Gen:Variant.Kazy.535449 (B) (Emsisoft), Gen:Variant.Kazy.535449 (AdAware), ZeroAccess.YR (Lavasoft MAS)Behaviour: Malware
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: f9c9339a63965591860eaea8f2ffa98d
SHA1: 81f38b132fb047a53235dd3a8c5c20bbbf9ff1dc
SHA256: 7a336da7164d44c909acf2a4526be823cdab78d7b7c7a3b9bbfaa07f0f02ea51
SSDeep: 12288:XtSQDmepTxzIdwC/K XmQIyJLRdjNiTC0:sQqsadwUK0tR1E
Size: 454656 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2015-01-06 02:36:08
Analyzed on: WindowsXP SP3 32-bit
Summary: Malware. Malware, short for malicious software, is any software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems.
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Malware creates the following process(es):
cscript.exe:216
cscript.exe:1788
cscript.exe:1140
cscript.exe:1300
cscript.exe:1780
cscript.exe:1264
cscript.exe:132
cscript.exe:1948
cscript.exe:268
cscript.exe:1836
cscript.exe:1076
cscript.exe:1072
cscript.exe:544
cscript.exe:1376
cscript.exe:1676
cscript.exe:1916
cscript.exe:284
cscript.exe:816
cscript.exe:2012
cscript.exe:1792
cscript.exe:1796
cscript.exe:260
cscript.exe:1228
cscript.exe:1016
cscript.exe:1704
cscript.exe:1824
cscript.exe:1064
cscript.exe:928
cscript.exe:1388
cscript.exe:296
cscript.exe:1920
cscript.exe:1480
cscript.exe:1484
cscript.exe:1716
cscript.exe:364
cscript.exe:916
cscript.exe:1100
cscript.exe:1336
cscript.exe:1932
cscript.exe:1936
cscript.exe:900
cscript.exe:1432
cscript.exe:852
cscript.exe:2040
cscript.exe:244
cscript.exe:1840
cscript.exe:1648
cscript.exe:1240
cscript.exe:1532
cscript.exe:436
cscript.exe:516
cscript.exe:1224
cscript.exe:624
cscript.exe:332
cscript.exe:256
cscript.exe:1900
cscript.exe:1632
cscript.exe:1980
cscript.exe:1988
cscript.exe:652
cscript.exe:188
cscript.exe:1036
cscript.exe:636
cscript.exe:464
cscript.exe:1860
cscript.exe:1596
cscript.exe:228
cscript.exe:224
cscript.exe:548
cscript.exe:220
cscript.exe:1992
cscript.exe:1028
cscript.exe:1748
cscript.exe:1452
cscript.exe:2028
cscript.exe:728
cscript.exe:1512
cscript.exe:1160
cscript.exe:156
cscript.exe:1288
cscript.exe:232
cscript.exe:1052
cscript.exe:876
cscript.exe:2036
cscript.exe:1112
cscript.exe:2032
cscript.exe:644
cscript.exe:776
cscript.exe:612
cscript.exe:616
cscript.exe:1816
cscript.exe:1276
cscript.exe:1608
cscript.exe:1040
cscript.exe:948
cscript.exe:1972
cscript.exe:1680
cscript.exe:2000
cscript.exe:476
cscript.exe:1688
cscript.exe:1368
cscript.exe:804
%original file name%.exe:216
%original file name%.exe:1140
%original file name%.exe:212
%original file name%.exe:1264
%original file name%.exe:132
%original file name%.exe:1948
%original file name%.exe:1076
%original file name%.exe:344
%original file name%.exe:544
%original file name%.exe:1376
%original file name%.exe:280
%original file name%.exe:1676
%original file name%.exe:220
%original file name%.exe:816
%original file name%.exe:2012
%original file name%.exe:716
%original file name%.exe:1796
%original file name%.exe:260
%original file name%.exe:268
%original file name%.exe:364
%original file name%.exe:520
%original file name%.exe:1824
%original file name%.exe:1064
%original file name%.exe:464
%original file name%.exe:928
%original file name%.exe:1388
%original file name%.exe:828
%original file name%.exe:296
%original file name%.exe:1920
%original file name%.exe:1480
%original file name%.exe:1484
%original file name%.exe:1716
%original file name%.exe:1524
%original file name%.exe:1252
%original file name%.exe:1016
%original file name%.exe:1236
%original file name%.exe:1452
%original file name%.exe:1336
%original file name%.exe:380
%original file name%.exe:244
%original file name%.exe:1964
%original file name%.exe:1936
%original file name%.exe:900
%original file name%.exe:844
%original file name%.exe:1432
%original file name%.exe:852
%original file name%.exe:2040
%original file name%.exe:1932
%original file name%.exe:1840
%original file name%.exe:1648
%original file name%.exe:1240
%original file name%.exe:1532
%original file name%.exe:436
%original file name%.exe:516
%original file name%.exe:1224
%original file name%.exe:624
%original file name%.exe:1228
%original file name%.exe:240
%original file name%.exe:1908
%original file name%.exe:252
%original file name%.exe:172
%original file name%.exe:1900
%original file name%.exe:1632
%original file name%.exe:972
%original file name%.exe:1980
%original file name%.exe:1988
%original file name%.exe:1500
%original file name%.exe:652
%original file name%.exe:1108
%original file name%.exe:188
%original file name%.exe:1036
%original file name%.exe:636
%original file name%.exe:1352
%original file name%.exe:1860
%original file name%.exe:228
%original file name%.exe:548
%original file name%.exe:1916
%original file name%.exe:868
%original file name%.exe:1028
%original file name%.exe:1104
%original file name%.exe:1748
%original file name%.exe:1100
%original file name%.exe:332
%original file name%.exe:408
%original file name%.exe:2028
%original file name%.exe:728
%original file name%.exe:1164
%original file name%.exe:1160
%original file name%.exe:884
%original file name%.exe:1288
%original file name%.exe:1816
%original file name%.exe:1056
%original file name%.exe:356
%original file name%.exe:876
%original file name%.exe:1960
%original file name%.exe:1568
%original file name%.exe:2036
%original file name%.exe:1112
%original file name%.exe:2032
%original file name%.exe:1116
%original file name%.exe:644
%original file name%.exe:1176
%original file name%.exe:612
%original file name%.exe:616
%original file name%.exe:1052
%original file name%.exe:1608
%original file name%.exe:1040
%original file name%.exe:948
%original file name%.exe:1976
%original file name%.exe:1972
%original file name%.exe:1680
%original file name%.exe:476
%original file name%.exe:1688
%original file name%.exe:2008
%original file name%.exe:804
The Malware injects its code into the following process(es):
fGAwoYMM.exe:1208
reIEcoQI.exe:320
NesIMIQs.exe:984
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process fGAwoYMM.exe:1208 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe (7726 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe (2321 bytes)
C:\totalcmd\TOTALCMD.EXE.exe (30812 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe (2321 bytes)
C:\totalcmd\TCMADMIN.EXE.exe (3073 bytes)
C:\totalcmd\TCUNINST.EXE.exe (3073 bytes)
C:\totalcmd\TcUsbRun.exe (3073 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\KAAo.txt (55978 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe (3361 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe (3073 bytes)
C:\totalcmd\TCMDX32.EXE.exe (3361 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe (3361 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe (3073 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Setup.exe (5441 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe (2321 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp (0 bytes)
C:\totalcmd\TCUNINST.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp (0 bytes)
C:\totalcmd\TOTALCMD.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp (0 bytes)
C:\totalcmd\TCMADMIN.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg (0 bytes)
C:\totalcmd\TCMDX32.EXE (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg (0 bytes)
The process %original file name%.exe:216 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\JEcAYQYs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BuYQUAck.bat (112 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\JEcAYQYs.bat (0 bytes)
The process %original file name%.exe:1140 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jGkskoQU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fQAoogIs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uwwgkcso.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lukUIcMw.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\fQAoogIs.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uwwgkcso.bat (0 bytes)
The process %original file name%.exe:212 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\HWgwYwUg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\coooQAMY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lKAsIgIQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cUQAEIwM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PeAcssMc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KqIgIgQo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JIEUIgIE.bat (4 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dWoUQkUc.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\cUQAEIwM.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lKAsIgIQ.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\coooQAMY.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JIEUIgIE.bat (0 bytes)
The process %original file name%.exe:1264 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qSAgYgYY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EkgYcQcM.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\qSAgYgYY.bat (0 bytes)
The process %original file name%.exe:132 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\QYYQQMEQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PGYYwMcU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yGsQMsMM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xAQocwEo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qggEIosQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ickIkggg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oyIMkswk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BoMcAggE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OiEgcowc.bat (4 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lqIQQEgo.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\OiEgcowc.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BoMcAggE.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yGsQMsMM.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oyIMkswk.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xAQocwEo.bat (0 bytes)
The process %original file name%.exe:1948 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\JewEQkEA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gQYAogoA.bat (112 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\JewEQkEA.bat (0 bytes)
The process %original file name%.exe:1076 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\TAEsYsoY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tWYEUAsY.bat (112 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\TAEsYsoY.bat (0 bytes)
The process %original file name%.exe:344 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\BiYcgMsE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pGkMUYkg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\heAAcscs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IegIQYoE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FKQoIcwM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hakQMEYs.bat (4 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (21 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\heAAcscs.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BiYcgMsE.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hakQMEYs.bat (0 bytes)
The process %original file name%.exe:544 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\ocMIQEUA.bat (112 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UYEkYMkw.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\UYEkYMkw.bat (0 bytes)
The process %original file name%.exe:1376 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IiYswoQY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DYswAwQk.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\IiYswoQY.bat (0 bytes)
The process %original file name%.exe:280 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\oQskoAcw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zEwAAUUw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uEAwEMwg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NQQwoUsU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cAcUMYQI.bat (112 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uOosAkok.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\zEwAAUUw.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uEAwEMwg.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uOosAkok.bat (0 bytes)
The process %original file name%.exe:1676 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\KWkYsYco.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tIwIAQww.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yAEQEooc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uSAMgAcg.bat (112 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iwAowQEE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LUIIgIEY.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\KWkYsYco.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tIwIAQww.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iwAowQEE.bat (0 bytes)
The process %original file name%.exe:220 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\mEwUkIkc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PEwwkYIc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PeMIAUgQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DmMYcUIA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PKwwgsEw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PswgksMI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYYsMAwU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MEMwUAUk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LiIskEgA.bat (112 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rkQUIEAY.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\PswgksMI.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PeMIAUgQ.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mEwUkIkc.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DmMYcUIA.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rkQUIEAY.bat (0 bytes)
The process %original file name%.exe:816 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\WMkgYksc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vQAcsgQY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EygkkoQs.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lCIEEgkk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FwgMMcYM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\kEcsUcoo.bat (112 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EuIgckMQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jmccgQgg.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\FwgMMcYM.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WMkgYksc.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vQAcsgQY.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lCIEEgkk.bat (0 bytes)
The process %original file name%.exe:2012 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\LeIssgMo.bat (4 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eYUYAgos.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KGAUgkUo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aiIcEIwQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zyEcMYgA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\kOgAYkUs.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AeAIMcEk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DoAsckwI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FOkYggIQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yAwsUQgM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DEsIUcco.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\DoAsckwI.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yAwsUQgM.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LeIssgMo.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zyEcMYgA.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FOkYggIQ.bat (0 bytes)
The process %original file name%.exe:716 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UKkYIQwU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xAsQMcws.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SQEAYAIM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HUAwUsss.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\SQEAYAIM.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xAsQMcws.bat (0 bytes)
The process %original file name%.exe:1796 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\REsEEcQk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yqMkkcQk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DEEAYskw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\noEcAIYg.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\DEEAYskw.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\noEcAIYg.bat (0 bytes)
The process %original file name%.exe:260 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\IiIYcsgc.bat (4 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\baYYoYAE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MuowcMgQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dKwgMwkg.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\IiIYcsgc.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MuowcMgQ.bat (0 bytes)
The process %original file name%.exe:268 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\lUQgQYwE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DYMscIwg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OEgYIMsY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LCAogcMk.bat (4 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gKgQwEQc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NmAUcIow.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\NmAUcIow.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LCAogcMk.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DYMscIwg.bat (0 bytes)
The process %original file name%.exe:364 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\pEgsYYsE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gCokAkco.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GmYkoIQE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EkgEkUQs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PYsIggMo.bat (4 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dIEwEwMk.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\EkgEkUQs.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dIEwEwMk.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PYsIggMo.bat (0 bytes)
The process %original file name%.exe:520 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ugEwwYsE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CCQookoo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YGkkYwgQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TCcookIA.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\TCcookIA.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YGkkYwgQ.bat (0 bytes)
The process %original file name%.exe:1824 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\migcwwME.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zeUoMIkE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ICUEosAQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LYAMcook.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\ICUEosAQ.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LYAMcook.bat (0 bytes)
The process %original file name%.exe:1064 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DEQYUkYU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wMEsAcwQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LOIcgoMo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lCAAMIYg.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\LOIcgoMo.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DEQYUkYU.bat (0 bytes)
The process %original file name%.exe:464 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\pWsEYows.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GesMIcMk.bat (112 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\pWsEYows.bat (0 bytes)
The process %original file name%.exe:928 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\IiAkYMMo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scMowkMU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AgkUokMQ.bat (4 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\isIkAIMs.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DGwsMEEg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fsUQUMQQ.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\AgkUokMQ.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IiAkYMMo.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scMowkMU.bat (0 bytes)
The process %original file name%.exe:1388 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\QeIAMsYc.bat (112 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RSkQwAEQ.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\RSkQwAEQ.bat (0 bytes)
The process %original file name%.exe:828 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\BAowUoIY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yakAMoEM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CaIckQQE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DEEEkUQA.bat (112 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZCYMkMAA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uIUEogsY.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\yakAMoEM.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZCYMkMAA.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BAowUoIY.bat (0 bytes)
The process %original file name%.exe:296 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YeUcgMAQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\secsQYUI.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\secsQYUI.bat (0 bytes)
The process %original file name%.exe:1920 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\USowowQQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zkgoYccs.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\USowowQQ.bat (0 bytes)
The process %original file name%.exe:1480 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\RMMwUUIc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oAckUgMk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aawwYwAw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GEYQwQIs.bat (112 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (14 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\RMMwUUIc.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aawwYwAw.bat (0 bytes)
The process %original file name%.exe:1484 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\MYUQkQQo.bat (4 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JCosAccU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DkMYkAwQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aYYcAIwE.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\MYUQkQQo.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aYYcAIwE.bat (0 bytes)
The process %original file name%.exe:1716 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\DiwUwYkY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eAoEMgEI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yoMQcAgg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KUUoYYIE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TQoEEswY.bat (4 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cIsoswQU.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\TQoEEswY.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KUUoYYIE.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DiwUwYkY.bat (0 bytes)
The process %original file name%.exe:1524 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\eUkQwgsk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zMYUcIIM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YqAQokwg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dqAoAMEY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hOsAQUcw.bat (112 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aWkQMkQI.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\YqAQokwg.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eUkQwgsk.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aWkQMkQI.bat (0 bytes)
The process %original file name%.exe:1252 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oIMsskAU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LQQAcUEc.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\oIMsskAU.bat (0 bytes)
The process %original file name%.exe:1016 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\zcgYEAQA.bat (112 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fKoUIckc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUAUgkwU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mUUcscYE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fqYUgAgs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TycwgEkg.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\TycwgEkg.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mUUcscYE.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fqYUgAgs.bat (0 bytes)
The process %original file name%.exe:1236 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pYkskMoI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UMUoMYwM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VckgAoQM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LMowIwwg.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\pYkskMoI.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VckgAoQM.bat (0 bytes)
The process %original file name%.exe:1452 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\GCksAIME.bat (4 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LSMoIQAE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JMwkAkcU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DCQwwEcI.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\GCksAIME.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LSMoIQAE.bat (0 bytes)
The process %original file name%.exe:1336 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iQMcksME.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xaQYgoEI.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\xaQYgoEI.bat (0 bytes)
The process %original file name%.exe:380 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\UicIIoEI.bat (112 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iMQoYooc.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\iMQoYooc.bat (0 bytes)
The process %original file name%.exe:244 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\qQoMUIYw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\POwgMQwM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BCYkgsEQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PkMMYYUU.bat (112 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LQUEscIo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zSgcEQsw.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\qQoMUIYw.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LQUEscIo.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BCYkgsEQ.bat (0 bytes)
The process %original file name%.exe:1964 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nYoQsAME.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WScUAYoI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hGUkwoAg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BQQkkcIE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KgkgIgYo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QQMcokUg.bat (4 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (21 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\QQMcokUg.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nYoQsAME.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BQQkkcIE.bat (0 bytes)
The process %original file name%.exe:1936 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\iGsQUoUo.bat (4 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GasIUQIE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EaIsgsQA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MIscgsMM.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\iGsQUoUo.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GasIUQIE.bat (0 bytes)
The process %original file name%.exe:900 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OSIkYgsM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NAYEYoQk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XKMUYQME.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KUEMMgQk.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\KUEMMgQk.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NAYEYoQk.bat (0 bytes)
The process %original file name%.exe:844 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KmYgAoYs.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EIMAcAYU.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\EIMAcAYU.bat (0 bytes)
The process %original file name%.exe:1432 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\oogwQYco.bat (112 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoIgQYY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uUYwEkUY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dywocooo.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\uUYwEkUY.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoIgQYY.bat (0 bytes)
The process %original file name%.exe:852 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IcsIoswI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RgUUMMYc.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\RgUUMMYc.bat (0 bytes)
The process %original file name%.exe:2040 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JQosowgA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GYkAkocY.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\GYkAkocY.bat (0 bytes)
The process %original file name%.exe:1932 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UwMgMIgI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\osgQIUco.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\UwMgMIgI.bat (0 bytes)
The process %original file name%.exe:1840 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DYMIkYcI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iKwAsMQk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vOgEwwcg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nIEAkwQk.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\iKwAsMQk.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vOgEwwcg.bat (0 bytes)
The process %original file name%.exe:1648 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\kOkIcMww.bat (4 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uYcYsAQE.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\kOkIcMww.bat (0 bytes)
The process %original file name%.exe:1240 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\QsMAkYAg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\umcwAsMY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PgEwUIAc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EaIIYMAg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xMAkQYgQ.bat (4 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UkoMMIsg.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\PgEwUIAc.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EaIIYMAg.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xMAkQYgQ.bat (0 bytes)
The process %original file name%.exe:1532 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YukoEgEU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IeEYsgcU.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\YukoEgEU.bat (0 bytes)
The process %original file name%.exe:436 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MqQAEEMs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\taYMkEEQ.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\MqQAEEMs.bat (0 bytes)
The process %original file name%.exe:516 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vScoUUAw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xawAYMUw.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\vScoUUAw.bat (0 bytes)
The process %original file name%.exe:1224 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\laMUAUAw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zsUQYMcQ.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\laMUAUAw.bat (0 bytes)
The process %original file name%.exe:624 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oeoskMQk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PUYocMIQ.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\oeoskMQk.bat (0 bytes)
The process %original file name%.exe:1228 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\zaUQsEkA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PsQgAQcY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oeEQUAog.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vwIMcIIs.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QAMAgMMg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZckUMIAA.bat (112 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (21 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\PsQgAQcY.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oeEQUAog.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zaUQsEkA.bat (0 bytes)
The process %original file name%.exe:240 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ouIAoUMU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xSAQoogk.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\ouIAoUMU.bat (0 bytes)
The process %original file name%.exe:1908 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uesssUgk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CQwkowcc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WuYIwogk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tsskgocI.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\uesssUgk.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CQwkowcc.bat (0 bytes)
The process %original file name%.exe:252 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\QwwIYckM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FyAcYgQI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iaAgoIQA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RiEgEEcE.bat (4 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eccEAkEA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dwYswwQY.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\QwwIYckM.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RiEgEEcE.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eccEAkEA.bat (0 bytes)
The process %original file name%.exe:172 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nSwMwYwA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hgckUIYA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uMEEUUoM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tsAMAwYo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sosIUUAw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xogEkoYc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iMIkQQoY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NWAsgAgU.bat (4 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (28 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\NWAsgAgU.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sosIUUAw.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hgckUIYA.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uMEEUUoM.bat (0 bytes)
The process %original file name%.exe:1900 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\rQkwsosA.bat (112 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BgQAowks.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\BgQAowks.bat (0 bytes)
The process %original file name%.exe:1632 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DSQEUIQg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JGIowcEs.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\JGIowcEs.bat (0 bytes)
The process %original file name%.exe:972 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KAYIgMoY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QOAssgYA.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\KAYIgMoY.bat (0 bytes)
The process %original file name%.exe:1980 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\UiMAAUYQ.bat (4 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oAMMgUoI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sEsUAAgY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\naQgkYMw.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\UiMAAUYQ.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oAMMgUoI.bat (0 bytes)
The process %original file name%.exe:1988 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JKsIYAgQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nyEYoEwA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oCQAYcwk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zGksQcYE.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\JKsIYAgQ.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nyEYoEwA.bat (0 bytes)
The process %original file name%.exe:1500 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\YqYwUwsk.bat (112 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wKQEUcYE.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\wKQEUcYE.bat (0 bytes)
The process %original file name%.exe:652 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EAQcQAwo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SWYEoEUk.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\EAQcQAwo.bat (0 bytes)
The process %original file name%.exe:1108 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WEsAkgoM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BEggEkwc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iiQAAocE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UmokQMEo.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\BEggEkwc.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UmokQMEo.bat (0 bytes)
The process %original file name%.exe:188 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\wgMwggos.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VgEQYEEw.bat (4 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BUgMYEsk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AMIAgIoA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\kaYMMAEA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pgkkcQco.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\VgEQYEEw.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BUgMYEsk.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AMIAgIoA.bat (0 bytes)
The process %original file name%.exe:1036 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ECcgEAUc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XiAUIEUk.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\ECcgEAUc.bat (0 bytes)
The process %original file name%.exe:636 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\OuIcAcQM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LcwgIkkQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vEUkAAgI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rgMYQEEw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JQEIwsQw.bat (4 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NIocckkk.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\NIocckkk.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rgMYQEEw.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JQEIwsQw.bat (0 bytes)
The process %original file name%.exe:1352 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\wMUYAEgc.bat (4 bytes)
%Documents and Settings%\All Users\JuwEIgUE\reIEcoQI.exe (3897 bytes)
%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe (3801 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZGwAYskc.bat (112 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe (3873 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\wMUYAEgc.bat (0 bytes)
The process %original file name%.exe:1860 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\bqgIEoYY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KIYYkoAs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YCYoUocQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UQMQoEcc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BoYEgkoQ.bat (112 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xsIIQgkw.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\YCYoUocQ.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KIYYkoAs.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UQMQoEcc.bat (0 bytes)
The process %original file name%.exe:228 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\wwAsEcko.bat (112 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AWEwgQQQ.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\AWEwgQQQ.bat (0 bytes)
The process %original file name%.exe:548 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BEQUsAAg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KCskQUkE.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\BEQUsAAg.bat (0 bytes)
The process %original file name%.exe:1916 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\HckgwIko.bat (4 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GMUIIsMw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NmQgkEAw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SUYsYMYM.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\HckgwIko.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NmQgkEAw.bat (0 bytes)
The process %original file name%.exe:868 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YEgcQEUU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FcEwkUAg.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\YEgcQEUU.bat (0 bytes)
The process %original file name%.exe:1028 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nscoEMEg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qukAMokE.bat (112 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nscoEMEg.bat (0 bytes)
The process %original file name%.exe:1104 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WKkswEAM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RWQYYIQc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SIowckMQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FEYEkMoQ.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\WKkswEAM.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RWQYYIQc.bat (0 bytes)
The process %original file name%.exe:1748 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\QcwwAcME.bat (4 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GuoYAAkE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mEooQwcQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TekgIYYE.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\QcwwAcME.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TekgIYYE.bat (0 bytes)
The process %original file name%.exe:1100 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VEgYgAMY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FYcgAYYY.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\VEgYgAMY.bat (0 bytes)
The process %original file name%.exe:332 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qywAwgEE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\puowQYcM.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\qywAwgEE.bat (0 bytes)
The process %original file name%.exe:408 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\JkQkMMAA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XSkokQAk.bat (112 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\JkQkMMAA.bat (0 bytes)
The process %original file name%.exe:2028 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oMEwQYAs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eysQUAQo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DEwAAgEo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FsYggMAM.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\oMEwQYAs.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DEwAAgEo.bat (0 bytes)
The process %original file name%.exe:728 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\SMswEwIU.bat (4 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xKIQgkoU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LYosYAgw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nwoEMows.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\SMswEwIU.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nwoEMows.bat (0 bytes)
The process %original file name%.exe:1164 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\PmsYcUMc.bat (112 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VKIIsAUU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ViMoIQAg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RwQMswAc.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\VKIIsAUU.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ViMoIQAg.bat (0 bytes)
The process %original file name%.exe:1160 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\iIUMYUEM.bat (4 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JuIIUEgY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MaoEUMwU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iqEoYIog.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\iIUMYUEM.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MaoEUMwU.bat (0 bytes)
The process %original file name%.exe:884 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\jOwMgwsU.bat (4 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FQMUYYYk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TaEYEkUw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LGwogcMo.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\jOwMgwsU.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LGwogcMo.bat (0 bytes)
The process %original file name%.exe:1288 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\QyAcIwUU.bat (112 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EysYsQgQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GQUIEkos.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UyEwQEok.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\UyEwQEok.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GQUIEkos.bat (0 bytes)
The process %original file name%.exe:1816 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lWAwgYsM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YsIwoUsM.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\lWAwgYsM.bat (0 bytes)
The process %original file name%.exe:1056 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\weAYoAUM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zmwAIIYI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\meMAwosM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NAswwUkU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\toUcQsEA.bat (4 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmAEcQUo.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\toUcQsEA.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zmwAIIYI.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmAEcQUo.bat (0 bytes)
The process %original file name%.exe:356 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ImggsIIQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qUoQkAgE.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\ImggsIIQ.bat (0 bytes)
The process %original file name%.exe:876 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ucUQUYwI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KaogYcoc.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\KaogYcoc.bat (0 bytes)
The process %original file name%.exe:1960 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ScgUAgEE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hEIsoEsc.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\hEIsoEsc.bat (0 bytes)
The process %original file name%.exe:1568 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wecEYAcA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UegEAsoM.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\UegEAsoM.bat (0 bytes)
The process %original file name%.exe:2036 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PwYwsogk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fwosAMII.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\PwYwsogk.bat (0 bytes)
The process %original file name%.exe:1112 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MwswEoEU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zCAUkIsg.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\MwswEoEU.bat (0 bytes)
The process %original file name%.exe:2032 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uSMYcQgM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TKgIIUAE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VsokAoIU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fyIUkcEI.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\uSMYcQgM.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VsokAoIU.bat (0 bytes)
The process %original file name%.exe:1116 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\TgwYYgUE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BSwEIUIE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QGIUYwMQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZwYgMUwE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BQAwcEYY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jQQcMwQE.bat (4 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (21 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\TgwYYgUE.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jQQcMwQE.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZwYgMUwE.bat (0 bytes)
The process %original file name%.exe:644 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VWgMIUYk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VYQgoYIA.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\VWgMIUYk.bat (0 bytes)
The process %original file name%.exe:1176 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UmwUAosY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wYEEgsMc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uAAQoYIU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rqkAsUcU.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\wYEEgsMc.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uAAQoYIU.bat (0 bytes)
The process %original file name%.exe:612 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mwYsEogc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xyYoUssg.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\xyYoUssg.bat (0 bytes)
The process %original file name%.exe:616 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\hyAYYIEg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iKsMAUsY.bat (112 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\hyAYYIEg.bat (0 bytes)
The process %original file name%.exe:1052 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QEoMEcUg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KOQMQoEk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ckswkYso.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OUgAMcUA.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\KOQMQoEk.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OUgAMcUA.bat (0 bytes)
The process %original file name%.exe:1608 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rQIUQosw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HMUwIoYc.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\rQIUQosw.bat (0 bytes)
The process %original file name%.exe:1040 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\ASQYcMoA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cWgIcIQA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XKQkgEcs.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\paUMQoUs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TwAcUgcw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ceIYowso.bat (112 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (21 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\ASQYcMoA.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\paUMQoUs.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cWgIcIQA.bat (0 bytes)
The process %original file name%.exe:948 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FeIgYoEI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QmIMUgQQ.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\FeIgYoEI.bat (0 bytes)
The process %original file name%.exe:1976 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\iYYYAQAU.bat (112 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tAIIAosU.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\tAIIAosU.bat (0 bytes)
The process %original file name%.exe:1972 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uSwEUoII.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PaoUgUww.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\uSwEUoII.bat (0 bytes)
The process %original file name%.exe:1680 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\gsIcsksE.bat (4 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KsoQwUQM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TkcYYscw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HuEQkQIM.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\gsIcsksE.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HuEQkQIM.bat (0 bytes)
The process %original file name%.exe:476 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\qcQoAogM.bat (4 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yUwUUYsI.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\qcQoAogM.bat (0 bytes)
The process %original file name%.exe:1688 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KWMIckYs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eeAYAQUE.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\KWMIckYs.bat (0 bytes)
The process %original file name%.exe:2008 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\QeQYgUQk.bat (112 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mUsIkUYI.bat (4 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\mUsIkUYI.bat (0 bytes)
The process %original file name%.exe:804 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\mCcckksQ.bat (4 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UwkssEoU.bat (112 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\mCcckksQ.bat (0 bytes)
Registry activity
The process cscript.exe:216 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "20 C6 1E AF E4 79 6D 3D 53 34 3D 5D 7B 2B 0C 73"
The process cscript.exe:1788 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7F CF A5 91 BA D5 7C 7C 10 6D D5 75 08 86 86 90"
The process cscript.exe:1140 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2D 5A 06 31 02 A1 CC F3 49 B2 41 A7 4E E1 75 97"
The process cscript.exe:1300 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F1 9D 5F FA F2 3A E2 46 D8 65 10 01 03 D7 CA 6E"
The process cscript.exe:1780 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B0 AC A2 92 7F 3F 99 E5 7C A3 F6 BC D9 27 4C 13"
The process cscript.exe:1264 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "95 3F DF 12 C5 16 D2 A3 05 01 5E 09 A5 31 5E E1"
The process cscript.exe:132 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "94 EC 1B A5 AB 00 AA B5 06 D5 B5 14 A8 18 AA B5"
The process cscript.exe:1948 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "28 DB 01 74 2C 2B 6D A0 69 5F 02 71 49 EE 0F 77"
The process cscript.exe:268 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CA 9F FF 25 8E F4 E7 F5 D6 13 3E 1A 1E 92 AC 0C"
The process cscript.exe:1836 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "90 E3 2C 42 56 15 B9 F3 CC 38 93 F8 57 99 30 88"
The process cscript.exe:1076 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9E 45 F5 05 DA DB 91 B4 03 26 5A 9B 54 9B 86 F4"
The process cscript.exe:1072 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DC 58 F2 54 9F DC 93 A8 52 05 AA 43 AA A8 95 76"
The process cscript.exe:544 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "68 2A 7F F3 0E 54 AB B3 0B 84 1E D9 46 1A 3F 1C"
The process cscript.exe:1376 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9A 0E 28 F8 60 40 9D C2 25 9A C8 3C EC C0 A3 17"
The process cscript.exe:1676 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9B 2A 40 21 1B 8B 59 A6 55 4E D4 CA 71 69 62 8C"
The process cscript.exe:1916 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6A 51 72 0B CA CE 74 A3 CF F3 23 1F 32 B4 F4 81"
The process cscript.exe:284 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "54 03 D1 06 49 99 A0 AE BA 63 F7 E3 24 F7 4D 88"
The process cscript.exe:816 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C4 A5 A0 E1 D4 90 D1 66 4C 46 79 29 DC 48 A6 A3"
The process cscript.exe:2012 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0B 12 2A 24 F0 E0 19 74 F7 BE A2 6A AB 24 89 17"
The process cscript.exe:1792 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "70 AD 2C 0C 10 DF 27 3D F9 CC 55 AB 1C 90 8E 42"
The process cscript.exe:1796 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8D 16 B4 A0 F5 37 F8 DE 2C BB 23 98 13 81 D2 0E"
The process cscript.exe:260 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EE B6 D3 6E A9 7F 80 A3 66 52 0A D9 77 3B BF 94"
The process cscript.exe:1228 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "93 7B BA 03 16 88 AB 4F 19 14 67 D7 29 46 FA DE"
The process cscript.exe:1016 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "84 7C 4B A6 53 93 CD CB 77 7D D1 21 EA 55 0B 00"
The process cscript.exe:1704 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6F 8A 64 2A 7C 15 BA 4F 70 9F 6C 35 FB 2C DD 8B"
The process cscript.exe:1824 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D6 01 4B 6D A7 2D 09 CE F3 37 48 07 E2 8A F0 3C"
The process cscript.exe:1064 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "24 34 41 66 7D 24 9F B3 A6 43 2C 57 D5 5F B1 7A"
The process cscript.exe:928 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E3 DD 9C 83 72 63 A3 27 7C 1E 15 29 72 4F 6D 29"
The process cscript.exe:1388 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "84 45 E6 FC E9 71 88 8F CF 16 43 8C 0D EB 89 33"
The process cscript.exe:296 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EF 84 15 57 EB 3C 8A 68 D2 13 95 9F A0 98 B7 29"
The process cscript.exe:1920 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AA F2 76 05 AD 53 6F 83 B2 B6 F2 91 B9 1A 2D CD"
The process cscript.exe:1480 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E3 43 F2 02 6E A0 31 A5 C6 F0 F5 F8 5A 2B 38 96"
The process cscript.exe:1484 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7B C3 12 19 D1 81 EF E3 CD 99 CA D9 96 F3 CA 7D"
The process cscript.exe:1716 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BB E1 01 42 4D A6 CF AE BC 89 C6 DA FB B2 5A 6B"
The process cscript.exe:364 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C8 A6 32 1D 95 8E A4 D9 5A 6F FA 0F 9B 33 63 AF"
The process cscript.exe:916 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "17 B2 52 2C A6 8E 6A 42 29 FA C0 79 8F 46 41 B2"
The process cscript.exe:1100 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "19 5D BF 97 68 68 7C DB A2 28 48 38 45 DD DD CB"
The process cscript.exe:1336 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "01 D9 29 FD EE 54 FA AC 8A 66 9C CF A8 42 58 38"
The process cscript.exe:1932 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AF AF B7 A1 A8 80 D7 E1 9D CC 4C 42 F9 2C F5 FD"
The process cscript.exe:1936 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "73 8C 7B 3B 8C 41 04 E3 86 9E 3A 31 94 BE 41 B4"
The process cscript.exe:900 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2D 9F D6 9D 63 C7 A5 8B 78 AE 0A D0 E9 D6 0E C3"
The process cscript.exe:1432 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "72 59 2C 9E 57 ED 57 8C CB B2 48 78 A4 42 77 1A"
The process cscript.exe:852 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "75 68 93 E4 CE 1F B1 60 FF AF 78 50 CE 69 46 29"
The process cscript.exe:2040 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EE 82 E9 F8 69 B9 08 6B 85 5C 0A FB 96 47 81 1F"
The process cscript.exe:244 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A3 8F 0E 72 FE 7B 8A E0 D9 10 7A 2F 9A 7A 0C 99"
The process cscript.exe:1840 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "23 BB F8 48 93 EE 71 4E 09 84 2C 7A 96 85 DF C3"
The process cscript.exe:1648 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0F D7 04 A0 85 E9 EC 30 29 0B 5A 7B 1B 31 36 F9"
The process cscript.exe:1240 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4E FE 6D BB B9 3B 93 8F 65 41 C1 0E 8E 68 66 BB"
The process cscript.exe:1532 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EB C5 44 A3 AD 0D 4F 19 46 31 89 ED 61 0A DA 98"
The process cscript.exe:436 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9F 99 DF A6 96 7E B7 6A 2A 6B 9B C0 42 A5 B0 47"
The process cscript.exe:516 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0D DB 9A 44 A2 C7 E3 BB A7 AE 39 AC 99 73 E6 00"
The process cscript.exe:1224 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C6 25 0F FB 50 54 44 0A B6 0D 9F 26 F3 CB F2 3F"
The process cscript.exe:624 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "91 56 AA 30 76 C4 09 74 20 4A 83 15 EE D9 11 DA"
The process cscript.exe:332 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E3 E2 A5 50 EC 8F 6C 23 4B E6 BA 19 69 DC 8C C7"
The process cscript.exe:256 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "11 AC 6C FE CE A3 B6 AC A6 CC B2 C6 7E 5C 5F 3F"
The process cscript.exe:1900 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BA 2A 08 A0 44 3A F8 A1 C8 D5 ED EB 63 DD B4 49"
The process cscript.exe:1632 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1B 4D F2 DA 72 E4 D2 CD 1C 45 5A 2B E6 B8 18 31"
The process cscript.exe:1980 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FD A7 92 2E 73 D7 A3 E2 D4 F2 65 E6 15 74 14 C1"
The process cscript.exe:1988 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4B B7 97 A7 16 AD 0F C1 64 9A A1 FB 95 44 F0 C2"
The process cscript.exe:652 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "52 6F 01 EC D1 66 09 C3 E5 DC 0B BD 18 47 94 E3"
The process cscript.exe:188 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "52 BC DB C8 A3 22 BE 56 F4 14 B2 41 58 03 29 C6"
The process cscript.exe:1036 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "94 60 17 70 0E 15 76 B7 6A 26 BD 98 81 89 A9 64"
The process cscript.exe:636 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "87 10 F8 CF 44 F1 EB DD E2 BE 48 80 E4 CA 8B 20"
The process cscript.exe:464 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2E 60 A6 1F A1 42 7B BA C0 A2 9A 0F F6 5D 8C 68"
The process cscript.exe:1860 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BC 68 97 75 FA DB 71 08 53 5B 7D E2 ED 43 56 62"
The process cscript.exe:1596 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4A CC BF 06 78 FB 57 50 85 E5 94 DD 63 85 5F A3"
The process cscript.exe:228 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3A 7E 63 74 89 29 7D 26 D3 57 2C DA 52 91 D6 F6"
The process cscript.exe:224 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7A D0 AF 1D DF 83 21 35 59 A7 15 80 DF 7C A8 4C"
The process cscript.exe:548 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "82 9D 4A 0D F9 52 84 E0 68 AF 3F 4B 75 47 27 E0"
The process cscript.exe:220 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "07 9F 5C 5C 8E 19 65 2D 84 6E B8 96 3E 21 BF FC"
The process cscript.exe:1992 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F3 8B 52 84 7D EB 11 C1 76 EA FA FD 98 8A AF E3"
The process cscript.exe:1028 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D2 82 A2 AE 7D 1F C8 47 CC 9E 3D 15 70 54 15 80"
The process cscript.exe:1748 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "92 DC 42 F5 CB 06 48 54 5E 19 4C 85 F0 C1 E5 08"
The process cscript.exe:1452 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E8 ED 42 11 5C AD C0 34 F5 2F 25 48 DD 9B A1 39"
The process cscript.exe:2028 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D3 77 5B 00 BF 82 27 CD CB B8 3E AE A5 F1 E0 96"
The process cscript.exe:728 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "96 9A 1A 69 59 90 83 08 16 3A 69 51 E2 83 55 D1"
The process cscript.exe:1512 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "05 6E 36 33 E9 E8 0D CC 74 58 F9 FF AB F2 53 CD"
The process cscript.exe:1160 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FA AB 42 83 43 54 3E 78 19 88 3C 1B D9 BD 05 CD"
The process cscript.exe:156 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "60 B8 2C 0F AE 0D A0 79 B1 4D 1C BA CB 42 80 80"
The process cscript.exe:1288 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9D C1 36 47 D2 B5 FE 55 01 0C 47 21 06 D4 9F A1"
The process cscript.exe:232 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CC 4B 5F 3E F3 8A FB 9A E1 8C 4D CC 51 61 A3 99"
The process cscript.exe:1052 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0D 17 81 1C 57 FE 0E 30 ED 79 EA 94 4A 0B FF EE"
The process cscript.exe:876 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "78 09 A9 21 D8 3F D4 C8 A6 14 9B 6E CF 30 6F 55"
The process cscript.exe:2036 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "84 01 38 B2 73 2E E9 A5 38 96 74 17 A4 98 78 F5"
The process cscript.exe:1112 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "20 F8 2E A5 34 17 1B 0E 09 7C 0C B0 7E ED 84 0F"
The process cscript.exe:2032 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5F 67 EC 9D 6D 7F 5C C6 22 24 7B 85 68 D5 14 CF"
The process cscript.exe:644 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "96 B5 E4 C8 79 A8 89 01 5B ED 1B E8 D8 89 8E A9"
The process cscript.exe:776 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "23 3D 1F DC D1 81 3B 35 E0 12 3B 91 0D 64 82 10"
The process cscript.exe:612 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9D 62 77 9C F6 C6 DF 73 D3 8B CC E7 58 93 26 B1"
The process cscript.exe:616 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5F B4 27 F6 98 22 22 E8 1B 96 7D A2 72 9E 0C 0A"
The process cscript.exe:1816 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DB A4 41 56 01 C8 EA E9 69 88 88 3E C4 49 54 99"
The process cscript.exe:1276 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "41 83 8B 8A A9 67 6F 8B 2A 27 19 07 02 21 03 09"
The process cscript.exe:1608 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "57 DF B5 95 28 FB DE A8 50 EC 01 7F 00 48 58 C3"
The process cscript.exe:1040 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F1 B8 5C 3B 02 C9 C4 69 D7 BF 84 B2 FD BE 2C 54"
The process cscript.exe:948 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "66 49 68 21 42 21 C0 11 2C 0A E3 D5 49 A8 AA 2C"
The process cscript.exe:1972 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2F 95 E2 B8 4B 9C 09 A4 D9 11 E2 35 49 16 C1 8A"
The process cscript.exe:1680 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "46 9A ED 13 D2 CA F0 44 40 18 F3 3A 08 AA CE 06"
The process cscript.exe:2000 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A5 2D 22 3E AF 14 88 2E 06 0D C8 32 73 C0 B8 6A"
The process cscript.exe:476 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "06 0D 2A 6C A2 D6 DE 54 4A 58 31 5E E1 72 A8 F0"
The process cscript.exe:1688 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DE B1 00 6E D7 ED D0 EB 8A E3 78 38 58 84 9F 53"
The process cscript.exe:1368 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CB 89 D5 56 46 41 96 86 6D 2B ED B1 FB 42 58 E2"
The process cscript.exe:804 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1A 58 45 AF E2 4B 28 CC A6 21 AA 13 D7 1E F0 44"
The process fGAwoYMM.exe:1208 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FF 50 3C DD C7 F7 C9 AA 3E 43 5C 84 CD A5 50 47"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
To automatically run itself each time Windows is booted, the Malware adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"fGAwoYMM.exe" = "%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe"
The process %original file name%.exe:216 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "17 E4 9F 93 3D 0D 0B 73 2D 4A AF E3 B7 AB BD 48"
The process %original file name%.exe:1140 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2E 22 89 36 44 71 52 9E 31 2C 87 50 91 30 1F 4D"
The process %original file name%.exe:212 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4C 50 81 82 46 81 3E F1 CD B8 6A 06 E3 0A 1C 13"
The process %original file name%.exe:1264 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "54 83 C0 D3 21 48 22 5C 18 75 79 A9 CB 87 95 81"
The process %original file name%.exe:132 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4D 18 CA EE 7B C6 03 90 DC 11 22 6C 9A 87 2C 7C"
The process %original file name%.exe:1948 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C2 F8 DD 38 CD 25 E0 B9 F9 EC 00 9F 87 8F 19 31"
The process %original file name%.exe:1076 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EE 99 94 11 67 21 3B A4 29 07 12 37 96 DB 40 B8"
The process %original file name%.exe:344 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "43 95 AF 8D EE 42 75 D0 56 3B D6 58 40 24 1A 81"
The process %original file name%.exe:544 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A8 0E F4 C0 B6 A6 6B E8 39 C0 C5 A1 44 C6 69 AC"
The process %original file name%.exe:1376 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "73 C5 34 C0 82 AA 28 B3 3A 40 06 F8 40 CF 66 BF"
The process %original file name%.exe:280 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CE 14 0F 30 D6 E8 E4 71 9E F2 C5 FD 13 58 BA B1"
The process %original file name%.exe:1676 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "72 FE 22 BB C0 6C 70 EE D3 41 76 77 F5 DE BE 7A"
The process %original file name%.exe:220 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4C 5C 5E 35 41 16 83 EF 9C 33 08 61 FC 09 E1 DE"
The process %original file name%.exe:816 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "02 A9 1E 61 85 1A BE 77 AD 10 F4 37 C7 23 7A 0B"
The process %original file name%.exe:2012 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2D D7 BA D7 C3 92 E8 1F AE 2A E9 00 E7 11 CB 97"
The process %original file name%.exe:716 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "29 DE 5D 3C 24 E4 63 93 34 67 D2 7A C7 08 E6 90"
The process %original file name%.exe:1796 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "32 EC 88 54 37 A1 70 8A CC 18 14 1C F9 9C DE 7E"
The process %original file name%.exe:260 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BF 11 BF FF 81 DA A4 A9 EB 2F 68 3F 3E CC 1C 7F"
The process %original file name%.exe:268 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "78 75 9F 43 71 6E F6 54 32 AE BA 09 2E 0E DB 92"
The process %original file name%.exe:364 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A0 12 0F 50 B0 5F 74 34 FE 76 EC EC 5B 91 DD A1"
The process %original file name%.exe:520 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F0 E5 AC 35 9B 05 85 03 DF 10 2B 42 D4 8C F4 85"
The process %original file name%.exe:1824 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4D 13 45 AA DA 6F E4 89 92 14 20 41 E3 57 D9 31"
The process %original file name%.exe:1064 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A9 85 00 9F 29 31 B7 BE 18 2A 19 F9 3B B8 05 EC"
The process %original file name%.exe:464 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6A 01 74 7E AF 91 D1 BD B2 09 F6 FB C7 BE 18 19"
The process %original file name%.exe:928 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5D 5D F6 0A A6 9E 7A 1D DB 7F EB F1 11 43 CF 80"
The process %original file name%.exe:1388 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "59 56 2F 47 F1 44 6A 24 5D 37 EA CD CB A2 A4 EA"
The process %original file name%.exe:828 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B1 57 59 A1 9B 41 2C 59 7C 47 76 E0 C6 34 4D E8"
The process %original file name%.exe:296 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D9 6E 35 76 38 B2 F3 6F 09 BF 95 F9 74 57 44 E3"
The process %original file name%.exe:1920 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E6 18 15 35 71 09 48 F4 75 A0 B8 38 08 94 52 E5"
The process %original file name%.exe:1480 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "00 E1 69 BF D8 42 01 70 CD C9 D3 CA 22 51 7B C0"
The process %original file name%.exe:1484 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C7 A8 5A E5 0E 36 AE FF 12 39 18 5C 39 21 CE B7"
The process %original file name%.exe:1716 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "12 15 99 C3 61 99 95 A3 62 03 F2 C6 18 B1 3E EF"
The process %original file name%.exe:1524 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6F 8A 26 CC 92 3D 56 B5 77 87 D5 4A B7 1A 3E E1"
The process %original file name%.exe:1252 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A4 6F 69 09 32 8A 99 70 98 13 85 A7 5C D9 EA 63"
The process %original file name%.exe:1016 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "73 60 8B 3E 94 FB 52 7E AC 22 A3 07 1C BC 87 88"
The process %original file name%.exe:1236 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4F 2F 40 36 F5 B1 99 7B D3 FD 4E DA F6 20 7D 9B"
The process %original file name%.exe:1452 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3A 27 B7 CD 11 CD 4D 7D 27 96 3F 05 81 CE F4 14"
The process %original file name%.exe:1336 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B5 2A B8 2F 67 9C 3A E7 5B 6F FE E7 F5 B7 15 01"
The process %original file name%.exe:380 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7A EA 91 73 78 54 4C 73 9C 9F 09 6C 8F 31 05 F2"
The process %original file name%.exe:244 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C7 E3 98 EC 94 96 8F 98 76 CD AE 11 C0 8B A4 0F"
The process %original file name%.exe:1964 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "62 14 1E D4 52 D1 43 C1 A5 27 93 D6 6F 3E D6 7A"
The process %original file name%.exe:1936 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D4 B0 97 FB 3B AA 77 57 96 55 47 48 51 4F EE 8D"
The process %original file name%.exe:900 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "ED A3 D2 CA 48 C8 B4 35 5F 34 69 5D 8B 06 FA B6"
The process %original file name%.exe:844 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E6 F6 B1 0E 2E EC DC 43 47 46 DB 04 A0 9C 08 53"
The process %original file name%.exe:1432 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D5 87 B4 2B 22 18 D1 39 61 F4 A2 B0 11 4A 0E 20"
The process %original file name%.exe:852 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DB C8 A0 CE 69 48 F9 97 BF F8 C3 6E A4 D0 B0 BB"
The process %original file name%.exe:2040 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3E 31 EB 7B 23 21 0B E6 51 BE DF FF 0B 2E C5 F1"
The process %original file name%.exe:1932 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6D F5 B4 C0 5B 33 38 EE EE 44 92 90 0D 41 17 4E"
The process %original file name%.exe:1840 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E1 F2 02 AD BA B8 C9 D2 51 9C BF 07 3D 8A 10 4B"
The process %original file name%.exe:1648 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "63 32 5E 49 2E F1 BC E7 CB 31 61 D8 55 B6 E8 0B"
The process %original file name%.exe:1240 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8D 85 08 21 88 98 4B 7E F3 99 BC 1A 15 59 E4 8C"
The process %original file name%.exe:1532 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "73 6D 3D 32 FB 0B 64 86 BF BF 49 43 74 8C 45 45"
The process %original file name%.exe:436 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AB 9A 88 4B 88 83 26 19 29 00 1F 4B 4D 25 39 D4"
The process %original file name%.exe:516 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F4 D9 06 A2 20 A4 DF 6F 9E 62 7B 72 CD 8F E0 76"
The process %original file name%.exe:1224 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FE 94 36 42 70 C2 D2 32 46 34 29 80 FE 20 B7 23"
The process %original file name%.exe:624 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "65 0E 08 B1 E4 EA 62 50 BA B9 29 A8 8D 73 D5 F3"
The process %original file name%.exe:1228 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "70 04 C7 B3 4A C6 B7 E9 34 3A 3A A4 7A 30 5B C2"
The process %original file name%.exe:240 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DB B4 C4 F1 33 ED 62 83 AC 74 17 17 63 C2 1F 5E"
The process %original file name%.exe:1908 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3A 1D EC 80 75 62 BF 2A F0 47 69 13 A8 79 E5 E4"
The process %original file name%.exe:252 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "66 36 18 3F 52 D9 9A BD 3D 20 7E 93 A7 7E 32 67"
The process %original file name%.exe:172 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0B BA 5F 61 E6 D4 A0 6A 6C B4 50 44 20 DE 8C D1"
The process %original file name%.exe:1900 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "91 90 B1 C0 17 AD 84 60 3B B9 C7 39 F9 B6 CA 79"
The process %original file name%.exe:1632 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B6 ED C9 9D C2 46 92 EC C4 11 5D 65 13 DC 06 D2"
The process %original file name%.exe:972 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "59 F9 A6 9F F0 FC 47 8D 51 6F 99 9E 5D 17 87 D5"
The process %original file name%.exe:1980 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "22 88 DA AC CA C8 D2 7D 87 6B C2 DE 06 1A A2 E6"
The process %original file name%.exe:1988 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "47 D1 C1 34 7E 64 A6 43 DE AF 16 D2 A2 1A 26 21"
The process %original file name%.exe:1500 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "32 39 E5 76 C5 F5 5A 49 E6 EF 98 B5 8E 59 ED EF"
The process %original file name%.exe:652 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "93 28 D2 D2 6B B9 23 34 D3 27 E2 99 7B 74 5F 38"
The process %original file name%.exe:1108 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "78 7E 2D EF 5E 67 BE 18 B5 62 75 7D 28 36 BF 4F"
The process %original file name%.exe:188 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BD D3 52 D5 4F 11 80 8C 05 B2 5E 70 F0 3B 25 E6"
The process %original file name%.exe:1036 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0E 08 48 E7 CF DC 40 4C B5 E3 C5 C2 7A 46 15 EA"
The process %original file name%.exe:636 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B3 8A A6 19 06 9C 0E 82 9C E0 D1 09 73 D9 05 6C"
The process %original file name%.exe:1352 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E9 24 E2 01 8D 5F B5 04 FE FF 64 4C 3D 58 94 A7"
To automatically run itself each time Windows is booted, the Malware adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"fGAwoYMM.exe" = "%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NesIMIQs.exe" = "%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe"
The process %original file name%.exe:1860 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "43 BB FE A9 3A E5 17 7A B8 D4 9C D5 2F 50 23 25"
The process %original file name%.exe:228 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C0 0B D3 D7 D0 44 03 CA 2B B7 94 A2 91 A2 1B 6C"
The process %original file name%.exe:548 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "78 99 0D 28 59 C9 30 61 F7 5E 06 7C CA 8F AF 6B"
The process %original file name%.exe:1916 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E2 A6 D7 59 56 DF FF BF BC 0E 1F DB 40 61 E3 0E"
The process %original file name%.exe:868 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BF 5D FB 7D 44 69 F0 37 56 63 6A E6 A3 DD 1D 9D"
The process %original file name%.exe:1028 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4E 23 40 8E 37 C1 FB B9 68 2C 3D 99 05 5A C6 33"
The process %original file name%.exe:1104 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "77 33 B8 CC 72 2C 81 60 58 E7 FF 8A 4E 8F AC 4D"
The process %original file name%.exe:1748 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8A 93 3C 18 CA E9 3B 3A BB 1E A1 4B F2 A4 59 4C"
The process %original file name%.exe:1100 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C5 F9 71 DE A5 CA 9C 60 1A D0 A5 2B 59 E1 F9 56"
The process %original file name%.exe:332 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E6 6C E7 9D F2 D2 C3 C9 16 15 5A A5 3C A8 65 DF"
The process %original file name%.exe:408 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "33 FC 2A CF D3 B6 B9 B0 7A 40 DF 14 60 2B 1B 28"
The process %original file name%.exe:2028 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9D 14 54 D1 27 80 D2 98 E9 40 57 95 4E 01 EC 85"
The process %original file name%.exe:728 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9F 85 2F A3 9A 96 95 E5 48 19 F5 F7 99 49 15 96"
The process %original file name%.exe:1164 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3D 04 56 83 8E EE B9 2C 53 17 BB 7D 75 10 4C 61"
The process %original file name%.exe:1160 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "46 76 91 08 E1 3F FD 1F F6 8C 15 F5 4F 49 70 45"
The process %original file name%.exe:884 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B3 21 96 F7 E6 F0 98 B7 8E 03 A5 53 89 76 83 A5"
The process %original file name%.exe:1288 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E6 A2 10 38 87 B7 16 7C 0D 48 3B 4E F5 3C 57 75"
The process %original file name%.exe:1816 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "32 E9 92 1E 99 DA 7B 44 51 7D FF BB 2A 30 85 BB"
The process %original file name%.exe:1056 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "91 D6 43 E8 D2 A3 AD 42 56 DB 85 6B 98 B1 52 F9"
The process %original file name%.exe:356 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6E BB 4F 8B F7 CC AD 25 46 7B 15 EA 3E EB 84 09"
The process %original file name%.exe:876 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "27 84 C2 80 DB BC B9 C8 CA 35 9D 65 7E 31 EB 1C"
The process %original file name%.exe:1960 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9E 02 2E EA 9F EE DF 9E 16 C5 15 F1 CE 9F BD 58"
The process %original file name%.exe:1568 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E9 69 42 50 AC 47 1E A1 3D 4B 45 8C 8C 95 7D DB"
The process %original file name%.exe:2036 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "69 14 16 D1 14 AA EB CA 36 7B C6 59 30 3B 76 85"
The process %original file name%.exe:1112 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B0 EB D4 F4 11 37 30 27 19 FF 66 ED C3 EF D0 DF"
The process %original file name%.exe:2032 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C0 4D 95 14 66 CC 24 FE 52 42 1D D0 6E E1 BF E7"
The process %original file name%.exe:1116 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "04 FC 18 8E B8 F2 5F 92 6B 28 34 C4 03 06 75 75"
The process %original file name%.exe:644 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B5 4E C8 4D 09 2F 98 7E 00 7A 59 E8 A9 C9 8A 09"
The process %original file name%.exe:1176 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "38 56 9C 61 7A DF 1D D1 70 29 2A 93 16 2C 5C 31"
The process %original file name%.exe:612 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "36 9E 2B 74 0C 99 13 71 72 30 D4 F4 45 FF C2 47"
The process %original file name%.exe:616 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7C 9D F6 D1 B7 91 77 29 90 34 1A C3 6A D7 CD DB"
The process %original file name%.exe:1052 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BD 15 7C 72 F8 BD FC 20 02 74 CC 8A 11 92 86 87"
The process %original file name%.exe:1608 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "30 A0 24 9C F8 D3 AC 75 E6 6C 92 46 BF A1 E9 C9"
The process %original file name%.exe:1040 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "97 42 CF 9D FB 12 2C E9 F7 4C DE 3C EA CB 74 E2"
The process %original file name%.exe:948 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "89 3F D5 1D 5E 1E AD B6 25 22 84 7A D7 E9 85 97"
The process %original file name%.exe:1976 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1C D9 51 F4 5F 56 AA 69 5C 6B 78 6F 6F E3 3A 69"
The process %original file name%.exe:1972 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FD C6 D2 54 E3 FD 16 A1 46 28 EA 22 01 BA 42 0A"
The process %original file name%.exe:1680 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "65 20 46 3B 0D 17 88 55 B1 4F A4 BB A6 CD 47 BC"
The process %original file name%.exe:476 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B6 CA 41 07 39 55 48 06 C1 12 C2 B5 C1 6D 5A 4E"
The process %original file name%.exe:1688 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5D 98 F5 8D 2A B3 AF 01 AE F0 11 AA 92 9A 3F F5"
The process %original file name%.exe:2008 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DF 52 D4 A2 1D 79 EE 3B DF D4 FD 6B 33 6A E3 CB"
The process %original file name%.exe:804 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A9 1B 69 31 16 93 76 FF 9E 9B 26 73 14 F7 AD C8"
The process reIEcoQI.exe:320 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "63 D0 6B 0A 84 7A C4 E0 F9 1B 31 2E 19 0F 53 31"
To automatically run itself each time Windows is booted, the Malware adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NesIMIQs.exe" = "%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe"
The process NesIMIQs.exe:984 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6A CC 74 22 8A 53 49 E2 C1 D7 CA 3E A7 E7 3E 1B"
To automatically run itself each time Windows is booted, the Malware adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NesIMIQs.exe" = "%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe"
Dropped PE files
| MD5 | File path |
|---|---|
| 93f3e330f04c1a784cb84334a9e520e7 | c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe |
| c12784dc7b9fa09c13905d08139a5f9d | c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe |
| bfebdce838f8fe63090f458103162710 | c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe |
| 7caae5c4a833adff36ef0e751e6bfde7 | c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe |
| eb5b45f8638cb4d0c2d7bdff409ce8bb | c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe |
| 1297e7f2fe80ccbd7e8bf1ec4d9b5c9e | c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe |
| 4fa6276bdf8a9819cd831ec5bbfc7129 | c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe |
| 60b3326b4c884968c13416a780a4b56b | c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe |
| 1ef18fd63b3201199799e6527b6aaa1d | c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe |
| 2bfd22d420ce8b1cf58659b82b84b8e7 | c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe |
| 9b0178dfbb40eb329b3968c509fcdd54 | c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe |
| c184477bfa32a286420d8f71a53ef81a | c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe |
| 9352770faa431827e37886e8057314e0 | c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe |
| 72ff8e9a3a78bacb90b502ab6bd91d14 | c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe |
| 010eac7129c91a5d875596507e25743b | c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe |
| a8e4e49d2e90a07b52c059b98dde5cce | c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe |
| 100d6f344cbcb327b83dcc621d1b53f6 | c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe |
| 8f9b9a9937f8be833db890285994ea60 | c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe |
| 43d6eef13e8e0eb035a29776acc3b298 | c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe |
| c00329ad13a86bdd0372bbf701e1f33b | c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe |
| 7dd7edecc0da4bc3765416c8094b7d62 | c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe |
| 928c9d90203f5ca8885c48e37614d1a8 | c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe |
| 0fd23ab301c460a44477a785c0ec3472 | c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe |
| 8efcee3d657ae18443afa65412c47b56 | c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe |
| 7ff5843a815322c30b80d27c7ec793e2 | c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe |
| bcecc370e2fd30dac0141a0257ee6c20 | c:\Documents and Settings\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe |
| d911d236d55b6f8e38b9ba144dade6e1 | c:\Documents and Settings\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe |
| 86aa03dd91b6516709e9d43ec2b7da66 | c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe |
| 5ef01e6937ae618bdfd8d71ec2aab6c1 | c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe |
| 8a097716a6d4799ef351b4836ae71880 | c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe |
| 74c21540f09d5e90109e35c62de72e56 | c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe |
| 682a31cab45bc673ca8ece423140c4f9 | c:\Documents and Settings\All Users\JuwEIgUE\reIEcoQI.exe |
| 43ce80d369c70e4a65b3bd40130f14f1 | c:\Documents and Settings\All Users\hcYYccwo\NesIMIQs.exe |
| 762bf9f0321c7eebd3f06e989bba8f23 | c:\Documents and Settings\"%CurrentUserName%"\dUskcAww\fGAwoYMM.exe |
| 514cc0639b4b248d914dddd344b41379 | c:\Perl\eg\IEExamples\ie_animated.gif.exe |
| 50b2a840c71c94d26879a04d7940e4eb | c:\Perl\eg\IEExamples\psbwlogo.gif.exe |
| 361a5fb54f8408aca2c81c1c2c31f3f0 | c:\Perl\eg\aspSamples\ASbanner.gif.exe |
| 1c1d925df7216b7d6632eff06d29adeb | c:\Perl\eg\aspSamples\Main_Banner.gif.exe |
| b89c0775d9b8fe9309b9d26ec4c4ed7f | c:\Perl\eg\aspSamples\psbwlogo.gif.exe |
| af74cd2ac101ef84ac3b48e7b5f91b5c | c:\Perl\html\images\AS_logo.gif.exe |
| 77061f849818fbd947ffa4241d6b3732 | c:\Perl\html\images\PerlCritic_run.png.exe |
| df03f6f74eccf1d84466f0958610dcd0 | c:\Perl\html\images\aslogo.gif.exe |
| ba7314cafaba242fafcbf128e9691466 | c:\Perl\html\images\ppm_gui.png.exe |
| b38423b967ee1e4048d284bfab05fe20 | c:\Perl\lib\ActivePerl\PPM\images\gecko.png.exe |
| 5219d72c800d551aa3c5ee33476a13cd | c:\Perl\lib\ActivePerl\PPM\images\perl_48x48.png.exe |
| b97bc079d5deaf38f480209caef5c6be | c:\Perl\lib\Devel\NYTProf\js\asc.png.exe |
| ba43daa6fc13388a8e77cb43fa441cd3 | c:\Perl\lib\Devel\NYTProf\js\bg.png.exe |
| e743996941298febc26814580462f66f | c:\Perl\lib\Devel\NYTProf\js\desc.png.exe |
| 483f686263f0f2d1431cdc784d9c5940 | c:\Perl\lib\Devel\NYTProf\js\jit\gradient.png.exe |
| 254e4f8e1f830e0fd79c13e8c706e3b7 | c:\Perl\lib\Devel\NYTProf\js\jit\gradient20.png.exe |
| ef8ab2069bbe844a976ce6a9d9bf2b2b | c:\Perl\lib\Devel\NYTProf\js\jit\gradient30.png.exe |
| 8a6335aca197cff6d61a4eb96556d166 | c:\Perl\lib\Devel\NYTProf\js\jit\gradient40.png.exe |
| b478d0ed5ff7bdd0f57038b4c0b05759 | c:\Perl\lib\Devel\NYTProf\js\jit\gradient50.png.exe |
| 1a91ed93358d24ee3f00d6729045d13d | c:\Perl\lib\Mozilla\CA\cacert.pem.exe |
| 73b3f295a8b7082cdc5baa594462408e | c:\totalcmd\TCMADMIN.EXE.exe |
| f32044f188a918e308ac63ab9c8632eb | c:\totalcmd\TCMDX32.EXE.exe |
| 6fdf7a9792ecbbc0b75f0a6db8f49a83 | c:\totalcmd\TCUNINST.EXE.exe |
| fc6caa1e98585f0f2be89b6e392f17ff | c:\totalcmd\TOTALCMD.EXE.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
cscript.exe:216
cscript.exe:1788
cscript.exe:1140
cscript.exe:1300
cscript.exe:1780
cscript.exe:1264
cscript.exe:132
cscript.exe:1948
cscript.exe:268
cscript.exe:1836
cscript.exe:1076
cscript.exe:1072
cscript.exe:544
cscript.exe:1376
cscript.exe:1676
cscript.exe:1916
cscript.exe:284
cscript.exe:816
cscript.exe:2012
cscript.exe:1792
cscript.exe:1796
cscript.exe:260
cscript.exe:1228
cscript.exe:1016
cscript.exe:1704
cscript.exe:1824
cscript.exe:1064
cscript.exe:928
cscript.exe:1388
cscript.exe:296
cscript.exe:1920
cscript.exe:1480
cscript.exe:1484
cscript.exe:1716
cscript.exe:364
cscript.exe:916
cscript.exe:1100
cscript.exe:1336
cscript.exe:1932
cscript.exe:1936
cscript.exe:900
cscript.exe:1432
cscript.exe:852
cscript.exe:2040
cscript.exe:244
cscript.exe:1840
cscript.exe:1648
cscript.exe:1240
cscript.exe:1532
cscript.exe:436
cscript.exe:516
cscript.exe:1224
cscript.exe:624
cscript.exe:332
cscript.exe:256
cscript.exe:1900
cscript.exe:1632
cscript.exe:1980
cscript.exe:1988
cscript.exe:652
cscript.exe:188
cscript.exe:1036
cscript.exe:636
cscript.exe:464
cscript.exe:1860
cscript.exe:1596
cscript.exe:228
cscript.exe:224
cscript.exe:548
cscript.exe:220
cscript.exe:1992
cscript.exe:1028
cscript.exe:1748
cscript.exe:1452
cscript.exe:2028
cscript.exe:728
cscript.exe:1512
cscript.exe:1160
cscript.exe:156
cscript.exe:1288
cscript.exe:232
cscript.exe:1052
cscript.exe:876
cscript.exe:2036
cscript.exe:1112
cscript.exe:2032
cscript.exe:644
cscript.exe:776
cscript.exe:612
cscript.exe:616
cscript.exe:1816
cscript.exe:1276
cscript.exe:1608
cscript.exe:1040
cscript.exe:948
cscript.exe:1972
cscript.exe:1680
cscript.exe:2000
cscript.exe:476
cscript.exe:1688
cscript.exe:1368
cscript.exe:804
%original file name%.exe:216
%original file name%.exe:1140
%original file name%.exe:212
%original file name%.exe:1264
%original file name%.exe:132
%original file name%.exe:1948
%original file name%.exe:1076
%original file name%.exe:344
%original file name%.exe:544
%original file name%.exe:1376
%original file name%.exe:280
%original file name%.exe:1676
%original file name%.exe:220
%original file name%.exe:816
%original file name%.exe:2012
%original file name%.exe:716
%original file name%.exe:1796
%original file name%.exe:260
%original file name%.exe:268
%original file name%.exe:364
%original file name%.exe:520
%original file name%.exe:1824
%original file name%.exe:1064
%original file name%.exe:464
%original file name%.exe:928
%original file name%.exe:1388
%original file name%.exe:828
%original file name%.exe:296
%original file name%.exe:1920
%original file name%.exe:1480
%original file name%.exe:1484
%original file name%.exe:1716
%original file name%.exe:1524
%original file name%.exe:1252
%original file name%.exe:1016
%original file name%.exe:1236
%original file name%.exe:1452
%original file name%.exe:1336
%original file name%.exe:380
%original file name%.exe:244
%original file name%.exe:1964
%original file name%.exe:1936
%original file name%.exe:900
%original file name%.exe:844
%original file name%.exe:1432
%original file name%.exe:852
%original file name%.exe:2040
%original file name%.exe:1932
%original file name%.exe:1840
%original file name%.exe:1648
%original file name%.exe:1240
%original file name%.exe:1532
%original file name%.exe:436
%original file name%.exe:516
%original file name%.exe:1224
%original file name%.exe:624
%original file name%.exe:1228
%original file name%.exe:240
%original file name%.exe:1908
%original file name%.exe:252
%original file name%.exe:172
%original file name%.exe:1900
%original file name%.exe:1632
%original file name%.exe:972
%original file name%.exe:1980
%original file name%.exe:1988
%original file name%.exe:1500
%original file name%.exe:652
%original file name%.exe:1108
%original file name%.exe:188
%original file name%.exe:1036
%original file name%.exe:636
%original file name%.exe:1352
%original file name%.exe:1860
%original file name%.exe:228
%original file name%.exe:548
%original file name%.exe:1916
%original file name%.exe:868
%original file name%.exe:1028
%original file name%.exe:1104
%original file name%.exe:1748
%original file name%.exe:1100
%original file name%.exe:332
%original file name%.exe:408
%original file name%.exe:2028
%original file name%.exe:728
%original file name%.exe:1164
%original file name%.exe:1160
%original file name%.exe:884
%original file name%.exe:1288
%original file name%.exe:1816
%original file name%.exe:1056
%original file name%.exe:356
%original file name%.exe:876
%original file name%.exe:1960
%original file name%.exe:1568
%original file name%.exe:2036
%original file name%.exe:1112
%original file name%.exe:2032
%original file name%.exe:1116
%original file name%.exe:644
%original file name%.exe:1176
%original file name%.exe:612
%original file name%.exe:616
%original file name%.exe:1052
%original file name%.exe:1608
%original file name%.exe:1040
%original file name%.exe:948
%original file name%.exe:1976
%original file name%.exe:1972
%original file name%.exe:1680
%original file name%.exe:476
%original file name%.exe:1688
%original file name%.exe:2008
%original file name%.exe:804 - Delete the original Malware file.
- Delete or disinfect the following files created/modified by the Malware:
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe (7726 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe (2321 bytes)
C:\totalcmd\TOTALCMD.EXE.exe (30812 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe (2321 bytes)
C:\totalcmd\TCMADMIN.EXE.exe (3073 bytes)
C:\totalcmd\TCUNINST.EXE.exe (3073 bytes)
C:\totalcmd\TcUsbRun.exe (3073 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\KAAo.txt (55978 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe (3361 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe (3073 bytes)
C:\totalcmd\TCMDX32.EXE.exe (3361 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe (3361 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe (3073 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Setup.exe (5441 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe (2321 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JEcAYQYs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BuYQUAck.bat (112 bytes)
C:\f9c9339a63965591860eaea8f2ffa98d (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jGkskoQU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fQAoogIs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uwwgkcso.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lukUIcMw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HWgwYwUg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\coooQAMY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lKAsIgIQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cUQAEIwM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PeAcssMc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KqIgIgQo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JIEUIgIE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dWoUQkUc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qSAgYgYY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EkgYcQcM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QYYQQMEQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PGYYwMcU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yGsQMsMM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xAQocwEo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qggEIosQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ickIkggg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oyIMkswk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BoMcAggE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OiEgcowc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lqIQQEgo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JewEQkEA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gQYAogoA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TAEsYsoY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tWYEUAsY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BiYcgMsE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pGkMUYkg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\heAAcscs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IegIQYoE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FKQoIcwM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hakQMEYs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ocMIQEUA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UYEkYMkw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IiYswoQY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DYswAwQk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oQskoAcw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zEwAAUUw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uEAwEMwg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NQQwoUsU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cAcUMYQI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uOosAkok.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KWkYsYco.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tIwIAQww.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yAEQEooc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uSAMgAcg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iwAowQEE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LUIIgIEY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mEwUkIkc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PEwwkYIc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PeMIAUgQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DmMYcUIA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PKwwgsEw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PswgksMI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYYsMAwU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MEMwUAUk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LiIskEgA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rkQUIEAY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WMkgYksc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vQAcsgQY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EygkkoQs.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lCIEEgkk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FwgMMcYM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\kEcsUcoo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EuIgckMQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jmccgQgg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LeIssgMo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eYUYAgos.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KGAUgkUo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aiIcEIwQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zyEcMYgA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\kOgAYkUs.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AeAIMcEk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DoAsckwI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FOkYggIQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yAwsUQgM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DEsIUcco.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UKkYIQwU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xAsQMcws.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SQEAYAIM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HUAwUsss.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\REsEEcQk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yqMkkcQk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DEEAYskw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\noEcAIYg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IiIYcsgc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\baYYoYAE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MuowcMgQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dKwgMwkg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lUQgQYwE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DYMscIwg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OEgYIMsY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LCAogcMk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gKgQwEQc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NmAUcIow.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pEgsYYsE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gCokAkco.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GmYkoIQE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EkgEkUQs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PYsIggMo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dIEwEwMk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ugEwwYsE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CCQookoo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YGkkYwgQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TCcookIA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\migcwwME.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zeUoMIkE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ICUEosAQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LYAMcook.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DEQYUkYU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wMEsAcwQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LOIcgoMo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lCAAMIYg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pWsEYows.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GesMIcMk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IiAkYMMo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scMowkMU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AgkUokMQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\isIkAIMs.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DGwsMEEg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fsUQUMQQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QeIAMsYc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RSkQwAEQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BAowUoIY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yakAMoEM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CaIckQQE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DEEEkUQA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZCYMkMAA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uIUEogsY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YeUcgMAQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\secsQYUI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\USowowQQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zkgoYccs.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RMMwUUIc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oAckUgMk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aawwYwAw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GEYQwQIs.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MYUQkQQo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JCosAccU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DkMYkAwQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aYYcAIwE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DiwUwYkY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eAoEMgEI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yoMQcAgg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KUUoYYIE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TQoEEswY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cIsoswQU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eUkQwgsk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zMYUcIIM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YqAQokwg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dqAoAMEY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hOsAQUcw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aWkQMkQI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oIMsskAU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LQQAcUEc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zcgYEAQA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fKoUIckc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUAUgkwU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mUUcscYE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fqYUgAgs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TycwgEkg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pYkskMoI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UMUoMYwM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VckgAoQM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LMowIwwg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GCksAIME.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LSMoIQAE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JMwkAkcU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DCQwwEcI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iQMcksME.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xaQYgoEI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UicIIoEI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iMQoYooc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qQoMUIYw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\POwgMQwM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BCYkgsEQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PkMMYYUU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LQUEscIo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zSgcEQsw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nYoQsAME.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WScUAYoI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hGUkwoAg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BQQkkcIE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KgkgIgYo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QQMcokUg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iGsQUoUo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GasIUQIE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EaIsgsQA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MIscgsMM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OSIkYgsM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NAYEYoQk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XKMUYQME.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KUEMMgQk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KmYgAoYs.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EIMAcAYU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oogwQYco.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoIgQYY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uUYwEkUY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dywocooo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IcsIoswI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RgUUMMYc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JQosowgA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GYkAkocY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UwMgMIgI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\osgQIUco.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DYMIkYcI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iKwAsMQk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vOgEwwcg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nIEAkwQk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\kOkIcMww.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uYcYsAQE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QsMAkYAg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\umcwAsMY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PgEwUIAc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EaIIYMAg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xMAkQYgQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UkoMMIsg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YukoEgEU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IeEYsgcU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MqQAEEMs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\taYMkEEQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vScoUUAw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xawAYMUw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\laMUAUAw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zsUQYMcQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oeoskMQk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PUYocMIQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zaUQsEkA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PsQgAQcY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oeEQUAog.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vwIMcIIs.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QAMAgMMg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZckUMIAA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ouIAoUMU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xSAQoogk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uesssUgk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CQwkowcc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WuYIwogk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tsskgocI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QwwIYckM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FyAcYgQI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iaAgoIQA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RiEgEEcE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eccEAkEA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dwYswwQY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nSwMwYwA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hgckUIYA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uMEEUUoM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tsAMAwYo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sosIUUAw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xogEkoYc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iMIkQQoY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NWAsgAgU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rQkwsosA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BgQAowks.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DSQEUIQg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JGIowcEs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KAYIgMoY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QOAssgYA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UiMAAUYQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oAMMgUoI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sEsUAAgY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\naQgkYMw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JKsIYAgQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nyEYoEwA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oCQAYcwk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zGksQcYE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YqYwUwsk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wKQEUcYE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EAQcQAwo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SWYEoEUk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WEsAkgoM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BEggEkwc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iiQAAocE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UmokQMEo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wgMwggos.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VgEQYEEw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BUgMYEsk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AMIAgIoA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\kaYMMAEA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pgkkcQco.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ECcgEAUc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XiAUIEUk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OuIcAcQM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LcwgIkkQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vEUkAAgI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rgMYQEEw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JQEIwsQw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NIocckkk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wMUYAEgc.bat (4 bytes)
%Documents and Settings%\All Users\JuwEIgUE\reIEcoQI.exe (3897 bytes)
%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe (3801 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZGwAYskc.bat (112 bytes)
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe (3873 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bqgIEoYY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KIYYkoAs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YCYoUocQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UQMQoEcc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BoYEgkoQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xsIIQgkw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wwAsEcko.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AWEwgQQQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BEQUsAAg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KCskQUkE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HckgwIko.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GMUIIsMw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NmQgkEAw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SUYsYMYM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YEgcQEUU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FcEwkUAg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nscoEMEg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qukAMokE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WKkswEAM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RWQYYIQc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SIowckMQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FEYEkMoQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QcwwAcME.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GuoYAAkE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mEooQwcQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TekgIYYE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VEgYgAMY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FYcgAYYY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qywAwgEE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\puowQYcM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JkQkMMAA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XSkokQAk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oMEwQYAs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eysQUAQo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DEwAAgEo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FsYggMAM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SMswEwIU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xKIQgkoU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LYosYAgw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nwoEMows.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PmsYcUMc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VKIIsAUU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ViMoIQAg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RwQMswAc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iIUMYUEM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JuIIUEgY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MaoEUMwU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iqEoYIog.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jOwMgwsU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FQMUYYYk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TaEYEkUw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LGwogcMo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QyAcIwUU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EysYsQgQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GQUIEkos.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UyEwQEok.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lWAwgYsM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YsIwoUsM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\weAYoAUM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zmwAIIYI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\meMAwosM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NAswwUkU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\toUcQsEA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmAEcQUo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ImggsIIQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qUoQkAgE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ucUQUYwI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KaogYcoc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ScgUAgEE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hEIsoEsc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wecEYAcA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UegEAsoM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PwYwsogk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fwosAMII.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MwswEoEU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zCAUkIsg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uSMYcQgM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TKgIIUAE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VsokAoIU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fyIUkcEI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TgwYYgUE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BSwEIUIE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QGIUYwMQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZwYgMUwE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BQAwcEYY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jQQcMwQE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VWgMIUYk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VYQgoYIA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UmwUAosY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wYEEgsMc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uAAQoYIU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rqkAsUcU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mwYsEogc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xyYoUssg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hyAYYIEg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iKsMAUsY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QEoMEcUg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KOQMQoEk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ckswkYso.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OUgAMcUA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rQIUQosw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HMUwIoYc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ASQYcMoA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cWgIcIQA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XKQkgEcs.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\paUMQoUs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TwAcUgcw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ceIYowso.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FeIgYoEI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QmIMUgQQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iYYYAQAU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tAIIAosU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uSwEUoII.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PaoUgUww.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gsIcsksE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KsoQwUQM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TkcYYscw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HuEQkQIM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qcQoAogM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yUwUUYsI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KWMIckYs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eeAYAQUE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QeQYgUQk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mUsIkUYI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mCcckksQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UwkssEoU.bat (112 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"fGAwoYMM.exe" = "%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NesIMIQs.exe" = "%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| .text | 4096 | 450560 | 447488 | 5.51476 | 3708cf19e5757d4b92e93e8a06febc43 |
| .rdata | 454656 | 4096 | 512 | 2.376 | 3f049539214dc16e1be34bd34eabe133 |
| .data | 458752 | 260 | 512 | 2.22792 | 57c525991169c27431d5c413075df6d3 |
| .rsrc | 462848 | 4444 | 4608 | 3.5617 | 7b60e75b72f5d4157b5ce840a5268dcc |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
| URL | IP |
|---|---|
| hxxp://google.com/ | 74.125.205.139 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET / HTTP/1.1
Host: google.com
HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=IN26VNiYCo7GYK_ygaAN
Content-Length: 260
Date: Sat, 17 Jan 2015 22:07:28 GMT
Server: GFE/2.0
Alternate-Protocol: 80:quic,p=0.02
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=IN26VNiYCo7GYK_ygaAN">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=IN26VNiYCo7GYK_ygaAN..Content-Length: 260..Date: Sat, 17 Jan 2015 22:07:28 GMT..Server: GFE/2.0..Alternate-Protocol: 80:quic,p=0.02..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=IN26VNiYCo7GYK_ygaAN">here</A>...</BODY></HTML>....
GET / HTTP/1.1
Host: google.com
HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Nt26VIzbBoau8we76YDwBA
Content-Length: 262
Date: Sat, 17 Jan 2015 22:07:50 GMT
Server: GFE/2.0
Alternate-Protocol: 80:quic,p=0.02
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Nt26VIzbBoau8we76YDwBA">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Nt26VIzbBoau8we76YDwBA..Content-Length: 262..Date: Sat, 17 Jan 2015 22:07:50 GMT..Server: GFE/2.0..Alternate-Protocol: 80:quic,p=0.02..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Nt26VIzbBoau8we76YDwBA">here</A>...</BODY></HTML>....
GET / HTTP/1.1
Host: google.com
HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=rNy6VMvpAoeu8weW-IHIBg
Content-Length: 262
Date: Sat, 17 Jan 2015 22:05:32 GMT
Server: GFE/2.0
Alternate-Protocol: 80:quic,p=0.02
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=rNy6VMvpAoeu8weW-IHIBg">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=rNy6VMvpAoeu8weW-IHIBg..Content-Length: 262..Date: Sat, 17 Jan 2015 22:05:32 GMT..Server: GFE/2.0..Alternate-Protocol: 80:quic,p=0.02..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=rNy6VMvpAoeu8weW-IHIBg">here</A>...</BODY></HTML>....
GET / HTTP/1.1
Host: google.com
HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=rNy6VObFB4iu8wf90oDACA
Content-Length: 262
Date: Sat, 17 Jan 2015 22:05:32 GMT
Server: GFE/2.0
Alternate-Protocol: 80:quic,p=0.02
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=rNy6VObFB4iu8wf90oDACA">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=rNy6VObFB4iu8wf90oDACA..Content-Length: 262..Date: Sat, 17 Jan 2015 22:05:32 GMT..Server: GFE/2.0..Alternate-Protocol: 80:quic,p=0.02..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=rNy6VObFB4iu8wf90oDACA">here</A>...</BODY></HTML>....
GET / HTTP/1.1
Host: google.com
HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=8Ny6VJXANJCu8wfJxYCYBw
Content-Length: 262
Date: Sat, 17 Jan 2015 22:06:40 GMT
Server: GFE/2.0
Alternate-Protocol: 80:quic,p=0.02
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=8Ny6VJXANJCu8wfJxYCYBw">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=8Ny6VJXANJCu8wfJxYCYBw..Content-Length: 262..Date: Sat, 17 Jan 2015 22:06:40 GMT..Server: GFE/2.0..Alternate-Protocol: 80:quic,p=0.02..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=8Ny6VJXANJCu8wfJxYCYBw">here</A>...</BODY></HTML>....
Map
The Malware connects to the servers at the folowing location(s):
Strings from Dumps
fGAwoYMM.exe_1208:
.text
.text
`.rdata
`.rdata
@.data
@.data
3E.Pcq:P!V^
3E.Pcq:P!V^
#%Xkq.
#%Xkq.
V.tjO
V.tjO
.I(%D~
.I(%D~
H%fj9
H%fj9
pd.hq
pd.hq
v .OK
v .OK
:T.bV
:T.bV
.lv58B
.lv58B
Bp~.mw
Bp~.mw
c9.AA
c9.AA
>%FMj
>%FMj
-.Idtz
-.Idtz
.wT0v
.wT0v
ZUc-h.uf^
ZUc-h.uf^
K.Ls\B
K.Ls\B
6L.ss%
6L.ss%
O^.xU
O^.xU
Windows Internet Explorer
Windows Internet Explorer
Windows Task Manager
Windows Task Manager
taskmgr.exetaskkill /F /IM taskmgr.exe /T
taskmgr.exetaskkill /F /IM taskmgr.exe /T
sqlCu
sqlCu
hg.plC[5
hg.plC[5
>.Qlx #6
>.Qlx #6
k.pR^
k.pR^
[.pR^
[.pR^
Microsoft Windows
Microsoft Windows
gLX%Dl
gLX%Dl
'E%Dl
'E%Dl
RtlpNtSetValueKey
RtlpNtSetValueKey
ntdll.dll
ntdll.dll
user32.dll
user32.dll
fGAwoYMM.exe_1208_rwx_00401000_00069000:
3E.Pcq:P!V^
3E.Pcq:P!V^
#%Xkq.
#%Xkq.
V.tjO
V.tjO
.I(%D~
.I(%D~
H%fj9
H%fj9
pd.hq
pd.hq
v .OK
v .OK
:T.bV
:T.bV
.lv58B
.lv58B
Bp~.mw
Bp~.mw
c9.AA
c9.AA
>%FMj
>%FMj
-.Idtz
-.Idtz
.wT0v
.wT0v
ZUc-h.uf^
ZUc-h.uf^
K.Ls\B
K.Ls\B
6L.ss%
6L.ss%
O^.xU
O^.xU
Windows Internet Explorer
Windows Internet Explorer
Windows Task Manager
Windows Task Manager
taskmgr.exetaskkill /F /IM taskmgr.exe /T
taskmgr.exetaskkill /F /IM taskmgr.exe /T
sqlCu
sqlCu
hg.plC[5
hg.plC[5
>.Qlx #6
>.Qlx #6
k.pR^
k.pR^
[.pR^
[.pR^
Microsoft Windows
Microsoft Windows
gLX%Dl
gLX%Dl
'E%Dl
'E%Dl
fGAwoYMM.exe_1208_rwx_00900000_00068000:
3E.Pcq:P!V^
3E.Pcq:P!V^
#%Xkq.
#%Xkq.
.JF{
.JF{
U%Sa@
U%Sa@
('%D^q-*
('%D^q-*
?|Q%f
?|Q%f
SE?.rn~M*
SE?.rn~M*
.Dhe4
.Dhe4
E.IdJWH
E.IdJWH
%k%cn>x_
%k%cn>x_
?%uRc!
?%uRc!
%3.UGiO0
%3.UGiO0
]w.LQ
]w.LQ
I 4keyy
I 4keyy
L%C['
L%C['
7.BLP
7.BLP
;.StH
;.StH
>.Qlx #6
>.Qlx #6
$g.Gd
$g.Gd
P.yrBX.
P.yrBX.
PB]%C
PB]%C
%FoS(
%FoS(
F<.cs>
F<.cs>
fGAwoYMM.exe_1208_rwx_00980000_00001000:
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp
NesIMIQs.exe_984:
.text
.text
`.rdata
`.rdata
@.data
@.data
3E.Pcq:P!V^
3E.Pcq:P!V^
#%Xkq.
#%Xkq.
.JF{
.JF{
U%Sa@
U%Sa@
('%D^q-*
('%D^q-*
?|Q%f
?|Q%f
SE?.rn~M*
SE?.rn~M*
.Dhe4
.Dhe4
E.IdJWH
E.IdJWH
%k%cn>x_
%k%cn>x_
?%uRc!
?%uRc!
%3.UGiO0
%3.UGiO0
]w.LQ
]w.LQ
I 4keyy
I 4keyy
L%C['
L%C['
7.BLP
7.BLP
;.StH
;.StH
>.Qlx #6
>.Qlx #6
Microsoft Windows
Microsoft Windows
&J%f/
&J%f/
P.yrBX.
P.yrBX.
PB]%C
PB]%C
%FoS(
%FoS(
F<.cs>
F<.cs>
advapi32.dll
advapi32.dll
oleaut32.dll
oleaut32.dll
ws2_32.dll
ws2_32.dll
kernel32.dll
kernel32.dll
user32.dll
user32.dll
fGAwoYMM.exe_1208_rwx_00BB0000_00001000:
iB.UV
iB.UV
fGAwoYMM.exe_1208_rwx_00BC0000_00001000:
%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM
%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM
fGAwoYMM.exe_1208_rwx_00BD0000_00001000:
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs
fGAwoYMM.exe_1208_rwx_00BE0000_00001000:
%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.inf
%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.inf
reIEcoQI.exe_320:
.text
.text
`.rdata
`.rdata
@.data
@.data
3E.Pcq:P!V^
3E.Pcq:P!V^
#%Xkq.
#%Xkq.
.JF{
.JF{
U%Sa@
U%Sa@
('%D^q-*
('%D^q-*
?|Q%f
?|Q%f
SE?.rn~M*
SE?.rn~M*
.Dhe4
.Dhe4
E.IdJWH
E.IdJWH
%k%cn>x_
%k%cn>x_
?%uRc!
?%uRc!
%3.UGiO0
%3.UGiO0
]w.LQ
]w.LQ
I 4keyy
I 4keyy
L%C['
L%C['
7.BLP
7.BLP
;.StH
;.StH
>.Qlx #6
>.Qlx #6
2software\microsoft\windows\currentversion\run
2software\microsoft\windows\currentversion\run
P.yrBX.
P.yrBX.
PB]%C
PB]%C
%FoS(
%FoS(
F<.cs>
F<.cs>
kernel32.dll
kernel32.dll
oleaut32.dll
oleaut32.dll
user32.dll
user32.dll
fGAwoYMM.exe_1208_rwx_00BF0000_00001000:
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.inf
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.inf
fGAwoYMM.exe_1208_rwx_00C00000_00001000:
%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe
%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe
fGAwoYMM.exe_1208_rwx_00C10000_00001000:
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe
fGAwoYMM.exe_1208_rwx_00C40000_00001000:
fGAwoYMM.exe
fGAwoYMM.exe
fGAwoYMM.exe_1208_rwx_00C50000_00001000:
NesIMIQs.exe
NesIMIQs.exe
fGAwoYMM.exe_1208_rwx_00C60000_00001000:
taskkill /FI "USERNAME eq adm" /F /IM fGAwoYMM.exe
taskkill /FI "USERNAME eq adm" /F /IM fGAwoYMM.exe
fGAwoYMM.exe_1208_rwx_00C70000_00001000:
taskkill /FI "USERNAME eq adm" /F /IM NesIMIQs.exe
taskkill /FI "USERNAME eq adm" /F /IM NesIMIQs.exe
fGAwoYMM.exe_1208_rwx_00C80000_00001000:
%Documents and Settings%\All Users\JuwEIgUE\reIEcoQI.exe
%Documents and Settings%\All Users\JuwEIgUE\reIEcoQI.exe
fGAwoYMM.exe_1208_rwx_00C90000_00001000:
%Documents and Settings%\All Users\KAAo.txt
%Documents and Settings%\All Users\KAAo.txt
fGAwoYMM.exe_1208_rwx_00CA0000_00001000:
notepad.exe "%Documents and Settings%\All Users\KAAo.txt"
notepad.exe "%Documents and Settings%\All Users\KAAo.txt"
fGAwoYMM.exe_1208_rwx_00CB0000_00001000:
%Documents and Settings%\All Users\JuwEIgUE
%Documents and Settings%\All Users\JuwEIgUE
fGAwoYMM.exe_1208_rwx_01100000_02300000:
oleaut32.dll
oleaut32.dll
kernel32.dll
kernel32.dll
advapi32.dll
advapi32.dll
ole32.dll
ole32.dll
user32.dll
user32.dll
.LUHq
.LUHq
C|,Èj
C|,Èj
H.xa8
H.xa8
P&%s}
P&%s}
Wt.it
Wt.it
3Tpb4%D
3Tpb4%D
F.vGehr/
F.vGehr/
i.fbMG
i.fbMG
g.flI
g.flI
kEYRpqN
kEYRpqN
>s.NGO
>s.NGO
>Q[(%c;
>Q[(%c;
%FM5d
%FM5d
-4}{.h
-4}{.h
.jif w
.jif w
M.HUL
M.HUL
~$~%d!^
~$~%d!^
.CPSM
.CPSM
>%f{3;
>%f{3;
AK}.Gc
AK}.Gc
7%s3?
7%s3?
}X.Ky
}X.Ky
PM.mDX
PM.mDX
mUN%S
mUN%S
,%c|.%a
,%c|.%a
e=}Ug?}%d!
e=}Ug?}%d!
e#}Ug%}%d'
e#}Ug%}%d'
~/.DN%!
~/.DN%!
t.xake
t.xake
|.xaGv%
|.xaGv%
o"d.za
o"d.za
d.za#
d.za#
(.xai
(.xai
-xa}H
-xa}H
7_%f}
7_%f}
7C%f}
7C%f}
!.zc%
!.zc%
b3.Op
b3.Op
b7.Op
b7.Op
%x=zX
%x=zX
dS%F#
dS%F#
-‚s
-‚s
_)-x}
_)-x}
%X\o,
%X\o,
_)-h}
_)-h}
_)-H}"
_)-H}"
_)/
_)/
_)-t}
_)-t}
.tP`.tP
.tP`.tP
|[]$|[]5|[]
|[]$|[]5|[]
_)-\_"%,
_)-\_"%,
_)-d}
_)-d}
_)-4}
_)-4}
Mh%cy
Mh%cy
(h%cy{n
(h%cy{n
_)-X}
_)-X}
_)-P}
_)-P}
u]i'%c
u]i'%c
_)-D}
_)-D}
.gs]i&8
.gs]i&8
S_]eS_]uS_]ES_]US_]%S_]5S_]
S_]eS_]uS_]ES_]US_]%S_]5S_]
`^]7`^]'`^]
`^]7`^]'`^]
] ?_]='_]
] ?_]='_]
H]\%C
H]\%C
K]]%C
K]]%C
_%Cos
_%Cos
y]E%S]
y]E%S]
]%x{
]%x{
%X4q.S
%X4q.S
8y5-.KE
8y5-.KE
$y]m%s
$y]m%s
.ex^=O
.ex^=O
$y]q%c
$y]q%c
H%F{V"
H%F{V"
]%c}OI%?]
]%c}OI%?]
.OIR_
.OIR_
.If*&
.If*&
.Id*&
.Id*&
.Ih*&
.Ih*&
HóT"
HóT"
ZQ^-;CEK÷U"
ZQ^-;CEK÷U"
HüW"
HüW"
%cy{I
%cy{I
%cy=H
%cy=H
%cy)KE
%cy)KE
.fq\i&y
.fq\i&y
E?]y%x
E?]y%x
AbyOI%?]%dy
AbyOI%?]%dy
]x]s%x]
]x]s%x]
{]%dz
{]%dz
BMJüT&
BMJüT&
.IS &
.IS &
.fy^i
.fy^i
e}-e}gH
e}-e}gH
q_-c}
q_-c}
qY-c}
qY-c}
Xy^-;CiK%F
Xy^-;CiK%F
bkOIz[]}%xs
bkOIz[]}%xs
]%czQIZ^\
]%czQIZ^\
_.me*&6l
_.me*&6l
o%du*&J
o%du*&J
]%c{)K
]%c{)K
\g.dx]K
\g.dx]K
k%uL)&F
k%uL)&F
.uk &
.uk &
|_-f}gHR
|_-f}gHR
y_-a}OI
y_-a}OI
q_-a})K
q_-a})K
r\-%U
r\-%U
g1\)%c"
g1\)%c"
hy]abyOI$;]%dygH
hy]abyOI$;]%dygH
(CmD)
(CmD)
KeygK
KeygK
.eOiD_Ou7[]ydyOm%K
.eOiD_Ou7[]ydyOm%K
.eOiD_Ou7[]yDyOm#[]
.eOiD_Ou7[]yDyOm#[]
CY-a}UH
CY-a}UH
Py}.Exg
Py}.Exg
Py"%c
Py"%c
xy"%d
xy"%d
$y]>%x
$y]>%x
,y][%x
,y][%x
,y]6%x]
,y]6%x]
(y]!%x]
(y]!%x]
4y]M%x
4y]M%x
4y]X%x]
4y]X%x]
0y]-%x]
0y]-%x]
]A%x]
]A%x]
y]\%x]
y]\%x]
y]H%x
y]H%x
y]1%x]
y]1%x]
]8%x]
]8%x]
hy]'%x
hy]'%x
hy]7%x
hy]7%x
]m%x]
]m%x]
xy]c%x]
xy]c%x]
xy]~%x
xy]~%x
]C%x]
]C%x]
xy]P%x
xy]P%x
xy](%x
xy](%x
xy]>%x
xy]>%x
xy]1%x
xy]1%x
]
]
]>%x]
]>%x]
.\]&.}]?
.\]&.}]?
H]]%Co
H]]%Co
C]^%C
C]^%C
Dy]S,y]]F~].Dy]
Dy]S,y]]F~].Dy]
.Zy]36y]]X~
.Zy]36y]]X~
x]%x~
x]%x~
$m}]-f}]
$m}]-f}]
]}]%f}])
]}]%f}])
g[}]-g}
g[}]-g}
~]%S|]9
~]%S|]9
OI$;]%fyOI%']%"y;m';
OI$;]%fyOI%']%"y;m';
h%x]a
h%x]a
y].ay]
y].ay]
}.BT@
}.BT@
]%u#]
]%u#]
|\`%x\
|\`%x\
fGAwoYMM.exe_1208_rwx_03900000_01E00000:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
u%Uh`
u%Uh`
QSSSh
QSSSh
QVSSh
QVSSh
t.PSh
t.PSh
T$lRSSh| "
T$lRSSh| "
UDPQRh
UDPQRh
L$ QSSh
L$ QSSh
L$,QSSh
L$,QSSh
QSSShlVU
QSSShlVU
RVSShlVU
RVSShlVU
t.Ph\
t.Ph\
tGHt.Ht&
tGHt.Ht&
operand of unlimited repeat could match the empty string
operand of unlimited repeat could match the empty string
POSIX named classes are supported only within a class
POSIX named classes are supported only within a class
erroffset passed as NULL
erroffset passed as NULL
POSIX collating elements are not supported
POSIX collating elements are not supported
this version of PCRE is not compiled with PCRE_UTF8 support
this version of PCRE is not compiled with PCRE_UTF8 support
PCRE does not support \L, \l, \N{name}, \U, or \u
PCRE does not support \L, \l, \N{name}, \U, or \u
support for \P, \p, and \X has not been compiled
support for \P, \p, and \X has not been compiled
this version of PCRE is not compiled with PCRE_UCP support
this version of PCRE is not compiled with PCRE_UCP support
\N is not supported in a class
\N is not supported in a class
inflate 1.2.5 Copyright 1995-2010 Mark Adler
inflate 1.2.5 Copyright 1995-2010 Mark Adler
Please contact the application's support team for more information.
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
operator
operator
GetProcessWindowStation
GetProcessWindowStation
USER32.DLL
USER32.DLL
RtlRunOnceExecuteOnce
RtlRunOnceExecuteOnce
advapi32_hack::try_hack: bad PE passed
advapi32_hack::try_hack: bad PE passed
advapi32_hack::try_hack: cannot read import table
advapi32_hack::try_hack: cannot read import table
advapi32_hack::try_hack: cannot find section .text
advapi32_hack::try_hack: cannot find section .text
.data
.data
advapi32_hack::try_hack: cannot find section .data
advapi32_hack::try_hack: cannot find section .data
advapi32_hack::try_hack: cannot read section .text
advapi32_hack::try_hack: cannot read section .text
Cannot read module %s, error %d
Cannot read module %s, error %d
Cannot read exports of %s, error %d
Cannot read exports of %s, error %d
advapi32_hack::try_hack: cannot read exports, error %d
advapi32_hack::try_hack: cannot read exports, error %d
.apiset
.apiset
Bad .apiset catalog - don`t fit in section
Bad .apiset catalog - don`t fit in section
String in cat item %d not in section
String in cat item %d not in section
Value in cat item %d not in section
Value in cat item %d not in section
Bad referred in cat item %d
Bad referred in cat item %d
Double mapped value in cat item %d not in section
Double mapped value in cat item %d not in section
Bad double referred in cat item %d
Bad double referred in cat item %d
BaseSrvRegisterWowExec
BaseSrvRegisterWowExec
BaseSrvGetProcessShutdownParam
BaseSrvGetProcessShutdownParam
BaseSrvSetProcessShutdownParam
BaseSrvSetProcessShutdownParam
basesrv.dll
basesrv.dll
Unknown size of BaseServerApiDispatchTable: %d
Unknown size of BaseServerApiDispatchTable: %d
ServerDll[%d] %p
ServerDll[%d] %p
csrsrv.dll
csrsrv.dll
CsrExecServerThread
CsrExecServerThread
ServerDll[%d]:
ServerDll[%d]:
ApiDispatchTable: %p %s
ApiDispatchTable: %p %s
ConnectRoutine: %p %s
ConnectRoutine: %p %s
DisconnectRoutine: %p %s
DisconnectRoutine: %p %s
HardErrorRoutine: %p %s
HardErrorRoutine: %p %s
AddProcessRoutine: %p %s
AddProcessRoutine: %p %s
ShutdownProcessRoutine: %p %s
ShutdownProcessRoutine: %p %s
Cannot open dir %S, error %d
Cannot open dir %S, error %d
clean_old_drvs: error %d on deleting file %S
clean_old_drvs: error %d on deleting file %S
Cannot find resource %X
Cannot find resource %X
Cannot load resource %X
Cannot load resource %X
Resource %d has zero length
Resource %d has zero length
Cannot lock resource %X
Cannot lock resource %X
Cannot unpack resource %X
Cannot unpack resource %X
Cannot create file %S, error %d
Cannot create file %S, error %d
1.2.5
1.2.5
Decompress buffer %d bytes too small
Decompress buffer %d bytes too small
DxDvpWaitForVideoPortSync
DxDvpWaitForVideoPortSync
DxDvpUpdateVideoPort
DxDvpUpdateVideoPort
DxDvpGetVideoPortConnectInfo
DxDvpGetVideoPortConnectInfo
DxDvpGetVideoPortOutputFormats
DxDvpGetVideoPortOutputFormats
DxDvpGetVideoPortLine
DxDvpGetVideoPortLine
DxDvpGetVideoPortInputFormats
DxDvpGetVideoPortInputFormats
DxDvpGetVideoPortFlipStatus
DxDvpGetVideoPortFlipStatus
DxDvpGetVideoPortField
DxDvpGetVideoPortField
DxDvpGetVideoPortBandwidth
DxDvpGetVideoPortBandwidth
DxDvpFlipVideoPort
DxDvpFlipVideoPort
DxDvpDestroyVideoPort
DxDvpDestroyVideoPort
DxDvpCreateVideoPort
DxDvpCreateVideoPort
DxDvpCanCreateVideoPort
DxDvpCanCreateVideoPort
DxDdSetColorKey
DxDdSetColorKey
Cannot read gaDxgFuncs handlers, readed %X bytes
Cannot read gaDxgFuncs handlers, readed %X bytes
.rdata
.rdata
Cannot read DxgCoreInterface handlers, readed %X bytes
Cannot read DxgCoreInterface handlers, readed %X bytes
Unknown acpi table version: %X
Unknown acpi table version: %X
SBP2PORT_Mask
SBP2PORT_Mask
STORMINIPORT_Mask
STORMINIPORT_Mask
STORPORT_Mask
STORPORT_Mask
TCPIP6_Mask
TCPIP6_Mask
WSOCKTRANSPORT_Mask
WSOCKTRANSPORT_Mask
FCPORT_Mask
FCPORT_Mask
SOFTPCI_Mask
SOFTPCI_Mask
TCPIP_Mask
TCPIP_Mask
SCSIMINIPORT_Mask
SCSIMINIPORT_Mask
SCSIPORT_Mask
SCSIPORT_Mask
Unknown KdComponentTableSize size %X
Unknown KdComponentTableSize size %X
dump_kd_masks return %X bytes, error %d, ntstatus %X
dump_kd_masks return %X bytes, error %d, ntstatus %X
dump_kd_masks return %X bytes, error %d
dump_kd_masks return %X bytes, error %d
dump_kd_masks(%s) return %X bytes, error %d, ntstatus %X
dump_kd_masks(%s) return %X bytes, error %d, ntstatus %X
dump_kd_masks(%s) return %X bytes, error %d
dump_kd_masks(%s) return %X bytes, error %d
%-*s: %X
%-*s: %X
read_kopts_length(%s) return %X bytes, error %d, ntstatus %X
read_kopts_length(%s) return %X bytes, error %d, ntstatus %X
read_kopts_length(%s) return %X bytes, error %d
read_kopts_length(%s) return %X bytes, error %d
Cannot alloc %X bytes
Cannot alloc %X bytes
Cannot realloc %X bytes for %s
Cannot realloc %X bytes for %s
read_kopts(%s) return %X bytes, error %d, ntstatus %X
read_kopts(%s) return %X bytes, error %d, ntstatus %X
read_kopts(%s) return %X bytes, error %d
read_kopts(%s) return %X bytes, error %d
%S (%s): %X
%S (%s): %X
%S (%s):
%S (%s):
dump_kopts(%s) return %X bytes, error %d, ntstatus %X
dump_kopts(%s) return %X bytes, error %d, ntstatus %X
dump_kopts(%s) return %X bytes, error %d
dump_kopts(%s) return %X bytes, error %d
MmSupportWriteWatch
MmSupportWriteWatch
KiPassiveWatchdogTimeout
KiPassiveWatchdogTimeout
ViImageExecutionOptions
ViImageExecutionOptions
DbgkErrorPortStartTimeout
DbgkErrorPortStartTimeout
DbgkErrorPortCommTimeout
DbgkErrorPortCommTimeout
MmDisablePagingExecutive
MmDisablePagingExecutive
CmDefaultLanguageId
CmDefaultLanguageId
DbgkpMaxModuleMsgs
DbgkpMaxModuleMsgs
IoCountOperations
IoCountOperations
KeDelayExecutionThread
KeDelayExecutionThread
resolve_IoFreeIrp: bad addr of %s
resolve_IoFreeIrp: bad addr of %s
get_interrupt_dispatch: cannot alloc %d bytes
get_interrupt_dispatch: cannot alloc %d bytes
Unknown kernel options: %S
Unknown kernel options: %S
PsGetProcessWin32WindowStation
PsGetProcessWin32WindowStation
KeIsExecutingDpc
KeIsExecutingDpc
bad addr of KeIsExecutingDpc
bad addr of KeIsExecutingDpc
Bad pnp handler item %d (%d)
Bad pnp handler item %d (%d)
Cannot find %s
Cannot find %s
ks.sys: cannot get KoCreateInstance
ks.sys: cannot get KoCreateInstance
ImportContext
ImportContext
ExportContext
ExportContext
SpChangeAccountPasswordFn
SpChangeAccountPasswordFn
CallPackagePassthrough
CallPackagePassthrough
%SystemRoot%\System32\
%SystemRoot%\System32\
GetServiceAccountPassword
GetServiceAccountPassword
DPAPIPasswordChangeForGMSA
DPAPIPasswordChangeForGMSA
GetCredentialKey
GetCredentialKey
INotifyPasswordChanged
INotifyPasswordChanged
%s PolicyChangeNotificationCallbacks
%s PolicyChangeNotificationCallbacks
PolicyChangeNotificationCallback[%d]: %d items
PolicyChangeNotificationCallback[%d]: %d items
[%d] %p %p %p %p %s
[%d] %p %p %p %p %s
lsasrv_hack::try_hack: bad PE passed
lsasrv_hack::try_hack: bad PE passed
lsasrv_hack::try_hack: cannot find section .data
lsasrv_hack::try_hack: cannot find section .data
lsasrv_hack::try_hack: cannot read section .data
lsasrv_hack::try_hack: cannot read section .data
lsasrv_hack::try_hack: bad section passed
lsasrv_hack::try_hack: bad section passed
lsasrv_hack::try_hack: cannot read exports, error %d
lsasrv_hack::try_hack: cannot read exports, error %d
LsaICallPackagePassthrough
LsaICallPackagePassthrough
lsasrv.dll
lsasrv.dll
VaultLogonSessionNotification: %p %s
VaultLogonSessionNotification: %p %s
Start of driver %S failed !
Start of driver %S failed !
WSPJoinLeaf
WSPJoinLeaf
MSAFD_WSPSendMsg
MSAFD_WSPSendMsg
MSAFD_WSPRecvMsg
MSAFD_WSPRecvMsg
mswsock.dll
mswsock.dll
CheckProc: cannot open process PID %d, error %d, ntstatus %X
CheckProc: cannot open process PID %d, error %d, ntstatus %X
CheckProc: cannot open process PID %d, error %d
CheckProc: cannot open process PID %d, error %d
threaded_processes_checker exception occured, error %X
threaded_processes_checker exception occured, error %X
MyWindowsChecker: len %d, kernel name %s
MyWindowsChecker: len %d, kernel name %s
Cannot get kernel name, error %d
Cannot get kernel name, error %d
Kill process %d
Kill process %d
Check processes in %d threads
Check processes in %d threads
Cannot find process %d
Cannot find process %d
Usage: %S [options]
Usage: %S [options]
-wmi - report about WMI entries
-wmi - report about WMI entries
-uem - check for Unknown Executable Memory
-uem - check for Unknown Executable Memory
-npo - dump RPC Named Pipes Owner
-npo - dump RPC Named Pipes Owner
-rdata - check .rdata sections too
-rdata - check .rdata sections too
-rpc - report about RPC interfaces
-rpc - report about RPC interfaces
DeriveKey
DeriveKey
NotifyChangeKey
NotifyChangeKey
EnumKeys
EnumKeys
IsAlgSupported
IsAlgSupported
FreeKey
FreeKey
DeleteKey
DeleteKey
FinalizeKey
FinalizeKey
SetKeyProperty
SetKeyProperty
CreatePersistedKey
CreatePersistedKey
OpenKey
OpenKey
OpenPrivateKey
OpenPrivateKey
ImportKey
ImportKey
ImportMasterKey
ImportMasterKey
GetKeyProperty
GetKeyProperty
GenerateSessionKeys
GenerateSessionKeys
GenerateMasterKey
GenerateMasterKey
ExportKey
ExportKey
CreateEphemeralKey
CreateEphemeralKey
ComputeEapKeyBlock
ComputeEapKeyBlock
ncrypt_hack::check_in_proc: cannot alloc %d bytes
ncrypt_hack::check_in_proc: cannot alloc %d bytes
GetKeyStorageInterface
GetKeyStorageInterface
Cannot load %s (copy of %s), error %d
Cannot load %s (copy of %s), error %d
Cannot load module %s, error %d
Cannot load module %s, error %d
Cannot read module %s import table
Cannot read module %s import table
NdisMRegisterMiniportDriver
NdisMRegisterMiniportDriver
resolve_minidrivers_list: bad addr of NdisMRegisterMiniportDriver
resolve_minidrivers_list: bad addr of NdisMRegisterMiniportDriver
NdisMRegisterMiniport
NdisMRegisterMiniport
resolve_minidrivers_list: cannot find NdisMRegisterMiniport
resolve_minidrivers_list: cannot find NdisMRegisterMiniport
resolve_minidrivers_list: bad addr of NdisMRegisterMiniport
resolve_minidrivers_list: bad addr of NdisMRegisterMiniport
resolve_miniports_list: cannot find NdisIMInitializeDeviceInstanceEx
resolve_miniports_list: cannot find NdisIMInitializeDeviceInstanceEx
resolve_miniports_list: bad addr of NdisIMInitializeDeviceInstanceEx
resolve_miniports_list: bad addr of NdisIMInitializeDeviceInstanceEx
OID_CO_TAPI_DONT_REPORT_DIGITS
OID_CO_TAPI_DONT_REPORT_DIGITS
OID_CO_TAPI_REPORT_DIGITS
OID_CO_TAPI_REPORT_DIGITS
OID_QOS_OPERATIONAL_PARAMETERS
OID_QOS_OPERATIONAL_PARAMETERS
OID_TCP_TASK_IPSEC_OFFLOAD_V2_ADD_SA_EX
OID_TCP_TASK_IPSEC_OFFLOAD_V2_ADD_SA_EX
OID_TCP_TASK_IPSEC_OFFLOAD_V2_UPDATE_SA
OID_TCP_TASK_IPSEC_OFFLOAD_V2_UPDATE_SA
OID_TCP_TASK_IPSEC_OFFLOAD_V2_DELETE_SA
OID_TCP_TASK_IPSEC_OFFLOAD_V2_DELETE_SA
OID_TCP_TASK_IPSEC_OFFLOAD_V2_ADD_SA
OID_TCP_TASK_IPSEC_OFFLOAD_V2_ADD_SA
OID_TCP_CONNECTION_OFFLOAD_PARAMETERS
OID_TCP_CONNECTION_OFFLOAD_PARAMETERS
OID_FFP_SUPPORT
OID_FFP_SUPPORT
OID_TCP_CONNECTION_OFFLOAD_HARDWARE_CAPABILITIES
OID_TCP_CONNECTION_OFFLOAD_HARDWARE_CAPABILITIES
OID_TCP_CONNECTION_OFFLOAD_CURRENT_CONFIG
OID_TCP_CONNECTION_OFFLOAD_CURRENT_CONFIG
OID_TCP_OFFLOAD_HARDWARE_CAPABILITIES
OID_TCP_OFFLOAD_HARDWARE_CAPABILITIES
OID_TCP_OFFLOAD_PARAMETERS
OID_TCP_OFFLOAD_PARAMETERS
OID_TCP_OFFLOAD_CURRENT_CONFIG
OID_TCP_OFFLOAD_CURRENT_CONFIG
OID_TCP6_OFFLOAD_STATS
OID_TCP6_OFFLOAD_STATS
OID_TCP4_OFFLOAD_STATS
OID_TCP4_OFFLOAD_STATS
OID_TCP_TASK_IPSEC_DELETE_UDPESP_SA
OID_TCP_TASK_IPSEC_DELETE_UDPESP_SA
OID_TCP_TASK_IPSEC_ADD_UDPESP_SA
OID_TCP_TASK_IPSEC_ADD_UDPESP_SA
OID_TCP_SAN_SUPPORT
OID_TCP_SAN_SUPPORT
OID_TCP_TASK_IPSEC_DELETE_SA
OID_TCP_TASK_IPSEC_DELETE_SA
OID_TCP_TASK_IPSEC_ADD_SA
OID_TCP_TASK_IPSEC_ADD_SA
OID_TCP_TASK_OFFLOAD
OID_TCP_TASK_OFFLOAD
OID_DOT11_SUPPORTED_DSSS_CHANNEL_LIST
OID_DOT11_SUPPORTED_DSSS_CHANNEL_LIST
OID_DOT11_SUPPORTED_OFDM_FREQUENCY_LIST
OID_DOT11_SUPPORTED_OFDM_FREQUENCY_LIST
OID_DOT11_QOS_TX_QUEUES_SUPPORTED
OID_DOT11_QOS_TX_QUEUES_SUPPORTED
OID_DOT11_AP_JOIN_REQUEST
OID_DOT11_AP_JOIN_REQUEST
OID_DOT11_HR_CCA_MODE_SUPPORTED
OID_DOT11_HR_CCA_MODE_SUPPORTED
OID_DOT11_FREQUENCY_BANDS_SUPPORTED
OID_DOT11_FREQUENCY_BANDS_SUPPORTED
OID_DOT11_SUPPORTED_DATA_RATES_VALUE
OID_DOT11_SUPPORTED_DATA_RATES_VALUE
OID_DOT11_SUPPORTED_RX_ANTENNA
OID_DOT11_SUPPORTED_RX_ANTENNA
OID_DOT11_SUPPORTED_TX_ANTENNA
OID_DOT11_SUPPORTED_TX_ANTENNA
OID_DOT11_REG_DOMAINS_SUPPORT_VALUE
OID_DOT11_REG_DOMAINS_SUPPORT_VALUE
OID_DOT11_CCA_MODE_SUPPORTED
OID_DOT11_CCA_MODE_SUPPORTED
OID_DOT11_SUPPORTED_POWER_LEVELS
OID_DOT11_SUPPORTED_POWER_LEVELS
OID_DOT11_DIVERSITY_SUPPORT
OID_DOT11_DIVERSITY_SUPPORT
OID_DOT11_SUPPORTED_PHY_TYPES
OID_DOT11_SUPPORTED_PHY_TYPES
OID_DOT11_OPERATIONAL_RATE_SET
OID_DOT11_OPERATIONAL_RATE_SET
OID_DOT11_JOIN_REQUEST
OID_DOT11_JOIN_REQUEST
OID_DOT11_CURRENT_OPERATION_MODE
OID_DOT11_CURRENT_OPERATION_MODE
OID_DOT11_OPERATION_MODE_CAPABILITY
OID_DOT11_OPERATION_MODE_CAPABILITY
OID_802_11_SUPPORTED_RATES
OID_802_11_SUPPORTED_RATES
OID_802_11_NETWORK_TYPES_SUPPORTED
OID_802_11_NETWORK_TYPES_SUPPORTED
OID_802_11_REMOVE_KEY
OID_802_11_REMOVE_KEY
OID_802_11_ADD_KEY
OID_802_11_ADD_KEY
OID_IRDA_SUPPORTED_SPEEDS
OID_IRDA_SUPPORTED_SPEEDS
OID_ATM_SUPPORTED_AAL_TYPES
OID_ATM_SUPPORTED_AAL_TYPES
OID_ATM_SUPPORTED_SERVICE_CATEGORY
OID_ATM_SUPPORTED_SERVICE_CATEGORY
OID_ATM_SUPPORTED_VC_RATES
OID_ATM_SUPPORTED_VC_RATES
OID_FDDI_PORT_ACTION
OID_FDDI_PORT_ACTION
OID_FDDI_PORT_HARDWARE_PRESENT
OID_FDDI_PORT_HARDWARE_PRESENT
OID_FDDI_PORT_LER_FLAG
OID_FDDI_PORT_LER_FLAG
OID_FDDI_PORT_PC_WITHHOLD
OID_FDDI_PORT_PC_WITHHOLD
OID_FDDI_PORT_PCM_STATE
OID_FDDI_PORT_PCM_STATE
OID_FDDI_PORT_CONNNECT_STATE
OID_FDDI_PORT_CONNNECT_STATE
OID_FDDI_PORT_LER_ALARM
OID_FDDI_PORT_LER_ALARM
OID_FDDI_PORT_LER_CUTOFF
OID_FDDI_PORT_LER_CUTOFF
OID_FDDI_PORT_LEM_CT
OID_FDDI_PORT_LEM_CT
OID_FDDI_PORT_LEM_REJECT_CT
OID_FDDI_PORT_LEM_REJECT_CT
OID_FDDI_PORT_LER_ESTIMATE
OID_FDDI_PORT_LER_ESTIMATE
OID_FDDI_PORT_LCT_FAIL_CT
OID_FDDI_PORT_LCT_FAIL_CT
OID_FDDI_PORT_EB_ERROR_CT
OID_FDDI_PORT_EB_ERROR_CT
OID_FDDI_PORT_PC_LS
OID_FDDI_PORT_PC_LS
OID_FDDI_PORT_BS_FLAG
OID_FDDI_PORT_BS_FLAG
OID_FDDI_PORT_MAINT_LS
OID_FDDI_PORT_MAINT_LS
OID_FDDI_PORT_INDEX
OID_FDDI_PORT_INDEX
OID_FDDI_PORT_CONNECTION_CAPABILITIES
OID_FDDI_PORT_CONNECTION_CAPABILITIES
OID_FDDI_PORT_PMD_CLASS
OID_FDDI_PORT_PMD_CLASS
OID_FDDI_PORT_MAC_LOOP_TIME
OID_FDDI_PORT_MAC_LOOP_TIME
OID_FDDI_PORT_AVAILABLE_PATHS
OID_FDDI_PORT_AVAILABLE_PATHS
OID_FDDI_PORT_MAC_PLACEMENT
OID_FDDI_PORT_MAC_PLACEMENT
OID_FDDI_PORT_REQUESTED_PATHS
OID_FDDI_PORT_REQUESTED_PATHS
OID_FDDI_PORT_CURRENT_PATH
OID_FDDI_PORT_CURRENT_PATH
OID_FDDI_PORT_MAC_INDICATED
OID_FDDI_PORT_MAC_INDICATED
OID_FDDI_PORT_CONNECTION_POLICIES
OID_FDDI_PORT_CONNECTION_POLICIES
OID_FDDI_PORT_NEIGHBOR_TYPE
OID_FDDI_PORT_NEIGHBOR_TYPE
OID_FDDI_PORT_MY_TYPE
OID_FDDI_PORT_MY_TYPE
OID_FDDI_MAC_DOWNSTREAM_PORT_TYPE
OID_FDDI_MAC_DOWNSTREAM_PORT_TYPE
OID_FDDI_SMT_MSG_TIME_STAMP
OID_FDDI_SMT_MSG_TIME_STAMP
OID_FDDI_SMT_BYPASS_PRESENT
OID_FDDI_SMT_BYPASS_PRESENT
OID_FDDI_SMT_MAC_INDEXES
OID_FDDI_SMT_MAC_INDEXES
OID_FDDI_SMT_PORT_INDEXES
OID_FDDI_SMT_PORT_INDEXES
OID_TCP_RSC_STATISTICS
OID_TCP_RSC_STATISTICS
OID_SWITCH_PORT_UPDATED
OID_SWITCH_PORT_UPDATED
OID_GEN_OPERATIONAL_STATUS
OID_GEN_OPERATIONAL_STATUS
OID_SWITCH_PORT_TEARDOWN
OID_SWITCH_PORT_TEARDOWN
OID_SWITCH_PORT_FEATURE_STATUS_QUERY
OID_SWITCH_PORT_FEATURE_STATUS_QUERY
OID_SWITCH_PORT_DELETE
OID_SWITCH_PORT_DELETE
OID_SWITCH_PORT_CREATE
OID_SWITCH_PORT_CREATE
OID_SWITCH_PORT_ARRAY
OID_SWITCH_PORT_ARRAY
OID_SWITCH_PORT_PROPERTY_ENUM
OID_SWITCH_PORT_PROPERTY_ENUM
OID_SWITCH_PORT_PROPERTY_DELETE
OID_SWITCH_PORT_PROPERTY_DELETE
OID_SWITCH_PORT_PROPERTY_UPDATE
OID_SWITCH_PORT_PROPERTY_UPDATE
OID_SWITCH_PORT_PROPERTY_ADD
OID_SWITCH_PORT_PROPERTY_ADD
OID_NIC_SWITCH_DELETE_VPORT
OID_NIC_SWITCH_DELETE_VPORT
OID_NIC_SWITCH_ENUM_VPORTS
OID_NIC_SWITCH_ENUM_VPORTS
OID_NIC_SWITCH_VPORT_PARAMETERS
OID_NIC_SWITCH_VPORT_PARAMETERS
OID_NIC_SWITCH_CREATE_VPORT
OID_NIC_SWITCH_CREATE_VPORT
OID_GEN_MINIPORT_RESTART_ATTRIBUTES
OID_GEN_MINIPORT_RESTART_ATTRIBUTES
OID_GEN_PORT_AUTHENTICATION_PARAMETERS
OID_GEN_PORT_AUTHENTICATION_PARAMETERS
OID_GEN_PORT_STATE
OID_GEN_PORT_STATE
OID_GEN_ENUMERATE_PORTS
OID_GEN_ENUMERATE_PORTS
OID_GEN_TRANSPORT_HEADER_OFFSET
OID_GEN_TRANSPORT_HEADER_OFFSET
OID_GEN_SUPPORTED_GUIDS
OID_GEN_SUPPORTED_GUIDS
OID_GEN_MEDIA_SUPPORTED
OID_GEN_MEDIA_SUPPORTED
OID_GEN_SUPPORTED_LIST
OID_GEN_SUPPORTED_LIST
Cannot read gWfpGlobal, readed %X bytes
Cannot read gWfpGlobal, readed %X bytes
Cannot read Wfp callout count, readed %X bytes
Cannot read Wfp callout count, readed %X bytes
Cannot read Wfp callouts, readed %X bytes
Cannot read Wfp callouts, readed %X bytes
Cannot read WFP index functions, readed %X bytes
Cannot read WFP index functions, readed %X bytes
iphlpapi.dll
iphlpapi.dll
%SystemRoot%\System32\iphlpapi.dll
%SystemRoot%\System32\iphlpapi.dll
AllocateAndGetTcpExTableFromStack
AllocateAndGetTcpExTableFromStack
AllocateAndGetUdpExTableFromStack
AllocateAndGetUdpExTableFromStack
GetExtendedTcpTable
GetExtendedTcpTable
GetExtendedUdpTable
GetExtendedUdpTable
Failed to snapshot TCP endpoints, error %d
Failed to snapshot TCP endpoints, error %d
Failed to snapshot UDP endpoints, error %d
Failed to snapshot UDP endpoints, error %d
Cannot alloc %d bytes for UDP extended table
Cannot alloc %d bytes for UDP extended table
Cannot alloc %d bytes for TCP extended table
Cannot alloc %d bytes for TCP extended table
ntdll_hack::try_hack: bad PE passed
ntdll_hack::try_hack: bad PE passed
ntdll_hack::try_hack: cannot find section .text
ntdll_hack::try_hack: cannot find section .text
ntdll_hack::try_hack: cannot read section .text
ntdll_hack::try_hack: cannot read section .text
ntdll_hack::try_hack: bad section passed
ntdll_hack::try_hack: bad section passed
ntdll_hack::try_hack: cannot read exports, error %d
ntdll_hack::try_hack: cannot read exports, error %d
%s channel hooks:
%s channel hooks:
ChannelHook[%d]: %p (%p - %s) %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X
ChannelHook[%d]: %p (%p - %s) %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X
ChannelHook[%d]: %p (%p) %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X
ChannelHook[%d]: %p (%p) %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X
MallocSpy: %p vtbl %p - %s
MallocSpy: %p vtbl %p - %s
webclient
webclient
msiexec32
msiexec32
msiexec
msiexec
tftp
tftp
ftp32
ftp32
cmd32
cmd32
ccmexec32
ccmexec32
ccmexec
ccmexec
chrome
chrome
opera
opera
firefox
firefox
Process PID %d raise dwwin PID %d
Process PID %d raise dwwin PID %d
Cannot alloc new process PID %d %S
Cannot alloc new process PID %d %S
Cannot open svchost process PID %d, error %d
Cannot open svchost process PID %d, error %d
proc_list::read: CreateToolhelp32Snapshot failed with error %d
proc_list::read: CreateToolhelp32Snapshot failed with error %d
PID %d Parent PID %d service {%S} %S
PID %d Parent PID %d service {%S} %S
PID %d Parent PID %d %S
PID %d Parent PID %d %S
PID %d Parent PID %d kind {%S} %S
PID %d Parent PID %d kind {%S} %S
read_service_exe_name(%S): cannot expand string %S
read_service_exe_name(%S): cannot expand string %S
ExWindowStationOpenProcedureCallout
ExWindowStationOpenProcedureCallout
ExWindowStationParseProcedureCallout
ExWindowStationParseProcedureCallout
ExWindowStationDeleteProcedureCallout
ExWindowStationDeleteProcedureCallout
ExWindowStationCloseProcedureCallout
ExWindowStationCloseProcedureCallout
ExWindowStationOkToCloseProcedureCallout
ExWindowStationOkToCloseProcedureCallout
read_w8_callout failed, len %d, returned %d bytes, error %d, ntstatus %X
read_w8_callout failed, len %d, returned %d bytes, error %d, ntstatus %X
read_w8_callout failed, len %d, returned %d bytes, error %d
read_w8_callout failed, len %d, returned %d bytes, error %d
PsWin32CallBack: %p %p %s
PsWin32CallBack: %p %p %s
check_callouts: cannot alloc %X bytes (size %d)
check_callouts: cannot alloc %X bytes (size %d)
check_callouts failed, error %d, status %X
check_callouts failed, error %d, status %X
check_callouts failed, error %d
check_callouts failed, error %d
Callouts (%d):
Callouts (%d):
%s: %p %s
%s: %p %s
ark_check_callbacks: cannot read size of callbacks list, error %d, ntstatus %X
ark_check_callbacks: cannot read size of callbacks list, error %d, ntstatus %X
ark_check_callbacks: cannot read size of callbacks list, error %d
ark_check_callbacks: cannot read size of callbacks list, error %d
ark_check_callbacks: cannot read %d bytes (readed %d), error %d, ntstatus %X
ark_check_callbacks: cannot read %d bytes (readed %d), error %d, ntstatus %X
ark_check_callbacks: cannot read %d bytes (readed %d), error %d
ark_check_callbacks: cannot read %d bytes (readed %d), error %d
CB: %S, total %X:
CB: %S, total %X:
%p (%s)
%p (%s)
check_shutdown_callbacks: cannot read size of callbacks list, error %d, ntstatus %X
check_shutdown_callbacks: cannot read size of callbacks list, error %d, ntstatus %X
check_shutdown_callbacks: cannot read size of callbacks list, error %d
check_shutdown_callbacks: cannot read size of callbacks list, error %d
check_shutdown_callbacks: cannot read callbacks list of %s, error %d, ntstatus %X
check_shutdown_callbacks: cannot read callbacks list of %s, error %d, ntstatus %X
check_shutdown_callbacks: cannot read callbacks list of %s, error %d
check_shutdown_callbacks: cannot read callbacks list of %s, error %d
%s - %d:
%s - %d:
FastIoUnlockAllByKey
FastIoUnlockAllByKey
MJ_CREATE_NAMED_PIPE
MJ_CREATE_NAMED_PIPE
%s!%s.%s patched by %s, addr %p
%s!%s.%s patched by %s, addr %p
%s!%s[%d] patched by %s, addr %p
%s!%s[%d] patched by %s, addr %p
Cannot open driver dumpfile %s, error %d
Cannot open driver dumpfile %s, error %d
Cannot open kernel dumpfile %s, error %d
Cannot open kernel dumpfile %s, error %d
Cannot read driver %s, error %d
Cannot read driver %s, error %d
hal.dll
hal.dll
Shadow SDT: %p, limit %X
Shadow SDT: %p, limit %X
win32k.sys
win32k.sys
Cannot relocate section %s.%s
Cannot relocate section %s.%s
Cannot alloc %X bytes for reading driver section %s.%s
Cannot alloc %X bytes for reading driver section %s.%s
Driver %s!%s has %X patched bytes !
Driver %s!%s has %X patched bytes !
.orig
.orig
.kmem
.kmem
Cannot read driver section %s.%s (flags %X) at %p size %X readed %X, error %d, ntstatus %X
Cannot read driver section %s.%s (flags %X) at %p size %X readed %X, error %d, ntstatus %X
Cannot read driver section %s.%s (flags %X) at %p size %X readed %X, error %d
Cannot read driver section %s.%s (flags %X) at %p size %X readed %X, error %d
Cannot read kernel %s, error %d
Cannot read kernel %s, error %d
ntoskrnl.exe
ntoskrnl.exe
Cannot alloc %X bytes for reading kernel sections
Cannot alloc %X bytes for reading kernel sections
Cannot relocate section %s
Cannot relocate section %s
KernelSection %s rva %X, size %X, 0x%X relocs has 0x%X patched bytes !
KernelSection %s rva %X, size %X, 0x%X relocs has 0x%X patched bytes !
Cannot read (whole) section %s (flags %X) at %p size %X (readed %X), error %d
Cannot read (whole) section %s (flags %X) at %p size %X (readed %X), error %d
\SystemRoot\system32\hal.dll
\SystemRoot\system32\hal.dll
\SystemRoot\system32\halapic.dll
\SystemRoot\system32\halapic.dll
\SystemRoot\system32\halmps.dll
\SystemRoot\system32\halmps.dll
\SystemRoot\system32\halacpi.dll
\SystemRoot\system32\halacpi.dll
\SystemRoot\system32\halaacpi.dll
\SystemRoot\system32\halaacpi.dll
\SystemRoot\system32\halmacpi.dll
\SystemRoot\system32\halmacpi.dll
%SystemRoot%\System32\hal.dll
%SystemRoot%\System32\hal.dll
halapic.dll
halapic.dll
halmps.dll
halmps.dll
halacpi.dll
halacpi.dll
halaacpi.dll
halaacpi.dll
halmacpi.dll
halmacpi.dll
Driver %S DrvObj %p:
Driver %S DrvObj %p:
DriverUnload patched by %s, addr %p
DriverUnload patched by %s, addr %p
DriverStartIo patched by %s, addr %p
DriverStartIo patched by %s, addr %p
AddDevice patched by %s, addr %p
AddDevice patched by %s, addr %p
Handler %s patched by %s, addr %p
Handler %s patched by %s, addr %p
Handler %s patched, addr %p
Handler %s patched, addr %p
Handler %d patched by %s, addr %p
Handler %d patched by %s, addr %p
Handler %d patched, addr %p
Handler %d patched, addr %p
FastIOHandler %s patched by %s, addr %p
FastIOHandler %s patched by %s, addr %p
FastIOHandler %s patched, addr %p
FastIOHandler %s patched, addr %p
FastIOHandler %d patched by %s, addr %p
FastIOHandler %d patched by %s, addr %p
FastIOHandler %d patched, addr %p
FastIOHandler %d patched, addr %p
FS_FILTER_CALLBACKS %s patched by %s, addr %p
FS_FILTER_CALLBACKS %s patched by %s, addr %p
FS_FILTER_CALLBACKS %s patched, addr %p
FS_FILTER_CALLBACKS %s patched, addr %p
FS_FILTER_CALLBACKS %d patched by %s, addr %p
FS_FILTER_CALLBACKS %d patched by %s, addr %p
FS_FILTER_CALLBACKS %d patched, addr %p
FS_FILTER_CALLBACKS %d patched, addr %p
StartIo patched by %s, addr %p
StartIo patched by %s, addr %p
read_fsmjxxx(%S): cannot make full driver name
read_fsmjxxx(%S): cannot make full driver name
read_fsmjxxx(%S) failed, error %d, ntstatus %X
read_fsmjxxx(%S) failed, error %d, ntstatus %X
read_fsmjxxx(%S) failed, error %d
read_fsmjxxx(%S) failed, error %d
read_mjxxx(%s): cannot make full driver name
read_mjxxx(%s): cannot make full driver name
read_mjxxx(%S) failed, error %d, ntstatus %X
read_mjxxx(%S) failed, error %d, ntstatus %X
read_mjxxx(%S) failed, error %d
read_mjxxx(%S) failed, error %d
Cannot alloc %X bytes for driver %s EAT checking
Cannot alloc %X bytes for driver %s EAT checking
read_driver_eat %s failed, error %d, status %X
read_driver_eat %s failed, error %d, status %X
read_driver_eat %s failed, error %d
read_driver_eat %s failed, error %d
Export addr %s.%s patched by %s !
Export addr %s.%s patched by %s !
Export addr %s.%s patched !
Export addr %s.%s patched !
Export addr %s.%d patched by %s !
Export addr %s.%d patched by %s !
Export addr %s.%d patched!
Export addr %s.%d patched!
\hal.dll
\hal.dll
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\ndis.sys
ndis.sys
ndis.sys
drivers\ndis.sys
drivers\ndis.sys
\SystemRoot\system32\DRIVERS\tdi.sys
\SystemRoot\system32\DRIVERS\tdi.sys
tdi.sys
tdi.sys
drivers\tdi.sys
drivers\tdi.sys
\SystemRoot\system32\DRIVERS\tcpip.sys
\SystemRoot\system32\DRIVERS\tcpip.sys
tcpip.sys
tcpip.sys
drivers\tcpip.sys
drivers\tcpip.sys
\SystemRoot\system32\DRIVERS\netio.sys
\SystemRoot\system32\DRIVERS\netio.sys
netio.sys
netio.sys
drivers\netio.sys
drivers\netio.sys
\SystemRoot\system32\DRIVERS\fltmgr.sys
\SystemRoot\system32\DRIVERS\fltmgr.sys
fltmgr.sys
fltmgr.sys
drivers\fltmgr.sys
drivers\fltmgr.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\ks.sys
ks.sys
ks.sys
drivers\ks.sys
drivers\ks.sys
\SystemRoot\system32\DRIVERS\dxg.sys
\SystemRoot\system32\DRIVERS\dxg.sys
drivers\dxg.sys
drivers\dxg.sys
\SystemRoot\system32\DRIVERS\dxgkrnl.sys
\SystemRoot\system32\DRIVERS\dxgkrnl.sys
drivers\dxgkrnl.sys
drivers\dxgkrnl.sys
\SystemRoot\system32\DRIVERS\watchdog.sys
\SystemRoot\system32\DRIVERS\watchdog.sys
drivers\watchdog.sys
drivers\watchdog.sys
\SystemRoot\system32\DRIVERS\ksecdd.sys
\SystemRoot\system32\DRIVERS\ksecdd.sys
ksecdd.sys
ksecdd.sys
drivers\ksecdd.sys
drivers\ksecdd.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\Ntfs.sys
ntfs.sys
ntfs.sys
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CLFS.SYS
CLFS.SYS
CLFS.SYS
\SystemRoot\system32\drivers\ataport.sys
\SystemRoot\system32\drivers\ataport.sys
ataport.sys
ataport.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\atapi.sys
atapi.sys
atapi.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\system32\drivers\peauth.sys
peauth.sys
peauth.sys
\SystemRoot\system32\drivers\WDFLDR.sys
\SystemRoot\system32\drivers\WDFLDR.sys
WDFLDR.sys
WDFLDR.sys
\SystemRoot\system32\drivers\usbstor.sys
\SystemRoot\system32\drivers\usbstor.sys
usbstor.sys
usbstor.sys
\SystemRoot\system32\drivers\usbd.sys
\SystemRoot\system32\drivers\usbd.sys
usbd.sys
usbd.sys
\SystemRoot\system32\drivers\USBPORT.sys
\SystemRoot\system32\drivers\USBPORT.sys
USBPORT.sys
USBPORT.sys
\SystemRoot\system32\drivers\usbohci.sys
\SystemRoot\system32\drivers\usbohci.sys
usbohci.sys
usbohci.sys
\SystemRoot\system32\drivers\usbehci.sys
\SystemRoot\system32\drivers\usbehci.sys
usbehci.sys
usbehci.sys
\SystemRoot\system32\drivers\usbhub.sys
\SystemRoot\system32\drivers\usbhub.sys
usbhub.sys
usbhub.sys
\SystemRoot\system32\drivers\usbccgp.sys
\SystemRoot\system32\drivers\usbccgp.sys
usbccgp.sys
usbccgp.sys
\SystemRoot\system32\drivers\discache.sys
\SystemRoot\system32\drivers\discache.sys
discache.sys
discache.sys
\SystemRoot\system32\drivers\termdd.sys
\SystemRoot\system32\drivers\termdd.sys
termdd.sys
termdd.sys
\SystemRoot\system32\drivers\rdppr.sys
\SystemRoot\system32\drivers\rdppr.sys
rdppr.sys
rdppr.sys
\SystemRoot\system32\drivers\mssmbios.sys
\SystemRoot\system32\drivers\mssmbios.sys
mssmbios.sys
mssmbios.sys
\SystemRoot\system32\drivers\1394BUS.SYS
\SystemRoot\system32\drivers\1394BUS.SYS
1394BUS.SYS
1394BUS.SYS
\SystemRoot\system32\drivers\BATTC.SYS
\SystemRoot\system32\drivers\BATTC.SYS
BATTC.SYS
BATTC.SYS
\SystemRoot\system32\drivers\bthport.sys
\SystemRoot\system32\drivers\bthport.sys
bthport.sys
bthport.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\drmk.sys
drmk.sys
drmk.sys
\SystemRoot\system32\drivers\HIDPARSE.SYS
\SystemRoot\system32\drivers\HIDPARSE.SYS
HIDPARSE.SYS
HIDPARSE.SYS
\SystemRoot\system32\drivers\HIDCLASS.SYS
\SystemRoot\system32\drivers\HIDCLASS.SYS
HIDCLASS.SYS
HIDCLASS.SYS
\SystemRoot\system32\drivers\msiscsi.sys
\SystemRoot\system32\drivers\msiscsi.sys
msiscsi.sys
msiscsi.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\system32\drivers\PCIIDEX.SYS
PCIIDEX.SYS
PCIIDEX.SYS
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\portcls.sys
portcls.sys
portcls.sys
\SystemRoot\system32\drivers\smsmdm.sys
\SystemRoot\system32\drivers\smsmdm.sys
smsmdm.sys
smsmdm.sys
\SystemRoot\system32\drivers\STREAM.SYS
\SystemRoot\system32\drivers\STREAM.SYS
STREAM.SYS
STREAM.SYS
\SystemRoot\system32\drivers\vga.sys
\SystemRoot\system32\drivers\vga.sys
vga.sys
vga.sys
\SystemRoot\system32\drivers\VIDEOPRT.SYS
\SystemRoot\system32\drivers\VIDEOPRT.SYS
VIDEOPRT.SYS
VIDEOPRT.SYS
\SystemRoot\system32\drivers\vmstorfl.sys
\SystemRoot\system32\drivers\vmstorfl.sys
vmstorfl.sys
vmstorfl.sys
\SystemRoot\system32\drivers\Dxapi.sys
\SystemRoot\system32\drivers\Dxapi.sys
Dxapi.sys
Dxapi.sys
\SystemRoot\system32\drivers\dxgthk.sys
\SystemRoot\system32\drivers\dxgthk.sys
dxgthk.sys
dxgthk.sys
\SystemRoot\system32\drivers\dxgmms1.sys
\SystemRoot\system32\drivers\dxgmms1.sys
dxgmms1.sys
dxgmms1.sys
\SystemRoot\system32\drivers\spsys.sys
\SystemRoot\system32\drivers\spsys.sys
spsys.sys
spsys.sys
\SystemRoot\system32\drivers\winhv.sys
\SystemRoot\system32\drivers\winhv.sys
winhv.sys
winhv.sys
\SystemRoot\system32\drivers\HdAudio.sys
\SystemRoot\system32\drivers\HdAudio.sys
HdAudio.sys
HdAudio.sys
\SystemRoot\System32\cdd.dll
\SystemRoot\System32\cdd.dll
cdd.dll
cdd.dll
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\System32\ATMFD.DLL
ATMFD.DLL
ATMFD.DLL
\SystemRoot\System32\RDPDD.dll
\SystemRoot\System32\RDPDD.dll
RDPDD.dll
RDPDD.dll
\SystemRoot\system32\drivers\vwifibus.sys
\SystemRoot\system32\drivers\vwifibus.sys
vwifibus.sys
vwifibus.sys
\SystemRoot\system32\drivers\nwifi.sys
\SystemRoot\system32\drivers\nwifi.sys
nwifi.sys
nwifi.sys
\SystemRoot\system32\drivers\vwififlt.sys
\SystemRoot\system32\drivers\vwififlt.sys
vwififlt.sys
vwififlt.sys
\SystemRoot\system32\drivers\wfplwf.sys
\SystemRoot\system32\drivers\wfplwf.sys
wfplwf.sys
wfplwf.sys
\SystemRoot\system32\drivers\wfplwfs.sys
\SystemRoot\system32\drivers\wfplwfs.sys
wfplwfs.sys
wfplwfs.sys
\SystemRoot\system32\drivers\tmtdi.sys
\SystemRoot\system32\drivers\tmtdi.sys
tmtdi.sys
tmtdi.sys
\SystemRoot\system32\drivers\netvsc60.sys
\SystemRoot\system32\drivers\netvsc60.sys
netvsc60.sys
netvsc60.sys
\SystemRoot\system32\drivers\mslldp.sys
\SystemRoot\system32\drivers\mslldp.sys
mslldp.sys
mslldp.sys
\SystemRoot\system32\drivers\netvsc63.sys
\SystemRoot\system32\drivers\netvsc63.sys
netvsc63.sys
netvsc63.sys
\SystemRoot\system32\drivers\ndiscap.sys
\SystemRoot\system32\drivers\ndiscap.sys
ndiscap.sys
ndiscap.sys
\SystemRoot\system32\drivers\agilevpn.sys
\SystemRoot\system32\drivers\agilevpn.sys
agilevpn.sys
agilevpn.sys
\SystemRoot\system32\drivers\asyncmac.sys
\SystemRoot\system32\drivers\asyncmac.sys
asyncmac.sys
asyncmac.sys
\SystemRoot\system32\drivers\mpsdrv.sys
\SystemRoot\system32\drivers\mpsdrv.sys
mpsdrv.sys
mpsdrv.sys
\SystemRoot\system32\drivers\rspndr.sys
\SystemRoot\system32\drivers\rspndr.sys
rspndr.sys
rspndr.sys
\SystemRoot\system32\drivers\ndisuio.sys
\SystemRoot\system32\drivers\ndisuio.sys
ndisuio.sys
ndisuio.sys
\SystemRoot\system32\drivers\lltdio.sys
\SystemRoot\system32\drivers\lltdio.sys
lltdio.sys
lltdio.sys
\SystemRoot\system32\drivers\NDProxy.sys
\SystemRoot\system32\drivers\NDProxy.sys
NDProxy.sys
NDProxy.sys
\SystemRoot\system32\drivers\raspppoe.sys
\SystemRoot\system32\drivers\raspppoe.sys
raspppoe.sys
raspppoe.sys
\SystemRoot\system32\drivers\ndiswan.sys
\SystemRoot\system32\drivers\ndiswan.sys
ndiswan.sys
ndiswan.sys
\SystemRoot\system32\drivers\wanarp.sys
\SystemRoot\system32\drivers\wanarp.sys
wanarp.sys
wanarp.sys
\SystemRoot\system32\drivers\bthpan.sys
\SystemRoot\system32\drivers\bthpan.sys
bthpan.sys
bthpan.sys
\SystemRoot\system32\drivers\rassstp.sys
\SystemRoot\system32\drivers\rassstp.sys
rassstp.sys
rassstp.sys
\SystemRoot\system32\drivers\raspptp.sys
\SystemRoot\system32\drivers\raspptp.sys
raspptp.sys
raspptp.sys
\SystemRoot\system32\drivers\rasl2tp.sys
\SystemRoot\system32\drivers\rasl2tp.sys
rasl2tp.sys
rasl2tp.sys
\SystemRoot\system32\drivers\rasacd.sys
\SystemRoot\system32\drivers\rasacd.sys
rasacd.sys
rasacd.sys
\SystemRoot\system32\drivers\tunnel.sys
\SystemRoot\system32\drivers\tunnel.sys
tunnel.sys
tunnel.sys
\SystemRoot\system32\drivers\tunmp.sys
\SystemRoot\system32\drivers\tunmp.sys
tunmp.sys
tunmp.sys
\SystemRoot\system32\drivers\pacer.sys
\SystemRoot\system32\drivers\pacer.sys
pacer.sys
pacer.sys
\SystemRoot\system32\drivers\NDISTAPI.SYS
\SystemRoot\system32\drivers\NDISTAPI.SYS
NDISTAPI.SYS
NDISTAPI.SYS
\SystemRoot\system32\drivers\msgpc.sys
\SystemRoot\system32\drivers\msgpc.sys
msgpc.sys
msgpc.sys
\SystemRoot\system32\drivers\partmgr.sys
\SystemRoot\system32\drivers\partmgr.sys
partmgr.sys
partmgr.sys
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\system32\drivers\volmgr.sys
volmgr.sys
volmgr.sys
\SystemRoot\system32\drivers\volmgrx.sys
\SystemRoot\system32\drivers\volmgrx.sys
volmgrx.sys
volmgrx.sys
\SystemRoot\system32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\mountmgr.sys
mountmgr.sys
mountmgr.sys
\SystemRoot\system32\drivers\iaStor.sys
\SystemRoot\system32\drivers\iaStor.sys
iaStor.sys
iaStor.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\system32\drivers\volsnap.sys
volsnap.sys
volsnap.sys
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\ACPI.sys
acpi.sys
acpi.sys
\SystemRoot\System32\Drivers\WppRecorder.sys
\SystemRoot\System32\Drivers\WppRecorder.sys
WppRecorder.sys
WppRecorder.sys
\SystemRoot\System32\Drivers\Mouclass.sys
\SystemRoot\System32\Drivers\Mouclass.sys
Mouclass.sys
Mouclass.sys
\SystemRoot\System32\Drivers\kbdclass.sys
\SystemRoot\System32\Drivers\kbdclass.sys
kbdclass.sys
kbdclass.sys
\SystemRoot\System32\Drivers\Fastfat.SYS
\SystemRoot\System32\Drivers\Fastfat.SYS
Fastfat.sys
Fastfat.sys
\SystemRoot\System32\Drivers\bowser.sys
\SystemRoot\System32\Drivers\bowser.sys
bowser.sys
bowser.sys
\SystemRoot\System32\Drivers\rdbss.sys
\SystemRoot\System32\Drivers\rdbss.sys
rdbss.sys
rdbss.sys
\SystemRoot\System32\Drivers\msfs.sys
\SystemRoot\System32\Drivers\msfs.sys
msfs.sys
msfs.sys
\SystemRoot\System32\Drivers\NetBIOS.sys
\SystemRoot\System32\Drivers\NetBIOS.sys
NetBIOS.sys
NetBIOS.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\Drivers\mup.sys
mup.sys
mup.sys
\SystemRoot\System32\Drivers\dfs.sys
\SystemRoot\System32\Drivers\dfs.sys
dfs.sys
dfs.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\System32\Drivers\dfsc.sys
dfsc.sys
dfsc.sys
\SystemRoot\System32\Drivers\npfs.SYS
\SystemRoot\System32\Drivers\npfs.SYS
npfs.sys
npfs.sys
\SystemRoot\System32\Drivers\luafv.SYS
\SystemRoot\System32\Drivers\luafv.SYS
luafv.sys
luafv.sys
\SystemRoot\System32\Drivers\MRxSmb.SYS
\SystemRoot\System32\Drivers\MRxSmb.SYS
MRxSmb.sys
MRxSmb.sys
\SystemRoot\System32\Drivers\MRxSmb10.SYS
\SystemRoot\System32\Drivers\MRxSmb10.SYS
MRxSmb10.sys
MRxSmb10.sys
\SystemRoot\System32\Drivers\MRxSmb20.SYS
\SystemRoot\System32\Drivers\MRxSmb20.SYS
MRxSmb20.sys
MRxSmb20.sys
\SystemRoot\System32\Drivers\MRxDAV.SYS
\SystemRoot\System32\Drivers\MRxDAV.SYS
MRxDAV.sys
MRxDAV.sys
\SystemRoot\system32\Drivers\fltmgr.sys
\SystemRoot\system32\Drivers\fltmgr.sys
\SystemRoot\system32\Drivers\TDI.SYS
\SystemRoot\system32\Drivers\TDI.SYS
\SystemRoot\system32\Drivers\tdx.sys
\SystemRoot\system32\Drivers\tdx.sys
\SystemRoot\system32\Drivers\ipfltdrv.sys
\SystemRoot\system32\Drivers\ipfltdrv.sys
\SystemRoot\system32\Drivers\tcpip.sys
\SystemRoot\system32\Drivers\tcpip.sys
\SystemRoot\System32\drivers\afd.sys
\SystemRoot\System32\drivers\afd.sys
afd.sys
afd.sys
\SystemRoot\System32\drivers\netbt.sys
\SystemRoot\System32\drivers\netbt.sys
\SystemRoot\System32\drivers\NETIO.sys
\SystemRoot\System32\drivers\NETIO.sys
\SystemRoot\System32\drivers\srv.sys
\SystemRoot\System32\drivers\srv.sys
srv.sys
srv.sys
\SystemRoot\System32\drivers\srv2.sys
\SystemRoot\System32\drivers\srv2.sys
srv2.sys
srv2.sys
\SystemRoot\System32\drivers\srvnet.sys
\SystemRoot\System32\drivers\srvnet.sys
\SystemRoot\System32\drivers\sr.sys
\SystemRoot\System32\drivers\sr.sys
sr.sys
sr.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\http.sys
\SystemRoot\System32\drivers\http.sys
http.sys
http.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\DRIVERS\msrpc.sys
\SystemRoot\system32\DRIVERS\msrpc.sys
msrpc.sys
msrpc.sys
\SystemRoot\system32\DRIVERS\disk.sys
\SystemRoot\system32\DRIVERS\disk.sys
disk.sys
disk.sys
\SystemRoot\system32\DRIVERS\ftdisk.sys
\SystemRoot\system32\DRIVERS\ftdisk.sys
ftdisk.sys
ftdisk.sys
\SystemRoot\system32\DRIVERS\Storport.SYS
\SystemRoot\system32\DRIVERS\Storport.SYS
Storport.SYS
Storport.SYS
\SystemRoot\system32\DRIVERS\CLASSPNP.SYS
\SystemRoot\system32\DRIVERS\CLASSPNP.SYS
CLASSPNP.SYS
CLASSPNP.SYS
\SystemRoot\system32\Drivers\ks.sys
\SystemRoot\system32\Drivers\ks.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\ksecdd.sys
ksecdd.SYS
ksecdd.SYS
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\kdcom.dll
kdcom.dll
kdcom.dll
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\Drivers\cng.sys
cng.sys
cng.sys
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\PSHED.dll
PSHED.dll
PSHED.dll
\SystemRoot\system32\CI.dll
\SystemRoot\system32\CI.dll
CI.dll
CI.dll
\SystemRoot\system32\DRIVERS\WMILIB.SYS
\SystemRoot\system32\DRIVERS\WMILIB.SYS
wmilib.sys
wmilib.sys
Cannot find %s for IAT resolving of %s
Cannot find %s for IAT resolving of %s
Cannot alloc %X bytes for drivers IAT checking
Cannot alloc %X bytes for drivers IAT checking
Cannot find %s import %s.%s
Cannot find %s import %s.%s
Cannot find %s import %s.%d
Cannot find %s import %s.%d
IAT %s %s.%s patched, addr %p
IAT %s %s.%s patched, addr %p
IAT %s %s.%d patched, addr %p
IAT %s %s.%d patched, addr %p
IAT %s %s.%s patched by %s, addr %p
IAT %s %s.%s patched by %s, addr %p
IAT %s %s.%d patched by %s, addr %p
IAT %s %s.%d patched by %s, addr %p
%s has %d patched IAT entries (total %d)
%s has %d patched IAT entries (total %d)
reading of IAT %s failed, readed %X, actual IAT size %X, error %d
reading of IAT %s failed, readed %X, actual IAT size %X, error %d
check_exts count failed, error %d, ntstatus %X
check_exts count failed, error %d, ntstatus %X
check_exts count failed, error %d
check_exts count failed, error %d
check_exts: cannot alloc %X bytes
check_exts: cannot alloc %X bytes
check_exts failed, error %d, ntstatus %X
check_exts failed, error %d, ntstatus %X
check_exts failed, error %d
check_exts failed, error %d
Ext[%X]:
Ext[%X]:
Handler1: %p %s
Handler1: %p %s
Handler2: %p %s
Handler2: %p %s
Handler3: %p %s
Handler3: %p %s
Table: %X items %p %s
Table: %X items %p %s
Item[%X]: %p %s
Item[%X]: %p %s
IRP_MJ_CREATE_NAMED_PIPE
IRP_MJ_CREATE_NAMED_PIPE
Unknown fltmgr: FrameList %X FilterSize %X cbn %X
Unknown fltmgr: FrameList %X FilterSize %X cbn %X
Unknown fltmgr: FrameList %X FilterSize %X
Unknown fltmgr: FrameList %X FilterSize %X
FltMgr: index %d
FltMgr: index %d
FRAME[%d] %p
FRAME[%d] %p
%s: %p
%s: %p
NormalizeNameComponent: %p %s
NormalizeNameComponent: %p %s
NormalizeContextCleanup: %p %s
NormalizeContextCleanup: %p %s
PreOperation: %p %s
PreOperation: %p %s
PostOperation: %p %s
PostOperation: %p %s
check_ks: cannot read size of ks list, error %d, ntstatus %X
check_ks: cannot read size of ks list, error %d, ntstatus %X
check_ks: cannot read size of ks list, error %d
check_ks: cannot read size of ks list, error %d
ks count: %X
ks count: %X
check_ks: cannot alloc %X bytes
check_ks: cannot alloc %X bytes
check_ks: cannot read ks list, error %d, ntstatus %X
check_ks: cannot read ks list, error %d, ntstatus %X
check_ks: cannot read ks list, error %d
check_ks: cannot read ks list, error %d
ks[%d] %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X
ks[%d] %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X
ChangeAccountPassword
ChangeAccountPassword
ImportSecurityContext
ImportSecurityContext
ExportSecurityContext
ExportSecurityContext
gKsecpBCryptExtension: %p %s
gKsecpBCryptExtension: %p %s
gKsecpSslExtension: %p %s
gKsecpSslExtension: %p %s
SecTable.%s patched %p %s
SecTable.%s patched %p %s
dxg.sys
dxg.sys
dxgkrnl.sys
dxgkrnl.sys
Win32kCallout: %p %s
Win32kCallout: %p %s
SessionStartCallout: %p %s
SessionStartCallout: %p %s
KTIMER %p DPC %p DefRoutine %p %s
KTIMER %p DPC %p DefRoutine %p %s
Cannot find KPRCB.DpcRoutineActive
Cannot find KPRCB.DpcRoutineActive
Unknown KPRCB: DpcRoutineActive %X WorkerRoutine %X
Unknown KPRCB: DpcRoutineActive %X WorkerRoutine %X
Unknown KPRCB: DpcRoutineActive %X
Unknown KPRCB: DpcRoutineActive %X
Processor %d:
Processor %d:
KTIMERS[%d]: %X
KTIMERS[%d]: %X
Patched %s %X by %s
Patched %s %X by %s
Patched ord.%d %X by %s
Patched ord.%d %X by %s
Patched %s %X
Patched %s %X
Patched ord.%d %X
Patched ord.%d %X
Patched %s by %s
Patched %s by %s
Patched ord.%d by %s
Patched ord.%d by %s
Patched %s
Patched %s
Patched ord.%d
Patched ord.%d
Exception %X occured during EAT checking of %s
Exception %X occured during EAT checking of %s
check_module_iat(%s) - cannot find exports for %s
check_module_iat(%s) - cannot find exports for %s
check_module_iat(%s): zeroed ImportLookUp, cannot check import
check_module_iat(%s): zeroed ImportLookUp, cannot check import
Cannot find ordinal %X in module %s (%s) in import table of %s
Cannot find ordinal %X in module %s (%s) in import table of %s
Cannot find symbol %s in module %s (%s) in import table of %s
Cannot find symbol %s in module %s (%s) in import table of %s
(%s) %s.%s hooked in %s: my IAT %p, must be %p
(%s) %s.%s hooked in %s: my IAT %p, must be %p
(%s) %s.%d hooked in %s: my IAT %p, must be %p
(%s) %s.%d hooked in %s: my IAT %p, must be %p
apfn %s patched by %s, addr %p
apfn %s patched by %s, addr %p
apfn[%d] patched by %s, addr %p
apfn[%d] patched by %s, addr %p
apfn %s patched, addr %p
apfn %s patched, addr %p
apfn[%d] patched, addr %p
apfn[%d] patched, addr %p
%s%s!%s patched by %s, addr %p
%s%s!%s patched by %s, addr %p
%s%s![%d] patched by %s, addr %p
%s%s![%d] patched by %s, addr %p
%s%s!%s patched, addr %p
%s%s!%s patched, addr %p
%s%s![%d] patched, addr %p
%s%s![%d] patched, addr %p
LSA SP %s has %d patched functions in SECPKG_FUNCTION_TABLE:
LSA SP %s has %d patched functions in SECPKG_FUNCTION_TABLE:
PID %d: LSA SP %s has %d patched functions in SECPKG_USER_FUNCTION_TABLE:
PID %d: LSA SP %s has %d patched functions in SECPKG_USER_FUNCTION_TABLE:
PID %d: LSA SP %s has %d patched functions in CallPackageDispatch:
PID %d: LSA SP %s has %d patched functions in CallPackageDispatch:
ole32 hooked by %s
ole32 hooked by %s
Cannot relocate section %s!%s
Cannot relocate section %s!%s
Exception %X occured on checking %s!%s
Exception %X occured on checking %s!%s
Module %s!%s has %X patched bytes !
Module %s!%s has %X patched bytes !
Exception %X occured on check_module_iat(%s)
Exception %X occured on check_module_iat(%s)
MyModule: %p %s
MyModule: %p %s
%SystemRoot%\System32\ncrypt.dll
%SystemRoot%\System32\ncrypt.dll
%SystemRoot%\System32\ntdsa.dll
%SystemRoot%\System32\ntdsa.dll
%SystemRoot%\System32\kernelbase.dll
%SystemRoot%\System32\kernelbase.dll
%SystemRoot%\System32\kernel32.dll
%SystemRoot%\System32\kernel32.dll
%SystemRoot%\System32\user32.dll
%SystemRoot%\System32\user32.dll
%SystemRoot%\System32\umpnpmgr.dll
%SystemRoot%\System32\umpnpmgr.dll
%SystemRoot%\System32\combase.dll
%SystemRoot%\System32\combase.dll
%SystemRoot%\System32\ole32.dll
%SystemRoot%\System32\ole32.dll
%SystemRoot%\System32\imm32.dll
%SystemRoot%\System32\imm32.dll
%SystemRoot%\System32\rpcrt4.dll
%SystemRoot%\System32\rpcrt4.dll
%SystemRoot%\System32\mswsock.dll
%SystemRoot%\System32\mswsock.dll
%SystemRoot%\System32\advapi32.dll
%SystemRoot%\System32\advapi32.dll
%SystemRoot%\System32\cryptbase.dll
%SystemRoot%\System32\cryptbase.dll
%SystemRoot%\System32\apisetschema.dll
%SystemRoot%\System32\apisetschema.dll
read_ndis_oid_handlers failed, returned %d bytes, error %d, ntstatus %X
read_ndis_oid_handlers failed, returned %d bytes, error %d, ntstatus %X
read_ndis_oid_handlers failed, returned %d bytes, error %d
read_ndis_oid_handlers failed, returned %d bytes, error %d
[%X] %s: post %p %s
[%X] %s: post %p %s
[%X] %s: pre %p %s
[%X] %s: pre %p %s
[%X] %s: pre %p (%s) post %p (%s)
[%X] %s: pre %p (%s) post %p (%s)
[%X] %X: post %p %s
[%X] %X: post %p %s
[%X] %X: pre %p %s
[%X] %X: pre %p %s
[%X] %X: pre %p (%s) post %p (%s)
[%X] %X: pre %p (%s) post %p (%s)
read_tcp_off_handlers failed, returned %d bytes, error %d, ntstatus %X
read_tcp_off_handlers failed, returned %d bytes, error %d, ntstatus %X
read_tcp_off_handlers failed, returned %d bytes, error %d
read_tcp_off_handlers failed, returned %d bytes, error %d
TcpOfflineHandlers:
TcpOfflineHandlers:
TcpOffloadEventIndicate: %p %s
TcpOffloadEventIndicate: %p %s
TcpOffloadReceiveIndicate: %p %s
TcpOffloadReceiveIndicate: %p %s
TcpOffloadSendComplete: %p %s
TcpOffloadSendComplete: %p %s
TcpOffloadReceiveComplete: %p %s
TcpOffloadReceiveComplete: %p %s
TcpOffloadDisconnectComplete: %p %s
TcpOffloadDisconnectComplete: %p %s
TcpOffloadForwardComplete: %p %s
TcpOffloadForwardComplete: %p %s
Cannot alloc %X bytes from reading filter block
Cannot alloc %X bytes from reading filter block
read_ndis_filter_block: len %d, returned %d bytes, error %d, ntstatus %X
read_ndis_filter_block: len %d, returned %d bytes, error %d, ntstatus %X
read_ndis_filter_block: len %d, returned %d bytes, error %d
read_ndis_filter_block: len %d, returned %d bytes, error %d
check_ndis - reading of TDI callback failed, error %d, ntstatus %X
check_ndis - reading of TDI callback failed, error %d, ntstatus %X
check_ndis - reading of TDI callback failed, error %d
check_ndis - reading of TDI callback failed, error %d
check_ndis - reading of TDI PnP handler failed, error %d, ntstatus %X
check_ndis - reading of TDI PnP handler failed, error %d, ntstatus %X
check_ndis - reading of TDI PnP handler failed, error %d
check_ndis - reading of TDI PnP handler failed, error %d
TDI callback %p patched by %s
TDI callback %p patched by %s
TDI PnP handler %p patched by %s
TDI PnP handler %p patched by %s
check_ndis - reading of providers count failed, error %d, ntstatus %X
check_ndis - reading of providers count failed, error %d, ntstatus %X
check_ndis - reading of providers count failed, error %d
check_ndis - reading of providers count failed, error %d
check_ndis: %d providers
check_ndis: %d providers
check_ndis: cannot alloc %X bytes
check_ndis: cannot alloc %X bytes
Cannot store provider_block %p (%d)
Cannot store provider_block %p (%d)
check_ndis: stored %d provider_blocks
check_ndis: stored %d provider_blocks
check_ndis - reading of interfaces count failed, error %d, ntstatus %X
check_ndis - reading of interfaces count failed, error %d, ntstatus %X
check_ndis - reading of interfaces count failed, error %d
check_ndis - reading of interfaces count failed, error %d
check_ndis: %d interfaces, size of miniport %X
check_ndis: %d interfaces, size of miniport %X
Interface[%d]:
Interface[%d]:
check_ndis - reading of protocols count failed, error %d, ntstatus %X
check_ndis - reading of protocols count failed, error %d, ntstatus %X
check_ndis - reading of protocols count failed, error %d
check_ndis - reading of protocols count failed, error %d
check_ndis: %d protocols, size of protocol %X
check_ndis: %d protocols, size of protocol %X
check_ndis: stored %d protocols
check_ndis: stored %d protocols
check_ndis - reading of minidrivers count failed, error %d, ntstatus %X
check_ndis - reading of minidrivers count failed, error %d, ntstatus %X
check_ndis - reading of minidrivers count failed, error %d
check_ndis - reading of minidrivers count failed, error %d
check_ndis: %d minidrivers, size of minidriver %X, sizeof(ndis50) %X, sizeof(ndis52) %X
check_ndis: %d minidrivers, size of minidriver %X, sizeof(ndis50) %X, sizeof(ndis52) %X
Cannot store minidriver %d (%p)
Cannot store minidriver %d (%p)
Stored %d mini-drivers
Stored %d mini-drivers
check_ndis - reading of miniports count failed, error %d, ntstatus %X
check_ndis - reading of miniports count failed, error %d, ntstatus %X
check_ndis - reading of miniports count failed, error %d
check_ndis - reading of miniports count failed, error %d
check_ndis: %d miniports, size of miniport %X
check_ndis: %d miniports, size of miniport %X
check_ndis: read %d miniports, total %X
check_ndis: read %d miniports, total %X
Miniport[%d] %p:
Miniport[%d] %p:
check_ndis: stored %d miniports, sizeof(miniport_block_w7) %X
check_ndis: stored %d miniports, sizeof(miniport_block_w7) %X
check_ndis - reading of open_blocks count failed, error %d, ntstatus %X
check_ndis - reading of open_blocks count failed, error %d, ntstatus %X
check_ndis - reading of open_blocks count failed, error %d
check_ndis - reading of open_blocks count failed, error %d
check_ndis: %d open_blocks, size of open_block %X
check_ndis: %d open_blocks, size of open_block %X
check_ndis: read %d open_blocks, total %X
check_ndis: read %d open_blocks, total %X
Open_Block[%d]:
Open_Block[%d]:
Cannot store open_block %p (%d)
Cannot store open_block %p (%d)
check_ndis: stored %d open_blocks
check_ndis: stored %d open_blocks
check_ndis - reading of filter_drivers count failed, error %d, ntstatus %X
check_ndis - reading of filter_drivers count failed, error %d, ntstatus %X
check_ndis - reading of filter_drivers count failed, error %d
check_ndis - reading of filter_drivers count failed, error %d
check_ndis: %d filter_drivers, size of open_block %X
check_ndis: %d filter_drivers, size of open_block %X
check_ndis: read %d filter_drivers, total %X
check_ndis: read %d filter_drivers, total %X
FilterDriver[%d]:
FilterDriver[%d]:
check_ndis: stored %d filter_drivers, %d filter_blocks
check_ndis: stored %d filter_drivers, %d filter_blocks
Passive
Passive
read_punicode_string failed, len %d, returned %d bytes, error %d, ntstatus %X
read_punicode_string failed, len %d, returned %d bytes, error %d, ntstatus %X
read_punicode_string failed, len %d, returned %d bytes, error %d
read_punicode_string failed, len %d, returned %d bytes, error %d
Cannot read NDIS_MINIPORT_INTERRUPT %p
Cannot read NDIS_MINIPORT_INTERRUPT %p
NDIS_MINIPORT_INTERRUPT:
NDIS_MINIPORT_INTERRUPT:
MiniportIsr: %p %s
MiniportIsr: %p %s
MiniportDpc: %p %s
MiniportDpc: %p %s
Cannot read NDIS_MINIPORT_INTERRUPT_CHARACTERISTICS %p
Cannot read NDIS_MINIPORT_INTERRUPT_CHARACTERISTICS %p
NDIS_MINIPORT_INTERRUPT_CHARACTERISTICS:
NDIS_MINIPORT_INTERRUPT_CHARACTERISTICS:
InterruptHandler: %p %s
InterruptHandler: %p %s
InterruptDpcHandler: %p %s
InterruptDpcHandler: %p %s
DisableInterruptHandler: %p %s
DisableInterruptHandler: %p %s
EnableInterruptHandler: %p %s
EnableInterruptHandler: %p %s
MessageInterruptHandler: %p %s
MessageInterruptHandler: %p %s
MessageInterruptDpcHandler: %p %s
MessageInterruptDpcHandler: %p %s
DisableMessageInterruptHandler: %p %s
DisableMessageInterruptHandler: %p %s
EnableMessageInterruptHandler: %p %s
EnableMessageInterruptHandler: %p %s
MiniportIsr: %p %s
MiniportIsr: %p %s
MiniportDpc: %p %s
MiniportDpc: %p %s
MiniportMessageIsr: %p %s
MiniportMessageIsr: %p %s
MiniportMessageInterruptDpc: %p %s
MiniportMessageInterruptDpc: %p %s
MiniportIsr: %p %s
MiniportIsr: %p %s
MiniportDpc: %p %s
MiniportDpc: %p %s
MiniportEnableInterrupt: %p %s
MiniportEnableInterrupt: %p %s
MiniportDisableInterrupt: %p %s
MiniportDisableInterrupt: %p %s
MiniportMessageIsr: %p %s
MiniportMessageIsr: %p %s
MiniportMessageInterruptDpc: %p %s
MiniportMessageInterruptDpc: %p %s
MiniportDisableMessageInterrupt: %p %s
MiniportDisableMessageInterrupt: %p %s
MiniportEnableMessageInterrupt: %p %s
MiniportEnableMessageInterrupt: %p %s
NDIS Protocol[%d]: %S
NDIS Protocol[%d]: %S
MajorNdisVersion %d
MajorNdisVersion %d
MinorNdisVersion %d
MinorNdisVersion %d
Flags %X
Flags %X
OpenAdapterCompleteHandler: %p %s
OpenAdapterCompleteHandler: %p %s
CloseAdapterCompleteHandler: %p %s
CloseAdapterCompleteHandler: %p %s
SendCompleteHandler: %p %s
SendCompleteHandler: %p %s
TransferDataCompleteHandler: %p %s
TransferDataCompleteHandler: %p %s
ResetCompleteHandler: %p %s
ResetCompleteHandler: %p %s
RequestCompleteHandler: %p %s
RequestCompleteHandler: %p %s
ReceiveHandler: %p %s
ReceiveHandler: %p %s
ReceiveCompleteHandler: %p %s
ReceiveCompleteHandler: %p %s
StatusHandler: %p %s
StatusHandler: %p %s
StatusCompleteHandler: %p %s
StatusCompleteHandler: %p %s
ReceivePacketHandler: %p %s
ReceivePacketHandler: %p %s
BindAdapterHandler: %p %s
BindAdapterHandler: %p %s
UnbindAdapterHandler: %p %s
UnbindAdapterHandler: %p %s
PnPEventHandler: %p %s
PnPEventHandler: %p %s
UnloadHandler: %p %s
UnloadHandler: %p %s
CoSendCompleteHandler: %p %s
CoSendCompleteHandler: %p %s
CoStatusHandler: %p %s
CoStatusHandler: %p %s
CoReceivePacketHandler: %p %s
CoReceivePacketHandler: %p %s
CoAfRegisterNotifyHandler: %p %s
CoAfRegisterNotifyHandler: %p %s
MajorNdisVersion %d
MajorNdisVersion %d
MinorNdisVersion %d
MinorNdisVersion %d
MajorDriverVersion %d
MajorDriverVersion %d
MinorDriverVersion %d
MinorDriverVersion %d
Flags %X
Flags %X
IsIPv4 %d
IsIPv4 %d
IsIPv6 %d
IsIPv6 %d
IsNdisTest6 %d
IsNdisTest6 %d
BindAdapterHandlerEx: %p %s
BindAdapterHandlerEx: %p %s
UnbindAdapterHandlerEx: %p %s
UnbindAdapterHandlerEx: %p %s
OpenAdapterCompleteHandlerEx: %p %s
OpenAdapterCompleteHandlerEx: %p %s
CloseAdapterCompleteHandlerEx: %p %s
CloseAdapterCompleteHandlerEx: %p %s
PnPEventHandler: %p %s
PnPEventHandler: %p %s
UnloadHandler: %p %s
UnloadHandler: %p %s
UninstallHandler: %p %s
UninstallHandler: %p %s
RequestCompleteHandler: %p %s
RequestCompleteHandler: %p %s
StatusHandler: %p %s
StatusHandler: %p %s
StatusCompleteHandler: %p %s
StatusCompleteHandler: %p %s
ReceiveNetBufferListsHandler: %p %s
ReceiveNetBufferListsHandler: %p %s
SendNetBufferListsCompleteHandler: %p %s
SendNetBufferListsCompleteHandler: %p %s
CoStatusHandler: %p %s
CoStatusHandler: %p %s
CoAfRegisterNotifyHandler: %p %s
CoAfRegisterNotifyHandler: %p %s
CoReceiveNetBufferListsHandler: %p %s
CoReceiveNetBufferListsHandler: %p %s
CoSendNetBufferListsCompleteHandler: %p %s
CoSendNetBufferListsCompleteHandler: %p %s
OpenAdapterCompleteHandler: %p %s
OpenAdapterCompleteHandler: %p %s
CloseAdapterCompleteHandler: %p %s
CloseAdapterCompleteHandler: %p %s
SendCompleteHandler: %p %s
SendCompleteHandler: %p %s
TransferDataCompleteHandler: %p %s
TransferDataCompleteHandler: %p %s
ResetCompleteHandler: %p %s
ResetCompleteHandler: %p %s
ReceiveHandler: %p %s
ReceiveHandler: %p %s
ReceiveCompleteHandler: %p %s
ReceiveCompleteHandler: %p %s
ReceivePacketHandler: %p %s
ReceivePacketHandler: %p %s
BindAdapterHandler: %p %s
BindAdapterHandler: %p %s
UnbindAdapterHandler: %p %s
UnbindAdapterHandler: %p %s
CoSendCompleteHandler: %p %s
CoSendCompleteHandler: %p %s
CoReceivePacketHandler: %p %s
CoReceivePacketHandler: %p %s
OidRequestCompleteHandler: %p %s
OidRequestCompleteHandler: %p %s
InitiateOffloadCompleteHandler: %p %s
InitiateOffloadCompleteHandler: %p %s
TerminateOffloadCompleteHandler: %p %s
TerminateOffloadCompleteHandler: %p %s
UpdateOffloadCompleteHandler: %p %s
UpdateOffloadCompleteHandler: %p %s
InvalidateOffloadCompleteHandler: %p %s
InvalidateOffloadCompleteHandler: %p %s
QueryOffloadCompleteHandler: %p %s
QueryOffloadCompleteHandler: %p %s
IndicateOffloadEventHandler: %p %s
IndicateOffloadEventHandler: %p %s
TcpOffloadSendCompleteHandler: %p %s
TcpOffloadSendCompleteHandler: %p %s
TcpOffloadReceiveCompleteHandler: %p %s
TcpOffloadReceiveCompleteHandler: %p %s
TcpOffloadDisconnectCompleteHandler: %p %s
TcpOffloadDisconnectCompleteHandler: %p %s
TcpOffloadForwardCompleteHandler: %p %s
TcpOffloadForwardCompleteHandler: %p %s
TcpOffloadEventHandler: %p %s
TcpOffloadEventHandler: %p %s
TcpOffloadReceiveIndicateHandler: %p %s
TcpOffloadReceiveIndicateHandler: %p %s
Unknown NDIS Type %X and Size %X
Unknown NDIS Type %X and Size %X
DirectOidRequestCompleteHandler: %p %s
DirectOidRequestCompleteHandler: %p %s
AllocateSharedMemoryHandler: %p %s
AllocateSharedMemoryHandler: %p %s
FreeSharedMemoryHandler: %p %s
FreeSharedMemoryHandler: %p %s
Unknown ndis protocol size: %X
Unknown ndis protocol size: %X
NDIS MiniDriver[%d] %p
NDIS MiniDriver[%d] %p
MajorNdisVersion: %d
MajorNdisVersion: %d
MinorNdisVersion: %d
MinorNdisVersion: %d
CheckForHangHandler: %p %s
CheckForHangHandler: %p %s
DisableInterruptHandler: %p %s
DisableInterruptHandler: %p %s
EnableInterruptHandler: %p %s
EnableInterruptHandler: %p %s
HaltHandler %p %s
HaltHandler %p %s
HandleInterruptHandler: %p %s
HandleInterruptHandler: %p %s
InitializeHandler: %p %s
InitializeHandler: %p %s
ISRHandler: %p %s
ISRHandler: %p %s
QueryInformationHandler: %p %s
QueryInformationHandler: %p %s
ReconfigureHandler: %p %s
ReconfigureHandler: %p %s
ResetHandler: %p %s
ResetHandler: %p %s
SendHandler: %p %s
SendHandler: %p %s
SetInformationHandler: %p %s
SetInformationHandler: %p %s
TransferDataHandler: %p %s
TransferDataHandler: %p %s
ReturnPacketHandler: %p %s
ReturnPacketHandler: %p %s
SendPacketsHandler: %p %s
SendPacketsHandler: %p %s
AllocateCompleteHandler: %p %s
AllocateCompleteHandler: %p %s
CoCreateVcHandler: %p %s
CoCreateVcHandler: %p %s
CoDeleteVcHandler: %p %s
CoDeleteVcHandler: %p %s
CoActivateVcHandler: %p %s
CoActivateVcHandler: %p %s
CoDeactivateVcHandler: %p %s
CoDeactivateVcHandler: %p %s
CoSendPacketsHandler: %p %s
CoSendPacketsHandler: %p %s
CoRequestHandler: %p %s
CoRequestHandler: %p %s
CheckForHangHandler: %p %s
CheckForHangHandler: %p %s
DisableInterruptHandler: %p %s
DisableInterruptHandler: %p %s
EnableInterruptHandler: %p %s
EnableInterruptHandler: %p %s
HaltHandler %p %s
HaltHandler %p %s
HandleInterruptHandler: %p %s
HandleInterruptHandler: %p %s
InitializeHandler: %p %s
InitializeHandler: %p %s
ISRHandler: %p %s
ISRHandler: %p %s
QueryInformationHandler: %p %s
QueryInformationHandler: %p %s
ReconfigureHandler: %p %s
ReconfigureHandler: %p %s
ResetHandler: %p %s
ResetHandler: %p %s
SendHandler: %p %s
SendHandler: %p %s
SetInformationHandler: %p %s
SetInformationHandler: %p %s
TransferDataHandler: %p %s
TransferDataHandler: %p %s
ReturnPacketHandler: %p %s
ReturnPacketHandler: %p %s
SendPacketsHandler: %p %s
SendPacketsHandler: %p %s
AllocateCompleteHandler: %p %s
AllocateCompleteHandler: %p %s
CoCreateVcHandler: %p %s
CoCreateVcHandler: %p %s
CoDeleteVcHandler: %p %s
CoDeleteVcHandler: %p %s
CoActivateVcHandler: %p %s
CoActivateVcHandler: %p %s
CoDeactivateVcHandler: %p %s
CoDeactivateVcHandler: %p %s
CoSendPacketsHandler: %p %s
CoSendPacketsHandler: %p %s
CoRequestHandler: %p %s
CoRequestHandler: %p %s
CancelSendPacketsHandler: %p %s
CancelSendPacketsHandler: %p %s
PnPEventNotifyHandler: %p %s
PnPEventNotifyHandler: %p %s
AdapterShutdownHandler: %p %s
AdapterShutdownHandler: %p %s
CheckForHangHandler: %p %s
CheckForHangHandler: %p %s
DisableInterruptHandler: %p %s
DisableInterruptHandler: %p %s
EnableInterruptHandler: %p %s
EnableInterruptHandler: %p %s
HaltHandler %p %s
HaltHandler %p %s
HandleInterruptHandler: %p %s
HandleInterruptHandler: %p %s
InitializeHandler: %p %s
InitializeHandler: %p %s
ISRHandler: %p %s
ISRHandler: %p %s
QueryInformationHandler: %p %s
QueryInformationHandler: %p %s
ReconfigureHandler: %p %s
ReconfigureHandler: %p %s
ResetHandler: %p %s
ResetHandler: %p %s
SendHandler: %p %s
SendHandler: %p %s
SetInformationHandler: %p %s
SetInformationHandler: %p %s
TransferDataHandler: %p %s
TransferDataHandler: %p %s
ReturnPacketHandler: %p %s
ReturnPacketHandler: %p %s
SendPacketsHandler: %p %s
SendPacketsHandler: %p %s
AllocateCompleteHandler: %p %s
AllocateCompleteHandler: %p %s
CoCreateVcHandler: %p %s
CoCreateVcHandler: %p %s
CoDeleteVcHandler: %p %s
CoDeleteVcHandler: %p %s
CoActivateVcHandler: %p %s
CoActivateVcHandler: %p %s
CoDeactivateVcHandler: %p %s
CoDeactivateVcHandler: %p %s
CoSendPacketsHandler: %p %s
CoSendPacketsHandler: %p %s
CoRequestHandler: %p %s
CoRequestHandler: %p %s
CancelSendPacketsHandler: %p %s
CancelSendPacketsHandler: %p %s
PnPEventNotifyHandler: %p %s
PnPEventNotifyHandler: %p %s
AdapterShutdownHandler: %p %s
AdapterShutdownHandler: %p %s
ISRHandlerEx: %p %s
ISRHandlerEx: %p %s
HandleInterruptHandlerEx: %p %s
HandleInterruptHandlerEx: %p %s
InitiateOffloadHandler: %p %s
InitiateOffloadHandler: %p %s
TerminateOffloadHandler: %p %s
TerminateOffloadHandler: %p %s
UpdateOffloadHandler: %p %s
UpdateOffloadHandler: %p %s
InvalidateOffloadHandler: %p %s
InvalidateOffloadHandler: %p %s
QueryOffloadHandler: %p %s
QueryOffloadHandler: %p %s
TcpOffloadSendHandler: %p %s
TcpOffloadSendHandler: %p %s
TcpOffloadReceiveHandler: %p %s
TcpOffloadReceiveHandler: %p %s
TcpOffloadDisconnectHandler: %p %s
TcpOffloadDisconnectHandler: %p %s
TcpOffloadForwardHandler: %p %s
TcpOffloadForwardHandler: %p %s
TcpOffloadReceiveReturnHandler: %p %s
TcpOffloadReceiveReturnHandler: %p %s
ReturnPacketsHandlerEx: %p %s
ReturnPacketsHandlerEx: %p %s
RequestTimeoutDpcHandler: %p %s
RequestTimeoutDpcHandler: %p %s
MajorNdisVersion: %d
MajorNdisVersion: %d
MinorNdisVersion: %d
MinorNdisVersion: %d
MajorDriverVersion: %d
MajorDriverVersion: %d
MinorDriverVersion: %d
MinorDriverVersion: %d
Flags: %X
Flags: %X
SetOptionsHandler: %p %s
SetOptionsHandler: %p %s
InitializeHandlerEx: %p %s
InitializeHandlerEx: %p %s
HaltHandlerEx: %p %s
HaltHandlerEx: %p %s
UnloadHandler: %p %s
UnloadHandler: %p %s
PauseHandler: %p %s
PauseHandler: %p %s
RestartHandler: %p %s
RestartHandler: %p %s
OidRequestHandler: %p %s
OidRequestHandler: %p %s
SendNetBufferListsHandler: %p %s
SendNetBufferListsHandler: %p %s
ReturnNetBufferListsHandler: %p %s
ReturnNetBufferListsHandler: %p %s
CancelSendHandler: %p %s
CancelSendHandler: %p %s
CheckForHangHandlerEx: %p %s
CheckForHangHandlerEx: %p %s
ResetHandlerEx: %p %s
ResetHandlerEx: %p %s
DevicePnPEventNotifyHandler: %p %s
DevicePnPEventNotifyHandler: %p %s
ShutdownHandlerEx: %p %s
ShutdownHandlerEx: %p %s
CancelOidRequestHandler: %p %s
CancelOidRequestHandler: %p %s
DirectOidRequestHandler: %p %s
DirectOidRequestHandler: %p %s
CancelDirectOidRequestHandler: %p %s
CancelDirectOidRequestHandler: %p %s
NDIS MiniPort[%d] %p
NDIS MiniPort[%d] %p
State: %s
State: %s
MediaType: %s
MediaType: %s
AdapterType: %s
AdapterType: %s
DefaultSendAuthorizationState: %s
DefaultSendAuthorizationState: %s
DefaultRcvAuthorizationState: %s
DefaultRcvAuthorizationState: %s
DefaultPortSendAuthorizationState: %s
DefaultPortSendAuthorizationState: %s
DefaultPortRcvAuthorizationState: %s
DefaultPortRcvAuthorizationState: %s
NextCancelSendNetBufferListsHandler: %p %s
NextCancelSendNetBufferListsHandler: %p %s
PacketIndicateHandler: %p %s
PacketIndicateHandler: %p %s
SendCompleteHandler: %p %s
SendCompleteHandler: %p %s
SendResourcesHandler: %p %s
SendResourcesHandler: %p %s
ResetCompleteHandler: %p %s
ResetCompleteHandler: %p %s
DisableInterruptHandler: %p %s
DisableInterruptHandler: %p %s
EnableInterruptHandler: %p %s
EnableInterruptHandler: %p %s
SendPacketsHandler: %p %s
SendPacketsHandler: %p %s
DeferredSendHandler: %p %s
DeferredSendHandler: %p %s
EthRxIndicateHandler: %p %s
EthRxIndicateHandler: %p %s
NextSendNetBufferListsHandler: %p %s
NextSendNetBufferListsHandler: %p %s
EthRxCompleteHandler: %p %s
EthRxCompleteHandler: %p %s
SavedNextSendNetBufferListsHandler: %p %s
SavedNextSendNetBufferListsHandler: %p %s
StatusHandler: %p %s
StatusHandler: %p %s
StatusCompleteHandler: %p %s
StatusCompleteHandler: %p %s
TDCompleteHandler: %p %s
TDCompleteHandler: %p %s
QueryCompleteHandler: %p %s
QueryCompleteHandler: %p %s
SetCompleteHandler: %p %s
SetCompleteHandler: %p %s
WanSendCompleteHandler: %p %s
WanSendCompleteHandler: %p %s
WanRcvHandler: %p %s
WanRcvHandler: %p %s
WanRcvCompleteHandler: %p %s
WanRcvCompleteHandler: %p %s
SendNetBufferListsCompleteHandler: %p %s
SendNetBufferListsCompleteHandler: %p %s
WSendPacketsHandler: %p %s
WSendPacketsHandler: %p %s
NextSendPacketsHandler: %p %s
NextSendPacketsHandler: %p %s
FinalSendPacketsHandler: %p %s
FinalSendPacketsHandler: %p %s
TopIndicateNetBufferListsHandler: %p %s
TopIndicateNetBufferListsHandler: %p %s
TopIndicateLoopbackNetBufferListsHandler: %p %s
TopIndicateLoopbackNetBufferListsHandler: %p %s
Ndis5PacketIndicateHandler: %p %s
Ndis5PacketIndicateHandler: %p %s
MiniportReturnPacketHandler: %p %s
MiniportReturnPacketHandler: %p %s
SynchronousReturnPacketHandler: %p %s
SynchronousReturnPacketHandler: %p %s
TopNdis5PacketIndicateHandler: %p %s
TopNdis5PacketIndicateHandler: %p %s
AllocateSharedMemoryHandler: %p %s
AllocateSharedMemoryHandler: %p %s
FreeSharedMemoryHandler: %p %s
FreeSharedMemoryHandler: %p %s
SetBusData: %p %s
SetBusData: %p %s
GetBusData: %p %s
GetBusData: %p %s
NoFilter.CancelSendHandler %p %s
NoFilter.CancelSendHandler %p %s
NoFilter.SendNetBufferListsCompleteHandler %p %s
NoFilter.SendNetBufferListsCompleteHandler %p %s
NoFilter.IndicateNetBufferListsHandler %p %s
NoFilter.IndicateNetBufferListsHandler %p %s
NoFilter.SaveIndicateNetBufferListsHandler %p %s
NoFilter.SaveIndicateNetBufferListsHandler %p %s
NoFilter.ReturnNetBufferListsHandler %p %s
NoFilter.ReturnNetBufferListsHandler %p %s
NoFilter.SendNetBufferListsHandler %p %s
NoFilter.SendNetBufferListsHandler %p %s
Next.CancelSendHandler %p %s
Next.CancelSendHandler %p %s
Next.SendNetBufferListsCompleteHandler %p %s
Next.SendNetBufferListsCompleteHandler %p %s
Next.IndicateNetBufferListsHandler %p %s
Next.IndicateNetBufferListsHandler %p %s
Next.SaveIndicateNetBufferListsHandler %p %s
Next.SaveIndicateNetBufferListsHandler %p %s
Next.ReturnNetBufferListsHandler %p %s
Next.ReturnNetBufferListsHandler %p %s
Next.SendNetBufferListsHandler %p %s
Next.SendNetBufferListsHandler %p %s
Name: %S
Name: %S
BaseName: %S
BaseName: %S
SymbolicLinkName: %S
SymbolicLinkName: %S
NextCancelSendNetBufferListsHandler %p %s
NextCancelSendNetBufferListsHandler %p %s
TrRxIndicateHandler: %p %s
TrRxIndicateHandler: %p %s
TrRxCompleteHandler: %p %s
TrRxCompleteHandler: %p %s
IndicateNetBufferListsHandler: %p %s
IndicateNetBufferListsHandler: %p %s
NextReturnNetBufferLists: %p %s
NextReturnNetBufferLists: %p %s
SavedIndicateNetBufferListsHandler: %p %s
SavedIndicateNetBufferListsHandler: %p %s
SavedPacketIndicateHandler: %p %s
SavedPacketIndicateHandler: %p %s
ShutdownHandler: %p %s
ShutdownHandler: %p %s
NDIS MiniPort[%d] %S
NDIS MiniPort[%d] %S
BusType: %s
BusType: %s
PacketIndicateHandler: %p %s
PacketIndicateHandler: %p %s
SendCompleteHandler: %p %s
SendCompleteHandler: %p %s
SendResourcesHandler: %p %s
SendResourcesHandler: %p %s
ResetCompleteHandler: %p %s
ResetCompleteHandler: %p %s
DeferredSendHandler: %p %s
DeferredSendHandler: %p %s
EthRxIndicateHandler: %p %s
EthRxIndicateHandler: %p %s
TrRxIndicateHandler: %p %s
TrRxIndicateHandler: %p %s
FddiRxIndicateHandler: %p %s
FddiRxIndicateHandler: %p %s
EthRxCompleteHandler: %p %s
EthRxCompleteHandler: %p %s
TrRxCompleteHandler: %p %s
TrRxCompleteHandler: %p %s
FddiRxCompleteHandler: %p %s
FddiRxCompleteHandler: %p %s
StatusHandler: %p %s
StatusHandler: %p %s
StatusCompleteHandler: %p %s
StatusCompleteHandler: %p %s
TDCompleteHandler: %p %s
TDCompleteHandler: %p %s
QueryCompleteHandler: %p %s
QueryCompleteHandler: %p %s
SetCompleteHandler: %p %s
SetCompleteHandler: %p %s
WanSendCompleteHandler: %p %s
WanSendCompleteHandler: %p %s
WanRcvHandler: %p %s
WanRcvHandler: %p %s
WanRcvCompleteHandler: %p %s
WanRcvCompleteHandler: %p %s
AdapterInstanceName: %S
AdapterInstanceName: %S
OpenBlock [%d] %p
OpenBlock [%d] %p
RootName: %S
RootName: %S
BindName: %S
BindName: %S
ProtocolMajorVersion: %X
ProtocolMajorVersion: %X
NextSendHandler: %p %s
NextSendHandler: %p %s
NextReturnNetBufferListsHandler: %p %s
NextReturnNetBufferListsHandler: %p %s
SendHandler: %p %s
SendHandler: %p %s
TransferDataHandler: %p %s
TransferDataHandler: %p %s
WanReceiveHandler: %p %s
WanReceiveHandler: %p %s
SendPacketsHandler: %p %s
SendPacketsHandler: %p %s
ResetHandler: %p %s
ResetHandler: %p %s
RequestHandler: %p %s
RequestHandler: %p %s
OidRequestHandler: %p %s
OidRequestHandler: %p %s
WSendHandler: %p %s
WSendHandler: %p %s
WTransferDataHandler: %p %s
WTransferDataHandler: %p %s
WSendPacketsHandler: %p %s
WSendPacketsHandler: %p %s
CancelSendPacketsHandler: %p %s
CancelSendPacketsHandler: %p %s
ProtSendNetBufferListsComplete: %p %s
ProtSendNetBufferListsComplete: %p %s
NextSendNetBufferListsComplete: %p %s
NextSendNetBufferListsComplete: %p %s
ReceiveNetBufferLists: %p %s
ReceiveNetBufferLists: %p %s
SavedSendNBLHandler: %p %s
SavedSendNBLHandler: %p %s
SavedSendPacketsHandler: %p %s
SavedSendPacketsHandler: %p %s
SavedCancelSendPacketsHandler: %p %s
SavedCancelSendPacketsHandler: %p %s
SavedSendHandler: %p %s
SavedSendHandler: %p %s
Ndis5WanSendHandler: %p %s
Ndis5WanSendHandler: %p %s
ProtSendCompleteHandler: %p %s
ProtSendCompleteHandler: %p %s
OidRequestCompleteHandler %p %s
OidRequestCompleteHandler %p %s
OpenFlags: %X
OpenFlags: %X
DirectOidRequestHandler: %p %s
DirectOidRequestHandler: %p %s
RootName: %S
RootName: %S
BindName: %S
BindName: %S
Flags: %X
Flags: %X
SendHandler: %p %s
SendHandler: %p %s
WanSendHandler: %p %s
WanSendHandler: %p %s
TransferDataHandler: %p %s
TransferDataHandler: %p %s
WanReceiveHandler: %p %s
WanReceiveHandler: %p %s
SendPacketsHandler: %p %s
SendPacketsHandler: %p %s
ResetHandler: %p %s
ResetHandler: %p %s
RequestHandler: %p %s
RequestHandler: %p %s
WSendHandler: %p %s
WSendHandler: %p %s
WTransferDataHandler: %p %s
WTransferDataHandler: %p %s
WSendPacketsHandler: %p %s
WSendPacketsHandler: %p %s
CancelSendPacketsHandler: %p %s
CancelSendPacketsHandler: %p %s
Flags %X
Flags %X
Mtu %X
Mtu %X
PromiscuousMode %d
PromiscuousMode %d
AccessType %s
AccessType %s
DirectionType %s
DirectionType %s
ConnectionType %s
ConnectionType %s
MediaType %s
MediaType %s
MediaConnectState %s
MediaConnectState %s
AdminStatus %s
AdminStatus %s
OperStatus %s
OperStatus %s
InterfaceGuid %s
InterfaceGuid %s
NetworkGuid %s
NetworkGuid %s
ifIndex %X
ifIndex %X
ifDescr %S
ifDescr %S
ifAlias %S
ifAlias %S
FilterDriverCharacteristics[%d]:
FilterDriverCharacteristics[%d]:
FriendlyName: %S
FriendlyName: %S
UniqueName: %S
UniqueName: %S
ServiceName: %S
ServiceName: %S
SetOptionsHandler: %p %s
SetOptionsHandler: %p %s
SetFilterModuleOptionsHandler: %p %s
SetFilterModuleOptionsHandler: %p %s
AttachHandler: %p %s
AttachHandler: %p %s
DetachHandler: %p %s
DetachHandler: %p %s
RestartHandler: %p %s
RestartHandler: %p %s
PauseHandler: %p %s
PauseHandler: %p %s
SendNetBufferListsHandler: %p %s
SendNetBufferListsHandler: %p %s
SendNetBufferListsCompleteHandler: %p %s
SendNetBufferListsCompleteHandler: %p %s
CancelSendNetBufferListsHandler: %p %s
CancelSendNetBufferListsHandler: %p %s
ReceiveNetBufferListsHandler: %p %s
ReceiveNetBufferListsHandler: %p %s
ReturnNetBufferListsHandler: %p %s
ReturnNetBufferListsHandler: %p %s
OidRequestHandler: %p %s
OidRequestHandler: %p %s
OidRequestCompleteHandler: %p %s
OidRequestCompleteHandler: %p %s
CancelOidRequestHandler: %p %s
CancelOidRequestHandler: %p %s
DevicePnPEventNotifyHandler: %p %s
DevicePnPEventNotifyHandler: %p %s
NetPnPEventHandler: %p %s
NetPnPEventHandler: %p %s
StatusHandler: %p %s
StatusHandler: %p %s
DirectOidRequestHandler: %p %s
DirectOidRequestHandler: %p %s
DirectOidRequestCompleteHandler: %p %s
DirectOidRequestCompleteHandler: %p %s
CancelDirectOidRequestHandler: %p %s
CancelDirectOidRequestHandler: %p %s
InterfaceGuid: %s
InterfaceGuid: %s
FilterState: %s
FilterState: %s
NextSendNetBufferListsHandler: %p %s
NextSendNetBufferListsHandler: %p %s
NextSendNetBufferListsCompleteHandler: %p %s
NextSendNetBufferListsCompleteHandler: %p %s
NextIndicateReceiveNetBufferListsHandler: %p %s
NextIndicateReceiveNetBufferListsHandler: %p %s
NextReturnNetBufferListsHandler: %p %s
NextReturnNetBufferListsHandler: %p %s
NextCancelSendNetBufferListsHandler: %p %s
NextCancelSendNetBufferListsHandler: %p %s
SetFilterModuleOptionalHandlers: %p %s
SetFilterModuleOptionalHandlers: %p %s
OidRequestHandler: %p %s
OidRequestHandler: %p %s
OidRequestCompleteHandler: %p %s
OidRequestCompleteHandler: %p %s
CancelRequestHandler: %p %s
CancelRequestHandler: %p %s
DevicePnPEventNotifyHandler: %p %s
DevicePnPEventNotifyHandler: %p %s
NetPnPEventHandler: %p %s
NetPnPEventHandler: %p %s
StatusHandler: %p %s
StatusHandler: %p %s
FilterSendNetBufferListsHandler: %p %s
FilterSendNetBufferListsHandler: %p %s
FilterIndicateReceiveNetBufferListsHandler: %p %s
FilterIndicateReceiveNetBufferListsHandler: %p %s
FilterCancelSendNetBufferListsHandler: %p %s
FilterCancelSendNetBufferListsHandler: %p %s
InitiateOffloadCompleteHandler: %p %s
InitiateOffloadCompleteHandler: %p %s
TerminateOffloadCompleteHandler: %p %s
TerminateOffloadCompleteHandler: %p %s
UpdateOffloadCompleteHandler: %p %s
UpdateOffloadCompleteHandler: %p %s
InvalidateOffloadCompleteHandler: %p %s
InvalidateOffloadCompleteHandler: %p %s
QueryOffloadCompleteHandler: %p %s
QueryOffloadCompleteHandler: %p %s
IndicateOffloadEventHandler: %p %s
IndicateOffloadEventHandler: %p %s
TcpOffloadSendCompleteHandler: %p %s
TcpOffloadSendCompleteHandler: %p %s
TcpOffloadReceiveCompleteHandler: %p %s
TcpOffloadReceiveCompleteHandler: %p %s
TcpOffloadDisconnectCompleteHandler: %p %s
TcpOffloadDisconnectCompleteHandler: %p %s
TcpOffloadForwardCompleteHandler: %p %s
TcpOffloadForwardCompleteHandler: %p %s
TcpOffloadEventHandler: %p %s
TcpOffloadEventHandler: %p %s
TcpOffloadReceiveIndicateHandler: %p %s
TcpOffloadReceiveIndicateHandler: %p %s
InitiateOffloadHandler: %p %s
InitiateOffloadHandler: %p %s
TerminateOffloadHandler: %p %s
TerminateOffloadHandler: %p %s
UpdateOffloadHandler: %p %s
UpdateOffloadHandler: %p %s
InvalidateOffloadHandler: %p %s
InvalidateOffloadHandler: %p %s
QueryOffloadHandler: %p %s
QueryOffloadHandler: %p %s
TcpOffloadReceiveReturnHandler: %p %s
TcpOffloadReceiveReturnHandler: %p %s
DirectOidRequestHandler: %p %s
DirectOidRequestHandler: %p %s
DirectOidRequestCompleteHandler: %p %s
DirectOidRequestCompleteHandler: %p %s
CancelDirectOidRequestHandler: %p %s
CancelDirectOidRequestHandler: %p %s
TcpOffloadSendHandler: %p %s
TcpOffloadSendHandler: %p %s
TcpOffloadReceiveHandler: %p %s
TcpOffloadReceiveHandler: %p %s
TcpOffloadDisconnectHandler: %p %s
TcpOffloadDisconnectHandler: %p %s
TcpOffloadForwardHandler: %p %s
TcpOffloadForwardHandler: %p %s
Provider[%d]: %p
Provider[%d]: %p
QueryObjectHandler: %p %s
QueryObjectHandler: %p %s
SetObjectHandler: %p %s
SetObjectHandler: %p %s
FilterDriverBlock[%d]
FilterDriverBlock[%d]
InitiateOffloadHandler: %p %s
InitiateOffloadHandler: %p %s
TerminateOffloadHandler: %p %s
TerminateOffloadHandler: %p %s
UpdateOffloadHandler: %p %s
UpdateOffloadHandler: %p %s
InvalidateOffloadHandler: %p %s
InvalidateOffloadHandler: %p %s
QueryOffloadHandler: %p %s
QueryOffloadHandler: %p %s
TcpOffloadReceiveReturnHandler: %p %s
TcpOffloadReceiveReturnHandler: %p %s
TcpOffloadSendHandler: %p %s
TcpOffloadSendHandler: %p %s
TcpOffloadReceiveHandler: %p %s
TcpOffloadReceiveHandler: %p %s
TcpOffloadDisconnectHandler: %p %s
TcpOffloadDisconnectHandler: %p %s
TcpOffloadForwardHandler: %p %s
TcpOffloadForwardHandler: %p %s
ClCreateVcHandler: %p %s
ClCreateVcHandler: %p %s
ClDeleteVcHandler: %p %s
ClDeleteVcHandler: %p %s
ClOidRequestHandler: %p %s
ClOidRequestHandler: %p %s
ClOidRequestCompleteHandler: %p %s
ClOidRequestCompleteHandler: %p %s
ClOpenAfCompleteHandlerEx: %p %s
ClOpenAfCompleteHandlerEx: %p %s
ClCloseAfCompleteHandler: %p %s
ClCloseAfCompleteHandler: %p %s
ClRegisterSapCompleteHandler: %p %s
ClRegisterSapCompleteHandler: %p %s
ClDeregisterSapCompleteHandler: %p %s
ClDeregisterSapCompleteHandler: %p %s
ClMakeCallCompleteHandler: %p %s
ClMakeCallCompleteHandler: %p %s
ClModifyCallQoSCompleteHandler: %p %s
ClModifyCallQoSCompleteHandler: %p %s
ClCloseCallCompleteHandler: %p %s
ClCloseCallCompleteHandler: %p %s
ClAddPartyCompleteHandler: %p %s
ClAddPartyCompleteHandler: %p %s
ClDropPartyCompleteHandler: %p %s
ClDropPartyCompleteHandler: %p %s
ClIncomingCallHandler: %p %s
ClIncomingCallHandler: %p %s
ClIncomingCallQoSChangeHandler: %p %s
ClIncomingCallQoSChangeHandler: %p %s
ClIncomingCloseCallHandler: %p %s
ClIncomingCloseCallHandler: %p %s
ClIncomingDropPartyHandler: %p %s
ClIncomingDropPartyHandler: %p %s
ClCallConnectedHandler: %p %s
ClCallConnectedHandler: %p %s
ClNotifyCloseAfHandler: %p %s
ClNotifyCloseAfHandler: %p %s
CmCreateVcHandler: %p %s
CmCreateVcHandler: %p %s
CmDeleteVcHandler: %p %s
CmDeleteVcHandler: %p %s
CmOpenAfHandler: %p %s
CmOpenAfHandler: %p %s
CmCloseAfHandler: %p %s
CmCloseAfHandler: %p %s
CmRegisterSapHandler: %p %s
CmRegisterSapHandler: %p %s
CmDeregisterSapHandler: %p %s
CmDeregisterSapHandler: %p %s
CmMakeCallHandler: %p %s
CmMakeCallHandler: %p %s
CmCloseCallHandler: %p %s
CmCloseCallHandler: %p %s
CmIncomingCallCompleteHandler: %p %s
CmIncomingCallCompleteHandler: %p %s
CmAddPartyHandler: %p %s
CmAddPartyHandler: %p %s
CmDropPartyHandler: %p %s
CmDropPartyHandler: %p %s
CmActivateVcCompleteHandler: %p %s
CmActivateVcCompleteHandler: %p %s
CmDeactivateVcCompleteHandler: %p %s
CmDeactivateVcCompleteHandler: %p %s
CmModifyCallQoSHandler: %p %s
CmModifyCallQoSHandler: %p %s
CmOidRequestHandler: %p %s
CmOidRequestHandler: %p %s
CmOidRequestCompleteHandler: %p %s
CmOidRequestCompleteHandler: %p %s
CmNotifyCloseAfCompleteHandler: %p %s
CmNotifyCloseAfCompleteHandler: %p %s
DriverVersion: %X
DriverVersion: %X
CoCreateVcHandler: %p %s
CoCreateVcHandler: %p %s
CoDeleteVcHandler: %p %s
CoDeleteVcHandler: %p %s
CoActivateVcHandler: %p %s
CoActivateVcHandler: %p %s
CoDeactivateVcHandler: %p %s
CoDeactivateVcHandler: %p %s
CoSendNetBufferListsHandler: %p %s
CoSendNetBufferListsHandler: %p %s
CoRequestHandler: %p %s
CoRequestHandler: %p %s
CoOidRequestHandler: %p %s
CoOidRequestHandler: %p %s
InitiateOffloadHandler: %p %s
InitiateOffloadHandler: %p %s
TerminateOffloadHandler: %p %s
TerminateOffloadHandler: %p %s
UpdateOffloadHandler: %p %s
UpdateOffloadHandler: %p %s
InvalidateOffloadHandler: %p %s
InvalidateOffloadHandler: %p %s
QueryOffloadHandler: %p %s
QueryOffloadHandler: %p %s
TcpOffloadSendHandler: %p %s
TcpOffloadSendHandler: %p %s
TcpOffloadReceiveHandler: %p %s
TcpOffloadReceiveHandler: %p %s
TcpOffloadDisconnectHandler: %p %s
TcpOffloadDisconnectHandler: %p %s
TcpOffloadForwardHandler: %p %s
TcpOffloadForwardHandler: %p %s
TcpOffloadReceiveReturnHandler: %p %s
TcpOffloadReceiveReturnHandler: %p %s
AddDeviceHandler: %p %s
AddDeviceHandler: %p %s
RemoveDeviceHandler: %p %s
RemoveDeviceHandler: %p %s
FilterResourceRequirementsHandler: %p %s
FilterResourceRequirementsHandler: %p %s
StartDeviceHandler: %p %s
StartDeviceHandler: %p %s
ServiceName: %S
ServiceName: %S
CoCreateVcHandler: %p %s
CoCreateVcHandler: %p %s
CoDeleteVcHandler: %p %s
CoDeleteVcHandler: %p %s
CoActivateVcHandler: %p %s
CoActivateVcHandler: %p %s
CoDeactivateVcHandler: %p %s
CoDeactivateVcHandler: %p %s
CoSendNetBufferListsHandler: %p %s
CoSendNetBufferListsHandler: %p %s
CoRequestHandler: %p %s
CoRequestHandler: %p %s
CoOidRequestHandler: %p %s
CoOidRequestHandler: %p %s
InitiateOffloadHandler: %p %s
InitiateOffloadHandler: %p %s
TerminateOffloadHandler: %p %s
TerminateOffloadHandler: %p %s
UpdateOffloadHandler: %p %s
UpdateOffloadHandler: %p %s
InvalidateOffloadHandler: %p %s
InvalidateOffloadHandler: %p %s
QueryOffloadHandler: %p %s
QueryOffloadHandler: %p %s
TcpOffloadSendHandler: %p %s
TcpOffloadSendHandler: %p %s
TcpOffloadReceiveHandler: %p %s
TcpOffloadReceiveHandler: %p %s
TcpOffloadDisconnectHandler: %p %s
TcpOffloadDisconnectHandler: %p %s
TcpOffloadForwardHandler: %p %s
TcpOffloadForwardHandler: %p %s
TcpOffloadReceiveReturnHandler: %p %s
TcpOffloadReceiveReturnHandler: %p %s
AddDeviceHandler: %p %s
AddDeviceHandler: %p %s
RemoveDeviceHandler: %p %s
RemoveDeviceHandler: %p %s
FilterResourceRequirementsHandler: %p %s
FilterResourceRequirementsHandler: %p %s
StartDeviceHandler: %p %s
StartDeviceHandler: %p %s
OpenNDKAdapterHandler: %p %s
OpenNDKAdapterHandler: %p %s
CloseNDKAdapterHandler: %p %s
CloseNDKAdapterHandler: %p %s
IdleNotificationHandler: %p %s
IdleNotificationHandler: %p %s
CancelIdleNotificationHandler: %p %s
CancelIdleNotificationHandler: %p %s
AllocateNetBufferListForwardingContextHandler: %p %s
AllocateNetBufferListForwardingContextHandler: %p %s
FreeNetBufferListForwardingContextHandler: %p %s
FreeNetBufferListForwardingContextHandler: %p %s
AddNetBufferListDestinationHandler: %p %s
AddNetBufferListDestinationHandler: %p %s
SetNetBufferListSourceHandler: %p %s
SetNetBufferListSourceHandler: %p %s
GrowNetBufferListDestinationsHandler: %p %s
GrowNetBufferListDestinationsHandler: %p %s
GetNetBufferListDestinationsHandler: %p %s
GetNetBufferListDestinationsHandler: %p %s
UpdateNetBufferListDestinationsHandler: %p %s
UpdateNetBufferListDestinationsHandler: %p %s
CopyNetBufferListInfoHandler: %p %s
CopyNetBufferListInfoHandler: %p %s
ReferenceSwitchNicHandler: %p %s
ReferenceSwitchNicHandler: %p %s
DereferenceSwitchNicHandler: %p %s
DereferenceSwitchNicHandler: %p %s
ReferenceSwitchPortHandler: %p %s
ReferenceSwitchPortHandler: %p %s
DereferenceSwitchPortHandler: %p %s
DereferenceSwitchPortHandler: %p %s
ReportFilteredNetBufferListsHandler: %p %s
ReportFilteredNetBufferListsHandler: %p %s
ImageName: %S
ImageName: %S
SetNetBufferListSwitchContextHandler: %p %s
SetNetBufferListSwitchContextHandler: %p %s
GetNetBufferListSwitchContextHandler: %p %s
GetNetBufferListSwitchContextHandler: %p %s
netio legacy handler %p %s
netio legacy handler %p %s
read netio legacy handler failed, error %d, status %X
read netio legacy handler failed, error %d, status %X
read netio legacy handler failed, error %d
read netio legacy handler failed, error %d
%p %s
%p %s
read netio WfpNblInfoDispTable failed, error %d, status %X
read netio WfpNblInfoDispTable failed, error %d, status %X
read netio WfpNblInfoDispTable failed, error %d
read netio WfpNblInfoDispTable failed, error %d
netio MacShim %p %s
netio MacShim %p %s
WfpShim[%d] %p %s
WfpShim[%d] %p %s
Unknown WFP callout size %d
Unknown WFP callout size %d
WFP callout[%d]:
WFP callout[%d]:
ClassifyCallback: %p %s
ClassifyCallback: %p %s
NotifyCallback: %p %s
NotifyCallback: %p %s
uFlowDeleteFunction: %p %s
uFlowDeleteFunction: %p %s
Exception %X on sysptr seed reading at %p
Exception %X on sysptr seed reading at %p
Decode system scheme - %s
Decode system scheme - %s
Decode scheme - %s
Decode scheme - %s
Cannot read my process cookie, error %X
Cannot read my process cookie, error %X
Trace[%d] %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X (%p) %s
Trace[%d] %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X (%p) %s
Trace[%d] %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X %p
Trace[%d] %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X %p
SystemFunction%3.3d (%p) %s
SystemFunction%3.3d (%p) %s
PFNCLIENT.%s patched by %s (%p)
PFNCLIENT.%s patched by %s (%p)
PFNCLIENT.%s patched %p
PFNCLIENT.%s patched %p
check_user32_pfnclient: exception %X occured
check_user32_pfnclient: exception %X occured
PFNCLIENTWORKER.%s patched by %s (%p)
PFNCLIENTWORKER.%s patched by %s (%p)
PFNCLIENTWORKER.%s patched %p
PFNCLIENTWORKER.%s patched %p
ConsoleCtrlHandler[%d]: %s (%p)
ConsoleCtrlHandler[%d]: %s (%p)
ConsoleCtrlHandler[%d]: %p UNKNOWN
ConsoleCtrlHandler[%d]: %p UNKNOWN
ConsoleCtrlHandler: %s (%p)
ConsoleCtrlHandler: %s (%p)
UnhandledExceptionFilter: %s (%p)
UnhandledExceptionFilter: %s (%p)
ShimModule: %s (%p)
ShimModule: %s (%p)
RtlpStartThreadFunc: %s (%p)
RtlpStartThreadFunc: %s (%p)
RtlpExitThreadFunc: %s (%p)
RtlpExitThreadFunc: %s (%p)
RtlpUnhandledExceptionFilter: %s (%p)
RtlpUnhandledExceptionFilter: %s (%p)
RtlSecureMemoryCacheCallback: %s (%p)
RtlSecureMemoryCacheCallback: %s (%p)
TppLogpRoutine: %s (%p)
TppLogpRoutine: %s (%p)
CsrServerApiRoutine: %s (%p)
CsrServerApiRoutine: %s (%p)
LdrpManifestProberRoutine: %s (%p)
LdrpManifestProberRoutine: %s (%p)
LdrpCreateActCtxLanguage: %s (%p)
LdrpCreateActCtxLanguage: %s (%p)
LdrpReleaseActCtx: %s (%p)
LdrpReleaseActCtx: %s (%p)
LdrpAppCompatDllRedirectionCallbackFunction: %s (%p)
LdrpAppCompatDllRedirectionCallbackFunction: %s (%p)
%s%s!%s patched by %s (addr %p)
%s%s!%s patched by %s (addr %p)
%s%s.%d patched by %s (addr %p)
%s%s.%d patched by %s (addr %p)
%s%s.%d patched, addr %p
%s%s.%d patched, addr %p
PID %d trace callbacks: %d
PID %d trace callbacks: %d
Trace[%d] %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X %p %s
Trace[%d] %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X %p %s
Process PID %d has the same token as system process: %p !!!
Process PID %d has the same token as system process: %p !!!
Process PID %d token: %p
Process PID %d token: %p
%p %s %8X
%p %s %8X
%p %s %8X
%p %s %8X
CheckProc: cannot get modules list for PID %d (%S), error %d, ntstatus %X
CheckProc: cannot get modules list for PID %d (%S), error %d, ntstatus %X
CheckProc: cannot get modules list for PID %d (%S), error %d
CheckProc: cannot get modules list for PID %d (%S), error %d
CheckProcess PID %d (%S):
CheckProcess PID %d (%S):
PEB.PostProcessInitRoutine: %p %s
PEB.PostProcessInitRoutine: %p %s
PEB.PostProcessInitRoutine: %p UNKNOWN
PEB.PostProcessInitRoutine: %p UNKNOWN
PEB.pShimData: %p
PEB.pShimData: %p
PEB.AppCompat: %p
PEB.AppCompat: %p
PEB.FastPebLockRoutine: %p %s
PEB.FastPebLockRoutine: %p %s
PEB.FastPebLockRoutine: %p UNKNOWN
PEB.FastPebLockRoutine: %p UNKNOWN
PEB.FastPebUnlockRoutine: %p %s
PEB.FastPebUnlockRoutine: %p %s
PEB.FastPebUnlockRoutine: %p UNKNOWN
PEB.FastPebUnlockRoutine: %p UNKNOWN
Module: %s at %p
Module: %s at %p
Cannot read %s, PID %d, error %d
Cannot read %s, PID %d, error %d
PID %d: LSA SP %s has %d patched functions in SECPKG_FUNCTION_TABLE:
PID %d: LSA SP %s has %d patched functions in SECPKG_FUNCTION_TABLE:
PID %d: ncrypt has %d patched functions
PID %d: ncrypt has %d patched functions
PID %d: mswsock has %d patched functions in SockProcTable
PID %d: mswsock has %d patched functions in SockProcTable
PID %d: mswsock has %d patched functions in NspVector
PID %d: mswsock has %d patched functions in NspVector
PID %d: mswsock has %d patched MSAFD functions
PID %d: mswsock has %d patched MSAFD functions
SHAREDINFO.aheList: %p
SHAREDINFO.aheList: %p
PID %d: ntdsa has %d patched functions
PID %d: ntdsa has %d patched functions
PID %d - ole32 hooked by %s
PID %d - ole32 hooked by %s
PID %d - ole32 hooked by unknown module, addr %p
PID %d - ole32 hooked by unknown module, addr %p
PID %d: rpcrt4 has %d patched functions
PID %d: rpcrt4 has %d patched functions
PID %d: basesrv has %d patched user functions
PID %d: basesrv has %d patched user functions
PID %d: winsrv has %d patched user functions
PID %d: winsrv has %d patched user functions
PID %d: winsrv has %d patched cons functions
PID %d: winsrv has %d patched cons functions
PID %d: lsasrv has %d patched functions
PID %d: lsasrv has %d patched functions
PID %d: lsasrv has %d patched functions in LsapSspiExtension
PID %d: lsasrv has %d patched functions in LsapSspiExtension
PID %d: lsasrv has %d patched functions in LsapLookupExtension
PID %d: lsasrv has %d patched functions in LsapLookupExtension
PID %d: lsasrv has %d patched functions in LsapLsasrvIfTable
PID %d: lsasrv has %d patched functions in LsapLsasrvIfTable
Cannot alloc %X bytes for EAT checking of %s, PID %d
Cannot alloc %X bytes for EAT checking of %s, PID %d
Cannot read EAT of %s, PID %d
Cannot read EAT of %s, PID %d
Cannot alloc %X bytes for checking section %s of %s, PID %d
Cannot alloc %X bytes for checking section %s of %s, PID %d
Cannot read section %s content %X bytes of %s, PID %d
Cannot read section %s content %X bytes of %s, PID %d
Cannot make section %s of %s, PID %d
Cannot make section %s of %s, PID %d
Module %s section %s has %X patched bytes, PID %d
Module %s section %s has %X patched bytes, PID %d
PID %d: user32 has %d patched imm32 functions
PID %d: user32 has %d patched imm32 functions
PID %d: advapi32 has %d patched functions
PID %d: advapi32 has %d patched functions
PID %d: kernel32 has %d patched functions
PID %d: kernel32 has %d patched functions
ShimHandler[%d]: %p %s
ShimHandler[%d]: %p %s
ShimHandler[%d]: %p UNKNOWN, located at %p
ShimHandler[%d]: %p UNKNOWN, located at %p
ApplicationRecoveryCallback: %s (%p)
ApplicationRecoveryCallback: %s (%p)
%s, PID %d:
%s, PID %d:
Cannot alloc %X bytes for IAT checking of %s, PID %d
Cannot alloc %X bytes for IAT checking of %s, PID %d
Cannot read IAT (size %X at %p) of %s, PID %d
Cannot read IAT (size %X at %p) of %s, PID %d
Cannot find function %s.%s for module %s process %d
Cannot find function %s.%s for module %s process %d
Cannot find function %s.%d for module %s process %d
Cannot find function %s.%d for module %s process %d
IAT Patched %s.%s in module %s process %d by %s
IAT Patched %s.%s in module %s process %d by %s
IAT Patched %s.%s in module %s process %d, addr %p
IAT Patched %s.%s in module %s process %d, addr %p
IAT Patched %s.%d in module %s process %d by %s
IAT Patched %s.%d in module %s process %d by %s
IAT Patched %s.%d in module %s process %d
IAT Patched %s.%d in module %s process %d
Cannot alloc %X bytes for delayed IAT checking of %s, PID %d
Cannot alloc %X bytes for delayed IAT checking of %s, PID %d
Cannot read delayed IAT (size %X at %p) of %s, PID %d
Cannot read delayed IAT (size %X at %p) of %s, PID %d
Cannot find delayed function %s.%s for module %s process %d
Cannot find delayed function %s.%s for module %s process %d
Cannot find delayed function %s.%d for module %s process %d
Cannot find delayed function %s.%d for module %s process %d
LdrpDllNotificationList: %d
LdrpDllNotificationList: %d
%p %s
%p %s
Read %d QueuedWorkerItems:
Read %d QueuedWorkerItems:
[%d] %p %s
[%d] %p %s
check_drivers_reinit: cannot read size of list, error %d, status %X
check_drivers_reinit: cannot read size of list, error %d, status %X
check_drivers_reinit: cannot read size of list, error %d
check_drivers_reinit: cannot read size of list, error %d
check_drivers_reinit: cannot alloc %X bytes
check_drivers_reinit: cannot alloc %X bytes
check_drivers_reinit: cannot read list, error %d, ntstatus %X
check_drivers_reinit: cannot read list, error %d, ntstatus %X
check_drivers_reinit: cannot read list, error %d
check_drivers_reinit: cannot read list, error %d
[%d] Drv %p %s routine %p %s
[%d] Drv %p %s routine %p %s
read_shutdown_notificators: cannot read size of %s, error %d, status %X
read_shutdown_notificators: cannot read size of %s, error %d, status %X
read_shutdown_notificators: cannot read size of %s, error %d
read_shutdown_notificators: cannot read size of %s, error %d
read_shutdown_notificators: cannot alloc %X bytes
read_shutdown_notificators: cannot alloc %X bytes
read_shutdown_notificators: cannot read %s, error %d, ntstatus %X
read_shutdown_notificators: cannot read %s, error %d, ntstatus %X
read_shutdown_notificators: cannot read %s, error %d
read_shutdown_notificators: cannot read %s, error %d
[%d] DevObj %p Drv %p (addr %p) %s
[%d] DevObj %p Drv %p (addr %p) %s
[%d] DevObj %p Drv %p %s
[%d] DevObj %p Drv %p %s
MailSlot: %S, server %d (%S)
MailSlot: %S, server %d (%S)
MailSlot: %S, server %d
MailSlot: %S, server %d
NamedPipe: %S, server %d (%S)
NamedPipe: %S, server %d (%S)
NamedPipe: %S, server %d
NamedPipe: %S, server %d
Flags: %X, server %d (%S)
Flags: %X, server %d (%S)
Flags: %X, creator %d, server %d
Flags: %X, creator %d, server %d
Flags: %X, server %d
Flags: %X, server %d
Endpoints: %d
Endpoints: %d
Endpoint %S PID %d (%S):
Endpoint %S PID %d (%S):
Endpoint %S:
Endpoint %S:
RPC controls: %d
RPC controls: %d
%S: %S
%S: %S
%8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X version %d.%d
%8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X version %d.%d
Cannot load kernel %s
Cannot load kernel %s
Unknown scheduler: ReadySummary %X DispatcherReadyListHead %X
Unknown scheduler: ReadySummary %X DispatcherReadyListHead %X
Unknown scheduler: ReadySummary %X DeferredReadyListHead %X
Unknown scheduler: ReadySummary %X DeferredReadyListHead %X
Unknown scheduler: ReadySummary %X
Unknown scheduler: ReadySummary %X
Readed %d threads, total %d
Readed %d threads, total %d
Thread %p ProcID %X ThreadID %X Win32Thread %p %s
Thread %p ProcID %X ThreadID %X Win32Thread %p %s
Thread %p ProcID %X ThreadID %X Priority %d Win32Thread %p
Thread %p ProcID %X ThreadID %X Priority %d Win32Thread %p
Thread %p ProcID %X ThreadID %X %s
Thread %p ProcID %X ThreadID %X %s
Thread %p ProcID %X ThreadID %X Priority %d
Thread %p ProcID %X ThreadID %X Priority %d
reading count of threads on processor %d failed, error %X
reading count of threads on processor %d failed, error %X
%d threads
%d threads
reading of threads on processor %d failed, error %X
reading of threads on processor %d failed, error %X
Scheduler index %d
Scheduler index %d
reading count of threads failed, error %X
reading count of threads failed, error %X
reading of threads failed, error %X
reading of threads failed, error %X
Cannot find ETHREAD.ServiceTable
Cannot find ETHREAD.ServiceTable
Unknown version of ETHREAD, offset %X
Unknown version of ETHREAD, offset %X
Cannot alloc %X bytes for ProcessesAndThreadsInformation
Cannot alloc %X bytes for ProcessesAndThreadsInformation
Cannot realloc %X bytes for ProcessesAndThreadsInformation
Cannot realloc %X bytes for ProcessesAndThreadsInformation
ProcessesAndThreadsInformation failed, error %X
ProcessesAndThreadsInformation failed, error %X
read_sdt for threadID %X failed, error %d, status %X
read_sdt for threadID %X failed, error %d, status %X
read_sdt for threadID %X failed, error %d
read_sdt for threadID %X failed, error %d
ProcessID %X (%S) ThreadID %X SDT %p %s
ProcessID %X (%S) ThreadID %X SDT %p %s
ProcessID %X ThreadID %X SDT %p %s
ProcessID %X ThreadID %X SDT %p %s
read_thread_token for threadID %X failed, error %d, status %X
read_thread_token for threadID %X failed, error %d, status %X
read_thread_token for threadID %X failed, error %d
read_thread_token for threadID %X failed, error %d
ProcessID %X (%S) ThreadID %X token %p ImpersonationLevel %d
ProcessID %X (%S) ThreadID %X token %p ImpersonationLevel %d
ProcessID %X ThreadID %X token %p ImpersonationLevel %d
ProcessID %X ThreadID %X token %p ImpersonationLevel %d
Cannot detect ETHREAD.StartAddress
Cannot detect ETHREAD.StartAddress
Unknown kernel %s, StartAddress %X, IrpList %X, StackLimit %X, StackBase %X
Unknown kernel %s, StartAddress %X, IrpList %X, StackLimit %X, StackBase %X
Unknown kernel %s, StartAddress %X, StackLimit %X, StackBase %X
Unknown kernel %s, StartAddress %X, StackLimit %X, StackBase %X
Unknown kernel %s, StartAddress %X, IrpList %X
Unknown kernel %s, StartAddress %X, IrpList %X
Unknown kernel %s, StartAddress %X
Unknown kernel %s, StartAddress %X
Cannot read count of system threads, ntstatus %X
Cannot read count of system threads, ntstatus %X
Cannot alloc %d bytes
Cannot alloc %d bytes
Cannot read system threads, ntstatus %X
Cannot read system threads, ntstatus %X
%d System Threads
%d System Threads
Thread %p Start %p %c stack %p limit %p %s
Thread %p Start %p %c stack %p limit %p %s
read IPSec status failed, error %d, status %X
read IPSec status failed, error %d, status %X
read IPSec status failed, error %d
read IPSec status failed, error %d
IPSec status %X
IPSec status %X
IPSecHandler: %p %s
IPSecHandler: %p %s
IPSecQueryStatus: %p %s
IPSecQueryStatus: %p %s
IPSecSendCmplt: %p %s
IPSecSendCmplt: %p %s
IPSecNdisStatus: %p %s
IPSecNdisStatus: %p %s
IPSecRcvFWPacket: %p %s
IPSecRcvFWPacket: %p %s
check_tdi_pnp_clnts: cannot read size of clnts list, error %d, ntstatus %X
check_tdi_pnp_clnts: cannot read size of clnts list, error %d, ntstatus %X
check_tdi_pnp_clnts: cannot read size of clnts list, error %d
check_tdi_pnp_clnts: cannot read size of clnts list, error %d
check_tdi_pnp_clnts: cannot alloc %X bytes
check_tdi_pnp_clnts: cannot alloc %X bytes
check_tdi_pnp_clnts: cannot read clnts list, error %d, ntstatus %X
check_tdi_pnp_clnts: cannot read clnts list, error %d, ntstatus %X
check_tdi_pnp_clnts: cannot read clnts list, error %d
check_tdi_pnp_clnts: cannot read clnts list, error %d
TDI PnP clients: %d (readed %d)
TDI PnP clients: %d (readed %d)
[%d]: version %X %S
[%d]: version %X %S
PnPPowerHandler: %p %s
PnPPowerHandler: %p %s
BindHandler: %p %s
BindHandler: %p %s
UnBindHandler: %p %s
UnBindHandler: %p %s
AddAddressHandler: %p %s
AddAddressHandler: %p %s
DelAddressHandler: %p %s
DelAddressHandler: %p %s
Microsoft-Windows-Windows Firewall With Advanced Security
Microsoft-Windows-Windows Firewall With Advanced Security
Microsoft-Windows-Kernel-Boot
Microsoft-Windows-Kernel-Boot
Microsoft-Windows-EQoS
Microsoft-Windows-EQoS
Microsoft-Windows-XWizards
Microsoft-Windows-XWizards
ASP.NET Events
ASP.NET Events
Microsoft-Windows-UIRibbon
Microsoft-Windows-UIRibbon
Microsoft-Windows-WPD-CompositeClassDriver
Microsoft-Windows-WPD-CompositeClassDriver
Microsoft-Windows-Wired-AutoConfig
Microsoft-Windows-Wired-AutoConfig
Microsoft-Windows-PrintService
Microsoft-Windows-PrintService
Microsoft-Windows-ApplicationExperience-LookupServiceTrigger
Microsoft-Windows-ApplicationExperience-LookupServiceTrigger
Microsoft-Windows-IDCRL
Microsoft-Windows-IDCRL
Microsoft-Windows-MPS-DRV
Microsoft-Windows-MPS-DRV
Microsoft-Windows-P2P-Mesh
Microsoft-Windows-P2P-Mesh
Microsoft-Windows-TabletPC-MathRecognizer
Microsoft-Windows-TabletPC-MathRecognizer
Microsoft-Windows-Spell-Checking
Microsoft-Windows-Spell-Checking
Microsoft-Windows-Fax
Microsoft-Windows-Fax
Microsoft-Windows-GroupPolicy
Microsoft-Windows-GroupPolicy
Microsoft-Windows-Crashdump
Microsoft-Windows-Crashdump
Microsoft-Windows-PrintSpooler
Microsoft-Windows-PrintSpooler
Microsoft-Windows-LanguagePackSetup
Microsoft-Windows-LanguagePackSetup
Microsoft-Windows-OneX
Microsoft-Windows-OneX
Microsoft-Windows-OfflineFiles-CscApi
Microsoft-Windows-OfflineFiles-CscApi
Microsoft-Windows-ADSI
Microsoft-Windows-ADSI
Microsoft-Windows-Dhcp-Client
Microsoft-Windows-Dhcp-Client
Microsoft-Windows-CertificateServicesClient-AutoEnrollment
Microsoft-Windows-CertificateServicesClient-AutoEnrollment
Microsoft-Windows-NlaSvc
Microsoft-Windows-NlaSvc
Microsoft-Windows-Diagnosis-MSDE
Microsoft-Windows-Diagnosis-MSDE
Microsoft-Windows-SpoolerWin32SPL
Microsoft-Windows-SpoolerWin32SPL
Microsoft-Windows-SPB-ClassExtension
Microsoft-Windows-SPB-ClassExtension
Microsoft-Windows-Kernel-Memory
Microsoft-Windows-Kernel-Memory
Microsoft-Windows-Application Server-Applications
Microsoft-Windows-Application Server-Applications
Microsoft-Windows-MUI
Microsoft-Windows-MUI
Microsoft-Windows-P2P-Collab
Microsoft-Windows-P2P-Collab
Microsoft-Windows-Security-Netlogon
Microsoft-Windows-Security-Netlogon
Microsoft-Windows-SQM-Events
Microsoft-Windows-SQM-Events
Microsoft-Windows-USB-USBPORT
Microsoft-Windows-USB-USBPORT
Microsoft-Windows-SendTo
Microsoft-Windows-SendTo
Microsoft-Windows-AIT
Microsoft-Windows-AIT
Microsoft-Windows-P2P-CRP
Microsoft-Windows-P2P-CRP
PrintFilterPipelineSvc_ObjectsGuid
PrintFilterPipelineSvc_ObjectsGuid
Microsoft-Windows-IME-JPPRED
Microsoft-Windows-IME-JPPRED
Microsoft-Windows-WMP
Microsoft-Windows-WMP
Microsoft-Windows-Eqos-SQM-Provider
Microsoft-Windows-Eqos-SQM-Provider
MSDADIAG.ETW
MSDADIAG.ETW
Microsoft-Windows-Processor-Aggregator
Microsoft-Windows-Processor-Aggregator
Microsoft-Windows-ErrorReportingConsole
Microsoft-Windows-ErrorReportingConsole
Microsoft-Windows-SmartCard-TPM-VCard-Module
Microsoft-Windows-SmartCard-TPM-VCard-Module
Microsoft-Windows-User Profiles Service
Microsoft-Windows-User Profiles Service
Microsoft-Windows-Crypto-CNG
Microsoft-Windows-Crypto-CNG
Microsoft-Windows-LinkLayerDiscoveryProtocol
Microsoft-Windows-LinkLayerDiscoveryProtocol
Microsoft-Windows-TaskbarCPL
Microsoft-Windows-TaskbarCPL
Microsoft-Windows-Networking-Correlation
Microsoft-Windows-Networking-Correlation
Microsoft-Windows-RestartManager
Microsoft-Windows-RestartManager
Microsoft-Windows-WMPDMCCore
Microsoft-Windows-WMPDMCCore
Microsoft-Windows-TCPIP
Microsoft-Windows-TCPIP
Microsoft-Windows-MSDTC
Microsoft-Windows-MSDTC
Microsoft-Windows-Resources-MrmBc
Microsoft-Windows-Resources-MrmBc
Microsoft-Windows-Time-Service
Microsoft-Windows-Time-Service
Microsoft-Windows-HomeGroup-ProviderService
Microsoft-Windows-HomeGroup-ProviderService
Microsoft-Windows-DriverFrameworks-UserMode
Microsoft-Windows-DriverFrameworks-UserMode
Microsoft-Windows-Runtime-Networking
Microsoft-Windows-Runtime-Networking
Microsoft-Windows-Network-Connection-Broker
Microsoft-Windows-Network-Connection-Broker
Microsoft-Windows-Shell-AppWizCpl
Microsoft-Windows-Shell-AppWizCpl
Microsoft-Windows-PDC
Microsoft-Windows-PDC
Microsoft-Windows-Biometrics
Microsoft-Windows-Biometrics
Microsoft-Windows-IME-SCDICCOMPILER
Microsoft-Windows-IME-SCDICCOMPILER
Microsoft-Windows-Wininit
Microsoft-Windows-Wininit
Microsoft-Windows-Dwm-Dwm
Microsoft-Windows-Dwm-Dwm
Microsoft-Windows-Photo-Image-Codec
Microsoft-Windows-Photo-Image-Codec
Microsoft-Windows-TaskScheduler
Microsoft-Windows-TaskScheduler
Microsoft-Windows-osk
Microsoft-Windows-osk
Microsoft-Windows-Kernel-PowerTrigger
Microsoft-Windows-Kernel-PowerTrigger
Microsoft-Windows-EventLog-WMIProvider
Microsoft-Windows-EventLog-WMIProvider
Microsoft-Windows-IME-OEDCompiler
Microsoft-Windows-IME-OEDCompiler
Microsoft-Windows-WER-SystemErrorReporting
Microsoft-Windows-WER-SystemErrorReporting
Microsoft-Windows-Deplorch
Microsoft-Windows-Deplorch
Microsoft-Windows-SPB-HIDI2C
Microsoft-Windows-SPB-HIDI2C
Microsoft-Windows-UxTheme
Microsoft-Windows-UxTheme
Microsoft-Windows-BfeTriggerProvider
Microsoft-Windows-BfeTriggerProvider
Microsoft-Windows-Media-Streaming
Microsoft-Windows-Media-Streaming
Microsoft-Windows-Remotefs-UTProvider
Microsoft-Windows-Remotefs-UTProvider
Microsoft-Windows-Ntfs-SQM
Microsoft-Windows-Ntfs-SQM
Microsoft-Windows-User-PnP
Microsoft-Windows-User-PnP
Microsoft-Windows-AltTab
Microsoft-Windows-AltTab
Microsoft-Windows-Kernel-StoreMgr
Microsoft-Windows-Kernel-StoreMgr
Microsoft-Windows-WindowsColorSystem
Microsoft-Windows-WindowsColorSystem
Microsoft-Windows-RemoteDesktopServices-RemoteFX-VM-User-Mode-Transport
Microsoft-Windows-RemoteDesktopServices-RemoteFX-VM-User-Mode-Transport
Microsoft-Windows-MSMPEG2ADEC
Microsoft-Windows-MSMPEG2ADEC
Microsoft-Windows-TerminalServices-PnPDevices
Microsoft-Windows-TerminalServices-PnPDevices
Microsoft-Windows-GettingStarted
Microsoft-Windows-GettingStarted
Microsoft-Windows-Narrator
Microsoft-Windows-Narrator
Windows Wininit Trace
Windows Wininit Trace
Microsoft-Windows-FileHistory-UI
Microsoft-Windows-FileHistory-UI
Microsoft-Windows-MediaFoundation-PlayAPI
Microsoft-Windows-MediaFoundation-PlayAPI
Microsoft-Windows-CertificateServicesClient-Lifecycle-System
Microsoft-Windows-CertificateServicesClient-Lifecycle-System
Microsoft-Windows-BitLocker-Driver-Performance
Microsoft-Windows-BitLocker-Driver-Performance
Microsoft-Windows-PerfProc
Microsoft-Windows-PerfProc
Microsoft-Windows-Resource-Leak-Diagnostic
Microsoft-Windows-Resource-Leak-Diagnostic
Microsoft-Windows-WebServices
Microsoft-Windows-WebServices
Microsoft-Windows-FileHistory-Service
Microsoft-Windows-FileHistory-Service
Microsoft-Windows-MediaEngine
Microsoft-Windows-MediaEngine
Microsoft-Windows-StartupRepair
Microsoft-Windows-StartupRepair
Microsoft-Windows-Security-IdentityStore
Microsoft-Windows-Security-IdentityStore
Microsoft-Windows-IME-SCSetting
Microsoft-Windows-IME-SCSetting
Microsoft-Windows-FileHistory-EventListener
Microsoft-Windows-FileHistory-EventListener
Microsoft-Windows-Program-Compatibility-Assistant
Microsoft-Windows-Program-Compatibility-Assistant
Microsoft-Windows-DesktopActivityModerator
Microsoft-Windows-DesktopActivityModerator
Microsoft-Windows-MemoryDiagnostics-Schedule
Microsoft-Windows-MemoryDiagnostics-Schedule
Microsoft-Windows-FileHistory-Engine
Microsoft-Windows-FileHistory-Engine
Microsoft-Windows-PerfDisk
Microsoft-Windows-PerfDisk
Microsoft-Windows-OOBE-Machine-Core
Microsoft-Windows-OOBE-Machine-Core
Microsoft-Windows-WLAN-AutoConfig
Microsoft-Windows-WLAN-AutoConfig
Microsoft-Windows-FileHistory-ConfigManager
Microsoft-Windows-FileHistory-ConfigManager
Microsoft-Windows-Search-ProfileNotify
Microsoft-Windows-Search-ProfileNotify
Microsoft-Windows-PerfCtrs
Microsoft-Windows-PerfCtrs
UMPass Driver Trace
UMPass Driver Trace
Microsoft-Windows-FileHistory-Catalog
Microsoft-Windows-FileHistory-Catalog
Microsoft-Windows-WlanDlg
Microsoft-Windows-WlanDlg
Microsoft-Windows-CDROM
Microsoft-Windows-CDROM
Microsoft-Windows-Crypto-NCrypt
Microsoft-Windows-Crypto-NCrypt
Certificate Services Client CredentialRoaming Trace
Certificate Services Client CredentialRoaming Trace
Microsoft-Windows-CredUI
Microsoft-Windows-CredUI
Windows Firewall Service
Windows Firewall Service
Microsoft-Windows-FileHistory-Core
Microsoft-Windows-FileHistory-Core
Microsoft-Windows-Direct3D11
Microsoft-Windows-Direct3D11
Microsoft-Windows-DirectoryServices-Deployment
Microsoft-Windows-DirectoryServices-Deployment
Microsoft-Windows-All-User-Install-Agent
Microsoft-Windows-All-User-Install-Agent
Microsoft-Windows-Kernel-Licensing-StartServiceTrigger
Microsoft-Windows-Kernel-Licensing-StartServiceTrigger
Microsoft-Windows-ServerManager-ManagementProvider
Microsoft-Windows-ServerManager-ManagementProvider
Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider
Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider
Microsoft-Windows-IIS-W3SVC-WP
Microsoft-Windows-IIS-W3SVC-WP
Microsoft-Windows-TerminalServices-MediaRedirection-DShow
Microsoft-Windows-TerminalServices-MediaRedirection-DShow
Microsoft-Windows-Rdms-UI
Microsoft-Windows-Rdms-UI
Microsoft-Windows-Feedback-Service-TriggerProvider
Microsoft-Windows-Feedback-Service-TriggerProvider
Microsoft-Windows-Eventlog
Microsoft-Windows-Eventlog
Microsoft-Windows-CodeIntegrity
Microsoft-Windows-CodeIntegrity
Microsoft-Windows-WPDClassInstaller
Microsoft-Windows-WPDClassInstaller
Microsoft-Windows-NetworkAccessProtection
Microsoft-Windows-NetworkAccessProtection
Microsoft-Windows-UIAutomationCore
Microsoft-Windows-UIAutomationCore
Microsoft-Windows-StartLmhosts
Microsoft-Windows-StartLmhosts
Microsoft-Windows-IME-Broker
Microsoft-Windows-IME-Broker
Microsoft-Windows-Kernel-Process
Microsoft-Windows-Kernel-Process
Microsoft-Windows-CertificateServicesClient
Microsoft-Windows-CertificateServicesClient
Microsoft-Windows-AppXDeployment
Microsoft-Windows-AppXDeployment
Microsoft-Windows-Shell-Core
Microsoft-Windows-Shell-Core
Microsoft-Windows-Anytime-Upgrade
Microsoft-Windows-Anytime-Upgrade
Microsoft-Windows-PCI
Microsoft-Windows-PCI
Microsoft-Windows-WPD-MTPBT
Microsoft-Windows-WPD-MTPBT
Microsoft-Windows-CertificationAuthorityClient-CertCli
Microsoft-Windows-CertificationAuthorityClient-CertCli
Microsoft-Windows-Srv2
Microsoft-Windows-Srv2
Microsoft-Windows-TunnelDriver-SQM-Provider
Microsoft-Windows-TunnelDriver-SQM-Provider
Microsoft-Windows-Security-Licensing-SLC
Microsoft-Windows-Security-Licensing-SLC
Microsoft-Windows-ATAPort
Microsoft-Windows-ATAPort
Microsoft-Windows-Recovery
Microsoft-Windows-Recovery
Microsoft-Windows-GenericRoaming
Microsoft-Windows-GenericRoaming
Microsoft-Windows-Sdbus-SQM
Microsoft-Windows-Sdbus-SQM
Microsoft-Windows-DirectComposition
Microsoft-Windows-DirectComposition
Microsoft-Windows-P2PIMSvc
Microsoft-Windows-P2PIMSvc
Microsoft-Windows-WCN-Config-Registrar
Microsoft-Windows-WCN-Config-Registrar
Microsoft-Windows-WPD-API
Microsoft-Windows-WPD-API
Microsoft-Windows-P2P-PNRP
Microsoft-Windows-P2P-PNRP
Microsoft-Windows-DeviceUx
Microsoft-Windows-DeviceUx
Windows Mobile Performance Hooks
Windows Mobile Performance Hooks
Microsoft-Windows-ProcessStateManager
Microsoft-Windows-ProcessStateManager
Windows Connect Now
Windows Connect Now
Microsoft-Windows-Networking-RealTimeCommunication
Microsoft-Windows-Networking-RealTimeCommunication
Microsoft-Windows-EventSystem
Microsoft-Windows-EventSystem
Microsoft-Windows-Spaceport
Microsoft-Windows-Spaceport
Windows Mobile Remote API
Windows Mobile Remote API
Microsoft-Windows-Dhcp-Nap-Enforcement-Client
Microsoft-Windows-Dhcp-Nap-Enforcement-Client
Microsoft-Windows-WinNat
Microsoft-Windows-WinNat
Windows Mobile AirSync Engine 2
Windows Mobile AirSync Engine 2
Microsoft-Windows-WCN-Config-Registrar-Secure
Microsoft-Windows-WCN-Config-Registrar-Secure
Windows Mobile AirSync Engine 1
Windows Mobile AirSync Engine 1
Microsoft-Windows-Security-Kerberos
Microsoft-Windows-Security-Kerberos
Windows Mobile ActiveSync Engine
Windows Mobile ActiveSync Engine
Microsoft-Windows-WSC-SRV
Microsoft-Windows-WSC-SRV
Microsoft-Windows-Eventlog-ForwardPlugin
Microsoft-Windows-Eventlog-ForwardPlugin
Windows Mobile Serial Connectivity
Windows Mobile Serial Connectivity
Microsoft-Windows-TerminalServices-SessionBroker-Client
Microsoft-Windows-TerminalServices-SessionBroker-Client
Microsoft-Windows-WMPNSS-PublicAPI
Microsoft-Windows-WMPNSS-PublicAPI
Windows Mobile Desktop Passthrough
Windows Mobile Desktop Passthrough
Microsoft-Windows-RPC-Events
Microsoft-Windows-RPC-Events
Microsoft-Windows-LanguageProfile
Microsoft-Windows-LanguageProfile
Microsoft-Windows-Anytime-Upgrade-Events
Microsoft-Windows-Anytime-Upgrade-Events
Microsoft-Windows-Management-UI
Microsoft-Windows-Management-UI
Microsoft-Windows-SMBClient
Microsoft-Windows-SMBClient
Microsoft-Windows-TerminalServices-RdpSoundDriver
Microsoft-Windows-TerminalServices-RdpSoundDriver
Microsoft-Windows-Dwm-Api
Microsoft-Windows-Dwm-Api
Microsoft-Windows-QoS-qWAVE
Microsoft-Windows-QoS-qWAVE
Microsoft-Windows-Kernel-Tm-Trigger
Microsoft-Windows-Kernel-Tm-Trigger
Microsoft-Windows-IPNAT
Microsoft-Windows-IPNAT
Microsoft-Windows-NetworkBridge
Microsoft-Windows-NetworkBridge
Microsoft-Windows-MPS-CLNT
Microsoft-Windows-MPS-CLNT
Microsoft-Windows-Diagnosis-Scheduled
Microsoft-Windows-Diagnosis-Scheduled
Microsoft-Windows-WMPNSS-Service
Microsoft-Windows-WMPNSS-Service
Microsoft-Windows-DxpTaskRingtone
Microsoft-Windows-DxpTaskRingtone
Microsoft-Windows-Kernel-AppCompat
Microsoft-Windows-Kernel-AppCompat
Microsoft-Windows-TimeBroker
Microsoft-Windows-TimeBroker
Microsoft-Windows-DeviceConfidence
Microsoft-Windows-DeviceConfidence
Microsoft-Windows-Shell-Shwebsvc
Microsoft-Windows-Shell-Shwebsvc
Microsoft-Windows-Diagnostics-Performance
Microsoft-Windows-Diagnostics-Performance
Windows NetworkMap Trace
Windows NetworkMap Trace
Microsoft-Windows-TerminalServices-Printers
Microsoft-Windows-TerminalServices-Printers
Microsoft-Windows-AppLocker
Microsoft-Windows-AppLocker
Microsoft-Windows-Audio
Microsoft-Windows-Audio
Microsoft-Windows-LLTD-MapperIO
Microsoft-Windows-LLTD-MapperIO
Microsoft-Windows-HotspotAuth
Microsoft-Windows-HotspotAuth
Microsoft-Windows-Firewall-CPL
Microsoft-Windows-Firewall-CPL
Microsoft-Windows-Kernel-IoTrace
Microsoft-Windows-Kernel-IoTrace
Microsoft-Windows-Perflib
Microsoft-Windows-Perflib
Microsoft-Windows-BootUX
Microsoft-Windows-BootUX
Microsoft-Windows-WMPDMCUI
Microsoft-Windows-WMPDMCUI
Microsoft-Windows-Disk
Microsoft-Windows-Disk
Microsoft-Windows-IME-JPLMP
Microsoft-Windows-IME-JPLMP
Microsoft-Windows-Security-SPP-UX-Notifications
Microsoft-Windows-Security-SPP-UX-Notifications
Microsoft-Windows-TerminalServices-ClientActiveXCore
Microsoft-Windows-TerminalServices-ClientActiveXCore
Microsoft-Windows-IIS-IISReset
Microsoft-Windows-IIS-IISReset
Microsoft-Windows-WindowsUIImmersive
Microsoft-Windows-WindowsUIImmersive
Windows Firewall Control Panel
Windows Firewall Control Panel
Microsoft-Windows-DeviceSetupManager
Microsoft-Windows-DeviceSetupManager
Microsoft-Windows-EnrollmentPolicyWebService
Microsoft-Windows-EnrollmentPolicyWebService
Microsoft-Windows-IME-Roaming
Microsoft-Windows-IME-Roaming
Microsoft-Windows-SetupQueue
Microsoft-Windows-SetupQueue
Microsoft-Windows-SmartCard-Audit
Microsoft-Windows-SmartCard-Audit
Microsoft-Windows-Servicing
Microsoft-Windows-Servicing
Microsoft-Windows-ACL-UI
Microsoft-Windows-ACL-UI
Microsoft-Windows-WWAN-CFE
Microsoft-Windows-WWAN-CFE
Microsoft-Windows-FCRegSvc
Microsoft-Windows-FCRegSvc
Microsoft-Windows-IIS-IisMetabaseAudit
Microsoft-Windows-IIS-IisMetabaseAudit
Microsoft-Windows-Kernel-WDI
Microsoft-Windows-Kernel-WDI
Microsoft-Windows-TabletPC-MathInput
Microsoft-Windows-TabletPC-MathInput
Microsoft-Windows-Kernel-General
Microsoft-Windows-Kernel-General
Windows Media Player Trace
Windows Media Player Trace
Microsoft-Windows-DxpTaskDLNA
Microsoft-Windows-DxpTaskDLNA
Microsoft-Windows-User Profiles General
Microsoft-Windows-User Profiles General
Microsoft-Windows-Kernel-WSService-StartServiceTrigger
Microsoft-Windows-Kernel-WSService-StartServiceTrigger
Microsoft-Windows-WebAuth
Microsoft-Windows-WebAuth
Microsoft-Windows-API-Tracing
Microsoft-Windows-API-Tracing
Microsoft-Windows-FunctionDiscovery
Microsoft-Windows-FunctionDiscovery
Microsoft-Windows-StickyNotes
Microsoft-Windows-StickyNotes
Microsoft-Windows-WCN-WscEapPeer-Trace
Microsoft-Windows-WCN-WscEapPeer-Trace
Microsoft-Windows-QoS-WMI-Diag
Microsoft-Windows-QoS-WMI-Diag
Microsoft-Windows-NetworkProvisioning
Microsoft-Windows-NetworkProvisioning
Microsoft-Windows-Network-DataUsage
Microsoft-Windows-Network-DataUsage
Microsoft-Windows-AppSruProv
Microsoft-Windows-AppSruProv
Microsoft-Windows-WebcamExperience
Microsoft-Windows-WebcamExperience
Microsoft-Windows-EaseOfAccess
Microsoft-Windows-EaseOfAccess
Microsoft-Windows-Spellchecking-Host
Microsoft-Windows-Spellchecking-Host
Microsoft-Windows-IME-CandidateUI
Microsoft-Windows-IME-CandidateUI
Microsoft-Windows-TPM-WMI
Microsoft-Windows-TPM-WMI
Microsoft-Windows-Security-SPP
Microsoft-Windows-Security-SPP
Microsoft-Windows-DirectShow-KernelSupport
Microsoft-Windows-DirectShow-KernelSupport
Microsoft-Windows-Diagnosis-AdvancedTaskManager
Microsoft-Windows-Diagnosis-AdvancedTaskManager
Microsoft-Windows-ThemeCPL
Microsoft-Windows-ThemeCPL
Windows Mobile Co-installer
Windows Mobile Co-installer
Microsoft-Windows-MPRMSG
Microsoft-Windows-MPRMSG
Microsoft-Windows-EnhancedStorage-EhStorCertDrv
Microsoft-Windows-EnhancedStorage-EhStorCertDrv
Microsoft-Windows-NdisImPlatformEventProvider
Microsoft-Windows-NdisImPlatformEventProvider
Microsoft-Windows-FunctionDiscoveryHost
Microsoft-Windows-FunctionDiscoveryHost
Microsoft-Windows-MediaFoundation-MSVideoDSP
Microsoft-Windows-MediaFoundation-MSVideoDSP
Microsoft-Windows-IME-JPTIP
Microsoft-Windows-IME-JPTIP
Windows Kernel Trace
Windows Kernel Trace
Microsoft-SQLServerDataTools
Microsoft-SQLServerDataTools
Microsoft-Windows-ASN1
Microsoft-Windows-ASN1
Microsoft-Windows-Crypto-BCrypt
Microsoft-Windows-Crypto-BCrypt
Microsoft-Windows-HealthCenterCPL
Microsoft-Windows-HealthCenterCPL
Microsoft-Windows-XAML
Microsoft-Windows-XAML
Microsoft-Windows-PDFReader
Microsoft-Windows-PDFReader
Microsoft-Windows-TerminalServices-ServerUSBDevices
Microsoft-Windows-TerminalServices-ServerUSBDevices
Microsoft-Windows-WWAN-SVC-EVENTS
Microsoft-Windows-WWAN-SVC-EVENTS
Microsoft-Windows-Search-ProtocolHandlers
Microsoft-Windows-Search-ProtocolHandlers
Microsoft-Windows-IdCtrls
Microsoft-Windows-IdCtrls
Microsoft-Windows-User-ControlPanel
Microsoft-Windows-User-ControlPanel
Microsoft-Windows-Runtime-Media
Microsoft-Windows-Runtime-Media
Microsoft-Windows-CAPI2
Microsoft-Windows-CAPI2
Windows Mobile Sync Handlers
Windows Mobile Sync Handlers
Microsoft-Windows-PowerCfg
Microsoft-Windows-PowerCfg
Microsoft-Windows-SrumTelemetry
Microsoft-Windows-SrumTelemetry
Microsoft-Windows-Base-Filtering-Engine-Connections
Microsoft-Windows-Base-Filtering-Engine-Connections
Microsoft-Windows-Sidebar
Microsoft-Windows-Sidebar
Microsoft-Windows-NDF-HelperClassDiscovery
Microsoft-Windows-NDF-HelperClassDiscovery
Microsoft-Windows-PerfNet
Microsoft-Windows-PerfNet
Microsoft-Windows-PortableDeviceStatusProvider
Microsoft-Windows-PortableDeviceStatusProvider
Microsoft-Windows-TabletPC-Platform-Manipulations
Microsoft-Windows-TabletPC-Platform-Manipulations
Microsoft-Windows-Subsys-SMSS
Microsoft-Windows-Subsys-SMSS
Microsoft-Windows-LDAP-Client
Microsoft-Windows-LDAP-Client
Microsoft-Windows-Security-SPP-UX-GC
Microsoft-Windows-Security-SPP-UX-GC
Microsoft-Windows-Media Center Extender
Microsoft-Windows-Media Center Extender
Microsoft-Windows-DiskDiagnostic
Microsoft-Windows-DiskDiagnostic
Microsoft-Windows-TSF-msutb
Microsoft-Windows-TSF-msutb
Microsoft-Windows-Reliability-Analysis-Agent
Microsoft-Windows-Reliability-Analysis-Agent
{B6501BA0-C61A-C4E6-6FA2-A4E7F8C8E7A0}
{B6501BA0-C61A-C4E6-6FA2-A4E7F8C8E7A0}
Microsoft-Windows-Kernel-Processor-Power
Microsoft-Windows-Kernel-Processor-Power
Microsoft-Windows-NCSI
Microsoft-Windows-NCSI
Microsoft-Windows-NetworkConnectivityStatus
Microsoft-Windows-NetworkConnectivityStatus
Microsoft-Windows-wmvdecod
Microsoft-Windows-wmvdecod
Microsoft-Windows-ServiceTriggerPerfEventProvider
Microsoft-Windows-ServiceTriggerPerfEventProvider
Microsoft-Windows-Service Pack Installer
Microsoft-Windows-Service Pack Installer
Microsoft-Windows-Bluetooth-HidGatt
Microsoft-Windows-Bluetooth-HidGatt
Microsoft-Windows-TabletPC-Platform-Input-Ninput
Microsoft-Windows-TabletPC-Platform-Input-Ninput
Microsoft-Windows-Tcpip-SQM-Provider
Microsoft-Windows-Tcpip-SQM-Provider
Microsoft-Windows-MPS-SRV
Microsoft-Windows-MPS-SRV
Microsoft-Windows-KnownFolders
Microsoft-Windows-KnownFolders
Microsoft-Windows-NAPIPSecEnf
Microsoft-Windows-NAPIPSecEnf
Microsoft-Windows-EnrollmentWebService
Microsoft-Windows-EnrollmentWebService
Microsoft-Windows-Deduplication-Change
Microsoft-Windows-Deduplication-Change
Microsoft-Windows-OfflineFiles-CscFastSync
Microsoft-Windows-OfflineFiles-CscFastSync
Microsoft-Windows-UxInit
Microsoft-Windows-UxInit
Microsoft-Windows-BranchCacheClientEventProvider
Microsoft-Windows-BranchCacheClientEventProvider
Microsoft-Windows-Forwarding
Microsoft-Windows-Forwarding
Microsoft-Windows-RPC-Proxy-LBS
Microsoft-Windows-RPC-Proxy-LBS
Microsoft-Windows-Kernel-Disk
Microsoft-Windows-Kernel-Disk
Microsoft-Windows-TriggerEmulatorProvider
Microsoft-Windows-TriggerEmulatorProvider
Microsoft-Windows-SystemHealthAgent
Microsoft-Windows-SystemHealthAgent
Microsoft-Windows-Memory-Diagnostic-Task-Handler
Microsoft-Windows-Memory-Diagnostic-Task-Handler
Microsoft-Windows-Winsock-WS2HELP
Microsoft-Windows-Winsock-WS2HELP
Microsoft-Windows-ThemeUI
Microsoft-Windows-ThemeUI
Microsoft-Windows-TerminalServices-MediaRedirection
Microsoft-Windows-TerminalServices-MediaRedirection
Microsoft-Windows-TerminalServices-ClientUSBDevices
Microsoft-Windows-TerminalServices-ClientUSBDevices
Microsoft-Windows-TabletPC-CoreInkRecognition
Microsoft-Windows-TabletPC-CoreInkRecognition
Microsoft-Windows-COM
Microsoft-Windows-COM
Microsoft-Windows-PnPMgrTriggerProvider
Microsoft-Windows-PnPMgrTriggerProvider
Microsoft-Windows-LoadPerf
Microsoft-Windows-LoadPerf
Microsoft-Windows-System-Restore
Microsoft-Windows-System-Restore
Microsoft-Windows-UserAccountControl
Microsoft-Windows-UserAccountControl
Microsoft-Windows-Services-Svchost
Microsoft-Windows-Services-Svchost
Microsoft-Windows-PushNotifications-Developer
Microsoft-Windows-PushNotifications-Developer
Microsoft-Windows-LiveId
Microsoft-Windows-LiveId
Microsoft-Windows-Security-SPP-UX
Microsoft-Windows-Security-SPP-UX
Microsoft-Windows-VAN
Microsoft-Windows-VAN
Microsoft-Windows-FirstUX-PerfInstrumentation
Microsoft-Windows-FirstUX-PerfInstrumentation
Microsoft-Windows-Kernel-Tm
Microsoft-Windows-Kernel-Tm
Microsoft-Windows-Kernel-ShimEngine
Microsoft-Windows-Kernel-ShimEngine
Microsoft-Windows-EapHost
Microsoft-Windows-EapHost
Microsoft-Windows-CertPolEng
Microsoft-Windows-CertPolEng
Microsoft-Windows-MsLbfoEventProvider
Microsoft-Windows-MsLbfoEventProvider
Microsoft-Windows-Complus
Microsoft-Windows-Complus
Microsoft-Windows-EFS
Microsoft-Windows-EFS
Microsoft-Windows-WwaHost
Microsoft-Windows-WwaHost
Microsoft-Windows-ServerManager
Microsoft-Windows-ServerManager
Microsoft-Windows-ComDlg32
Microsoft-Windows-ComDlg32
Microsoft-Windows-MP4SDECD
Microsoft-Windows-MP4SDECD
Microsoft-Windows-PeopleNearMe
Microsoft-Windows-PeopleNearMe
Microsoft-Windows-SmartCard-Bluetooth-Profile
Microsoft-Windows-SmartCard-Bluetooth-Profile
Microsoft-Windows-TZUtil
Microsoft-Windows-TZUtil
Microsoft-Windows-ApplicationExperience-SwitchBack
Microsoft-Windows-ApplicationExperience-SwitchBack
Microsoft-Windows-UI-Input-Inking
Microsoft-Windows-UI-Input-Inking
Microsoft-Windows-VDRVROOT
Microsoft-Windows-VDRVROOT
Windows Firewall NetShell Plugin
Windows Firewall NetShell Plugin
Windows Firewall API
Windows Firewall API
Microsoft-Windows-Kernel-Acpi
Microsoft-Windows-Kernel-Acpi
Microsoft-Windows-WinRM
Microsoft-Windows-WinRM
Microsoft-Windows-Direct3D10_1
Microsoft-Windows-Direct3D10_1
Microsoft-Windows-Kernel-LicensingSqm
Microsoft-Windows-Kernel-LicensingSqm
Microsoft-Windows-SpoolerSpoolss
Microsoft-Windows-SpoolerSpoolss
Microsoft-Windows-FilterManager
Microsoft-Windows-FilterManager
Microsoft-Windows-ActionQueue
Microsoft-Windows-ActionQueue
Microsoft-Windows-IME-KRAPI
Microsoft-Windows-IME-KRAPI
Microsoft-Windows-Resource-Exhaustion-Detector
Microsoft-Windows-Resource-Exhaustion-Detector
Microsoft-Windows-ApplicationExperienceInfrastructure
Microsoft-Windows-ApplicationExperienceInfrastructure
Microsoft-Windows-StorSqm
Microsoft-Windows-StorSqm
Microsoft-Windows-Search
Microsoft-Windows-Search
Microsoft-Windows-HttpEvent
Microsoft-Windows-HttpEvent
Microsoft-Windows-AxInstallService
Microsoft-Windows-AxInstallService
Microsoft-Windows-Diagnosis-PerfHost
Microsoft-Windows-Diagnosis-PerfHost
Microsoft-Windows-International
Microsoft-Windows-International
Microsoft-Windows-CertificateServicesClient-CredentialRoaming
Microsoft-Windows-CertificateServicesClient-CredentialRoaming
Microsoft-Windows-SoftwareRestrictionPolicies
Microsoft-Windows-SoftwareRestrictionPolicies
Microsoft-Windows-Windows Defender
Microsoft-Windows-Windows Defender
Microsoft-Windows-ShareMedia-ControlPanel
Microsoft-Windows-ShareMedia-ControlPanel
Microsoft-Windows-CertificateServicesClient-Lifecycle-User
Microsoft-Windows-CertificateServicesClient-Lifecycle-User
Microsoft-Windows-WPD-MTPUS
Microsoft-Windows-WPD-MTPUS
Microsoft-Windows-DirectWrite
Microsoft-Windows-DirectWrite
Microsoft-Windows-RPCSS
Microsoft-Windows-RPCSS
Microsoft-Windows-DeviceSync
Microsoft-Windows-DeviceSync
Microsoft-Windows-NcdAutoSetup
Microsoft-Windows-NcdAutoSetup
Microsoft-Windows-Diagnosis-PCW
Microsoft-Windows-Diagnosis-PCW
Microsoft-Windows-DistributedCOM
Microsoft-Windows-DistributedCOM
ATA Port Driver Tracing Provider
ATA Port Driver Tracing Provider
Microsoft-Windows-WebdavClient-LookupServiceTrigger
Microsoft-Windows-WebdavClient-LookupServiceTrigger
Microsoft-Windows-USB-USBXHCI
Microsoft-Windows-USB-USBXHCI
Microsoft-Windows-Diagnosis-PLA
Microsoft-Windows-Diagnosis-PLA
Microsoft-Windows-WlanConn
Microsoft-Windows-WlanConn
Microsoft-Windows-Winlogon
Microsoft-Windows-Winlogon
Microsoft-Windows-stobject
Microsoft-Windows-stobject
Microsoft-Windows-Mobile-Broadband-Experience-SmsRouter
Microsoft-Windows-Mobile-Broadband-Experience-SmsRouter
Microsoft-Windows-D3D10Level9
Microsoft-Windows-D3D10Level9
Microsoft-Windows-WAS-ListenerAdapter
Microsoft-Windows-WAS-ListenerAdapter
Microsoft-Windows-ServerManager-MultiMachine
Microsoft-Windows-ServerManager-MultiMachine
Microsoft-Windows-AppxPackagingOM
Microsoft-Windows-AppxPackagingOM
Microsoft-Windows-PushNotifications-Platform
Microsoft-Windows-PushNotifications-Platform
Microsoft-Windows-OOBE-Machine-Plugins-Wireless
Microsoft-Windows-OOBE-Machine-Plugins-Wireless
Microsoft-Windows-IME-JPAPI
Microsoft-Windows-IME-JPAPI
SBP2 Port Driver Tracing Provider
SBP2 Port Driver Tracing Provider
Microsoft-Windows-BranchCacheEventProvider
Microsoft-Windows-BranchCacheEventProvider
Microsoft-Windows-Immersive-Shell-API
Microsoft-Windows-Immersive-Shell-API
Microsoft-Windows-ntshrui
Microsoft-Windows-ntshrui
Microsoft-Windows-KPSSVC
Microsoft-Windows-KPSSVC
Microsoft-Windows-BitLocker-DrivePreparationTool
Microsoft-Windows-BitLocker-DrivePreparationTool
Microsoft-Windows-EapMethods-Sim
Microsoft-Windows-EapMethods-Sim
Microsoft-Windows-Shell-ZipFolder
Microsoft-Windows-Shell-ZipFolder
Microsoft-Windows-Search-Core
Microsoft-Windows-Search-Core
Microsoft-Windows-OfflineFiles-CscNetApi
Microsoft-Windows-OfflineFiles-CscNetApi
Microsoft-Windows-Diagnosis-WDI
Microsoft-Windows-Diagnosis-WDI
Microsoft-Windows-PortableDeviceSyncProvider
Microsoft-Windows-PortableDeviceSyncProvider
Microsoft-Windows-Diagnostics-PerfTrack-Counters
Microsoft-Windows-Diagnostics-PerfTrack-Counters
Microsoft-Windows-Speech-TTS
Microsoft-Windows-Speech-TTS
Microsoft-Windows-Component-Resources-MrmCore-Events
Microsoft-Windows-Component-Resources-MrmCore-Events
Microsoft-Windows-BranchCache
Microsoft-Windows-BranchCache
Microsoft-Windows-SystemEventsBroker
Microsoft-Windows-SystemEventsBroker
Microsoft-Windows-VolumeControl
Microsoft-Windows-VolumeControl
Microsoft-Windows-Win32k
Microsoft-Windows-Win32k
Microsoft-Windows-Kernel-WHEA
Microsoft-Windows-Kernel-WHEA
Microsoft-Windows-P2P-Meetings
Microsoft-Windows-P2P-Meetings
Microsoft-Windows-Diagnosis-WDC
Microsoft-Windows-Diagnosis-WDC
Microsoft-Windows-Serial-ClassExtension
Microsoft-Windows-Serial-ClassExtension
Microsoft-Windows-KPSSVC-WPP
Microsoft-Windows-KPSSVC-WPP
Microsoft-Windows-CertificateServices-Deployment
Microsoft-Windows-CertificateServices-Deployment
Microsoft-Windows-PerfOS
Microsoft-Windows-PerfOS
Microsoft-Windows-ResetEng
Microsoft-Windows-ResetEng
Microsoft-Windows-Runtime-Graphics
Microsoft-Windows-Runtime-Graphics
Microsoft-Windows-IPSEC-SRV
Microsoft-Windows-IPSEC-SRV
Microsoft-Windows-CorruptedFileRecovery-Server
Microsoft-Windows-CorruptedFileRecovery-Server
Windows Mobile Bluetooth Connectivity
Windows Mobile Bluetooth Connectivity
Microsoft-Windows-DLNA-Namespace
Microsoft-Windows-DLNA-Namespace
Microsoft-Windows-WLAN-MediaManager
Microsoft-Windows-WLAN-MediaManager
Certificate Services Client Trace
Certificate Services Client Trace
Microsoft-Windows-BranchCacheSMB
Microsoft-Windows-BranchCacheSMB
Microsoft-Windows-PrintService-USBMon
Microsoft-Windows-PrintService-USBMon
Microsoft-Windows-OOBE-Machine
Microsoft-Windows-OOBE-Machine
Microsoft-Windows-DXP
Microsoft-Windows-DXP
Microsoft-Windows-Immersive-Shell
Microsoft-Windows-Immersive-Shell
Microsoft-Windows-OOBE-Machine-Plugins
Microsoft-Windows-OOBE-Machine-Plugins
Microsoft-Windows-Reliability-Analysis-Engine
Microsoft-Windows-Reliability-Analysis-Engine
Microsoft-Windows-Application-Experience
Microsoft-Windows-Application-Experience
Microsoft-Windows-KdsSvc
Microsoft-Windows-KdsSvc
Microsoft-Windows-MediaFoundation-Platform
Microsoft-Windows-MediaFoundation-Platform
Microsoft-Windows-Security-Configuration-Wizard
Microsoft-Windows-Security-Configuration-Wizard
Microsoft-Windows-DisplayColorCalibration
Microsoft-Windows-DisplayColorCalibration
Windows Mobile Device Center Base
Windows Mobile Device Center Base
Microsoft-Windows-WPD-MTPClassDriver
Microsoft-Windows-WPD-MTPClassDriver
Microsoft-Windows-DNS-Client
Microsoft-Windows-DNS-Client
Microsoft-Windows-MSDTC Client
Microsoft-Windows-MSDTC Client
Microsoft-Windows-NDIS-PacketCapture
Microsoft-Windows-NDIS-PacketCapture
Windows Remote Management Trace
Windows Remote Management Trace
Microsoft-Windows-MSPaint
Microsoft-Windows-MSPaint
Microsoft-Windows-HomeGroup-ListenerService
Microsoft-Windows-HomeGroup-ListenerService
Microsoft-Windows-Sensor-Service-Trigger
Microsoft-Windows-Sensor-Service-Trigger
Microsoft-Windows-EapMethods-Ttls
Microsoft-Windows-EapMethods-Ttls
Microsoft-Windows-Remotefs-Smb
Microsoft-Windows-Remotefs-Smb
Microsoft-Windows-SMBWitnessClient
Microsoft-Windows-SMBWitnessClient
Microsoft-Windows-USB-USBHUB
Microsoft-Windows-USB-USBHUB
Microsoft-Windows-DirectWrite-FontCache
Microsoft-Windows-DirectWrite-FontCache
Microsoft-Windows-WindowsBackup
Microsoft-Windows-WindowsBackup
Microsoft-Windows-NWiFi
Microsoft-Windows-NWiFi
Microsoft-Windows-WER-Diag
Microsoft-Windows-WER-Diag
Microsoft-Windows-UAC
Microsoft-Windows-UAC
Microsoft-Windows-LUA
Microsoft-Windows-LUA
Microsoft-Windows-AppID
Microsoft-Windows-AppID
Microsoft-Windows-IIS-WMSVC
Microsoft-Windows-IIS-WMSVC
Microsoft-Windows-Shell-OpenWith
Microsoft-Windows-Shell-OpenWith
Microsoft-Windows-MediaFoundation-MFReadWrite
Microsoft-Windows-MediaFoundation-MFReadWrite
Microsoft-Windows-BrokerInfrastructure
Microsoft-Windows-BrokerInfrastructure
Microsoft-Windows-Fault-Tolerant-Heap
Microsoft-Windows-Fault-Tolerant-Heap
Microsoft-Windows-Shell-DefaultPrograms
Microsoft-Windows-Shell-DefaultPrograms
Microsoft-Windows-Dism-Cli
Microsoft-Windows-Dism-Cli
Microsoft-Windows-SMBDirect
Microsoft-Windows-SMBDirect
Microsoft-Windows-IME-SCTIP
Microsoft-Windows-IME-SCTIP
Microsoft-Windows-EnergyEfficiencyWizard
Microsoft-Windows-EnergyEfficiencyWizard
Microsoft-Windows-ParentalControls
Microsoft-Windows-ParentalControls
Microsoft-Windows-Smartcard-Server
Microsoft-Windows-Smartcard-Server
Microsoft-Windows-FMS
Microsoft-Windows-FMS
Microsoft-Windows-Devices-Location
Microsoft-Windows-Devices-Location
Microsoft-Windows-LLTD-Responder
Microsoft-Windows-LLTD-Responder
Microsoft-Windows-MsLbfoSysEvtProvider
Microsoft-Windows-MsLbfoSysEvtProvider
sqlos
sqlos
Microsoft-Windows-TerminalServices-RemoteConnectionManager
Microsoft-Windows-TerminalServices-RemoteConnectionManager
Microsoft-Windows-SCPNP
Microsoft-Windows-SCPNP
Microsoft-Windows-Wordpad
Microsoft-Windows-Wordpad
WMI_Tracing_Client_Operations
WMI_Tracing_Client_Operations
Microsoft-Windows-Security-Audit-Configuration-Client
Microsoft-Windows-Security-Audit-Configuration-Client
Microsoft-Windows-EFSADU
Microsoft-Windows-EFSADU
Windows Notification Facility Provider
Windows Notification Facility Provider
Microsoft-Windows-DiagCpl
Microsoft-Windows-DiagCpl
Windows NetworkItemFactory Trace
Windows NetworkItemFactory Trace
Microsoft-Windows-ApplicationExperience-Cache
Microsoft-Windows-ApplicationExperience-Cache
Microsoft-Windows-ResourcePublication
Microsoft-Windows-ResourcePublication
Microsoft-Windows-FailoverClustering-Client
Microsoft-Windows-FailoverClustering-Client
Microsoft-Windows-Runtime-Networking-BackgroundTransfer
Microsoft-Windows-Runtime-Networking-BackgroundTransfer
Microsoft-Windows-AppHost
Microsoft-Windows-AppHost
Microsoft-Windows-NetAdapterCim-Diag
Microsoft-Windows-NetAdapterCim-Diag
Microsoft-Windows-IIS-FTP
Microsoft-Windows-IIS-FTP
Microsoft-Windows-Iphlpsvc
Microsoft-Windows-Iphlpsvc
Microsoft-Windows-WinINet
Microsoft-Windows-WinINet
Microsoft-Windows-TabletPC-InputPersonalization
Microsoft-Windows-TabletPC-InputPersonalization
Microsoft-Windows-SpoolerFilterPipelineSVC
Microsoft-Windows-SpoolerFilterPipelineSVC
Microsoft-Windows-Globalization
Microsoft-Windows-Globalization
Microsoft-Windows-Bits-Client
Microsoft-Windows-Bits-Client
Microsoft-Windows-WFP
Microsoft-Windows-WFP
Microsoft-Windows-Services
Microsoft-Windows-Services
Microsoft-Windows-IdleTriggerProvider
Microsoft-Windows-IdleTriggerProvider
Microsoft-Windows-DxgKrnl
Microsoft-Windows-DxgKrnl
Microsoft-Windows-HealthCenter
Microsoft-Windows-HealthCenter
Microsoft-Windows-OtpCredentialProviderEvt
Microsoft-Windows-OtpCredentialProviderEvt
Microsoft-Windows-MemoryDiagnostics-Results
Microsoft-Windows-MemoryDiagnostics-Results
Microsoft-Windows-Ncasvc
Microsoft-Windows-Ncasvc
Microsoft-Windows-SystemSettings
Microsoft-Windows-SystemSettings
Microsoft-Windows-PDH
Microsoft-Windows-PDH
Microsoft-Windows-WMPNSSUI
Microsoft-Windows-WMPNSSUI
Microsoft-Windows-BdeTriggerProvider
Microsoft-Windows-BdeTriggerProvider
Microsoft-Windows-Diagnostics-PerfTrack
Microsoft-Windows-Diagnostics-PerfTrack
Microsoft-Windows-IIS-APPHOSTSVC
Microsoft-Windows-IIS-APPHOSTSVC
Microsoft-Windows-CoreWindow
Microsoft-Windows-CoreWindow
Microsoft-Windows-Help
Microsoft-Windows-Help
Microsoft-Windows-WindowsUpdateClient
Microsoft-Windows-WindowsUpdateClient
Microsoft-Windows-IIS-W3SVC-PerfCounters
Microsoft-Windows-IIS-W3SVC-PerfCounters
Microsoft-Windows-WMI
Microsoft-Windows-WMI
Microsoft-Windows-TabletPC-Platform-Input-Wisp
Microsoft-Windows-TabletPC-Platform-Input-Wisp
Microsoft-Windows-ProcessExitMonitor
Microsoft-Windows-ProcessExitMonitor
Microsoft-Windows-IME-JPSetting
Microsoft-Windows-IME-JPSetting
Microsoft-Windows-Diagnosis-Scripted
Microsoft-Windows-Diagnosis-Scripted
Microsoft-Windows-GroupPolicyTriggerProvider
Microsoft-Windows-GroupPolicyTriggerProvider
File Kernel Trace; Operation Set 2
File Kernel Trace; Operation Set 2
Microsoft-Windows-IIS-Configuration
Microsoft-Windows-IIS-Configuration
Microsoft-Windows-Diagnosis-TaskManager
Microsoft-Windows-Diagnosis-TaskManager
Microsoft-Windows-Diagnosis-DPS
Microsoft-Windows-Diagnosis-DPS
Microsoft-Windows-UserPnp
Microsoft-Windows-UserPnp
Microsoft-Windows-Security-SPP-UX-GenuineCenter-Logging
Microsoft-Windows-Security-SPP-UX-GenuineCenter-Logging
Microsoft-Windows-Schannel-Events
Microsoft-Windows-Schannel-Events
NetJoin
NetJoin
Microsoft-Windows-TabletPC-InputPanel
Microsoft-Windows-TabletPC-InputPanel
Microsoft-Windows-FileServices-ServerManager-EventProvider
Microsoft-Windows-FileServices-ServerManager-EventProvider
Microsoft-Windows-MediaFoundation-Performance
Microsoft-Windows-MediaFoundation-Performance
Microsoft-Windows-EndpointTriggerProvider
Microsoft-Windows-EndpointTriggerProvider
Microsoft-Windows-IME-KRTIP
Microsoft-Windows-IME-KRTIP
Microsoft-Windows-Mobile-Broadband-Experience-SmsApi
Microsoft-Windows-Mobile-Broadband-Experience-SmsApi
Microsoft-Windows-Hyper-V-Netvsc
Microsoft-Windows-Hyper-V-Netvsc
Microsoft-Windows-DirectSound
Microsoft-Windows-DirectSound
Microsoft-Windows-TabletPC-Platform-Input-Core
Microsoft-Windows-TabletPC-Platform-Input-Core
Microsoft-Windows-PushNotifications-InProc
Microsoft-Windows-PushNotifications-InProc
Microsoft-Windows-Kernel-Network
Microsoft-Windows-Kernel-Network
Microsoft-Windows-DiskDiagnosticResolver
Microsoft-Windows-DiskDiagnosticResolver
Microsoft-Windows-NdisImPlatformSysEvtProvider
Microsoft-Windows-NdisImPlatformSysEvtProvider
Microsoft-Windows-MeetingSpace
Microsoft-Windows-MeetingSpace
Microsoft-Windows-Base-Filtering-Engine-Resource-Flows
Microsoft-Windows-Base-Filtering-Engine-Resource-Flows
Microsoft-Windows-RasServer
Microsoft-Windows-RasServer
Microsoft-Windows-VHDMP
Microsoft-Windows-VHDMP
Microsoft-Windows-WindowsSystemAssessmentTool
Microsoft-Windows-WindowsSystemAssessmentTool
Microsoft-Windows-DCLocator
Microsoft-Windows-DCLocator
Microsoft-Windows-Diagnosis-MSDT
Microsoft-Windows-Diagnosis-MSDT
Microsoft-Windows-WLGPA
Microsoft-Windows-WLGPA
SQLSRV32.1
SQLSRV32.1
Microsoft-Windows-CertificateServicesClient-CertEnroll
Microsoft-Windows-CertificateServicesClient-CertEnroll
Microsoft-Windows-IME-TCCORE
Microsoft-Windows-IME-TCCORE
Microsoft-Windows-SmartCard-Bluetooth-Transport
Microsoft-Windows-SmartCard-Bluetooth-Transport
Microsoft-Windows-WMVENCOD
Microsoft-Windows-WMVENCOD
Microsoft-Windows-mobsync
Microsoft-Windows-mobsync
Microsoft-Windows-EFSTriggerProvider
Microsoft-Windows-EFSTriggerProvider
Microsoft-Windows-DUSER
Microsoft-Windows-DUSER
Microsoft-Windows-DiskDiagnosticDataCollector
Microsoft-Windows-DiskDiagnosticDataCollector
Microsoft-Windows-DirectAccess-MediaManager
Microsoft-Windows-DirectAccess-MediaManager
Microsoft-Windows-DisplaySwitch
Microsoft-Windows-DisplaySwitch
Microsoft-Windows-PackageStateRoaming
Microsoft-Windows-PackageStateRoaming
Microsoft-Windows-Crypto-DPAPI
Microsoft-Windows-Crypto-DPAPI
Microsoft-Windows-IME-CustomerFeedbackManagerUI
Microsoft-Windows-IME-CustomerFeedbackManagerUI
sqlserver
sqlserver
Microsoft-Windows-User-Loader
Microsoft-Windows-User-Loader
Microsoft-Windows-NetworkProfileTriggerProvider
Microsoft-Windows-NetworkProfileTriggerProvider
Microsoft-Windows-NetworkProfile
Microsoft-Windows-NetworkProfile
Windows Firewall API - GP
Windows Firewall API - GP
Microsoft-Windows-CmiSetup
Microsoft-Windows-CmiSetup
Microsoft-Windows-Sysprep
Microsoft-Windows-Sysprep
Microsoft-Windows-Windeploy
Microsoft-Windows-Windeploy
Microsoft-Windows-Setup
Microsoft-Windows-Setup
Microsoft-Windows-OobeLdr
Microsoft-Windows-OobeLdr
Microsoft-Windows-SetupUGC
Microsoft-Windows-SetupUGC
Microsoft-Windows-Audit
Microsoft-Windows-Audit
Microsoft-Windows-SetupCl
Microsoft-Windows-SetupCl
Microsoft-Windows-Winsrv
Microsoft-Windows-Winsrv
Microsoft-Windows-WinHttp
Microsoft-Windows-WinHttp
Microsoft-Windows-RadioManager
Microsoft-Windows-RadioManager
Microsoft-Windows-Websocket-Protocol-Component
Microsoft-Windows-Websocket-Protocol-Component
Microsoft-Windows-WebIO
Microsoft-Windows-WebIO
Microsoft-Windows-Dwm-Core
Microsoft-Windows-Dwm-Core
Microsoft-Windows-Registry-SQM-Provider
Microsoft-Windows-Registry-SQM-Provider
Microsoft-Windows-WHEA-Logger
Microsoft-Windows-WHEA-Logger
Microsoft-Windows-PeerToPeerDrtEventProvider
Microsoft-Windows-PeerToPeerDrtEventProvider
Microsoft-Windows-BitLocker-Driver
Microsoft-Windows-BitLocker-Driver
Microsoft-Windows-SettingSync
Microsoft-Windows-SettingSync
Microsoft-Windows-Mobile-Broadband-Experience-Api-Internal
Microsoft-Windows-Mobile-Broadband-Experience-Api-Internal
Microsoft-Windows-EnhancedStorage-EhStorTcgDrv
Microsoft-Windows-EnhancedStorage-EhStorTcgDrv
Microsoft-Windows-PowerShell
Microsoft-Windows-PowerShell
Microsoft-Windows-DirectShow-Core
Microsoft-Windows-DirectShow-Core
Microsoft-Windows-Kernel-Power
Microsoft-Windows-Kernel-Power
Microsoft-Windows-msmpeg2venc
Microsoft-Windows-msmpeg2venc
Microsoft-Windows-MPEG2_DLNA-Encoder
Microsoft-Windows-MPEG2_DLNA-Encoder
Microsoft-Windows-Remote-FileSystem-Log
Microsoft-Windows-Remote-FileSystem-Log
Microsoft-Windows-Kernel-PnP
Microsoft-Windows-Kernel-PnP
Microsoft-Windows-AppXDeployment-Server
Microsoft-Windows-AppXDeployment-Server
Microsoft-Windows-Folder Redirection
Microsoft-Windows-Folder Redirection
Microsoft-Windows-OfflineFiles-CscUM
Microsoft-Windows-OfflineFiles-CscUM
Microsoft-Windows-ServerManager-DeploymentProvider
Microsoft-Windows-ServerManager-DeploymentProvider
Microsoft-Windows-ServiceReportingApi
Microsoft-Windows-ServiceReportingApi
Microsoft-Windows-StorDiag
Microsoft-Windows-StorDiag
Microsoft-Windows-IME-CustomerFeedbackManager
Microsoft-Windows-IME-CustomerFeedbackManager
Microsoft-Windows-Kernel-EventTracing
Microsoft-Windows-Kernel-EventTracing
Microsoft-Windows-Kernel-BootDiagnostics
Microsoft-Windows-Kernel-BootDiagnostics
Microsoft-Windows-DXGI
Microsoft-Windows-DXGI
Microsoft-Windows-Build-RegDll
Microsoft-Windows-Build-RegDll
Microsoft-Windows-PNRPSvc
Microsoft-Windows-PNRPSvc
Microsoft-Windows-Ndu
Microsoft-Windows-Ndu
Microsoft-Windows-Firewall
Microsoft-Windows-Firewall
Microsoft-Windows-Wcmsvc
Microsoft-Windows-Wcmsvc
Microsoft-Windows-OLEACC
Microsoft-Windows-OLEACC
Microsoft-Windows-MSDTC Client 2
Microsoft-Windows-MSDTC Client 2
Microsoft-Windows-InputSwitch
Microsoft-Windows-InputSwitch
Microsoft-Windows-Runtime-WebAPI
Microsoft-Windows-Runtime-WebAPI
Microsoft-Windows-HAL
Microsoft-Windows-HAL
Microsoft-Windows-International-RegionalOptionsControlPanel
Microsoft-Windows-International-RegionalOptionsControlPanel
Microsoft-Windows-RPC
Microsoft-Windows-RPC
Microsoft-Windows-MFH264Enc
Microsoft-Windows-MFH264Enc
Microsoft-Windows-SharedAccess_NAT
Microsoft-Windows-SharedAccess_NAT
Microsoft-Windows-DeviceAssociationService
Microsoft-Windows-DeviceAssociationService
Microsoft-Windows-Bluetooth-MTPEnum
Microsoft-Windows-Bluetooth-MTPEnum
Microsoft-Windows-BitLocker-API
Microsoft-Windows-BitLocker-API
{C5BFFE2E-9D87-D568-A09E-08FC83D0C7C2}
{C5BFFE2E-9D87-D568-A09E-08FC83D0C7C2}
Microsoft-Windows-IPMIProvider
Microsoft-Windows-IPMIProvider
Microsoft-Windows-IME-TIP
Microsoft-Windows-IME-TIP
Microsoft-Windows-WindowsToGo-StartupOptions
Microsoft-Windows-WindowsToGo-StartupOptions
Microsoft-Windows-Backup
Microsoft-Windows-Backup
Microsoft-Windows-WMP-MediaDeliveryEngine
Microsoft-Windows-WMP-MediaDeliveryEngine
Microsoft-Windows-PrintBRM
Microsoft-Windows-PrintBRM
Microsoft-Windows-ServerManager-ConfigureSMRemoting
Microsoft-Windows-ServerManager-ConfigureSMRemoting
Microsoft-Windows-Video-For-Windows
Microsoft-Windows-Video-For-Windows
Microsoft-Windows-ClearTypeTextTuner
Microsoft-Windows-ClearTypeTextTuner
Microsoft-Windows-Subsys-Csr
Microsoft-Windows-Subsys-Csr
Microsoft-Windows-USB-UCX
Microsoft-Windows-USB-UCX
Microsoft-Windows-RemoteApp and Desktop Connections
Microsoft-Windows-RemoteApp and Desktop Connections
Windows Winlogon Trace
Windows Winlogon Trace
Microsoft-Windows-RasSstp
Microsoft-Windows-RasSstp
Microsoft-Windows-UAC-FileVirtualization
Microsoft-Windows-UAC-FileVirtualization
Microsoft-Windows-ClassicSruMon
Microsoft-Windows-ClassicSruMon
Microsoft-Windows-Security-IdentityListener
Microsoft-Windows-Security-IdentityListener
Microsoft-Windows-WWAN-MM-EVENTS
Microsoft-Windows-WWAN-MM-EVENTS
Microsoft-Windows-MsiServer
Microsoft-Windows-MsiServer
Microsoft-Windows-PhotoAcq
Microsoft-Windows-PhotoAcq
Microsoft-Windows-Power-Troubleshooter
Microsoft-Windows-Power-Troubleshooter
Microsoft-Windows-DxpTaskSyncProvider
Microsoft-Windows-DxpTaskSyncProvider
Microsoft-Windows-Remotefs-Rdbss
Microsoft-Windows-Remotefs-Rdbss
Microsoft-Windows-AppIDServiceTrigger
Microsoft-Windows-AppIDServiceTrigger
Microsoft-Windows-Kernel-File
Microsoft-Windows-Kernel-File
Microsoft-Windows-TSF-msctf
Microsoft-Windows-TSF-msctf
Microsoft-Windows-PowerCpl
Microsoft-Windows-PowerCpl
Microsoft-Windows-LanGPA
Microsoft-Windows-LanGPA
Microsoft-Windows-WWAN-MediaManager
Microsoft-Windows-WWAN-MediaManager
Microsoft-Windows-PrimaryNetworkIcon
Microsoft-Windows-PrimaryNetworkIcon
Microsoft-Windows-OfflineFiles
Microsoft-Windows-OfflineFiles
Microsoft-Windows-UIAnimation
Microsoft-Windows-UIAnimation
Microsoft-Windows-Security-Auditing
Microsoft-Windows-Security-Auditing
Microsoft-Windows-WCN-Config-Registrar-Wizard-Trace
Microsoft-Windows-WCN-Config-Registrar-Wizard-Trace
Microsoft-Windows-WWAN-NDISUIO-EVENTS
Microsoft-Windows-WWAN-NDISUIO-EVENTS
Microsoft-Windows-NetworkManagerTriggerProvider
Microsoft-Windows-NetworkManagerTriggerProvider
Microsoft-Windows-Winsock-AFD
Microsoft-Windows-Winsock-AFD
Microsoft-Windows-Remote-FileSystem-Monitor
Microsoft-Windows-Remote-FileSystem-Monitor
Microsoft-Windows-WABSyncProvider
Microsoft-Windows-WABSyncProvider
.NET Common Language Runtime
.NET Common Language Runtime
Microsoft-Windows-MSMPEG2VDEC
Microsoft-Windows-MSMPEG2VDEC
Microsoft-Windows-DateTimeControlPanel
Microsoft-Windows-DateTimeControlPanel
Windows Firewall Driver
Windows Firewall Driver
Microsoft-Windows-IIS-W3SVC
Microsoft-Windows-IIS-W3SVC
Microsoft-Windows-WWAN-UI-EVENTS
Microsoft-Windows-WWAN-UI-EVENTS
Microsoft-Windows-Speech-UserExperience
Microsoft-Windows-Speech-UserExperience
Microsoft-Windows-Dism-Api
Microsoft-Windows-Dism-Api
Microsoft-Windows-Store-Client-UI
Microsoft-Windows-Store-Client-UI
Microsoft-Windows-Calculator
Microsoft-Windows-Calculator
Microsoft-Windows-Shell-ConnectedAccountState
Microsoft-Windows-Shell-ConnectedAccountState
Microsoft-Windows-PrintDialogs
Microsoft-Windows-PrintDialogs
Microsoft-Windows-Network-and-Sharing-Center
Microsoft-Windows-Network-and-Sharing-Center
Microsoft-Windows-Crypto-RNG
Microsoft-Windows-Crypto-RNG
Microsoft-Windows-MSDTC 2
Microsoft-Windows-MSDTC 2
Microsoft-Windows-SpellChecker
Microsoft-Windows-SpellChecker
Microsoft-Windows-propsys
Microsoft-Windows-propsys
Microsoft-Windows-WPD-MTPIP
Microsoft-Windows-WPD-MTPIP
Microsoft-Windows-Documents
Microsoft-Windows-Documents
Microsoft-Windows-StorPort
Microsoft-Windows-StorPort
Microsoft-Windows-Magnification
Microsoft-Windows-Magnification
Microsoft-Windows-Shell-AuthUI
Microsoft-Windows-Shell-AuthUI
Microsoft-Windows-Dwm-Redir
Microsoft-Windows-Dwm-Redir
Microsoft-Windows-BTH-BTHUSB
Microsoft-Windows-BTH-BTHUSB
Microsoft-Windows-Ntfs
Microsoft-Windows-Ntfs
Microsoft-Windows-Sens
Microsoft-Windows-Sens
Microsoft-Windows-UserAccessLogging
Microsoft-Windows-UserAccessLogging
Microsoft-Windows-RemoteDesktopServices-RdpCoreTS
Microsoft-Windows-RemoteDesktopServices-RdpCoreTS
Microsoft-Windows-COM-Perf
Microsoft-Windows-COM-Perf
Microsoft-Windows-StorageSpaces-BackgroundAgent
Microsoft-Windows-StorageSpaces-BackgroundAgent
Microsoft-Windows-Kernel-Prefetch
Microsoft-Windows-Kernel-Prefetch
Portable Device Connectivity API Trace
Portable Device Connectivity API Trace
Microsoft-Windows-RemoteAssistance
Microsoft-Windows-RemoteAssistance
Microsoft-Windows-MF
Microsoft-Windows-MF
Microsoft-Windows-MediaFoundation-MSVProc
Microsoft-Windows-MediaFoundation-MSVProc
Microsoft-Windows-TBS
Microsoft-Windows-TBS
Microsoft-Windows-FeedbackTool
Microsoft-Windows-FeedbackTool
Microsoft-Windows-WlanPref
Microsoft-Windows-WlanPref
Microsoft-Windows-OfflineFiles-CscDclUser
Microsoft-Windows-OfflineFiles-CscDclUser
Microsoft-Windows-Http-SQM-Provider
Microsoft-Windows-Http-SQM-Provider
Microsoft-Windows-Wireless-Network-Setup-Wizard-Trace
Microsoft-Windows-Wireless-Network-Setup-Wizard-Trace
Microsoft-Windows-MCT
Microsoft-Windows-MCT
Microsoft-Windows-HotStart
Microsoft-Windows-HotStart
Microsoft-Windows-Diagnostics-Networking
Microsoft-Windows-Diagnostics-Networking
Microsoft-Windows-Sensors
Microsoft-Windows-Sensors
Microsoft-Windows-SmbServer
Microsoft-Windows-SmbServer
Microsoft-Windows-USB-USBHUB3
Microsoft-Windows-USB-USBHUB3
Microsoft-Windows-Dot3MM
Microsoft-Windows-Dot3MM
Microsoft-Windows-KernelStreaming
Microsoft-Windows-KernelStreaming
Microsoft-Windows-Mobile-Broadband-Experience-Api
Microsoft-Windows-Mobile-Broadband-Experience-Api
Microsoft-Windows-VolumeSnapshot-Driver
Microsoft-Windows-VolumeSnapshot-Driver
Microsoft-Windows-MobilityCenter
Microsoft-Windows-MobilityCenter
Microsoft-Windows-OfflineFiles-CscService
Microsoft-Windows-OfflineFiles-CscService
Microsoft-Windows-Superfetch
Microsoft-Windows-Superfetch
Microsoft-Windows-IPBusEnum
Microsoft-Windows-IPBusEnum
Microsoft-Windows-Mprddm
Microsoft-Windows-Mprddm
Microsoft-Windows-Dwm-Udwm
Microsoft-Windows-Dwm-Udwm
Microsoft-Windows-AppModel-State
Microsoft-Windows-AppModel-State
Microsoft-Windows-WCN-FD-Provider-Trace
Microsoft-Windows-WCN-FD-Provider-Trace
Microsoft-Windows-Resource-Exhaustion-Resolver
Microsoft-Windows-Resource-Exhaustion-Resolver
Microsoft-Windows-Iphlpsvc-Trace
Microsoft-Windows-Iphlpsvc-Trace
Microsoft-Windows-WUSA
Microsoft-Windows-WUSA
Microsoft-Windows-TerminalServices-LocalSessionManager
Microsoft-Windows-TerminalServices-LocalSessionManager
Microsoft-Windows-RPC-FirewallManager
Microsoft-Windows-RPC-FirewallManager
Microsoft-Windows-WCN-Common-Trace
Microsoft-Windows-WCN-Common-Trace
Microsoft-Windows-MediaFoundation-MFCaptureEngine
Microsoft-Windows-MediaFoundation-MFCaptureEngine
Microsoft-Windows-ReadyBoostDriver
Microsoft-Windows-ReadyBoostDriver
Microsoft-Windows-DUI
Microsoft-Windows-DUI
Microsoft-Windows-WMP-Setup_WM
Microsoft-Windows-WMP-Setup_WM
Microsoft-Windows-Direct3D10
Microsoft-Windows-Direct3D10
Microsoft-Windows-DfsSvc
Microsoft-Windows-DfsSvc
Microsoft-Windows-IME-SCCORE
Microsoft-Windows-IME-SCCORE
Microsoft-Windows-NTLM
Microsoft-Windows-NTLM
Microsoft-Windows-VWiFi
Microsoft-Windows-VWiFi
Microsoft-Windows-Kernel-PnPConfig
Microsoft-Windows-Kernel-PnPConfig
Microsoft-Windows-Winsock-SQM
Microsoft-Windows-Winsock-SQM
Microsoft-Windows-SpoolerSpoolSV
Microsoft-Windows-SpoolerSpoolSV
Microsoft-Windows-Netshell
Microsoft-Windows-Netshell
Microsoft-Windows-UserModePowerService
Microsoft-Windows-UserModePowerService
Microsoft-Windows-HttpService
Microsoft-Windows-HttpService
HTTP Service Trace
HTTP Service Trace
Microsoft-Windows-D3D9
Microsoft-Windows-D3D9
Microsoft-Windows-AppModel-Runtime
Microsoft-Windows-AppModel-Runtime
Microsoft-Windows-CEIP
Microsoft-Windows-CEIP
Microsoft-Windows-Directory-Services-SAM
Microsoft-Windows-Directory-Services-SAM
Microsoft-Windows-SpoolerTCPMon
Microsoft-Windows-SpoolerTCPMon
Microsoft-Windows-ReadyBoost
Microsoft-Windows-ReadyBoost
Microsoft-Windows-L2NACP
Microsoft-Windows-L2NACP
Microsoft-Windows-LLTD-Mapper
Microsoft-Windows-LLTD-Mapper
Microsoft-Windows-Deduplication
Microsoft-Windows-Deduplication
Microsoft-Windows-HomeGroup-ControlPanel
Microsoft-Windows-HomeGroup-ControlPanel
Microsoft-Windows-Mobile-Broadband-Experience-Parser-Task
Microsoft-Windows-Mobile-Broadband-Experience-Parser-Task
Microsoft-Windows-DomainJoinManagerTriggerProvider
Microsoft-Windows-DomainJoinManagerTriggerProvider
Microsoft-Windows-SruMon
Microsoft-Windows-SruMon
Microsoft-Windows-ELS-Hyphenation
Microsoft-Windows-ELS-Hyphenation
TCPIP Service Trace
TCPIP Service Trace
Microsoft-Windows-DriverFrameworks-KernelMode
Microsoft-Windows-DriverFrameworks-KernelMode
Microsoft-Windows-CorruptedFileRecovery-Client
Microsoft-Windows-CorruptedFileRecovery-Client
Microsoft-Windows-WMI-Activity
Microsoft-Windows-WMI-Activity
Microsoft-Windows-COMRuntime
Microsoft-Windows-COMRuntime
Microsoft-Windows-WAS
Microsoft-Windows-WAS
Microsoft-Windows-Wnv
Microsoft-Windows-Wnv
Microsoft-Windows-Shsvcs
Microsoft-Windows-Shsvcs
Microsoft-Windows-NDIS
Microsoft-Windows-NDIS
Microsoft-Windows-WinMDE
Microsoft-Windows-WinMDE
File Kernel Trace; Operation Set 1
File Kernel Trace; Operation Set 1
Microsoft-Windows-Proximity-Common
Microsoft-Windows-Proximity-Common
Microsoft-Windows-Ntfs-UBPM
Microsoft-Windows-Ntfs-UBPM
Microsoft-Windows-Kernel-Registry
Microsoft-Windows-Kernel-Registry
Microsoft-Windows-RemoteDesktopServices-RemoteDesktopSessionManager
Microsoft-Windows-RemoteDesktopServices-RemoteDesktopSessionManager
Microsoft-Windows-TunnelDriver
Microsoft-Windows-TunnelDriver
Microsoft-Windows-QoS-Pacer
Microsoft-Windows-QoS-Pacer
Microsoft-Windows-EventCollector
Microsoft-Windows-EventCollector
Microsoft-Windows-OOBE-Machine-DUI
Microsoft-Windows-OOBE-Machine-DUI
Microsoft-Windows-IME-TCTIP
Microsoft-Windows-IME-TCTIP
Microsoft-Windows-WCNWiz
Microsoft-Windows-WCNWiz
Microsoft-Windows-Display
Microsoft-Windows-Display
Microsoft-Windows-OcSetup
Microsoft-Windows-OcSetup
Microsoft-Windows-DesktopWindowManager-Diag
Microsoft-Windows-DesktopWindowManager-Diag
Microsoft-Windows-FileInfoMinifilter
Microsoft-Windows-FileInfoMinifilter
Microsoft-Windows-TextPredictionEngine
Microsoft-Windows-TextPredictionEngine
Microsoft-Windows-NetworkGCW
Microsoft-Windows-NetworkGCW
Microsoft-Windows-DHCPv6-Client
Microsoft-Windows-DHCPv6-Client
Microsoft-Windows-PlayToManager
Microsoft-Windows-PlayToManager
NDIS_STATUS_TCP_CONNECTION_OFFLOAD_CURRENT_CONFIG
NDIS_STATUS_TCP_CONNECTION_OFFLOAD_CURRENT_CONFIG
NDIS_STATUS_PORT_STATE
NDIS_STATUS_PORT_STATE
MS_Windows_AeLookupServiceTrigger_Provider
MS_Windows_AeLookupServiceTrigger_Provider
Microsoft_Windows_SQM_Provider
Microsoft_Windows_SQM_Provider
MS_Windows_AIT_Provider
MS_Windows_AIT_Provider
NDIS_TCP_CONNECTION_OFFLOAD_CURRENT_CONFIG
NDIS_TCP_CONNECTION_OFFLOAD_CURRENT_CONFIG
NDIS_TCP_OFFLOAD_CURRENT_CONFIG
NDIS_TCP_OFFLOAD_CURRENT_CONFIG
PARPORT_WMI_ALLOCATE_FREE_COUNTS_GUID
PARPORT_WMI_ALLOCATE_FREE_COUNTS_GUID
NDIS_GEN_ENUMERATE_PORTS
NDIS_GEN_ENUMERATE_PORTS
GUID_QOS_TC_SUPPORTED
GUID_QOS_TC_SUPPORTED
MS1394_PortVendorRegisterAccessGuid
MS1394_PortVendorRegisterAccessGuid
iSCSI_PersistentLoginsGuid
iSCSI_PersistentLoginsGuid
iSCSI_PortalInfoClassGuid
iSCSI_PortalInfoClassGuid
SerailPortPerfGuid
SerailPortPerfGuid
PortClsEvent
PortClsEvent
UdpIpGuid
UdpIpGuid
TcpIpGuid
TcpIpGuid
iSCSI_OperationsGuid
iSCSI_OperationsGuid
CTLGUID_usbport
CTLGUID_usbport
NDIS_STATUS_TCP_CONNECTION_OFFLOAD_HARDWARE_CAPABILITIES
NDIS_STATUS_TCP_CONNECTION_OFFLOAD_HARDWARE_CAPABILITIES
iSCSI_DiscoveryOperationsGuid
iSCSI_DiscoveryOperationsGuid
SerialPortNameGuid
SerialPortNameGuid
CTLGUID_WebClntTrace
CTLGUID_WebClntTrace
POINTER_PORT_WMI_STD_DATA_GUID
POINTER_PORT_WMI_STD_DATA_GUID
KEYBOARD_PORT_WMI_STD_DATA_GUID
KEYBOARD_PORT_WMI_STD_DATA_GUID
MSKeyboard_ClassInformationGuid
MSKeyboard_ClassInformationGuid
NDIS_GEN_CO_MEDIA_SUPPORTED
NDIS_GEN_CO_MEDIA_SUPPORTED
MS_Windows_AeSwitchBack_Provider
MS_Windows_AeSwitchBack_Provider
SerialPortHWGuid
SerialPortHWGuid
MS_SM_PortInformationMethods
MS_SM_PortInformationMethods
ataport_CtlGuid
ataport_CtlGuid
storport_CtlGuid
storport_CtlGuid
MS1394_PortDriverInformationGuid
MS1394_PortDriverInformationGuid
BTHPORT_WMI_HCI_PACKET_INFO
BTHPORT_WMI_HCI_PACKET_INFO
SerialPortCommGuid
SerialPortCommGuid
iScsiLBOperationsGuid
iScsiLBOperationsGuid
MS_Windows_AeCache_Provider
MS_Windows_AeCache_Provider
NDIS_GEN_PORT_STATE
NDIS_GEN_PORT_STATE
WindowsBackup TracingControlGuid
WindowsBackup TracingControlGuid
WmiMonitorListedSupportedSourceModes_GUID
WmiMonitorListedSupportedSourceModes_GUID
NDIS_GEN_MEDIA_SUPPORTED
NDIS_GEN_MEDIA_SUPPORTED
CTLGUID_certprop
CTLGUID_certprop
BTHPORT_WMI_SDP_SERVER_LOG_INFO
BTHPORT_WMI_SDP_SERVER_LOG_INFO
KEYBOARD_PORT_WMI_EXTENDED_ID
KEYBOARD_PORT_WMI_EXTENDED_ID
iSCSIRedirectPortalGuid
iSCSIRedirectPortalGuid
NDIS_GEN_PORT_AUTHENTICATION_PARAMETERS
NDIS_GEN_PORT_AUTHENTICATION_PARAMETERS
BTHPORT_WMI_SDP_DATABASE_EVENT
BTHPORT_WMI_SDP_DATABASE_EVENT
NDIS_TCP_CONNECTION_OFFLOAD_HARDWARE_CAPABILITIES
NDIS_TCP_CONNECTION_OFFLOAD_HARDWARE_CAPABILITIES
iSCSI_TCPIPConfigGuid
iSCSI_TCPIPConfigGuid
SerialPortPropertiesGuid
SerialPortPropertiesGuid
PortCls_IrpProcessing
PortCls_IrpProcessing
iSCSI_SecurityConfigOperationsGuid
iSCSI_SecurityConfigOperationsGuid
NDIS_TCP_OFFLOAD_PARAMETERS
NDIS_TCP_OFFLOAD_PARAMETERS
PortCls_PowerState
PortCls_PowerState
Microsoft_Windows_GameUx
Microsoft_Windows_GameUx
iSCSI_InitiatorLoginStatisticsGuid
iSCSI_InitiatorLoginStatisticsGuid
MS1394_PortErrorInformationGuid
MS1394_PortErrorInformationGuid
PortCls_PinState
PortCls_PinState
CTLGUID_PortCls
CTLGUID_PortCls
NDIS_TCP_OFFLOAD_HARDWARE_CAPABILITIES
NDIS_TCP_OFFLOAD_HARDWARE_CAPABILITIES
CTRLGUID_MF_PIPELINE
CTRLGUID_MF_PIPELINE
.PX`i`
.PX`i`
`.HBS
`.HBS
&{%UD(_
&{%UD(_
dump_wmi_guidentries failed, error %d, status %X
dump_wmi_guidentries failed, error %d, status %X
dump_wmi_guidentries failed, error %d
dump_wmi_guidentries failed, error %d
dump_wmi_guidentries: cannot alloc %X bytes (total %d)
dump_wmi_guidentries: cannot alloc %X bytes (total %d)
dump_wmi_guidentries: read failed, error %d, status %X
dump_wmi_guidentries: read failed, error %d, status %X
dump_wmi_guidentries: read failed, error %d
dump_wmi_guidentries: read failed, error %d
WMI guidentries: total %X readed %X:
WMI guidentries: total %X readed %X:
[%X] %X flag %X refcnt %X - %s
[%X] %X flag %X refcnt %X - %s
[%X] %X flag %X refcnt %X %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X
[%X] %X flag %X refcnt %X %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X
dump_wmi_regentries failed, error %d, status %X
dump_wmi_regentries failed, error %d, status %X
dump_wmi_regentries failed, error %d
dump_wmi_regentries failed, error %d
dump_wmi_regentries: cannot alloc %X bytes (total %d)
dump_wmi_regentries: cannot alloc %X bytes (total %d)
dump_wmi_regentries: read failed, error %d, status %X
dump_wmi_regentries: read failed, error %d, status %X
dump_wmi_regentries: read failed, error %d
dump_wmi_regentries: read failed, error %d
WMI regentries: total %X readed %X:
WMI regentries: total %X readed %X:
[%X] flags %X refcnt %X dev %p prov %X DS %p %s
[%X] flags %X refcnt %X dev %p prov %X DS %p %s
[%X] flags %X refcnt %X cb %p prov %X DS %p %s
[%X] flags %X refcnt %X cb %p prov %X DS %p %s
Etw[%d]:
Etw[%d]:
Type %X Index %X InternalCB %p (%s) %s
Type %X Index %X InternalCB %p (%s) %s
Type %X Index %X InternalCB %p %s
Type %X Index %X InternalCB %p %s
Type %X Index %X InternalCB %p (%s) ProviderId: %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X
Type %X Index %X InternalCB %p (%s) ProviderId: %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X
Type %X Index %X InternalCB %p ProviderId: %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X
Type %X Index %X InternalCB %p ProviderId: %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X
dump_Etw: exception occured, code %X
dump_Etw: exception occured, code %X
dump_Etws: exception occured, code %X
dump_Etws: exception occured, code %X
KPRCB.EtwSupport %p:
KPRCB.EtwSupport %p:
KPRCB[%d].EtwSupport %p:
KPRCB[%d].EtwSupport %p:
read_kernel_etws count failed, error %d, ntstatus %X
read_kernel_etws count failed, error %d, ntstatus %X
read_kernel_etws count failed, error %d
read_kernel_etws count failed, error %d
read_kernel_etws: cannot alloc %X bytes
read_kernel_etws: cannot alloc %X bytes
read_kernel_etws failed, error %d, ntstatus %X
read_kernel_etws failed, error %d, ntstatus %X
read_kernel_etws failed, error %d
read_kernel_etws failed, error %d
KEtw[%X]:
KEtw[%X]:
KEtw[%X]: RefCount %d, KProvider - %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X
KEtw[%X]: RefCount %d, KProvider - %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X
KEtw[%X]: RefCount %d %s
KEtw[%X]: RefCount %d %s
[%X] %p %s
[%X] %p %s
Type %X InUse %d Index %X InternalCB %p (%s) %s
Type %X InUse %d Index %X InternalCB %p (%s) %s
Type %X InUse %d Index %X InternalCB %p %s
Type %X InUse %d Index %X InternalCB %p %s
Type %X InUse %d Index %X InternalCB %p (%s) ProviderId: %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X
Type %X InUse %d Index %X InternalCB %p (%s) ProviderId: %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X
Type %X InUse %d Index %X InternalCB %p ProviderId: %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X
Type %X InUse %d Index %X InternalCB %p ProviderId: %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X
EtwCallback[%d] %p %s:
EtwCallback[%d] %p %s:
EtwCallback[%d]:
EtwCallback[%d]:
EtwTrace[%d] %p Ctx %p %s:
EtwTrace[%d] %p Ctx %p %s:
EtwTrace[%d] %p Ctx %p %s - %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X
EtwTrace[%d] %p Ctx %p %s - %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X
Unknown type %d for Etw[%d]
Unknown type %d for Etw[%d]
DEVINTERFACE_MT_TRANSPORT
DEVINTERFACE_MT_TRANSPORT
DEVINTERFACE_KEYBOARD
DEVINTERFACE_KEYBOARD
DEVINTERFACE_COMPORT
DEVINTERFACE_COMPORT
DEVINTERFACE_VIAMINIPORT
DEVINTERFACE_VIAMINIPORT
DEVINTERFACE_STORAGEPORT
DEVINTERFACE_STORAGEPORT
DEVINTERFACE_IRPORT
DEVINTERFACE_IRPORT
check_pnp_notifiers failed, error %d, status %X
check_pnp_notifiers failed, error %d, status %X
check_pnp_notifiers failed, error %d
check_pnp_notifiers failed, error %d
check_pnp_notifiers: cannot alloc %X bytes (total %d)
check_pnp_notifiers: cannot alloc %X bytes (total %d)
check_pnp_notifiers: read failed, error %d, status %X
check_pnp_notifiers: read failed, error %d, status %X
check_pnp_notifiers: read failed, error %d
check_pnp_notifiers: read failed, error %d
Pnp Notifiers: total %d, readed %d
Pnp Notifiers: total %d, readed %d
Pnp[%d] %p %s %s addr %p
Pnp[%d] %p %s %s addr %p
Pnp[%d] %s %s addr %p %s
Pnp[%d] %s %s addr %p %s
check_pnp_handlers failed, error %d, status %X
check_pnp_handlers failed, error %d, status %X
check_pnp_handlers failed, error %d
check_pnp_handlers failed, error %d
PlugPlayHandlerTable: %d items
PlugPlayHandlerTable: %d items
PlugPlayHandlerTable[%d] %p %s
PlugPlayHandlerTable[%d] %p %s
PlugPlayHandlerTable[%d] %p
PlugPlayHandlerTable[%d] %p
check_sess_notify, error %d, status %X
check_sess_notify, error %d, status %X
check_sess_notify, error %d
check_sess_notify, error %d
check_sess_notify: cannot alloc %X bytes (total %d)
check_sess_notify: cannot alloc %X bytes (total %d)
check_sess_notify: read failed, error %d, status %X
check_sess_notify: read failed, error %d, status %X
check_sess_notify: read failed, error %d
check_sess_notify: read failed, error %d
IopSessionNotifications: %d
IopSessionNotifications: %d
SessionNotifier[%d]: class %d len %X session %p cb %p %s
SessionNotifier[%d]: class %d len %X session %p cb %p %s
check_sess_term_ntfs failed, error %d, status %X
check_sess_term_ntfs failed, error %d, status %X
check_sess_term_ntfs failed, error %d
check_sess_term_ntfs failed, error %d
check_sess_term_ntfs: cannot alloc %X bytes (total %d)
check_sess_term_ntfs: cannot alloc %X bytes (total %d)
check_sess_term_ntfs: read failed, error %d, status %X
check_sess_term_ntfs: read failed, error %d, status %X
check_sess_term_ntfs: read failed, error %d
check_sess_term_ntfs: read failed, error %d
LogonSessionTerminatedRoutines: %d
LogonSessionTerminatedRoutines: %d
[%d] %p %s
[%d] %p %s
check_fs_changes failed, error %d, status %X
check_fs_changes failed, error %d, status %X
check_fs_changes failed, error %d
check_fs_changes failed, error %d
check_fs_changes: cannot alloc %X bytes (total %d)
check_fs_changes: cannot alloc %X bytes (total %d)
check_fs_changes: read failed, error %d, status %X
check_fs_changes: read failed, error %d, status %X
check_fs_changes: read failed, error %d
check_fs_changes: read failed, error %d
FS Change notifiers: %d (actual %d)
FS Change notifiers: %d (actual %d)
DriverObj %p addr %p %s
DriverObj %p addr %p %s
Cannot read count for %s, error %d
Cannot read count for %s, error %d
Count of %s is too big - %X
Count of %s is too big - %X
Cannot read %s table, error %d
Cannot read %s table, error %d
Cannot read entry %d from table of %s, error %d
Cannot read entry %d from table of %s, error %d
check_vista_cmp_list get count failed, error %d, status %X
check_vista_cmp_list get count failed, error %d, status %X
check_vista_cmp_list get count failed, error %d
check_vista_cmp_list get count failed, error %d
check_vista_cmp_list failed, error %d, status %X
check_vista_cmp_list failed, error %d, status %X
check_vista_cmp_list failed, error %d
check_vista_cmp_list failed, error %d
check_ai_cbs: cannot read ExpDisQueryAttributeInformation, error %d, ntstatus %X
check_ai_cbs: cannot read ExpDisQueryAttributeInformation, error %d, ntstatus %X
check_ai_cbs: cannot read ExpDisQueryAttributeInformation, error %d
check_ai_cbs: cannot read ExpDisQueryAttributeInformation, error %d
ExpDisQueryAttributeInformation %p %s
ExpDisQueryAttributeInformation %p %s
check_ai_cbs: cannot read ExpDisSetAttributeInformation, error %d, ntstatus %X
check_ai_cbs: cannot read ExpDisSetAttributeInformation, error %d, ntstatus %X
check_ai_cbs: cannot read ExpDisSetAttributeInformation, error %d
check_ai_cbs: cannot read ExpDisSetAttributeInformation, error %d
ExpDisSetAttributeInformation %p %s
ExpDisSetAttributeInformation %p %s
check_dbgk_lkmd: cannot read DbgkLkmd_cblist, error %d, ntstatus %X
check_dbgk_lkmd: cannot read DbgkLkmd_cblist, error %d, ntstatus %X
check_dbgk_lkmd: cannot read DbgkLkmd_cblist, error %d
check_dbgk_lkmd: cannot read DbgkLkmd_cblist, error %d
DbgkLkmd[%d] callback %p %s
DbgkLkmd[%d] callback %p %s
check_fsrtl: cannot read FltMgrCallbacks, error %d, ntstatus %X
check_fsrtl: cannot read FltMgrCallbacks, error %d, ntstatus %X
check_fsrtl: cannot read FltMgrCallbacks, error %d
check_fsrtl: cannot read FltMgrCallbacks, error %d
FltMgrCallbacks: %p %s
FltMgrCallbacks: %p %s
check_fsrtl: cannot read FsRtlpMupCalls, error %d, ntstatus %X
check_fsrtl: cannot read FsRtlpMupCalls, error %d, ntstatus %X
check_fsrtl: cannot read FsRtlpMupCalls, error %d
check_fsrtl: cannot read FsRtlpMupCalls, error %d
FsRtlpMupCalls: %p %s
FsRtlpMupCalls: %p %s
check_Iof: cannot read pIofCallDriver, error %d, ntstatus %X
check_Iof: cannot read pIofCallDriver, error %d, ntstatus %X
check_Iof: cannot read pIofCallDriver, error %d
check_Iof: cannot read pIofCallDriver, error %d
pIofCallDriver %p patched by %s
pIofCallDriver %p patched by %s
check_Iof: cannot read pIofCompleteRequest, error %d, ntstatus %X
check_Iof: cannot read pIofCompleteRequest, error %d, ntstatus %X
check_Iof: cannot read pIofCompleteRequest, error %d
check_Iof: cannot read pIofCompleteRequest, error %d
pIofCompleteRequest %p patched by %s
pIofCompleteRequest %p patched by %s
check_Iof: cannot read pIoAllocateIrp, error %d, ntstatus %X
check_Iof: cannot read pIoAllocateIrp, error %d, ntstatus %X
check_Iof: cannot read pIoAllocateIrp, error %d
check_Iof: cannot read pIoAllocateIrp, error %d
pIoAllocateIrp %p patched by %s
pIoAllocateIrp %p patched by %s
check_Iof: cannot read pIoFreeIrp, error %d, ntstatus %X
check_Iof: cannot read pIoFreeIrp, error %d, ntstatus %X
check_Iof: cannot read pIoFreeIrp, error %d
check_Iof: cannot read pIoFreeIrp, error %d
pIoFreeIrp %p patched by %s
pIoFreeIrp %p patched by %s
check_Iof: cannot read HvlpHypercallCodeVa, error %d, ntstatus %X
check_Iof: cannot read HvlpHypercallCodeVa, error %d, ntstatus %X
check_Iof: cannot read HvlpHypercallCodeVa, error %d
check_Iof: cannot read HvlpHypercallCodeVa, error %d
HvlpHypercallCodeVa %p patched by %s
HvlpHypercallCodeVa %p patched by %s
%SystemRoot%\System32\sxssrv.dll
%SystemRoot%\System32\sxssrv.dll
%SystemRoot%\System32\csrsrv.dll
%SystemRoot%\System32\csrsrv.dll
%SystemRoot%\System32\basesrv.dll
%SystemRoot%\System32\basesrv.dll
%SystemRoot%\System32\winsrv.dll
%SystemRoot%\System32\winsrv.dll
%SystemRoot%\System32\lsasrv.dll
%SystemRoot%\System32\lsasrv.dll
%SystemRoot%\System32\ntdll.dll
%SystemRoot%\System32\ntdll.dll
KiDebugRoutine %p hooked by %s
KiDebugRoutine %p hooked by %s
PspLegoNotifyRoutine %p hooked by %s
PspLegoNotifyRoutine %p hooked by %s
KiTimeUpdateNotifyRoutine %p hooked by %s
KiTimeUpdateNotifyRoutine %p hooked by %s
KiSwapContextNotifyRoutine %p hooked by %s
KiSwapContextNotifyRoutine %p hooked by %s
KiThreadSelectNotifyRoutine %p hooked by %s
KiThreadSelectNotifyRoutine %p hooked by %s
Sysenter patched, addr %p not in %s !!!
Sysenter patched, addr %p not in %s !!!
Mailslot: %S
Mailslot: %S
NamedPipe: %S
NamedPipe: %S
DEVCLASS_MULTIPORTSERIAL
DEVCLASS_MULTIPORTSERIAL
DEVCLASS_PORTS
DEVCLASS_PORTS
DEVCLASS_KEYBOARD
DEVCLASS_KEYBOARD
DEVCLASS_APMSUPPORT
DEVCLASS_APMSUPPORT
read_dev_chrs(%S) failed, ntstatus %X
read_dev_chrs(%S) failed, ntstatus %X
DrvObj %p name %S %s
DrvObj %p name %S %s
DrvObj %p nameLen %X %s
DrvObj %p nameLen %X %s
dev_props failed, status %X
dev_props failed, status %X
ClassGUID: %S
ClassGUID: %S
ClassGUID: %S - %s
ClassGUID: %S - %s
Cannot open directory %S, error %X
Cannot open directory %S, error %X
Cannot realloc %d bytes
Cannot realloc %d bytes
Cannot open device directory, error %X
Cannot open device directory, error %X
Cannot open driver directory, error %X
Cannot open driver directory, error %X
Cannot open FileSystem directory, error %X
Cannot open FileSystem directory, error %X
Unknown HAL private dispatch table version %X
Unknown HAL private dispatch table version %X
HalAcpiTimerInit: %p %s
HalAcpiTimerInit: %p %s
HalAcpiTimerCarry: %p %s
HalAcpiTimerCarry: %p %s
HalAcpiMachineStateInit: %p %s
HalAcpiMachineStateInit: %p %s
HalAcpiQueryFlags: %p %s
HalAcpiQueryFlags: %p %s
HalAcpiPicStateIntact: %p %s
HalAcpiPicStateIntact: %p %s
HalRestoreInterruptControllerState: %p %s
HalRestoreInterruptControllerState: %p %s
HalPciInterfaceReadConfig: %p %s
HalPciInterfaceReadConfig: %p %s
HalPciInterfaceWriteConfig: %p %s
HalPciInterfaceWriteConfig: %p %s
HalSetVectorState: %p %s
HalSetVectorState: %p %s
HalGetApicVersion: %p %s
HalGetApicVersion: %p %s
HalSetMaxLegacyPciBusNumber: %p %s
HalSetMaxLegacyPciBusNumber: %p %s
HalIsVectorValid: %p %s
HalIsVectorValid: %p %s
HalAcpiGetTableDispatch: %p %s
HalAcpiGetTableDispatch: %p %s
HalAcpiGetRsdpDispatch: %p %s
HalAcpiGetRsdpDispatch: %p %s
HalAcpiGetFacsMappingDispatch: %p %s
HalAcpiGetFacsMappingDispatch: %p %s
HalAcpiGetAllTablesDispatch: %p %s
HalAcpiGetAllTablesDispatch: %p %s
HalAcpiPmRegisterAvailable: %p %s
HalAcpiPmRegisterAvailable: %p %s
HalAcpiPmRegisterRead: %p %s
HalAcpiPmRegisterRead: %p %s
HalAcpiPmRegisterWrite: %p %s
HalAcpiPmRegisterWrite: %p %s
HalHandlerForBus: %p %s
HalHandlerForBus: %p %s
HalHandlerForConfigSpace: %p %s
HalHandlerForConfigSpace: %p %s
HalLocateHiberRanges: %p %s
HalLocateHiberRanges: %p %s
HalRegisterBusHandler: %p %s
HalRegisterBusHandler: %p %s
HalSetWakeEnable: %p %s
HalSetWakeEnable: %p %s
HalSetWakeAlarm: %p %s
HalSetWakeAlarm: %p %s
HalPciTranslateBusAddress: %p %s
HalPciTranslateBusAddress: %p %s
HalPciAssignSlotResources: %p %s
HalPciAssignSlotResources: %p %s
HalHaltSystem: %p %s
HalHaltSystem: %p %s
HalFindBusAddressTranslation: %p %s
HalFindBusAddressTranslation: %p %s
HalResetDisplay: %p %s
HalResetDisplay: %p %s
HalHandlerForBus: %p %s
HalHandlerForBus: %p %s
HalHandlerForConfigSpace: %p %s
HalHandlerForConfigSpace: %p %s
HalLocateHiberRanges: %p %s
HalLocateHiberRanges: %p %s
HalRegisterBusHandler: %p %s
HalRegisterBusHandler: %p %s
HalSetWakeEnable: %p %s
HalSetWakeEnable: %p %s
HalSetWakeAlarm: %p %s
HalSetWakeAlarm: %p %s
HalPciTranslateBusAddress: %p %s
HalPciTranslateBusAddress: %p %s
HalPciAssignSlotResources: %p %s
HalPciAssignSlotResources: %p %s
HalHaltSystem: %p %s
HalHaltSystem: %p %s
HalFindBusAddressTranslation: %p %s
HalFindBusAddressTranslation: %p %s
HalResetDisplay: %p %s
HalResetDisplay: %p %s
KdSetupPciDeviceForDebugging: %p %s
KdSetupPciDeviceForDebugging: %p %s
KdReleasePciDeviceforDebugging: %p %s
KdReleasePciDeviceforDebugging: %p %s
KdGetAcpiTablePhase0: %p %s
KdGetAcpiTablePhase0: %p %s
KdCheckPowerButton: %p %s
KdCheckPowerButton: %p %s
HalVectorToIDTEntry: %p %s
HalVectorToIDTEntry: %p %s
KdMapPhysicalMemory64: %p %s
KdMapPhysicalMemory64: %p %s
KdUnmapVirtualAddress: %p %s
KdUnmapVirtualAddress: %p %s
HalMmMemoryUsage: %p %s
HalMmMemoryUsage: %p %s
HalAllocateMapRegisters: %p %s
HalAllocateMapRegisters: %p %s
KdGetPciDataByOffset: %p %s
KdGetPciDataByOffset: %p %s
KdSetPciDataByOffset: %p %s
KdSetPciDataByOffset: %p %s
HalGetInterruptVector: %p %s
HalGetInterruptVector: %p %s
HalGetVectorInput: %p %s
HalGetVectorInput: %p %s
HalLoadMicrocode: %p %s
HalLoadMicrocode: %p %s
HalUnloadMicrocode: %p %s
HalUnloadMicrocode: %p %s
HalMcUpdatePostUpdate: %p %s
HalMcUpdatePostUpdate: %p %s
HalAllocateMessageTarget: %p %s
HalAllocateMessageTarget: %p %s
HalFreeMessageTarget: %p %s
HalFreeMessageTarget: %p %s
HalDpReplaceBegin: %p %s
HalDpReplaceBegin: %p %s
HalDpReplaceTarget: %p %s
HalDpReplaceTarget: %p %s
HalDpReplaceControl: %p %s
HalDpReplaceControl: %p %s
HalDpReplaceEnd: %p %s
HalDpReplaceEnd: %p %s
HalPrepareForBugcheck: %p %s
HalPrepareForBugcheck: %p %s
HalQueryWakeTime: %p %s
HalQueryWakeTime: %p %s
HalReportIdleStateUsage: %p %s
HalReportIdleStateUsage: %p %s
HalHandlerForBus: %p %s
HalHandlerForBus: %p %s
HalHandlerForConfigSpace: %p %s
HalHandlerForConfigSpace: %p %s
HalLocateHiberRanges: %p %s
HalLocateHiberRanges: %p %s
HalRegisterBusHandler: %p %s
HalRegisterBusHandler: %p %s
HalSetWakeEnable: %p %s
HalSetWakeEnable: %p %s
HalSetWakeAlarm: %p %s
HalSetWakeAlarm: %p %s
HalPciTranslateBusAddress: %p %s
HalPciTranslateBusAddress: %p %s
HalPciAssignSlotResources: %p %s
HalPciAssignSlotResources: %p %s
HalHaltSystem: %p %s
HalHaltSystem: %p %s
HalFindBusAddressTranslation: %p %s
HalFindBusAddressTranslation: %p %s
HalResetDisplay: %p %s
HalResetDisplay: %p %s
HalAllocateMapRegisters: %p %s
HalAllocateMapRegisters: %p %s
KdSetupPciDeviceForDebugging: %p %s
KdSetupPciDeviceForDebugging: %p %s
KdReleasePciDeviceforDebugging: %p %s
KdReleasePciDeviceforDebugging: %p %s
KdGetAcpiTablePhase0: %p %s
KdGetAcpiTablePhase0: %p %s
KdCheckPowerButton: %p %s
KdCheckPowerButton: %p %s
HalVectorToIDTEntry: %p %s
HalVectorToIDTEntry: %p %s
KdMapPhysicalMemory64: %p %s
KdMapPhysicalMemory64: %p %s
KdUnmapVirtualAddress: %p %s
KdUnmapVirtualAddress: %p %s
KdGetPciDataByOffset: %p %s
KdGetPciDataByOffset: %p %s
KdSetPciDataByOffset: %p %s
KdSetPciDataByOffset: %p %s
HalGetInterruptVector: %p %s
HalGetInterruptVector: %p %s
HalGetVectorInput: %p %s
HalGetVectorInput: %p %s
HalLoadMicrocode: %p %s
HalLoadMicrocode: %p %s
HalUnloadMicrocode: %p %s
HalUnloadMicrocode: %p %s
HalMcUpdatePostUpdate: %p %s
HalMcUpdatePostUpdate: %p %s
HalAllocateMessageTarget: %p %s
HalAllocateMessageTarget: %p %s
HalFreeMessageTarget: %p %s
HalFreeMessageTarget: %p %s
HalDpReplaceBegin: %p %s
HalDpReplaceBegin: %p %s
HalDpReplaceTarget: %p %s
HalDpReplaceTarget: %p %s
HalDpReplaceControl: %p %s
HalDpReplaceControl: %p %s
HalDpReplaceEnd: %p %s
HalDpReplaceEnd: %p %s
HalPrepareForBugcheck: %p %s
HalPrepareForBugcheck: %p %s
HalQueryWakeTime: %p %s
HalQueryWakeTime: %p %s
HalReportIdleStateUsage: %p %s
HalReportIdleStateUsage: %p %s
HalTscSynchronization: %p %s
HalTscSynchronization: %p %s
HalWheaInitProcessorGenericSection: %p %s
HalWheaInitProcessorGenericSection: %p %s
HalStopLegacyUsbInterrupts: %p %s
HalStopLegacyUsbInterrupts: %p %s
HalReadWheaPhysicalMemory: %p %s
HalReadWheaPhysicalMemory: %p %s
HalWriteWheaPhysicalMemory: %p %s
HalWriteWheaPhysicalMemory: %p %s
HalDpMaskLevelTriggeredInterrupts: %p %s
HalDpMaskLevelTriggeredInterrupts: %p %s
HalDpUnmaskLevelTriggeredInterrupts: %p %s
HalDpUnmaskLevelTriggeredInterrupts: %p %s
HalDpGetInterruptReplayState: %p %s
HalDpGetInterruptReplayState: %p %s
HalDpReplayInterrupts: %p %s
HalDpReplayInterrupts: %p %s
HalQueryIoPortAccessSupported: %p %s
HalQueryIoPortAccessSupported: %p %s
HalHandlerForBus: %p %s
HalHandlerForBus: %p %s
HalHandlerForConfigSpace: %p %s
HalHandlerForConfigSpace: %p %s
HalLocateHiberRanges: %p %s
HalLocateHiberRanges: %p %s
HalRegisterBusHandler: %p %s
HalRegisterBusHandler: %p %s
HalSetWakeEnable: %p %s
HalSetWakeEnable: %p %s
HalSetWakeAlarm: %p %s
HalSetWakeAlarm: %p %s
HalPciTranslateBusAddress: %p %s
HalPciTranslateBusAddress: %p %s
HalPciAssignSlotResources: %p %s
HalPciAssignSlotResources: %p %s
HalHaltSystem: %p %s
HalHaltSystem: %p %s
HalFindBusAddressTranslation: %p %s
HalFindBusAddressTranslation: %p %s
HalResetDisplay: %p %s
HalResetDisplay: %p %s
HalAllocateMapRegisters: %p %s
HalAllocateMapRegisters: %p %s
KdSetupPciDeviceForDebugging: %p %s
KdSetupPciDeviceForDebugging: %p %s
KdReleasePciDeviceforDebugging: %p %s
KdReleasePciDeviceforDebugging: %p %s
KdGetAcpiTablePhase0: %p %s
KdGetAcpiTablePhase0: %p %s
KdCheckPowerButton: %p %s
KdCheckPowerButton: %p %s
HalVectorToIDTEntry: %p %s
HalVectorToIDTEntry: %p %s
KdMapPhysicalMemory64: %p %s
KdMapPhysicalMemory64: %p %s
KdUnmapVirtualAddress: %p %s
KdUnmapVirtualAddress: %p %s
KdGetPciDataByOffset: %p %s
KdGetPciDataByOffset: %p %s
KdSetPciDataByOffset: %p %s
KdSetPciDataByOffset: %p %s
HalGetInterruptVector: %p %s
HalGetInterruptVector: %p %s
HalGetVectorInput: %p %s
HalGetVectorInput: %p %s
HalLoadMicrocode: %p %s
HalLoadMicrocode: %p %s
HalUnloadMicrocode: %p %s
HalUnloadMicrocode: %p %s
HalMcUpdatePostUpdate: %p %s
HalMcUpdatePostUpdate: %p %s
HalAllocateMessageTarget: %p %s
HalAllocateMessageTarget: %p %s
HalFreeMessageTarget: %p %s
HalFreeMessageTarget: %p %s
HalDpReplaceBegin: %p %s
HalDpReplaceBegin: %p %s
HalDpReplaceTarget: %p %s
HalDpReplaceTarget: %p %s
HalDpReplaceControl: %p %s
HalDpReplaceControl: %p %s
HalDpReplaceEnd: %p %s
HalDpReplaceEnd: %p %s
HalPrepareForBugcheck: %p %s
HalPrepareForBugcheck: %p %s
HalQueryWakeTime: %p %s
HalQueryWakeTime: %p %s
HalReportIdleStateUsage: %p %s
HalReportIdleStateUsage: %p %s
HalTscSynchronization: %p %s
HalTscSynchronization: %p %s
HalWheaInitProcessorGenericSection: %p %s
HalWheaInitProcessorGenericSection: %p %s
HalStopLegacyUsbInterrupts: %p %s
HalStopLegacyUsbInterrupts: %p %s
HalReadWheaPhysicalMemory: %p %s
HalReadWheaPhysicalMemory: %p %s
HalWriteWheaPhysicalMemory: %p %s
HalWriteWheaPhysicalMemory: %p %s
HalInterruptMaskLevelTriggeredLines: %p %s
HalInterruptMaskLevelTriggeredLines: %p %s
HalInterruptUnmaskLevelTriggeredLines: %p %s
HalInterruptUnmaskLevelTriggeredLines: %p %s
HalDpGetInterruptReplayState: %p %s
HalDpGetInterruptReplayState: %p %s
HalDpReplayInterrupts: %p %s
HalDpReplayInterrupts: %p %s
HalQueryIoPortAccessSupported: %p %s
HalQueryIoPortAccessSupported: %p %s
KdSetupIntegratedDeviceForDebugging: %p %s
KdSetupIntegratedDeviceForDebugging: %p %s
KdReleaseIntegratedDeviceForDebugging: %p %s
KdReleaseIntegratedDeviceForDebugging: %p %s
HalEnlightenmentInitialize: %p %s
HalEnlightenmentInitialize: %p %s
HalAllocateEarlyPages: %p %s
HalAllocateEarlyPages: %p %s
HalMapEarlyPages: %p %s
HalMapEarlyPages: %p %s
HalTimerGetClockOwner: %p %s
HalTimerGetClockOwner: %p %s
HalTimerGetClockConfiguration: %p %s
HalTimerGetClockConfiguration: %p %s
HalTimerNotifyProcessorFreeze: %p %s
HalTimerNotifyProcessorFreeze: %p %s
HalTimerPrepareProcessorForIdle: %p %s
HalTimerPrepareProcessorForIdle: %p %s
HalDiagRegisterLogRoutine: %p %s
HalDiagRegisterLogRoutine: %p %s
HalTimerResumeProcessorFromIdle: %p %s
HalTimerResumeProcessorFromIdle: %p %s
HalTimerResetLastClockTick: %p %s
HalTimerResetLastClockTick: %p %s
HalVectorToIDTEntryEx: %p %s
HalVectorToIDTEntryEx: %p %s
HalSecondaryInterruptQueryPrimaryInformation: %p %s
HalSecondaryInterruptQueryPrimaryInformation: %p %s
HalMaskInterrupt: %p %s
HalMaskInterrupt: %p %s
HalUnmaskInterrupt: %p %s
HalUnmaskInterrupt: %p %s
HalIsInterruptTypeSecondary: %p %s
HalIsInterruptTypeSecondary: %p %s
HalAllocateGsivForSecondaryInterrupt: %p %s
HalAllocateGsivForSecondaryInterrupt: %p %s
HalAddInterruptRemapping: %p %s
HalAddInterruptRemapping: %p %s
HalRemoveInterruptRemapping: %p %s
HalRemoveInterruptRemapping: %p %s
HalSaveAndDisableEnlightenment: %p %s
HalSaveAndDisableEnlightenment: %p %s
HalRestoreHvEnlightenment: %p %s
HalRestoreHvEnlightenment: %p %s
HalPciEarlyRestore: %p %s
HalPciEarlyRestore: %p %s
HalInterruptGetLocalIdentifier: %p %s
HalInterruptGetLocalIdentifier: %p %s
HalAllocatePmcCounterSet: %p %s
HalAllocatePmcCounterSet: %p %s
HalCollectPmcCounters: %p %s
HalCollectPmcCounters: %p %s
HalFreePmcCounterSet: %p %s
HalFreePmcCounterSet: %p %s
HalTimerQueryCycleCounter: %p %s
HalTimerQueryCycleCounter: %p %s
HalTimerGetNextTickDuration: %p %s
HalTimerGetNextTickDuration: %p %s
HalPciMarkHiberPhase: %p %s
HalPciMarkHiberPhase: %p %s
HalInterruptQueryProcessorRestartEntryPoint: %p %s
HalInterruptQueryProcessorRestartEntryPoint: %p %s
HalInterruptRequestSecondaryInterrupt: %p %s
HalInterruptRequestSecondaryInterrupt: %p %s
HalInterruptEnumerateUnmaskedInterrupts: %p %s
HalInterruptEnumerateUnmaskedInterrupts: %p %s
HalBiosDisplayReset: %p %s
HalBiosDisplayReset: %p %s
HalGetDmaAdapter: %p %s
HalGetDmaAdapter: %p %s
HalCheckPowerButton: %p %s
HalCheckPowerButton: %p %s
HalMapPhysicalMemoryWriteThrough64: %p %s
HalMapPhysicalMemoryWriteThrough64: %p %s
HalUnmapVirtualAddress: %p %s
HalUnmapVirtualAddress: %p %s
HalKdReadPCIConfig: %p %s
HalKdReadPCIConfig: %p %s
HalKdWritePCIConfig: %p %s
HalKdWritePCIConfig: %p %s
HalTimerQueryWakeTime: %p %s
HalTimerQueryWakeTime: %p %s
HalTimerReportIdleStateUsage: %p %s
HalTimerReportIdleStateUsage: %p %s
HalKdEnumerateDebuggingDevices: %p %s
HalKdEnumerateDebuggingDevices: %p %s
HalFlushIoRectangleExternalCache: %p %s
HalFlushIoRectangleExternalCache: %p %s
HalPowerEarlyRestore: %p %s
HalPowerEarlyRestore: %p %s
HalQueryCapsuleCapabilities: %p %s
HalQueryCapsuleCapabilities: %p %s
HalUpdateCapsule: %p %s
HalUpdateCapsule: %p %s
HalPciMultiStageResumeCapable: %p %s
HalPciMultiStageResumeCapable: %p %s
check_hal_private_disp_table: cannot read table, error %d, ntstatus %X
check_hal_private_disp_table: cannot read table, error %d, ntstatus %X
check_hal_private_disp_table: cannot read table, error %d
check_hal_private_disp_table: cannot read table, error %d
check_hal_disp_table: cannot read table, error %d, ntstatus %X
check_hal_disp_table: cannot read table, error %d, ntstatus %X
check_hal_disp_table: cannot read table, error %d
check_hal_disp_table: cannot read table, error %d
HalQuerySystemInformation: %p %s
HalQuerySystemInformation: %p %s
HalSetSystemInformation: %p %s
HalSetSystemInformation: %p %s
HalQueryBusSlots: %p %s
HalQueryBusSlots: %p %s
HalExamineMBR: %p %s
HalExamineMBR: %p %s
HalIoReadPartitionTable: %p %s
HalIoReadPartitionTable: %p %s
HalIoSetPartitionInformation: %p %s
HalIoSetPartitionInformation: %p %s
HalIoWritePartitionTable: %p %s
HalIoWritePartitionTable: %p %s
HalReferenceHandlerForBus %p %s
HalReferenceHandlerForBus %p %s
HalReferenceBusHandler %p %s
HalReferenceBusHandler %p %s
HalDereferenceBusHandler %p %s
HalDereferenceBusHandler %p %s
HalInitPnpDriver %p %s
HalInitPnpDriver %p %s
HalInitPowerManagement %p %s
HalInitPowerManagement %p %s
HalGetDmaAdapter %p %s
HalGetDmaAdapter %p %s
HalGetInterruptTranslator %p %s
HalGetInterruptTranslator %p %s
HalStartMirroring %p %s
HalStartMirroring %p %s
HalEndMirroring %p %s
HalEndMirroring %p %s
HalMirrorPhysicalMemory %p %s
HalMirrorPhysicalMemory %p %s
HalEndOfBoot %p %s
HalEndOfBoot %p %s
HalMirrorVerify %p %s
HalMirrorVerify %p %s
HalGetCachedAcpiTable %p %s
HalGetCachedAcpiTable %p %s
HalSetPciErrorHandlerCallback %p %s
HalSetPciErrorHandlerCallback %p %s
read_hal_apci_disp_table return %X bytes, error %d, ntstatus %X
read_hal_apci_disp_table return %X bytes, error %d, ntstatus %X
read_hal_apci_disp_table return %X bytes, error %d
read_hal_apci_disp_table return %X bytes, error %d
Bad HalAcpiDispatchTable version: %X
Bad HalAcpiDispatchTable version: %X
read_gdt_size failed, error %d, ntstatus %X
read_gdt_size failed, error %d, ntstatus %X
read_gdt_size failed, error %d
read_gdt_size failed, error %d
Cannot alloc %d bytes for GDT entries
Cannot alloc %d bytes for GDT entries
read_gdt failed, error %d, ntstatus %X
read_gdt failed, error %d, ntstatus %X
read_gdt failed, error %d
read_gdt failed, error %d
Descriptor[%d] %s S %d DPL %d type %X base %X limit %X
Descriptor[%d] %s S %d DPL %d type %X base %X limit %X
WinChecker::dump_ldt failed, error %X, ntstatus %X
WinChecker::dump_ldt failed, error %X, ntstatus %X
WinChecker::dump_ldt failed, error %X
WinChecker::dump_ldt failed, error %X
WinChecker::dump_ldt: cannot alloc ldt array, size %X
WinChecker::dump_ldt: cannot alloc ldt array, size %X
Ldt[%d]:
Ldt[%d]:
Base: X
Base: X
Limit: X
Limit: X
AVL: %d
AVL: %d
D/B: %d
D/B: %d
DPL: %d
DPL: %d
G: %d
G: %d
P: %d
P: %d
S: %d
S: %d
Type: %d
Type: %d
Cannot read code for kinterrupt(%X) thunk, error %d
Cannot read code for kinterrupt(%X) thunk, error %d
IDT patched: unknown type %X selector %X addr %p for int%X
IDT patched: unknown type %X selector %X addr %p for int%X
IDT patched: unknown selector %X for int%X
IDT patched: unknown selector %X for int%X
IDT patched: int%X has unknown selector %X base %X limit %X addr %p
IDT patched: int%X has unknown selector %X base %X limit %X addr %p
IDT patched: int%X addr %p by module %s
IDT patched: int%X addr %p by module %s
IDT int%X addr %p KINTERRUPT %p
IDT int%X addr %p KINTERRUPT %p
IDT patched: int%X addr %p
IDT patched: int%X addr %p
Int%X: selector %X type TASK DPL %X base %X limit %X
Int%X: selector %X type TASK DPL %X base %X limit %X
Int%X: selector %X type %X DPL %X addr %p base %X limit %X
Int%X: selector %X type %X DPL %X addr %p base %X limit %X
Int%X: selector %X type %X DPL %X addr %p
Int%X: selector %X type %X DPL %X addr %p
read_idt_size failed, error %d, ntstatus %X
read_idt_size failed, error %d, ntstatus %X
read_idt_size failed, error %d
read_idt_size failed, error %d
read_idt: cannot alloc %d bytes for IDT storage
read_idt: cannot alloc %d bytes for IDT storage
read_idt failed, error %d, ntstatus %X
read_idt failed, error %d, ntstatus %X
read_idt failed, error %d
read_idt failed, error %d
Cannot read kinterrupt (%X), error %d
Cannot read kinterrupt (%X), error %d
KInterrupt %X (%p):
KInterrupt %X (%p):
Size %X type %X
Size %X type %X
ServiceRoutine %p %s
ServiceRoutine %p %s
DispatchAddress %p %s
DispatchAddress %p %s
check_ob_types: cannot read size of ObTypes list, error %d, ntstatus %X
check_ob_types: cannot read size of ObTypes list, error %d, ntstatus %X
check_ob_types: cannot read size of ObTypes list, error %d
check_ob_types: cannot read size of ObTypes list, error %d
check_ob_types: cannot read %d bytes (readed %d), error %d, ntstatus %X
check_ob_types: cannot read %d bytes (readed %d), error %d, ntstatus %X
check_ob_types: cannot read %d bytes (readed %d), error %d
check_ob_types: cannot read %d bytes (readed %d), error %d
fill_ob_type: cannot read ObType %S (%X), error %d
fill_ob_type: cannot read ObType %S (%X), error %d
Cannot read ObType %S (%X), error %d
Cannot read ObType %S (%X), error %d
ObType %S:
ObType %S:
DumpProcedure: %p %s
DumpProcedure: %p %s
OpenProcedure: %p %s
OpenProcedure: %p %s
CloseProcedure: %p %s
CloseProcedure: %p %s
DeleteProcedure: %p %s
DeleteProcedure: %p %s
ParseProcedure: %p %s
ParseProcedure: %p %s
SecurityProcedure: %p %s
SecurityProcedure: %p %s
QueryNameProcedure: %p %s
QueryNameProcedure: %p %s
OkayToCloseProcedure: %p %s
OkayToCloseProcedure: %p %s
ZwAlpcConnectPortEx
ZwAlpcConnectPortEx
ZwOpenKeyTransactedEx
ZwOpenKeyTransactedEx
ZwOpenKeyEx
ZwOpenKeyEx
ZwOpenKeyTransacted
ZwOpenKeyTransacted
ZwCreateKeyTransacted
ZwCreateKeyTransacted
ZwAlpcSendWaitReceivePort
ZwAlpcSendWaitReceivePort
ZwAlpcImpersonateClientOfPort
ZwAlpcImpersonateClientOfPort
ZwAlpcDisconnectPort
ZwAlpcDisconnectPort
ZwAlpcDeletePortSection
ZwAlpcDeletePortSection
ZwAlpcCreatePortSection
ZwAlpcCreatePortSection
ZwAlpcCreatePort
ZwAlpcCreatePort
ZwAlpcConnectPort
ZwAlpcConnectPort
ZwAlpcAcceptConnectPort
ZwAlpcAcceptConnectPort
ZwUnloadKey2
ZwUnloadKey2
ZwQueryOpenSubKeysEx
ZwQueryOpenSubKeysEx
ZwLoadKeyEx
ZwLoadKeyEx
ZwQueryPortInformationProcess
ZwQueryPortInformationProcess
ZwWaitForKeyedEvent
ZwWaitForKeyedEvent
ZwReleaseKeyedEvent
ZwReleaseKeyedEvent
ZwOpenKeyedEvent
ZwOpenKeyedEvent
ZwCreateKeyedEvent
ZwCreateKeyedEvent
ZwUnloadKeyEx
ZwUnloadKeyEx
ZwSaveKeyEx
ZwSaveKeyEx
ZwRenameKey
ZwRenameKey
ZwLockRegistryKey
ZwLockRegistryKey
ZwLockProductActivationKeys
ZwLockProductActivationKeys
ZwCompressKey
ZwCompressKey
ZwCompactKeys
ZwCompactKeys
ZwYieldExecution
ZwYieldExecution
ZwUnloadKey
ZwUnloadKey
ZwSetValueKey
ZwSetValueKey
ZwSetThreadExecutionState
ZwSetThreadExecutionState
ZwSetInformationKey
ZwSetInformationKey
ZwSetDefaultHardErrorPort
ZwSetDefaultHardErrorPort
ZwSecureConnectPort
ZwSecureConnectPort
ZwSaveMergedKeys
ZwSaveMergedKeys
ZwSaveKey
ZwSaveKey
ZwRestoreKey
ZwRestoreKey
ZwRequestWaitReplyPort
ZwRequestWaitReplyPort
ZwRequestPort
ZwRequestPort
ZwReplyWaitReplyPort
ZwReplyWaitReplyPort
ZwReplyWaitReceivePortEx
ZwReplyWaitReceivePortEx
ZwReplyWaitReceivePort
ZwReplyWaitReceivePort
ZwReplyPort
ZwReplyPort
ZwReplaceKey
ZwReplaceKey
ZwRegisterThreadTerminatePort
ZwRegisterThreadTerminatePort
ZwQueryValueKey
ZwQueryValueKey
ZwQueryOpenSubKeys
ZwQueryOpenSubKeys
ZwQueryMultipleValueKey
ZwQueryMultipleValueKey
ZwQueryKey
ZwQueryKey
ZwQueryInformationPort
ZwQueryInformationPort
ZwOpenKey
ZwOpenKey
ZwNotifyChangeMultipleKeys
ZwNotifyChangeMultipleKeys
ZwNotifyChangeKey
ZwNotifyChangeKey
ZwLoadKey2
ZwLoadKey2
ZwLoadKey
ZwLoadKey
ZwListenPort
ZwListenPort
ZwImpersonateClientOfPort
ZwImpersonateClientOfPort
ZwFlushKey
ZwFlushKey
ZwEnumerateValueKey
ZwEnumerateValueKey
ZwEnumerateKey
ZwEnumerateKey
ZwDeleteValueKey
ZwDeleteValueKey
ZwDeleteKey
ZwDeleteKey
ZwDelayExecution
ZwDelayExecution
ZwCreateWaitablePort
ZwCreateWaitablePort
ZwCreatePort
ZwCreatePort
ZwCreateNamedPipeFile
ZwCreateNamedPipeFile
ZwCreateKey
ZwCreateKey
ZwConnectPort
ZwConnectPort
ZwCompleteConnectPort
ZwCompleteConnectPort
ZwAcceptConnectPort
ZwAcceptConnectPort
FindKiServiceTable: relocation type %d found at X
FindKiServiceTable: relocation type %d found at X
Cannot read body of %s !
Cannot read body of %s !
Cannot extract index of %s, error %d
Cannot extract index of %s, error %d
kernel %s don`t contains KeServiceDescriptorTable function !
kernel %s don`t contains KeServiceDescriptorTable function !
Cannot find SDT in %s
Cannot find SDT in %s
Cannot read ntdll.dll
Cannot read ntdll.dll
Cannot read body of %s!
Cannot read body of %s!
Cannot read body of ZwYieldExecution!
Cannot read body of ZwYieldExecution!
Cannot extract index of ZwYieldExecution, error %d
Cannot extract index of ZwYieldExecution, error %d
Cannot extract index of ZwPlugPlayControl , error %d
Cannot extract index of ZwPlugPlayControl , error %d
%s: %p
%s: %p
SDT entry %X (%s) hooked %p %s!
SDT entry %X (%s) hooked %p %s!
SDT entry %X hooked %p %s!
SDT entry %X hooked %p %s!
Need unhook %d items in SSDT
Need unhook %d items in SSDT
UNHOOK_ITEM: Index %X Offset %X
UNHOOK_ITEM: Index %X Offset %X
Unhook SSDT failed, lasterror %d
Unhook SSDT failed, lasterror %d
Unhooked %d SSDT items
Unhooked %d SSDT items
NtUserSetProcessRestrictionExemption
NtUserSetProcessRestrictionExemption
NtUserAcquireIAMKey
NtUserAcquireIAMKey
NtGdiDdDDICreateKeyedMutex2
NtGdiDdDDICreateKeyedMutex2
NtGdiDdDDIOpenKeyedMutex2
NtGdiDdDDIOpenKeyedMutex2
NtGdiDdDDIAcquireKeyedMutex2
NtGdiDdDDIAcquireKeyedMutex2
NtGdiDdDDIReleaseKeyedMutex2
NtGdiDdDDIReleaseKeyedMutex2
NtUserSetTHQAPublicKey
NtUserSetTHQAPublicKey
NtGdiDdDDIReleaseKeyedMutex
NtGdiDdDDIReleaseKeyedMutex
NtGdiDdDDIAcquireKeyedMutex
NtGdiDdDDIAcquireKeyedMutex
NtGdiDdDDIDestroyKeyedMutex
NtGdiDdDDIDestroyKeyedMutex
NtGdiDdDDIOpenKeyedMutex
NtGdiDdDDIOpenKeyedMutex
NtGdiDdDDICreateKeyedMutex
NtGdiDdDDICreateKeyedMutex
NtUserEndTouchOperation
NtUserEndTouchOperation
NtUserSfmDxReportPendingBindingsToDwm
NtUserSfmDxReportPendingBindingsToDwm
NtGdiDDCCIGetTimingReport
NtGdiDDCCIGetTimingReport
NtUserUnregisterSessionPort
NtUserUnregisterSessionPort
NtUserRegisterSessionPort
NtUserRegisterSessionPort
NtUserRegisterErrorReportingDialog
NtUserRegisterErrorReportingDialog
NtGdiSetOPMSigningKeyAndSequenceNumbers
NtGdiSetOPMSigningKeyAndSequenceNumbers
NtGdiGetCertificateSize
NtGdiGetCertificateSize
NtGdiGetCertificate
NtGdiGetCertificate
NtUserWaitForMsgAndEvent
NtUserWaitForMsgAndEvent
NtUserVkKeyScanEx
NtUserVkKeyScanEx
NtUserUnregisterHotKey
NtUserUnregisterHotKey
NtUserUnlockWindowStation
NtUserUnlockWindowStation
NtUserUnloadKeyboardLayout
NtUserUnloadKeyboardLayout
NtUserUnhookWindowsHookEx
NtUserUnhookWindowsHookEx
NtUserSetWindowStationUser
NtUserSetWindowStationUser
NtUserSetWindowsHookEx
NtUserSetWindowsHookEx
NtUserSetWindowsHookAW
NtUserSetWindowsHookAW
NtUserSetProcessWindowStation
NtUserSetProcessWindowStation
NtUserSetKeyboardState
NtUserSetKeyboardState
NtUserSetImeHotKey
NtUserSetImeHotKey
NtUserSetConsoleReserveKeys
NtUserSetConsoleReserveKeys
NtUserRegisterHotKey
NtUserRegisterHotKey
NtUserOpenWindowStation
NtUserOpenWindowStation
NtUserMapVirtualKeyEx
NtUserMapVirtualKeyEx
NtUserLockWindowStation
NtUserLockWindowStation
NtUserLoadKeyboardLayoutEx
NtUserLoadKeyboardLayoutEx
NtUserGetProcessWindowStation
NtUserGetProcessWindowStation
NtUserGetKeyState
NtUserGetKeyState
NtUserGetKeyNameText
NtUserGetKeyNameText
NtUserGetKeyboardState
NtUserGetKeyboardState
NtUserGetKeyboardLayoutName
NtUserGetKeyboardLayoutName
NtUserGetKeyboardLayoutList
NtUserGetKeyboardLayoutList
NtUserGetImeHotKey
NtUserGetImeHotKey
NtUserGetCPD
NtUserGetCPD
NtUserGetAsyncKeyState
NtUserGetAsyncKeyState
NtUserCreateWindowStation
NtUserCreateWindowStation
NtUserCloseWindowStation
NtUserCloseWindowStation
NtUserCheckImeHotKey
NtUserCheckImeHotKey
NtUserCallMsgFilter
NtUserCallMsgFilter
NtUserAlterWindowStyle
NtUserAlterWindowStyle
NtUserActivateKeyboardLayout
NtUserActivateKeyboardLayout
NtGdiScaleViewportExtEx
NtGdiScaleViewportExtEx
NtGdiDvpWaitForVideoPortSync
NtGdiDvpWaitForVideoPortSync
NtGdiDvpUpdateVideoPort
NtGdiDvpUpdateVideoPort
NtGdiDvpGetVideoPortConnectInfo
NtGdiDvpGetVideoPortConnectInfo
NtGdiDvpGetVideoPortOutputFormats
NtGdiDvpGetVideoPortOutputFormats
NtGdiDvpGetVideoPortLine
NtGdiDvpGetVideoPortLine
NtGdiDvpGetVideoPortInputFormats
NtGdiDvpGetVideoPortInputFormats
NtGdiDvpGetVideoPortFlipStatus
NtGdiDvpGetVideoPortFlipStatus
NtGdiDvpGetVideoPortField
NtGdiDvpGetVideoPortField
NtGdiDvpGetVideoPortBandwidth
NtGdiDvpGetVideoPortBandwidth
NtGdiDvpFlipVideoPort
NtGdiDvpFlipVideoPort
NtGdiDvpDestroyVideoPort
NtGdiDvpDestroyVideoPort
NtGdiDvpCreateVideoPort
NtGdiDvpCreateVideoPort
NtGdiDvpCanCreateVideoPort
NtGdiDvpCanCreateVideoPort
NtGdiDdSetColorKey
NtGdiDdSetColorKey
read_shadow_sdt failed, error %d
read_shadow_sdt failed, error %d
check_win32k_sdt: cannot alloc %d bytes
check_win32k_sdt: cannot alloc %d bytes
Cannot read win32k_sdt at %p size %X, error %d
Cannot read win32k_sdt at %p size %X, error %d
win32k_sdt[%d] (%s) hooked, addr %p %s
win32k_sdt[%d] (%s) hooked, addr %p %s
win32k_sdt[%d] hooked, addr %p %s
win32k_sdt[%d] hooked, addr %p %s
GetNamedPipeServerProcessId
GetNamedPipeServerProcessId
read_kddb read %X bytes, error %d
read_kddb read %X bytes, error %d
cannot read MmNonPagedPoolStart (%p), error %d
cannot read MmNonPagedPoolStart (%p), error %d
cannot read MmNonPagedPoolEnd (%p), error %d
cannot read MmNonPagedPoolEnd (%p), error %d
cannot read MmPagedPoolStart (%p), error %d
cannot read MmPagedPoolStart (%p), error %d
cannot read MmPagedPoolEnd (%p), error %d
cannot read MmPagedPoolEnd (%p), error %d
cannot read KernelVerifier (%p), error %d
cannot read KernelVerifier (%p), error %d
WindowsType: %S
WindowsType: %S
ETHREAD.StartAddress %X
ETHREAD.StartAddress %X
KiProcessorBlock: %p (%X)
KiProcessorBlock: %p (%X)
KernelVerifier: %X
KernelVerifier: %X
KeBugCheckCallbackList: %p (%X)
KeBugCheckCallbackList: %p (%X)
WorkerRoutine: %p %s
WorkerRoutine: %p %s
IdleFunction: %p %s
IdleFunction: %p %s
IdleFunction: %p %s
IdleFunction: %p %s
KPRCB[%d].WorkerRoutine: %p %s
KPRCB[%d].WorkerRoutine: %p %s
KPRCB[%d].IdleFunction: %p %s
KPRCB[%d].IdleFunction: %p %s
KPRCB[%d].IdleFunction: %p %s
KPRCB[%d].IdleFunction: %p %s
read_kpcr return %X bytes, error %d, ntstatus %X
read_kpcr return %X bytes, error %d, ntstatus %X
read_kpcr return %X bytes, error %d
read_kpcr return %X bytes, error %d
KPCR[%d] %p major %X minor %X
KPCR[%d] %p major %X minor %X
KPCR[%d] %p
KPCR[%d] %p
get_os_info return %X bytes, error %d, ntstatus %X
get_os_info return %X bytes, error %d, ntstatus %X
get_os_info return %X bytes, error %d
get_os_info return %X bytes, error %d
NtMajorVersion: %d
NtMajorVersion: %d
NtMinorVersion: %d
NtMinorVersion: %d
BuildNumber: %d
BuildNumber: %d
GlobalFlag: %X
GlobalFlag: %X
Processors: %d
Processors: %d
MmVerifierFlags %d
MmVerifierFlags %d
MmSystemSize %d %s
MmSystemSize %d %s
DebuggerEnabled %d
DebuggerEnabled %d
DebuggerNotPresent %d
DebuggerNotPresent %d
SafeBootMode %d
SafeBootMode %d
NXSupportPolicy %X
NXSupportPolicy %X
CR0 %8.8X %s
CR0 %8.8X %s
CR4 %8.8X %s
CR4 %8.8X %s
Cannot open mailslot %S, error %d
Cannot open mailslot %S, error %d
get_mail_slot_owner(%S): returned %d bytes, error %d, ntstatus %X
get_mail_slot_owner(%S): returned %d bytes, error %d, ntstatus %X
get_mail_slot_owner(%S): returned %d bytes, error %d
get_mail_slot_owner(%S): returned %d bytes, error %d
Cannot open named pipe %S, error %d
Cannot open named pipe %S, error %d
GetNamedPipeServerProcessId(%S) failed, error %d
GetNamedPipeServerProcessId(%S) failed, error %d
get_named_pipe_owner(%S): returned %d bytes, error %d, ntstatus %X
get_named_pipe_owner(%S): returned %d bytes, error %d, ntstatus %X
get_named_pipe_owner(%S): returned %d bytes, error %d
get_named_pipe_owner(%S): returned %d bytes, error %d
read_lpc_port_chars: len %d, returned %d bytes, error %d, ntstatus %X
read_lpc_port_chars: len %d, returned %d bytes, error %d, ntstatus %X
read_lpc_port_chars: len %d, returned %d bytes, error %d
read_lpc_port_chars: len %d, returned %d bytes, error %d
read_unicode_string: len %d, returned %d bytes, error %d, ntstatus %X
read_unicode_string: len %d, returned %d bytes, error %d, ntstatus %X
read_unicode_string: len %d, returned %d bytes, error %d
read_unicode_string: len %d, returned %d bytes, error %d
read_drivers_list: cannot get size of drivers list, returned %d bytes, error %d, ntstatus %X
read_drivers_list: cannot get size of drivers list, returned %d bytes, error %d, ntstatus %X
read_drivers_list: cannot get size of drivers list, returned %d bytes, error %d
read_drivers_list: cannot get size of drivers list, returned %d bytes, error %d
read_drivers_list: cannot alloc %X bytes for driver list
read_drivers_list: cannot alloc %X bytes for driver list
read_drivers_list: cannot read drivers list, error %d, ntstatus %X
read_drivers_list: cannot read drivers list, error %d, ntstatus %X
read_drivers_list: cannot read drivers list, error %d
read_drivers_list: cannot read drivers list, error %d
%p:%X flags %X LoadCount %d %s
%p:%X flags %X LoadCount %d %s
read_KiThreadSelectNotifyRoutine failed, error %d
read_KiThreadSelectNotifyRoutine failed, error %d
read_KiSwapContextNotifyRoutine failed, error %d
read_KiSwapContextNotifyRoutine failed, error %d
read_KiTimeUpdateNotifyRoutine failed, error %d
read_KiTimeUpdateNotifyRoutine failed, error %d
read_PspLegoNotifyRoutine failed, error %d
read_PspLegoNotifyRoutine failed, error %d
read_KiDebugRoutine failed, error %d
read_KiDebugRoutine failed, error %d
read_msrs failed, error %d, ntstatus %X
read_msrs failed, error %d, ntstatus %X
read_msrs failed, error %d
read_msrs failed, error %d
IManageProcess: Cannot OpenProcess %d
IManageProcess: Cannot OpenProcess %d
IManageProcess: Cannot open process %d
IManageProcess: Cannot open process %d
read_win32_process for PID %X failed, error %d, status %X
read_win32_process for PID %X failed, error %d, status %X
read_win32_process for PID %X failed, error %d
read_win32_process for PID %X failed, error %d
read_dword(%p, PID %d) failed, error %d, ntstatus %X
read_dword(%p, PID %d) failed, error %d, ntstatus %X
read_dword(%p, PID %d) failed, error %d
read_dword(%p, PID %d) failed, error %d
read_ptr(%p, PID %d) failed, error %d, ntstatus %X
read_ptr(%p, PID %d) failed, error %d, ntstatus %X
read_ptr(%p, PID %d) failed, error %d
read_ptr(%p, PID %d) failed, error %d
rp_ReadProcessMemory(%p size %X) from %p error %d
rp_ReadProcessMemory(%p size %X) from %p error %d
read_token for PID %X failed, error %d, status %X
read_token for PID %X failed, error %d, status %X
read_token for PID %X failed, error %d
read_token for PID %X failed, error %d
open_proc(%d, access %X) failed, error %d, ntstatus %X
open_proc(%d, access %X) failed, error %d, ntstatus %X
open_proc(%d, access %X) failed, error %d
open_proc(%d, access %X) failed, error %d
rp_OpenProcess(%d, access %X) dwRet %d, error %d
rp_OpenProcess(%d, access %X) dwRet %d, error %d
rp_TerminateProcess(%p, %X) dwRet %d, error %d
rp_TerminateProcess(%p, %X) dwRet %d, error %d
Major %d Minor %d BuildNumber %d PlatformId %d ServicePackMajor %d ServicePackMinor %d SuiteMask %d ProductType %d CSDVersion %S
Major %d Minor %d BuildNumber %d PlatformId %d ServicePackMajor %d ServicePackMinor %d SuiteMask %d ProductType %d CSDVersion %S
ProductType: %X
ProductType: %X
Cannot open RPC control, error %X
Cannot open RPC control, error %X
msgsvcsend
msgsvcsend
_ILocalObjectExporter
_ILocalObjectExporter
IVsShell
IVsShell
IWbemLoginClientID
IWbemLoginClientID
ICertProtect
ICertProtect
_IBTFTPApiEvents
_IBTFTPApiEvents
_s_PasswordRecovery
_s_PasswordRecovery
wininet_UrlCache
wininet_UrlCache
_IObjectExporter
_IObjectExporter
WMsgAPIs
WMsgAPIs
WMsgKAPIs
WMsgKAPIs
INCryptKeyIso
INCryptKeyIso
HttpProxyMgrProvider
HttpProxyMgrProvider
IKeySvcR
IKeySvcR
WcnTransportRpc
WcnTransportRpc
IPortResolve
IPortResolve
IWbemLoginHelper
IWbemLoginHelper
LRpcSIDKey
LRpcSIDKey
ISmartCardRootCerts
ISmartCardRootCerts
IDebugPortSupplier2
IDebugPortSupplier2
IAsyncOperation
IAsyncOperation
IPipelineElement
IPipelineElement
OnlineProviderCertInterface
OnlineProviderCertInterface
IBackgroundCopyJobHttpOptions
IBackgroundCopyJobHttpOptions
HttpProxyMgrClient
HttpProxyMgrClient
IStaticPortMappingCollection
IStaticPortMappingCollection
IKeySvc
IKeySvc
s_WindowsShutdown
s_WindowsShutdown
IWebBrowser2
IWebBrowser2
IDebugPortSupplierLocale2
IDebugPortSupplierLocale2
IUPnPHttpHeaderControl
IUPnPHttpHeaderControl
WINHTTP_AUTOPROXY_SERVICE
WINHTTP_AUTOPROXY_SERVICE
IErcLuaSupport
IErcLuaSupport
IDebugPortSupplier3
IDebugPortSupplier3
IKeySvc2
IKeySvc2
BackupKey
BackupKey
IWerReport
IWerReport
ICertPassage
ICertPassage
IStaticPortMapping
IStaticPortMapping
IDebugPortSupplierEx2
IDebugPortSupplierEx2
IWbemLevel1Login
IWbemLevel1Login
IWebBrowserApp
IWebBrowserApp
msgsvc
msgsvc
IShellWindows
IShellWindows
RpcBindingFromStringBinding(%S) failed: %d
RpcBindingFromStringBinding(%S) failed: %d
RpcMgmtInqIfIds(%S) failed: %d
RpcMgmtInqIfIds(%S) failed: %d
RpcStringBindingCompose failed: %d
RpcStringBindingCompose failed: %d
RpcBindingFromStringBinding failed: %d
RpcBindingFromStringBinding failed: %d
RpcMgmtInqIfIds failed: %d
RpcMgmtInqIfIds failed: %d
%8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X version %d.%d : %s
%8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X version %d.%d : %s
%8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X version %d.%d : (%s)
%8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X version %d.%d : (%s)
RpcMgmtEpEltInqBegin failed: %d
RpcMgmtEpEltInqBegin failed: %d
Cannot read npc table, readed %X bytes
Cannot read npc table, readed %X bytes
rpcrt4
rpcrt4
%s.AddressChangeFn: %p %s
%s.AddressChangeFn: %p %s
rpcrt4_hack::check_myself: exception %d occured
rpcrt4_hack::check_myself: exception %d occured
rpcrt4_hack::try_hack: cannot find RpcServerRegisterIfEx
rpcrt4_hack::try_hack: cannot find RpcServerRegisterIfEx
I_RpcInitNdrImports
I_RpcInitNdrImports
load_driver(%S) returned %X
load_driver(%S) returned %X
Loaded kernel driver: %S
Loaded kernel driver: %S
Error loading kernel driver: %ls - 0xx
Error loading kernel driver: %ls - 0xx
Error loading kernel driver: %S - 0xx
Error loading kernel driver: %S - 0xx
Error loading kernel driver: %S - OpenSCManager 0xx
Error loading kernel driver: %S - OpenSCManager 0xx
tcpip
tcpip
ClientImmProcessKey
ClientImmProcessKey
fnHkOPTINLPEVENTMSG
fnHkOPTINLPEVENTMSG
fnHkINLPMSG
fnHkINLPMSG
fnSENTDDEMSG
fnSENTDDEMSG
fnDWORDOPTINLPMSG
fnDWORDOPTINLPMSG
RealMsgWaitForMultipleObjectsEx
RealMsgWaitForMultipleObjectsEx
PEB.KernelCallbackTable patched, %p
PEB.KernelCallbackTable patched, %p
user32_hack::try_hack: bad PE passed
user32_hack::try_hack: bad PE passed
user32_hack::try_hack: cannot read import table
user32_hack::try_hack: cannot read import table
pfnWowMsgBoxIndirectCallback
pfnWowMsgBoxIndirectCallback
Unknown apfnDispatch size: %d
Unknown apfnDispatch size: %d
%s_hack::try_hack: bad PE passed
%s_hack::try_hack: bad PE passed
%s_hack::try_hack: cannot read exports, error %d
%s_hack::try_hack: cannot read exports, error %d
%s_hack::try_hack: cannot find section .data
%s_hack::try_hack: cannot find section .data
%s_hack::try_hack: cannot read section .data
%s_hack::try_hack: cannot read section .data
%s_hack::try_hack: cannot read section .rdata
%s_hack::try_hack: cannot read section .rdata
%s_hack::try_hack: cannot find section .text
%s_hack::try_hack: cannot find section .text
%s_hack::try_hack: cannot read section .text
%s_hack::try_hack: cannot read section .text
DxgkReleaseKeyedMutex2
DxgkReleaseKeyedMutex2
DxgkAcquireKeyedMutex2
DxgkAcquireKeyedMutex2
DxgkOpenKeyedMutex2
DxgkOpenKeyedMutex2
DxgkCreateKeyedMutex2
DxgkCreateKeyedMutex2
DxgkReleaseKeyedMutex
DxgkReleaseKeyedMutex
DxgkAcquireKeyedMutex
DxgkAcquireKeyedMutex
DxgkDestroyKeyedMutex
DxgkDestroyKeyedMutex
DxgkOpenKeyedMutex
DxgkOpenKeyedMutex
DxgkCreateKeyedMutex
DxgkCreateKeyedMutex
Cannot read gDxgkInterface, readed %X bytes
Cannot read gDxgkInterface, readed %X bytes
WindowHasShadow
WindowHasShadow
DisableProcessWindowsGhosting
DisableProcessWindowsGhosting
zzzUnhookWindowsHook
zzzUnhookWindowsHook
xxxUpdateWindows
xxxUpdateWindows
xxxArrangeIconicWindows
xxxArrangeIconicWindows
SetWindowState
SetWindowState
ClearWindowState
ClearWindowState
SetMsgBox
SetMsgBox
GetKeyboardType
GetKeyboardType
GetKeyboardLayout
GetKeyboardLayout
RemotePassthruDisable
RemotePassthruDisable
xxxRemotePassthruEnable
xxxRemotePassthruEnable
Cannot read gpsi, readed %X bytes
Cannot read gpsi, readed %X bytes
Cannot read gpsi handlers, readed %X bytes
Cannot read gpsi handlers, readed %X bytes
Cannot read apfnSimpleCall, readed %X bytes
Cannot read apfnSimpleCall, readed %X bytes
Cannot read gapfnMessageCall, readed %X bytes
Cannot read gapfnMessageCall, readed %X bytes
Cannot read gapfnScSendMessage, readed %X bytes
Cannot read gapfnScSendMessage, readed %X bytes
Cannot read gaNewProcAddresses, readed %X bytes
Cannot read gaNewProcAddresses, readed %X bytes
Cannot open logfile %S
Cannot open logfile %S
Cannot create stop event, error %d
Cannot create stop event, error %d
Driver %S loaded from %S
Driver %S loaded from %S
SrvGetConsoleKeyboardLayoutName
SrvGetConsoleKeyboardLayoutName
SrvSetConsoleKeyShortcuts
SrvSetConsoleKeyShortcuts
SrvGetConsoleAliasExes
SrvGetConsoleAliasExes
SrvGetConsoleAliasExesLength
SrvGetConsoleAliasExesLength
SrvVDMConsoleOperation
SrvVDMConsoleOperation
SrvGetLargestConsoleWindowSize
SrvGetLargestConsoleWindowSize
SrvExitWindowsEx
SrvExitWindowsEx
winsrv.dll
winsrv.dll
Unknown size of ConsoleServerApiDispatchTable: %d
Unknown size of ConsoleServerApiDispatchTable: %d
Unknown size of UserServerApiDispatchTable: %d
Unknown size of UserServerApiDispatchTable: %d
CallUserpExitWindowsEx
CallUserpExitWindowsEx
GetConsoleAliasExesInternal
GetConsoleAliasExesInternal
GetConsoleAliasExesLengthInternal
GetConsoleAliasExesLengthInternal
SetConsoleKeyShortcuts
SetConsoleKeyShortcuts
GetConsoleKeyboardLayoutNameWorker
GetConsoleKeyboardLayoutNameWorker
SetConsoleOutputCPInternal
SetConsoleOutputCPInternal
GetConsoleOutputCP
GetConsoleOutputCP
GetLargestConsoleWindowSize
GetLargestConsoleWindowSize
reg_ccs_services::read failed - error %d
reg_ccs_services::read failed - error %d
Cannot open key %S, error %d
Cannot open key %S, error %d
SafeSecondaryLog(%d) failed, error %d
SafeSecondaryLog(%d) failed, error %d
SafeSecondaryLog failed, error %d
SafeSecondaryLog failed, error %d
SafeSendLog(%d) failed, error %d
SafeSendLog(%d) failed, error %d
SafeSendLog failed, error %d
SafeSendLog failed, error %d
Bad memory %p len %X in dump_hex_buffer
Bad memory %p len %X in dump_hex_buffer
Cannot alloc %d bytes for delayed imports
Cannot alloc %d bytes for delayed imports
Cannot alloc %d bytes for imports
Cannot alloc %d bytes for imports
read_import_safe(%s) failed %X
read_import_safe(%s) failed %X
Cannot realloc %d bytes for iat
Cannot realloc %d bytes for iat
read_delayed_safe(%s) failed %X
read_delayed_safe(%s) failed %X
store2md_cache: cannot alloc %d bytes
store2md_cache: cannot alloc %d bytes
store2md_cache: cannot realloc, alloced %d bytes
store2md_cache: cannot realloc, alloced %d bytes
wdigest.dll
wdigest.dll
tspkg.dll
tspkg.dll
schannel.dll
schannel.dll
pku2u.dll
pku2u.dll
negoexts.dll
negoexts.dll
msv1_0.dll
msv1_0.dll
livessp.dll
livessp.dll
kerberos.dll
kerberos.dll
umpnpmgr.dll
umpnpmgr.dll
combase.dll
combase.dll
ntdsa.dll
ntdsa.dll
ntdll.dll
ntdll.dll
cryptbase.dll
cryptbase.dll
ncrypt.dll
ncrypt.dll
rpcrt4.dll
rpcrt4.dll
imm32.dll
imm32.dll
user32.dll
user32.dll
kernelbase.dll
kernelbase.dll
kernel32.dll
kernel32.dll
advapi32.dll
advapi32.dll
ole32.dll
ole32.dll
Cannot alloc %X bytes for relocs
Cannot alloc %X bytes for relocs
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired
WS2_32.dll
WS2_32.dll
RPCRT4.dll
RPCRT4.dll
GetProcessHeap
GetProcessHeap
GetWindowsDirectoryA
GetWindowsDirectoryA
KERNEL32.dll
KERNEL32.dll
RegCloseKey
RegCloseKey
RegOpenKeyExW
RegOpenKeyExW
RegOpenKeyExA
RegOpenKeyExA
RegCreateKeyExW
RegCreateKeyExW
ADVAPI32.dll
ADVAPI32.dll
GetWindowsDirectoryW
GetWindowsDirectoryW
GetCPInfo
GetCPInfo
RegQueryInfoKeyW
RegQueryInfoKeyW
RegEnumKeyW
RegEnumKeyW
zcÃ
zcÃ
.?AVMyWindowsChecker@@
.?AVMyWindowsChecker@@
.?AV?$rpcrt4_hack@U_IMAGE_NT_HEADERS@@@@
.?AV?$rpcrt4_hack@U_IMAGE_NT_HEADERS@@@@
.?AVtcpip_hack@@
.?AVtcpip_hack@@
.?AV?$import_holder@U_IMAGE_NT_HEADERS@@@CMN@@
.?AV?$import_holder@U_IMAGE_NT_HEADERS@@@CMN@@
.?AVinmem_import_holder@CMN@@
.?AVinmem_import_holder@CMN@@
.?AVimport_holder_intf@CMN@@
.?AVimport_holder_intf@CMN@@
.?AVmodule_import@CMN@@
.?AVmodule_import@CMN@@
aR.Rn
aR.Rn
X.UJ^A
X.UJ^A
w%xyW
w%xyW
f.Gkf
f.Gkf
%0X0m0
%0X0m0
>$?(?,?0?
>$?(?,?0?
3&4;456?90:
3&4;456?90:
77g7
77g7
7>7[7`7|7
7>7[7`7|7
6#8*878^8~8
6#8*878^8~8
11_1
11_1
0#101#202
0#101#202
0 11h1J3
0 11h1J3
6%7S7
6%7S7
7*717>7[8
7*717>7[8
=!>&>9>>>
=!>&>9>>>
7&7@7l7Â8N8V8z8
7&7@7l7Â8N8V8z8
:);4;>;\;
:);4;>;\;
0%0X0
0%0X0
= >$>(>,>0>
= >$>(>,>0>
?,?4?\?|?
?,?4?\?|?
.----/01/01/01
.----/01/01/01
KERNEL32.DLL
KERNEL32.DLL
mscoree.dll
mscoree.dll
U%SystemRoot%\system32\svchost.exe
U%SystemRoot%\system32\svchost.exe
%SystemRoot%\system32\svchost
%SystemRoot%\system32\svchost
WSOCKTRANSPORT
WSOCKTRANSPORT
TCPIP6
TCPIP6
TCPIP
TCPIP
STORPORT
STORPORT
STORMINIPORT
STORMINIPORT
SOFTPCI
SOFTPCI
SCSIPORT
SCSIPORT
SCSIMINIPORT
SCSIMINIPORT
SBP2PORT
SBP2PORT
FCPORT
FCPORT
PassiveWatchdogTimeout
PassiveWatchdogTimeout
sImageExecutionOptions
sImageExecutionOptions
ErrorPortStartTimeout
ErrorPortStartTimeout
ErrorPortCommTimeout
ErrorPortCommTimeout
DisablePagingExecutive
DisablePagingExecutive
DebuggerMaxModuleMsgs
DebuggerMaxModuleMsgs
CountOperations
CountOperations
B\\.\
B\\.\
Psapi.dll
Psapi.dll
sWindows PowerShell
sWindows PowerShell
tHost Process for Windows Tasks
tHost Process for Windows Tasks
Windows Problem Reporting 32 bit
Windows Problem Reporting 32 bit
Windows Problem Reporting
Windows Problem Reporting
Windows Modules Installer
Windows Modules Installer
mWindows Start-Up Application
mWindows Start-Up Application
tWindows Search Indexer
tWindows Search Indexer
sWindows Server Initial Configuration Tasks
sWindows Server Initial Configuration Tasks
Windows Media Player
Windows Media Player
Dump Reporting Tool
Dump Reporting Tool
Error Reporter
Error Reporter
rWindows Control Panel 32 bit
rWindows Control Panel 32 bit
Windows Control Panel
Windows Control Panel
Windows Connect Now - Config Registrar Service
Windows Connect Now - Config Registrar Service
Windows Media Player Network Sharing Service
Windows Media Player Network Sharing Service
Windows firewall
Windows firewall
Windows Error Reporting Service
Windows Error Reporting Service
tWindows Defender
tWindows Defender
vError reporting service
vError reporting service
eWindows update service
eWindows update service
Windows Image Acquisition
Windows Image Acquisition
WebClient
WebClient
tWindows Security Center Notification App
tWindows Security Center Notification App
yWindows Based Script Host
yWindows Based Script Host
Windows installer 32 bit
Windows installer 32 bit
Windows installer
Windows installer
Windows 16-bit Virtual Machine
Windows 16-bit Virtual Machine
Windows Management Instrumentation
Windows Management Instrumentation
Windows User Mode Driver Manager
Windows User Mode Driver Manager
MS tftp
MS tftp
MS ftp 32 bit
MS ftp 32 bit
MS ftp
MS ftp
Microsoft Help and Support Center
Microsoft Help and Support Center
Cmd.exe 32 bit
Cmd.exe 32 bit
Cmd.exe
Cmd.exe
Windows Logon User Interface Host
Windows Logon User Interface Host
Windows update
Windows update
tGoogle Chrome
tGoogle Chrome
rOpera Internet Browser
rOpera Internet Browser
Mozilla Thunderbird Mail and News Client
Mozilla Thunderbird Mail and News Client
dFirefox browser
dFirefox browser
Services.exe
Services.exe
%SystemRoot%\msagent\agentsvr.exe
%SystemRoot%\msagent\agentsvr.exe
%SystemRoot%\System32\dfrgfat.exe
%SystemRoot%\System32\dfrgfat.exe
%SystemRoot%\System32\dfrgntfs.exe
%SystemRoot%\System32\dfrgntfs.exe
%SystemRoot%\System32\services.exe
%SystemRoot%\System32\services.exe
%SystemRoot%\System32\svchost.exe
%SystemRoot%\System32\svchost.exe
%SystemRoot%\System32\alg.exe
%SystemRoot%\System32\alg.exe
%SystemRoot%\System32\spoolsv.exe
%SystemRoot%\System32\spoolsv.exe
%SystemRoot%\System32\net.exe
%SystemRoot%\System32\net.exe
%SystemRoot%\System32\net1.exe
%SystemRoot%\System32\net1.exe
%SystemRoot%\System32\cmd.exe
%SystemRoot%\System32\cmd.exe
%SystemRoot%\System32\notepad.exe
%SystemRoot%\System32\notepad.exe
%SystemRoot%\System32\calc.exe
%SystemRoot%\System32\calc.exe
%SystemRoot%\System32\PTF.exe
%SystemRoot%\System32\PTF.exe
%SystemRoot%\System32\tPTF.exe
%SystemRoot%\System32\tPTF.exe
%SystemRoot%\System32\telnet.exe
%SystemRoot%\System32\telnet.exe
%SystemRoot%\System32\taskkill.exe
%SystemRoot%\System32\taskkill.exe
%SystemRoot%\System32\ctfmon.exe
%SystemRoot%\System32\ctfmon.exe
%SystemRoot%\System32\wdfmgr.exe
%SystemRoot%\System32\wdfmgr.exe
%SystemRoot%\System32\mmc.exe
%SystemRoot%\System32\mmc.exe
%SystemRoot%\System32\userinit.exe
%SystemRoot%\System32\userinit.exe
%SystemRoot%\System32\wbem\wmiprvse.exe
%SystemRoot%\System32\wbem\wmiprvse.exe
%SystemRoot%\System32\wbem\wmiadap.exe
%SystemRoot%\System32\wbem\wmiadap.exe
%SystemRoot%\explorer.exe
%SystemRoot%\explorer.exe
%SystemRoot%\System32\lsass.exe
%SystemRoot%\System32\lsass.exe
%SystemRoot%\System32\winlogon.exe
%SystemRoot%\System32\winlogon.exe
%SystemRoot%\System32\LogonUI.exe
%SystemRoot%\System32\LogonUI.exe
%SystemRoot%\System32\wuauclt.exe
%SystemRoot%\System32\wuauclt.exe
%SystemRoot%\System32\wuauclt1.exe
%SystemRoot%\System32\wuauclt1.exe
%SystemRoot%\System32\CCM\CcmExec.exe
%SystemRoot%\System32\CCM\CcmExec.exe
%SystemRoot%\System32\csrss.exe
%SystemRoot%\System32\csrss.exe
%SystemRoot%\System32\smss.exe
%SystemRoot%\System32\smss.exe
\SystemRoot\System32\smss.exe
\SystemRoot\System32\smss.exe
%SystemRoot%\System32\inetsrv\w3wp.exe
%SystemRoot%\System32\inetsrv\w3wp.exe
%SystemRoot%\System32\schtasks.exe
%SystemRoot%\System32\schtasks.exe
%SystemRoot%\System32\tstheme.exe
%SystemRoot%\System32\tstheme.exe
%SystemRoot%\System32\control.exe
%SystemRoot%\System32\control.exe
%SystemRoot%\System32\taskmgr.exe
%SystemRoot%\System32\taskmgr.exe
%SystemRoot%\System32\dwwin.exe
%SystemRoot%\System32\dwwin.exe
%SystemRoot%\System32\drwtsn32.exe
%SystemRoot%\System32\drwtsn32.exe
%SystemRoot%\System32\dumprep.exe
%SystemRoot%\System32\dumprep.exe
%SystemRoot%\System32\dfssvc.exe
%SystemRoot%\System32\dfssvc.exe
%SystemRoot%\System32\dllhost.exe
%SystemRoot%\System32\dllhost.exe
%SystemRoot%\System32\ntvdm.exe
%SystemRoot%\System32\ntvdm.exe
%SystemRoot%\System32\rundll32.exe
%SystemRoot%\System32\rundll32.exe
%SystemRoot%\System32\msiexec.exe
%SystemRoot%\System32\msiexec.exe
%SystemRoot%\System32\mshta.exe
%SystemRoot%\System32\mshta.exe
%SystemRoot%\System32\regsvr32.exe
%SystemRoot%\System32\regsvr32.exe
%SystemRoot%\System32\cscript.exe
%SystemRoot%\System32\cscript.exe
%SystemRoot%\System32\wscript.exe
%SystemRoot%\System32\wscript.exe
%SystemRoot%\System32\wscntfy.exe
%SystemRoot%\System32\wscntfy.exe
%SystemRoot%\System32\mstsc.exe
%SystemRoot%\System32\mstsc.exe
%SystemRoot%\System32\dashost.exe
%SystemRoot%\System32\dashost.exe
far.exe
far.exe
Far.exe
Far.exe
CLSID\{FC7D9E02-3F9E-11d3-93C0-00C04F72DAF7}\InprocServer32
CLSID\{FC7D9E02-3F9E-11d3-93C0-00C04F72DAF7}\InprocServer32
CLSID\{73FDDC80-AEA9-101A-98A7-00AA00374959}\LocalServer32
CLSID\{73FDDC80-AEA9-101A-98A7-00AA00374959}\LocalServer32
CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32
CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32
iedw.exe
iedw.exe
%SystemRoot%\System32\oobechk.exe
%SystemRoot%\System32\oobechk.exe
%SystemRoot%\System32\oobe.exe
%SystemRoot%\System32\oobe.exe
%SystemRoot%\System32\psxss.exe
%SystemRoot%\System32\psxss.exe
%SystemRoot%\System32\internat.exe
%SystemRoot%\System32\internat.exe
AcroRd32.exe
AcroRd32.exe
excel.exe
excel.exe
outlook.exe
outlook.exe
winword.exe
winword.exe
powerpnt.exe
powerpnt.exe
wmplayer.exe
wmplayer.exe
firefox.exe
firefox.exe
thunderbird.exe
thunderbird.exe
Opera.exe
Opera.exe
WinRAR.exe
WinRAR.exe
%SystemRoot%\System32\wininit.exe
%SystemRoot%\System32\wininit.exe
%SystemRoot%\System32\lsm.exe
%SystemRoot%\System32\lsm.exe
%SystemRoot%\System32\dwm.exe
%SystemRoot%\System32\dwm.exe
%SystemRoot%\System32\werfault.exe
%SystemRoot%\System32\werfault.exe
%SystemRoot%\System32\taskeng.exe
%SystemRoot%\System32\taskeng.exe
%SystemRoot%\System32\conime.exe
%SystemRoot%\System32\conime.exe
%SystemRoot%\System32\wudfhost.exe
%SystemRoot%\System32\wudfhost.exe
%SystemRoot%\System32\taskhost.exe
%SystemRoot%\System32\taskhost.exe
%SystemRoot%\System32\conhost.exe
%SystemRoot%\System32\conhost.exe
%SystemRoot%\System32\rdpclip.exe
%SystemRoot%\System32\rdpclip.exe
%SystemRoot%\System32\SearchFilterHost.exe
%SystemRoot%\System32\SearchFilterHost.exe
%SystemRoot%\System32\SearchProtocolHost.exe
%SystemRoot%\System32\SearchProtocolHost.exe
csrss.exe
csrss.exe
svchost.exe
svchost.exe
alg.exe
alg.exe
sPptpMiniport
sPptpMiniport
Tcpip
Tcpip
psapi.dll
psapi.dll
127.0.0.1
127.0.0.1
\\.\pipe\
\\.\pipe\
\\.\mailslot\
\\.\mailslot\
SOFTWARE\Microsoft\Windows NT\CurrentVersion
SOFTWARE\Microsoft\Windows NT\CurrentVersion
\\.\Pipe\
\\.\Pipe\
\\.\Mailslot\
\\.\Mailslot\
ncacn_ip_tcp:
ncacn_ip_tcp:
ncadg_ip_udp:
ncadg_ip_udp:
\\pipe\\
\\pipe\\
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\
SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell
SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell
RemediationExe
RemediationExe
SOFTWARE\Classes\SCCM.VAppLauncher\shell\Open\command
SOFTWARE\Classes\SCCM.VAppLauncher\shell\Open\command
SOFTWARE\Classes\CLSID\{00AAB372-0D6D-4976-B5F5-9BC7605E30BB}\LocalServer32
SOFTWARE\Classes\CLSID\{00AAB372-0D6D-4976-B5F5-9BC7605E30BB}\LocalServer32
SOFTWARE\Classes\CLSID\{3C296D07-90AE-4FAC-86F9-65EAA8B82D22}\LocalServer32
SOFTWARE\Classes\CLSID\{3C296D07-90AE-4FAC-86F9-65EAA8B82D22}\LocalServer32
SOFTWARE\Classes\CLSID\{D63B10C5-BB46-4990-A94F-E40B9D520160}\LocalServer32
SOFTWARE\Classes\CLSID\{D63B10C5-BB46-4990-A94F-E40B9D520160}\LocalServer32
SOFTWARE\Classes\CLSID\{03e64e17-b220-4052-9b9b-155f9cb8e016}\LocalServer32
SOFTWARE\Classes\CLSID\{03e64e17-b220-4052-9b9b-155f9cb8e016}\LocalServer32
SOFTWARE\Classes\CLSID\{1F69F884-285E-418E-9715-B9EEE402DD5F}\LocalServer32
SOFTWARE\Classes\CLSID\{1F69F884-285E-418E-9715-B9EEE402DD5F}\LocalServer32
Software\Microsoft\Windows\CurrentVersion\WINEVT\publishers
Software\Microsoft\Windows\CurrentVersion\WINEVT\publishers
Windows checker
Windows checker
1.0.0.3432
1.0.0.3432
wincheck.exe
wincheck.exe
0, 0, 8, 16
0, 0, 8, 16
fGAwoYMM.exe_1208_rwx_05740000_00001000:
.text
.text
`.rdata
`.rdata
@.data
@.data
fGAwoYMM.exe_1208_rwx_05750000_00001000:
.text
.text
`.rdata
`.rdata
@.data
@.data
fGAwoYMM.exe_1208_rwx_06010000_00001000:
notepad.exe "%Documents and Settings%\%current user%\myfile"
notepad.exe "%Documents and Settings%\%current user%\myfile"
fGAwoYMM.exe_1208_rwx_06020000_00001000:
%Documents and Settings%\%current user%\myfile
%Documents and Settings%\%current user%\myfile
NesIMIQs.exe_984_rwx_00401000_00069000:
3E.Pcq:P!V^
3E.Pcq:P!V^
#%Xkq.
#%Xkq.
.JF{
.JF{
U%Sa@
U%Sa@
('%D^q-*
('%D^q-*
?|Q%f
?|Q%f
SE?.rn~M*
SE?.rn~M*
.Dhe4
.Dhe4
E.IdJWH
E.IdJWH
%k%cn>x_
%k%cn>x_
?%uRc!
?%uRc!
%3.UGiO0
%3.UGiO0
]w.LQ
]w.LQ
I 4keyy
I 4keyy
L%C['
L%C['
7.BLP
7.BLP
;.StH
;.StH
>.Qlx #6
>.Qlx #6
Microsoft Windows
Microsoft Windows
&J%f/
&J%f/
P.yrBX.
P.yrBX.
PB]%C
PB]%C
%FoS(
%FoS(
F<.cs>
F<.cs>
NesIMIQs.exe_984_rwx_00900000_00068000:
3E.Pcq:P!V^
3E.Pcq:P!V^
#%Xkq.
#%Xkq.
.JF{
.JF{
U%Sa@
U%Sa@
('%D^q-*
('%D^q-*
?|Q%f
?|Q%f
SE?.rn~M*
SE?.rn~M*
.Dhe4
.Dhe4
E.IdJWH
E.IdJWH
%k%cn>x_
%k%cn>x_
?%uRc!
?%uRc!
%3.UGiO0
%3.UGiO0
]w.LQ
]w.LQ
I 4keyy
I 4keyy
L%C['
L%C['
7.BLP
7.BLP
;.StH
;.StH
>.Qlx #6
>.Qlx #6
$g.Gd
$g.Gd
&J%f/
&J%f/
P.yrBX.
P.yrBX.
PB]%C
PB]%C
%FoS(
%FoS(
F<.cs>
F<.cs>
NesIMIQs.exe_984_rwx_00980000_00001000:
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp
NesIMIQs.exe_984_rwx_00BC0000_00001000:
%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM
%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM
NesIMIQs.exe_984_rwx_00BD0000_00001000:
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs
NesIMIQs.exe_984_rwx_00BE0000_00001000:
%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.inf
%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.inf
NesIMIQs.exe_984_rwx_00BF0000_00001000:
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.inf
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.inf
NesIMIQs.exe_984_rwx_00C00000_00001000:
%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe
%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe
NesIMIQs.exe_984_rwx_00C10000_00001000:
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe
NesIMIQs.exe_984_rwx_00C40000_00001000:
fGAwoYMM.exe
fGAwoYMM.exe
NesIMIQs.exe_984_rwx_00C50000_00001000:
NesIMIQs.exe
NesIMIQs.exe
NesIMIQs.exe_984_rwx_00C60000_00001000:
taskkill /FI "USERNAME eq adm" /F /IM fGAwoYMM.exe
taskkill /FI "USERNAME eq adm" /F /IM fGAwoYMM.exe
NesIMIQs.exe_984_rwx_00C70000_00001000:
taskkill /FI "USERNAME eq adm" /F /IM NesIMIQs.exe
taskkill /FI "USERNAME eq adm" /F /IM NesIMIQs.exe
NesIMIQs.exe_984_rwx_00C80000_00001000:
%Documents and Settings%\All Users\JuwEIgUE\reIEcoQI.exe
%Documents and Settings%\All Users\JuwEIgUE\reIEcoQI.exe
NesIMIQs.exe_984_rwx_00C90000_00001000:
%Documents and Settings%\All Users\KAAo.txt
%Documents and Settings%\All Users\KAAo.txt
NesIMIQs.exe_984_rwx_00CA0000_00001000:
notepad.exe "%Documents and Settings%\All Users\KAAo.txt"
notepad.exe "%Documents and Settings%\All Users\KAAo.txt"
NesIMIQs.exe_984_rwx_00CB0000_00001000:
%Documents and Settings%\All Users\JuwEIgUE
%Documents and Settings%\All Users\JuwEIgUE
reIEcoQI.exe_320_rwx_00401000_00069000:
3E.Pcq:P!V^
3E.Pcq:P!V^
#%Xkq.
#%Xkq.
.JF{
.JF{
U%Sa@
U%Sa@
('%D^q-*
('%D^q-*
?|Q%f
?|Q%f
SE?.rn~M*
SE?.rn~M*
.Dhe4
.Dhe4
E.IdJWH
E.IdJWH
%k%cn>x_
%k%cn>x_
?%uRc!
?%uRc!
%3.UGiO0
%3.UGiO0
]w.LQ
]w.LQ
I 4keyy
I 4keyy
L%C['
L%C['
7.BLP
7.BLP
;.StH
;.StH
>.Qlx #6
>.Qlx #6
2software\microsoft\windows\currentversion\run
2software\microsoft\windows\currentversion\run
P.yrBX.
P.yrBX.
PB]%C
PB]%C
%FoS(
%FoS(
F<.cs>
F<.cs>
reIEcoQI.exe_320_rwx_00680000_00068000:
3E.Pcq:P!V^
3E.Pcq:P!V^
#%Xkq.
#%Xkq.
.JF{
.JF{
U%Sa@
U%Sa@
('%D^q-*
('%D^q-*
?|Q%f
?|Q%f
SE?.rn~M*
SE?.rn~M*
.Dhe4
.Dhe4
E.IdJWH
E.IdJWH
%k%cn>x_
%k%cn>x_
?%uRc!
?%uRc!
%3.UGiO0
%3.UGiO0
]w.LQ
]w.LQ
I 4keyy
I 4keyy
L%C['
L%C['
7.BLP
7.BLP
;.StH
;.StH
>.Qlx #6
>.Qlx #6
$g.Gd
$g.Gd
P.yrBX.
P.yrBX.
PB]%C
PB]%C
%FoS(
%FoS(
F<.cs>
F<.cs>
reIEcoQI.exe_320_rwx_00700000_00001000:
%WinDir%\TEMP
%WinDir%\TEMP
reIEcoQI.exe_320_rwx_00940000_00001000:
%Documents and Settings%\LocalService\dUskcAww\fGAwoYMM
%Documents and Settings%\LocalService\dUskcAww\fGAwoYMM
reIEcoQI.exe_320_rwx_00950000_00001000:
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs
reIEcoQI.exe_320_rwx_00960000_00001000:
%Documents and Settings%\LocalService\dUskcAww\fGAwoYMM.inf
%Documents and Settings%\LocalService\dUskcAww\fGAwoYMM.inf
reIEcoQI.exe_320_rwx_00970000_00001000:
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.inf
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.inf
reIEcoQI.exe_320_rwx_00980000_00001000:
%Documents and Settings%\LocalService\dUskcAww\fGAwoYMM.exe
%Documents and Settings%\LocalService\dUskcAww\fGAwoYMM.exe
reIEcoQI.exe_320_rwx_00990000_00001000:
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe
reIEcoQI.exe_320_rwx_009C0000_00001000:
fGAwoYMM.exe
fGAwoYMM.exe
reIEcoQI.exe_320_rwx_009D0000_00001000:
NesIMIQs.exe
NesIMIQs.exe
reIEcoQI.exe_320_rwx_009E0000_00001000:
taskkill /FI "USERNAME eq SYSTEM" /F /IM fGAwoYMM.exe
taskkill /FI "USERNAME eq SYSTEM" /F /IM fGAwoYMM.exe
reIEcoQI.exe_320_rwx_009F0000_00001000:
taskkill /FI "USERNAME eq SYSTEM" /F /IM NesIMIQs.exe
taskkill /FI "USERNAME eq SYSTEM" /F /IM NesIMIQs.exe