.dll
conhost.exe_2076_rwx_01A30000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_2076_rwx_01AB0000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_2076_rwx_01AF0000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_2076_rwx_01B30000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_2076_rwx_01BB0000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_2076_rwx_01BF0000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_2076_rwx_01C30000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_2076_rwx_01C70000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_2076_rwx_01CB0000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_2076_rwx_01CF0000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_2076_rwx_01D30000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_2076_rwx_01D70000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_2076_rwx_01DB0000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_2076_rwx_01DF0000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_2076_rwx_01E30000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_2076_rwx_01E70000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_2076_rwx_01EB0000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_2076_rwx_01EE0000_00001000:
ntdll.dll
ntdll.dll
conhost.exe_2076_rwx_01F20000_00001000:
ntdll.dll
ntdll.dll
conhost.exe_2076_rwx_31910000_00009000:
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
kernel32.dll
Ntdll.dll
Ntdll.dll
NtEnumerateValueKey
NtEnumerateValueKey
NtEnumerateKey
NtEnumerateKey
advapi32.dll
advapi32.dll
GetProcessHeap
GetProcessHeap
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
ntdll.dll
ntdll.dll
KWindows
KWindows
SearchIndexer.exe_2136_rwx_033A0000_00001000:
kernel32.dll
kernel32.dll
SearchIndexer.exe_2136_rwx_033F0000_00001000:
kernel32.dll
kernel32.dll
SearchIndexer.exe_2136_rwx_03470000_00001000:
kernel32.dll
kernel32.dll
SearchIndexer.exe_2136_rwx_034F0000_00001000:
kernel32.dll
kernel32.dll
SearchIndexer.exe_2136_rwx_03570000_00001000:
kernel32.dll
kernel32.dll
SearchIndexer.exe_2136_rwx_035B0000_00001000:
kernel32.dll
kernel32.dll
SearchIndexer.exe_2136_rwx_035F0000_00001000:
kernel32.dll
kernel32.dll
SearchIndexer.exe_2136_rwx_03A40000_00001000:
kernel32.dll
kernel32.dll
SearchIndexer.exe_2136_rwx_03AC0000_00001000:
kernel32.dll
kernel32.dll
SearchIndexer.exe_2136_rwx_03B00000_00001000:
kernel32.dll
kernel32.dll
SearchIndexer.exe_2136_rwx_03B40000_00001000:
kernel32.dll
kernel32.dll
SearchIndexer.exe_2136_rwx_03B80000_00001000:
kernel32.dll
kernel32.dll
SearchIndexer.exe_2136_rwx_03BC0000_00001000:
kernel32.dll
kernel32.dll
SearchIndexer.exe_2136_rwx_03C00000_00001000:
kernel32.dll
kernel32.dll
SearchIndexer.exe_2136_rwx_03C50000_00001000:
kernel32.dll
kernel32.dll
SearchIndexer.exe_2136_rwx_03C80000_00001000:
kernel32.dll
kernel32.dll
SearchIndexer.exe_2136_rwx_03CC0000_00001000:
kernel32.dll
kernel32.dll
SearchIndexer.exe_2136_rwx_03D00000_00001000:
kernel32.dll
kernel32.dll
SearchIndexer.exe_2136_rwx_03D30000_00001000:
GetProcessHeap
GetProcessHeap
SearchIndexer.exe_2136_rwx_03D40000_00001000:
kernel32.dll
kernel32.dll
SearchIndexer.exe_2136_rwx_03D70000_00001000:
oleaut32.dll
oleaut32.dll
SearchIndexer.exe_2136_rwx_03DB0000_00001000:
oleaut32.dll
oleaut32.dll
SearchIndexer.exe_2136_rwx_03DF0000_00001000:
oleaut32.dll
oleaut32.dll
SearchIndexer.exe_2136_rwx_03E20000_00001000:
advapi32.dll
advapi32.dll
SearchIndexer.exe_2136_rwx_03E50000_00001000:
RegOpenKeyExA
RegOpenKeyExA
SearchIndexer.exe_2136_rwx_03E60000_00001000:
advapi32.dll
advapi32.dll
SearchIndexer.exe_2136_rwx_03EA0000_00001000:
advapi32.dll
advapi32.dll
SearchIndexer.exe_2136_rwx_03ED0000_00001000:
RegCloseKey
RegCloseKey
SearchIndexer.exe_2136_rwx_03EE0000_00001000:
advapi32.dll
advapi32.dll
SearchIndexer.exe_2136_rwx_03F10000_00001000:
kernel32.dll
kernel32.dll
SearchIndexer.exe_2136_rwx_03F50000_00001000:
kernel32.dll
kernel32.dll
SearchIndexer.exe_2136_rwx_03F90000_00001000:
kernel32.dll
kernel32.dll
SearchIndexer.exe_2136_rwx_03FD0000_00001000:
kernel32.dll
kernel32.dll
SearchIndexer.exe_2136_rwx_04010000_00001000:
kernel32.dll
kernel32.dll
SearchIndexer.exe_2136_rwx_04050000_00001000:
kernel32.dll
kernel32.dll
SearchIndexer.exe_2136_rwx_04090000_00001000:
kernel32.dll
kernel32.dll
SearchIndexer.exe_2136_rwx_040D0000_00001000:
kernel32.dll
kernel32.dll
SearchIndexer.exe_2136_rwx_04110000_00001000:
kernel32.dll
kernel32.dll
SearchIndexer.exe_2136_rwx_04150000_00001000:
kernel32.dll
kernel32.dll
SearchIndexer.exe_2136_rwx_04190000_00001000:
kernel32.dll
kernel32.dll
SearchIndexer.exe_2136_rwx_041D0000_00001000:
kernel32.dll
kernel32.dll
SearchIndexer.exe_2136_rwx_04220000_00001000:
kernel32.dll
kernel32.dll
SearchIndexer.exe_2136_rwx_04250000_00001000:
kernel32.dll
kernel32.dll
SearchIndexer.exe_2136_rwx_04290000_00001000:
kernel32.dll
kernel32.dll
SearchIndexer.exe_2136_rwx_042D0000_00001000:
kernel32.dll
kernel32.dll
SearchIndexer.exe_2136_rwx_04310000_00001000:
kernel32.dll
kernel32.dll
SearchIndexer.exe_2136_rwx_04340000_00001000:
ntdll.dll
ntdll.dll
SearchIndexer.exe_2136_rwx_04380000_00001000:
ntdll.dll
ntdll.dll
SearchIndexer.exe_2136_rwx_31920000_00009000:
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
kernel32.dll
Ntdll.dll
Ntdll.dll
NtEnumerateValueKey
NtEnumerateValueKey
NtEnumerateKey
NtEnumerateKey
advapi32.dll
advapi32.dll
GetProcessHeap
GetProcessHeap
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
ntdll.dll
ntdll.dll
KWindows
KWindows
wmiprvse.exe_2360_rwx_00650000_00001000:
kernel32.dll
kernel32.dll
wmiprvse.exe_2360_rwx_006D0000_00001000:
kernel32.dll
kernel32.dll
wmiprvse.exe_2360_rwx_00A30000_00001000:
kernel32.dll
kernel32.dll
wmiprvse.exe_2360_rwx_00C10000_00001000:
kernel32.dll
kernel32.dll
wmiprvse.exe_2360_rwx_00D10000_00001000:
kernel32.dll
kernel32.dll
wmiprvse.exe_2360_rwx_00D50000_00001000:
kernel32.dll
kernel32.dll
wmiprvse.exe_2360_rwx_00DD0000_00001000:
kernel32.dll
kernel32.dll
wmiprvse.exe_2360_rwx_00E10000_00001000:
kernel32.dll
kernel32.dll
wmiprvse.exe_2360_rwx_00E50000_00001000:
kernel32.dll
kernel32.dll
wmiprvse.exe_2360_rwx_00E90000_00001000:
kernel32.dll
kernel32.dll
wmiprvse.exe_2360_rwx_00EC0000_00001000:
kernel32.dll
kernel32.dll
wmiprvse.exe_2360_rwx_00F10000_00001000:
kernel32.dll
kernel32.dll
wmiprvse.exe_2360_rwx_01750000_00001000:
kernel32.dll
kernel32.dll
wmiprvse.exe_2360_rwx_01790000_00001000:
kernel32.dll
kernel32.dll
wmiprvse.exe_2360_rwx_017D0000_00001000:
kernel32.dll
kernel32.dll
wmiprvse.exe_2360_rwx_01810000_00001000:
kernel32.dll
kernel32.dll
wmiprvse.exe_2360_rwx_01850000_00001000:
kernel32.dll
kernel32.dll
wmiprvse.exe_2360_rwx_01890000_00001000:
kernel32.dll
kernel32.dll
wmiprvse.exe_2360_rwx_018C0000_00001000:
GetProcessHeap
GetProcessHeap
wmiprvse.exe_2360_rwx_018D0000_00001000:
kernel32.dll
kernel32.dll
wmiprvse.exe_2360_rwx_01900000_00001000:
oleaut32.dll
oleaut32.dll
wmiprvse.exe_2360_rwx_01940000_00001000:
oleaut32.dll
oleaut32.dll
wmiprvse.exe_2360_rwx_01980000_00001000:
oleaut32.dll
oleaut32.dll
wmiprvse.exe_2360_rwx_019B0000_00001000:
advapi32.dll
advapi32.dll
wmiprvse.exe_2360_rwx_019F0000_00001000:
advapi32.dll
advapi32.dll
wmiprvse.exe_2360_rwx_01A20000_00001000:
RegOpenKeyExA
RegOpenKeyExA
wmiprvse.exe_2360_rwx_01A30000_00001000:
advapi32.dll
advapi32.dll
wmiprvse.exe_2360_rwx_01A60000_00001000:
RegCloseKey
RegCloseKey
wmiprvse.exe_2360_rwx_01A70000_00001000:
advapi32.dll
advapi32.dll
wmiprvse.exe_2360_rwx_01AA0000_00001000:
kernel32.dll
kernel32.dll
wmiprvse.exe_2360_rwx_01AE0000_00001000:
kernel32.dll
kernel32.dll
wmiprvse.exe_2360_rwx_01B20000_00001000:
kernel32.dll
kernel32.dll
wmiprvse.exe_2360_rwx_01B50000_00001000:
kernel32.dll
kernel32.dll
wmiprvse.exe_2360_rwx_01BA0000_00001000:
kernel32.dll
kernel32.dll
wmiprvse.exe_2360_rwx_01BE0000_00001000:
kernel32.dll
kernel32.dll
wmiprvse.exe_2360_rwx_01C20000_00001000:
kernel32.dll
kernel32.dll
wmiprvse.exe_2360_rwx_01C60000_00001000:
kernel32.dll
kernel32.dll
wmiprvse.exe_2360_rwx_01CA0000_00001000:
kernel32.dll
kernel32.dll
wmiprvse.exe_2360_rwx_01CE0000_00001000:
kernel32.dll
kernel32.dll
wmiprvse.exe_2360_rwx_01D20000_00001000:
kernel32.dll
kernel32.dll
wmiprvse.exe_2360_rwx_01D60000_00001000:
kernel32.dll
kernel32.dll
wmiprvse.exe_2360_rwx_01DA0000_00001000:
kernel32.dll
kernel32.dll
wmiprvse.exe_2360_rwx_01DE0000_00001000:
kernel32.dll
kernel32.dll
wmiprvse.exe_2360_rwx_01E20000_00001000:
kernel32.dll
kernel32.dll
wmiprvse.exe_2360_rwx_01E70000_00001000:
kernel32.dll
kernel32.dll
wmiprvse.exe_2360_rwx_01EA0000_00001000:
kernel32.dll
kernel32.dll
wmiprvse.exe_2360_rwx_01ED0000_00001000:
ntdll.dll
ntdll.dll
wmiprvse.exe_2360_rwx_01F10000_00001000:
ntdll.dll
ntdll.dll
wmiprvse.exe_2360_rwx_319D0000_00009000:
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
kernel32.dll
Ntdll.dll
Ntdll.dll
NtEnumerateValueKey
NtEnumerateValueKey
NtEnumerateKey
NtEnumerateKey
advapi32.dll
advapi32.dll
GetProcessHeap
GetProcessHeap
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
ntdll.dll
ntdll.dll
KWindows
KWindows
svchost.exe_2884_rwx_00210000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_2884_rwx_006C0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_2884_rwx_00700000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_2884_rwx_00740000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_2884_rwx_007C0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_2884_rwx_00800000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_2884_rwx_013C0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_2884_rwx_01440000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_2884_rwx_014C0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_2884_rwx_01500000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_2884_rwx_01550000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_2884_rwx_01580000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_2884_rwx_015C0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_2884_rwx_01600000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_2884_rwx_01640000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_2884_rwx_01700000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_2884_rwx_01740000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_2884_rwx_01770000_00001000:
GetProcessHeap
GetProcessHeap
svchost.exe_2884_rwx_01780000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_2884_rwx_01800000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_2884_rwx_01C70000_00001000:
oleaut32.dll
oleaut32.dll
svchost.exe_2884_rwx_01CB0000_00001000:
oleaut32.dll
oleaut32.dll
svchost.exe_2884_rwx_01CF0000_00001000:
oleaut32.dll
oleaut32.dll
svchost.exe_2884_rwx_01D20000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_2884_rwx_01D60000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_2884_rwx_01D90000_00001000:
RegOpenKeyExA
RegOpenKeyExA
svchost.exe_2884_rwx_01DA0000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_2884_rwx_01DD0000_00001000:
RegCloseKey
RegCloseKey
svchost.exe_2884_rwx_01DE0000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_2884_rwx_01E10000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_2884_rwx_01E50000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_2884_rwx_01E90000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_2884_rwx_01EB0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_2884_rwx_01F10000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_2884_rwx_01F50000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_2884_rwx_01F90000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_2884_rwx_01FD0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_2884_rwx_02010000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_2884_rwx_02050000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_2884_rwx_02090000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_2884_rwx_020D0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_2884_rwx_02110000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_2884_rwx_02150000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_2884_rwx_02190000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_2884_rwx_021D0000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_2884_rwx_02210000_00001000:
kernel32.dll
kernel32.dll
svchost.exe_2884_rwx_02240000_00001000:
ntdll.dll
ntdll.dll
svchost.exe_2884_rwx_02280000_00001000:
ntdll.dll
ntdll.dll
svchost.exe_2884_rwx_31930000_00009000:
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
kernel32.dll
Ntdll.dll
Ntdll.dll
NtEnumerateValueKey
NtEnumerateValueKey
NtEnumerateKey
NtEnumerateKey
advapi32.dll
advapi32.dll
GetProcessHeap
GetProcessHeap
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
ntdll.dll
ntdll.dll
KWindows
KWindows
conhost.exe_3448_rwx_001C0000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_3448_rwx_00410000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_3448_rwx_00490000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_3448_rwx_00510000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_3448_rwx_00560000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_3448_rwx_005A0000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_3448_rwx_009B0000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_3448_rwx_009F0000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_3448_rwx_00A30000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_3448_rwx_00A70000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_3448_rwx_00AB0000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_3448_rwx_02070000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_3448_rwx_020B0000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_3448_rwx_020F0000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_3448_rwx_02130000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_3448_rwx_02170000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_3448_rwx_021B0000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_3448_rwx_021F0000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_3448_rwx_02220000_00001000:
GetProcessHeap
GetProcessHeap
conhost.exe_3448_rwx_02230000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_3448_rwx_02260000_00001000:
oleaut32.dll
oleaut32.dll
conhost.exe_3448_rwx_022A0000_00001000:
oleaut32.dll
oleaut32.dll
conhost.exe_3448_rwx_022E0000_00001000:
oleaut32.dll
oleaut32.dll
conhost.exe_3448_rwx_02310000_00001000:
advapi32.dll
advapi32.dll
conhost.exe_3448_rwx_02350000_00001000:
advapi32.dll
advapi32.dll
conhost.exe_3448_rwx_02380000_00001000:
RegOpenKeyExA
RegOpenKeyExA
conhost.exe_3448_rwx_02390000_00001000:
advapi32.dll
advapi32.dll
conhost.exe_3448_rwx_023C0000_00001000:
RegCloseKey
RegCloseKey
conhost.exe_3448_rwx_023D0000_00001000:
advapi32.dll
advapi32.dll
conhost.exe_3448_rwx_02440000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_3448_rwx_024C0000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_3448_rwx_02500000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_3448_rwx_02540000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_3448_rwx_025C0000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_3448_rwx_02600000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_3448_rwx_02640000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_3448_rwx_02680000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_3448_rwx_026C0000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_3448_rwx_02700000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_3448_rwx_02740000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_3448_rwx_02780000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_3448_rwx_027C0000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_3448_rwx_02800000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_3448_rwx_02840000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_3448_rwx_02880000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_3448_rwx_028C0000_00001000:
kernel32.dll
kernel32.dll
conhost.exe_3448_rwx_028F0000_00001000:
ntdll.dll
ntdll.dll
conhost.exe_3448_rwx_02930000_00001000:
ntdll.dll
ntdll.dll
conhost.exe_3448_rwx_31960000_00009000:
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
kernel32.dll
Ntdll.dll
Ntdll.dll
NtEnumerateValueKey
NtEnumerateValueKey
NtEnumerateKey
NtEnumerateKey
advapi32.dll
advapi32.dll
GetProcessHeap
GetProcessHeap
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
ntdll.dll
ntdll.dll
KWindows
KWindows
taskhost.exe_3500_rwx_006A0000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_3500_rwx_009A0000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_3500_rwx_00A20000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_3500_rwx_012D0000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_3500_rwx_013E0000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_3500_rwx_014A0000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_3500_rwx_01930000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_3500_rwx_019F0000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_3500_rwx_01A70000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_3500_rwx_01AB0000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_3500_rwx_01B70000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_3500_rwx_01C70000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_3500_rwx_01CF0000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_3500_rwx_01D30000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_3500_rwx_01D70000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_3500_rwx_01E30000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_3500_rwx_01EF0000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_3500_rwx_01F30000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_3500_rwx_01F60000_00001000:
GetProcessHeap
GetProcessHeap
taskhost.exe_3500_rwx_01F70000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_3500_rwx_01FE0000_00001000:
oleaut32.dll
oleaut32.dll
taskhost.exe_3500_rwx_02060000_00001000:
oleaut32.dll
oleaut32.dll
taskhost.exe_3500_rwx_020E0000_00001000:
oleaut32.dll
oleaut32.dll
taskhost.exe_3500_rwx_021D0000_00001000:
advapi32.dll
advapi32.dll
taskhost.exe_3500_rwx_02210000_00001000:
advapi32.dll
advapi32.dll
taskhost.exe_3500_rwx_02240000_00001000:
RegOpenKeyExA
RegOpenKeyExA
taskhost.exe_3500_rwx_02250000_00001000:
advapi32.dll
advapi32.dll
taskhost.exe_3500_rwx_02280000_00001000:
RegCloseKey
RegCloseKey
taskhost.exe_3500_rwx_02290000_00001000:
advapi32.dll
advapi32.dll
taskhost.exe_3500_rwx_02300000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_3500_rwx_02380000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_3500_rwx_02480000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_3500_rwx_024C0000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_3500_rwx_025C0000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_3500_rwx_026C0000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_3500_rwx_02740000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_3500_rwx_027C0000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_3500_rwx_02800000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_3500_rwx_02880000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_3500_rwx_028C0000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_3500_rwx_02900000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_3500_rwx_02980000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_3500_rwx_02A00000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_3500_rwx_02A80000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_3500_rwx_02AC0000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_3500_rwx_02B80000_00001000:
kernel32.dll
kernel32.dll
taskhost.exe_3500_rwx_02BB0000_00001000:
ntdll.dll
ntdll.dll
taskhost.exe_3500_rwx_02C70000_00001000:
ntdll.dll
ntdll.dll
taskhost.exe_3500_rwx_31940000_00009000:
.idata
.idata
.reloc
.reloc
P.rsrc
P.rsrc
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
kernel32.dll
Ntdll.dll
Ntdll.dll
NtEnumerateValueKey
NtEnumerateValueKey
NtEnumerateKey
NtEnumerateKey
advapi32.dll
advapi32.dll
GetProcessHeap
GetProcessHeap
oleaut32.dll
oleaut32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
ntdll.dll
ntdll.dll
KWindows
KWindows