Susp_Dropper (Kaspersky), Gen:Variant.Barys.49635 (AdAware), Backdoor.Win32.Farfli.FD, WormRebhip.YR, GenericAutorunWorm.YR (Lavasoft MAS)Behaviour: Backdoor, Worm, WormAutorun
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 994700a15e89908c467ef43672fbbe36
SHA1: 5ebf60d8fc5f94e9f693ee317a8b2b73f8ec9de8
SHA256: 7c17df942cd0d4b77c10ccee8397179ee1afa67f3138e596825d660f01f2a035
SSDeep: 24576:ECdxte/80jYLT3U1jfsWaT2cmXySUaIMA6KtEpnOuhQ:Vw80cTsjkWaT2bUaIiIt7
Size: 1245184 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Downtown Media
Created at: 2016-04-02 04:17:16
Analyzed on: WindowsXP SP3 32-bit
Summary: Backdoor. Malware that enables a remote control of victim's machine.
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Backdoor's file once a user opens a drive's folder in Windows Explorer. |
Process activity
The Backdoor creates the following process(es):
TempNajaf.exe:1780
server.exe:2232
Tempserver.exe:1028
%original file name%.exe:1332
The Backdoor injects its code into the following process(es):
WindowsApplication1.exe:844
Tempprogram.exe:1264
svchost.exe:1816
Explorer.EXE:532
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process WindowsApplication1.exe:844 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\TempNajaf.exe (1645 bytes)
The Backdoor deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\Security.exe (0 bytes)
The process TempNajaf.exe:1780 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Tempserver.exe (266 bytes)
%Documents and Settings%\%current user%\Local Settings\Tempprogram.exe (192 bytes)
The process Tempserver.exe:1028 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\X-GRY-X.txt (222 bytes)
%Program Files%\Large\server.exe (1425 bytes)
The process %original file name%.exe:1332 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (3273 bytes)
%Program Files%\WindowsApplication1.exe (2105 bytes)
The Backdoor deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (0 bytes)
Registry activity
The process WindowsApplication1.exe:844 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8F A6 5C 91 C4 B4 9D EA D7 85 43 4E 7A E8 C0 C2"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings]
"TempNajaf.exe" = "WindowsApplication"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
The Backdoor modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Backdoor modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Backdoor modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The process TempNajaf.exe:1780 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "16 5C 3F 33 A0 31 4A A3 91 75 19 94 E0 21 AC 35"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings]
"Tempserver.exe" = "Tempserver"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings]
"Tempprogram.exe" = "MegaDumper"
The Backdoor modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Backdoor modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Backdoor modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The process server.exe:2232 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F0 87 24 DE 2C E2 AA FD 2E 79 E6 69 B2 D5 8B FF"
The process Tempprogram.exe:1264 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2F E8 C9 85 6B 80 61 9F 10 77 69 5F 8B 5D 2A 36"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
The process Tempserver.exe:1028 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D1 5B 3F 9F 7C 70 8E 00 7D 7A 50 2C D4 2F FB C5"
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{MB3JKSW-Y883-WE0K-IY6U-SL6N6I178}]
"StubPath" = "%Program Files%\Large\server.exe Restart"
To automatically run itself each time Windows is booted, the Backdoor adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HKLM" = "%Program Files%\Large\server.exe"
The process %original file name%.exe:1332 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "09 53 F3 A9 F4 26 33 33 6F F6 4C 2F 59 48 DE 2D"
Dropped PE files
MD5 | File path |
---|---|
f6d2ff6c8926c84a6af30474c84cbdd0 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\TempNajaf.exe |
fe3939ed3ab1b6c8e93187e9dedee944 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Tempprogram.exe |
529eb73d6dc60315f463af1aa56b2c70 | c:\Program Files\Large\server.exe |
b813fe66a27dd81df48c961541f7ba24 | c:\Program Files\WindowsApplication1.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Backdoor's file once a user opens a drive's folder in Windows Explorer.
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
TempNajaf.exe:1780
server.exe:2232
Tempserver.exe:1028
%original file name%.exe:1332 - Delete the original Backdoor file.
- Delete or disinfect the following files created/modified by the Backdoor:
%Documents and Settings%\%current user%\Local Settings\TempNajaf.exe (1645 bytes)
%Documents and Settings%\%current user%\Local Settings\Tempserver.exe (266 bytes)
%Documents and Settings%\%current user%\Local Settings\Tempprogram.exe (192 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\X-GRY-X.txt (222 bytes)
%Program Files%\Large\server.exe (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (3273 bytes)
%Program Files%\WindowsApplication1.exe (2105 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HKLM" = "%Program Files%\Large\server.exe" - Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.
Static Analysis
VersionInfo
Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description:
Comments:
Language: Language Neutral
Company Name: Product Name: Product Version: Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: File Description: Comments: Language: Language Neutral
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 580910 | 581120 | 4.62736 | c2c2260508750422d20cd5cbb116b146 |
.rdata | 585728 | 188686 | 188928 | 3.99304 | 4513b58651e3d8d87c81a396e5b2f1d1 |
.data | 778240 | 36724 | 20992 | 0.830952 | c2de4a3d214eae7e87c7bfc06bd79775 |
.rsrc | 815104 | 423836 | 423936 | 5.4883 | 4814183959ebbd91cb34ffa2e803d228 |
.reloc | 1241088 | 28976 | 29184 | 4.70119 | 1254908a9a03d2bcf12045d49cd572b9 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Map
The Backdoor connects to the servers at the folowing location(s):
Strings from Dumps
svchost.exe_1816:
.text
.text
`.data
`.data
.rsrc
.rsrc
ADVAPI32.dll
ADVAPI32.dll
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
RPCRT4.dll
RPCRT4.dll
NETAPI32.dll
NETAPI32.dll
ole32.dll
ole32.dll
ntdll.dll
ntdll.dll
RegCloseKey
RegCloseKey
RegOpenKeyExW
RegOpenKeyExW
GetProcessHeap
GetProcessHeap
NtOpenKey
NtOpenKey
svchost.pdb
svchost.pdb
\PIPE\
\PIPE\
Software\Microsoft\Windows NT\CurrentVersion\Svchost
Software\Microsoft\Windows NT\CurrentVersion\Svchost
\Registry\Machine\System\CurrentControlSet\Control\SecurePipeServers\
\Registry\Machine\System\CurrentControlSet\Control\SecurePipeServers\
5.1.2600.5512 (xpsp.080413-2111)
5.1.2600.5512 (xpsp.080413-2111)
svchost.exe
svchost.exe
Windows
Windows
Operating System
Operating System
5.1.2600.5512
5.1.2600.5512
svchost.exe_1816_rwx_00090000_00001000:
KERNEL32.DLL
KERNEL32.DLL
svchost.exe_1816_rwx_001D0000_00001000:
KERNEL32.DLL
KERNEL32.DLL
svchost.exe_1816_rwx_00210000_00001000:
KERNEL32.DLL
KERNEL32.DLL
svchost.exe_1816_rwx_00240000_00001000:
user32.dll
user32.dll
DW20.EXE_1220:
.text
.text
`.data
`.data
.cdata
.cdata
.rsrc
.rsrc
watson.microsoft.com
watson.microsoft.com
.mdmp
.mdmp
%s?szAppName=%S&szAppVer=%S&szAppStamp=%S&szModName=%S&szModVer=%S&szModStamp=%S&fDebug=%S&offset=%S
%s?szAppName=%S&szAppVer=%S&szAppStamp=%S&szModName=%S&szModVer=%S&szModStamp=%S&fDebug=%S&offset=%S
/dw/stagetwo.asp
/dw/stagetwo.asp
%s/%S/%S/%S/%S/%S/%S/%S/%S.htm
%s/%S/%S/%S/%S/%S/%S/%S/%S.htm
Failed to fill report params from generic params
Failed to fill report params from generic params
Not offering reporting
Not offering reporting
%s Mode
%s Mode
Failed to get a reporting destination
Failed to get a reporting destination
Nothing to report from queue
Nothing to report from queue
No reports left to send. Removing queue triggers and bailing.
No reports left to send. Removing queue triggers and bailing.
Failed to plug UI; LCID=%u
Failed to plug UI; LCID=%u
Ignoring %S due to unknown queue version
Ignoring %S due to unknown queue version
Reporting is disabled
Reporting is disabled
SignOff queue reporting is disabled
SignOff queue reporting is disabled
Queued Reporting Mode called but still want to report to the queue
Queued Reporting Mode called but still want to report to the queue
Bad queue type to report from
Bad queue type to report from
No reports for given queue mask - %u
No reports for given queue mask - %u
Invalid queue mask - %u
Invalid queue mask - %u
Suspending: Force cancel to queued reporting
Suspending: Force cancel to queued reporting
Suspending: Force cancel to network reporting
Suspending: Force cancel to network reporting
CreateWindowExA failed with %d.
CreateWindowExA failed with %d.
Application Error Reporting %d
Application Error Reporting %d
WatsonQueuedReportingInstanceVerification
WatsonQueuedReportingInstanceVerification
riched20.dll
riched20.dll
qMicrosoft\PCHealth\ErrorReporting\DW
qMicrosoft\PCHealth\ErrorReporting\DW
msaccess.exe
msaccess.exe
hXXp://watson.microsoft.com/dw/dcp.asp
hXXp://watson.microsoft.com/dw/dcp.asp
hXXp://watson.microsoft.com/dw/watsoninfo.asp
hXXp://watson.microsoft.com/dw/watsoninfo.asp
dwintl20.dll
dwintl20.dll
Launching lightweight browser with URL
Launching lightweight browser with URL
mshtml.dll
mshtml.dll
Not reporting
Not reporting
Reporting
Reporting
DWBypassQueue
DWBypassQueue
DWExplainerURL
DWExplainerURL
DWNoSignOffQueueReporting
DWNoSignOffQueueReporting
DWAlwaysReport
DWAlwaysReport
DWReporteeName
DWReporteeName
DWURLLaunch
DWURLLaunch
DWNoExternalURL
DWNoExternalURL
DWStressReport
DWStressReport
ole32.dll
ole32.dll
imm32.dll
imm32.dll
BTLog.dll
BTLog.dll
Microsoft\PCHealth\ErrorReporting\DW
Microsoft\PCHealth\ErrorReporting\DW
HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug\Debugger
HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug\Debugger
hXXp://
hXXp://
hXXps://
hXXps://
Software\Microsoft\PCHealth\ErrorReporting\DW\Debug
Software\Microsoft\PCHealth\ErrorReporting\DW\Debug
%s\%s
%s\%s
https
https
DwBTLog.log
DwBTLog.log
Failed to get minidump for %S!
Failed to get minidump for %S!
szAppName=%s
szAppName=%s
szAppVer=%d.%d.%d.%d
szAppVer=%d.%d.%d.%d
szAppStamp=x
szAppStamp=x
szModName=%s
szModName=%s
szModVer=%d.%d.%d.%d
szModVer=%d.%d.%d.%d
szModStamp=x
szModStamp=x
fDebug=%s
fDebug=%s
offset=x
offset=x
microsoft.com
microsoft.com
.msn.com
.msn.com
.microsoft.com
.microsoft.com
d:d:d d-d-d
d:d:d d-d-d
/dw/generictwo.asp
/dw/generictwo.asp
kernel32.dll
kernel32.dll
psapi.dll
psapi.dll
mso.dll
mso.dll
MsoDWRecover%x
MsoDWRecover%x
MsoDWHang%x
MsoDWHang%x
Launching browser with URL
Launching browser with URL
shell32.dll
shell32.dll
%d.%d.%d.%d
%d.%d.%d.%d
%d.%d.%d.%d.x.%d.%d
%d.%d.%d.%d.x.%d.%d
shfolder.dll
shfolder.dll
unknown.sig
unknown.sig
%s dw20.exe %d.%d.%d.%d
%s dw20.exe %d.%d.%d.%d
RegKey=
RegKey=
ResponseURL=
ResponseURL=
URLLaunch=
URLLaunch=
NoExternalURL=
NoExternalURL=
%s:(%s) XX
%s:(%s) XX
%s:(%s) X
%s:(%s) X
%s:(%s)
%s:(%s)
%s:(%s) %s
%s:(%s) %s
registry.txt
registry.txt
wql.txt
wql.txt
Windows NT Version %d.%d Build: %d
Windows NT Version %d.%d Build: %d
Stage 1 server response: %s
Stage 1 server response: %s
Stage 2 server response: %s
Stage 2 server response: %s
Stage 4 server response: %s
Stage 4 server response: %s
StatusCode: %d
StatusCode: %d
Opening server: %s
Opening server: %s
HttpOpen failed.
HttpOpen failed.
Opening %s Request:
Opening %s Request:
HTTPS
HTTPS
HttpSend Failed.
HttpSend Failed.
HttpWrite Failed, GLE=%d.
HttpWrite Failed, GLE=%d.
HttpEndReq failed.
HttpEndReq failed.
Count filename length greater than MAX_PATH, can't report.
Count filename length greater than MAX_PATH, can't report.
Filesystem reporting: count file updated
Filesystem reporting: count file updated
FReportToQueue: GetLastError=%u
FReportToQueue: GetLastError=%u
FReportToQueue: File Tree Root does not exist: %S
FReportToQueue: File Tree Root does not exist: %S
Failed to add heap file to cab: %S
Failed to add heap file to cab: %S
memory.dmp
memory.dmp
mdmpmem.hdmp
mdmpmem.hdmp
version.txt
version.txt
Network reporting complete.
Network reporting complete.
Network reporting failed.
Network reporting failed.
Application Error Reporting Transfer %d
Application Error Reporting Transfer %d
Filesystem reporting complete
Filesystem reporting complete
Filesystem reporting: cab successfully written
Filesystem reporting: cab successfully written
Filesystem reporting: could not find/create directory for cab/count
Filesystem reporting: could not find/create directory for cab/count
Filesystem reporting: redirection failure, too many redirects
Filesystem reporting: redirection failure, too many redirects
Filesystem reporting: redirection failure, no previous roots
Filesystem reporting: redirection failure, no previous roots
Filesystem reporting: improper file tree root
Filesystem reporting: improper file tree root
Filesystem reporting cancelled
Filesystem reporting cancelled
Filesystem reporting: file tree root is too long
Filesystem reporting: file tree root is too long
Record: 0xxx
Record: 0xxx
Address: 0xxx
Address: 0xxx
Code: 0xx
Code: 0xx
Flags: 0xx
Flags: 0xx
x:x
x:x
(%d.%d:%d.%d)
(%d.%d:%d.%d)
Checksum: 0xx
Checksum: 0xx
Time Stamp: 0xx
Time Stamp: 0xx
Image Base: 0xx
Image Base: 0xx
Image Size: 0xx
Image Size: 0xx
Module %d
Module %d
Windows NT %d.%d Build: %d
Windows NT %d.%d Build: %d
CPU AMD Feature Code: X
CPU AMD Feature Code: X
CPU Version: X CPU Feature Code: X
CPU Version: X CPU Feature Code: X
CPU Vendor Code: X - X - X
CPU Vendor Code: X - X - X
0xx:
0xx:
0xx: x x x x
0xx: x x x x
EFlags: 0xx ESP: 0xx SegSs: 0xx
EFlags: 0xx ESP: 0xx SegSs: 0xx
EIP: 0xx EBP: 0xx SegCs: 0xx
EIP: 0xx EBP: 0xx SegCs: 0xx
EBX: 0xx ECX: 0xx EDX: 0xx
EBX: 0xx ECX: 0xx EDX: 0xx
EDI: 0xx ESI: 0xx EAX: 0xx
EDI: 0xx ESI: 0xx EAX: 0xx
Thread ID: 0xx
Thread ID: 0xx
Thread %d
Thread %d
Memory Range %d
Memory Range %d
Software\Microsoft\PCHealth\ErrorReporting\DW
Software\Microsoft\PCHealth\ErrorReporting\DW
OkToReportFromTheseQueues
OkToReportFromTheseQueues
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Failed to obtain queue mutex. GetLastError=%u
Failed to obtain queue mutex. GetLastError=%u
FGetQueueMutex: WaitForSingleObject returned %u
FGetQueueMutex: WaitForSingleObject returned %u
Failed to open or create queue mutex. GetLastError=%u
Failed to open or create queue mutex. GetLastError=%u
Failed queued reporting pester check
Failed queued reporting pester check
Failed to create run reg key
Failed to create run reg key
Persistent run key is set.
Persistent run key is set.
CoInitializeEx() returned 0x%x.
CoInitializeEx() returned 0x%x.
Reporting to Admin Queue
Reporting to Admin Queue
Reporting to Regular Queue
Reporting to Regular Queue
Reporting to SignOff Queue
Reporting to SignOff Queue
Reporting to Headless Queue
Reporting to Headless Queue
Reporting from Regular Queue
Reporting from Regular Queue
Reporting from SignOff Queue
Reporting from SignOff Queue
Reporting from Headless Queue
Reporting from Headless Queue
OOM Failed to alloc QueuedReportData
OOM Failed to alloc QueuedReportData
FAllocSD: GetLastError=%u
FAllocSD: GetLastError=%u
%s%s%s
%s%s%s
FEnsureQueueDirW: GetLastError=%u
FEnsureQueueDirW: GetLastError=%u
Failed to write snt. GLE: %u
Failed to write snt. GLE: %u
Failed to create snt. GLE: %u
Failed to create snt. GLE: %u
Failed to set info; bad queue type: %u
Failed to set info; bad queue type: %u
Failed to open reg key for queue
Failed to open reg key for queue
Failed to get windows folder path for queue: %u
Failed to get windows folder path for queue: %u
Failed to move instr file from queue A to queue B - %u
Failed to move instr file from queue A to queue B - %u
Failed to move cab file from queue A to queue B - %u
Failed to move cab file from queue A to queue B - %u
Did not move any reports from admin q to user q
Did not move any reports from admin q to user q
Did not move any reports from user q to headless q
Did not move any reports from user q to headless q
Queue types that have reports: %u
Queue types that have reports: %u
Setting triggerAtConnectionMade to: %u
Setting triggerAtConnectionMade to: %u
Setting triggerAtLogon to: %u
Setting triggerAtLogon to: %u
Setting the queue trigger based upon: %u
Setting the queue trigger based upon: %u
SUCCESS adding report to queue
SUCCESS adding report to queue
Launched (%S)
Launched (%S)
Failed to store the SensSubscription. hr: %d
Failed to store the SensSubscription. hr: %d
failed to allocate PROGID string: %S
failed to allocate PROGID string: %S
Failed putting SubscriberInterface. hr: %d
Failed putting SubscriberInterface. hr: %d
Failed putting PerUser. hr: %d
Failed putting PerUser. hr: %d
Failed putting Enabled. hr: %d
Failed putting Enabled. hr: %d
Failed putting MachineName. hr: %d
Failed putting MachineName. hr: %d
Failed putting OwnerSID. hr: %d
Failed putting OwnerSID. hr: %d
Failed putting Description. hr: %d
Failed putting Description. hr: %d
Failed putting InterfaceID. hr: %d
Failed putting InterfaceID. hr: %d
Failed putting EventClassID. hr: %d
Failed putting EventClassID. hr: %d
Failed putting MethodName. hr: %d
Failed putting MethodName. hr: %d
Failed putting SubscriptionName. hr: %d
Failed putting SubscriptionName. hr: %d
Failed putting PublisherID. hr: %d
Failed putting PublisherID. hr: %d
Failed putting SubscriberCLSID. hr: %d
Failed putting SubscriberCLSID. hr: %d
Failed putting SubscriptionID. hr: %d
Failed putting SubscriptionID. hr: %d
Failed CoCreateInstance on EventSubscription. hr: %d
Failed CoCreateInstance on EventSubscription. hr: %d
Failed to remove the SensSubscription. hr: %d
Failed to remove the SensSubscription. hr: %d
failed to allocate query string: %S
failed to allocate query string: %S
Failed CoCreateInstance on EventSystem. hr: %d
Failed CoCreateInstance on EventSystem. hr: %d
SENS: StringFromIID() returned
SENS: StringFromIID() returned
DWSHARED: SysAllocString(%s) failed!
DWSHARED: SysAllocString(%s) failed!
Failed to subscribe subscription %u. hr: %d
Failed to subscribe subscription %u. hr: %d
Failed to get data for subscription %u. hr: %d
Failed to get data for subscription %u. hr: %d
Failed to query install reg key
Failed to query install reg key
Failed to open install reg key
Failed to open install reg key
Software\Microsoft\PCHealth\ErrorReporting\DW\Installed
Software\Microsoft\PCHealth\ErrorReporting\DW\Installed
HKEY_USERS\
HKEY_USERS\
HKEY_CURRENT_CONFIG\
HKEY_CURRENT_CONFIG\
HKEY_CLASSES_ROOT\
HKEY_CLASSES_ROOT\
HKEY_LOCAL_MACHINE\
HKEY_LOCAL_MACHINE\
HKEY_CURRENT_USER\
HKEY_CURRENT_USER\
initing CDwAccessible: hwnd %x, idc %d, m_pDefAcc %x, cRef %d
initing CDwAccessible: hwnd %x, idc %d, m_pDefAcc %x, cRef %d
freeing CDwAccessible: hwnd %x, idc %d, m_pDefAcc %x, cRef %d
freeing CDwAccessible: hwnd %x, idc %d, m_pDefAcc %x, cRef %d
0addref CDwAccessible: hwnd %x, idc %d, m_pDefAcc %x, cRef %d
0addref CDwAccessible: hwnd %x, idc %d, m_pDefAcc %x, cRef %d
QIing CDwAccessible: hwnd %x, idc %d, m_pDefAcc %x, cRef %d
QIing CDwAccessible: hwnd %x, idc %d, m_pDefAcc %x, cRef %d
releasing CDwAccessible: hwnd %x, idc %d, m_pDefAcc %x, cRef %d
releasing CDwAccessible: hwnd %x, idc %d, m_pDefAcc %x, cRef %d
deleting CDwAccessible: hwnd %x, idc %d, m_pDefAcc %x, cRef %d
deleting CDwAccessible: hwnd %x, idc %d, m_pDefAcc %x, cRef %d
creating CDwAccessible: hwnd %x, idc %d
creating CDwAccessible: hwnd %x, idc %d
WriteAtOffset.Write(0x%x) failed, 0xx
WriteAtOffset.Write(0x%x) failed, 0xx
WriteAtOffset.Seek(0x%x) failed, 0xx
WriteAtOffset.Seek(0x%x) failed, 0xx
WriteMemoryFromProcess.Read(0x%I64x, 0x%x) failed, 0xx
WriteMemoryFromProcess.Read(0x%I64x, 0x%x) failed, 0xx
WriteStringToPool.Write(0x%x) failed, 0xx
WriteStringToPool.Write(0x%x) failed, 0xx
WriteFunctionTable.RawEntries.Write(0x%x) failed, 0xx
WriteFunctionTable.RawEntries.Write(0x%x) failed, 0xx
WriteFunctionTable.RawTable.Write(0x%x) failed, 0xx
WriteFunctionTable.RawTable.Write(0x%x) failed, 0xx
WriteFunctionTableList.DumpTable.Write(0x%x) failed, 0xx
WriteFunctionTableList.DumpTable.Write(0x%x) failed, 0xx
WriteFunctionTableList.Seek(0x%x) failed, 0xx
WriteFunctionTableList.Seek(0x%x) failed, 0xx
WriteDirectoryEntry.Write(0x%x) failed, 0xx
WriteDirectoryEntry.Write(0x%x) failed, 0xx
Thread(0x%x) callback returned FALSE
Thread(0x%x) callback returned FALSE
WriteSystemInfo.GetOsCsdString failed, 0xx
WriteSystemInfo.GetOsCsdString failed, 0xx
WriteSystemInfo.GetCpuInfo failed, 0xx
WriteSystemInfo.GetCpuInfo failed, 0xx
CalculateSizeForSystemInfo.GetOsCsdString failed, 0xx
CalculateSizeForSystemInfo.GetOsCsdString failed, 0xx
WriteHeader.GetCurrentTimeDate failed, 0xx
WriteHeader.GetCurrentTimeDate failed, 0xx
WriteDirectoryTable.Seek(0x%x) failed, 0xx
WriteDirectoryTable.Seek(0x%x) failed, 0xx
WriteMemoryInfo.Write(0x%x) failed, 0xx
WriteMemoryInfo.Write(0x%x) failed, 0xx
WriteMemoryInfo.QueryVirtual(0x%I64x) failed, 0xx
WriteMemoryInfo.QueryVirtual(0x%I64x) failed, 0xx
WriteFullMemory virtual memory layout changed, retries %d, 0x%I64x (0x%I64x:0x%I64x) vs. 0x%I64x (0x%I64x:0x%I64x)
WriteFullMemory virtual memory layout changed, retries %d, 0x%I64x (0x%I64x:0x%I64x) vs. 0x%I64x (0x%I64x:0x%I64x)
WriteFullMemory.Memory.Write(0x%x) failed, 0xx
WriteFullMemory.Memory.Write(0x%x) failed, 0xx
WriteFullMemory.Memory.Read(0x%I64x, 0x%x) failed, retries %d, 0xx
WriteFullMemory.Memory.Read(0x%I64x, 0x%x) failed, retries %d, 0xx
WriteFullMemory.QueryVirtual(0x%I64x) for data failed, 0xx
WriteFullMemory.QueryVirtual(0x%I64x) for data failed, 0xx
WriteFullMemory.Desc.Write(0x%x) failed, 0xx
WriteFullMemory.Desc.Write(0x%x) failed, 0xx
WriteFullMemory.QueryVirtual(0x%I64x) for info failed, 0xx
WriteFullMemory.QueryVirtual(0x%I64x) for info failed, 0xx
Kernel minidump write failed, 0xx
Kernel minidump write failed, 0xx
MarshalExceptionPointers.CxRecord.Read(0x%I64x, 0x%x) failed, 0xx
MarshalExceptionPointers.CxRecord.Read(0x%I64x, 0x%x) failed, 0xx
MarshalExceptionPointers.ExRecord.Read(0x%I64x, 0x%x) failed, 0xx
MarshalExceptionPointers.ExRecord.Read(0x%I64x, 0x%x) failed, 0xx
Invalid exception record parameter count (0x%x)
Invalid exception record parameter count (0x%x)
Invalid exception record size (0x%x)
Invalid exception record size (0x%x)
Invalid CPU type (0x%x)
Invalid CPU type (0x%x)
Invalid function table size (0x%x)
Invalid function table size (0x%x)
GetSystemType.GetOsInfo failed, 0xx
GetSystemType.GetOsInfo failed, 0xx
GetSystemType.GetCpuType failed, 0xx
GetSystemType.GetCpuType failed, 0xx
Write.Start failed, 0xx
Write.Start failed, 0xx
Dump type requires streaming but output provider does not support streaming
Dump type requires streaming but output provider does not support streaming
Invalid dump type 0x%x
Invalid dump type 0x%x
dbghelp.dll
dbghelp.dll
Alloc(0x%x) failed
Alloc(0x%x) failed
Thread(0x%x) will not be included
Thread(0x%x) will not be included
GenGetImageSections.Section.Read(0x%I64x, 0x%x) failed, 0xx
GenGetImageSections.Section.Read(0x%I64x, 0x%x) failed, 0xx
GenGetImageSections.GenImageNtHeader(0x%I64x) failed
GenGetImageSections.GenImageNtHeader(0x%I64x) failed
GenGetImageSections.Read(0x%I64x, 0x%x) failed, 0xx
GenGetImageSections.Read(0x%I64x, 0x%x) failed, 0xx
0GenAllocateThreadObject.GetTebInfo(0x%x) failed, 0xx
0GenAllocateThreadObject.GetTebInfo(0x%x) failed, 0xx
GenAllocateThreadObject.GetContext(0x%x) failed, 0xx
GenAllocateThreadObject.GetContext(0x%x) failed, 0xx
GenAllocateThreadObject.Open(0x%x) failed, 0xx
GenAllocateThreadObject.Open(0x%x) failed, 0xx
GenReadTlsDirectory.Index(0x%I64x, %ws) failed, 0xx
GenReadTlsDirectory.Index(0x%I64x, %ws) failed, 0xx
GenReadTlsDirectory(0x%I64x, %ws) unknown machine 0x%x
GenReadTlsDirectory(0x%I64x, %ws) unknown machine 0x%x
GenReadTlsDirectory.Read(0x%I64x, %ws) failed, 0xx
GenReadTlsDirectory.Read(0x%I64x, %ws) failed, 0xx
GenAllocateModuleObject.GenDebugRecord(0x%I64x, %ws) failed, 0xx
GenAllocateModuleObject.GenDebugRecord(0x%I64x, %ws) failed, 0xx
GenAllocateModuleObject.GenImageNtHeader(0x%I64x, %ws) failed, 0xx
GenAllocateModuleObject.GenImageNtHeader(0x%I64x, %ws) failed, 0xx
GenAllocateModuleObject.GetImageHeaderInfo(0x%I64x, %ws) failed, 0xx
GenAllocateModuleObject.GetImageHeaderInfo(0x%I64x, %ws) failed, 0xx
GenAllocateModuleObject.GetVersion(0x%I64x, %ws) failed, 0xx
GenAllocateModuleObject.GetVersion(0x%I64x, %ws) failed, 0xx
GenAllocateProcessObject.GetPeb(0x%x) failed, 0xx
GenAllocateProcessObject.GetPeb(0x%x) failed, 0xx
GenIncludeUnwindInfoMemory.Enum(0x%I64x, 0x%x) failed, 0xx
GenIncludeUnwindInfoMemory.Enum(0x%I64x, 0x%x) failed, 0xx
GenGenTebMemory.TLS(0x%I64x) failed, 0xx
GenGenTebMemory.TLS(0x%I64x) failed, 0xx
GenScanAddressSpace.QueryVirtual(0x%I64x) failed, 0xx
GenScanAddressSpace.QueryVirtual(0x%I64x) failed, 0xx
0GenGetAuxMemory(%ws) failed, 0xx
0GenGetAuxMemory(%ws) failed, 0xx
GenGetProcessInfo.EnumUnloadedModules(0x%x) failed, 0xx
GenGetProcessInfo.EnumUnloadedModules(0x%x) failed, 0xx
GenGetProcessInfo.EnumUnloadedModules(0x%x) looped
GenGetProcessInfo.EnumUnloadedModules(0x%x) looped
GenGetProcessInfo.EnumFunctionTableEntries(0x%I64x, 0x%x) failed, 0xx
GenGetProcessInfo.EnumFunctionTableEntries(0x%I64x, 0x%x) failed, 0xx
GenGetProcessInfo.EnumFunctionTables(0x%x) failed, 0xx
GenGetProcessInfo.EnumFunctionTables(0x%x) failed, 0xx
GenGetProcessInfo.EnumFunctionTables(0x%x) looped
GenGetProcessInfo.EnumFunctionTables(0x%x) looped
GenGetProcessInfo.EnumModules(0x%x) failed, 0xx
GenGetProcessInfo.EnumModules(0x%x) failed, 0xx
GenGetProcessInfo.EnumModules(0x%x) looped
GenGetProcessInfo.EnumModules(0x%x) looped
GenGetProcessInfo.EnumThreads(0x%x) failed, 0xx
GenGetProcessInfo.EnumThreads(0x%x) failed, 0xx
GenGetProcessInfo.EnumThreads(0x%x) looped
GenGetProcessInfo.EnumThreads(0x%x) looped
GenGetProcessInfo.Start(0x%x) failed, 0xx
GenGetProcessInfo.Start(0x%x) failed, 0xx
GenWriteHandleData.Desc.Write(0x%x) failed, 0xx
GenWriteHandleData.Desc.Write(0x%x) failed, 0xx
GenWriteHandleData.Header.Write(0x%x) failed, 0xx
GenWriteHandleData.Header.Write(0x%x) failed, 0xx
GenWriteHandleData.ObjectName.Write(0x%x) failed, 0xx
GenWriteHandleData.ObjectName.Write(0x%x) failed, 0xx
GenWriteHandleData.ObjectNameLen.Write(0x%x) failed, 0xx
GenWriteHandleData.ObjectNameLen.Write(0x%x) failed, 0xx
GenWriteHandleData.TypeName.Write(0x%x) failed, 0xx
GenWriteHandleData.TypeName.Write(0x%x) failed, 0xx
GenWriteHandleData.TypeNameLen.Write(0x%x) failed, 0xx
GenWriteHandleData.TypeNameLen.Write(0x%x) failed, 0xx
GenWriteHandleData.Start(0x%x) failed, 0xx
GenWriteHandleData.Start(0x%x) failed, 0xx
GenWriteHandleData.Seek(0x%x) failed, 0xx
GenWriteHandleData.Seek(0x%x) failed, 0xx
Software\Microsoft\Windows NT\CurrentVersion\MiniDumpAuxiliaryDlls
Software\Microsoft\Windows NT\CurrentVersion\MiniDumpAuxiliaryDlls
Software\Microsoft\Windows NT\CurrentVersion\KnownManagedDebuggingDlls
Software\Microsoft\Windows NT\CurrentVersion\KnownManagedDebuggingDlls
version.dll
version.dll
ntdll.dll
ntdll.dll
%$%,%4%
%$%,%4%
S%T%U%V%W%X%Y%Z%[%\%]%^%_%`%a%
S%T%U%V%W%X%Y%Z%[%\%]%^%_%`%a%
b%c%d%e%f%g%h%i%j%k%l%
b%c%d%e%f%g%h%i%j%k%l%
!"#$%&'()* ,-./0123456789:;
!"#$%&'()* ,-./0123456789:;
!!!!2222
!!!!2222
%%%f||||
%%%f||||
!!!!2222||||
!!!!2222||||
!"#$%&'(
!"#$%&'(
'()* ,-./0
'()* ,-./0
&'()* ,-./
&'()* ,-./
&'()* ,-./012345
&'()* ,-./012345
3456789
3456789
.ASex
.ASex
!"#$%&'()* ,-./012
!"#$%&'()* ,-./012
!"#$%&'()
!"#$%&'()
?msodatad.dat
?msodatad.dat
msodatalast.dat
msodatalast.dat
Unicows.dll
Unicows.dll
Kernel32.dll
Kernel32.dll
SHLWAPI.DLL
SHLWAPI.DLL
GDI32.DLL
GDI32.DLL
wintrust.dll
wintrust.dll
1108160
1108160
0u.hN
0u.hN
0SSh
0SSh
t.WWWj
t.WWWj
PSSh07
PSSh07
t5SSh(
t5SSh(
PSSSSSSh
PSSSSSSh
0SSSSh
0SSSSh
ADVAPI32.dll
ADVAPI32.dll
COMCTL32.dll
COMCTL32.dll
GDI32.dll
GDI32.dll
KERNEL32.dll
KERNEL32.dll
OLEACC.dll
OLEACC.dll
OLEAUT32.dll
OLEAUT32.dll
MSVCRT.dll
MSVCRT.dll
RPCRT4.dll
RPCRT4.dll
SHELL32.dll
SHELL32.dll
SHLWAPI.dll
SHLWAPI.dll
urlmon.dll
urlmon.dll
USER32.dll
USER32.dll
VERSION.dll
VERSION.dll
WININET.dll
WININET.dll
RegCloseKey
RegCloseKey
RegOpenKeyExA
RegOpenKeyExA
RegCreateKeyExA
RegCreateKeyExA
ReportEventA
ReportEventA
ReportEventW
ReportEventW
RegEnumKeyExA
RegEnumKeyExA
RegQueryInfoKeyA
RegQueryInfoKeyA
RegQueryInfoKeyW
RegQueryInfoKeyW
GetProcessHeap
GetProcessHeap
GetSystemWindowsDirectoryW
GetSystemWindowsDirectoryW
_amsg_exit
_amsg_exit
_acmdln
_acmdln
ShellExecuteExA
ShellExecuteExA
UrlGetPartA
UrlGetPartA
CreateURLMoniker
CreateURLMoniker
CreateDialogIndirectParamA
CreateDialogIndirectParamA
EnumWindows
EnumWindows
HttpQueryInfoA
HttpQueryInfoA
HttpSendRequestExA
HttpSendRequestExA
HttpOpenRequestA
HttpOpenRequestA
InternetCanonicalizeUrlA
InternetCanonicalizeUrlA
InternetCrackUrlA
InternetCrackUrlA
HttpEndRequestA
HttpEndRequestA
dw20.pdb
dw20.pdb
\devsplab1\otools\BBT_TEMP\DW20O.pdb
\devsplab1\otools\BBT_TEMP\DW20O.pdb
winword.exe
winword.exe
wwordlt.exe
wwordlt.exe
excel.exe
excel.exe
excellt.exe
excellt.exe
mspub.exe
mspub.exe
frontpg.exe
frontpg.exe
outlook.exe
outlook.exe
powerpnt.exe
powerpnt.exe
powpntlt.exe
powpntlt.exe
onenote.exe
onenote.exe
infopath.exe
infopath.exe
winproj.exe
winproj.exe
ois.exe
ois.exe
visio.exe
visio.exe
`!`'`)` `
`!`'`)` `
e%f-f|3 f'f/f
e%f-f|3 f'f/f
]!^"^#^ ^$^
]!^"^#^ ^$^
t.uGuHu
t.uGuHu
x4x7x%x-x x
x4x7x%x-x x
h&h(h.hMh:h%h h,k/k-k1k4kmk
h&h(h.hMh:h%h h,k/k-k1k4kmk
k%lzmcmdmvm
k%lzmcmdmvm
^Q]Q~NzP}P\PGPCPLPZPIPePvPNPUPuPtPwPOP
^Q]Q~NzP}P\PGPCPLPZPIPePvPNPUPuPtPwPOP
]8^6^3^7^
]8^6^3^7^
ichczc]eVeQeYeWe_UOeXeUeTe
ichczc]eVeQeYeWe_UOeXeUeTe
{1{ {-{/{2{8{
{1{ {-{/{2{8{
r6s%s4s)s:t*t3t"t%t5t6t4t/t
r6s%s4s)s:t*t3t"t%t5t6t4t/t
t&t(t%u&ukuju
t&t(t%u&ukuju
WHX%X
WHX%X
`IaJa aEa6a2a.aFa/aOa)a@a bh
`IaJa aEa6a2a.aFa/aOa)a@a bh
d@d%d'd
d@d%d'd
duewexei
duewexei
kCpDpJpHpIpEpFp
kCpDpJpHpIpEpFp
S$S%S&S'S(S)S S,S.S2S3S5S6S8S:S;SBSFSKSNSOSPSUSVSXSYS[S]S_SbSdSeSgShSiSjSkSmStSvSzS}S~S
S$S%S&S'S(S)S S,S.S2S3S5S6S8S:S;SBSFSKSNSOSPSUSVSXSYS[S]S_SbSdSeSgShSiSjSkSmStSvSzS}S~S
U U!U"U#U$U%U(U)U U:U=U?UBUGUIULUSUTUXUYUZU[U]U`UgUhUiUkUlUmUnUoUpUqUrUsUtUxUyUzU
U U!U"U#U$U%U(U)U U:U=U?UBUGUIULUSUTUXUYUZU[U]U`UgUhUiUkUlUmUnUoUpUqUrUsUtUxUyUzU
c c!c"c#c$c%c&c'c.c0c1c5c7c?cRcSc[c\c]c^c_c`cacbcccdcfcjclcsctcyc~c
c c!c"c#c$c%c&c'c.c0c1c5c7c?cRcSc[c\c]c^c_c`cacbcccdcfcjclcsctcyc~c
m!m#m$m&mCmDmEmFmGmHmImJmKmLmMmNmOmPmQmRmSmTmUmVmWm[m\m]mkmqmrmsm
m!m#m$m&mCmDmEmFmGmHmImJmKmLmMmNmOmPmQmRmSmTmUmVmWm[m\m]mkmqmrmsm
nRsSsh
nRsSsh
evg%f
evg%f
m.tRa
m.tRa
gtr%x
gtr%x
Q%SKg
Q%SKg
f.ebp>QI
f.ebp>QI
y.yxT
y.yxT
fn:q%uN
fn:q%uN
aw.Toiz
aw.Toiz
RMeXe
RMeXe
S#S$S%S;ScSdSrSsStSuS
S#S$S%S;ScSdSrSsStSuS
`!`"`&`'`)`*` `,`-`.`/`0`2`3`4`5`6`:`=`>`?`
`!`"`&`'`)`*` `,`-`.`/`0`2`3`4`5`6`:`=`>`?`
^ ^!^"^#^$^%^&^'^.^}^
^ ^!^"^#^$^%^&^'^.^}^
c c!c"c#c$c%c&c'c*c7c:c;cSc[c1e?e@eAeBeCeDeEe
c c!c"c#c$c%c&c'c*c7c:c;cSc[c1e?e@eAeBeCeDeEe
f f!f"f#f$f%f&f'f(f)f*f f,f-f
f f!f"f#f$f%f&f'f(f)f*f f,f-f
m m!m"m#m$m%m&m'm(m)m*m m,m-m.m1m2m3m4m5m6m7m8m9m:m;mm?m@mBmCmDmGmHmImJmKmLmMmNmOmPmQmRmSmTmUm
m m!m"m#m$m%m&m'm(m)m*m m,m-m.m1m2m3m4m5m6m7m8m9m:m;mm?m@mBmCmDmGmHmImJmKmLmMmNmOmPmQmRmSmTmUm
u u-u.uFuGuHuIuJuKuLuMuNuOuPuQuRuSu
u u-u.uFuGuHuIuJuKuLuMuNuOuPuQuRuSu
U U!U"U#U$U%U&U'U(U4UJU
U U!U"U#U$U%U&U'U(U4UJU
](^)^*^ ^,^-^/^0^1^
](^)^*^ ^,^-^/^0^1^
m/mAmFmVmWmXmYmZm[m\m]m^m_m`mambmcmdmemfmgmhmimjmkmlmmmnmompmqmrmsmtmumvmwmxmymzm{m|m}m~m
m/mAmFmVmWmXmYmZm[m\m]m^m_m`mambmcmdmemfmgmhmimjmkmlmmmnmompmqmrmsmtmumvmwmxmymzm{m|m}m~m
x x!x"x#x$x%x'x(x)x*x x,x.x/x0x1x2x3x4x5x6x7x8x9x:x;xx?x@xAxXy_yaycydyeygyiyjykylynyoy
x x!x"x#x$x%x'x(x)x*x x,x.x/x0x1x2x3x4x5x6x7x8x9x:x;xx?x@xAxXy_yaycydyeygyiyjykylynyoy
} }!}"}#}$}%}&}'}
} }!}"}#}$}%}&}'}
] ]!]"]#]$]%]&]'](])]*] ],]-].]/]0]
] ]!]"]#]$]%]&]'](])]*] ],]-].]/]0]
]2^3^4^5^6^7^8^9^:^;^^
]2^3^4^5^6^7^8^9^:^;^^
cMeNeOePeQeReSeTeUeWeXeYeZe[e]ebe
cMeNeOePeQeReSeTeUeWeXeYeZe[e]ebe
X X!X"X#X$X%X&X'X(X)X*X X,X-X.X/X0X1X3X4X6X7X8X9X:X;XX?X@XAXBXCXDXEXFXGXHXJXTX_X`XfXmX
X X!X"X#X$X%X&X'X(X)X*X X,X-X.X/X0X1X3X4X6X7X8X9X:X;XX?X@XAXBXCXDXEXFXGXHXJXTX_X`XfXmX
d%d-d0d=dRdad2e\e^e_e`eaecedeeefegeheiejele
d%d-d0d=dRdad2e\e^e_e`eaecedeeefegeheiejele
s"s#s$s%s&s(s)s,s-s/s0s1s2s3s4s5s6s8s9s>s@sGs
s"s#s$s%s&s(s)s,s-s/s0s1s2s3s4s5s6s8s9s>s@sGs
u$u%u&u/ujukulumunuouqurusutu
u$u%u&u/ujukulumunuouqurusutu
duewexeyeze{e
duewexeyeze{e
~ ~!~"~#~$~%~&~'~(~*~ ~-~8~:~0
~ ~!~"~#~$~%~&~'~(~*~ ~-~8~:~0
| |!|"|#|$|%|&|(|)|*|-|.|/|0|1|2|6|
| |!|"|#|$|%|&|(|)|*|-|.|/|0|1|2|6|
{3~3}3|3
{3~3}3|3
eZl%u
eZl%u
Q.YeY
Q.YeY
R:\Sg|p5rL
R:\Sg|p5rL
e$e#e e4e5e7e6e8eKuHeVeUeMeXe^e]erexei
e$e#e e4e5e7e6e8eKuHeVeUeMeXe^e]erexei
s4s/s)s%s>sNsOs
s4s/s)s%s>sNsOs
s&t*t)t.tbt
s&t*t)t.tbt
2%2.bx
2%2.bx
{ | }9},
{ | }9},
d6exe9j
d6exe9j
]%sOu4](n
]%sOu4](n
m.t.zB}
m.t.zB}
w%xIyWy
w%xIyWy
^vcÓv
^vcÓv
%f?iCt
%f?iCt
U>_.lE
U>_.lE
f.ebp
f.ebp
.nrR=
.nrR=
{fn:q%uN
{fn:q%uN
windowsapplication1.exe
windowsapplication1.exe
name="Microsoft.Windows.ErrorReporter"
name="Microsoft.Windows.ErrorReporter"
version="5.1.0.0"
version="5.1.0.0"
publicKeyToken="6595b64144ccf1df" />
publicKeyToken="6595b64144ccf1df" />
Windows Error Reporting
Windows Error Reporting
name="Microsoft.Windows.Common-Controls"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
publicKeyToken="6595b64144ccf1df"
1%s\%s\%s\%s\%s\%s\%s\%s
1%s\%s\%s\%s\%s\%s\%s\%s
AppName: %s AppVer: %s AppStamp:%s
AppName: %s AppVer: %s AppStamp:%s
ModName: %s ModVer: %s ModStamp:%s
ModName: %s ModVer: %s ModStamp:%s
fDebug: %s Offset: %s
fDebug: %s Offset: %s
Main_AlwaysReportBtn=
Main_AlwaysReportBtn=
Main_NoReportBtn=
Main_NoReportBtn=
Main_ReportBtn=
Main_ReportBtn=
General_Reportee=
General_Reportee=
CheckBoxRegKey=
CheckBoxRegKey=
ReportingFlags=
ReportingFlags=
Stage1URL=
Stage1URL=
Stage2URL=
Stage2URL=
%General_Reportee%
%General_Reportee%
%u %s
%u %s
%u.%u %s
%u.%u %s
%s %s %s %s in %s %s %s fDebug %s at offset %s
%s %s %s %s in %s %s %s fDebug %s at offset %s
Bucket: d
Bucket: d
BucketTable %d
BucketTable %d
%s, %s, %s, %s, %s, %s, %s, %s, %s, %s %s
%s, %s, %s, %s, %s, %s, %s, %s, %s, %s %s
\dw.log
\dw.log
policy.txt
policy.txt
crash.log
crash.log
status.txt
status.txt
hits.log
hits.log
count.txt
count.txt
%s\%s\%s
%s\%s\%s
%s\%s\%s\%s
%s\%s\%s\%s
eDWQueuedReporting
eDWQueuedReporting
DWPersistentQueuedReporting
DWPersistentQueuedReporting
"%s\%s" -%c
"%s\%s" -%c
dwtrig20.exe
dwtrig20.exe
ReportSize=
ReportSize=
\*.cab
\*.cab
dwq.snt
dwq.snt
"%s" -%c %u
"%s" -%c %u
SEventSystem.EventSubscription
SEventSystem.EventSubscription
SubscriptionID=%s
SubscriptionID=%s
#$%&%&'(
#$%&%&'(
Comctl32.dll
Comctl32.dll
WindowsApplication1.exe
WindowsApplication1.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\E00D6.dmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\E00D6.dmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp
WindowsApplication1
WindowsApplication1
.NET Runtime 4.0 Error Reporting
.NET Runtime 4.0 Error Reporting
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\dw.log
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\dw.log
Microsoft Application Error Reporting
Microsoft Application Error Reporting
11.0.8160
11.0.8160
Windows
Windows
DW20.Exe
DW20.Exe
svchost.exe_1816_rwx_00280000_00001000:
user32.dll
user32.dll
svchost.exe_1816_rwx_002B0000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_1816_rwx_002E0000_00001000:
RegCloseKey
RegCloseKey
svchost.exe_1816_rwx_002F0000_00001000:
advapi32.dll
advapi32.dll
svchost.exe_1816_rwx_00AC0000_00001000:
oleaut32.dll
oleaut32.dll
svchost.exe_1816_rwx_00B00000_00001000:
oleaut32.dll
oleaut32.dll
svchost.exe_1816_rwx_00B30000_00001000:
mpr.dll
mpr.dll
svchost.exe_1816_rwx_00F80000_00001000:
mpr.dll
mpr.dll
svchost.exe_1816_rwx_00FB0000_00001000:
gdi32.dll
gdi32.dll
svchost.exe_1816_rwx_00FF0000_00001000:
gdi32.dll
gdi32.dll
svchost.exe_1816_rwx_01130000_00001000:
ntdll.dll
ntdll.dll
svchost.exe_1816_rwx_01270000_00001000:
ntdll.dll
ntdll.dll
svchost.exe_1816_rwx_012A0000_00001000:
wininet.dll
wininet.dll
svchost.exe_1816_rwx_013D0000_00001000:
FtpOpenFileA
FtpOpenFileA
svchost.exe_1816_rwx_013E0000_00001000:
wininet.dll
wininet.dll
svchost.exe_1816_rwx_01410000_00001000:
wsock32.dll
wsock32.dll
svchost.exe_1816_rwx_01550000_00001000:
wsock32.dll
wsock32.dll
svchost.exe_1816_rwx_01580000_00001000:
ole32.dll
ole32.dll
svchost.exe_1816_rwx_016D0000_00001000:
ole32.dll
ole32.dll
svchost.exe_1816_rwx_01700000_00001000:
gdiplus.dll
gdiplus.dll
svchost.exe_1816_rwx_01840000_00001000:
gdiplus.dll
gdiplus.dll
svchost.exe_1816_rwx_01870000_00001000:
AVICAP32.DLL
AVICAP32.DLL
svchost.exe_1816_rwx_018B0000_00001000:
AVICAP32.DLL
AVICAP32.DLL
svchost.exe_1816_rwx_018E0000_00001000:
shell32.dll
shell32.dll
svchost.exe_1816_rwx_01920000_00001000:
shell32.dll
shell32.dll
svchost.exe_1816_rwx_01950000_00001000:
winmm.dll
winmm.dll
svchost.exe_1816_rwx_01CA0000_00001000:
winmm.dll
winmm.dll
svchost.exe_1816_rwx_01CD0000_00001000:
powrprof.dll
powrprof.dll
svchost.exe_1816_rwx_01E10000_00001000:
powrprof.dll
powrprof.dll
svchost.exe_1816_rwx_01E40000_00001000:
msacm32.dll
msacm32.dll
svchost.exe_1816_rwx_01F80000_00001000:
msacm32.dll
msacm32.dll
svchost.exe_1816_rwx_24070000_0005E000:
!Win32 .DLL.
!Win32 .DLL.
.MPRESS1
.MPRESS1
`.MPRESS2
`.MPRESS2
`.rsrc
`.rsrc
kernel32.dll
kernel32.dll
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
SHFileOperationA
SHFileOperationA
shell32.dll
shell32.dll
URLDownloadToFileA
URLDownloadToFileA
urlmon.dll
urlmon.dll
ShellExecuteA
ShellExecuteA
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
GetWindowsDirectoryA
GetWindowsDirectoryA
SOFTWARE\Microsoft\Windows\CurrentVersion
SOFTWARE\Microsoft\Windows\CurrentVersion
http\shell\open\command
http\shell\open\command
\Internet Explorer\iexplore.exe
\Internet Explorer\iexplore.exe
####@####
####@####
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
Portugal
Portugal
Turkey
Turkey
Windows 8
Windows 8
Windows 3.1
Windows 3.1
Windows 95 (Release 2)
Windows 95 (Release 2)
Windows 95
Windows 95
Windows 98 SE
Windows 98 SE
Windows 98
Windows 98
Windows ME
Windows ME
Windows 7
Windows 7
Windows Vista
Windows Vista
%s %s
%s %s
Windows XP Professional x64
Windows XP Professional x64
Windows XP Home
Windows XP Home
Windows XP Professional
Windows XP Professional
Windows 2000 Professional
Windows 2000 Professional
Windows NT %d.%d
Windows NT %d.%d
Windows 2008
Windows 2008
%s %s Server
%s %s Server
Windows 2003 Server Datacenter
Windows 2003 Server Datacenter
Windows 2003 Server Enterprise
Windows 2003 Server Enterprise
Windows 2003 Server Web Edition
Windows 2003 Server Web Edition
Windows 2003 Server
Windows 2003 Server
Windows Home Server
Windows Home Server
Windows 2003 Server (Release 2)
Windows 2003 Server (Release 2)
Windows 2000 Server Datacenter
Windows 2000 Server Datacenter
Windows 2000 Server Enterprise
Windows 2000 Server Enterprise
Windows 2000 Server Web Edition
Windows 2000 Server Web Edition
Windows 2000 Server
Windows 2000 Server
Windows NT 4.0 Server Datacenter
Windows NT 4.0 Server Datacenter
Windows NT 4.0 Server Enterprise
Windows NT 4.0 Server Enterprise
Windows NT 4.0 Server Web Edition
Windows NT 4.0 Server Web Edition
Windows NT 4.0 Server
Windows NT 4.0 Server
Unknown Platform ID (%d)
Unknown Platform ID (%d)
%d.%d
%d.%d
%s (Build: %d
%s (Build: %d
- Service Pack: %s
- Service Pack: %s
KERNEL32.DLL
KERNEL32.DLL
teste.vbs
teste.vbs
teste.txt
teste.txt
Set objSecurityCenter = GetObject("winmgmts:\\.\root\SecurityCenter")
Set objSecurityCenter = GetObject("winmgmts:\\.\root\SecurityCenter")
Set colFirewall = objSecurityCenter.ExecQuery("Select * From FirewallProduct",,48)
Set colFirewall = objSecurityCenter.ExecQuery("Select * From FirewallProduct",,48)
Set colAntiVirus = objSecurityCenter.ExecQuery("Select * From AntiVirusProduct",,48)
Set colAntiVirus = objSecurityCenter.ExecQuery("Select * From AntiVirusProduct",,48)
Set objFileSystem = CreateObject("Scripting.fileSystemObject")
Set objFileSystem = CreateObject("Scripting.fileSystemObject")
Set objFile = objFileSystem.CreateTextFile("
Set objFile = objFileSystem.CreateTextFile("
Info = Info & "F" & CountFw & ") " & objFirewall.displayName & " v" & objFirewall.versionNumber & Enter
Info = Info & "F" & CountFw & ") " & objFirewall.displayName & " v" & objFirewall.versionNumber & Enter
Info = Info & "A" & CountAV & ") " & objAntiVirus.displayName & " v" & objAntiVirus.versionNumber & Enter
Info = Info & "A" & CountAV & ") " & objAntiVirus.displayName & " v" & objAntiVirus.versionNumber & Enter
objFile.WriteLine(Info)
objFile.WriteLine(Info)
objFile.Close
objFile.Close
xxgryxx.exe
xxgryxx.exe
AVICAP32.dll
AVICAP32.dll
tFtpAccess
tFtpAccess
BuildImportTable: can't load library:
BuildImportTable: can't load library:
BuildImportTable: ReallocMemory failed
BuildImportTable: ReallocMemory failed
BuildImportTable: GetProcAddress failed
BuildImportTable: GetProcAddress failed
BTMemoryLoadLibary: BuildImportTable failed
BTMemoryLoadLibary: BuildImportTable failed
BTMemoryGetProcAddress: no export table found
BTMemoryGetProcAddress: no export table found
BTMemoryGetProcAddress: DLL doesn't export anything
BTMemoryGetProcAddress: DLL doesn't export anything
BTMemoryGetProcAddress: exported symbol not found
BTMemoryGetProcAddress: exported symbol not found
SetupApi.dll
SetupApi.dll
SetupDiOpenClassRegKey
SetupDiOpenClassRegKey
SetupDiOpenClassRegKeyExA
SetupDiOpenClassRegKeyExA
SetupDiOpenClassRegKeyExW
SetupDiOpenClassRegKeyExW
SetupDiCreateDeviceInterfaceRegKeyA
SetupDiCreateDeviceInterfaceRegKeyA
SetupDiCreateDeviceInterfaceRegKeyW
SetupDiCreateDeviceInterfaceRegKeyW
SetupDiOpenDeviceInterfaceRegKey
SetupDiOpenDeviceInterfaceRegKey
SetupDiDeleteDeviceInterfaceRegKey
SetupDiDeleteDeviceInterfaceRegKey
SetupDiCreateDevRegKeyA
SetupDiCreateDevRegKeyA
SetupDiCreateDevRegKeyW
SetupDiCreateDevRegKeyW
SetupDiOpenDevRegKey
SetupDiOpenDevRegKey
SetupDiDeleteDevRegKey
SetupDiDeleteDevRegKey
CM_DEVCAP_LOCKSUPPORTED
CM_DEVCAP_LOCKSUPPORTED
CM_DEVCAP_EJECTSUPPORTED
CM_DEVCAP_EJECTSUPPORTED
PDCAP_D0_SUPPORTED
PDCAP_D0_SUPPORTED
PDCAP_D1_SUPPORTED
PDCAP_D1_SUPPORTED
PDCAP_D2_SUPPORTED
PDCAP_D2_SUPPORTED
PDCAP_D3_SUPPORTED
PDCAP_D3_SUPPORTED
PDCAP_WAKE_FROM_D0_SUPPORTED
PDCAP_WAKE_FROM_D0_SUPPORTED
PDCAP_WAKE_FROM_D1_SUPPORTED
PDCAP_WAKE_FROM_D1_SUPPORTED
PDCAP_WAKE_FROM_D2_SUPPORTED
PDCAP_WAKE_FROM_D2_SUPPORTED
PDCAP_WAKE_FROM_D3_SUPPORTED
PDCAP_WAKE_FROM_D3_SUPPORTED
PDCAP_WARM_EJECT_SUPPORTED
PDCAP_WARM_EJECT_SUPPORTED
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_USERS
127.0.0.1
127.0.0.1
iphlpapi.dll
iphlpapi.dll
AllocateAndGetTcpExTableFromStack
AllocateAndGetTcpExTableFromStack
AllocateAndGetUdpExTableFromStack
AllocateAndGetUdpExTableFromStack
SetTcpEntry
SetTcpEntry
GetExtendedTcpTable
GetExtendedTcpTable
GetExtendedUdpTable
GetExtendedUdpTable
Mozilla3_5Password
Mozilla3_5Password
GetChromePass
GetChromePass
StartHttpProxy
StartHttpProxy
1.2.3
1.2.3
keyboardkey
keyboardkey
webcaminactive
webcaminactive
webcamgetbuffer
webcamgetbuffer
webcam
webcam
enviarexecnormal
enviarexecnormal
enviarexechidden
enviarexechidden
openweb
openweb
downexec
downexec
sendftp
sendftp
keylogger
keylogger
keyloggergetlog
keyloggergetlog
keyloggereraselog
keyloggereraselog
keyloggerativar
keyloggerativar
keyloggerdesativar
keyloggerdesativar
renamekey
renamekey
windowsfechar
windowsfechar
windowsmax
windowsmax
windowsmin
windowsmin
windowsmostrar
windowsmostrar
windowsocultar
windowsocultar
windowsmintodas
windowsmintodas
windowscaption
windowscaption
listarportas
listarportas
listarportasdns
listarportasdns
finalizarprocessoportas
finalizarprocessoportas
webcamsettings
webcamsettings
chatmsg
chatmsg
getpassword
getpassword
updateservidorweb
updateservidorweb
keyloggersearch
keyloggersearch
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
PSAPI.dll
PSAPI.dll
\config\SteamAppData.vdf
\config\SteamAppData.vdf
AutoLoginUser
AutoLoginUser
/ClientRegistry.Blob
/ClientRegistry.Blob
\ClientRegistry.blob
\ClientRegistry.blob
\steam.dll
\steam.dll
%SYS%
%SYS%
ÞSKTOP%
ÞSKTOP%
FirstExecution
FirstExecution
chatmsg|
chatmsg|
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
listarjanelas|windowsfechar|
listarjanelas|windowsfechar|
listarjanelas|windowsmax|
listarjanelas|windowsmax|
listarjanelas|windowsmin|
listarjanelas|windowsmin|
listarjanelas|windowsmostrar|
listarjanelas|windowsmostrar|
listarjanelas|windowsocultar|
listarjanelas|windowsocultar|
listarjanelas|windowsmintodas|
listarjanelas|windowsmintodas|
listarjanelas|windowscaption|
listarjanelas|windowscaption|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
listarportas|listadeportaspronta|
listarportas|listadeportaspronta|
listarportas|finalizarconexao|
listarportas|finalizarconexao|
listarportas|finalizarprocessoportas|Y|
listarportas|finalizarprocessoportas|Y|
listarportas|finalizarprocessoportas|N|
listarportas|finalizarprocessoportas|N|
registro|renamekey|
registro|renamekey|
keylogger|keylogger|keyloggerativar|
keylogger|keylogger|keyloggerativar|
keylogger|keylogger|keyloggerdesativar|
keylogger|keylogger|keyloggerdesativar|
keylogger|keyloggergetlog|
keylogger|keyloggergetlog|
keylogger|keylogger|keyloggervazio|
keylogger|keylogger|keyloggervazio|
keyloggersearchok|
keyloggersearchok|
webcam|webcaminactive|
webcam|webcaminactive|
webcam|webcamactive|
webcam|webcamactive|
_y_X_PASSWORDLIST_X_y_
_y_X_PASSWORDLIST_X_y_
NOIP.abc
NOIP.abc
MSN.abc
MSN.abc
FIREFOX.abc
FIREFOX.abc
IELOGIN.abc
IELOGIN.abc
IEPASS.abc
IEPASS.abc
IEAUTO.abc
IEAUTO.abc
IEWEB.abc
IEWEB.abc
SOFTWARE\Mozilla\Mozilla Firefox
SOFTWARE\Mozilla\Mozilla Firefox
getfirefox
getfirefox
getielogin
getielogin
getiepass
getiepass
getieweb
getieweb
getchrome
getchrome
getpassword|getpasswordlist|
getpassword|getpasswordlist|
getpassword|getpassworderror|
getpassword|getpassworderror|
##@@## ##@@## ##@@##
##@@## ##@@## ##@@##
Windows\CurrentVersion\Uninstall\eDonkey2000
Windows\CurrentVersion\Uninstall\eDonkey2000
UNWISE.EXE
UNWISE.EXE
ntdll.dll
ntdll.dll
icon=shell32.dll,4
icon=shell32.dll,4
shellexecute=
shellexecute=
autorun.inf
autorun.inf
X-GRY-X.txt
X-GRY-X.txt
logs.dat
logs.dat
SQLite3.dll
SQLite3.dll
$1.2.3
$1.2.3
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
inflate 1.2.3 Copyright 1995-2005 Mark Adler
inflate 1.2.3 Copyright 1995-2005 Mark Adler
"""\(((@
"""\(((@
$$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,
$$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,
&$8@,@.:@:
&$8@,@.:@:
$@@&@:@:@
$@@&@:@:@
,2@&2@&2@ 2@ 2@&2@&2@ 2@ 2@ $
,2@&2@&2@ 2@ 2@&2@&2@ 2@ 2@ $
2@"2@"2@"2@"2@"
2@"2@"2@"2@"2@"
:."2@0 6$"
:."2@0 6$"
KWindows
KWindows
UnitAllCMD
UnitAllCMD
UnitExecutarComandos
UnitExecutarComandos
uftp
uftp
UrlMon
UrlMon
.UnitBytesSize
.UnitBytesSize
UnitListarPortasAtivas
UnitListarPortasAtivas
UnitWebcam
UnitWebcam
UnitKeylogger
UnitKeylogger
user32.dll
user32.dll
advapi32.dll
advapi32.dll
RegCloseKey
RegCloseKey
oleaut32.dll
oleaut32.dll
mpr.dll
mpr.dll
gdi32.dll
gdi32.dll
wininet.dll
wininet.dll
FtpOpenFileA
FtpOpenFileA
wsock32.dll
wsock32.dll
ole32.dll
ole32.dll
gdiplus.dll
gdiplus.dll
AVICAP32.DLL
AVICAP32.DLL
winmm.dll
winmm.dll
powrprof.dll
powrprof.dll
msacm32.dll
msacm32.dll
Explorer.EXE_532_rwx_00FF0000_00001000:
KERNEL32.DLL
KERNEL32.DLL
Explorer.EXE_532_rwx_01F00000_00001000:
KERNEL32.DLL
KERNEL32.DLL
Explorer.EXE_532_rwx_01FD0000_00001000:
KERNEL32.DLL
KERNEL32.DLL
Explorer.EXE_532_rwx_02010000_00001000:
user32.dll
user32.dll
Explorer.EXE_532_rwx_02060000_00001000:
user32.dll
user32.dll
Explorer.EXE_532_rwx_020C0000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_532_rwx_02130000_00001000:
RegCloseKey
RegCloseKey
Explorer.EXE_532_rwx_02350000_00001000:
advapi32.dll
advapi32.dll
Explorer.EXE_532_rwx_02380000_00001000:
oleaut32.dll
oleaut32.dll
Explorer.EXE_532_rwx_023C0000_00001000:
oleaut32.dll
oleaut32.dll
Explorer.EXE_532_rwx_023F0000_00001000:
mpr.dll
mpr.dll
Explorer.EXE_532_rwx_02430000_00001000:
mpr.dll
mpr.dll
Explorer.EXE_532_rwx_028B0000_00001000:
gdi32.dll
gdi32.dll
Explorer.EXE_532_rwx_029D0000_00001000:
gdi32.dll
gdi32.dll
Explorer.EXE_532_rwx_02A90000_00001000:
ntdll.dll
ntdll.dll
Explorer.EXE_532_rwx_02AD0000_00001000:
ntdll.dll
ntdll.dll
Explorer.EXE_532_rwx_03020000_00001000:
wininet.dll
wininet.dll
Explorer.EXE_532_rwx_03050000_00001000:
FtpOpenFileA
FtpOpenFileA
Explorer.EXE_532_rwx_030A0000_00001000:
wininet.dll
wininet.dll
Explorer.EXE_532_rwx_030D0000_00001000:
wsock32.dll
wsock32.dll
Explorer.EXE_532_rwx_03A10000_00001000:
wsock32.dll
wsock32.dll
Explorer.EXE_532_rwx_03A40000_00001000:
ole32.dll
ole32.dll
Explorer.EXE_532_rwx_03B80000_00001000:
ole32.dll
ole32.dll
Explorer.EXE_532_rwx_03BB0000_00001000:
gdiplus.dll
gdiplus.dll
Explorer.EXE_532_rwx_03CF0000_00001000:
gdiplus.dll
gdiplus.dll
Explorer.EXE_532_rwx_03D20000_00001000:
AVICAP32.DLL
AVICAP32.DLL
Explorer.EXE_532_rwx_03D60000_00001000:
AVICAP32.DLL
AVICAP32.DLL
Explorer.EXE_532_rwx_03D90000_00001000:
shell32.dll
shell32.dll
Explorer.EXE_532_rwx_03DD0000_00001000:
shell32.dll
shell32.dll
Explorer.EXE_532_rwx_03E00000_00001000:
winmm.dll
winmm.dll
Explorer.EXE_532_rwx_04150000_00001000:
winmm.dll
winmm.dll
Explorer.EXE_532_rwx_04180000_00001000:
powrprof.dll
powrprof.dll
Explorer.EXE_532_rwx_042C0000_00001000:
powrprof.dll
powrprof.dll
Explorer.EXE_532_rwx_042F0000_00001000:
msacm32.dll
msacm32.dll
Explorer.EXE_532_rwx_04430000_00001000:
msacm32.dll
msacm32.dll
Explorer.EXE_532_rwx_24010000_0005E000:
!Win32 .DLL.
!Win32 .DLL.
.MPRESS1
.MPRESS1
`.MPRESS2
`.MPRESS2
`.rsrc
`.rsrc
kernel32.dll
kernel32.dll
Portions Copyright (c) 1999,2003 Avenger by NhT
Portions Copyright (c) 1999,2003 Avenger by NhT
SHFileOperationA
SHFileOperationA
shell32.dll
shell32.dll
URLDownloadToFileA
URLDownloadToFileA
urlmon.dll
urlmon.dll
ShellExecuteA
ShellExecuteA
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
GetWindowsDirectoryA
GetWindowsDirectoryA
SOFTWARE\Microsoft\Windows\CurrentVersion
SOFTWARE\Microsoft\Windows\CurrentVersion
http\shell\open\command
http\shell\open\command
\Internet Explorer\iexplore.exe
\Internet Explorer\iexplore.exe
####@####
####@####
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
Portugal
Portugal
Turkey
Turkey
Windows 8
Windows 8
Windows 3.1
Windows 3.1
Windows 95 (Release 2)
Windows 95 (Release 2)
Windows 95
Windows 95
Windows 98 SE
Windows 98 SE
Windows 98
Windows 98
Windows ME
Windows ME
Windows 7
Windows 7
Windows Vista
Windows Vista
%s %s
%s %s
Windows XP Professional x64
Windows XP Professional x64
Windows XP Home
Windows XP Home
Windows XP Professional
Windows XP Professional
Windows 2000 Professional
Windows 2000 Professional
Windows NT %d.%d
Windows NT %d.%d
Windows 2008
Windows 2008
%s %s Server
%s %s Server
Windows 2003 Server Datacenter
Windows 2003 Server Datacenter
Windows 2003 Server Enterprise
Windows 2003 Server Enterprise
Windows 2003 Server Web Edition
Windows 2003 Server Web Edition
Windows 2003 Server
Windows 2003 Server
Windows Home Server
Windows Home Server
Windows 2003 Server (Release 2)
Windows 2003 Server (Release 2)
Windows 2000 Server Datacenter
Windows 2000 Server Datacenter
Windows 2000 Server Enterprise
Windows 2000 Server Enterprise
Windows 2000 Server Web Edition
Windows 2000 Server Web Edition
Windows 2000 Server
Windows 2000 Server
Windows NT 4.0 Server Datacenter
Windows NT 4.0 Server Datacenter
Windows NT 4.0 Server Enterprise
Windows NT 4.0 Server Enterprise
Windows NT 4.0 Server Web Edition
Windows NT 4.0 Server Web Edition
Windows NT 4.0 Server
Windows NT 4.0 Server
Unknown Platform ID (%d)
Unknown Platform ID (%d)
%d.%d
%d.%d
%s (Build: %d
%s (Build: %d
- Service Pack: %s
- Service Pack: %s
KERNEL32.DLL
KERNEL32.DLL
teste.vbs
teste.vbs
teste.txt
teste.txt
Set objSecurityCenter = GetObject("winmgmts:\\.\root\SecurityCenter")
Set objSecurityCenter = GetObject("winmgmts:\\.\root\SecurityCenter")
Set colFirewall = objSecurityCenter.ExecQuery("Select * From FirewallProduct",,48)
Set colFirewall = objSecurityCenter.ExecQuery("Select * From FirewallProduct",,48)
Set colAntiVirus = objSecurityCenter.ExecQuery("Select * From AntiVirusProduct",,48)
Set colAntiVirus = objSecurityCenter.ExecQuery("Select * From AntiVirusProduct",,48)
Set objFileSystem = CreateObject("Scripting.fileSystemObject")
Set objFileSystem = CreateObject("Scripting.fileSystemObject")
Set objFile = objFileSystem.CreateTextFile("
Set objFile = objFileSystem.CreateTextFile("
Info = Info & "F" & CountFw & ") " & objFirewall.displayName & " v" & objFirewall.versionNumber & Enter
Info = Info & "F" & CountFw & ") " & objFirewall.displayName & " v" & objFirewall.versionNumber & Enter
Info = Info & "A" & CountAV & ") " & objAntiVirus.displayName & " v" & objAntiVirus.versionNumber & Enter
Info = Info & "A" & CountAV & ") " & objAntiVirus.displayName & " v" & objAntiVirus.versionNumber & Enter
objFile.WriteLine(Info)
objFile.WriteLine(Info)
objFile.Close
objFile.Close
xxgryxx.exe
xxgryxx.exe
AVICAP32.dll
AVICAP32.dll
tFtpAccess
tFtpAccess
BuildImportTable: can't load library:
BuildImportTable: can't load library:
BuildImportTable: ReallocMemory failed
BuildImportTable: ReallocMemory failed
BuildImportTable: GetProcAddress failed
BuildImportTable: GetProcAddress failed
BTMemoryLoadLibary: BuildImportTable failed
BTMemoryLoadLibary: BuildImportTable failed
BTMemoryGetProcAddress: no export table found
BTMemoryGetProcAddress: no export table found
BTMemoryGetProcAddress: DLL doesn't export anything
BTMemoryGetProcAddress: DLL doesn't export anything
BTMemoryGetProcAddress: exported symbol not found
BTMemoryGetProcAddress: exported symbol not found
SetupApi.dll
SetupApi.dll
SetupDiOpenClassRegKey
SetupDiOpenClassRegKey
SetupDiOpenClassRegKeyExA
SetupDiOpenClassRegKeyExA
SetupDiOpenClassRegKeyExW
SetupDiOpenClassRegKeyExW
SetupDiCreateDeviceInterfaceRegKeyA
SetupDiCreateDeviceInterfaceRegKeyA
SetupDiCreateDeviceInterfaceRegKeyW
SetupDiCreateDeviceInterfaceRegKeyW
SetupDiOpenDeviceInterfaceRegKey
SetupDiOpenDeviceInterfaceRegKey
SetupDiDeleteDeviceInterfaceRegKey
SetupDiDeleteDeviceInterfaceRegKey
SetupDiCreateDevRegKeyA
SetupDiCreateDevRegKeyA
SetupDiCreateDevRegKeyW
SetupDiCreateDevRegKeyW
SetupDiOpenDevRegKey
SetupDiOpenDevRegKey
SetupDiDeleteDevRegKey
SetupDiDeleteDevRegKey
CM_DEVCAP_LOCKSUPPORTED
CM_DEVCAP_LOCKSUPPORTED
CM_DEVCAP_EJECTSUPPORTED
CM_DEVCAP_EJECTSUPPORTED
PDCAP_D0_SUPPORTED
PDCAP_D0_SUPPORTED
PDCAP_D1_SUPPORTED
PDCAP_D1_SUPPORTED
PDCAP_D2_SUPPORTED
PDCAP_D2_SUPPORTED
PDCAP_D3_SUPPORTED
PDCAP_D3_SUPPORTED
PDCAP_WAKE_FROM_D0_SUPPORTED
PDCAP_WAKE_FROM_D0_SUPPORTED
PDCAP_WAKE_FROM_D1_SUPPORTED
PDCAP_WAKE_FROM_D1_SUPPORTED
PDCAP_WAKE_FROM_D2_SUPPORTED
PDCAP_WAKE_FROM_D2_SUPPORTED
PDCAP_WAKE_FROM_D3_SUPPORTED
PDCAP_WAKE_FROM_D3_SUPPORTED
PDCAP_WARM_EJECT_SUPPORTED
PDCAP_WARM_EJECT_SUPPORTED
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_USERS
127.0.0.1
127.0.0.1
iphlpapi.dll
iphlpapi.dll
AllocateAndGetTcpExTableFromStack
AllocateAndGetTcpExTableFromStack
AllocateAndGetUdpExTableFromStack
AllocateAndGetUdpExTableFromStack
SetTcpEntry
SetTcpEntry
GetExtendedTcpTable
GetExtendedTcpTable
GetExtendedUdpTable
GetExtendedUdpTable
Mozilla3_5Password
Mozilla3_5Password
GetChromePass
GetChromePass
StartHttpProxy
StartHttpProxy
1.2.3
1.2.3
keyboardkey
keyboardkey
webcaminactive
webcaminactive
webcamgetbuffer
webcamgetbuffer
webcam
webcam
enviarexecnormal
enviarexecnormal
enviarexechidden
enviarexechidden
openweb
openweb
downexec
downexec
sendftp
sendftp
keylogger
keylogger
keyloggergetlog
keyloggergetlog
keyloggereraselog
keyloggereraselog
keyloggerativar
keyloggerativar
keyloggerdesativar
keyloggerdesativar
renamekey
renamekey
windowsfechar
windowsfechar
windowsmax
windowsmax
windowsmin
windowsmin
windowsmostrar
windowsmostrar
windowsocultar
windowsocultar
windowsmintodas
windowsmintodas
windowscaption
windowscaption
listarportas
listarportas
listarportasdns
listarportasdns
finalizarprocessoportas
finalizarprocessoportas
webcamsettings
webcamsettings
chatmsg
chatmsg
getpassword
getpassword
updateservidorweb
updateservidorweb
keyloggersearch
keyloggersearch
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
PSAPI.dll
PSAPI.dll
\config\SteamAppData.vdf
\config\SteamAppData.vdf
AutoLoginUser
AutoLoginUser
/ClientRegistry.Blob
/ClientRegistry.Blob
\ClientRegistry.blob
\ClientRegistry.blob
\steam.dll
\steam.dll
%SYS%
%SYS%
ÞSKTOP%
ÞSKTOP%
FirstExecution
FirstExecution
chatmsg|
chatmsg|
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
listarjanelas|windowsfechar|
listarjanelas|windowsfechar|
listarjanelas|windowsmax|
listarjanelas|windowsmax|
listarjanelas|windowsmin|
listarjanelas|windowsmin|
listarjanelas|windowsmostrar|
listarjanelas|windowsmostrar|
listarjanelas|windowsocultar|
listarjanelas|windowsocultar|
listarjanelas|windowsmintodas|
listarjanelas|windowsmintodas|
listarjanelas|windowscaption|
listarjanelas|windowscaption|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
listarportas|listadeportaspronta|
listarportas|listadeportaspronta|
listarportas|finalizarconexao|
listarportas|finalizarconexao|
listarportas|finalizarprocessoportas|Y|
listarportas|finalizarprocessoportas|Y|
listarportas|finalizarprocessoportas|N|
listarportas|finalizarprocessoportas|N|
registro|renamekey|
registro|renamekey|
keylogger|keylogger|keyloggerativar|
keylogger|keylogger|keyloggerativar|
keylogger|keylogger|keyloggerdesativar|
keylogger|keylogger|keyloggerdesativar|
keylogger|keyloggergetlog|
keylogger|keyloggergetlog|
keylogger|keylogger|keyloggervazio|
keylogger|keylogger|keyloggervazio|
keyloggersearchok|
keyloggersearchok|
webcam|webcaminactive|
webcam|webcaminactive|
webcam|webcamactive|
webcam|webcamactive|
_y_X_PASSWORDLIST_X_y_
_y_X_PASSWORDLIST_X_y_
NOIP.abc
NOIP.abc
MSN.abc
MSN.abc
FIREFOX.abc
FIREFOX.abc
IELOGIN.abc
IELOGIN.abc
IEPASS.abc
IEPASS.abc
IEAUTO.abc
IEAUTO.abc
IEWEB.abc
IEWEB.abc
SOFTWARE\Mozilla\Mozilla Firefox
SOFTWARE\Mozilla\Mozilla Firefox
getfirefox
getfirefox
getielogin
getielogin
getiepass
getiepass
getieweb
getieweb
getchrome
getchrome
getpassword|getpasswordlist|
getpassword|getpasswordlist|
getpassword|getpassworderror|
getpassword|getpassworderror|
##@@## ##@@## ##@@##
##@@## ##@@## ##@@##
Windows\CurrentVersion\Uninstall\eDonkey2000
Windows\CurrentVersion\Uninstall\eDonkey2000
UNWISE.EXE
UNWISE.EXE
ntdll.dll
ntdll.dll
icon=shell32.dll,4
icon=shell32.dll,4
shellexecute=
shellexecute=
autorun.inf
autorun.inf
X-GRY-X.txt
X-GRY-X.txt
logs.dat
logs.dat
SQLite3.dll
SQLite3.dll
$1.2.3
$1.2.3
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
inflate 1.2.3 Copyright 1995-2005 Mark Adler
inflate 1.2.3 Copyright 1995-2005 Mark Adler
"""\(((@
"""\(((@
$$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,
$$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,
&$8@,@.:@:
&$8@,@.:@:
$@@&@:@:@
$@@&@:@:@
,2@&2@&2@ 2@ 2@&2@&2@ 2@ 2@ $
,2@&2@&2@ 2@ 2@&2@&2@ 2@ 2@ $
2@"2@"2@"2@"2@"
2@"2@"2@"2@"2@"
:."2@0 6$"
:."2@0 6$"
KWindows
KWindows
UnitAllCMD
UnitAllCMD
UnitExecutarComandos
UnitExecutarComandos
uftp
uftp
UrlMon
UrlMon
.UnitBytesSize
.UnitBytesSize
UnitListarPortasAtivas
UnitListarPortasAtivas
UnitWebcam
UnitWebcam
UnitKeylogger
UnitKeylogger
user32.dll
user32.dll
advapi32.dll
advapi32.dll
RegCloseKey
RegCloseKey
oleaut32.dll
oleaut32.dll
mpr.dll
mpr.dll
gdi32.dll
gdi32.dll
wininet.dll
wininet.dll
FtpOpenFileA
FtpOpenFileA
wsock32.dll
wsock32.dll
ole32.dll
ole32.dll
gdiplus.dll
gdiplus.dll
AVICAP32.DLL
AVICAP32.DLL
winmm.dll
winmm.dll
powrprof.dll
powrprof.dll
msacm32.dll
msacm32.dll