Trojan.Muldrop.BDT_595d2fe558 – Adaware

Trojan-Dropper.Win32.Agent.akh (Kaspersky), Trojan.Muldrop.BDT (B) (Emsisoft), Trojan.Muldrop.BDT (AdAware), Trojan.Win32.Bumat.FD, Trojan.Win32.Sasfis.FD, Virus.Win32.Parite.B.FD, VirusParite.YR, GenericPhysicalDrive0.YR, BankerGeneric.YR (Lavasoft MAS)Behaviour: Trojan-Dropper, Banker, Trojan, Virus

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 595d2fe55837abb03136f44d32f550f2

SHA1: 9fa3ef3475d0bbe01f00c1734918d440027322f3

SHA256: 3830cab6ab5014f5453af5bd3d03f3fa671193032b6648a4b547c7c3b56041fc

SSDeep: 24576:b4usE2ccfcdSkvRryzXkfcdSkvRryzXEfcdSkvRryzXfU8ZKneTe:rn2VCSkvRGzXACSkvRGzXgCSkvRGzXf

Size: 1511424 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: PolyEnE001byLennartHedlund, WinUpackv030beta, Upackv032Beta, UPolyXv05_v6

Company: CamStudio Group

Created at: no data

Analyzed on: Windows7 SP1 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

DATA0002.EXE:2956
%original file name%.exe:1760
Rundll32.exe:2696
Rundll32.exe:316
SysAnti.exe:440
DATA0000.EXE:1904
DrvInst.exe:1272

The Trojan injects its code into the following process(es):

rundll32.exe:3876
DATA0003.EXE:2060
DATA0001.EXE:2936
Svchost.exe:2920
IEXPLORE.EXE:2064
Explorer.EXE:2024

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process DATA0002.EXE:2956 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~DFE0F5.tmp (49 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ila7751.tmp (11186 bytes)
C:\my.sys (2 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~DFE0F5.tmp (0 bytes)

The process %original file name%.exe:1760 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\DATA0003.EXE (1766 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\DATA0001.EXE (77 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\DATA0002.EXE (618 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\DATA0000.EXE (552 bytes)

The process Rundll32.exe:2696 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Windows\Fonts\upho.fon (6 bytes)
C:\Windows\Fonts\kdjnc.fon (32 bytes)

The Trojan deletes the following file(s):

C:\Windows\Fonts\upho.fon (0 bytes)

The process Rundll32.exe:316 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Windows\Fonts\lmiv.fon (6 bytes)

The Trojan deletes the following file(s):

C:\Windows\Fonts\lmiv.fon (0 bytes)

The process SysAnti.exe:440 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Windows\Fonts\kdjnc.fon (32 bytes)

The process DATA0003.EXE:2060 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~DFE0F5.tmp (49 bytes)
\Device\Harddisk0\DR0 (7 bytes)
C:\my.sys (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\gla7742.tmp (11186 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\hook.rom (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~DFE0F5.tmp (0 bytes)
C:\Windows\System32\drivers\bios.sys (0 bytes)

The process DATA0001.EXE:2936 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\RAV\CCtest.sys (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3120.reg (58 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{70c86755-ad3c-5798-9568-7366bcb29155}\SETAAFF.tmp (4 bytes)
%Program Files%\RAV\CCtest.inf (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{70c86755-ad3c-5798-9568-7366bcb29155}\SETAAEE.tmp (7 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{70c86755-ad3c-5798-9568-7366bcb29155}\SETAAEE.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3120.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{70c86755-ad3c-5798-9568-7366bcb29155}\SETAAFF.tmp (0 bytes)

The process DATA0000.EXE:1904 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\gla7741.tmp (11186 bytes)
C:\Windows\Fonts\ghhtc.fon (32 bytes)
%Program Files%\Common Files\SysAnti.exe (1703 bytes)

The process DrvInst.exe:1272 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Windows\System32\DriverStore\Temp\{64e28f61-4fd2-0c4d-bc44-540856657538}\SETAB4C.tmp (7 bytes)
C:\Windows\System32\DriverStore\Temp\{64e28f61-4fd2-0c4d-bc44-540856657538}\SETAB5C.tmp (4 bytes)

The Trojan deletes the following file(s):

C:\Windows\System32\DriverStore\Temp\{64e28f61-4fd2-0c4d-bc44-540856657538}\SETAB4C.tmp (0 bytes)
C:\Windows\System32\DriverStore\Temp\{64e28f61-4fd2-0c4d-bc44-540856657538}\SETAB5C.tmp (0 bytes)

Registry activity

The process SysAnti.exe:440 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
"SysAnti" = "%Program Files%\Common Files\SysAnti.exe"

The process DATA0001.EXE:2936 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SYSTEM\Setup\SetupapiLogStatus]
"setupapi.dev.log" = "4096"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SYSTEM\Setup\SetupapiLogStatus]
"setupapi.app.log" = "4096"

[HKCU\Software\Classes\Local Settings\MuiCache\30\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process DATA0000.EXE:1904 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\DATA0000_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3C 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\DATA0000_RASMANCS]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\DATA0000_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\DATA0000_RASMANCS]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\DATA0000_RASAPI32]
"ConsoleTracingMask" = "4294901760"
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\DATA0000_RASMANCS]
"EnableConsoleTracing" = "0"
"MaxFileSize" = "1048576"
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\DATA0000_RASAPI32]
"FileTracingMask" = "4294901760"
"EnableFileTracing" = "0"

"EnableConsoleTracing" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"

Dropped PE files

MD5	File path
861d9fee9290c78c2e794b3ca6e9bc77	c:\%original file name%.exe
7d6b20a018d24a25a55fbed8a68a92eb	c:\Program Files\Common Files\SysAnti.exe
a9c38565a7134c16225faf7ccd96cd61	c:\Program Files\RAV\CCtest.sys
7d6b20a018d24a25a55fbed8a68a92eb	c:\SysAnti.exe
78822fff0494912dc394c5095894cee7	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\DATA0001.EXE
1e7c93864220813b5b0a52e7893cf2b6	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\DATA0002.EXE
cbfcc5ef142c580c55a602ed1397ceea	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\DATA0003.EXE
685f1cbd4af30a1d0c25f252d399a666	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\gla7741.tmp
685f1cbd4af30a1d0c25f252d399a666	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\gla7742.tmp
685f1cbd4af30a1d0c25f252d399a666	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ila7751.tmp
a9c38565a7134c16225faf7ccd96cd61	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\{70c86755-ad3c-5798-9568-7366bcb29155}\CCTest.sys
650284d127f208fef9ac26f5aed9aa4e	c:\Windows\Fonts\ghhtc.fon
650284d127f208fef9ac26f5aed9aa4e	c:\Windows\Fonts\kdjnc.fon
a9c38565a7134c16225faf7ccd96cd61	c:\Windows\System32\DriverStore\Temp\{64e28f61-4fd2-0c4d-bc44-540856657538}\CCTest.sys
ec313b6fbc41d3372949799ba59715f4	c:\Windows\flash.dll
353c3e4b55cb94a6e6a54dc423bddc6d	c:\my.sys

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 794 bytes in size. The following strings are added to the hosts file listed below:

127.0.0.1	www.360.cn
127.0.0.1	www.360safe.cn
127.0.0.1	www.360safe.com
127.0.0.1	www.chinakv.com
127.0.0.1	www.rising.com.cn
127.0.0.1	rising.com.cn
127.0.0.1	dl.jiangmin.com
127.0.0.1	jiangmin.com
127.0.0.1	www.jiangmin.com
127.0.0.1	www.duba.net
127.0.0.1	www.eset.com.cn
127.0.0.1	www.nod32.com
127.0.0.1	shadu.duba.net
127.0.0.1	union.kingsoft.com
127.0.0.1	www.kaspersky.com.cn
127.0.0.1	kaspersky.com.cn
127.0.0.1	virustotal.com
127.0.0.1	virscan.org
127.0.0.1	www.virscan.org
127.0.0.1	www.kaspersky.com
127.0.0.1	www.cnnod32.cn
127.0.0.1	www.lanniao.org
127.0.0.1	www.nod32club.com
127.0.0.1	www.dswlab.com
127.0.0.1	bbs.sucop.com
127.0.0.1	www.virustotal.com
127.0.0.1	tool.ikaka.com
127.0.0.1	360.qihoo.com
127.0.0.1	www.kafan.cn
127.0.0.1	bbs.kafan.cn

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
DATA0002.EXE:2956
%original file name%.exe:1760
Rundll32.exe:2696
Rundll32.exe:316
SysAnti.exe:440
DATA0000.EXE:1904
DrvInst.exe:1272
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~DFE0F5.tmp (49 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ila7751.tmp (11186 bytes)
C:\my.sys (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\DATA0003.EXE (1766 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\DATA0001.EXE (77 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\DATA0002.EXE (618 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\DATA0000.EXE (552 bytes)
C:\Windows\Fonts\upho.fon (6 bytes)
C:\Windows\Fonts\kdjnc.fon (32 bytes)
C:\Windows\Fonts\lmiv.fon (6 bytes)
\Device\Harddisk0\DR0 (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\gla7742.tmp (11186 bytes)
%Program Files%\RAV\CCtest.sys (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3120.reg (58 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{70c86755-ad3c-5798-9568-7366bcb29155}\SETAAFF.tmp (4 bytes)
%Program Files%\RAV\CCtest.inf (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{70c86755-ad3c-5798-9568-7366bcb29155}\SETAAEE.tmp (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\gla7741.tmp (11186 bytes)
C:\Windows\Fonts\ghhtc.fon (32 bytes)
%Program Files%\Common Files\SysAnti.exe (1703 bytes)
C:\Windows\System32\DriverStore\Temp\{64e28f61-4fd2-0c4d-bc44-540856657538}\SETAB4C.tmp (7 bytes)
C:\Windows\System32\DriverStore\Temp\{64e28f61-4fd2-0c4d-bc44-540856657538}\SETAB5C.tmp (4 bytes)
Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
CODE	4096	4096	512	3.39105	1f4fb7d81227ebd0cb410783feb83a5f
DATA	8192	4096	512	0.273864	112ca019a106f4fe16f043f97b67e497
.idata	12288	4096	512	2.71676	2e7dcee722f41a792183832ae33c3a81
.reloc	16384	4096	512	0.620029	6d7aed319bec4769f502896c7af57209
.rsrc	20480	1511424	1507840	5.5044	5fd5957c86a8a23d8486837c58dc71e0

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
teredo.ipv6.microsoft.com	157.56.106.189
dns.msftncsi.com	131.107.255.255

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

DATA0001.EXE_2936:

MZKERNEL32.DLL

.Upack

.rsrc

RCv=kAv.SCv

; File Name: CCTest.inf

; Generated by C DriverWizard 3.2.0 (Build 2485)

Signature="$WINDOWS NT$"

ClassGUID={D4A133FE-C9E5-4F11-A812-FED74DA86ED5}

DriverVer=5/7/2010,1.00.0000

CatalogFile=CCTest.cat

;reg-root,[subkey],[value-entry-name],[flags],[value]

HKR,,,%REG_SZ%,ÃžviceClassName%

1 = %DiskId1%,,,""

CCTest.sys = 1,,

ÃŒTest_DeviceDesc$=CCTest_DDI, *CCTestDevice

; --------- Windows 98 -----------------

; cause problems in Windows 98

HKR,,NTMPDriver,,CCTest.sys

HKR,,Description,,ÃŒTest_DeviceDesc%

; --------- Windows NT -----------------

[CCTest_DDI.NT]

[CCTest_DDI.NT.Services]

Addservice = CCTest, %FLG_ADDREG_NOCLOBBER%, CCTest_Service

DisplayName = ÃŒTest_SvcDesc%

ServiceType = %SERVICE_KERNEL_DRIVER%

StartType = %SERVICE_DEMAND_START%

ErrorControl = %SERVICE_ERROR_NORMAL%

ServiceBinary = %\CCTest.sys

CCTest.sys,,,2

FLG_ADDREG_KEYONLY = 0x00000010

FLG_ADDREG_64BITKEY = 0x00001000

FLG_ADDREG_KEYONLY_COMMON = 0x00002000

FLG_ADDREG_32BITKEY = 0x00004000

.text

h.data

B.reloc

C:\9\CCTest\Driver\objfre\i386\CCTest.pdb

ntoskrnl.exe

HAL.dll

Zi{r $zrWhIsbxf^%dib h|YdBF\Wz\s}igJ &!E`dU"\'fsD^e%zDCWW|QQ

&$%$9"9&

% 0vug}wKg`f}zsTPA 0w|ufK`fu}`gTPTg`pTTB 0uxx{wu`{fTPT&TTg`pTTEUQTLN

KWT % KZaxxg`fT 0vug}wKg`f}zsTPA 0w|ufK`fu}`gTPTg`pTTB 0uxx{wu`{fTPT&TTg`pTTWUDVPLNT PV

sq`x}zqTg`pTTMUUUB 0vug}wK}g`fquyTPA 0w|ufK`fu}`gTPTg`pTTT%TUUB&%TUUB 0vug}wKg`f}zsTPA 0w|ufK`fu}`gTPTg`pTTB 0uxx{wu`{fTPT&TT%TTN

K@}pmT 0vug}wKg`f}zsTPA 0w|ufK`fu}`gTPTg`pTTB 0uxx{wu`{fTPT&TTg`pTTUUQLKZTN

ugg}szT 0vug}wKg`f}zsTPA 0w|ufK`fu}`gTPTg`pTTB 0uxx{wu`{fTPT&TTg`pTTEUQUUB%&TDVP]TN

%4%0%

setupapi.dll

shell32.dll

advapi32.dll

reg.exe

import

3120.reg

tmpacik.tmp

%scd%d.exe

SSShh

KERNEL32.DLL

GetWindowsDirectoryA

GetCPInfo

USER32.DLL

SETUPAPI.DLL

]%CSjv

Windows NT\

svchost.exe

CCTest.sys

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local]

"ActivePolicy"="SOFTWARE\\Policies\\Microsoft\\Windows\\IPSec\\Policy\\Local\\ipsecPolicy{587716d4-83f7-4a02-97c2-6137d945e86a}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local\ipsecFilter{72385235-70fa-11d1-864c-14a300000000}]

"name"="ipsecFilter{72385235-70fa-11d1-864c-14a300000000}"

"ipsecID"="{72385235-70fa-11d1-864c-14a300000000}"

00,00,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local\ipsecFilter{7238523a-70fa-11d1-864c-14a300000000}]

"name"="ipsecFilter{7238523a-70fa-11d1-864c-14a300000000}"

"ipsecID"="{7238523a-70fa-11d1-864c-14a300000000}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local\ipsecFilter{f2fd0bda-3962-428d-9d06-34c2b19568bb}]

"name"="ipsecFilter{f2fd0bda-3962-428d-9d06-34c2b19568bb}"

"ipsecID"="{f2fd0bda-3962-428d-9d06-34c2b19568bb}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local\ipsecISAKMPPolicy{72385234-70fa-11d1-864c-14a300000000}]

"name"="ipsecISAKMPPolicy{72385234-70fa-11d1-864c-14a300000000}"

"ipsecID"="{72385234-70fa-11d1-864c-14a300000000}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local\ipsecISAKMPPolicy{c37d0b66-13e0-4bf0-a103-e09908ece1b7}]

"name"="ipsecISAKMPPolicy{c37d0b66-13e0-4bf0-a103-e09908ece1b7}"

"ipsecID"="{c37d0b66-13e0-4bf0-a103-e09908ece1b7}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local\ipsecNegotiationPolicy{56093cf4-1dd4-4ed9-b0f8-e9f83f4ae82f}]

"name"="ipsecNegotiationPolicy{56093cf4-1dd4-4ed9-b0f8-e9f83f4ae82f}"

"ipsecID"="{56093cf4-1dd4-4ed9-b0f8-e9f83f4ae82f}"

"ipsecNegotiationPolicyAction"="{3f91a819-7647-11d1-864d-d46a00000000}"

"ipsecNegotiationPolicyType"="{62f49e10-6c37-11d1-864c-14a300000000}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local\ipsecNegotiationPolicy{72385233-70fa-11d1-864c-14a300000000}]

"name"="ipsecNegotiationPolicy{72385233-70fa-11d1-864c-14a300000000}"

"ipsecID"="{72385233-70fa-11d1-864c-14a300000000}"

"ipsecNegotiationPolicyAction"="{3f91a81a-7647-11d1-864d-d46a00000000}"

00,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local\ipsecNegotiationPolicy{7238523b-70fa-11d1-864c-14a300000000}]

"name"="ipsecNegotiationPolicy{7238523b-70fa-11d1-864c-14a300000000}"

"ipsecID"="{7238523b-70fa-11d1-864c-14a300000000}"

"ipsecNegotiationPolicyAction"="{8a171dd2-77e3-11d1-8659-a04f00000000}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local\ipsecNegotiationPolicy{7238523f-70fa-11d1-864c-14a300000000}]

"name"="ipsecNegotiationPolicy{7238523f-70fa-11d1-864c-14a300000000}"

"ipsecID"="{7238523f-70fa-11d1-864c-14a300000000}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local\ipsecNegotiationPolicy{a664b054-eebd-4697-aee0-a38f35bc4eb8}]

"name"="ipsecNegotiationPolicy{a664b054-eebd-4697-aee0-a38f35bc4eb8}"

"ipsecID"="{a664b054-eebd-4697-aee0-a38f35bc4eb8}"

"ipsecNegotiationPolicyAction"="{8a171dd3-77e3-11d1-8659-a04f00000000}"

"ipsecNegotiationPolicyType"="{62f49e13-6c37-11d1-864c-14a300000000}"

00,00,00,00,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local\ipsecNFA{77d93b21-350c-4649-b8fd-3b5428af7b8d}]

"name"="ipsecNFA{77d93b21-350c-4649-b8fd-3b5428af7b8d}"

"ipsecID"="{77d93b21-350c-4649-b8fd-3b5428af7b8d}"

"ipsecNegotiationPolicyReference"="SOFTWARE\\Policies\\Microsoft\\Windows\\IPSec\\Policy\\Local\\ipsecNegotiationPolicy{56093cf4-1dd4-4ed9-b0f8-e9f83f4ae82f}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local\ipsecNFA{f6050147-987a-4592-8d14-e8aee7e77bd4}]

"name"="ipsecNFA{f6050147-987a-4592-8d14-e8aee7e77bd4}"

"ipsecID"="{f6050147-987a-4592-8d14-e8aee7e77bd4}"

"ipsecNegotiationPolicyReference"="SOFTWARE\\Policies\\Microsoft\\Windows\\IPSec\\Policy\\Local\\ipsecNegotiationPolicy{a664b054-eebd-4697-aee0-a38f35bc4eb8}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local\ipsecPolicy{587716d4-83f7-4a02-97c2-6137d945e86a}]

"name"="ipsecPolicy{587716d4-83f7-4a02-97c2-6137d945e86a}"

"ipsecID"="{587716d4-83f7-4a02-97c2-6137d945e86a}"

"ipsecISAKMPReference"="SOFTWARE\\Policies\\Microsoft\\Windows\\IPSec\\Policy\\Local\\ipsecISAKMPPolicy{c37d0b66-13e0-4bf0-a103-e09908ece1b7}"

DATA0001.EXE_2936_rwx_00401000_00022000:

RCv=kAv.SCv

; File Name: CCTest.inf

; Generated by C DriverWizard 3.2.0 (Build 2485)

Signature="$WINDOWS NT$"

ClassGUID={D4A133FE-C9E5-4F11-A812-FED74DA86ED5}

DriverVer=5/7/2010,1.00.0000

CatalogFile=CCTest.cat

;reg-root,[subkey],[value-entry-name],[flags],[value]

HKR,,,%REG_SZ%,ÃžviceClassName%

1 = %DiskId1%,,,""

CCTest.sys = 1,,

ÃŒTest_DeviceDesc$=CCTest_DDI, *CCTestDevice

; --------- Windows 98 -----------------

; cause problems in Windows 98

HKR,,NTMPDriver,,CCTest.sys

HKR,,Description,,ÃŒTest_DeviceDesc%

; --------- Windows NT -----------------

[CCTest_DDI.NT]

[CCTest_DDI.NT.Services]

Addservice = CCTest, %FLG_ADDREG_NOCLOBBER%, CCTest_Service

DisplayName = ÃŒTest_SvcDesc%

ServiceType = %SERVICE_KERNEL_DRIVER%

StartType = %SERVICE_DEMAND_START%

ErrorControl = %SERVICE_ERROR_NORMAL%

ServiceBinary = %\CCTest.sys

CCTest.sys,,,2

FLG_ADDREG_KEYONLY = 0x00000010

FLG_ADDREG_64BITKEY = 0x00001000

FLG_ADDREG_KEYONLY_COMMON = 0x00002000

FLG_ADDREG_32BITKEY = 0x00004000

.text

h.data

.rsrc

B.reloc

C:\9\CCTest\Driver\objfre\i386\CCTest.pdb

ntoskrnl.exe

HAL.dll

Zi{r $zrWhIsbxf^%dib h|YdBF\Wz\s}igJ &!E`dU"\'fsD^e%zDCWW|QQ

&$%$9"9&

% 0vug}wKg`f}zsTPA 0w|ufK`fu}`gTPTg`pTTB 0uxx{wu`{fTPT&TTg`pTTEUQTLN

KWT % KZaxxg`fT 0vug}wKg`f}zsTPA 0w|ufK`fu}`gTPTg`pTTB 0uxx{wu`{fTPT&TTg`pTTWUDVPLNT PV

sq`x}zqTg`pTTMUUUB 0vug}wK}g`fquyTPA 0w|ufK`fu}`gTPTg`pTTT%TUUB&%TUUB 0vug}wKg`f}zsTPA 0w|ufK`fu}`gTPTg`pTTB 0uxx{wu`{fTPT&TT%TTN

K@}pmT 0vug}wKg`f}zsTPA 0w|ufK`fu}`gTPTg`pTTB 0uxx{wu`{fTPT&TTg`pTTUUQLKZTN

ugg}szT 0vug}wKg`f}zsTPA 0w|ufK`fu}`gTPTg`pTTB 0uxx{wu`{fTPT&TTg`pTTEUQUUB%&TDVP]TN

%4%0%

setupapi.dll

shell32.dll

advapi32.dll

reg.exe

import

3120.reg

tmpacik.tmp

%scd%d.exe

SSShh

KERNEL32.DLL

GetWindowsDirectoryA

GetCPInfo

USER32.DLL

SETUPAPI.DLL

Windows NT\

svchost.exe

CCTest.sys

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local]

"ActivePolicy"="SOFTWARE\\Policies\\Microsoft\\Windows\\IPSec\\Policy\\Local\\ipsecPolicy{587716d4-83f7-4a02-97c2-6137d945e86a}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local\ipsecFilter{72385235-70fa-11d1-864c-14a300000000}]

"name"="ipsecFilter{72385235-70fa-11d1-864c-14a300000000}"

"ipsecID"="{72385235-70fa-11d1-864c-14a300000000}"

00,00,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local\ipsecFilter{7238523a-70fa-11d1-864c-14a300000000}]

"name"="ipsecFilter{7238523a-70fa-11d1-864c-14a300000000}"

"ipsecID"="{7238523a-70fa-11d1-864c-14a300000000}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local\ipsecFilter{f2fd0bda-3962-428d-9d06-34c2b19568bb}]

"name"="ipsecFilter{f2fd0bda-3962-428d-9d06-34c2b19568bb}"

"ipsecID"="{f2fd0bda-3962-428d-9d06-34c2b19568bb}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local\ipsecISAKMPPolicy{72385234-70fa-11d1-864c-14a300000000}]

"name"="ipsecISAKMPPolicy{72385234-70fa-11d1-864c-14a300000000}"

"ipsecID"="{72385234-70fa-11d1-864c-14a300000000}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local\ipsecISAKMPPolicy{c37d0b66-13e0-4bf0-a103-e09908ece1b7}]

"name"="ipsecISAKMPPolicy{c37d0b66-13e0-4bf0-a103-e09908ece1b7}"

"ipsecID"="{c37d0b66-13e0-4bf0-a103-e09908ece1b7}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local\ipsecNegotiationPolicy{56093cf4-1dd4-4ed9-b0f8-e9f83f4ae82f}]

"name"="ipsecNegotiationPolicy{56093cf4-1dd4-4ed9-b0f8-e9f83f4ae82f}"

"ipsecID"="{56093cf4-1dd4-4ed9-b0f8-e9f83f4ae82f}"

"ipsecNegotiationPolicyAction"="{3f91a819-7647-11d1-864d-d46a00000000}"

"ipsecNegotiationPolicyType"="{62f49e10-6c37-11d1-864c-14a300000000}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local\ipsecNegotiationPolicy{72385233-70fa-11d1-864c-14a300000000}]

"name"="ipsecNegotiationPolicy{72385233-70fa-11d1-864c-14a300000000}"

"ipsecID"="{72385233-70fa-11d1-864c-14a300000000}"

"ipsecNegotiationPolicyAction"="{3f91a81a-7647-11d1-864d-d46a00000000}"

00,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local\ipsecNegotiationPolicy{7238523b-70fa-11d1-864c-14a300000000}]

"name"="ipsecNegotiationPolicy{7238523b-70fa-11d1-864c-14a300000000}"

"ipsecID"="{7238523b-70fa-11d1-864c-14a300000000}"

"ipsecNegotiationPolicyAction"="{8a171dd2-77e3-11d1-8659-a04f00000000}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local\ipsecNegotiationPolicy{7238523f-70fa-11d1-864c-14a300000000}]

"name"="ipsecNegotiationPolicy{7238523f-70fa-11d1-864c-14a300000000}"

"ipsecID"="{7238523f-70fa-11d1-864c-14a300000000}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local\ipsecNegotiationPolicy{a664b054-eebd-4697-aee0-a38f35bc4eb8}]

"name"="ipsecNegotiationPolicy{a664b054-eebd-4697-aee0-a38f35bc4eb8}"

"ipsecID"="{a664b054-eebd-4697-aee0-a38f35bc4eb8}"

"ipsecNegotiationPolicyAction"="{8a171dd3-77e3-11d1-8659-a04f00000000}"

"ipsecNegotiationPolicyType"="{62f49e13-6c37-11d1-864c-14a300000000}"

00,00,00,00,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local\ipsecNFA{77d93b21-350c-4649-b8fd-3b5428af7b8d}]

"name"="ipsecNFA{77d93b21-350c-4649-b8fd-3b5428af7b8d}"

"ipsecID"="{77d93b21-350c-4649-b8fd-3b5428af7b8d}"

"ipsecNegotiationPolicyReference"="SOFTWARE\\Policies\\Microsoft\\Windows\\IPSec\\Policy\\Local\\ipsecNegotiationPolicy{56093cf4-1dd4-4ed9-b0f8-e9f83f4ae82f}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local\ipsecNFA{f6050147-987a-4592-8d14-e8aee7e77bd4}]

"name"="ipsecNFA{f6050147-987a-4592-8d14-e8aee7e77bd4}"

"ipsecID"="{f6050147-987a-4592-8d14-e8aee7e77bd4}"

"ipsecNegotiationPolicyReference"="SOFTWARE\\Policies\\Microsoft\\Windows\\IPSec\\Policy\\Local\\ipsecNegotiationPolicy{a664b054-eebd-4697-aee0-a38f35bc4eb8}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local\ipsecPolicy{587716d4-83f7-4a02-97c2-6137d945e86a}]

"name"="ipsecPolicy{587716d4-83f7-4a02-97c2-6137d945e86a}"

"ipsecID"="{587716d4-83f7-4a02-97c2-6137d945e86a}"

"ipsecISAKMPReference"="SOFTWARE\\Policies\\Microsoft\\Windows\\IPSec\\Policy\\Local\\ipsecISAKMPPolicy{c37d0b66-13e0-4bf0-a103-e09908ece1b7}"

DATA0001.EXE_2936_rwx_0042B000_00008000:

]%CSjv

DATA0003.EXE_2060:

!This program cannoc:\my.sys

.text

`.rdata

.data

.rsrc

@.nkh

MSVCRT

PSAPI.DLL

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

ADVAPI32.dll

\\.\PHYSICALDRIVE0

~DFE0F5.tmp

[-]OpenSCManager Failed in LoadDriver %d

c:\bios.bin

%s %s /isa %s

%s %s /isa release

cbrom.exe

\\.\Bios

explorer.exe

svchost.exe

services.exe

\flash.dll

\\.\MyDeviceDriver

\drivers\beep.sys

beep.sys

RSTray.exe

\drivers\bios.sys

hook.rom

User32.DLL

c:\my.sys

L%xSl

PvtS%D

S.HHu"$J

}b~%c

?.GMA

Kernel32.dll

RegOpenKeyExA

RegCloseKey

Software\Microsoft\Windows\CurrentVersion\Explorer

DATA0003.EXE_2060_rwx_001D1000_00071000:

UDPSockError

NMUDP

Errmsg

Port

TNMUDP

RemotePort

LocalPort

ReportLevelLk

0.0.0.0

%d.%d.%d.%d

AutoHotkeys

:].tJ

EInvalidGraphicOperation,0

EInvalidGraphicOperation

KeyPreview,

WindowState

OnKeyDown

OnKeyPressdz

OnKeyUp

ssHotTrack

TWindowState

poProportional

TWMKey

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

TDragOperation

TKeyEvent

TKeyPressEvent

crSQLWait

%s (%s)

IMM32.DLL

EInvalidOperation

%s[%d]

%s_%d

USER32.DLL

comctl32.dll

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

kernel32.dll

explorer.exe

Software\Microsoft\Windows\CurrentVersion\Explorer

*.TMP

Kernel32.dll

ADVAPI32.dll

RegOpenKeyExA

RegCloseKey

readbook.exe

rundll32.exe

*.exe

*.scr

UdpT

UdpOnDataReceived

xxtype.cpp

derv->tpClass.tpcFlags & CF_HAS_BASES

Inappropriate I/O control operation

Broken pipe

Operation not permitted

%H:%M:%S

%m/%d/%y

%A, %B %d, %Y

d/d/d d:d:d.d

An exception (X) occurred during DllEntryPoint or DllMain in module:

xx.cpp

varType->tpClass.tpcFlags & CF_HAS_DTOR

varType->tpClass.tpcDtorAddr

(errPtr->ERRcInitDtc >= varType->tpClass.tpcDtorCount) || flags

memType->tpClass.tpcFlags & CF_HAS_DTOR

varType->tpArr.tpaElemType->tpClass.tpcFlags & CF_HAS_DTOR

dttPtr->dttType->tpPtr.tppBaseType->tpClass.tpcFlags & CF_HAS_DTOR

IS_CLASS(dttPtr->dttType->tpMask) && (dttPtr->dttType->tpClass.tpcFlags & CF_HAS_DTOR)

elemType->tpClass.tpcFlags & CF_HAS_DTOR

Cv.SCv

Bv}.Bv

ReportLevel

GetCPInfo

GetProcessHeap

GetWindowsDirectoryA

RegCreateKeyExA

RegFlushKey

SetViewportOrgEx

ActivateKeyboardLayout

EnumThreadWindows

EnumWindows

GetKeyNameTextA

GetKeyState

GetKeyboardLayout

GetKeyboardLayoutList

GetKeyboardState

GetKeyboardType

LoadKeyboardLayoutA

MapVirtualKeyA

MsgWaitForMultipleObjects

SetWindowsHookExA

UnhookWindowsHookEx

VprK|%Ud

â‚¬00404

8 @ @ @ @ @

.text

`.data

.idata

@.edata

@.rsrc

@.reloc

70"!(&&$

External exception %x

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

Win32 Error. Code: %d.

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Operation aborted%Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'

Invalid variant operation"Variant method calls not supported

I/O error %d

Integer overflow Invalid floating point operation

Invalid data type for '%s'

Failed to set data for '%s'

Failed to get data for '%s'/Menu '%s' is already being used by another form*Windows socket error: %s (%d), on API '%s'

Asynchronous socket error %d

- Dock zone has no control%List does not allow duplicates ($0%x)!'%s' is not a valid integer value

Alt Clipboard does not support Icons

!Control '%s' has no parent window

Error reading %s%s%s: %s

Ancestor for '%s' not found

Unsupported clipboard format

Class %s not found

Resource %s not found

List index out of bounds (%d) List capacity out of bounds (%d)

List count out of bounds (%d) Operation not allowed on sorted string list%String list does not allow duplicates#A component named %s already exists$''%s'' is not a valid component name

A class named %s already exists

Cannot assign a %s to a %s

Cannot create file %s

Cannot open file %s

DATA0003.EXE_2060_rwx_00403000_00002000:

MSVCRT

PSAPI.DLL

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

ADVAPI32.dll

\\.\PHYSICALDRIVE0

~DFE0F5.tmp

[-]OpenSCManager Failed in LoadDriver %d

c:\bios.bin

%s %s /isa %s

%s %s /isa release

cbrom.exe

\\.\Bios

explorer.exe

svchost.exe

services.exe

\flash.dll

\\.\MyDeviceDriver

\drivers\beep.sys

beep.sys

RSTray.exe

\drivers\bios.sys

hook.rom

User32.DLL

c:\my.sys

DATA0003.EXE_2060_rwx_00422000_00001000:

Kernel32.dll

ADVAPI32.dll

RegOpenKeyExA

RegCloseKey

Software\Microsoft\Windows\CurrentVersion\Explorer

Svchost.exe_2920:

.idata

.rdata

P.reloc

P.rsrc

P.xur

kernel32.dll

hXXp://

HTTP/1.0

Content-Type: application/x-www-form-urlencoded

Windows 95

Windows 95 OSR 2

Windows 98

Windows 98 Second Edition

Windows Millenium

Windows NT

Windows NT 3.5

Windows NT 4.0

Windows 2000

Windows XP

Windows XP Service Pack 2

Windows XP x64

Windows Server 2003

Windows Vista

Windows Server Longhorn

rpcrt4.dll

ntdll.dll

Kernel32.dll

Unit_GetWebSV

wininet.dll

InternetOpenUrlA

HttpQueryInfoA

HttpOpenRequestA

HttpSendRequestA

ShellExecuteA

Shell32.dll

360hotfix.exe;360rpt.exe;360Safe.exe;360safebox.exe;360tray.exe;adam.exe;AgentSvr.exe;AntiArp.exe;AppSvc32.exe;arvmon.exe;AutoGuarder.exe;autoruns.exe;avgrssvc.exe;AvMonitor.exe;avp.com;avp.exe;CCenter.exe;ccSvcHst.exe;FileDsty.exe;findt2005.exe;FTCleanerShell.exe;HijackThis.exe;IceSword.exe;iparmo.exe;Iparmor.exe;IsHelp.exe;isPwdSvc.exe;kabaload.exe;KaScrScn.SCR;KASMain.exe;KASTask.exe;KAV32.exe;KAVDX.exe;KAVPFW.exe;KAVSetup.exe;KAVStart.exe;killhidepid.exe;KISLnchr.exe;KMailMon.exe;KMFilter.exe;KPFW32.exe;KPFW32X.exe;KPFWSvc.exe;KRepair.COM;KsLoader.exe;KVCenter.kxp;KvDetect.exe;kvfw.exe;KvfwMcl.exe;KVMonXP.kxp;KVMonXP_1.kxp;kvol.exe;kvolself.exe;KvReport.kxp;KVScan.kxp;KVSrvXP.exe;KVStub.kxp;kvupload.exe;kvwsc.exe;KvXP.kxp;KvXP_1.kxp;KWatch.exe;KWatch9x.exe;KWatchX.exe;loaddll.exe;MagicSet.exe;mcconsol.exe;mmqczj.exe;mmsk.exe;NAVSetup.exe;nod32krn.exe;nod32kui.exe;PFW.exe;PFWLiveUpdate.exe;QHSET.exe;Ras.exe;Rav.exe;RavCopy.exe;RavMon.exe;RavMonD.exe;RavStore.exe;RavStub.exe;ravt08.exe;RavTask.exe;RegClean.exe;RegEx.exe;rfwcfg.exe;RfwMain.exe;rfwolusr.exe;rfwProxy.exe;rfwsrv.exe;RsAgent.exe;Rsaupd.exe;RsMain.exe;rsnetsvr.exe;RSTray.exe;runiep.exe;safebank.exe;safeboxTray.exe;safelive.exe;scan32.exe;ScanFrm.exe;shcfg32.exe;smartassistant.exe;SmartUp.exe;SREng.exe;SREngPS.exe;symlcsvc.exe;syscheck.exe;Syscheck2.exe;SysSafe.exe;ToolsUp.exe;TrojanDetector.exe;Trojanwall.exe;TrojDie.kxp;UIHost.exe;UmxAgent.exe;UmxAttachment.exe;UmxCfg.exe;UmxFwHlp.exe;UmxPol.exe;UpLive.exe;WoptiClean.exe;zxsweep.exe;LiveUpdate360.exe;

AutoRun.inf

Open=%s

Shell\Open\Command=%s

Shell\Explore\Command=%s

Sfc.dll

VVV.360.cn

VVV.360safe.cn

VVV.360safe.com

VVV.chinakv.com

VVV.rising.com.cn

rising.com.cn

dl.jiangmin.com

jiangmin.com

VVV.jiangmin.com

VVV.duba.net

VVV.eset.com.cn

VVV.nod32.com

shadu.duba.net

union.kingsoft.com

VVV.kaspersky.com.cn

kaspersky.com.cn

virustotal.com

virscan.org

VVV.virscan.org

VVV.kaspersky.com

VVV.cnnod32.cn

VVV.lanniao.org

VVV.nod32club.com

VVV.dswlab.com

bbs.sucop.com

VVV.virustotal.com

tool.ikaka.com

360.qihoo.com

VVV.kafan.cn

bbs.kafan.cn

127.0.0.1

d-d-d d:d:d

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\

&Key=

cmd /c erase /F "

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

"!"""&"""

",#)#%("8""

?""$

22222222

930 2|222

2222222

.Rr23D#X2X2X2Z

.Rr22FÂ»`fX0X2Z

.Rr23D5ba

.Rr23D/b`c

.Rr23D `fX3X2Z

.Rr23D"fX0X2Z

.Rr22E

.Rr22E'b

.Rr22E=

( (((,(((

%)(@(.)(

(()()(-(

(8((8(((2

22222222222222

22322232223222

22220222

2222=2223

GetProcessHeap

user32.dll

oleaut32.dll

advapi32.dll

RegOpenKeyExA

RegCreateKeyA

RegCloseKey

WinExec

GetWindowsDirectoryA

t!==9sff!

KWindows

LUnit_GetWeb

Unit_NsPass

ADVAPI32.dll

Software\Microsoft\Windows\CurrentVersion\Explorer

Svchost.exe_2920_rwx_000E1000_00071000:

UDPSockError

NMUDP

Errmsg

Port

TNMUDP

RemotePort

LocalPort

ReportLevelLk

0.0.0.0

%d.%d.%d.%d

AutoHotkeys

:].tJ

EInvalidGraphicOperation,0

EInvalidGraphicOperation

KeyPreview,

WindowState

OnKeyDown

OnKeyPressdz

OnKeyUp

ssHotTrack

TWindowState

poProportional

TWMKey

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

TDragOperation

TKeyEvent

TKeyPressEvent

crSQLWait

%s (%s)

IMM32.DLL

EInvalidOperation

%s[%d]

%s_%d

USER32.DLL

comctl32.dll

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

kernel32.dll

explorer.exe

Software\Microsoft\Windows\CurrentVersion\Explorer

*.TMP

Kernel32.dll

ADVAPI32.dll

RegOpenKeyExA

RegCloseKey

readbook.exe

rundll32.exe

*.exe

*.scr

UdpT

UdpOnDataReceived

xxtype.cpp

derv->tpClass.tpcFlags & CF_HAS_BASES

Inappropriate I/O control operation

Broken pipe

Operation not permitted

%H:%M:%S

%m/%d/%y

%A, %B %d, %Y

d/d/d d:d:d.d

An exception (X) occurred during DllEntryPoint or DllMain in module:

xx.cpp

varType->tpClass.tpcFlags & CF_HAS_DTOR

varType->tpClass.tpcDtorAddr

(errPtr->ERRcInitDtc >= varType->tpClass.tpcDtorCount) || flags

memType->tpClass.tpcFlags & CF_HAS_DTOR

varType->tpArr.tpaElemType->tpClass.tpcFlags & CF_HAS_DTOR

dttPtr->dttType->tpPtr.tppBaseType->tpClass.tpcFlags & CF_HAS_DTOR

IS_CLASS(dttPtr->dttType->tpMask) && (dttPtr->dttType->tpClass.tpcFlags & CF_HAS_DTOR)

elemType->tpClass.tpcFlags & CF_HAS_DTOR

Cv.SCv

Bv}.Bv

ReportLevel

GetCPInfo

GetProcessHeap

GetWindowsDirectoryA

RegCreateKeyExA

RegFlushKey

SetViewportOrgEx

ActivateKeyboardLayout

EnumThreadWindows

EnumWindows

GetKeyNameTextA

GetKeyState

GetKeyboardLayout

GetKeyboardLayoutList

GetKeyboardState

GetKeyboardType

LoadKeyboardLayoutA

MapVirtualKeyA

MsgWaitForMultipleObjects

SetWindowsHookExA

UnhookWindowsHookEx

VprK|%Ud

â‚¬00404

8 @ @ @ @ @

.text

`.data

.idata

@.edata

@.rsrc

@.reloc

70"!(&&$

External exception %x

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

Win32 Error. Code: %d.

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Operation aborted%Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'

Invalid variant operation"Variant method calls not supported

I/O error %d

Integer overflow Invalid floating point operation

Invalid data type for '%s'

Failed to set data for '%s'

Failed to get data for '%s'/Menu '%s' is already being used by another form*Windows socket error: %s (%d), on API '%s'

Asynchronous socket error %d

- Dock zone has no control%List does not allow duplicates ($0%x)!'%s' is not a valid integer value

Alt Clipboard does not support Icons

!Control '%s' has no parent window

Error reading %s%s%s: %s

Ancestor for '%s' not found

Unsupported clipboard format

Class %s not found

Resource %s not found

List index out of bounds (%d) List capacity out of bounds (%d)

List count out of bounds (%d) Operation not allowed on sorted string list%String list does not allow duplicates#A component named %s already exists$''%s'' is not a valid component name

A class named %s already exists

Cannot assign a %s to a %s

Cannot create file %s

Cannot open file %s

Svchost.exe_2920_rwx_00400000_0001F000:

.idata

.rdata

P.reloc

P.rsrc

P.xur

kernel32.dll

hXXp://

HTTP/1.0

Content-Type: application/x-www-form-urlencoded

Windows 95

Windows 95 OSR 2

Windows 98

Windows 98 Second Edition

Windows Millenium

Windows NT

Windows NT 3.5

Windows NT 4.0

Windows 2000

Windows XP

Windows XP Service Pack 2

Windows XP x64

Windows Server 2003

Windows Vista

Windows Server Longhorn

rpcrt4.dll

ntdll.dll

Kernel32.dll

Unit_GetWebSV

wininet.dll

InternetOpenUrlA

HttpQueryInfoA

HttpOpenRequestA

HttpSendRequestA

ShellExecuteA

Shell32.dll

AutoRun.inf

Open=%s

Shell\Open\Command=%s

Shell\Explore\Command=%s

Sfc.dll

VVV.360.cn

VVV.360safe.cn

VVV.360safe.com

VVV.chinakv.com

VVV.rising.com.cn

rising.com.cn

dl.jiangmin.com

jiangmin.com

VVV.jiangmin.com

VVV.duba.net

VVV.eset.com.cn

VVV.nod32.com

shadu.duba.net

union.kingsoft.com

VVV.kaspersky.com.cn

kaspersky.com.cn

virustotal.com

virscan.org

VVV.virscan.org

VVV.kaspersky.com

VVV.cnnod32.cn

VVV.lanniao.org

VVV.nod32club.com

VVV.dswlab.com

bbs.sucop.com

VVV.virustotal.com

tool.ikaka.com

360.qihoo.com

VVV.kafan.cn

bbs.kafan.cn

127.0.0.1

d-d-d d:d:d

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\

&Key=

cmd /c erase /F "

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

"!"""&"""

",#)#%("8""

?""$

22222222

930 2|222

2222222

.Rr23D#X2X2X2Z

.Rr22FÂ»`fX0X2Z

.Rr23D5ba

.Rr23D/b`c

.Rr23D `fX3X2Z

.Rr23D"fX0X2Z

.Rr22E

.Rr22E'b

.Rr22E=

( (((,(((

%)(@(.)(

(()()(-(

(8((8(((2

22222222222222

22322232223222

22220222

2222=2223

GetProcessHeap

user32.dll

oleaut32.dll

advapi32.dll

RegOpenKeyExA

RegCreateKeyA

RegCloseKey

WinExec

GetWindowsDirectoryA

t!==9sff!

KWindows

LUnit_GetWeb

Unit_NsPass

ADVAPI32.dll

Software\Microsoft\Windows\CurrentVersion\Explorer

IEXPLORE.EXE_2064:

.idata

.rdata

P.reloc

P.rsrc

P.xur

kernel32.dll

hXXp://

HTTP/1.0

Content-Type: application/x-www-form-urlencoded

Windows 95

Windows 95 OSR 2

Windows 98

Windows 98 Second Edition

Windows Millenium

Windows NT

Windows NT 3.5

Windows NT 4.0

Windows 2000

Windows XP

Windows XP Service Pack 2

Windows XP x64

Windows Server 2003

Windows Vista

Windows Server Longhorn

rpcrt4.dll

ntdll.dll

Kernel32.dll

Unit_GetWebSV

wininet.dll

InternetOpenUrlA

HttpQueryInfoA

HttpOpenRequestA

HttpSendRequestA

ShellExecuteA

Shell32.dll

AutoRun.inf

Open=%s

Shell\Open\Command=%s

Shell\Explore\Command=%s

Sfc.dll

VVV.360.cn

VVV.360safe.cn

VVV.360safe.com

VVV.chinakv.com

VVV.rising.com.cn

rising.com.cn

dl.jiangmin.com

jiangmin.com

VVV.jiangmin.com

VVV.duba.net

VVV.eset.com.cn

VVV.nod32.com

shadu.duba.net

union.kingsoft.com

VVV.kaspersky.com.cn

kaspersky.com.cn

virustotal.com

virscan.org

VVV.virscan.org

VVV.kaspersky.com

VVV.cnnod32.cn

VVV.lanniao.org

VVV.nod32club.com

VVV.dswlab.com

bbs.sucop.com

VVV.virustotal.com

tool.ikaka.com

360.qihoo.com

VVV.kafan.cn

bbs.kafan.cn

127.0.0.1

d-d-d d:d:d

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\

&Key=

cmd /c erase /F "

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

"!"""&"""

",#)#%("8""

?""$

22222222

930 2|222

2222222

.Rr23D#X2X2X2Z

.Rr22FÂ»`fX0X2Z

.Rr23D5ba

.Rr23D/b`c

.Rr23D `fX3X2Z

.Rr23D"fX0X2Z

.Rr22E

.Rr22E'b

.Rr22E=

( (((,(((

%)(@(.)(

(()()(-(

(8((8(((2

22222222222222

22322232223222

22220222

2222=2223

GetProcessHeap

user32.dll

oleaut32.dll

advapi32.dll

RegOpenKeyExA

RegCreateKeyA

RegCloseKey

WinExec

GetWindowsDirectoryA

t!==9sff!

KWindows

LUnit_GetWeb

Unit_NsPass

ADVAPI32.dll

Software\Microsoft\Windows\CurrentVersion\Explorer

IEXPLORE.EXE_2064_rwx_00400000_0001F000:

.idata

.rdata

P.reloc

P.rsrc

P.xur

kernel32.dll

hXXp://

HTTP/1.0

Content-Type: application/x-www-form-urlencoded

Windows 95

Windows 95 OSR 2

Windows 98

Windows 98 Second Edition

Windows Millenium

Windows NT

Windows NT 3.5

Windows NT 4.0

Windows 2000

Windows XP

Windows XP Service Pack 2

Windows XP x64

Windows Server 2003

Windows Vista

Windows Server Longhorn

rpcrt4.dll

ntdll.dll

Kernel32.dll

Unit_GetWebSV

wininet.dll

InternetOpenUrlA

HttpQueryInfoA

HttpOpenRequestA

HttpSendRequestA

ShellExecuteA

Shell32.dll

AutoRun.inf

Open=%s

Shell\Open\Command=%s

Shell\Explore\Command=%s

Sfc.dll

VVV.360.cn

VVV.360safe.cn

VVV.360safe.com

VVV.chinakv.com

VVV.rising.com.cn

rising.com.cn

dl.jiangmin.com

jiangmin.com

VVV.jiangmin.com

VVV.duba.net

VVV.eset.com.cn

VVV.nod32.com

shadu.duba.net

union.kingsoft.com

VVV.kaspersky.com.cn

kaspersky.com.cn

virustotal.com

virscan.org

VVV.virscan.org

VVV.kaspersky.com

VVV.cnnod32.cn

VVV.lanniao.org

VVV.nod32club.com

VVV.dswlab.com

bbs.sucop.com

VVV.virustotal.com

tool.ikaka.com

360.qihoo.com

VVV.kafan.cn

bbs.kafan.cn

127.0.0.1

d-d-d d:d:d

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\

&Key=

cmd /c erase /F "

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

"!"""&"""

",#)#%("8""

?""$

22222222

930 2|222

2222222

.Rr23D#X2X2X2Z

.Rr22FÂ»`fX0X2Z

.Rr23D5ba

.Rr23D/b`c

.Rr23D `fX3X2Z

.Rr23D"fX0X2Z

.Rr22E

.Rr22E'b

.Rr22E=

( (((,(((

%)(@(.)(

(()()(-(

(8((8(((2

22222222222222

22322232223222

22220222

2222=2223

GetProcessHeap

user32.dll

oleaut32.dll

advapi32.dll

RegOpenKeyExA

RegCreateKeyA

RegCloseKey

WinExec

GetWindowsDirectoryA

t!==9sff!

KWindows

LUnit_GetWeb

Unit_NsPass

ADVAPI32.dll

Software\Microsoft\Windows\CurrentVersion\Explorer

IEXPLORE.EXE_2064_rwx_00421000_00071000:

UDPSockError

NMUDP

Errmsg

Port

TNMUDP

RemotePort

LocalPort

ReportLevelLkB

0.0.0.0

%d.%d.%d.%d

AutoHotkeys

:].tJ

EInvalidGraphicOperation,0C

EInvalidGraphicOperation

KeyPreview,

WindowState

OnKeyDown

OnKeyPressdzD

OnKeyUp

ssHotTrack

TWindowState

poProportional

TWMKey

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

TDragOperation

TKeyEvent

TKeyPressEvent

crSQLWait

%s (%s)

IMM32.DLL

EInvalidOperation

%s[%d]

%s_%d

USER32.DLL

comctl32.dll

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

kernel32.dll

explorer.exe

Software\Microsoft\Windows\CurrentVersion\Explorer

*.TMP

Kernel32.dll

ADVAPI32.dll

RegOpenKeyExA

RegCloseKey

readbook.exe

rundll32.exe

*.exe

*.scr

UdpT

UdpOnDataReceived

xxtype.cpp

derv->tpClass.tpcFlags & CF_HAS_BASES

Inappropriate I/O control operation

Broken pipe

Operation not permitted

%H:%M:%S

%m/%d/%y

%A, %B %d, %Y

d/d/d d:d:d.d

An exception (X) occurred during DllEntryPoint or DllMain in module:

xx.cpp

varType->tpClass.tpcFlags & CF_HAS_DTOR

varType->tpClass.tpcDtorAddr

(errPtr->ERRcInitDtc >= varType->tpClass.tpcDtorCount) || flags

memType->tpClass.tpcFlags & CF_HAS_DTOR

varType->tpArr.tpaElemType->tpClass.tpcFlags & CF_HAS_DTOR

dttPtr->dttType->tpPtr.tppBaseType->tpClass.tpcFlags & CF_HAS_DTOR

IS_CLASS(dttPtr->dttType->tpMask) && (dttPtr->dttType->tpClass.tpcFlags & CF_HAS_DTOR)

elemType->tpClass.tpcFlags & CF_HAS_DTOR

Cv.SCv

Bv}.Bv

ReportLevel

GetCPInfo

GetProcessHeap

GetWindowsDirectoryA

RegCreateKeyExA

RegFlushKey

SetViewportOrgEx

ActivateKeyboardLayout

EnumThreadWindows

EnumWindows

GetKeyNameTextA

GetKeyState

GetKeyboardLayout

GetKeyboardLayoutList

GetKeyboardState

GetKeyboardType

LoadKeyboardLayoutA

MapVirtualKeyA

MsgWaitForMultipleObjects

SetWindowsHookExA

UnhookWindowsHookEx

VprK|%Ud

â‚¬00404

8 @ @ @ @ @

.text

`.data

.idata

@.edata

@.rsrc

@.reloc

70"!(&&$

External exception %x

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

Win32 Error. Code: %d.

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Operation aborted%Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'

Invalid variant operation"Variant method calls not supported

I/O error %d

Integer overflow Invalid floating point operation

Invalid data type for '%s'

Failed to set data for '%s'

Failed to get data for '%s'/Menu '%s' is already being used by another form*Windows socket error: %s (%d), on API '%s'

Asynchronous socket error %d

- Dock zone has no control%List does not allow duplicates ($0%x)!'%s' is not a valid integer value

Alt Clipboard does not support Icons

!Control '%s' has no parent window

Error reading %s%s%s: %s

Ancestor for '%s' not found

Unsupported clipboard format

Class %s not found

Resource %s not found

List index out of bounds (%d) List capacity out of bounds (%d)

List count out of bounds (%d) Operation not allowed on sorted string list%String list does not allow duplicates#A component named %s already exists$''%s'' is not a valid component name

A class named %s already exists

Cannot assign a %s to a %s

Cannot create file %s

Cannot open file %s

svchost.exe_3704:

.text

`.data

.rsrc

@.reloc

msvcrt.dll

API-MS-Win-Core-ProcessThreads-L1-1-0.dll

KERNEL32.dll

NTDLL.DLL

API-MS-Win-Security-Base-L1-1-0.dll

API-MS-WIN-Service-Core-L1-1-0.dll

API-MS-WIN-Service-winsvc-L1-1-0.dll

RPCRT4.dll

ole32.dll

ntdll.dll

_amsg_exit

RegCloseKey

RegOpenKeyExW

GetProcessHeap

svchost.pdb

version="5.1.0.0"

name="Microsoft.Windows.Services.SvcHost"

Host Process for Windows Services

Software\Microsoft\Windows NT\CurrentVersion\Svchost

Software\Microsoft\Windows NT\CurrentVersion\MgdSvchost

\PIPE\

Host Process for Windows Services

6.1.7600.16385 (win7_rtm.090713-1255)

svchost.exe

Windows

Operating System

6.1.7600.16385

DrvInst.exe_1272:

.text

`.data

.rsrc

@.reloc

msvcrt.dll

ntdll.dll

API-MS-Win-Core-Debug-L1-1-0.dll

API-MS-Win-Core-ErrorHandling-L1-1-0.dll

API-MS-Win-Core-File-L1-1-0.dll

API-MS-Win-Core-Handle-L1-1-0.dll

API-MS-Win-Core-Heap-L1-1-0.dll

API-MS-Win-Core-Interlocked-L1-1-0.dll

API-MS-Win-Core-IO-L1-1-0.dll

API-MS-Win-Core-LibraryLoader-L1-1-0.dll

API-MS-Win-Core-LocalRegistry-L1-1-0.dll

API-MS-Win-Core-Memory-L1-1-0.dll

API-MS-Win-Core-Misc-L1-1-0.dll

API-MS-Win-Core-ProcessThreads-L1-1-0.dll

API-MS-Win-Core-Profile-L1-1-0.dll

API-MS-Win-Core-String-L1-1-0.dll

API-MS-Win-Core-Synch-L1-1-0.dll

API-MS-Win-Core-SysInfo-L1-1-0.dll

API-MS-Win-Security-Base-L1-1-0.dll

SETUPAPI.dll

cfgmgr32.DLL

devrtl.DLL

KERNEL32.dll

Exception in DRVINST.EXE HandleDeviceInstallEntry!, ExceptionCode = 0xlx

Exception in DRVINST.EXE wmain!, ExceptionCode = 0xlx

Driver package failed signature validation. Error = 0xX

System restore disabled by policy. Error = 0xX

Unable to mark devices that match new INF - (x)!

DRVINST.EXE: Entering debugger while %ws driver package to Driver Store.

Ea~Cancel Windows Update search failed!

Received request to cancel Windows Update search.

CancelWUOperation

Error (x):Unexpected cancel wait failure!

Error 0x%X opening up RunOnce key.

{Core Device Install - exit(0xx)}

Queueing up error report since device installation failed...

Policy is set to skip sending error report for additional software requested

Additional software is requested so a WER report should be sent, but the sending of WER reports from drvinst has been suppressed.

Queueing up error report since additional software is requested...

Policy is set to skip sending error report for generic device driver install

A generic driver was installed so a WER report should be sent, but the sending of WER reports from drvinst has been suppressed.

Queueing up error report since device driver is generic...

Queueing up error report since device has a PnP problem...

Device install status=0xx

Error(x) installing device!

Enabling shuffle-move file queue operations.

Error(x) determining installation policy for device!

Error(x) creating drvinst install mutex!

No driver found on Windows Update.

Failed to load download functions from search DLL! Error=%d

Selecting best match from Windows Update...

Failed to build driver list from WU package. Error=%d

Found driver on Windows Update, downloading - %.1f MB...

Windows Update driver search cancelled.

Error(x) opening WU cancel event!

Error(x) creating WU search serialization mutex!

Failed to load search function from search DLL! Error=%d

Searching Windows Update for drivers...

INF specified BasicDriverOk for this device, skipping Windows Update search.

Failed to load WU search DLL! Error=%d

Failed to load initialization functions from search DLL! Error=%d

Skipping Windows Update because no internet connection!

Device driver was updated during servicing, skipping Windows Update search.

Driver Store import failed, failing install.

Error(x) creating cancel thread!

Error(x) opening cancel thread event!

Error(x) creating end-cancel thread event!

Error(x) creating Device Manager sync event!

DRVINST.EXE: Entering debugger during PnP device installation.

DRVINST.EXE: Waiting for debugger on Process ID = %d ...

DRVINST.EXE: Unknown DebugInstall options, NOT breaking to debugger.

The system will restart in %d seconds in order to enforce device installation restriction policy.

{Driver package policy check - exit(0xx)}

Driver Package importation is subject to policy

{Device installation policy check [%ws] exit(0xx)}

{Device Installation Restrictions Policy Check - exit(0xx)}

{Device Removal Initiated by Policy Change [%ws] exit(0xx)}

API-MS-Win-Security-SDDL-L1-1-0.dll

ADVAPI32.dll

COMCTL32.dll

OS Version = %d.%d.%d

Service Pack = %d.%d

Suite = 0xx

ProductType = %d

Architecture = %s

d/d/d

d:d:d.d

[Exit status: FAILURE(0xx)]

cmd: %s

os: Version = %d.%d.%d, Service Pack = %d.%d, Suite = 0xx, ProductType = %d, Architecture = %s

[Boot Session: d/d/d d:d:d.d]

[%s - %s]

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegQueryInfoKeyW

drvstore.dll

DrvInst.pdb

udPPj

Ht.Ht

PSSSSSSh

pServerImportDriverPackage

_amsg_exit

SetupDiReportDeviceInstallError

SetupDiReportAdditionalSoftwareRequested

SetupDiReportGenericDriverInstalled

SetupDiReportPnPDeviceProblem

SetupDiReportDriverNotFoundError

SetupDiOpenDevRegKey

GetSystemWindowsDirectoryW

GetProcessHeap

name="Microsoft.Windows.DrvInst"

version="5.1.0.0"

2"363;3@3

Global\DrvInst_CancelSearch_{86EC8168-ECD8-46ac-B312-AAE1DAF80BB8}

!%d-%d-%d

...

streamci.dll

rundll32.exe

Software\Microsoft\Windows\CurrentVersion\RunOnce

setupapi.dll

!DrvInst.exe_mutex_{5B10AC83-4F13-4fde-8C0B-B85681BA8D73}

!DrvInst.exe_mutex_{6848E37B-F8FA-404d-AF21-279E723B6D35}

Software\Microsoft\Windows\CurrentVersion\Device Installer

Software\Microsoft\Windows\CurrentVersion\Component Based Servicing\DoqInProgress

Software\Microsoft\Windows\CurrentVersion\DriverSearching

Software\Policies\Microsoft\Windows\DriverSearching

Software\Microsoft\Windows\CurrentVersion\DriverSearching\Plugin

Software\Policies\Microsoft\Windows\DeviceInstall

Software\Policies\Microsoft\Windows\DriverInstall

Registry Keys

Software\Microsoft\Windows\CurrentVersion\Setup

setupapi.offline.log

setupapi.dev.log

setupapi.app.log

%s.ddd_ddd.%s

%s.????????_??????.%s

setupapi.ev3

setupapi.ev2

setupapi.ev1

advapi32.dll

6.1.7600.16385 (win7_rtm.090713-1255)

DrvInst.EXE

Windows

Operating System

6.1.7600.16385

rundll32.exe_3876:

.text

`.data

.rsrc

@.reloc

KERNEL32.dll

USER32.dll

msvcrt.dll

imagehlp.dll

ntdll.dll

Av.TBv

?.ulf

.ue9]

ole32.dll

_amsg_exit

_wcmdln

rundll32.pdb

name="Microsoft.Windows.Shell.rundll32"

version="5.1.0.0"

name="Microsoft.Windows.Shell.rundll32"

version="5.1.0.0"

.....eZXnnnnnnnnnnnn3

....eDXnnnnnnnnnnnn3

...eDXnnnnnnnnnnnn,

.eDXnnnnnnnnnnnn,

%Xnnnnnnnnnnnnnnn1

O3$dS7"%U9

.manifest

{00000000-0000-0000-0000-000000000000}

\\?\Volume

\\?\UNC\

rundll32.exe

Windows host process (Rundll32)

6.1.7600.16385 (win7_rtm.090713-1255)

RUNDLL32.EXE

Windows

Operating System

6.1.7600.16385

Explorer.EXE_2024_rwx_046C1000_00071000:

UDPSockError

NMUDP

Errmsg

Port

TNMUDP

RemotePort

LocalPort

ReportLevelLkl

0.0.0.0

%d.%d.%d.%d

AutoHotkeys

:].tJ

EInvalidGraphicOperation,0m

EInvalidGraphicOperation

KeyPreview,

WindowState

OnKeyDown

OnKeyPressdzn

OnKeyUp

ssHotTrack

TWindowState

poProportional

TWMKey

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

TDragOperation

TKeyEvent

TKeyPressEvent

crSQLWait

%s (%s)

IMM32.DLL

EInvalidOperation

%s[%d]

%s_%d

USER32.DLL

comctl32.dll

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

kernel32.dll

explorer.exe

Software\Microsoft\Windows\CurrentVersion\Explorer

*.TMP

Kernel32.dll

ADVAPI32.dll

RegOpenKeyExA

RegCloseKey

readbook.exe

rundll32.exe

*.exe

*.scr

UdpT

UdpOnDataReceived

xxtype.cpp

derv->tpClass.tpcFlags & CF_HAS_BASES

Inappropriate I/O control operation

Broken pipe

Operation not permitted

%H:%M:%S

%m/%d/%y

%A, %B %d, %Y

d/d/d d:d:d.d

An exception (X) occurred during DllEntryPoint or DllMain in module:

xx.cpp

varType->tpClass.tpcFlags & CF_HAS_DTOR

varType->tpClass.tpcDtorAddr

(errPtr->ERRcInitDtc >= varType->tpClass.tpcDtorCount) || flags

memType->tpClass.tpcFlags & CF_HAS_DTOR

varType->tpArr.tpaElemType->tpClass.tpcFlags & CF_HAS_DTOR

dttPtr->dttType->tpPtr.tppBaseType->tpClass.tpcFlags & CF_HAS_DTOR

IS_CLASS(dttPtr->dttType->tpMask) && (dttPtr->dttType->tpClass.tpcFlags & CF_HAS_DTOR)

elemType->tpClass.tpcFlags & CF_HAS_DTOR

Cv.SCv

Bv}.Bv

ReportLevel

GetCPInfo

GetProcessHeap

GetWindowsDirectoryA

RegCreateKeyExA

RegFlushKey

SetViewportOrgEx

ActivateKeyboardLayout

EnumThreadWindows

EnumWindows

GetKeyNameTextA

GetKeyState

GetKeyboardLayout

GetKeyboardLayoutList

GetKeyboardState

GetKeyboardType

LoadKeyboardLayoutA

MapVirtualKeyA

MsgWaitForMultipleObjects

SetWindowsHookExA

UnhookWindowsHookEx

VprK|%Ud

â‚¬00404

8 @ @ @ @ @

.text

`.data

.idata

@.edata

@.rsrc

@.reloc

70"!(&&$

External exception %x

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

Win32 Error. Code: %d.

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Operation aborted%Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'

Invalid variant operation"Variant method calls not supported

I/O error %d

Integer overflow Invalid floating point operation

Invalid data type for '%s'

Failed to set data for '%s'

Failed to get data for '%s'/Menu '%s' is already being used by another form*Windows socket error: %s (%d), on API '%s'

Asynchronous socket error %d

- Dock zone has no control%List does not allow duplicates ($0%x)!'%s' is not a valid integer value

Alt Clipboard does not support Icons

!Control '%s' has no parent window

Error reading %s%s%s: %s

Ancestor for '%s' not found

Unsupported clipboard format

Class %s not found

Resource %s not found

List index out of bounds (%d) List capacity out of bounds (%d)

List count out of bounds (%d) Operation not allowed on sorted string list%String list does not allow duplicates#A component named %s already exists$''%s'' is not a valid component name

A class named %s already exists

Cannot assign a %s to a %s

Cannot create file %s

Cannot open file %s

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps

Related articles