Trojan.Win32.Xtrat.wwj (Kaspersky), Backdoor.Win32.Farfli.FD, Backdoor.Win32.Xtrat.FD, WormRebhip.YR, GenericAutorunWorm.YR, GenericInjector.YR (Lavasoft MAS)Behaviour: Trojan, Backdoor, Worm, WormAutorun
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: ae91ab40a147ecfd1108d9989f522766
SHA1: 84f9e7f702dbe89641389ef06d2045a312617660
SHA256: fcbab4a533e959fa4a6c3f260597f6f52a198fc5b644077541691a3d1a8ec757
SSDeep: 24576:cU6L5csRuImEIeGwLkJKt8zAcmyPmcv/3Hk6tNI7U:iLLRYEnGtJml6/3Hk6kU
Size: 1047960 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6
Company: no certificate found
Created at: 2015-10-01 01:40:49
Analyzed on: WindowsXP SP3 32-bit
Summary: Worm. A program that is primarily replicating on networks or removable drives.
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer. |
Process activity
The Worm creates the following process(es):
571serversdfdsfdsf.exe:1648
%original file name%.exe:1860
Pluguin.exe:1284
The Worm injects its code into the following process(es):
Explorer.EXE:884
442SUPER POTION.exe:1412
svchost.exe:1780
svchost.exe:1016
explorer.exe:256
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process 571serversdfdsfdsf.exe:1648 makes changes in the file system.
The Worm creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Application Data\install\svchostexe (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XX--XX--XX.txt (235 bytes)
The process %original file name%.exe:1860 makes changes in the file system.
The Worm creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\Pluguin.exe (124052 bytes)
The process Pluguin.exe:1284 makes changes in the file system.
The Worm creates and/or writes to the following file(s):
%System%\571serversdfdsfdsf.exe.exe (4 bytes)
%WinDir%\442SUPER POTION.exe.exe (4 bytes)
%System%\571serversdfdsfdsf.exe (290 bytes)
%WinDir%\442SUPER POTION.exe (3673 bytes)
Registry activity
The process 571serversdfdsfdsf.exe:1648 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "37 CE AD 82 94 57 B4 73 AB CA 1B CE B6 2C 57 A0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"Policies" = "%Documents and Settings%\%current user%\Application Data\install\svchostexe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
"Policies" = "%Documents and Settings%\%current user%\Application Data\install\svchostexe"
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{3K17UN5Q-2H4M-6B6R-TR53-755726T63808}]
"StubPath" = "%Documents and Settings%\%current user%\Application Data\install\svchostexe Restart"
To automatically run itself each time Windows is booted, the Worm adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"TcpNoDelay" = "%Documents and Settings%\%current user%\Application Data\install\svchostexe"
The process %original file name%.exe:1860 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5A C2 18 8B B1 4C 5F 80 18 ED 7B A3 1A 4A 17 AF"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Temp]
"Pluguin.exe" = "Pluguin"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
The Worm modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"
The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:
"IntranetName" = "1"
The process Explorer.EXE:884 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\Shell\Bags\1\Desktop]
"ItemPos1916x902(1)" = "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
"Sort" = "0"
"SortDir" = "1"
"Mode" = "1"
"ScrollPos1916x902(1).y" = "0"
"ScrollPos1916x902(1).x" = "0"
"Col" = "4294967295"
"ColInfo" = "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
The process 442SUPER POTION.exe:1412 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BC 01 90 D5 3E A3 01 CC F8 C3 4D FD 6D 33 87 65"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
The process Pluguin.exe:1284 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4F 1C 6D 90 8D 1D 79 0B 55 77 B6 0F 42 33 D6 0E"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"571serversdfdsfdsf.exe" = "571serversdfdsfdsf"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%WinDir%]
"442SUPER POTION.exe" = "HHTESTE"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\TGhBlDuAQ]
"442SUPER POTION.exe" = "OK"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\XtremeRAT]
"Mutex" = "TGhBlDuAQ"
The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Worm modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Dropped PE files
MD5 | File path |
---|---|
87a13ed4a97d60f0cb2e6c3fe598e6f4 | c:\Documents and Settings\"%CurrentUserName%"\Application Data\install\svchostexe |
412199d37e34bbf44ddcb02cc3b94dbc | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Pluguin.exe |
37dda86d7c96165e95063fef74aa8b7a | c:\WINDOWS\442SUPER POTION.exe |
87a13ed4a97d60f0cb2e6c3fe598e6f4 | c:\WINDOWS\system32\571serversdfdsfdsf.exe |
412199d37e34bbf44ddcb02cc3b94dbc | c:\WINDOWS\system32\System32\svchost.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer.
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
571serversdfdsfdsf.exe:1648
%original file name%.exe:1860
Pluguin.exe:1284 - Delete the original Worm file.
- Delete or disinfect the following files created/modified by the Worm:
%Documents and Settings%\%current user%\Application Data\install\svchostexe (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XX--XX--XX.txt (235 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Pluguin.exe (124052 bytes)
%System%\571serversdfdsfdsf.exe.exe (4 bytes)
%WinDir%\442SUPER POTION.exe.exe (4 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"TcpNoDelay" = "%Documents and Settings%\%current user%\Application Data\install\svchostexe" - Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.
Static Analysis
VersionInfo
Company Name:
Product Name: Gerenciador de arquivos
Product Version: 1.0.0.0
Legal Copyright: Copyright (c) 2015
Legal Trademarks:
Original Filename: Gerenciador de arquivos.exe
Internal Name: Gerenciador de arquivos.exe
File Version: 1.0.0.0
File Description: Gerenciador de arquivos
Comments:
Language: English (United Kingdom)
Company Name: Product Name: Gerenciador de arquivosProduct Version: 1.0.0.0Legal Copyright: Copyright (c) 2015Legal Trademarks: Original Filename: Gerenciador de arquivos.exeInternal Name: Gerenciador de arquivos.exeFile Version: 1.0.0.0File Description: Gerenciador de arquivosComments: Language: English (United Kingdom)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 8192 | 81178 | 81408 | 4.86617 | 878f5db837aa623c81fe9b035e17b35c |
.rsrc | 90112 | 3914 | 4096 | 2.13727 | 86af675ecd353ade73ff89c779123945 |
.reloc | 98304 | 12 | 512 | 0.070639 | fd92c43a791c4aee5d5fd94405623f9f |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Map
The Worm connects to the servers at the folowing location(s):
Strings from Dumps
svchost.exe_1780:
.text
.text
`.data
`.data
.rsrc
.rsrc
ADVAPI32.dll
ADVAPI32.dll
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
RPCRT4.dll
RPCRT4.dll
NETAPI32.dll
NETAPI32.dll
ole32.dll
ole32.dll
ntdll.dll
ntdll.dll
RegCloseKey
RegCloseKey
RegOpenKeyExW
RegOpenKeyExW
GetProcessHeap
GetProcessHeap
NtOpenKey
NtOpenKey
svchost.pdb
svchost.pdb
\PIPE\
\PIPE\
Software\Microsoft\Windows NT\CurrentVersion\Svchost
Software\Microsoft\Windows NT\CurrentVersion\Svchost
\Registry\Machine\System\CurrentControlSet\Control\SecurePipeServers\
\Registry\Machine\System\CurrentControlSet\Control\SecurePipeServers\
5.1.2600.5512 (xpsp.080413-2111)
5.1.2600.5512 (xpsp.080413-2111)
svchost.exe
svchost.exe
Windows
Windows
Operating System
Operating System
5.1.2600.5512
5.1.2600.5512
svchost.exe_1780_rwx_10000000_00124000:
.idata
.idata
.rdata
.rdata
P.reloc
P.reloc
P.rsrc
P.rsrc
ServerKeyloggerU
ServerKeyloggerU
789:;
789:;
%SERVER%
%SERVER%
URLMON.DLL
URLMON.DLL
shell32.dll
shell32.dll
hXXp://
hXXp://
advapi32.dll
advapi32.dll
kernel32.dll
kernel32.dll
mpr.dll
mpr.dll
version.dll
version.dll
comctl32.dll
comctl32.dll
gdi32.dll
gdi32.dll
opengl32.dll
opengl32.dll
user32.dll
user32.dll
wintrust.dll
wintrust.dll
msimg32.dll
msimg32.dll
GetKeyboardType
GetKeyboardType
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
oleaut32.dll
oleaut32.dll
RegOpenKeyExW
RegOpenKeyExW
RegCreateKeyW
RegCreateKeyW
GetWindowsDirectoryW
GetWindowsDirectoryW
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookExW
SetWindowsHookExW
MapVirtualKeyW
MapVirtualKeyW
GetKeyboardLayout
GetKeyboardLayout
GetKeyState
GetKeyState
shlwapi.dll
shlwapi.dll
SHDeleteKeyW
SHDeleteKeyW
FindExecutableW
FindExecutableW
URLDownloadToCacheFileW
URLDownloadToCacheFileW
wininet.dll
wininet.dll
FtpPutFileW
FtpPutFileW
FtpSetCurrentDirectoryW
FtpSetCurrentDirectoryW
GetKeyboardState
GetKeyboardState
ShellExecuteW
ShellExecuteW
ntdll.dll
ntdll.dll
1 1$1(1,10141
1 1$1(1,10141
KWindows
KWindows
TServerKeylogger
TServerKeylogger
.nzhm
.nzhm
]n.yhk
]n.yhk
cmD@kz
cmD@kz
7z)m%c
7z)m%c
9@Z%x
9@Z%x
BL.Gx
BL.Gx
.LM-S~_
.LM-S~_
%d;a\[1y
%d;a\[1y
{!%sJ
{!%sJ
]@.hw{
]@.hw{
o4p
o4p
|h.nq/
|h.nq/
L%d>:I
L%d>:I
p.wBN/{3
p.wBN/{3
`i.Xp
`i.Xp
.Ec(r
.Ec(r
kEYr3
kEYr3
z%FGwf[h
z%FGwf[h
[{.Ya
[{.Ya
.Il(;
.Il(;
.guf(
.guf(
.EdGl
.EdGl
.cej>#
.cej>#
V.ORT
V.ORT
.nQL0
.nQL0
o"%dn
o"%dn
%FkwN
%FkwN
)p7C.xa
)p7C.xa
%C*Up
%C*Up
6".aKfPf(
6".aKfPf(
txKeY
txKeY
}%C\Ao$
}%C\Ao$
Z%X`l,`>n
Z%X`l,`>n
P.CgX
P.CgX
UK%X7K
UK%X7K
|5.gK
|5.gK
GKeYx
GKeYx
.WRpi
.WRpi
*S-D].wVW
*S-D].wVW
S@%SQ
S@%SQ
-b8}*
-b8}*
.Pj/i-
.Pj/i-
f^.SmZ
f^.SmZ
f.LN1q2
f.LN1q2
0v.gK
0v.gK
W=%c|
W=%c|
#).eE
#).eE
V.aX~
V.aX~
17%C!
17%C!
o.ci&
o.ci&
$2(m%x
$2(m%x
ed.Fm
ed.Fm
&Bn%F
&Bn%F
A%fLm
A%fLm
.taqO
.taqO
;Y.OI
;Y.OI
%UA4H
%UA4H
ER .fD
ER .fD
%x)6X
%x)6X
N.Ooo|
N.Ooo|
0%XF1
0%XF1
G.ph8R
G.ph8R
-<.vn>
-<.vn>
.UJn~
.UJn~
.pB,sS
.pB,sS
;=b%d
;=b%d
3s_x%d
3s_x%d
O.vEt
O.vEt
2c%ul
2c%ul
S%FG H
S%FG H
.aS6d
.aS6d
i@%uE8
i@%uE8
yDAa%f
yDAa%f
.wTN&
.wTN&
.kwP5
.kwP5
.NI4X
.NI4X
p.YQh
p.YQh
p
p
wL.fx
wL.fx
x.html
x.html
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_USERS
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
[Execute]
[Execute]
KeyDelBackspace
KeyDelBackspace
.html
.html
XtremeKeylogger
XtremeKeylogger
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
.functions
.functions
icon=shell32.dll,4
icon=shell32.dll,4
shellexecute=
shellexecute=
autorun.inf
autorun.inf
\Microsoft\Windows\
\Microsoft\Windows\
ÞFAULTBROWSER%
ÞFAULTBROWSER%
svchost.exe
svchost.exe
riquelindezalinda.no-ip.org
riquelindezalinda.no-ip.org
riquelindezalinda.no-ip.o
riquelindezalinda.no-ip.o
M{M7S00O8Y-2400-V0U7-8H72-2Q33A0V17D14}
M{M7S00O8Y-2400-V0U7-8H72-2Q33A0V17D14}
ftpuser
ftpuser
PTF.ftpserver.com
PTF.ftpserver.com
svchost.exe_1016:
.text
.text
`.data
`.data
.rsrc
.rsrc
ADVAPI32.dll
ADVAPI32.dll
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
RPCRT4.dll
RPCRT4.dll
NETAPI32.dll
NETAPI32.dll
ole32.dll
ole32.dll
ntdll.dll
ntdll.dll
RegCloseKey
RegCloseKey
RegOpenKeyExW
RegOpenKeyExW
GetProcessHeap
GetProcessHeap
NtOpenKey
NtOpenKey
svchost.pdb
svchost.pdb
\PIPE\
\PIPE\
Software\Microsoft\Windows NT\CurrentVersion\Svchost
Software\Microsoft\Windows NT\CurrentVersion\Svchost
\Registry\Machine\System\CurrentControlSet\Control\SecurePipeServers\
\Registry\Machine\System\CurrentControlSet\Control\SecurePipeServers\
5.1.2600.5512 (xpsp.080413-2111)
5.1.2600.5512 (xpsp.080413-2111)
svchost.exe
svchost.exe
Windows
Windows
Operating System
Operating System
5.1.2600.5512
5.1.2600.5512
svchost.exe_1016_rwx_10000000_00124000:
.idata
.idata
.rdata
.rdata
P.reloc
P.reloc
P.rsrc
P.rsrc
ServerKeyloggerU
ServerKeyloggerU
789:;
789:;
%SERVER%
%SERVER%
URLMON.DLL
URLMON.DLL
shell32.dll
shell32.dll
hXXp://
hXXp://
advapi32.dll
advapi32.dll
kernel32.dll
kernel32.dll
mpr.dll
mpr.dll
version.dll
version.dll
comctl32.dll
comctl32.dll
gdi32.dll
gdi32.dll
opengl32.dll
opengl32.dll
user32.dll
user32.dll
wintrust.dll
wintrust.dll
msimg32.dll
msimg32.dll
GetKeyboardType
GetKeyboardType
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
oleaut32.dll
oleaut32.dll
RegOpenKeyExW
RegOpenKeyExW
RegCreateKeyW
RegCreateKeyW
GetWindowsDirectoryW
GetWindowsDirectoryW
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookExW
SetWindowsHookExW
MapVirtualKeyW
MapVirtualKeyW
GetKeyboardLayout
GetKeyboardLayout
GetKeyState
GetKeyState
shlwapi.dll
shlwapi.dll
SHDeleteKeyW
SHDeleteKeyW
FindExecutableW
FindExecutableW
URLDownloadToCacheFileW
URLDownloadToCacheFileW
wininet.dll
wininet.dll
FtpPutFileW
FtpPutFileW
FtpSetCurrentDirectoryW
FtpSetCurrentDirectoryW
GetKeyboardState
GetKeyboardState
ShellExecuteW
ShellExecuteW
ntdll.dll
ntdll.dll
1 1$1(1,10141
1 1$1(1,10141
KWindows
KWindows
TServerKeylogger
TServerKeylogger
.nzhm
.nzhm
]n.yhk
]n.yhk
cmD@kz
cmD@kz
7z)m%c
7z)m%c
9@Z%x
9@Z%x
BL.Gx
BL.Gx
.LM-S~_
.LM-S~_
%d;a\[1y
%d;a\[1y
{!%sJ
{!%sJ
]@.hw{
]@.hw{
o4p
o4p
|h.nq/
|h.nq/
L%d>:I
L%d>:I
p.wBN/{3
p.wBN/{3
`i.Xp
`i.Xp
.Ec(r
.Ec(r
kEYr3
kEYr3
z%FGwf[h
z%FGwf[h
[{.Ya
[{.Ya
.Il(;
.Il(;
.guf(
.guf(
.EdGl
.EdGl
.cej>#
.cej>#
V.ORT
V.ORT
.nQL0
.nQL0
o"%dn
o"%dn
%FkwN
%FkwN
)p7C.xa
)p7C.xa
%C*Up
%C*Up
6".aKfPf(
6".aKfPf(
txKeY
txKeY
}%C\Ao$
}%C\Ao$
Z%X`l,`>n
Z%X`l,`>n
P.CgX
P.CgX
UK%X7K
UK%X7K
|5.gK
|5.gK
GKeYx
GKeYx
.WRpi
.WRpi
*S-D].wVW
*S-D].wVW
S@%SQ
S@%SQ
-b8}*
-b8}*
.Pj/i-
.Pj/i-
f^.SmZ
f^.SmZ
f.LN1q2
f.LN1q2
0v.gK
0v.gK
W=%c|
W=%c|
#).eE
#).eE
V.aX~
V.aX~
17%C!
17%C!
o.ci&
o.ci&
$2(m%x
$2(m%x
ed.Fm
ed.Fm
&Bn%F
&Bn%F
A%fLm
A%fLm
.taqO
.taqO
;Y.OI
;Y.OI
%UA4H
%UA4H
ER .fD
ER .fD
%x)6X
%x)6X
N.Ooo|
N.Ooo|
0%XF1
0%XF1
G.ph8R
G.ph8R
-<.vn>
-<.vn>
.UJn~
.UJn~
.pB,sS
.pB,sS
;=b%d
;=b%d
3s_x%d
3s_x%d
O.vEt
O.vEt
2c%ul
2c%ul
S%FG H
S%FG H
.aS6d
.aS6d
i@%uE8
i@%uE8
yDAa%f
yDAa%f
.wTN&
.wTN&
.kwP5
.kwP5
.NI4X
.NI4X
p.YQh
p.YQh
p
p
wL.fx
wL.fx
x.html
x.html
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_USERS
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
[Execute]
[Execute]
KeyDelBackspace
KeyDelBackspace
.html
.html
XtremeKeylogger
XtremeKeylogger
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
.functions
.functions
icon=shell32.dll,4
icon=shell32.dll,4
shellexecute=
shellexecute=
autorun.inf
autorun.inf
\Microsoft\Windows\
\Microsoft\Windows\
ÞFAULTBROWSER%
ÞFAULTBROWSER%
svchost.exe
svchost.exe
riquelindezalinda.no-ip.org
riquelindezalinda.no-ip.org
riquelindezalinda.no-ip.o
riquelindezalinda.no-ip.o
M{M7S00O8Y-2400-V0U7-8H72-2Q33A0V17D14}
M{M7S00O8Y-2400-V0U7-8H72-2Q33A0V17D14}
ftpuser
ftpuser
PTF.ftpserver.com
PTF.ftpserver.com
%Documents and Settings%\%current user%\Local Settings\Temp\Pluguin.exe
%Documents and Settings%\%current user%\Local Settings\Temp\Pluguin.exe
explorer.exe_256:
.text
.text
`.data
`.data
.rsrc
.rsrc
@.reloc
@.reloc
ADVAPI32.dll
ADVAPI32.dll
BROWSEUI.dll
BROWSEUI.dll
GDI32.dll
GDI32.dll
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
msvcrt.dll
msvcrt.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
SHDOCVW.dll
SHDOCVW.dll
SHELL32.dll
SHELL32.dll
SHLWAPI.dll
SHLWAPI.dll
USER32.dll
USER32.dll
UxTheme.dll
UxTheme.dll
FTSSh
FTSSh
t0SSh
t0SSh
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
SShwk
SShwk
98~%SP
98~%SP
ExplorerStartMsgLoop
ExplorerStartMsgLoop
PSSh;
PSSh;
6SSSSh
6SSSSh
SSSSh
SSSSh
SPSSSShL
SPSSSShL
u%SSh
u%SSh
t.WWWW
t.WWWW
xpsp2res.dll
xpsp2res.dll
xpsp3res.dll
xpsp3res.dll
tbSSh
tbSSh
Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartMenu
Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartMenu
Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartPanel
Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartPanel
kernel32.dll
kernel32.dll
GetSystemWindowsDirectoryW
GetSystemWindowsDirectoryW
NetGetJoinInformation
NetGetJoinInformation
WINMM.dll
WINMM.dll
SETUPAPI.dll
SETUPAPI.dll
WINSTA.dll
WINSTA.dll
OLEACC.dll
OLEACC.dll
USERENV.dll
USERENV.dll
ntdll.dll
ntdll.dll
RegEnumKeyExW
RegEnumKeyExW
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
RegOpenKeyExA
RegOpenKeyExA
RegEnumKeyW
RegEnumKeyW
RegCloseKey
RegCloseKey
RegCreateKeyW
RegCreateKeyW
RegQueryInfoKeyW
RegQueryInfoKeyW
RegOpenKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegCreateKeyExW
OffsetViewportOrgEx
OffsetViewportOrgEx
GetViewportOrgEx
GetViewportOrgEx
SetViewportOrgEx
SetViewportOrgEx
SetProcessShutdownParameters
SetProcessShutdownParameters
GetProcessHeap
GetProcessHeap
GetWindowsDirectoryW
GetWindowsDirectoryW
CreateIoCompletionPort
CreateIoCompletionPort
ShellExecuteExW
ShellExecuteExW
SHRegCloseUSKey
SHRegCloseUSKey
SHRegCreateUSKeyW
SHRegCreateUSKeyW
AssocQueryKeyW
AssocQueryKeyW
SHRegOpenUSKeyW
SHRegOpenUSKeyW
SHDeleteKeyW
SHDeleteKeyW
TileWindows
TileWindows
ExitWindowsEx
ExitWindowsEx
RegisterHotKey
RegisterHotKey
UnregisterHotKey
UnregisterHotKey
EnumChildWindows
EnumChildWindows
GetKeyState
GetKeyState
GetAsyncKeyState
GetAsyncKeyState
CascadeWindows
CascadeWindows
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
EnumWindows
EnumWindows
explorer.pdb
explorer.pdb
name="Microsoft.Windows.Shell.explorer"
name="Microsoft.Windows.Shell.explorer"
version="5.1.0.0"
version="5.1.0.0"
Windows Shell
Windows Shell
name="Microsoft.Windows.Common-Controls"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
publicKeyToken="6595b64144ccf1df"
]]"```^]]\
]]"```^]]\
3333333330
3333333330
3333330
3333330
333333334
333333334
)@. '5 !*
)@. '5 !*
.DEHHF>?/
.DEHHF>?/
2
2
&$%Uooqkezs
&$%Uooqkezs
['$$#%&(4
['$$#%&(4
3333333333333333333
3333333333333333333
33333333333330
33333333333330
7''''))
7''''))
3'')))33.
3'')))33.
222`444(555
222`444(555
%%%{///-
%%%{///-
000000000
000000000
00000000
00000000
`[66...00
`[66...00
0000000
0000000
`]66./.000
`]66./.000
/./././././././.
/./././././././.
66///0000
66///0000
0000000000000
0000000000000
0000000000
0000000000
6666,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,0.010.010.010.010.010.010.010.010.010.010.001
6666,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,0.010.010.010.010.010.010.010.010.010.010.001
4366666666K,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6.010.010.010.010.010.010.010.010.010.010.000
4366666666K,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6.010.010.010.010.010.010.010.010.010.010.000
:;
:;
) ) ) ) )
) ) ) ) )
|2222'2'2'2'2'2'2'2'2'2'2'2'2'2'2'2',),),),),),),),),),),),),),),),),),),),),),,
|2222'2'2'2'2'2'2'2'2'2'2'2'2'2'2'2',),),),),),),),),),),),),),),),),),),),),),,
22222222222
22222222222
3333333
3333333
.SB99;;;99twv}ut{oxt~
.SB99;;;99twv}ut{oxt~
.SB;;;:::2:w}{{qddgghg
.SB;;;:::2:w}{{qddgghg
" """ """ """ """ "" #
" """ """ """ """ "" #
""" """ """ "#
""" """ """ "#
.SG>''';;9::p
.SG>''';;9::p
:5:5:5:5:5:5:5:5:5:5#"
:5:5:5:5:5:5:5:5:5:5#"
# # # # # # # # # # # # # # # # # # # # # ##$
# # # # # # # # # # # # # # # # # # # # # ##$
( # # # # # # # # # # # # # # # # # # # # ###
( # # # # # # # # # # # # # # # # # # # # ###
1232123212321232123
1232123212321232123
(&(((&(((&(((&(((&((&&)
(&(((&(((&(((&(((&((&&)
&(((&(((&(((&()
&(((&(((&(((&()
`,''')))
`,''')))
'4,4'4,4'4,4'4,4'4,4)(
'4,4'4,4'4,4'4,4'4,4)(
55///0000
55///0000
5555-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-0
5555-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-0
555555555
555555555
55555555
55555555
5555555
5555555
14441444144414441
14441444144414441
4343434343434343
4343434343434343
5555555555555
5555555555555
5555555555
5555555555
-,-,-,-,-,-,-,-,-,-,-*.
-,-,-,-,-,-,-,-,-,-,-*.
..............................JFJFJFJFJFJFJFJFJFJFJ.-
..............................JFJFJFJFJFJFJFJFJFJFJ.-
{22*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-../
{22*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-../
|ujjjjuhF..BBBBBBBBBBBBT
|ujjjjuhF..BBBBBBBBBBBBT
~j|F.BB*BBB*BBB*Bwop
~j|F.BB*BBB*BBB*Bwop
&!!!&!!!&
&!!!&!!!&
44466666
44466666
44444444416
44444444416
4446666
4446666
66666666
66666666
|= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |=
|= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |=
|= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |=
|= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |=
DDDDE%CTDD@
DDDDE%CTDD@
A%US$
A%US$
%UUUU
%UUUU
%%UUU
%%UUU
33U
33U
""2222!!
""2222!!
!"!"%UUR""
!"!"%UUR""
!""!"#2"""
!""!"#2"""
"!!"#3"!"
"!!"#3"!"
dnnnnn:n.nfCnmddddd
dnnnnn:n.nfCnmddddd
////;/;;88
////;/;;88
;888;;!/
;888;;!/
!//!!;;^
!//!!;;^
:;:!::!!!
:;:!::!!!
.88.88.8
.88.88.8
.N.NN.M
.N.NN.M
::8.8...
::8.8...
:::!;;:!
:::!;;:!
//!!;888
//!!;888
.8.8.88...
.8.8.88...
:;!::!!;!//!;
:;!::!!;!//!;
!!;:!!::
!!;:!!::
.88..8..
.88..8..
!!:::/^!
!!:::/^!
!;/;!;;;!!!:
!;/;!;;;!!!:
.8:!!!!^
.8:!!!!^
!!:;:::..
!!:;:::..
/:!^^!;{8{../
/:!^^!;{8{../
...:::.-
...:::.-
**6***66*6**6566*5666 ,
**6***66*6**6566*5666 ,
6*6666*6*6 655*65
6*6666*6*6 655*65
6*65 56*5 55 555 *5 6
6*65 56*5 55 555 *5 6
555( 55 (5 5(
555( 55 (5 5(
76 5 66 555*677
76 5 66 555*677
6*6 5 5(5 (55( '5((5 (556 ('5
6*6 5 5(5 (55( '5((5 (556 ('5
665**6(('S((((((S(((]('((@('SS((S(((((((6C-.NEC66S5sU
665**6(('S((((((S(((]('((@('SS((S(((((((6C-.NEC66S5sU
555(555(5((5(5(5(
555(555(5((5(5(5(
5 5 5 5555 (555(555'(((5(5('55(((
5 5 5 5555 (555(555'(((5(5('55(((
((''('5'5(5('('('('('((''('(((@(((('&(((&
((''('5'5(5('('('('('((''('(((@(((('&(((&
%&&%&&&&3>&3&3&33&3&3333&&3>3333
%&&%&&&&3>&3&3&33&3&3333&&3>3333
'(3&'&3&
'(3&'&3&
3&33&&((
3&33&&((
3323>33>%>3%>3>33>3%3&%
3323>33>%>3%>3>33>3%3&%
*5'(('((&@3(
*5'(('((&@3(
,63%3>323>3%>&>33323>>%>
,63%3>323>3%>&>33323>>%>
3(3'(((@@'5('@(@(&('(
3(3'(((@@'5('@(@(&('(
>2>323%>3
>2>323%>3
75((((@3&333&3&&&%&3&&3&33>33%3>23%>3
75((((@3&333&3&&&%&3&&3&33>33%3>23%>3
>2%$32%>2>%>2$3>
>2%$32%>2>%>2$3>
3&%&&3&33>3>33
3&%&&3&33>3>33
3>%>3%&3$23>23$2>2%$>2>
3>%>3%&3$23>23$2>2%$>2>
)4433((&(&('*
)4433((&(&('*
('((((''(**6(('' *
('((((''(**6(('' *
32323>3>
32323>3>
2$%>22%>%3' (
2$%>22%>%3' (
&(&''((5(5 *
&(&''((5(5 *
'(&(&((&('''
'(&(&((&('''
&&%&3&&%3%
&&%&3&&%3%
2%>22>22
2%>22>22
5''3(((3(('&(&'&
5''3(((3(('&(&'&
3%%3%3%2#$
3%%3%3%2#$
22$22$2%$22$2%2%$2%$2$222%$22
22$22$2%$22$2%2%$2%$2$222%$22
&>2$2$2$222$22$%%
&>2$2$2$222$22$%%
:7'((('(3('(3(&(&
:7'((('(3('(3(&(&
222222222222
222222222222
22222222222222
22222222222222
222222222222222
222222222222222
22$22$22$22$
22$22$22$22$
&(%3%&&&&3&&&3%3
&(%3%&&&&3&&&3%3
222222222222222222
222222222222222222
&&(&3(&(&'('((3'(&&
&&(&3(&(&'('((3'(&&
2222222
2222222
22$
22$
&&(3(3('(&'
&&(3(3('(&'
222"2212
222"2212
22
22
(&(3(3((
(&(3(3((
((565 ((( 6
((565 ((( 6
333&33(&&
333&33(&&
'(('('(('(
'(('('(('(
'&%%"$
'&%%"$
2"2"22"2
2"2"22"2
2222
2222
"2"22
"2"22
2%('(3'32222?&'
2%('(3'32222?&'
2"2"2"121212
2"2"2"121212
2"2"2$"?
2"2"2$"?
%%22%2
%%22%2
&3(3(3((&
&3(3(3((&
"2"
"2"
1"?((&21
1"?((&21
22
22
2%""22&&
2%""22&&
2
2
'&('(3(''
'&('(3(''
((%%%"
((%%%"
5(3%"%
5(3%"%
"2%5*67
"2%5*67
))) ))))
))) ))))
""**
""**
"*
"*
#2#---2222-222442-
#2#---2222-222442-
---(-%
---(-%
$/222(--444222!
$/222(--444222!
#&-221269924999;
#&-221269924999;
&$-22-($2%
&$-22-($2%
#(2---222622212-
#(2---222622212-
#2221299629968
#2221299629968
#&--%#(2##!
#&--%#(2##!
-222422422426662-%
-222422422426662-%
"2-##&
"2-##&
!##-#-&%---#---#&-219662%
!##-#-&%---#---#&-219662%
$&-(151,44.9
$&-(151,44.9
&1242662-
&1242662-
-(..19.19
-(..19.19
,4492.12
,4492.12
12-$-,-,
12-$-,-,
-, $$----
-, $$----
#%#-15/-&
#%#-15/-&
-,(,,(,(,
-,(,,(,(,
$$11651566/,$&&
$$11651566/,$&&
,2592&&&-
,2592&&&-
2466/!$$
2466/!$$
""*
""*
) '????[
) '????[
&&&$-556>>61,,5994511-
&&&$-556>>61,,5994511-
$(//$$$(6>6/,$,-$
$(//$$$(6>6/,$,-$
#$-22692/,,$,-&
#$-22692/,,$,-&
-266661..4514#
-266661..4514#
&,2-&#
&,2-&#
&-222,22--#
&-222,22--#
#&&---2-,-&$&(,,291.566..BNNNTNNNNNAABIAA88
#&&---2-,-&$&(,,291.566..BNNNTNNNNNAABIAA88
&!#&!-##
&!#&!-##
--//11468>885882&
--//11468>885882&
$266961$&--$&%
$266961$&--$&%
,1661,!-((#
,1661,!-((#
&$,4255$,92
&$,4255$,92
&$,44..&
&$,44..&
""**""***""
""**""***""
"****
"****
"**""""*""""
"**""""*""""
&-569./-,16522$
&-569./-,16522$
.BAA=86546888=AAAEAAEMNRMQQSWZZ\]gk__m__\
.BAA=86546888=AAAEAAEMNRMQQSWZZ\]gk__m__\
bTRHHHHHQQHQJQWJSSSSSSSSSSSSSSSSWWSSSS\\V]VZW8,.FW]\\]\]\]\\ZZ\\WFR>38(
bTRHHHHHQQHQJQWJSSSSSSSSSSSSSSSSWWSSSS\\V]VZW8,.FW]\\]\]\]\\ZZ\\WFR>38(
.BTTkgn]ktvgmvvvvvmvvvsvzzzyzyzyzyyyzmkkkkkZSRA816;F87
.BTTkgn]ktvgmvvvvvmvvvsvzzzyzyzyzyyyzmkkkkkZSRA816;F87
yzyzyzym^Z]WN3 $&$.Wt\
yzyzyzym^Z]WN3 $&$.Wt\
""*"""****""""
""*"""****""""
"***"**""**
"***"**""**
$5612,.2,
$5612,.2,
&$$,,,5]
&$$,,,5]
$]t.Ft
$]t.Ft
7%8U8
7%8U8
3 303
3 303
2
8 8$8(8,80848885%5,575{67 7$7(7,70747rundll32.exeSOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AdvancedSOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPageSoftware\Microsoft\Windows\CurrentVersion\Explorer\Advanced::{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}::{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}::{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}::{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}::{D20EA4E1-3957-11d2-A40B-0C5020524153}::{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}{208D2C60-3AEA-1069-A2D7-08002B30309D}{20D04FE0-3AEA-1069-A2D8-08002B30309D}Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites{450D8FBA-AD25-11D0-98A8-0800361B1103}CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}Software\Microsoft\Windows\CurrentVersion\RunOnceSoftware\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoadSoftware\Microsoft\Windows\CurrentVersion\Explorer\DontShowMeThisDialogAgainSoftware\Microsoft\Windows\CurrentVersion\Explorer\Desktop\CleanupWiz\\.\WMIDataDeviceSoftware\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\Policies\Explorer\RunSoftware\Microsoft\Windows NT\CurrentVersion\WindowsExplorerIsShellMutexdesk.cplSoftware\Microsoft\Windows\CurrentVersion\Explorertourstart.exetourstart.exe,0Microsoft.OfferTourWINWORD.EXESoftware\Microsoft\Windows\CurrentVersion\AppletsSoftware\Microsoft\Windows\CurrentVersion\Applets\Tourexplorer.exe,9Microsoft.FixScreenResolutionshell:::{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}Software\Microsoft\Windows\CurrentVersion\Explorer\FileAssociationSoftware\Microsoft\Windows NT\CurrentVersionshell:::{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}Software\Microsoft\Windows\CurrentVersion\Explorer\StartPageSoftware\Microsoft\Windows\CurrentVersion\Policies\ExplorerDDEEXECUTESHORTCIRCUIThttp\shellIEXPLORE.EXESoftware\Microsoft\Windows\CurrentVersion\Explorer\Streams\DesktopSoftware\Microsoft\Windows\CurrentVersion\RunOnceExcomctl32.dllSoftware\Microsoft\Windows\Internet SettingsAutoConfigURLsystem.iniAppEvents\Schemes\Apps\.Default\%s\.currentSoftware\Microsoft\Windows\CurrentVersion\Explorer\TrayNotifyMSShellRunDlgReadyres://mys.dll/mys.hta /explorermshta.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Setup\WelcomeSoftware\Microsoft\Windows\CurrentVersion\Explorer\TipsSOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\MYScys.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\srvWizinstall.exeSOFTWARE\Microsoft\Windows\CurrentVersion\Control PanelOUTLOOK.EXEexplorer.exe,16iernonce.dllWININET.DLLUpdateURLWindowsUpdateHWND%xSoftware\Microsoft\Windows\CurrentVersion\OemStartMenuDatafldrclnr.dll,Wizard_RunDLLiexplore.exewinbrand.dllSoftware\Microsoft\Windows\CurrentVersion\Explorer\Remote\%dshell32.dllnusrmgr.cpl ,initialTask=ChangePictureNewExeNameWindowsediskeer.dlltimedate.cplSoftware\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\LastVisitedMRUSoftware\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\OpenSaveMRUSoftware\Microsoft\Windows\CurrentVersion\Explorer\Doc Find Spec MRUSoftware\Microsoft\Windows\CurrentVersion\Explorer\RunMRUSoftware\Microsoft\Internet Explorer\TypedURLs%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Calculator.lnk%ALLUSERSPROFILE%\Start Menu\Programs\Games\Solitaire.lnk%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Paint.lnk%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\WordPad.lnk%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\Files and Settings Transfer Wizard.lnk%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Windows Movie Maker.lnk%USERPROFILE%\Start Menu\Programs\Accessories\Tour Windows XP.lnk%ALLUSERSPROFILE%\Start Menu\Programs\Windows Messenger.lnk%USERPROFILE%\Start Menu\Programs\Windows Media Player.lnk%ALLUSERSPROFILE%\Start Menu\Programs\MSN.lnk%ALLUSERSPROFILE%\Start Menu\Programs\Get Online with MSN.lnk%ALLUSERSPROFILE%\Start Menu\Programs\Get Going with Tablet PC.lnk%ALLUSERSPROFILE%\Start Menu\Set Program Access and Defaults.lnk%ALLUSERSPROFILE%\Start Menu\Programs\Windows Journal.lnk%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Media Center\Media Center.lnk%USERPROFILE%\Start Menu\Programs\Internet Explorer.lnkSoftware\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanelTSAppCMP.DLLnetapi32.dll%SystemRoot%\system32\restore\rstrui.exeRunDLL32.EXE Shell32.DLL,ShellExec_RunDLL ?0x%X?%sRunDLL32.EXE%s%d%sSoftware\Microsoft\Windows\CurrentVersion\Policies\Systemsettings.dllexplorer.exe "explorer.exe /e, "WindowsLogonWindowsLogoff%s %sSoftware\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\CountuAppWiz.Cpl\explorer.exeSoftware\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu::{20D04FE0-3AEA-1069-A2D8-08002B30309D}taskmgr.exeShellExecuteSoftware\Microsoft\Windows\CurrentVersion\Explorer\AppKey\%d\WindowsShell.ManifestGet Online with MSN.lnkSet Program Access and Defaults.lnkLink%dOEM%dSoftware\Microsoft\Windows\CurrentVersion\SMDEn::{D20EA4E1-3957-11d2-A40B-0C5020524152}There is a file or folder on your computer called "%s" which could cause certain applications to not function correctly. Renaming it to "%s" would solve this problem. Would you like to rename it now?Ca&scade WindowsTile Windows &HorizontallyTile Windows V&ertically&Windows Security...&Help and Support&Log Off %s...Windows Explorer6.00.2900.5512 (xpsp.080413-2105)EXPLORER.EXEWindowsOperating System6.00.2900.5512Keep the &taskbar on top of other windowsTo remove records of recently accessed documents, programs, and Web sites, click Clear.Windows displays icons for active and urgent notifications, and hides inactive ones. You can change this behavior for items in the list below.Select this option to use the menu style from earlier versions of Windows.6There is not enough memory to complete this operation.8Unable to run command.The folder '%1' has been removed.WMy Computer or Windows Explorer has not been properly initialized yet. Try again later.&Undo %sWindows is running in safe mode.This special diagnostic mode of Windows enables you to fix a problem which may be caused by your network or hardware settings. Make sure these settings are correct in Control Panel, and then try starting Windows again. While in safe mode, some of your devices may not be available.startRThere was an internal error and one of the windows you were using has been closed.Restrictions{This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator.&Show Open WindowsWindows was unable to change the display settings for the new configuration. Return the computer to the previous state, shut down Windows, and restart the computer in the desired configuration.There may be a problem with your display settings if you continue. To safely change to a new configuration, you should shut down Windows and restart the computer in the desired configuration. Do you want to continue anyway?This pre-release version of "Internet Explorer 4.0" Desktop/Explorer has expired. Please update to the latest release of "Internet Explorer 4.0" from WWW.MICROSOFT.COMhelpctr.exe>-FromStartHelpTake a tour of Windows XPNOpens a window where you can pick search options and work with search results.aOpens a central location for Help topics, tutorials, troubleshooting, and other support services./Opens a program, folder, document, or Web site.Provides options for closing your programs and logging off, or for leaving your programs running and switching to another user.lProvides options for turning off or restarting your computer, or for activating Stand By or Hibernate modes.RDisconnects your session. You can reconnect to the session when you log on again.&Windows SecurityiOpens the My Documents folder, where you can store letters, reports, notes, and other kinds of documents./Displays recently opened documents and folders.KOpens the My Music folder, where you can store music and other audio files.]Opens the My Pictures folder, where you can store digital photos, images, and graphics files.zGives access to, and information about, the disk drives, cameras, scanners, and other hardware connected to your computer.MGives access to, and information about, folders and files on other computers.8Connects to other computers, networks, and the Internet.explorer.exe_256_rwx_00090000_00001000:KERNEL32.DLLexplorer.exe_256_rwx_001D0000_00001000:KERNEL32.DLLexplorer.exe_256_rwx_00210000_00001000:KERNEL32.DLLexplorer.exe_256_rwx_00250000_00001000:KERNEL32.DLLexplorer.exe_256_rwx_00290000_00001000:KERNEL32.DLLexplorer.exe_256_rwx_002D0000_00001000:KERNEL32.DLLexplorer.exe_256_rwx_00BD0000_00001000:advapi32.dllexplorer.exe_256_rwx_00C00000_00001000:RegOpenKeyAexplorer.exe_256_rwx_00C10000_00001000:advapi32.dllexplorer.exe_256_rwx_00C40000_00001000:AVICAP32.DLLexplorer.exe_256_rwx_00C90000_00001000:AVICAP32.DLLexplorer.exe_256_rwx_00CC0000_00001000:gdi32.dllexplorer.exe_256_rwx_00D00000_00001000:gdi32.dllexplorer.exe_256_rwx_00F40000_00001000:gdiplus.dllexplorer.exe_256_rwx_00F80000_00001000:gdiplus.dllexplorer.exe_256_rwx_00FC0000_00001000:mpr.dllexplorer.exe_256_rwx_01400000_00001000:mpr.dllexplorer.exe_256_rwx_01430000_00001000:msacm32.dllexplorer.exe_256_rwx_01570000_00001000:msacm32.dllexplorer.exe_256_rwx_015A0000_00001000:ntdll.dllexplorer.exe_256_rwx_016E0000_00001000:ntdll.dllexplorer.exe_256_rwx_01710000_00001000:ole32.dllexplorer.exe_256_rwx_01850000_00001000:ole32.dllexplorer.exe_256_rwx_01880000_00001000:oleaut32.dllexplorer.exe_256_rwx_019C0000_00001000:oleaut32.dllexplorer.exe_256_rwx_019F0000_00001000:powrprof.dllexplorer.exe_256_rwx_01B30000_00001000:powrprof.dllexplorer.exe_256_rwx_01B60000_00001000:shell32.dllexplorer.exe_256_rwx_01CA0000_00001000:shell32.dllexplorer.exe_256_rwx_01CD0000_00001000:user32.dllexplorer.exe_256_rwx_01E10000_00001000:user32.dllexplorer.exe_256_rwx_01E40000_00001000:wininet.dllexplorer.exe_256_rwx_01F70000_00001000:FtpOpenFileAexplorer.exe_256_rwx_01F80000_00001000:wininet.dllexplorer.exe_256_rwx_01FB0000_00001000:winmm.dllexplorer.exe_256_rwx_020F0000_00001000:winmm.dllexplorer.exe_256_rwx_02120000_00001000:wsock32.dllexplorer.exe_256_rwx_02260000_00001000:wsock32.dllexplorer.exe_256_rwx_24080000_00062000:`.rsrc/w)f%u/kernel32.dllPortions Copyright (c) 1999,2003 Avenger by NhTSHFileOperationAshell32.dllURLDownloadToFileAurlmon.dllShellExecuteASOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell FoldersGetWindowsDirectoryASOFTWARE\Microsoft\Windows\CurrentVersionhttp\shell\open\command\Internet Explorer\iexplore.exe####@####$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)PortugalTurkeyWindows 3.1Windows 95 (Release 2)Windows 95Windows 98 SEWindows 98Windows MEWindows 7Windows Vista%s %sWindows XP Professional x64Windows XP HomeWindows XP ProfessionalWindows 2000 ProfessionalWindows NT %d.%dWindows 2008%s %s ServerWindows 2003 Server DatacenterWindows 2003 Server EnterpriseWindows 2003 Server Web EditionWindows 2003 ServerWindows Home ServerWindows 2003 Server (Release 2)Windows 2000 Server DatacenterWindows 2000 Server EnterpriseWindows 2000 Server Web EditionWindows 2000 ServerWindows NT 4.0 Server DatacenterWindows NT 4.0 Server EnterpriseWindows NT 4.0 Server Web EditionWindows NT 4.0 ServerUnknown Platform ID (%d)%d.%d%s (Build: %d- Service Pack: %sKERNEL32.DLLteste.vbsteste.txtSet objSecurityCenter = GetObject("winmgmts:\\.\root\SecurityCenter")Set colFirewall = objSecurityCenter.ExecQuery("Select * From FirewallProduct",,48)Set colAntiVirus = objSecurityCenter.ExecQuery("Select * From AntiVirusProduct",,48)Set objFileSystem = CreateObject("Scripting.fileSystemObject")Set objFile = objFileSystem.CreateTextFile("Info = Info & "F" & CountFw & ") " & objFirewall.displayName & " v" & objFirewall.versionNumber & EnterInfo = Info & "A" & CountAV & ") " & objAntiVirus.displayName & " v" & objAntiVirus.versionNumber & EnterobjFile.WriteLine(Info)objFile.Closecscript.exeAVICAP32.dlltFtpAccessBuildImportTable: can't load library:BuildImportTable: ReallocMemory failedBuildImportTable: GetProcAddress failedBTMemoryLoadLibary: BuildImportTable failedBTMemoryGetProcAddress: no export table foundBTMemoryGetProcAddress: DLL doesn't export anythingBTMemoryGetProcAddress: exported symbol not foundSetupApi.dllSetupDiOpenClassRegKeySetupDiOpenClassRegKeyExASetupDiOpenClassRegKeyExWSetupDiCreateDeviceInterfaceRegKeyASetupDiCreateDeviceInterfaceRegKeyWSetupDiOpenDeviceInterfaceRegKeySetupDiDeleteDeviceInterfaceRegKeySetupDiCreateDevRegKeyASetupDiCreateDevRegKeyWSetupDiOpenDevRegKeySetupDiDeleteDevRegKeyCM_DEVCAP_LOCKSUPPORTEDCM_DEVCAP_EJECTSUPPORTEDPDCAP_D0_SUPPORTEDPDCAP_D1_SUPPORTEDPDCAP_D2_SUPPORTEDPDCAP_D3_SUPPORTEDPDCAP_WAKE_FROM_D0_SUPPORTEDPDCAP_WAKE_FROM_D1_SUPPORTEDPDCAP_WAKE_FROM_D2_SUPPORTEDPDCAP_WAKE_FROM_D3_SUPPORTEDPDCAP_WARM_EJECT_SUPPORTEDHKEY_CLASSES_ROOTHKEY_CURRENT_CONFIGHKEY_CURRENT_USERHKEY_LOCAL_MACHINEHKEY_USERS127.0.0.1iphlpapi.dllAllocateAndGetTcpExTableFromStackAllocateAndGetUdpExTableFromStackSetTcpEntryGetExtendedTcpTableGetExtendedUdpTableMozilla3_5PasswordGetChromePassStartHttpProxy1.2.3XxX.xXxUuU.uUukeyboardkeywebcaminactivewebcamgetbufferwebcamenviarexecnormalenviarexechiddenopenwebdownexecsendftpkeyloggerkeyloggergetlogkeyloggereraselogkeyloggerativarkeyloggerdesativarrenamekeywindowsfecharwindowsmaxwindowsminwindowsmostrarwindowsocultarwindowsmintodaswindowscaptionlistarportaslistarportasdnsfinalizarprocessoportaswebcamsettingschatmsgSOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PSAPI.dll\config\SteamAppData.vdfAutoLoginUser/ClientRegistry.Blob\ClientRegistry.blob\steam.dll%SYS%ÞSKTOP%FirstExecutionchatmsg|Software\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\Policies\Explorer\Runlistarjanelas|windowsfechar|listarjanelas|windowsmax|listarjanelas|windowsmin|listarjanelas|windowsmostrar|listarjanelas|windowsocultar|listarjanelas|windowsmintodas|listarjanelas|windowscaption|HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstalllistarportas|listadeportaspronta|listarportas|finalizarconexao|listarportas|finalizarprocessoportas|Y|listarportas|finalizarprocessoportas|N|registro|renamekey|keylogger|keylogger|keyloggerativar|keylogger|keylogger|keyloggerdesativar|keylogger|keyloggergetlog|keylogger|keylogger|keyloggervazio|keyloggersearchkeyloggersearchok|webcam|webcaminactive|webcam|webcamactive|getpassword_x_X_PASSWORDLIST_X_x_NOIP.abcMSN.abcFIREFOX.abcIELOGIN.abcIEPASS.abcIEAUTO.abcIEWEB.abcSOFTWARE\Mozilla\Mozilla Firefoxgetfirefoxgetielogingetiepassgetiewebgetchromegetpassword|getpasswordlist|getpassword|getpassworderror|updateservidorweb##@@## ##@@## ##@@##Windows\CurrentVersion\Uninstall\eDonkey2000UNWISE.EXEntdll.dllicon=shell32.dll,4shellexecute=autorun.infXX--XX--XX.txtlogs.datSQLite3.dll$1.2.3deflate 1.2.3 Copyright 1995-2005 Jean-loup Gaillyinflate 1.2.3 Copyright 1995-2005 Mark AdlerKWindowsUnitExecutarComandosuftpUrlMon.UnitBytesSizeUnitListarPortasAtivasUnitWebcamUnitKeyloggerWinExecSetNamedPipeHandleStateGetProcessHeapCreatePipeRegOpenKeyExARegOpenKeyARegEnumKeyExARegDeleteKeyARegCreateKeyARegCloseKeyGdiplusShutdownkeybd_eventMapVirtualKeyAGetKeyboardStateGetKeyboardLayoutNameAGetKeyStateGetAsyncKeyStateExitWindowsExEnumWindowsFtpGetFileSizeFtpSetCurrentDirectoryAFtpOpenFileA%( % & % % % ].idata.relocP.rsrcadvapi32.dllAVICAP32.DLLgdi32.dllgdiplus.dllmpr.dllmsacm32.dllole32.dlloleaut32.dllpowrprof.dlluser32.dllwininet.dllwinmm.dllwsock32.dllExplorer.EXE_884_rwx_014D0000_00001000:KERNEL32.DLLExplorer.EXE_884_rwx_02080000_00001000:KERNEL32.DLLExplorer.EXE_884_rwx_021D0000_00001000:KERNEL32.DLLExplorer.EXE_884_rwx_02210000_00001000:KERNEL32.DLLExplorer.EXE_884_rwx_02250000_00001000:KERNEL32.DLLExplorer.EXE_884_rwx_02290000_00001000:KERNEL32.DLLExplorer.EXE_884_rwx_022C0000_00001000:advapi32.dllExplorer.EXE_884_rwx_023F0000_00001000:RegOpenKeyAExplorer.EXE_884_rwx_02400000_00001000:advapi32.dllExplorer.EXE_884_rwx_02430000_00001000:AVICAP32.DLLExplorer.EXE_884_rwx_02570000_00001000:AVICAP32.DLLExplorer.EXE_884_rwx_025A0000_00001000:gdi32.dllExplorer.EXE_884_rwx_026E0000_00001000:gdi32.dllExplorer.EXE_884_rwx_02710000_00001000:gdiplus.dllExplorer.EXE_884_rwx_02850000_00001000:gdiplus.dllExplorer.EXE_884_rwx_02880000_00001000:mpr.dllExplorer.EXE_884_rwx_028C0000_00001000:mpr.dllExplorer.EXE_884_rwx_028F0000_00001000:msacm32.dllExplorer.EXE_884_rwx_02930000_00001000:msacm32.dllExplorer.EXE_884_rwx_02960000_00001000:ntdll.dllExplorer.EXE_884_rwx_02CB0000_00001000:ntdll.dllExplorer.EXE_884_rwx_02CE0000_00001000:ole32.dllExplorer.EXE_884_rwx_02E20000_00001000:ole32.dllExplorer.EXE_884_rwx_02E50000_00001000:oleaut32.dllExplorer.EXE_884_rwx_02F90000_00001000:oleaut32.dllExplorer.EXE_884_rwx_02FC0000_00001000:powrprof.dllExplorer.EXE_884_rwx_03100000_00001000:powrprof.dllExplorer.EXE_884_rwx_03130000_00001000:shell32.dllExplorer.EXE_884_rwx_03270000_00001000:shell32.dllExplorer.EXE_884_rwx_032A0000_00001000:user32.dllExplorer.EXE_884_rwx_033E0000_00001000:user32.dllExplorer.EXE_884_rwx_03410000_00001000:wininet.dllExplorer.EXE_884_rwx_03540000_00001000:FtpOpenFileAExplorer.EXE_884_rwx_03550000_00001000:wininet.dllExplorer.EXE_884_rwx_03580000_00001000:winmm.dllExplorer.EXE_884_rwx_036C0000_00001000:winmm.dllExplorer.EXE_884_rwx_036F0000_00001000:wsock32.dllExplorer.EXE_884_rwx_03830000_00001000:wsock32.dllExplorer.EXE_884_rwx_24010000_00062000:`.rsrc/w)f%u/kernel32.dllPortions Copyright (c) 1999,2003 Avenger by NhTSHFileOperationAshell32.dllURLDownloadToFileAurlmon.dllShellExecuteASOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell FoldersGetWindowsDirectoryASOFTWARE\Microsoft\Windows\CurrentVersionhttp\shell\open\command\Internet Explorer\iexplore.exe####@####$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)PortugalTurkeyWindows 3.1Windows 95 (Release 2)Windows 95Windows 98 SEWindows 98Windows MEWindows 7Windows Vista%s %sWindows XP Professional x64Windows XP HomeWindows XP ProfessionalWindows 2000 ProfessionalWindows NT %d.%dWindows 2008%s %s ServerWindows 2003 Server DatacenterWindows 2003 Server EnterpriseWindows 2003 Server Web EditionWindows 2003 ServerWindows Home ServerWindows 2003 Server (Release 2)Windows 2000 Server DatacenterWindows 2000 Server EnterpriseWindows 2000 Server Web EditionWindows 2000 ServerWindows NT 4.0 Server DatacenterWindows NT 4.0 Server EnterpriseWindows NT 4.0 Server Web EditionWindows NT 4.0 ServerUnknown Platform ID (%d)%d.%d%s (Build: %d- Service Pack: %sKERNEL32.DLLteste.vbsteste.txtSet objSecurityCenter = GetObject("winmgmts:\\.\root\SecurityCenter")Set colFirewall = objSecurityCenter.ExecQuery("Select * From FirewallProduct",,48)Set colAntiVirus = objSecurityCenter.ExecQuery("Select * From AntiVirusProduct",,48)Set objFileSystem = CreateObject("Scripting.fileSystemObject")Set objFile = objFileSystem.CreateTextFile("Info = Info & "F" & CountFw & ") " & objFirewall.displayName & " v" & objFirewall.versionNumber & EnterInfo = Info & "A" & CountAV & ") " & objAntiVirus.displayName & " v" & objAntiVirus.versionNumber & EnterobjFile.WriteLine(Info)objFile.Closecscript.exeAVICAP32.dlltFtpAccessBuildImportTable: can't load library:BuildImportTable: ReallocMemory failedBuildImportTable: GetProcAddress failedBTMemoryLoadLibary: BuildImportTable failedBTMemoryGetProcAddress: no export table foundBTMemoryGetProcAddress: DLL doesn't export anythingBTMemoryGetProcAddress: exported symbol not foundSetupApi.dllSetupDiOpenClassRegKeySetupDiOpenClassRegKeyExASetupDiOpenClassRegKeyExWSetupDiCreateDeviceInterfaceRegKeyASetupDiCreateDeviceInterfaceRegKeyWSetupDiOpenDeviceInterfaceRegKeySetupDiDeleteDeviceInterfaceRegKeySetupDiCreateDevRegKeyASetupDiCreateDevRegKeyWSetupDiOpenDevRegKeySetupDiDeleteDevRegKeyCM_DEVCAP_LOCKSUPPORTEDCM_DEVCAP_EJECTSUPPORTEDPDCAP_D0_SUPPORTEDPDCAP_D1_SUPPORTEDPDCAP_D2_SUPPORTEDPDCAP_D3_SUPPORTEDPDCAP_WAKE_FROM_D0_SUPPORTEDPDCAP_WAKE_FROM_D1_SUPPORTEDPDCAP_WAKE_FROM_D2_SUPPORTEDPDCAP_WAKE_FROM_D3_SUPPORTEDPDCAP_WARM_EJECT_SUPPORTEDHKEY_CLASSES_ROOTHKEY_CURRENT_CONFIGHKEY_CURRENT_USERHKEY_LOCAL_MACHINEHKEY_USERS127.0.0.1iphlpapi.dllAllocateAndGetTcpExTableFromStackAllocateAndGetUdpExTableFromStackSetTcpEntryGetExtendedTcpTableGetExtendedUdpTableMozilla3_5PasswordGetChromePassStartHttpProxy1.2.3XxX.xXxUuU.uUukeyboardkeywebcaminactivewebcamgetbufferwebcamenviarexecnormalenviarexechiddenopenwebdownexecsendftpkeyloggerkeyloggergetlogkeyloggereraselogkeyloggerativarkeyloggerdesativarrenamekeywindowsfecharwindowsmaxwindowsminwindowsmostrarwindowsocultarwindowsmintodaswindowscaptionlistarportaslistarportasdnsfinalizarprocessoportaswebcamsettingschatmsgSOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PSAPI.dll\config\SteamAppData.vdfAutoLoginUser/ClientRegistry.Blob\ClientRegistry.blob\steam.dll%SYS%ÞSKTOP%FirstExecutionchatmsg|Software\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\Policies\Explorer\Runlistarjanelas|windowsfechar|listarjanelas|windowsmax|listarjanelas|windowsmin|listarjanelas|windowsmostrar|listarjanelas|windowsocultar|listarjanelas|windowsmintodas|listarjanelas|windowscaption|HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstalllistarportas|listadeportaspronta|listarportas|finalizarconexao|listarportas|finalizarprocessoportas|Y|listarportas|finalizarprocessoportas|N|registro|renamekey|keylogger|keylogger|keyloggerativar|keylogger|keylogger|keyloggerdesativar|keylogger|keyloggergetlog|keylogger|keylogger|keyloggervazio|keyloggersearchkeyloggersearchok|webcam|webcaminactive|webcam|webcamactive|getpassword_x_X_PASSWORDLIST_X_x_NOIP.abcMSN.abcFIREFOX.abcIELOGIN.abcIEPASS.abcIEAUTO.abcIEWEB.abcSOFTWARE\Mozilla\Mozilla Firefoxgetfirefoxgetielogingetiepassgetiewebgetchromegetpassword|getpasswordlist|getpassword|getpassworderror|updateservidorweb##@@## ##@@## ##@@##Windows\CurrentVersion\Uninstall\eDonkey2000UNWISE.EXEntdll.dllicon=shell32.dll,4shellexecute=autorun.infXX--XX--XX.txtlogs.datSQLite3.dll$1.2.3deflate 1.2.3 Copyright 1995-2005 Jean-loup Gaillyinflate 1.2.3 Copyright 1995-2005 Mark AdlerKWindowsUnitExecutarComandosuftpUrlMon.UnitBytesSizeUnitListarPortasAtivasUnitWebcamUnitKeyloggerWinExecSetNamedPipeHandleStateGetProcessHeapCreatePipeRegOpenKeyExARegOpenKeyARegEnumKeyExARegDeleteKeyARegCreateKeyARegCloseKeyGdiplusShutdownkeybd_eventMapVirtualKeyAGetKeyboardStateGetKeyboardLayoutNameAGetKeyStateGetAsyncKeyStateExitWindowsExEnumWindowsFtpGetFileSizeFtpSetCurrentDirectoryAFtpOpenFileA%( % & % % % ].idata.relocP.rsrcadvapi32.dllAVICAP32.DLLgdi32.dllgdiplus.dllmpr.dllmsacm32.dllole32.dlloleaut32.dllpowrprof.dlluser32.dllwininet.dllwinmm.dllwsock32.dll3>