Gen.Trojan.Heur.TP.tWbmpVyvii_848164c177

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:3924
%original file name%.exe:3496
%original file name%.exe:3648
%original file name%.exe:3328
%original file name%.exe:3252
%original file name%.exe:2328
%original file name%.exe:3256
%original file name%.exe:404
%original file name%.exe:2248
%original file name%.exe:2152
%original file name%.exe:3784
%original file name%.exe:3488
%original file name%.exe:1096
%original file name%.exe:3764
%original file name%.exe:3480
%original file name%.exe:2468
%original file name%.exe:1496
%original file name%.exe:1952
%original file name%.exe:3408
%original file name%.exe:3644
%original file name%.exe:2216
%original file name%.exe:3248
%original file name%.exe:3564
%original file name%.exe:3568
%original file name%.exe:3240
%original file name%.exe:2996
%original file name%.exe:3244
%original file name%.exe:1284
%original file name%.exe:2416
%original file name%.exe:2060
%original file name%.exe:2904
%original file name%.exe:3940
%original file name%.exe:196
%original file name%.exe:3944
%original file name%.exe:1088
%original file name%.exe:3276
%original file name%.exe:2824
%original file name%.exe:2820
%original file name%.exe:2308
%original file name%.exe:2988
%original file name%.exe:4040
%original file name%.exe:3576
%original file name%.exe:2984
%original file name%.exe:1524
%original file name%.exe:2268
%original file name%.exe:2804
%original file name%.exe:4060
%original file name%.exe:2604
%original file name%.exe:3816
%original file name%.exe:2608
%original file name%.exe:2140
%original file name%.exe:2284
%original file name%.exe:3956
%original file name%.exe:3740
%original file name%.exe:244
%original file name%.exe:2836
%original file name%.exe:3316
%original file name%.exe:4056
%original file name%.exe:2272
%original file name%.exe:3012
%original file name%.exe:2572
%original file name%.exe:2372
%original file name%.exe:3612
%original file name%.exe:2456
%original file name%.exe:3004
%original file name%.exe:1908
%original file name%.exe:1900
%original file name%.exe:3216
%original file name%.exe:2052
%original file name%.exe:3364
%original file name%.exe:3360
%original file name%.exe:3696
%original file name%.exe:1736
%original file name%.exe:2684
%original file name%.exe:2112
%original file name%.exe:3896
%original file name%.exe:2116
%original file name%.exe:2620
%original file name%.exe:2400
%original file name%.exe:636
%original file name%.exe:1644
%original file name%.exe:2420
%original file name%.exe:3908
%original file name%.exe:3872
%original file name%.exe:3288
%original file name%.exe:3172
%original file name%.exe:2952
%original file name%.exe:3228
%original file name%.exe:3880
%original file name%.exe:3200
%original file name%.exe:2680
%original file name%.exe:2896
%original file name%.exe:3440
%original file name%.exe:2108
%original file name%.exe:1748
%original file name%.exe:2100
%original file name%.exe:3868
%original file name%.exe:4084
%original file name%.exe:2432
%original file name%.exe:3632
%original file name%.exe:2436
%original file name%.exe:3112
%original file name%.exe:2948
%original file name%.exe:3736
%original file name%.exe:236
%original file name%.exe:2944
%original file name%.exe:3732
%original file name%.exe:3068
%original file name%.exe:2624
%original file name%.exe:2224
%original file name%.exe:2744
%original file name%.exe:324
%original file name%.exe:3976
%original file name%.exe:2504
%original file name%.exe:2876
%original file name%.exe:2720
%original file name%.exe:2644
%original file name%.exe:1896
%original file name%.exe:2540
%original file name%.exe:2932
%original file name%.exe:3056
%original file name%.exe:1884
%original file name%.exe:3544
%original file name%.exe:2120
%original file name%.exe:2124
%original file name%.exe:2336
%original file name%.exe:2128
%original file name%.exe:3788
%original file name%.exe:3420
%original file name%.exe:3220
%original file name%.exe:2084
%original file name%.exe:808
%original file name%.exe:3988
%original file name%.exe:2532
%original file name%.exe:1572
%original file name%.exe:2008
cscript.exe:212
cscript.exe:3924
cscript.exe:4036
cscript.exe:3492
cscript.exe:3412
cscript.exe:3328
cscript.exe:3044
cscript.exe:492
cscript.exe:2488
cscript.exe:3796
cscript.exe:2528
cscript.exe:1944
cscript.exe:2248
cscript.exe:2752
cscript.exe:348
cscript.exe:1096
cscript.exe:1260
cscript.exe:2916
cscript.exe:1792
cscript.exe:1796
cscript.exe:3932
cscript.exe:3336
cscript.exe:3132
cscript.exe:3564
cscript.exe:2312
cscript.exe:2996
cscript.exe:2396
cscript.exe:2412
cscript.exe:2392
cscript.exe:532
cscript.exe:2792
cscript.exe:3848
cscript.exe:2796
cscript.exe:2148
cscript.exe:3820
cscript.exe:3144
cscript.exe:1928
cscript.exe:3164
cscript.exe:3300
cscript.exe:2068
cscript.exe:2540
cscript.exe:1852
cscript.exe:3024
cscript.exe:4048
cscript.exe:2388
cscript.exe:2076
cscript.exe:2668
cscript.exe:3580
cscript.exe:2444
cscript.exe:2936
cscript.exe:3956
cscript.exe:3740
cscript.exe:444
cscript.exe:3836
cscript.exe:3264
cscript.exe:3268
cscript.exe:2764
cscript.exe:3316
cscript.exe:1648
cscript.exe:3468
cscript.exe:3092
cscript.exe:3364
cscript.exe:436
cscript.exe:3156
cscript.exe:2616
cscript.exe:3612
cscript.exe:1224
cscript.exe:2592
cscript.exe:2920
cscript.exe:336
cscript.exe:2452
cscript.exe:1908
cscript.exe:2836
cscript.exe:1904
cscript.exe:3292
cscript.exe:2880
cscript.exe:2204
cscript.exe:3212
cscript.exe:2208
cscript.exe:3516
cscript.exe:3696
cscript.exe:3088
cscript.exe:2368
cscript.exe:2680
cscript.exe:500
cscript.exe:2360
cscript.exe:2620
cscript.exe:2584
cscript.exe:2812
cscript.exe:564
cscript.exe:3876
cscript.exe:2264
cscript.exe:2180
cscript.exe:3728
cscript.exe:3284
cscript.exe:3528
cscript.exe:220
cscript.exe:1992
cscript.exe:3200
cscript.exe:3896
cscript.exe:3372
cscript.exe:2108
cscript.exe:1748
cscript.exe:3960
cscript.exe:2356
cscript.exe:944
cscript.exe:3628
cscript.exe:2868
cscript.exe:2436
cscript.exe:3672
cscript.exe:3732
cscript.exe:3232
cscript.exe:2132
cscript.exe:4000
cscript.exe:3340
cscript.exe:320
cscript.exe:324
cscript.exe:1560
cscript.exe:2500
cscript.exe:2648
cscript.exe:2136
cscript.exe:2872
cscript.exe:140
cscript.exe:1712
cscript.exe:2644
cscript.exe:3624
cscript.exe:1760
cscript.exe:3544
cscript.exe:1284
cscript.exe:4012
cscript.exe:3788
cscript.exe:3220
cscript.exe:2084
cscript.exe:2236
cscript.exe:2008

The Trojan injects its code into the following process(es):

fGAwoYMM.exe:1616
reIEcoQI.exe:1276
NesIMIQs.exe:1664

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process fGAwoYMM.exe:1616 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe (7726 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe (2321 bytes)
C:\totalcmd\TOTALCMD.EXE.exe (30812 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe (2321 bytes)
C:\totalcmd\TCMADMIN.EXE.exe (3073 bytes)
C:\totalcmd\TCUNINST.EXE.exe (3073 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\KAAo.txt (55978 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe (3073 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe (3361 bytes)
C:\totalcmd\TCMDX32.EXE.exe (3361 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe (3073 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe (3361 bytes)
C:\totalcmd\TcUsbRun.exe (3073 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Setup.exe (5441 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe (2321 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp (0 bytes)
C:\totalcmd\TCUNINST.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp (0 bytes)
C:\totalcmd\TOTALCMD.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp (0 bytes)
C:\totalcmd\TCMADMIN.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg (0 bytes)
C:\totalcmd\TCMDX32.EXE (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg (0 bytes)

The process %original file name%.exe:3924 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\aiEocAwI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eQkoIAAc.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\aiEocAwI.bat (0 bytes)

The process %original file name%.exe:3496 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\VgQkkcoI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lqsQUcsY.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\VgQkkcoI.bat (0 bytes)

The process %original file name%.exe:3648 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\pikcQQMA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cmEQQEcI.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\cmEQQEcI.bat (0 bytes)

The process %original file name%.exe:3328 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GAggMkoQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FgoQIcoY.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GAggMkoQ.bat (0 bytes)

The process %original file name%.exe:3252 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\MmMsckMM.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CsEwoEkE.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CsEwoEkE.bat (0 bytes)

The process %original file name%.exe:2328 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nwEwwwoY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IckAwcIQ.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\IckAwcIQ.bat (0 bytes)

The process %original file name%.exe:3256 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\wAMYkAMk.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oyQAQYIY.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\oyQAQYIY.bat (0 bytes)

The process %original file name%.exe:404 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\fWQcsQAs.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nEsQEYgY.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\fWQcsQAs.bat (0 bytes)

The process %original file name%.exe:2248 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\KucoUIsQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wUQoQkAk.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\wUQoQkAk.bat (0 bytes)

The process %original file name%.exe:2152 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\iKcsAIgM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eoEowAYs.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\iKcsAIgM.bat (0 bytes)

The process %original file name%.exe:3784 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\hKQcUYkA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SWMoMkUU.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\hKQcUYkA.bat (0 bytes)

The process %original file name%.exe:3488 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\oIokIAog.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jeoUkwAM.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\oIokIAog.bat (0 bytes)

The process %original file name%.exe:1096 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\uywsUYcs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JyEIQoUA.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\uywsUYcs.bat (0 bytes)

The process %original file name%.exe:3764 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\cCgQgQgk.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NIwcMQkA.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\cCgQgQgk.bat (0 bytes)

The process %original file name%.exe:3480 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jqEUwosA.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VmsYQAYM.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jqEUwosA.bat (0 bytes)

The process %original file name%.exe:2468 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\TUAMoUoQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ziIIocos.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ziIIocos.bat (0 bytes)

The process %original file name%.exe:1496 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\JuMUwMMg.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hSwoccEc.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\JuMUwMMg.bat (0 bytes)

The process %original file name%.exe:1952 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\zakAIoMA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sIgEQocg.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\zakAIoMA.bat (0 bytes)

The process %original file name%.exe:3408 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ocYYMsks.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IkQcAEsQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bgYwwoco.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (57004 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NiEkIYgs.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\bgYwwoco.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IkQcAEsQ.bat (0 bytes)

The process %original file name%.exe:3644 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\XSQgAoog.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bIUEcswU.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\XSQgAoog.bat (0 bytes)

The process %original file name%.exe:2216 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\OeYcwMkQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BEcQQkUI.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\BEcQQkUI.bat (0 bytes)

The process %original file name%.exe:3248 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\vasgQYko.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jqMUMscU.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\vasgQYko.bat (0 bytes)

The process %original file name%.exe:3564 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\uacYwwAk.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gAgAQYAk.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\gAgAQYAk.bat (0 bytes)

The process %original file name%.exe:3568 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CsIwwUAk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lGMscgYA.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CsIwwUAk.bat (0 bytes)

The process %original file name%.exe:3240 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\XMAAUAoA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eeYsIMAM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NOkcEAYs.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (57004 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LAAwsEUk.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\eeYsIMAM.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LAAwsEUk.bat (0 bytes)

The process %original file name%.exe:2996 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\JkoUgogw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iwwEcgAg.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\iwwEcgAg.bat (0 bytes)

The process %original file name%.exe:3244 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\smgIUMUM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ruIocEkk.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\smgIUMUM.bat (0 bytes)

The process %original file name%.exe:1284 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\pQQoEosI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CewYsEwk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BQEcEMUQ.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (57004 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GAMsYckg.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\BQEcEMUQ.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GAMsYckg.bat (0 bytes)

The process %original file name%.exe:2416 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\hOYMIkMY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jeYkAMYA.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jeYkAMYA.bat (0 bytes)

The process %original file name%.exe:2060 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\KisUEoss.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YoMIwYgA.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\KisUEoss.bat (0 bytes)

The process %original file name%.exe:2904 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\kMQwQgMg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hwgUAowk.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\kMQwQgMg.bat (0 bytes)

The process %original file name%.exe:3940 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\KAEscAYE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DwUsIAkg.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\DwUsIAkg.bat (0 bytes)

The process %original file name%.exe:196 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eysQMQIQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dgEwksQk.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\eysQMQIQ.bat (0 bytes)

The process %original file name%.exe:3944 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\EMEAswYo.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DOMYwUEY.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\EMEAswYo.bat (0 bytes)

The process %original file name%.exe:1088 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\QgcMgEoQ.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xMcgkYEs.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\QgcMgEoQ.bat (0 bytes)

The process %original file name%.exe:3276 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\SIogooYw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aEooIgIc.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\aEooIgIc.bat (0 bytes)

The process %original file name%.exe:2824 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\hWAEkEwE.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lKoEwwcs.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\hWAEkEwE.bat (0 bytes)

The process %original file name%.exe:2820 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\fQIsIkUA.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WwUoEMws.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\WwUoEMws.bat (0 bytes)

The process %original file name%.exe:2308 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\eYswQEgI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ogEAwwkQ.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\eYswQEgI.bat (0 bytes)

The process %original file name%.exe:2988 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\VkAUogAI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZKEAsswo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GcEwQcwg.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (57004 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vuskIkYY.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ZKEAsswo.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VkAUogAI.bat (0 bytes)

The process %original file name%.exe:4040 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jcAggkEU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uQQcwgoo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bUAcgEkc.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (57004 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tGkAgckA.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jcAggkEU.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tGkAgckA.bat (0 bytes)

The process %original file name%.exe:3576 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\zQskIIYE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DCkUEcMw.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\DCkUEcMw.bat (0 bytes)

The process %original file name%.exe:2984 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\DcgIAsAQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HAwsswYM.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\DcgIAsAQ.bat (0 bytes)

The process %original file name%.exe:1524 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ACcIwssA.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QaYwIkgE.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\QaYwIkgE.bat (0 bytes)

The process %original file name%.exe:2268 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\mcwgYoUs.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qQYIsEkQ.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\qQYIsEkQ.bat (0 bytes)

The process %original file name%.exe:2804 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\hysIUQsQ.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GQsYMUAw.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GQsYMUAw.bat (0 bytes)

The process %original file name%.exe:4060 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ESoQcAwc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pMwAUIgM.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ESoQcAwc.bat (0 bytes)

The process %original file name%.exe:2604 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\OyQcwgos.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hIcQYAYE.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\OyQcwgos.bat (0 bytes)

The process %original file name%.exe:3816 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\gaIUUgQo.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lQoEAMQs.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\gaIUUgQo.bat (0 bytes)

The process %original file name%.exe:2608 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\UEAEsgYg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uQsEskMw.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\UEAEsgYg.bat (0 bytes)

The process %original file name%.exe:2140 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\FsEYEYAg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SsYscMwQ.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\SsYscMwQ.bat (0 bytes)

The process %original file name%.exe:2284 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\lIcwQQMQ.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zkcEwgcM.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\lIcwQQMQ.bat (0 bytes)

The process %original file name%.exe:3956 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ggAAwowo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LYcgMwEg.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ggAAwowo.bat (0 bytes)

The process %original file name%.exe:3740 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\oawMMQcQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ueUcIIgM.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\oawMMQcQ.bat (0 bytes)

The process %original file name%.exe:244 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\MGwYAQIg.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hOkYEQgs.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\hOkYEQgs.bat (0 bytes)

The process %original file name%.exe:2836 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\WAQIUoss.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UEkQsIUY.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\WAQIUoss.bat (0 bytes)

The process %original file name%.exe:3316 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\kGkQEQgQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XekYYMoc.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\XekYYMoc.bat (0 bytes)

The process %original file name%.exe:4056 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\XUwAgksw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GOMIwUgc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xAUEYMEw.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (57004 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AOMkwMok.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\XUwAgksw.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GOMIwUgc.bat (0 bytes)

The process %original file name%.exe:2272 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\sAAMQkQI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BSUUEoMM.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\sAAMQkQI.bat (0 bytes)

The process %original file name%.exe:3012 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AAcsgEIE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jOQYUMMw.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jOQYUMMw.bat (0 bytes)

The process %original file name%.exe:2572 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ZMwkccIU.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WgkQUIYY.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\WgkQUIYY.bat (0 bytes)

The process %original file name%.exe:2372 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\twgssMAo.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\juEcgkYI.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\juEcgkYI.bat (0 bytes)

The process %original file name%.exe:3612 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\UKgYEkAo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ogckYMYo.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ogckYMYo.bat (0 bytes)

The process %original file name%.exe:2456 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ycAwUccw.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oyEskYsk.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\oyEskYsk.bat (0 bytes)

The process %original file name%.exe:3004 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\OoooEsIo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fqwccAcI.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\fqwccAcI.bat (0 bytes)

The process %original file name%.exe:1908 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CswMUgAI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AyYsMccM.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AyYsMccM.bat (0 bytes)

The process %original file name%.exe:1900 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\PmsUMcoI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FaUwwssA.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (85506 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GwAwMQEE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OGoMgoYg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UGscoAkE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pEYAYMwI.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\pEYAYMwI.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UGscoAkE.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PmsUMcoI.bat (0 bytes)

The process %original file name%.exe:3216 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\eKYcIgUU.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LSIAAsEI.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\eKYcIgUU.bat (0 bytes)

The process %original file name%.exe:2052 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\QMAkQscE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jwYIgQcY.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jwYIgQcY.bat (0 bytes)

The process %original file name%.exe:3364 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GgwYkcgk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RgkkAIYA.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GgwYkcgk.bat (0 bytes)

The process %original file name%.exe:3360 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\swAMUIQM.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TIkcoAQw.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\swAMUIQM.bat (0 bytes)

The process %original file name%.exe:3696 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\WcckwsoU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\euoEswQg.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\euoEswQg.bat (0 bytes)

The process %original file name%.exe:1736 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\JuwEIgUE\reIEcoQI.exe (3921 bytes)
%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe (3849 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe (3969 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iyUkwcks.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bOcsMYAU.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\bOcsMYAU.bat (0 bytes)

The process %original file name%.exe:2684 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\UKsYYYcI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zsYsYMEE.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\UKsYYYcI.bat (0 bytes)

The process %original file name%.exe:2112 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RAcUMgEQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gowQsEsw.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\gowQsEsw.bat (0 bytes)

The process %original file name%.exe:3896 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\MWkoAQMw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rQwgswMc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NIAogQEg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nMgsMYoM.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (57004 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\rQwgswMc.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NIAogQEg.bat (0 bytes)

The process %original file name%.exe:2116 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\risAgAcQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ouoMocUQ.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\risAgAcQ.bat (0 bytes)

The process %original file name%.exe:2620 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\omcIkUgQ.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\asAAMckM.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\asAAMckM.bat (0 bytes)

The process %original file name%.exe:2400 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\wOoEcgcI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WOcYMoMo.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\wOoEcgcI.bat (0 bytes)

The process %original file name%.exe:636 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\HEEIwYUM.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LMQgEowg.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\LMQgEowg.bat (0 bytes)

The process %original file name%.exe:1644 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\HEQoAEUU.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fSowosoo.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\fSowosoo.bat (0 bytes)

The process %original file name%.exe:2420 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GSsQggMQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pQwgwoEk.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\pQwgwoEk.bat (0 bytes)

The process %original file name%.exe:3908 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\buokwUQc.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tUMUYMsg.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\buokwUQc.bat (0 bytes)

The process %original file name%.exe:3872 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\oMYAIUgo.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\emgYwUMs.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\emgYwUMs.bat (0 bytes)

The process %original file name%.exe:3288 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AmIAgMAY.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nQkMQgYg.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nQkMQgYg.bat (0 bytes)

The process %original file name%.exe:3172 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\QOIIIEoQ.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FAYEUgQA.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\QOIIIEoQ.bat (0 bytes)

The process %original file name%.exe:2952 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\gKsUoIQo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UyoIMMcI.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\UyoIMMcI.bat (0 bytes)

The process %original file name%.exe:3228 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\gSYYQEwo.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZGwUYUkY.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ZGwUYUkY.bat (0 bytes)

The process %original file name%.exe:3880 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\geYwscUM.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DskMQkYs.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\DskMQkYs.bat (0 bytes)

The process %original file name%.exe:3200 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GEgUwAsg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\neMggkIU.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GEgUwAsg.bat (0 bytes)

The process %original file name%.exe:2680 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\UwcsIUMw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ucYsAQsY.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\UwcsIUMw.bat (0 bytes)

The process %original file name%.exe:2896 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\EUgkAIgU.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xiMsIYgY.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\xiMsIYgY.bat (0 bytes)

The process %original file name%.exe:3440 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\IskcYoEI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LkIQIIco.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\LkIQIIco.bat (0 bytes)

The process %original file name%.exe:2108 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\vswcUgAE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OOwYUQco.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FkwUAQkc.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (38683 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\FkwUAQkc.bat (0 bytes)

The process %original file name%.exe:1748 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RWggUwEM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yoYgEIsE.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\yoYgEIsE.bat (0 bytes)

The process %original file name%.exe:2100 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\PGwMgYMU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zWMksgYY.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\PGwMgYMU.bat (0 bytes)

The process %original file name%.exe:3868 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\WYMccscw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QIMwcAcY.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\WYMccscw.bat (0 bytes)

The process %original file name%.exe:4084 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\sSsAUwcw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LSAAQUkA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OUsMokYI.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (57004 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RcAoMEEc.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\sSsAUwcw.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OUsMokYI.bat (0 bytes)

The process %original file name%.exe:2432 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\KKYYgAoA.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SYwEIYQs.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\SYwEIYQs.bat (0 bytes)

The process %original file name%.exe:3632 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\uegUAEAg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JIwcMQso.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\uegUAEAg.bat (0 bytes)

The process %original file name%.exe:2436 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\DokkIYMY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OOYMQwEU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yOkIQwUU.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (57004 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yiwkEook.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\DokkIYMY.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OOYMQwEU.bat (0 bytes)

The process %original file name%.exe:3112 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\dMUYgIws.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FswAkUEg.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\dMUYgIws.bat (0 bytes)

The process %original file name%.exe:2948 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UGssMoQk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pcgQMwcs.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\UGssMoQk.bat (0 bytes)

The process %original file name%.exe:3736 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CqAsgksk.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XSgokYAA.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CqAsgksk.bat (0 bytes)

The process %original file name%.exe:236 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AaAEYwoo.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tUUIswgw.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AaAEYwoo.bat (0 bytes)

The process %original file name%.exe:2944 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\TIUUEkos.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pAQMogko.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\pAQMogko.bat (0 bytes)

The process %original file name%.exe:3732 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\VCAwAUIA.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vkcMgkUs.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\vkcMgkUs.bat (0 bytes)

The process %original file name%.exe:3068 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GqwEAUsk.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fOMEkIMs.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GqwEAUsk.bat (0 bytes)

The process %original file name%.exe:2624 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\UGAkwoAM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iAMgsMsk.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\UGAkwoAM.bat (0 bytes)

The process %original file name%.exe:2224 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\FowwYYEc.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PoQIUcoY.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\FowwYYEc.bat (0 bytes)

The process %original file name%.exe:2744 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\FuMQUIQM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jeMQQAww.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jeMQQAww.bat (0 bytes)

The process %original file name%.exe:324 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ZQwooUsA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TycMoQMI.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ZQwooUsA.bat (0 bytes)

The process %original file name%.exe:3976 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\zuIYEAUo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wkwIoccs.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\zuIYEAUo.bat (0 bytes)

The process %original file name%.exe:2504 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CMYIsQcQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bKggogYo.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CMYIsQcQ.bat (0 bytes)

The process %original file name%.exe:2876 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\FEckMUIA.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bCscEcco.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\FEckMUIA.bat (0 bytes)

The process %original file name%.exe:2720 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\YOgIkcso.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zCoQQoYU.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\YOgIkcso.bat (0 bytes)

The process %original file name%.exe:2644 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ZaUsQUAg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CQoYcIkg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bewEAIws.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zYIMIocM.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (57004 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ZaUsQUAg.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CQoYcIkg.bat (0 bytes)

The process %original file name%.exe:1896 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\lWokYEYs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sEcwMoMU.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\lWokYEYs.bat (0 bytes)

The process %original file name%.exe:2540 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\WWIAUwwY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GMYAoIwg.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GMYAoIwg.bat (0 bytes)

The process %original file name%.exe:2932 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\gscQkwEI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lSEYEwAw.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\gscQkwEI.bat (0 bytes)

The process %original file name%.exe:3056 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\EuYUscgo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ogMkQcwU.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ogMkQcwU.bat (0 bytes)

The process %original file name%.exe:1884 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\OsEoQkMM.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LqsMscIk.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\OsEoQkMM.bat (0 bytes)

The process %original file name%.exe:3544 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\uWcAQMcY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SyEokYUI.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\uWcAQMcY.bat (0 bytes)

The process %original file name%.exe:2120 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\bicggMMM.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FIgYoUMg.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\bicggMMM.bat (0 bytes)

The process %original file name%.exe:2124 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\emEgkwkY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KaYEgUIk.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\emEgkwkY.bat (0 bytes)

The process %original file name%.exe:2336 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\eCMksUcg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nSAgEEkw.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nSAgEEkw.bat (0 bytes)

The process %original file name%.exe:2128 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\cyQMcIsY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nwYsoooc.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nwYsoooc.bat (0 bytes)

The process %original file name%.exe:3788 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\MEUAocoU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MGoQQsoY.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\MGoQQsoY.bat (0 bytes)

The process %original file name%.exe:3420 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\qwoEYcII.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VKMoQAww.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\VKMoQAww.bat (0 bytes)

The process %original file name%.exe:3220 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\eyEowEgs.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lcsswMcY.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\lcsswMcY.bat (0 bytes)

The process %original file name%.exe:2084 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\cQMEgUEY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YIIEgwgc.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\cQMEgUEY.bat (0 bytes)

The process %original file name%.exe:808 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\pQgMokIk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WAQQEsog.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BqUUMwYg.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (57004 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nkccgMIs.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\pQgMokIk.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BqUUMwYg.bat (0 bytes)

The process %original file name%.exe:3988 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\FkYcEsgY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WOEMgAwk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WusoEMkk.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (57004 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BwUQQksk.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\FkYcEsgY.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BwUQQksk.bat (0 bytes)

The process %original file name%.exe:2532 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\xswwooEg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XAAMEgYU.bat (112 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\xswwooEg.bat (0 bytes)

The process %original file name%.exe:1572 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\uMAUAoYk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nuUgUIcM.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nuUgUIcM.bat (0 bytes)

The process %original file name%.exe:2008 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\YsEMgcoY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FwoAUQUs.bat (4 bytes)
C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\FwoAUQUs.bat (0 bytes)

Registry activity

The process fGAwoYMM.exe:1616 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7E 6B 21 D1 07 BE 15 9A 18 5A 4E 3A 98 3F 89 EF"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"fGAwoYMM.exe" = "%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe"

The process reIEcoQI.exe:1276 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A2 B4 95 3D DD 5D C1 0A 47 EB 9A 45 1C D8 4E EF"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NesIMIQs.exe" = "%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe"

The process %original file name%.exe:3924 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7E DB 80 50 B3 2F 97 A5 C8 77 DF 05 21 60 99 39"

The process %original file name%.exe:3496 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "81 BD 6F 57 25 63 DD 1D CF B7 32 4B 0C B3 9F C7"

The process %original file name%.exe:3648 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "40 C4 88 05 62 53 CF 63 C0 C4 5C 1A 14 23 41 BB"

The process %original file name%.exe:3328 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0E 1D 6A AE 85 C1 F7 EC 7B DF 54 2D B7 5F 74 63"

The process %original file name%.exe:3252 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "71 D4 87 B0 32 C2 77 37 8D 6F 58 78 52 41 69 9C"

The process %original file name%.exe:2328 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0D 74 34 DC B3 78 CE E8 D0 5A 5A 9E F9 38 FC B9"

The process %original file name%.exe:3256 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C5 10 30 8E AA 4E 97 1E BA 29 1B 51 A0 C9 E1 18"

The process %original file name%.exe:404 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D3 26 C0 F7 0A 06 06 57 A5 E3 C3 FC CC 73 9F 38"

The process %original file name%.exe:2248 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "81 BE F0 43 6D 48 CB 42 5D 9C 06 CD 78 5B B4 1C"

The process %original file name%.exe:2152 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8E E2 D7 84 4E E3 E2 2B 12 AE DA 04 25 E9 95 0E"

The process %original file name%.exe:3784 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "78 F9 C0 EC F6 49 00 25 02 8A 38 2C AD 6E AE 58"

The process %original file name%.exe:3488 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A2 DB D9 F9 20 C7 DC 12 79 48 48 0C E0 11 42 9C"

The process %original file name%.exe:1096 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "82 51 B7 F5 30 72 91 A5 D7 A6 FF 28 3A 91 8D 94"

The process %original file name%.exe:3764 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "32 59 08 50 B0 C3 3B 82 E0 1C F1 B2 36 42 6A 54"

The process %original file name%.exe:3480 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3F 42 7F B0 85 64 B9 CB 88 6D 19 CA 34 E4 9A 5A"

The process %original file name%.exe:2468 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8B 52 3C 10 32 8B B3 64 53 97 63 82 F8 FE 69 E1"

The process %original file name%.exe:1496 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F9 8B 41 A2 34 27 A6 DE FE 2B 12 A4 34 CF 44 6D"

The process %original file name%.exe:1952 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B5 EA 18 43 24 D1 C9 B8 2D 28 E3 15 C5 15 3E 5A"

The process %original file name%.exe:3408 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "81 1C 9B 91 CD 2F 9C 9A 53 F1 17 6D 7B C0 4B 97"

The process %original file name%.exe:3644 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "75 FD EC 47 18 8A 1B A6 0A 9F EE 6F DF CF B9 96"

The process %original file name%.exe:2216 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "80 FB 7E 49 5D 3B 74 6D 3F 52 15 8D B6 97 0A 12"

The process %original file name%.exe:3248 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F4 1E 65 2D BF 1E A4 23 16 36 9E 5A 47 2F A5 75"

The process %original file name%.exe:3564 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B7 AC D2 8B 72 C8 45 33 93 5E 78 5B E4 5E 18 3C"

The process %original file name%.exe:3568 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "37 9A EE B8 93 50 89 F8 75 A1 F3 12 A3 04 F9 6D"

The process %original file name%.exe:3240 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3E 84 2C 5D 96 34 14 A0 0A BA DA 82 C7 39 71 42"

The process %original file name%.exe:2996 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "78 34 78 97 0E AA 57 B1 3B 77 A8 86 B6 4D C2 51"

The process %original file name%.exe:3244 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "32 C3 4A 0A 11 FA 5C 66 8D A3 E8 A9 94 F8 DF 52"

The process %original file name%.exe:1284 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C3 64 8D 48 3F A3 86 A7 D1 87 46 99 D7 85 E3 57"

The process %original file name%.exe:2416 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1D 40 E8 C5 20 A5 1E AC 42 35 4F E3 27 A9 8A 29"

The process %original file name%.exe:2060 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "67 21 7A B1 AC DC 48 E7 C4 66 18 03 71 1D C1 A9"

The process %original file name%.exe:2904 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8A F0 0E AA F5 3E 42 54 30 3D 28 63 20 15 B0 80"

The process %original file name%.exe:3940 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A4 A9 EA F1 09 96 67 75 21 67 1C 6E 18 13 1B B6"

The process %original file name%.exe:196 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B3 80 58 D4 15 6D E8 BB BA B0 4B 02 15 86 DC 44"

The process %original file name%.exe:3944 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D9 A1 E0 CB 96 EF 48 7D AB B6 09 61 21 98 48 98"

The process %original file name%.exe:1088 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "80 E1 D3 9F EC 76 72 9C 08 EB CA 72 DD 5D 07 DC"

The process %original file name%.exe:3276 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2E 3A B7 49 3A C2 A5 2A B8 97 03 AD AD 05 4E 29"

The process %original file name%.exe:2824 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D2 14 23 4A 03 12 A1 A6 99 55 03 4A 39 22 E2 F6"

The process %original file name%.exe:2820 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "29 C8 FB 51 A6 B2 D7 36 F2 04 7F 75 06 52 26 8C"

The process %original file name%.exe:2308 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BF 53 4F 03 8D 6D 86 FF 5B 6C 25 B2 43 33 BB 1A"

The process %original file name%.exe:2988 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9A 78 9C EF EB 67 71 D5 85 D0 6E 65 B9 8F 71 76"

The process %original file name%.exe:4040 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0B 7D B4 EE 11 36 47 53 D9 AD 38 7D 7D D2 A5 8C"

The process %original file name%.exe:3576 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C2 0B 3C C1 F3 AB 52 7D 66 36 CA 84 D4 5F C3 91"

The process %original file name%.exe:2984 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A8 B9 3D B4 11 B2 B2 10 A7 AE CF 03 C2 82 46 36"

The process %original file name%.exe:1524 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E5 08 93 87 4D 55 89 34 7A 76 B9 B6 25 83 BC 44"

The process %original file name%.exe:2268 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "52 FC 81 7F D3 89 2C 6D 7A AB D7 18 59 CB C5 FB"

The process %original file name%.exe:2804 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7D B7 34 A4 5A 97 A5 5A 19 8F D4 32 88 E7 35 3A"

The process %original file name%.exe:4060 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DA BA C8 E7 0A 6A B4 25 BE 3D 0F 9D AE 7D 3D 20"

The process %original file name%.exe:2604 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "27 2E DD F6 E8 E3 9D C3 C3 F9 CA 01 4F 7F A8 13"

The process %original file name%.exe:3816 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "76 E8 25 DD E7 05 EF C3 AD FD 12 96 77 DA 5D D3"

The process %original file name%.exe:2608 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E9 F7 A7 98 9C 46 7E 98 2A 18 F0 8E 8A 2B A9 A3"

The process %original file name%.exe:2140 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "76 75 63 17 36 8F C9 F9 23 CA F7 D6 8E 8A 4E B3"

The process %original file name%.exe:2284 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "12 75 EB EA B9 8D 8C 04 8B F6 1A C3 BD 59 0B C8"

The process %original file name%.exe:3956 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "50 47 11 8F F0 7D 79 38 EB 9C 84 A5 56 B9 7D 7B"

The process %original file name%.exe:3740 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "86 55 4B A2 60 16 7A 05 49 E1 54 73 84 AB 5E 2E"

The process %original file name%.exe:244 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DE 52 61 74 07 F4 5A 02 32 25 B0 25 3D 9A 0D A9"

The process %original file name%.exe:2836 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1F BB AA 52 16 B4 8E 76 DC 20 2F CC 16 4C 8E CD"

The process %original file name%.exe:3316 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "90 32 5E 4A 81 5A 0B F0 81 FE 78 C3 B9 AC E1 B2"

The process %original file name%.exe:4056 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E2 5D E9 91 3C CD D6 CA 27 84 94 B9 B5 80 8B BC"

The process %original file name%.exe:2272 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5D 30 71 99 61 78 28 B1 D5 EB 15 B2 6A 1E 8B FB"

The process %original file name%.exe:3012 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8E 29 AF EC C3 5E 4F D1 03 88 84 D5 C9 7B 6F 4E"

The process %original file name%.exe:2572 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "28 21 AB DB 00 79 21 25 4E CF F2 CB 91 D2 64 C5"

The process %original file name%.exe:2372 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "83 CC 12 A7 C8 6F 8B 1E 44 C9 47 D4 4E 00 3F B0"

The process %original file name%.exe:3612 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DA 46 D7 E6 C0 5A 86 FA 62 B7 72 C7 0C 95 46 0E"

The process %original file name%.exe:2456 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AE 65 36 07 83 8A 11 CA 11 71 8C 2D 39 BE 55 8F"

The process %original file name%.exe:3004 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0F BC D5 5D C6 57 75 D9 14 31 53 2A 0F F0 92 4A"

The process %original file name%.exe:1908 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B8 7B 94 EC F7 D8 B8 51 50 B0 24 02 AA D2 7D 03"

The process %original file name%.exe:1900 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "32 7B 92 BB 07 95 AB 51 77 43 A7 3A DD B2 A5 D1"

The process %original file name%.exe:3216 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4C C6 51 FB 06 16 64 0F 2F 51 D3 0F A5 D2 F4 32"

The process %original file name%.exe:2052 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A2 C6 15 37 E1 D6 CA 50 79 B2 D1 CA 27 D5 EA 0B"

The process %original file name%.exe:3364 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BF 08 15 27 38 94 08 E8 09 7D C6 E0 F9 35 5E 6B"

The process %original file name%.exe:3360 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "78 5D 3D 44 2F 83 B8 51 02 D6 B5 45 9E 75 85 61"

The process %original file name%.exe:3696 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "55 EF B5 56 F8 9F 3A DB 8D 10 CE A9 02 ED 48 7E"

The process %original file name%.exe:1736 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1F 84 F8 50 70 97 05 E1 5D B3 91 F1 F0 2B 13 79"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"fGAwoYMM.exe" = "%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NesIMIQs.exe" = "%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe"

The process %original file name%.exe:2684 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C8 B9 C7 23 73 6A 0C 41 3B 6A 74 5C D4 36 67 A9"

The process %original file name%.exe:2112 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "43 9E 79 1B 0B 99 DB DC 1D 62 12 85 E0 25 86 C5"

The process %original file name%.exe:3896 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2A 1D 25 8D CA 3C 88 E4 DE 70 E4 6B 5F 14 0E 6F"

The process %original file name%.exe:2116 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "55 A6 70 C5 2C E4 AB C0 E1 27 E8 BA 17 14 81 91"

The process %original file name%.exe:2620 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "12 17 43 A2 11 12 89 49 15 9F A1 4D FE 3D F4 A2"

The process %original file name%.exe:2400 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AA C8 81 4B B7 8C 86 DC 65 21 03 09 D7 91 03 7E"

The process %original file name%.exe:636 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D0 A8 54 99 57 B1 C1 89 05 38 A7 90 6F CD 9E 64"

The process %original file name%.exe:1644 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1E 69 FE A7 AA BE 5E 91 B7 2F F1 EA 00 7C 3C 2B"

The process %original file name%.exe:2420 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3A 9D 15 B1 BD 67 91 46 9C 2B 1C D8 9B D9 A6 9F"

The process %original file name%.exe:3908 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "71 47 74 4D 35 0D 3B DB C4 D0 CF A7 8D C2 96 68"

The process %original file name%.exe:3872 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C5 18 C5 0F DE 17 9C A1 A0 43 99 22 8F C5 9E 53"

The process %original file name%.exe:3288 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6A A8 5A 16 D2 33 F0 F3 5C 0B 5C D0 18 B0 27 E5"

The process %original file name%.exe:3172 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "56 F0 65 12 B4 B4 88 DA 7D 0C E0 45 89 13 65 5D"

The process %original file name%.exe:2952 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5F 3D 12 46 8B F3 50 2B 48 46 96 1A 30 EE A2 09"

The process %original file name%.exe:3228 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9B 76 AC 99 EC 33 BA AC BB 25 44 BF 45 99 B0 62"

The process %original file name%.exe:3880 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E8 DA 99 38 C0 A1 CB FB 4A 93 6C C8 46 5A 2A 1B"

The process %original file name%.exe:3200 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B2 97 7D 4E 20 62 44 86 DD F4 1B 3B 64 05 2D 1E"

The process %original file name%.exe:2680 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BD 51 C3 54 F4 30 52 7B 29 7F 01 C6 CF 60 3E 37"

The process %original file name%.exe:2896 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1A 20 DC 9F 7C 4A C5 DA E7 CC 72 32 A0 49 7F 1B"

The process %original file name%.exe:3440 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "27 76 3A 6E 9F C8 12 13 00 0C 60 2F C9 58 FE DC"

The process %original file name%.exe:2108 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "86 7F 7B C8 AF 6A F0 B7 B9 CC 4F 8D 33 83 9A CE"

The process %original file name%.exe:1748 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FE EC 06 50 3A 26 2F F8 23 B4 7F 86 FA CD 54 7C"

The process %original file name%.exe:2100 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "21 B0 25 99 CE 67 42 85 F9 4A D0 94 BB 72 91 01"

The process %original file name%.exe:3868 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "72 96 45 CF 2A D5 40 D3 CD 71 9B CA 57 AE 85 86"

The process %original file name%.exe:4084 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2B CA C0 0C EC 90 2F 12 6F B9 54 1E AC 3F 21 69"

The process %original file name%.exe:2432 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "04 A1 DB B7 8F 0F 3A FB 04 35 FC 81 99 A2 D7 B1"

The process %original file name%.exe:3632 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "35 82 FF 6D 3B 5A F4 A3 E8 04 69 FD 8D EF F9 97"

The process %original file name%.exe:2436 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D6 A5 70 07 03 26 7E 07 C7 F5 52 E7 3D 1E 9C 32"

The process %original file name%.exe:3112 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F4 3C 92 A5 C0 9C 31 8D 47 3B BB 0D B8 A7 A9 DA"

The process %original file name%.exe:2948 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AD 11 72 81 E0 6E 5E CB 92 56 37 7B 21 6E AB D8"

The process %original file name%.exe:3736 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C9 70 9C 6F F1 F2 19 98 2A 1C D5 79 C4 90 6C 78"

The process %original file name%.exe:236 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "06 89 73 A3 51 8B 54 1E F0 56 E6 F5 1C 01 73 17"

The process %original file name%.exe:2944 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A9 08 AF EB 8C EB 35 AF 51 60 F0 A2 5E A6 78 69"

The process %original file name%.exe:3732 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "19 AA E4 42 3D 5A A8 5B 20 08 83 09 0E F6 78 91"

The process %original file name%.exe:3068 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CD C0 DD FB 48 41 7E 46 EF 0F 2D 40 AC 81 85 59"

The process %original file name%.exe:2624 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1C 48 B1 11 8A A4 9A 63 59 64 18 3D BC 27 0D 8D"

The process %original file name%.exe:2224 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B8 D4 1D 91 EF 22 38 BD 1F 1C 9B 17 D0 ED E6 94"

The process %original file name%.exe:2744 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "84 72 8F 47 87 9E A6 5D 2D 44 35 D7 32 95 4C 2C"

The process %original file name%.exe:324 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "91 05 EE C7 FC 3D D0 F4 1C 12 4F 60 D9 4E 25 B7"

The process %original file name%.exe:3976 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "44 A4 CB CC 46 EB 2B 96 77 88 8F C2 D9 15 86 FA"

The process %original file name%.exe:2504 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C7 17 69 DB 44 C4 46 E2 84 66 B1 B6 FB 5C A4 44"

The process %original file name%.exe:2876 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AF 64 23 39 BE 2F 0A 83 43 9C 13 91 AD 74 1A 02"

The process %original file name%.exe:2720 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7B B1 DA F6 FB 61 14 66 E5 D0 14 FA 9A 9E D2 40"

The process %original file name%.exe:2644 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3F C2 33 15 72 1E C6 0A 4C 81 72 5C B5 DD AC 7D"

The process %original file name%.exe:1896 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AD 04 1F D9 C6 C8 12 6A 11 40 30 D9 A8 E7 AB 30"

The process %original file name%.exe:2540 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "07 48 23 9A 1D A0 2A 5A ED C3 D8 01 BA 56 3D 5D"

The process %original file name%.exe:2932 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1D 9E E0 19 29 98 E0 71 AC C7 7B BB ED 14 83 8D"

The process %original file name%.exe:3056 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "01 48 D5 A8 71 93 DB 91 5F 63 FB DF 47 79 29 E0"

The process %original file name%.exe:1884 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "07 94 29 B0 19 91 39 74 4C 42 24 74 D1 FC C2 89"

The process %original file name%.exe:3544 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "27 87 56 0A 3B B0 52 DF 6A 74 4B BD CF 51 31 FD"

The process %original file name%.exe:2120 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BD A5 DC 8B 4A 4F 8B A5 D7 BC 66 03 DD 7B A9 88"

The process %original file name%.exe:2124 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "05 BE 92 E7 BC 5D FE F5 F2 A1 F9 AF A4 01 81 0F"

The process %original file name%.exe:2336 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "30 F8 37 49 A0 21 07 6F AC 97 8C 64 F7 15 25 10"

The process %original file name%.exe:2128 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CB 46 63 1B EB 02 E1 CF AD FB B8 C0 98 6A BC 68"

The process %original file name%.exe:3788 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F0 5F 7F 3D 9D A7 9A 79 DB 05 C1 D5 5C C7 40 13"

The process %original file name%.exe:3420 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BA AF 0C 3A 1E A0 BE 40 D3 BA D1 95 18 80 16 03"

The process %original file name%.exe:3220 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "70 5C B6 0D E3 F5 2B 55 63 53 F4 88 75 BC A4 07"

The process %original file name%.exe:2084 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A8 36 27 98 1B 63 92 A3 8B 65 3C BF 1D 09 29 24"

The process %original file name%.exe:808 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A4 0B F7 D2 86 49 C2 CE 67 52 E8 59 FB 73 B6 DD"

The process %original file name%.exe:3988 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B0 F0 C6 0A E6 6B 58 67 46 C5 00 D4 86 A6 B3 79"

The process %original file name%.exe:2532 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "71 59 F5 02 0E 93 2C 80 12 84 20 AA 01 D6 74 6D"

The process %original file name%.exe:1572 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "29 B3 D2 D2 62 2D 1D 76 71 4F BB 8C EC 30 60 40"

The process %original file name%.exe:2008 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DC 50 82 E3 E8 04 61 DF C3 14 0D 9B B5 A7 07 6E"

The process cscript.exe:212 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "46 08 9D 16 EB D8 01 1F 19 B0 AD E3 35 87 73 78"

The process cscript.exe:3924 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "50 32 10 D5 4D 18 22 61 66 0B 50 45 42 F0 74 43"

The process cscript.exe:4036 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "90 36 BA 63 8C 53 24 96 A9 3A 51 39 C1 35 0E F8"

The process cscript.exe:3492 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "78 47 9C B9 7A 14 6A 21 AB 6A A9 82 D5 8F 92 3B"

The process cscript.exe:3412 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "29 9C E8 81 EB A4 DB 3A 30 AF E4 82 34 A6 B1 2D"

The process cscript.exe:3328 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "33 9D B8 E7 16 F9 01 67 56 D6 9A 8B B8 37 E2 49"

The process cscript.exe:3044 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B1 42 CF E5 BB EF 75 C0 38 E0 7B 80 82 6F 07 27"

The process cscript.exe:492 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8B 3F 29 16 7B 93 EA D3 4B 6A 09 CC 2E F7 1D FA"

The process cscript.exe:2488 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "ED 6E 51 72 53 20 F6 0E B0 48 F3 BE 5E 83 A9 8D"

The process cscript.exe:3796 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3F E1 4C 54 66 CD 7A C3 9B F9 85 BD AE 38 0A B1"

The process cscript.exe:2528 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B4 6D EA 43 83 35 95 B7 81 E6 3B 0B CF 30 AC C6"

The process cscript.exe:1944 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A9 7B 6A 52 A8 D6 C4 15 8A 47 A5 22 4A 6B F3 41"

The process cscript.exe:2248 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A3 84 4E 54 54 F3 E8 8E 81 69 AA 9B 08 7E 5D 17"

The process cscript.exe:2752 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B0 DF 6D CB BD 31 14 F5 6A 27 F6 DE 1D 99 DD B7"

The process cscript.exe:348 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "71 01 F2 E8 D6 FD 16 21 DE 17 BA EF 9C 52 DC 9A"

The process cscript.exe:1096 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B3 A9 8A 6F A3 25 86 D8 16 80 F5 66 47 E4 91 86"

The process cscript.exe:1260 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "56 0E 25 2E C4 23 8E 37 D3 CE 2A FA 9F 74 6A C2"

The process cscript.exe:2916 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "41 51 C5 F7 F5 2B 48 D8 FC 00 52 06 49 7F A4 4B"

The process cscript.exe:1792 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "01 E1 C6 07 2A 72 D1 49 DB B7 3E 32 45 34 32 DE"

The process cscript.exe:1796 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8C 05 4D 7E 35 FC E2 62 51 7B 9F F8 01 E6 BA 46"

The process cscript.exe:3932 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AA 47 2C 88 E8 86 0E 11 B6 3C 5F 15 32 AD 3D 5F"

The process cscript.exe:3336 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2E E6 01 90 54 D7 44 A3 8C 77 81 94 3E 02 B6 0E"

The process cscript.exe:3132 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FB CB 91 4A AA 4D EE 4A 61 A2 F4 E8 B7 2E B2 F6"

The process cscript.exe:3564 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B4 0D D6 86 AC B4 86 F1 59 A8 C3 56 DE 49 B9 0B"

The process cscript.exe:2312 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "39 1D 3D 38 2C 48 F3 ED 86 09 65 0D E7 CF 6F 91"

The process cscript.exe:2996 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0C 01 D3 FB 65 38 A0 43 68 45 B9 5F 9A 49 2B 6C"

The process cscript.exe:2396 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FE 1C AC 71 39 3B 72 EE F0 46 3F 5D F6 4F 9E 34"

The process cscript.exe:2412 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "16 CE 6E 1B 2C 16 DF 10 3A 2A CF 7B CB AA 20 39"

The process cscript.exe:2392 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F6 2A E1 C7 55 47 A8 9F B7 F8 52 6F E8 10 F6 01"

The process cscript.exe:532 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "53 95 AE D2 A4 6B 4B 49 5A 80 80 CB B5 E9 45 8B"

The process cscript.exe:2792 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "98 31 D9 34 88 BE 14 A2 29 B9 54 DB FD 44 AE A2"

The process cscript.exe:3848 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "80 1B D5 FE BD 18 01 0C 15 D6 AF B1 BE 41 70 45"

The process cscript.exe:2796 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CE C9 02 C3 5C 83 9F 2B 16 B3 29 45 FE 59 11 99"

The process cscript.exe:2148 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5F C5 79 1B F9 3C 94 EA 8F 34 E6 82 5E EE D2 B0"

The process cscript.exe:3820 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2B 35 42 E0 C8 19 63 FE F4 F8 68 3C E2 19 74 83"

The process cscript.exe:3144 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "64 62 83 94 3B 4A 30 AA EC F6 B9 8D BB A0 36 63"

The process cscript.exe:1928 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1F 0D F6 BA 05 1C E4 C3 45 15 23 B2 85 A3 5B A5"

The process cscript.exe:3164 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E5 87 77 5D 06 3B F6 0E 69 60 58 99 61 52 DD 5E"

The process cscript.exe:3300 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "29 11 1C E2 1B 9E CF 94 43 F0 73 22 B3 0B DE C2"

The process cscript.exe:2068 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "86 34 CA 59 1D 57 4B 74 37 2A 41 5B CB 74 31 CE"

The process cscript.exe:2540 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "11 DE 0D 64 20 A5 F6 BA CD 3A B7 02 9C E8 79 66"

The process cscript.exe:1852 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2D 2F 8E E2 26 41 BD 8B CB 85 47 7A E8 7E 6A B2"

The process cscript.exe:3024 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B7 F6 02 9A B2 3E 7F 18 F0 99 DE D1 DD 17 61 A8"

The process cscript.exe:4048 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "00 E0 44 E0 1B E6 AD BD 97 6F 63 D8 59 8C 08 0A"

The process cscript.exe:2388 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8A 4C 99 BC DA 35 19 82 26 A3 09 5B EA 1A DD CF"

The process cscript.exe:2076 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B0 A3 26 54 E0 C2 B7 34 B1 29 72 18 C1 98 5A DB"

The process cscript.exe:2668 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A4 FB 47 66 0D C7 05 41 12 D9 A0 65 DB A6 16 21"

The process cscript.exe:3580 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C5 63 52 F8 28 CE 2C 36 4A E8 A9 50 77 D6 69 CE"

The process cscript.exe:2444 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "62 96 66 BC 88 B8 57 10 A5 DF F6 29 CA 51 FB 9B"

The process cscript.exe:2936 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FC C2 10 51 D2 8F D8 58 93 71 27 56 D4 70 6E 8B"

The process cscript.exe:3956 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C7 56 02 DA 53 CC 82 C8 E9 5E 8D 3C 08 0F BA 77"

The process cscript.exe:3740 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "12 E1 F7 96 55 EC 21 27 63 F2 6F 1E AF 3F AC 3D"

The process cscript.exe:444 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D3 67 43 98 11 F1 0E E1 65 02 BB D1 19 E4 72 81"

The process cscript.exe:3836 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "33 F4 70 36 7F DC 01 AE 0B 4E 45 9E F5 C5 8B 8C"

The process cscript.exe:3264 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BC 03 67 88 BC EF DD 37 0C BB FD F3 69 B1 C1 1B"

The process cscript.exe:3268 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B9 B4 9C 16 A2 66 EF 6C 9C 83 03 F3 C8 21 16 D3"

The process cscript.exe:2764 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4E B5 C2 8B CD C3 18 9C 1B A6 91 0F 03 25 FD DA"

The process cscript.exe:3316 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "47 19 21 A7 0C 17 BE 1B AC 21 FC 42 CF AF D6 70"

The process cscript.exe:1648 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2B 35 24 C2 A5 FB 90 E6 00 79 2E A0 D7 13 F2 53"

The process cscript.exe:3468 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "76 10 15 B4 42 E5 E0 22 50 CF 78 25 FE 7A AE DD"

The process cscript.exe:3092 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E9 D7 2F 61 08 09 CC 3D 6C EB 3E 41 56 7B EA 6A"

The process cscript.exe:3364 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "63 FB 7E 6C 5F 5D 36 4E 31 6C DA B1 B3 A7 77 2B"

The process cscript.exe:436 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "72 92 C0 9F DB 33 90 E3 F7 9B 6C 4C 28 59 15 48"

The process cscript.exe:3156 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FD AA A8 AD 25 A3 72 0D 8A 81 1C 1B 76 D0 0D 18"

The process cscript.exe:2616 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AF 35 49 B5 1B 87 0A F2 0E 69 97 2E FF 57 29 97"

The process cscript.exe:3612 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "60 89 2A 8D 81 26 6F 0D 0D C8 78 DB BC 7F 00 D4"

The process cscript.exe:1224 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1A FE 01 25 3E 4F 5C C0 4A B2 AB FA B9 0B 9F 7F"

The process cscript.exe:2592 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3D 27 6B 08 84 55 7B A0 8A EE DD 92 5A 69 52 91"

The process cscript.exe:2920 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5D 0D 24 52 45 9F 1E CB 51 60 80 F4 D9 E4 1E 50"

The process cscript.exe:336 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F5 C4 83 42 D4 E3 A2 58 E9 EC 2F B2 74 91 0C 06"

The process cscript.exe:2452 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D2 6D 18 F0 F8 51 DA A2 8B 66 00 5F 83 61 9A 2E"

The process cscript.exe:1908 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2A 7E 31 FF 5B EF 42 99 42 66 2C A3 CF FB CC 4E"

The process cscript.exe:2836 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0D 11 D4 18 83 4A DA BC 2E BF FC D4 6D 24 02 1C"

The process cscript.exe:1904 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B4 A0 1E 3D 63 98 66 9C 9B 4C A9 9A AE 16 45 C6"

The process cscript.exe:3292 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D2 0B 77 4B 1D 09 68 E1 F8 48 F8 22 FA F9 40 E1"

The process cscript.exe:2880 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A4 AF AE 8E 37 FC 3B BC 08 65 6E 09 57 04 04 FB"

The process cscript.exe:2204 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9F E9 D6 69 DF D0 AC A4 6A 96 B2 84 CC E8 BD 11"

The process cscript.exe:3212 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0F A6 AF AC 9C 3C EE 7D 10 3F AF 76 74 D3 8E F7"

The process cscript.exe:2208 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "61 43 C4 5E 8B 6F 4C 8B 38 B4 97 F1 F1 85 93 3D"

The process cscript.exe:3516 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D2 DB 22 74 84 F7 1C C4 CF 40 1A C0 B9 10 FE 5E"

The process cscript.exe:3696 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C2 43 3A F0 1A 8D 94 8D E2 70 45 9D 6A A2 F7 BF"

The process cscript.exe:3088 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "86 77 B5 61 D4 B3 4A 9A 23 0E A6 EC CF 3A C7 98"

The process cscript.exe:2368 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "69 B0 F8 FF 37 84 71 40 78 7E 7D F7 68 B4 4E 25"

The process cscript.exe:2680 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "46 6B F3 81 71 53 3F 77 CC 40 E1 E0 05 BC 3B 8E"

The process cscript.exe:500 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F5 EF E3 6A 5F 6C D6 F3 68 F9 5F FA 92 08 08 DB"

The process cscript.exe:2360 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "86 C8 62 9D 4A 36 B5 44 70 9D 0D AF C0 46 06 5B"

The process cscript.exe:2620 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "67 AF B1 C7 75 FA C1 E6 6B 80 57 E2 27 23 85 E9"

The process cscript.exe:2584 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "16 0D EB 94 70 2F EE C9 50 3A 03 68 4F 78 01 75"

The process cscript.exe:2812 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FA AA C2 34 DF 14 A0 ED FE 6B 61 D5 79 2A FD 14"

The process cscript.exe:564 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A0 E9 CD 72 0D 19 78 E2 AD 3F 5C 8D 5C E0 77 C7"

The process cscript.exe:3876 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1E 7C 06 83 82 80 49 95 9E CC B1 19 56 4E 66 6E"

The process cscript.exe:2264 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "51 DE 4A 93 DC AB 44 DE 40 42 C0 2D B0 C2 68 B4"

The process cscript.exe:2180 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1A F0 17 C7 58 DD 6B 07 42 74 B7 FC F0 5F 45 C8"

The process cscript.exe:3728 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "16 30 1C C6 FE 10 B3 BE 46 C8 EB A9 F8 85 71 65"

The process cscript.exe:3284 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "44 9A FB 37 94 92 A3 60 FF 56 40 53 C3 1F C3 20"

The process cscript.exe:3528 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "47 D3 5A 51 35 9B 3B 6A 89 69 AA CB 78 90 19 4E"

The process cscript.exe:220 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5F 88 1A 8A 20 C3 AF EC B4 A3 9A DD EA B0 07 24"

The process cscript.exe:1992 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "48 2E 2E E8 7F 37 C4 18 B3 D7 03 0B B4 13 28 90"

The process cscript.exe:3200 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0E 3B 94 1F 2E DD 23 F8 12 15 C6 96 8C 47 2D 04"

The process cscript.exe:3896 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "99 D0 56 B1 F2 6F 12 43 CC 07 1C CF 5F 9C BF 95"

The process cscript.exe:3372 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A8 63 CA 74 79 BC C4 36 62 E8 09 84 F3 38 B6 5A"

The process cscript.exe:2108 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CB 8D 15 1A 8C B5 D0 14 8C 3A 4D EE DA 26 17 33"

The process cscript.exe:1748 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AE 81 22 D0 81 F8 AA CB 98 D8 C6 8C BF E9 34 53"

The process cscript.exe:3960 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A9 4C 1F 71 27 FA 52 EF 99 93 29 71 64 92 0C 25"

The process cscript.exe:2356 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "55 79 B5 58 A3 8B 87 D6 7F E3 CC D4 C6 24 00 E4"

The process cscript.exe:944 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C7 08 26 62 38 15 77 12 DE 80 7A AE 49 EE E3 2A"

The process cscript.exe:3628 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7C FA 36 A0 84 B4 4F 0D BF 74 E7 C1 4D DB 00 B5"

The process cscript.exe:2868 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "65 1F 9F 65 BB 41 41 34 9F 0A A0 9C 56 A3 98 2F"

The process cscript.exe:2436 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "62 CB 3D 53 32 73 21 D3 6B A3 EB B6 CF 24 2A 21"

The process cscript.exe:3672 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "59 4E D7 E1 5E 15 7F 22 F1 DF F3 24 0B EE 30 C6"

The process cscript.exe:3732 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D5 E4 B3 AB 14 19 D4 D7 82 03 E2 AB 1F 42 1F 9A"

The process cscript.exe:3232 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "27 C3 23 0D C1 22 BE F7 4C D3 EB EC AD 42 3F AD"

The process cscript.exe:2132 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BB 81 58 C9 BE 78 B5 CA 23 99 99 6B 77 7A 8C 70"

The process cscript.exe:4000 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "19 E5 53 D1 E3 5D 98 55 FB B2 AE 31 80 28 6F 89"

The process cscript.exe:3340 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "63 DA 50 47 BA 0C 2C B3 6F 2E 51 8A C4 C2 AC 5C"

The process cscript.exe:320 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2F DA 79 17 6A 55 AF 6E 72 B8 BD 96 3F 65 97 0C"

The process cscript.exe:324 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D5 97 EB 5F E8 AC 56 A2 CD DF 29 11 0B 35 A0 72"

The process cscript.exe:1560 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C9 F8 7F F6 CD CC A2 46 57 D2 19 A7 14 14 A8 32"

The process cscript.exe:2500 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "35 87 96 83 E5 68 27 15 1F A7 57 F8 7F 3A 63 99"

The process cscript.exe:2648 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "16 83 58 15 15 6A D9 62 0F 36 6F 6D 4F 0E F2 63"

The process cscript.exe:2136 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "34 8B C7 04 3E 0A 96 B6 F7 4D 6E 65 AD 63 53 26"

The process cscript.exe:2872 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6D 5F 90 CD 77 97 2B C7 3E 83 83 3F 82 B9 D5 FD"

The process cscript.exe:140 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DF 2F 4E 2E 3A 9D 77 FD 26 2C E0 E7 B1 60 FA E1"

The process cscript.exe:1712 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "39 EE 78 5F 93 84 52 00 6A FD 48 DD 62 11 8E C1"

The process cscript.exe:2644 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2E F7 B2 69 9A BD 1A E3 23 31 31 DA E4 C4 EE B3"

The process cscript.exe:3624 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E8 94 D1 1B 80 24 38 61 0F 5B F1 28 86 DD 70 61"

The process cscript.exe:1760 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "62 EA AC 58 90 D6 83 57 CF F5 1F 61 01 E7 FD 0C"

The process cscript.exe:3544 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "80 FB 30 2A BE 87 90 FD A9 11 DA 28 69 0E 46 AD"

The process cscript.exe:1284 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EB E9 0B 36 44 00 8B 93 42 3A C3 A9 56 80 84 DC"

The process cscript.exe:4012 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C2 DE 3E B6 C4 15 75 7E F5 F8 DE ED 03 24 D9 94"

The process cscript.exe:3788 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "71 7F 02 7C 9C 59 37 00 B1 3D 8C 7D 91 2B BB 62"

The process cscript.exe:3220 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B6 B0 47 77 5B 58 9B 0E 5A 1B 68 6D 02 5A 80 09"

The process cscript.exe:2084 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "79 ED 56 B3 F1 58 01 C2 1A 1C 00 35 22 88 7F AA"

The process cscript.exe:2236 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F5 1D EA 88 B7 45 45 5B 01 F9 68 0C 0E 0B EE 14"

The process cscript.exe:2008 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4F EE CC 13 7E D7 B9 B5 75 3B 13 48 1F D5 21 49"

The process NesIMIQs.exe:1664 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "96 C4 43 A9 25 71 E7 54 4D C8 3C A9 85 0C A3 74"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NesIMIQs.exe" = "%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe"

Dropped PE files

MD5	File path
e7406b0ec029dc43dbea2a6d8d08f3d0	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
e6e44b41b3bc2db2dff30aa02409d274	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
cc5459b3de32906cb9403263428dccca	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
dc25a566d1e4540f816f55a4053e1fdb	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
85375efa385772513ad06ab5034342de	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
1f4cd7355780c9735fe685372c657a5d	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
f440014ab12dfa56ba6210b2584d7cbc	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
b1f3fe90553abfc511589ddd94f10591	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
7686f85d39901d41a4a245775dee7165	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
7e66c48472ea356db8cae19562bfc8a9	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
fb160f7596c7ffc95093c8a4768703a8	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
0962ecb0119458cbba5b2170fe7e09e6	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
326ef4c1bc8542cf2928003254df41ab	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
d29e1facc80b3ec34669f7be923dcdbc	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
0aadbefd0703a361cdf1514510bd4743	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
da196548b2b0b0564ffdbcb7515d891a	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
e26d5604b49fb84c5540b59795768c2f	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
31131a61b81d9ce111ee936f17d759d0	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
78627f74f3ca917d047ee4202bd45b21	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
d6208694ce6be3e7d1d6170023f2f79b	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
02c9ea58134bf7f0685994b32d31b5af	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
4c7ef7049b3caa94bc2d366c46739614	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
6386b890143af428682f5df02dc171bc	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
f0af4900ecc3d4528b0adc6f43ad2ea8	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe
a5855ef3bcc0d3734348ea58cfffe2d8	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
c30f856572b81c01bd5796d3bbcac225	c:\Documents and Settings\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
489b86d97846b27fe1f9fa46b649bb82	c:\Documents and Settings\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
36919c167bd9a4e43f837f3171124e1d	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
dc38c5094a242918c2e85b2ea9e90a3f	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
3c4d801b28fa25c3c7110a8a34305d75	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
c9dd83f8d66963448f79678e2f05fcda	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
8dea5b92057f9838d47aab0cfdbb5cc2	c:\Documents and Settings\All Users\JuwEIgUE\reIEcoQI.exe
d5788bb3f06f592d5a01006a1353c834	c:\Documents and Settings\All Users\hcYYccwo\NesIMIQs.exe
a419f612782ec583fd094eecf4cf3036	c:\Documents and Settings\"%CurrentUserName%"\dUskcAww\fGAwoYMM.exe
86a7d4b703efd91fbaf2bdec12c024b7	c:\Perl\eg\IEExamples\ie_animated.gif.exe
9d89bb896b4521c6b83c190e988b55a8	c:\Perl\eg\IEExamples\psbwlogo.gif.exe
1b355a88c4776bf7c33e3c36b208fda8	c:\Perl\eg\aspSamples\ASbanner.gif.exe
06af432f8ccd51231fd92fa6a4ce0770	c:\Perl\eg\aspSamples\Main_Banner.gif.exe
1a3e040a3fa4f0859a3a03135da21620	c:\Perl\eg\aspSamples\psbwlogo.gif.exe
d8b4073a1eeb87050905a03ed4a8ad15	c:\Perl\html\images\AS_logo.gif.exe
d906eceb37acb2ca343db1a1f0913fcc	c:\Perl\html\images\PerlCritic_run.png.exe
281be581570992cb23d89ca3e3888b53	c:\Perl\html\images\aslogo.gif.exe
35dc5e473330eee701cacebc58337147	c:\Perl\html\images\ppm_gui.png.exe
47e915be984c85f7364357c43a27ab8a	c:\Perl\lib\ActivePerl\PPM\images\gecko.png.exe
e0eeb4d5ea58b6e234cff13cff6391b9	c:\Perl\lib\ActivePerl\PPM\images\perl_48x48.png.exe
8dd4471fe9ef6758f8f355a1fea4bb21	c:\Perl\lib\Devel\NYTProf\js\asc.png.exe
368ed2dfb11c3b07dcf8e54d47e656a4	c:\Perl\lib\Devel\NYTProf\js\bg.png.exe
7c6af0c5750200c6071fde262c7ee6f6	c:\Perl\lib\Devel\NYTProf\js\desc.png.exe
e1c3c3bd5b0db2999538eab0b3c95a67	c:\Perl\lib\Devel\NYTProf\js\jit\gradient.png.exe
fb32622293ac2bb63a7ee0e7aa35a1b5	c:\Perl\lib\Devel\NYTProf\js\jit\gradient20.png.exe
7b3563d64a3beae041a5d6d56ebdf8de	c:\Perl\lib\Devel\NYTProf\js\jit\gradient30.png.exe
28205c76576c6455e2692f510e85317f	c:\Perl\lib\Devel\NYTProf\js\jit\gradient40.png.exe
a09a9082b91ec6bda7f165ec643eb2cd	c:\Perl\lib\Devel\NYTProf\js\jit\gradient50.png.exe
879e4f9e8d55cd7a84f9aa511cea8b1a	c:\Perl\lib\Mozilla\CA\cacert.pem.exe
eb64b37f02190d1fa06ee5c071ddb139	c:\totalcmd\TCMADMIN.EXE.exe
f6b56db0c230376f0b0de9c18b74eb95	c:\totalcmd\TCMDX32.EXE.exe
2f01499172dfcd422fa2572844e8da50	c:\totalcmd\TCUNINST.EXE.exe
bd263e05100c0517fc4c064d95551e12	c:\totalcmd\TOTALCMD.EXE.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   %original file name%.exe:3924
   %original file name%.exe:3496
   %original file name%.exe:3648
   %original file name%.exe:3328
   %original file name%.exe:3252
   %original file name%.exe:2328
   %original file name%.exe:3256
   %original file name%.exe:404
   %original file name%.exe:2248
   %original file name%.exe:2152
   %original file name%.exe:3784
   %original file name%.exe:3488
   %original file name%.exe:1096
   %original file name%.exe:3764
   %original file name%.exe:3480
   %original file name%.exe:2468
   %original file name%.exe:1496
   %original file name%.exe:1952
   %original file name%.exe:3408
   %original file name%.exe:3644
   %original file name%.exe:2216
   %original file name%.exe:3248
   %original file name%.exe:3564
   %original file name%.exe:3568
   %original file name%.exe:3240
   %original file name%.exe:2996
   %original file name%.exe:3244
   %original file name%.exe:1284
   %original file name%.exe:2416
   %original file name%.exe:2060
   %original file name%.exe:2904
   %original file name%.exe:3940
   %original file name%.exe:196
   %original file name%.exe:3944
   %original file name%.exe:1088
   %original file name%.exe:3276
   %original file name%.exe:2824
   %original file name%.exe:2820
   %original file name%.exe:2308
   %original file name%.exe:2988
   %original file name%.exe:4040
   %original file name%.exe:3576
   %original file name%.exe:2984
   %original file name%.exe:1524
   %original file name%.exe:2268
   %original file name%.exe:2804
   %original file name%.exe:4060
   %original file name%.exe:2604
   %original file name%.exe:3816
   %original file name%.exe:2608
   %original file name%.exe:2140
   %original file name%.exe:2284
   %original file name%.exe:3956
   %original file name%.exe:3740
   %original file name%.exe:244
   %original file name%.exe:2836
   %original file name%.exe:3316
   %original file name%.exe:4056
   %original file name%.exe:2272
   %original file name%.exe:3012
   %original file name%.exe:2572
   %original file name%.exe:2372
   %original file name%.exe:3612
   %original file name%.exe:2456
   %original file name%.exe:3004
   %original file name%.exe:1908
   %original file name%.exe:1900
   %original file name%.exe:3216
   %original file name%.exe:2052
   %original file name%.exe:3364
   %original file name%.exe:3360
   %original file name%.exe:3696
   %original file name%.exe:1736
   %original file name%.exe:2684
   %original file name%.exe:2112
   %original file name%.exe:3896
   %original file name%.exe:2116
   %original file name%.exe:2620
   %original file name%.exe:2400
   %original file name%.exe:636
   %original file name%.exe:1644
   %original file name%.exe:2420
   %original file name%.exe:3908
   %original file name%.exe:3872
   %original file name%.exe:3288
   %original file name%.exe:3172
   %original file name%.exe:2952
   %original file name%.exe:3228
   %original file name%.exe:3880
   %original file name%.exe:3200
   %original file name%.exe:2680
   %original file name%.exe:2896
   %original file name%.exe:3440
   %original file name%.exe:2108
   %original file name%.exe:1748
   %original file name%.exe:2100
   %original file name%.exe:3868
   %original file name%.exe:4084
   %original file name%.exe:2432
   %original file name%.exe:3632
   %original file name%.exe:2436
   %original file name%.exe:3112
   %original file name%.exe:2948
   %original file name%.exe:3736
   %original file name%.exe:236
   %original file name%.exe:2944
   %original file name%.exe:3732
   %original file name%.exe:3068
   %original file name%.exe:2624
   %original file name%.exe:2224
   %original file name%.exe:2744
   %original file name%.exe:324
   %original file name%.exe:3976
   %original file name%.exe:2504
   %original file name%.exe:2876
   %original file name%.exe:2720
   %original file name%.exe:2644
   %original file name%.exe:1896
   %original file name%.exe:2540
   %original file name%.exe:2932
   %original file name%.exe:3056
   %original file name%.exe:1884
   %original file name%.exe:3544
   %original file name%.exe:2120
   %original file name%.exe:2124
   %original file name%.exe:2336
   %original file name%.exe:2128
   %original file name%.exe:3788
   %original file name%.exe:3420
   %original file name%.exe:3220
   %original file name%.exe:2084
   %original file name%.exe:808
   %original file name%.exe:3988
   %original file name%.exe:2532
   %original file name%.exe:1572
   %original file name%.exe:2008
   cscript.exe:212
   cscript.exe:3924
   cscript.exe:4036
   cscript.exe:3492
   cscript.exe:3412
   cscript.exe:3328
   cscript.exe:3044
   cscript.exe:492
   cscript.exe:2488
   cscript.exe:3796
   cscript.exe:2528
   cscript.exe:1944
   cscript.exe:2248
   cscript.exe:2752
   cscript.exe:348
   cscript.exe:1096
   cscript.exe:1260
   cscript.exe:2916
   cscript.exe:1792
   cscript.exe:1796
   cscript.exe:3932
   cscript.exe:3336
   cscript.exe:3132
   cscript.exe:3564
   cscript.exe:2312
   cscript.exe:2996
   cscript.exe:2396
   cscript.exe:2412
   cscript.exe:2392
   cscript.exe:532
   cscript.exe:2792
   cscript.exe:3848
   cscript.exe:2796
   cscript.exe:2148
   cscript.exe:3820
   cscript.exe:3144
   cscript.exe:1928
   cscript.exe:3164
   cscript.exe:3300
   cscript.exe:2068
   cscript.exe:2540
   cscript.exe:1852
   cscript.exe:3024
   cscript.exe:4048
   cscript.exe:2388
   cscript.exe:2076
   cscript.exe:2668
   cscript.exe:3580
   cscript.exe:2444
   cscript.exe:2936
   cscript.exe:3956
   cscript.exe:3740
   cscript.exe:444
   cscript.exe:3836
   cscript.exe:3264
   cscript.exe:3268
   cscript.exe:2764
   cscript.exe:3316
   cscript.exe:1648
   cscript.exe:3468
   cscript.exe:3092
   cscript.exe:3364
   cscript.exe:436
   cscript.exe:3156
   cscript.exe:2616
   cscript.exe:3612
   cscript.exe:1224
   cscript.exe:2592
   cscript.exe:2920
   cscript.exe:336
   cscript.exe:2452
   cscript.exe:1908
   cscript.exe:2836
   cscript.exe:1904
   cscript.exe:3292
   cscript.exe:2880
   cscript.exe:2204
   cscript.exe:3212
   cscript.exe:2208
   cscript.exe:3516
   cscript.exe:3696
   cscript.exe:3088
   cscript.exe:2368
   cscript.exe:2680
   cscript.exe:500
   cscript.exe:2360
   cscript.exe:2620
   cscript.exe:2584
   cscript.exe:2812
   cscript.exe:564
   cscript.exe:3876
   cscript.exe:2264
   cscript.exe:2180
   cscript.exe:3728
   cscript.exe:3284
   cscript.exe:3528
   cscript.exe:220
   cscript.exe:1992
   cscript.exe:3200
   cscript.exe:3896
   cscript.exe:3372
   cscript.exe:2108
   cscript.exe:1748
   cscript.exe:3960
   cscript.exe:2356
   cscript.exe:944
   cscript.exe:3628
   cscript.exe:2868
   cscript.exe:2436
   cscript.exe:3672
   cscript.exe:3732
   cscript.exe:3232
   cscript.exe:2132
   cscript.exe:4000
   cscript.exe:3340
   cscript.exe:320
   cscript.exe:324
   cscript.exe:1560
   cscript.exe:2500
   cscript.exe:2648
   cscript.exe:2136
   cscript.exe:2872
   cscript.exe:140
   cscript.exe:1712
   cscript.exe:2644
   cscript.exe:3624
   cscript.exe:1760
   cscript.exe:3544
   cscript.exe:1284
   cscript.exe:4012
   cscript.exe:3788
   cscript.exe:3220
   cscript.exe:2084
   cscript.exe:2236
   cscript.exe:2008
   

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe (2321 bytes)
   %Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe (7726 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe (2321 bytes)
   C:\totalcmd\TOTALCMD.EXE.exe (30812 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe (2321 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe (2321 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe (2321 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe (2321 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe (2321 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe (2321 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe (2321 bytes)
   C:\totalcmd\TCMADMIN.EXE.exe (3073 bytes)
   C:\totalcmd\TCUNINST.EXE.exe (3073 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe (2321 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe (2321 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe (2321 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe (2321 bytes)
   %Documents and Settings%\All Users\KAAo.txt (55978 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe (2321 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe (2321 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe (2321 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe (2321 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe (2321 bytes)
   %Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe (3073 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe (2321 bytes)
   %Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe (3361 bytes)
   C:\totalcmd\TCMDX32.EXE.exe (3361 bytes)
   %Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe (3073 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe (2321 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe (2321 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe (2321 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe (2321 bytes)
   %Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe (3361 bytes)
   C:\totalcmd\TcUsbRun.exe (3073 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Setup.exe (5441 bytes)
   %Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe (7433 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe (2321 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe (2321 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\aiEocAwI.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\eQkoIAAc.bat (112 bytes)
   C:\848164c177e47f296fbc53e1541421e5 (28502 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\VgQkkcoI.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\lqsQUcsY.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\pikcQQMA.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\cmEQQEcI.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GAggMkoQ.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\FgoQIcoY.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\MmMsckMM.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\CsEwoEkE.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nwEwwwoY.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\IckAwcIQ.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\wAMYkAMk.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\oyQAQYIY.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\fWQcsQAs.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nEsQEYgY.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\KucoUIsQ.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\wUQoQkAk.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\iKcsAIgM.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\eoEowAYs.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\hKQcUYkA.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\SWMoMkUU.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\oIokIAog.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\jeoUkwAM.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\uywsUYcs.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\JyEIQoUA.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\cCgQgQgk.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\NIwcMQkA.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\jqEUwosA.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\VmsYQAYM.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\TUAMoUoQ.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ziIIocos.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\JuMUwMMg.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\hSwoccEc.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zakAIoMA.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\sIgEQocg.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ocYYMsks.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\IkQcAEsQ.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\bgYwwoco.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\NiEkIYgs.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\XSQgAoog.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\bIUEcswU.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\OeYcwMkQ.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\BEcQQkUI.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\vasgQYko.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\jqMUMscU.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\uacYwwAk.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\gAgAQYAk.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\CsIwwUAk.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\lGMscgYA.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\XMAAUAoA.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\eeYsIMAM.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\NOkcEAYs.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\LAAwsEUk.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\JkoUgogw.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\iwwEcgAg.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\smgIUMUM.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ruIocEkk.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\pQQoEosI.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\CewYsEwk.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\BQEcEMUQ.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GAMsYckg.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\hOYMIkMY.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\jeYkAMYA.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\KisUEoss.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\YoMIwYgA.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\kMQwQgMg.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\hwgUAowk.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\KAEscAYE.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\DwUsIAkg.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\eysQMQIQ.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\dgEwksQk.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\EMEAswYo.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\DOMYwUEY.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\QgcMgEoQ.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\xMcgkYEs.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\SIogooYw.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\aEooIgIc.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\hWAEkEwE.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\lKoEwwcs.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\fQIsIkUA.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\WwUoEMws.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\eYswQEgI.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ogEAwwkQ.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\VkAUogAI.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ZKEAsswo.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GcEwQcwg.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\vuskIkYY.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\jcAggkEU.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\uQQcwgoo.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\bUAcgEkc.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\tGkAgckA.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zQskIIYE.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\DCkUEcMw.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\DcgIAsAQ.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\HAwsswYM.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ACcIwssA.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\QaYwIkgE.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\mcwgYoUs.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qQYIsEkQ.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\hysIUQsQ.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GQsYMUAw.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ESoQcAwc.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\pMwAUIgM.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\OyQcwgos.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\hIcQYAYE.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\gaIUUgQo.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\lQoEAMQs.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\UEAEsgYg.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\uQsEskMw.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\FsEYEYAg.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\SsYscMwQ.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\lIcwQQMQ.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zkcEwgcM.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ggAAwowo.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\LYcgMwEg.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\oawMMQcQ.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ueUcIIgM.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\MGwYAQIg.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\hOkYEQgs.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\WAQIUoss.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\UEkQsIUY.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\kGkQEQgQ.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\XekYYMoc.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\XUwAgksw.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GOMIwUgc.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\xAUEYMEw.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\AOMkwMok.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\sAAMQkQI.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\BSUUEoMM.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\AAcsgEIE.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\jOQYUMMw.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ZMwkccIU.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\WgkQUIYY.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\twgssMAo.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\juEcgkYI.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\UKgYEkAo.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ogckYMYo.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ycAwUccw.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\oyEskYsk.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\OoooEsIo.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\fqwccAcI.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\CswMUgAI.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\AyYsMccM.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\PmsUMcoI.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\FaUwwssA.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GwAwMQEE.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\OGoMgoYg.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\UGscoAkE.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\pEYAYMwI.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\eKYcIgUU.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\LSIAAsEI.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\QMAkQscE.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\jwYIgQcY.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GgwYkcgk.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\RgkkAIYA.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\swAMUIQM.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\TIkcoAQw.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\WcckwsoU.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\euoEswQg.bat (4 bytes)
   %Documents and Settings%\All Users\JuwEIgUE\reIEcoQI.exe (3921 bytes)
   %Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe (3849 bytes)
   %Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe (3969 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\iyUkwcks.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\bOcsMYAU.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\UKsYYYcI.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zsYsYMEE.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\RAcUMgEQ.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\gowQsEsw.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\MWkoAQMw.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\rQwgswMc.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\NIAogQEg.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nMgsMYoM.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\risAgAcQ.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ouoMocUQ.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\omcIkUgQ.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\asAAMckM.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\wOoEcgcI.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\WOcYMoMo.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\HEEIwYUM.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\LMQgEowg.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\HEQoAEUU.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\fSowosoo.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GSsQggMQ.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\pQwgwoEk.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\buokwUQc.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\tUMUYMsg.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\oMYAIUgo.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\emgYwUMs.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\AmIAgMAY.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nQkMQgYg.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\QOIIIEoQ.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\FAYEUgQA.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\gKsUoIQo.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\UyoIMMcI.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\gSYYQEwo.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ZGwUYUkY.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\geYwscUM.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\DskMQkYs.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GEgUwAsg.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\neMggkIU.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\UwcsIUMw.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ucYsAQsY.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\EUgkAIgU.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\xiMsIYgY.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\IskcYoEI.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\LkIQIIco.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\vswcUgAE.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\OOwYUQco.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\FkwUAQkc.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\RWggUwEM.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\yoYgEIsE.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\PGwMgYMU.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zWMksgYY.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\WYMccscw.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\QIMwcAcY.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\sSsAUwcw.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\LSAAQUkA.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\OUsMokYI.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\RcAoMEEc.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\KKYYgAoA.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\SYwEIYQs.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\uegUAEAg.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\JIwcMQso.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\DokkIYMY.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\OOYMQwEU.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\yOkIQwUU.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\yiwkEook.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\dMUYgIws.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\FswAkUEg.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\UGssMoQk.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\pcgQMwcs.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\CqAsgksk.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\XSgokYAA.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\AaAEYwoo.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\tUUIswgw.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\TIUUEkos.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\pAQMogko.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\VCAwAUIA.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\vkcMgkUs.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GqwEAUsk.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\fOMEkIMs.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\UGAkwoAM.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\iAMgsMsk.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\FowwYYEc.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\PoQIUcoY.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\FuMQUIQM.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\jeMQQAww.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ZQwooUsA.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\TycMoQMI.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zuIYEAUo.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\wkwIoccs.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\CMYIsQcQ.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\bKggogYo.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\FEckMUIA.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\bCscEcco.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\YOgIkcso.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zCoQQoYU.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ZaUsQUAg.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\CQoYcIkg.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\bewEAIws.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zYIMIocM.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\lWokYEYs.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\sEcwMoMU.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\WWIAUwwY.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GMYAoIwg.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\gscQkwEI.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\lSEYEwAw.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\EuYUscgo.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ogMkQcwU.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\OsEoQkMM.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\LqsMscIk.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\uWcAQMcY.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\SyEokYUI.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\bicggMMM.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\FIgYoUMg.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\emEgkwkY.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\KaYEgUIk.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\eCMksUcg.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nSAgEEkw.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\cyQMcIsY.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nwYsoooc.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\MEUAocoU.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\MGoQQsoY.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\qwoEYcII.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\VKMoQAww.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\eyEowEgs.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\lcsswMcY.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\cQMEgUEY.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\YIIEgwgc.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\pQgMokIk.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\WAQQEsog.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\BqUUMwYg.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nkccgMIs.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\FkYcEsgY.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\WOEMgAwk.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\WusoEMkk.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\BwUQQksk.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\xswwooEg.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\XAAMEgYU.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\uMAUAoYk.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nuUgUIcM.bat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\YsEMgcoY.bat (112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\FwoAUQUs.bat (4 bytes)
   

4. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "fGAwoYMM.exe" = "%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe"
   
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "NesIMIQs.exe" = "%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe"
   
   

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	4657152	4653568	5.54387	21158250707d838cf620dec3807d2eee
.rdata	4661248	4096	512	2.1059	a149f5c4002acb5ad92c8cda446c9dab
.data	4665344	224	512	2.90026	a5495de87a3bfe0fd7949329856fb52f
.rsrc	4669440	4444	4608	3.14966	f445af5f22e1b09abbde0ea89c8a92cc

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://google.com/	173.194.113.194

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET / HTTP/1.1

Host: google.com

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=o5-5VI6lL4qu8weGxIKoDA

Content-Length: 262

Date: Fri, 16 Jan 2015 23:32:51 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0.02

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=o5-5VI6lL4qu8weGxIKoDA">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=o5-5VI6lL4qu8weGxIKoDA..Content-Length: 262..Date: Fri, 16 Jan 2015 23:32:51 GMT..Server: GFE/2.0..Alternate-Protocol: 80:quic,p=0.02..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=o5-5VI6lL4qu8weGxIKoDA">here</A>...</BODY></HTML>....

GET / HTTP/1.1

Host: google.com

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=8Z-5VOOZBZGu8wfO3ILACQ

Content-Length: 262

Date: Fri, 16 Jan 2015 23:34:09 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0.02

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=8Z-5VOOZBZGu8wfO3ILACQ">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=8Z-5VOOZBZGu8wfO3ILACQ..Content-Length: 262..Date: Fri, 16 Jan 2015 23:34:09 GMT..Server: GFE/2.0..Alternate-Protocol: 80:quic,p=0.02..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=8Z-5VOOZBZGu8wfO3ILACQ">here</A>...</BODY></HTML>....

GET / HTTP/1.1

Host: google.com

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=CaC5VITfLrSt8wetxoLgCQ

Content-Length: 262

Date: Fri, 16 Jan 2015 23:34:33 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0.02

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=CaC5VITfLrSt8wetxoLgCQ">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=CaC5VITfLrSt8wetxoLgCQ..Content-Length: 262..Date: Fri, 16 Jan 2015 23:34:33 GMT..Server: GFE/2.0..Alternate-Protocol: 80:quic,p=0.02..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=CaC5VITfLrSt8wetxoLgCQ">here</A>...</BODY></HTML>....

GET / HTTP/1.1

Host: google.com

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=pp-5VPqEMKyt8wfkuoDQBA

Content-Length: 262

Date: Fri, 16 Jan 2015 23:32:54 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0.02

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=pp-5VPqEMKyt8wfkuoDQBA">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=pp-5VPqEMKyt8wfkuoDQBA..Content-Length: 262..Date: Fri, 16 Jan 2015 23:32:54 GMT..Server: GFE/2.0..Alternate-Protocol: 80:quic,p=0.02..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=pp-5VPqEMKyt8wfkuoDQBA">here</A>...</BODY></HTML>....

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

fGAwoYMM.exe_1616:

.text

.text

`.rdata

`.rdata

@.data

@.data

3E.Pcq:P!V^

3E.Pcq:P!V^

#%Xkq.

#%Xkq.

.JF{

.JF{

U%Sa@

U%Sa@

('%D^q-*

('%D^q-*

?|Q%f

?|Q%f

SE?.rn~M*

SE?.rn~M*

.Dhe4

.Dhe4

E.IdJWH

E.IdJWH

%k%cn>x_

%k%cn>x_

?%uRc!

?%uRc!

%3.UGiO0

%3.UGiO0

]w.LQ

]w.LQ

I 4keyy

I 4keyy

L%C['

L%C['

7.BLP

7.BLP

>.Qlx #6

>.Qlx #6

Microsoft Windows

Microsoft Windows

1.nv-$.7G

1.nv-$.7G

M.if>

M.if>

VMEl%u

VMEl%u

ntdll.dll

ntdll.dll

GetProcessHeap

GetProcessHeap

kernel32.dll

kernel32.dll

user32.dll

user32.dll

fGAwoYMM.exe_1616_rwx_00401000_00069000:

3E.Pcq:P!V^

3E.Pcq:P!V^

#%Xkq.

#%Xkq.

.JF{

.JF{

U%Sa@

U%Sa@

('%D^q-*

('%D^q-*

?|Q%f

?|Q%f

SE?.rn~M*

SE?.rn~M*

.Dhe4

.Dhe4

E.IdJWH

E.IdJWH

%k%cn>x_

%k%cn>x_

?%uRc!

?%uRc!

%3.UGiO0

%3.UGiO0

]w.LQ

]w.LQ

I 4keyy

I 4keyy

L%C['

L%C['

7.BLP

7.BLP

>.Qlx #6

>.Qlx #6

Microsoft Windows

Microsoft Windows

1.nv-$.7G

1.nv-$.7G

M.if>

M.if>

VMEl%u

VMEl%u

fGAwoYMM.exe_1616_rwx_00900000_00068000:

3E.Pcq:P!V^

3E.Pcq:P!V^

#%Xkq.

#%Xkq.

.JF{

.JF{

U%Sa@

U%Sa@

('%D^q-*

('%D^q-*

?|Q%f

?|Q%f

SE?.rn~M*

SE?.rn~M*

.Dhe4

.Dhe4

E.IdJWH

E.IdJWH

%k%cn>x_

%k%cn>x_

?%uRc!

?%uRc!

%3.UGiO0

%3.UGiO0

]w.LQ

]w.LQ

I 4keyy

I 4keyy

L%C['

L%C['

7.BLP

7.BLP

;.StH

;.StH

>.Qlx #6

>.Qlx #6

$g.Gd

$g.Gd

P.yrBX.

P.yrBX.

PB]%C

PB]%C

%FoS(

%FoS(

F<.cs>

F<.cs>

fGAwoYMM.exe_1616_rwx_00980000_00001000:

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp

NesIMIQs.exe_1664:

.text

.text

`.rdata

`.rdata

@.data

@.data

3E.Pcq:P!V^

3E.Pcq:P!V^

#%Xkq.

#%Xkq.

.JF{

.JF{

U%Sa@

U%Sa@

('%D^q-*

('%D^q-*

?|Q%f

?|Q%f

SE?.rn~M*

SE?.rn~M*

.Dhe4

.Dhe4

E.IdJWH

E.IdJWH

%k%cn>x_

%k%cn>x_

?%uRc!

?%uRc!

%3.UGiO0

%3.UGiO0

]w.LQ

]w.LQ

I 4keyy

I 4keyy

L%C['

L%C['

7.BLP

7.BLP

;.StH

;.StH

>.Qlx #6

>.Qlx #6

Microsoft Windows

Microsoft Windows

P.yrBX.

P.yrBX.

PB]%C

PB]%C

%FoS(

%FoS(

F<.cs>

F<.cs>

ole32.dll

ole32.dll

ntdll.dll

ntdll.dll

user32.dll

user32.dll

kernel32.dll

kernel32.dll

fGAwoYMM.exe_1616_rwx_00BC0000_00001000:

%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM

%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM

fGAwoYMM.exe_1616_rwx_00BD0000_00001000:

%Documents and Settings%\All Users\hcYYccwo\NesIMIQs

%Documents and Settings%\All Users\hcYYccwo\NesIMIQs

fGAwoYMM.exe_1616_rwx_00BE0000_00001000:

%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.inf

%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.inf

fGAwoYMM.exe_1616_rwx_00BF0000_00001000:

%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.inf

%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.inf

fGAwoYMM.exe_1616_rwx_00C00000_00001000:

%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe

%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe

fGAwoYMM.exe_1616_rwx_00C10000_00001000:

%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe

%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe

reIEcoQI.exe_1276:

.text

.text

`.rdata

`.rdata

@.data

@.data

/.-,3210'&%$ *)(

/.-,3210'&%$ *)(

0/.-4321('&%, *)

0/.-4321('&%, *)

.ywW6

.ywW6

.uO_6

.uO_6

"$&(*,.0

"$&(*,.0

3E.Pcq:P!V^

3E.Pcq:P!V^

#%Xkq.

#%Xkq.

2468:@

2468:@

.JF{

.JF{

U%Sa@

U%Sa@

('%D^q-*

('%D^q-*

?|Q%f

?|Q%f

SE?.rn~M*

SE?.rn~M*

.Dhe4

.Dhe4

E.IdJWH

E.IdJWH

%k%cn>x_

%k%cn>x_

?%uRc!

?%uRc!

%3.UGiO0

%3.UGiO0

]w.LQ

]w.LQ

I 4keyy

I 4keyy

L%C['

L%C['

7.BLP

7.BLP

.bN$

.bN$

ok.dj-U

ok.dj-U

;.StH

;.StH

>.Qlx #6

>.Qlx #6

2software\microsoft\windows\currentversion\run

2software\microsoft\windows\currentversion\run

..yEjoe~51Ku58x(w9'vY2'

..yEjoe~51Ku58x(w9'vY2'

$~,1.\01.T80.MY

$~,1.\01.T80.MY

8..W,).bY

8..W,).bY

*.KN&s7

*.KN&s7

3={54/{-8

3={54/{-8

89l0>.MY

89l0>.MY

u>2%MY>'s;]8u:6.nY:.n128n;$%{48Kr-2%iY>$t78(nY4$y-18u:6.nY..t=]8

u>2%MY>'s;]8u:6.nY:.n128n;$%{48Kr-2%iY>$t78(nY4$y-18u:6.nY..t=]8

.KT

.KT

P.yrBX.

P.yrBX.

PB]%C

PB]%C

%FoS(

%FoS(

F<.cs>

F<.cs>

user32.dll

user32.dll

kernel32.dll

kernel32.dll

fGAwoYMM.exe_1616_rwx_00C40000_00001000:

fGAwoYMM.exe

fGAwoYMM.exe

fGAwoYMM.exe_1616_rwx_00C50000_00001000:

NesIMIQs.exe

NesIMIQs.exe

fGAwoYMM.exe_1616_rwx_00C60000_00001000:

taskkill /FI "USERNAME eq adm" /F /IM fGAwoYMM.exe

taskkill /FI "USERNAME eq adm" /F /IM fGAwoYMM.exe

fGAwoYMM.exe_1616_rwx_00C70000_00001000:

taskkill /FI "USERNAME eq adm" /F /IM NesIMIQs.exe

taskkill /FI "USERNAME eq adm" /F /IM NesIMIQs.exe

fGAwoYMM.exe_1616_rwx_00C80000_00001000:

%Documents and Settings%\All Users\JuwEIgUE\reIEcoQI.exe

%Documents and Settings%\All Users\JuwEIgUE\reIEcoQI.exe

fGAwoYMM.exe_1616_rwx_00C90000_00001000:

%Documents and Settings%\All Users\KAAo.txt

%Documents and Settings%\All Users\KAAo.txt

fGAwoYMM.exe_1616_rwx_00CA0000_00001000:

notepad.exe "%Documents and Settings%\All Users\KAAo.txt"

notepad.exe "%Documents and Settings%\All Users\KAAo.txt"

fGAwoYMM.exe_1616_rwx_00CB0000_00001000:

%Documents and Settings%\All Users\JuwEIgUE

%Documents and Settings%\All Users\JuwEIgUE

fGAwoYMM.exe_1616_rwx_01100000_02300000:

y.BJN

y.BJN

advapi32.dll

advapi32.dll

ntdll.dll

ntdll.dll

user32.dll

user32.dll

W.RxR

W.RxR

:C_^.NI

:C_^.NI

.TJN.

.TJN.

u?

u?

z.oSp

z.oSp

.DOdI

.DOdI

[$.kO

[$.kO

I-.fT

I-.fT

u.YA;

u.YA;

x.XU-

x.XU-

{[N%cVe

{[N%cVe

o[[v%c

o[[v%c

Z .HU

Z .HU

÷R"

÷R"

xK.yZ

xK.yZ

;.v%c

;.v%c

-.Cf7

-.Cf7

[cv%c

[cv%c

{Scv%c

{Scv%c

;H'%Cl/

;H'%Cl/

%X)}4\{

%X)}4\{

hze%d

hze%d

;;v%c

;;v%c

%U/Gs

%U/Gs

.qU0ft~^

.qU0ft~^

EM%D*

EM%D*

@{t!7K

o.IHE

@#.qE

nOv%c

.JMf[

u~

{S_v%c

%U_ap

%d=Bu

.MUq6

.MU16

DÕT

.HUW[

.DrKM

T{cRt

H{cRt

.Myk1>~

.Fr{E

.MzC2

T{cRtK

f0T{cRtK

.Kz{E

.lrSB

K{cRt

.iZ2Y

.GY_%

L%X&?

.nUWX

H{cRtK

.IjK]

.KR[>

.EU77

.EU16

.NM-&

-cM5}8{m

-c}5}

.KC=ea

.UaZ#w

I.az#

%Ua{b

%D,G!

Y%9xrk

6,.My

L.MxU

.az#W

fGAwoYMM.exe_1616_rwx_03900000_01E00000:

.text

`.rdata

@.data

.rsrc

@.reloc

u%Uh`

QSSSh

QVSSh

t.PSh

T$lRSSh| "

UDPQRh

L$ QSSh

L$,QSSh

QSSShlVU

RVSShlVU

t.Ph\

tGHt.Ht&

operand of unlimited repeat could match the empty string

POSIX named classes are supported only within a class

erroffset passed as NULL

POSIX collating elements are not supported

this version of PCRE is not compiled with PCRE_UTF8 support

PCRE does not support \L, \l, \N{name}, \U, or \u

support for \P, \p, and \X has not been compiled

this version of PCRE is not compiled with PCRE_UCP support

\N is not supported in a class

inflate 1.2.5 Copyright 1995-2010 Mark Adler

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

operator

GetProcessWindowStation

USER32.DLL

RtlRunOnceExecuteOnce

advapi32_hack::try_hack: bad PE passed

advapi32_hack::try_hack: cannot read import table

advapi32_hack::try_hack: cannot find section .text

.data

advapi32_hack::try_hack: cannot find section .data

advapi32_hack::try_hack: cannot read section .text

Cannot read module %s, error %d

Cannot read exports of %s, error %d

advapi32_hack::try_hack: cannot read exports, error %d

.apiset

Bad .apiset catalog - don`t fit in section

String in cat item %d not in section

Value in cat item %d not in section

Bad referred in cat item %d

Double mapped value in cat item %d not in section

Bad double referred in cat item %d

BaseSrvRegisterWowExec

BaseSrvGetProcessShutdownParam

BaseSrvSetProcessShutdownParam

basesrv.dll

Unknown size of BaseServerApiDispatchTable: %d

ServerDll[%d] %p

csrsrv.dll

CsrExecServerThread

ServerDll[%d]:

ApiDispatchTable: %p %s

ConnectRoutine: %p %s

DisconnectRoutine: %p %s

HardErrorRoutine: %p %s

AddProcessRoutine: %p %s

ShutdownProcessRoutine: %p %s

Cannot open dir %S, error %d

clean_old_drvs: error %d on deleting file %S

Cannot find resource %X

Cannot load resource %X

Resource %d has zero length

Cannot lock resource %X

Cannot unpack resource %X

Cannot create file %S, error %d

1.2.5

Decompress buffer %d bytes too small

DxDvpWaitForVideoPortSync

DxDvpUpdateVideoPort

DxDvpGetVideoPortConnectInfo

DxDvpGetVideoPortOutputFormats

DxDvpGetVideoPortLine

DxDvpGetVideoPortInputFormats

DxDvpGetVideoPortFlipStatus

DxDvpGetVideoPortField

DxDvpGetVideoPortBandwidth

DxDvpFlipVideoPort

DxDvpDestroyVideoPort

DxDvpCreateVideoPort

DxDvpCanCreateVideoPort

DxDdSetColorKey

Cannot read gaDxgFuncs handlers, readed %X bytes

.rdata

Cannot read DxgCoreInterface handlers, readed %X bytes

Unknown acpi table version: %X

SBP2PORT_Mask

STORMINIPORT_Mask

STORPORT_Mask

TCPIP6_Mask

WSOCKTRANSPORT_Mask

FCPORT_Mask

SOFTPCI_Mask

TCPIP_Mask

SCSIMINIPORT_Mask

SCSIPORT_Mask

Unknown KdComponentTableSize size %X

dump_kd_masks return %X bytes, error %d, ntstatus %X

dump_kd_masks return %X bytes, error %d

dump_kd_masks(%s) return %X bytes, error %d, ntstatus %X

dump_kd_masks(%s) return %X bytes, error %d

%-*s: %X

read_kopts_length(%s) return %X bytes, error %d, ntstatus %X

read_kopts_length(%s) return %X bytes, error %d

Cannot alloc %X bytes

Cannot realloc %X bytes for %s

read_kopts(%s) return %X bytes, error %d, ntstatus %X

read_kopts(%s) return %X bytes, error %d

%S (%s): %X

%S (%s):

dump_kopts(%s) return %X bytes, error %d, ntstatus %X

dump_kopts(%s) return %X bytes, error %d

MmSupportWriteWatch

KiPassiveWatchdogTimeout

ViImageExecutionOptions

DbgkErrorPortStartTimeout

DbgkErrorPortCommTimeout

MmDisablePagingExecutive

CmDefaultLanguageId

DbgkpMaxModuleMsgs

IoCountOperations

KeDelayExecutionThread

resolve_IoFreeIrp: bad addr of %s

get_interrupt_dispatch: cannot alloc %d bytes

Unknown kernel options: %S

PsGetProcessWin32WindowStation

KeIsExecutingDpc

bad addr of KeIsExecutingDpc

Bad pnp handler item %d (%d)

Cannot find %s

ks.sys: cannot get KoCreateInstance

ImportContext

ExportContext

SpChangeAccountPasswordFn

CallPackagePassthrough

%SystemRoot%\System32\

GetServiceAccountPassword

DPAPIPasswordChangeForGMSA

GetCredentialKey

INotifyPasswordChanged

%s PolicyChangeNotificationCallbacks

PolicyChangeNotificationCallback[%d]: %d items

[%d] %p %p %p %p %s

lsasrv_hack::try_hack: bad PE passed

lsasrv_hack::try_hack: cannot find section .data

lsasrv_hack::try_hack: cannot read section .data

lsasrv_hack::try_hack: bad section passed

lsasrv_hack::try_hack: cannot read exports, error %d

LsaICallPackagePassthrough

lsasrv.dll

VaultLogonSessionNotification: %p %s

Start of driver %S failed !

WSPJoinLeaf

MSAFD_WSPSendMsg

MSAFD_WSPRecvMsg

mswsock.dll

CheckProc: cannot open process PID %d, error %d, ntstatus %X

CheckProc: cannot open process PID %d, error %d

threaded_processes_checker exception occured, error %X

MyWindowsChecker: len %d, kernel name %s

Cannot get kernel name, error %d

Kill process %d

Check processes in %d threads

Cannot find process %d

Usage: %S [options]

-wmi - report about WMI entries

-uem - check for Unknown Executable Memory

-npo - dump RPC Named Pipes Owner

-rdata - check .rdata sections too

-rpc - report about RPC interfaces

DeriveKey

NotifyChangeKey

EnumKeys

IsAlgSupported

FreeKey

DeleteKey

FinalizeKey

SetKeyProperty

CreatePersistedKey

OpenKey

OpenPrivateKey

ImportKey

ImportMasterKey

GetKeyProperty

GenerateSessionKeys

GenerateMasterKey

ExportKey

CreateEphemeralKey

ComputeEapKeyBlock

ncrypt_hack::check_in_proc: cannot alloc %d bytes

GetKeyStorageInterface

Cannot load %s (copy of %s), error %d

Cannot load module %s, error %d

Cannot read module %s import table

NdisMRegisterMiniportDriver

resolve_minidrivers_list: bad addr of NdisMRegisterMiniportDriver

NdisMRegisterMiniport

resolve_minidrivers_list: cannot find NdisMRegisterMiniport

resolve_minidrivers_list: bad addr of NdisMRegisterMiniport

resolve_miniports_list: cannot find NdisIMInitializeDeviceInstanceEx

resolve_miniports_list: bad addr of NdisIMInitializeDeviceInstanceEx

OID_CO_TAPI_DONT_REPORT_DIGITS

OID_CO_TAPI_REPORT_DIGITS

OID_QOS_OPERATIONAL_PARAMETERS

OID_TCP_TASK_IPSEC_OFFLOAD_V2_ADD_SA_EX

OID_TCP_TASK_IPSEC_OFFLOAD_V2_UPDATE_SA

OID_TCP_TASK_IPSEC_OFFLOAD_V2_DELETE_SA

OID_TCP_TASK_IPSEC_OFFLOAD_V2_ADD_SA

OID_TCP_CONNECTION_OFFLOAD_PARAMETERS

OID_FFP_SUPPORT

OID_TCP_CONNECTION_OFFLOAD_HARDWARE_CAPABILITIES

OID_TCP_CONNECTION_OFFLOAD_CURRENT_CONFIG

OID_TCP_OFFLOAD_HARDWARE_CAPABILITIES

OID_TCP_OFFLOAD_PARAMETERS

OID_TCP_OFFLOAD_CURRENT_CONFIG

OID_TCP6_OFFLOAD_STATS

OID_TCP4_OFFLOAD_STATS

OID_TCP_TASK_IPSEC_DELETE_UDPESP_SA

OID_TCP_TASK_IPSEC_ADD_UDPESP_SA

OID_TCP_SAN_SUPPORT

OID_TCP_TASK_IPSEC_DELETE_SA

OID_TCP_TASK_IPSEC_ADD_SA

OID_TCP_TASK_OFFLOAD

OID_DOT11_SUPPORTED_DSSS_CHANNEL_LIST

OID_DOT11_SUPPORTED_OFDM_FREQUENCY_LIST

OID_DOT11_QOS_TX_QUEUES_SUPPORTED

OID_DOT11_AP_JOIN_REQUEST

OID_DOT11_HR_CCA_MODE_SUPPORTED

OID_DOT11_FREQUENCY_BANDS_SUPPORTED

OID_DOT11_SUPPORTED_DATA_RATES_VALUE

OID_DOT11_SUPPORTED_RX_ANTENNA

OID_DOT11_SUPPORTED_TX_ANTENNA

OID_DOT11_REG_DOMAINS_SUPPORT_VALUE

OID_DOT11_CCA_MODE_SUPPORTED

OID_DOT11_SUPPORTED_POWER_LEVELS

OID_DOT11_DIVERSITY_SUPPORT

OID_DOT11_SUPPORTED_PHY_TYPES

OID_DOT11_OPERATIONAL_RATE_SET

OID_DOT11_JOIN_REQUEST

OID_DOT11_CURRENT_OPERATION_MODE

OID_DOT11_OPERATION_MODE_CAPABILITY

OID_802_11_SUPPORTED_RATES

OID_802_11_NETWORK_TYPES_SUPPORTED

OID_802_11_REMOVE_KEY

OID_802_11_ADD_KEY

OID_IRDA_SUPPORTED_SPEEDS

OID_ATM_SUPPORTED_AAL_TYPES

OID_ATM_SUPPORTED_SERVICE_CATEGORY

OID_ATM_SUPPORTED_VC_RATES

OID_FDDI_PORT_ACTION

OID_FDDI_PORT_HARDWARE_PRESENT

OID_FDDI_PORT_LER_FLAG

OID_FDDI_PORT_PC_WITHHOLD

OID_FDDI_PORT_PCM_STATE

OID_FDDI_PORT_CONNNECT_STATE

OID_FDDI_PORT_LER_ALARM

OID_FDDI_PORT_LER_CUTOFF

OID_FDDI_PORT_LEM_CT

OID_FDDI_PORT_LEM_REJECT_CT

OID_FDDI_PORT_LER_ESTIMATE

OID_FDDI_PORT_LCT_FAIL_CT

OID_FDDI_PORT_EB_ERROR_CT

OID_FDDI_PORT_PC_LS

OID_FDDI_PORT_BS_FLAG

OID_FDDI_PORT_MAINT_LS

OID_FDDI_PORT_INDEX

OID_FDDI_PORT_CONNECTION_CAPABILITIES

OID_FDDI_PORT_PMD_CLASS

OID_FDDI_PORT_MAC_LOOP_TIME

OID_FDDI_PORT_AVAILABLE_PATHS

OID_FDDI_PORT_MAC_PLACEMENT

OID_FDDI_PORT_REQUESTED_PATHS

OID_FDDI_PORT_CURRENT_PATH

OID_FDDI_PORT_MAC_INDICATED

OID_FDDI_PORT_CONNECTION_POLICIES

OID_FDDI_PORT_NEIGHBOR_TYPE

OID_FDDI_PORT_MY_TYPE

OID_FDDI_MAC_DOWNSTREAM_PORT_TYPE

OID_FDDI_SMT_MSG_TIME_STAMP

OID_FDDI_SMT_BYPASS_PRESENT

OID_FDDI_SMT_MAC_INDEXES

OID_FDDI_SMT_PORT_INDEXES

OID_TCP_RSC_STATISTICS

OID_SWITCH_PORT_UPDATED

OID_GEN_OPERATIONAL_STATUS

OID_SWITCH_PORT_TEARDOWN

OID_SWITCH_PORT_FEATURE_STATUS_QUERY

OID_SWITCH_PORT_DELETE

OID_SWITCH_PORT_CREATE

OID_SWITCH_PORT_ARRAY

OID_SWITCH_PORT_PROPERTY_ENUM

OID_SWITCH_PORT_PROPERTY_DELETE

OID_SWITCH_PORT_PROPERTY_UPDATE

OID_SWITCH_PORT_PROPERTY_ADD

OID_NIC_SWITCH_DELETE_VPORT

OID_NIC_SWITCH_ENUM_VPORTS

OID_NIC_SWITCH_VPORT_PARAMETERS

OID_NIC_SWITCH_CREATE_VPORT

OID_GEN_MINIPORT_RESTART_ATTRIBUTES

OID_GEN_PORT_AUTHENTICATION_PARAMETERS

OID_GEN_PORT_STATE

OID_GEN_ENUMERATE_PORTS

OID_GEN_TRANSPORT_HEADER_OFFSET

OID_GEN_SUPPORTED_GUIDS

OID_GEN_MEDIA_SUPPORTED

OID_GEN_SUPPORTED_LIST

Cannot read gWfpGlobal, readed %X bytes

Cannot read Wfp callout count, readed %X bytes

Cannot read Wfp callouts, readed %X bytes

Cannot read WFP index functions, readed %X bytes

iphlpapi.dll

%SystemRoot%\System32\iphlpapi.dll

AllocateAndGetTcpExTableFromStack

AllocateAndGetUdpExTableFromStack

GetExtendedTcpTable

GetExtendedUdpTable

Failed to snapshot TCP endpoints, error %d

Failed to snapshot UDP endpoints, error %d

Cannot alloc %d bytes for UDP extended table

Cannot alloc %d bytes for TCP extended table

ntdll_hack::try_hack: bad PE passed

ntdll_hack::try_hack: cannot find section .text

ntdll_hack::try_hack: cannot read section .text

ntdll_hack::try_hack: bad section passed

ntdll_hack::try_hack: cannot read exports, error %d

%s channel hooks:

ChannelHook[%d]: %p (%p - %s) %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X

ChannelHook[%d]: %p (%p) %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X

MallocSpy: %p vtbl %p - %s

webclient

msiexec32

msiexec

tftp

ftp32

cmd32

ccmexec32

ccmexec

chrome

opera

firefox

Process PID %d raise dwwin PID %d

Cannot alloc new process PID %d %S

Cannot open svchost process PID %d, error %d

proc_list::read: CreateToolhelp32Snapshot failed with error %d

PID %d Parent PID %d service {%S} %S

PID %d Parent PID %d %S

PID %d Parent PID %d kind {%S} %S

read_service_exe_name(%S): cannot expand string %S

ExWindowStationOpenProcedureCallout

ExWindowStationParseProcedureCallout

ExWindowStationDeleteProcedureCallout

ExWindowStationCloseProcedureCallout

ExWindowStationOkToCloseProcedureCallout

read_w8_callout failed, len %d, returned %d bytes, error %d, ntstatus %X

read_w8_callout failed, len %d, returned %d bytes, error %d

PsWin32CallBack: %p %p %s

check_callouts: cannot alloc %X bytes (size %d)

check_callouts failed, error %d, status %X

check_callouts failed, error %d

Callouts (%d):

%s: %p %s

ark_check_callbacks: cannot read size of callbacks list, error %d, ntstatus %X

ark_check_callbacks: cannot read size of callbacks list, error %d

ark_check_callbacks: cannot read %d bytes (readed %d), error %d, ntstatus %X

ark_check_callbacks: cannot read %d bytes (readed %d), error %d

CB: %S, total %X:

%p (%s)

check_shutdown_callbacks: cannot read size of callbacks list, error %d, ntstatus %X

check_shutdown_callbacks: cannot read size of callbacks list, error %d

check_shutdown_callbacks: cannot read callbacks list of %s, error %d, ntstatus %X

check_shutdown_callbacks: cannot read callbacks list of %s, error %d

%s - %d:

FastIoUnlockAllByKey

MJ_CREATE_NAMED_PIPE

%s!%s.%s patched by %s, addr %p

%s!%s[%d] patched by %s, addr %p

Cannot open driver dumpfile %s, error %d

Cannot open kernel dumpfile %s, error %d

Cannot read driver %s, error %d

hal.dll

Shadow SDT: %p, limit %X

win32k.sys

Cannot relocate section %s.%s

Cannot alloc %X bytes for reading driver section %s.%s

Driver %s!%s has %X patched bytes !

.orig

.kmem

Cannot read driver section %s.%s (flags %X) at %p size %X readed %X, error %d, ntstatus %X

Cannot read driver section %s.%s (flags %X) at %p size %X readed %X, error %d

Cannot read kernel %s, error %d

ntoskrnl.exe

Cannot alloc %X bytes for reading kernel sections

Cannot relocate section %s

KernelSection %s rva %X, size %X, 0x%X relocs has 0x%X patched bytes !

Cannot read (whole) section %s (flags %X) at %p size %X (readed %X), error %d

\SystemRoot\system32\hal.dll

\SystemRoot\system32\halapic.dll

\SystemRoot\system32\halmps.dll

\SystemRoot\system32\halacpi.dll

\SystemRoot\system32\halaacpi.dll

\SystemRoot\system32\halmacpi.dll

%SystemRoot%\System32\hal.dll

halapic.dll

halmps.dll

halacpi.dll

halaacpi.dll

halmacpi.dll

Driver %S DrvObj %p:

DriverUnload patched by %s, addr %p

DriverStartIo patched by %s, addr %p

AddDevice patched by %s, addr %p

Handler %s patched by %s, addr %p

Handler %s patched, addr %p

Handler %d patched by %s, addr %p

Handler %d patched, addr %p

FastIOHandler %s patched by %s, addr %p

FastIOHandler %s patched, addr %p

FastIOHandler %d patched by %s, addr %p

FastIOHandler %d patched, addr %p

FS_FILTER_CALLBACKS %s patched by %s, addr %p

FS_FILTER_CALLBACKS %s patched, addr %p

FS_FILTER_CALLBACKS %d patched by %s, addr %p

FS_FILTER_CALLBACKS %d patched, addr %p

StartIo patched by %s, addr %p

read_fsmjxxx(%S): cannot make full driver name

read_fsmjxxx(%S) failed, error %d, ntstatus %X

read_fsmjxxx(%S) failed, error %d

read_mjxxx(%s): cannot make full driver name

read_mjxxx(%S) failed, error %d, ntstatus %X

read_mjxxx(%S) failed, error %d

Cannot alloc %X bytes for driver %s EAT checking

read_driver_eat %s failed, error %d, status %X

read_driver_eat %s failed, error %d

Export addr %s.%s patched by %s !

Export addr %s.%s patched !

Export addr %s.%d patched by %s !

Export addr %s.%d patched!

\hal.dll

\SystemRoot\system32\drivers\ndis.sys

ndis.sys

drivers\ndis.sys

\SystemRoot\system32\DRIVERS\tdi.sys

tdi.sys

drivers\tdi.sys

\SystemRoot\system32\DRIVERS\tcpip.sys

tcpip.sys

drivers\tcpip.sys

\SystemRoot\system32\DRIVERS\netio.sys

netio.sys

drivers\netio.sys

\SystemRoot\system32\DRIVERS\fltmgr.sys

fltmgr.sys

drivers\fltmgr.sys

\SystemRoot\system32\DRIVERS\ks.sys

ks.sys

drivers\ks.sys

\SystemRoot\system32\DRIVERS\dxg.sys

drivers\dxg.sys

\SystemRoot\system32\DRIVERS\dxgkrnl.sys

drivers\dxgkrnl.sys

\SystemRoot\system32\DRIVERS\watchdog.sys

drivers\watchdog.sys

\SystemRoot\system32\DRIVERS\ksecdd.sys

ksecdd.sys

drivers\ksecdd.sys

\SystemRoot\System32\Drivers\Ntfs.sys

ntfs.sys

\SystemRoot\system32\CLFS.SYS

CLFS.SYS

\SystemRoot\system32\drivers\ataport.sys

ataport.sys

\SystemRoot\system32\drivers\atapi.sys

atapi.sys

\SystemRoot\system32\drivers\peauth.sys

peauth.sys

\SystemRoot\system32\drivers\WDFLDR.sys

WDFLDR.sys

\SystemRoot\system32\drivers\usbstor.sys

usbstor.sys

\SystemRoot\system32\drivers\usbd.sys

usbd.sys

\SystemRoot\system32\drivers\USBPORT.sys

USBPORT.sys

\SystemRoot\system32\drivers\usbohci.sys

usbohci.sys

\SystemRoot\system32\drivers\usbehci.sys

usbehci.sys

\SystemRoot\system32\drivers\usbhub.sys

usbhub.sys

\SystemRoot\system32\drivers\usbccgp.sys

usbccgp.sys

\SystemRoot\system32\drivers\discache.sys

discache.sys

\SystemRoot\system32\drivers\termdd.sys

termdd.sys

\SystemRoot\system32\drivers\rdppr.sys

rdppr.sys

\SystemRoot\system32\drivers\mssmbios.sys

mssmbios.sys

\SystemRoot\system32\drivers\1394BUS.SYS

1394BUS.SYS

\SystemRoot\system32\drivers\BATTC.SYS

BATTC.SYS

\SystemRoot\system32\drivers\bthport.sys

bthport.sys

\SystemRoot\system32\drivers\drmk.sys

drmk.sys

\SystemRoot\system32\drivers\HIDPARSE.SYS

HIDPARSE.SYS

\SystemRoot\system32\drivers\HIDCLASS.SYS

HIDCLASS.SYS

\SystemRoot\system32\drivers\msiscsi.sys

msiscsi.sys

\SystemRoot\system32\drivers\PCIIDEX.SYS

PCIIDEX.SYS

\SystemRoot\system32\drivers\portcls.sys

portcls.sys

\SystemRoot\system32\drivers\smsmdm.sys

smsmdm.sys

\SystemRoot\system32\drivers\STREAM.SYS

STREAM.SYS

\SystemRoot\system32\drivers\vga.sys

vga.sys

\SystemRoot\system32\drivers\VIDEOPRT.SYS

VIDEOPRT.SYS

\SystemRoot\system32\drivers\vmstorfl.sys

vmstorfl.sys

\SystemRoot\system32\drivers\Dxapi.sys

Dxapi.sys

\SystemRoot\system32\drivers\dxgthk.sys

dxgthk.sys

\SystemRoot\system32\drivers\dxgmms1.sys

dxgmms1.sys

\SystemRoot\system32\drivers\spsys.sys

spsys.sys

\SystemRoot\system32\drivers\winhv.sys

winhv.sys

\SystemRoot\system32\drivers\HdAudio.sys

HdAudio.sys

\SystemRoot\System32\cdd.dll

cdd.dll

\SystemRoot\System32\ATMFD.DLL

ATMFD.DLL

\SystemRoot\System32\RDPDD.dll

RDPDD.dll

\SystemRoot\system32\drivers\vwifibus.sys

vwifibus.sys

\SystemRoot\system32\drivers\nwifi.sys

nwifi.sys

\SystemRoot\system32\drivers\vwififlt.sys

vwififlt.sys

\SystemRoot\system32\drivers\wfplwf.sys

wfplwf.sys

\SystemRoot\system32\drivers\wfplwfs.sys

wfplwfs.sys

\SystemRoot\system32\drivers\tmtdi.sys

tmtdi.sys

\SystemRoot\system32\drivers\netvsc60.sys

netvsc60.sys

\SystemRoot\system32\drivers\mslldp.sys

mslldp.sys

\SystemRoot\system32\drivers\netvsc63.sys

netvsc63.sys

\SystemRoot\system32\drivers\ndiscap.sys

ndiscap.sys

\SystemRoot\system32\drivers\agilevpn.sys

agilevpn.sys

\SystemRoot\system32\drivers\asyncmac.sys

asyncmac.sys

\SystemRoot\system32\drivers\mpsdrv.sys

mpsdrv.sys

\SystemRoot\system32\drivers\rspndr.sys

rspndr.sys

\SystemRoot\system32\drivers\ndisuio.sys

ndisuio.sys

\SystemRoot\system32\drivers\lltdio.sys

lltdio.sys

\SystemRoot\system32\drivers\NDProxy.sys

NDProxy.sys

\SystemRoot\system32\drivers\raspppoe.sys

raspppoe.sys

\SystemRoot\system32\drivers\ndiswan.sys

ndiswan.sys

\SystemRoot\system32\drivers\wanarp.sys

wanarp.sys

\SystemRoot\system32\drivers\bthpan.sys

bthpan.sys

\SystemRoot\system32\drivers\rassstp.sys

rassstp.sys

\SystemRoot\system32\drivers\raspptp.sys

raspptp.sys

\SystemRoot\system32\drivers\rasl2tp.sys

rasl2tp.sys

\SystemRoot\system32\drivers\rasacd.sys

rasacd.sys

\SystemRoot\system32\drivers\tunnel.sys

tunnel.sys

\SystemRoot\system32\drivers\tunmp.sys

tunmp.sys

\SystemRoot\system32\drivers\pacer.sys

pacer.sys

\SystemRoot\system32\drivers\NDISTAPI.SYS

NDISTAPI.SYS

\SystemRoot\system32\drivers\msgpc.sys

msgpc.sys

\SystemRoot\system32\drivers\partmgr.sys

partmgr.sys

\SystemRoot\system32\drivers\volmgr.sys

volmgr.sys

\SystemRoot\system32\drivers\volmgrx.sys

volmgrx.sys

\SystemRoot\system32\drivers\mountmgr.sys

mountmgr.sys

\SystemRoot\system32\drivers\iaStor.sys

iaStor.sys

\SystemRoot\system32\drivers\volsnap.sys

volsnap.sys

\SystemRoot\system32\drivers\ACPI.sys

acpi.sys

\SystemRoot\System32\Drivers\WppRecorder.sys

WppRecorder.sys

\SystemRoot\System32\Drivers\Mouclass.sys

Mouclass.sys

\SystemRoot\System32\Drivers\kbdclass.sys

kbdclass.sys

\SystemRoot\System32\Drivers\Fastfat.SYS

Fastfat.sys

\SystemRoot\System32\Drivers\bowser.sys

bowser.sys

\SystemRoot\System32\Drivers\rdbss.sys

rdbss.sys

\SystemRoot\System32\Drivers\msfs.sys

msfs.sys

\SystemRoot\System32\Drivers\NetBIOS.sys

NetBIOS.sys

\SystemRoot\System32\Drivers\mup.sys

mup.sys

\SystemRoot\System32\Drivers\dfs.sys

dfs.sys

\SystemRoot\System32\Drivers\dfsc.sys

dfsc.sys

\SystemRoot\System32\Drivers\npfs.SYS

npfs.sys

\SystemRoot\System32\Drivers\luafv.SYS

luafv.sys

\SystemRoot\System32\Drivers\MRxSmb.SYS

MRxSmb.sys

\SystemRoot\System32\Drivers\MRxSmb10.SYS

MRxSmb10.sys

\SystemRoot\System32\Drivers\MRxSmb20.SYS

MRxSmb20.sys

\SystemRoot\System32\Drivers\MRxDAV.SYS

MRxDAV.sys

\SystemRoot\system32\Drivers\fltmgr.sys

\SystemRoot\system32\Drivers\TDI.SYS

\SystemRoot\system32\Drivers\tdx.sys

\SystemRoot\system32\Drivers\ipfltdrv.sys

\SystemRoot\system32\Drivers\tcpip.sys

\SystemRoot\System32\drivers\afd.sys

afd.sys

\SystemRoot\System32\drivers\netbt.sys

\SystemRoot\System32\drivers\NETIO.sys

\SystemRoot\System32\drivers\srv.sys

srv.sys

\SystemRoot\System32\drivers\srv2.sys

srv2.sys

\SystemRoot\System32\drivers\srvnet.sys

\SystemRoot\System32\drivers\sr.sys

sr.sys

\SystemRoot\System32\win32k.sys

\SystemRoot\System32\drivers\http.sys

http.sys

\SystemRoot\System32\drivers\fwpkclnt.sys

\SystemRoot\system32\DRIVERS\msrpc.sys

msrpc.sys

\SystemRoot\system32\DRIVERS\disk.sys

disk.sys

\SystemRoot\system32\DRIVERS\ftdisk.sys

ftdisk.sys

\SystemRoot\system32\DRIVERS\Storport.SYS

Storport.SYS

\SystemRoot\system32\DRIVERS\CLASSPNP.SYS

CLASSPNP.SYS

\SystemRoot\system32\Drivers\ks.sys

\SystemRoot\System32\Drivers\ksecdd.sys

ksecdd.SYS

\SystemRoot\system32\kdcom.dll

kdcom.dll

\SystemRoot\System32\Drivers\cng.sys

cng.sys

\SystemRoot\system32\PSHED.dll

PSHED.dll

\SystemRoot\system32\CI.dll

CI.dll

\SystemRoot\system32\DRIVERS\WMILIB.SYS

wmilib.sys

Cannot find %s for IAT resolving of %s

Cannot alloc %X bytes for drivers IAT checking

Cannot find %s import %s.%s

Cannot find %s import %s.%d

IAT %s %s.%s patched, addr %p

IAT %s %s.%d patched, addr %p

IAT %s %s.%s patched by %s, addr %p

IAT %s %s.%d patched by %s, addr %p

%s has %d patched IAT entries (total %d)

reading of IAT %s failed, readed %X, actual IAT size %X, error %d

check_exts count failed, error %d, ntstatus %X

check_exts count failed, error %d

check_exts: cannot alloc %X bytes

check_exts failed, error %d, ntstatus %X

check_exts failed, error %d

Ext[%X]:

Handler1: %p %s

Handler2: %p %s

Handler3: %p %s

Table: %X items %p %s

Item[%X]: %p %s

IRP_MJ_CREATE_NAMED_PIPE

Unknown fltmgr: FrameList %X FilterSize %X cbn %X

Unknown fltmgr: FrameList %X FilterSize %X

FltMgr: index %d

FRAME[%d] %p

%s: %p

NormalizeNameComponent: %p %s

NormalizeContextCleanup: %p %s

PreOperation: %p %s

PostOperation: %p %s

check_ks: cannot read size of ks list, error %d, ntstatus %X

check_ks: cannot read size of ks list, error %d

ks count: %X

check_ks: cannot alloc %X bytes

check_ks: cannot read ks list, error %d, ntstatus %X

check_ks: cannot read ks list, error %d

ks[%d] %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X

ChangeAccountPassword

ImportSecurityContext

ExportSecurityContext

gKsecpBCryptExtension: %p %s

gKsecpSslExtension: %p %s

SecTable.%s patched %p %s

dxg.sys

dxgkrnl.sys

Win32kCallout: %p %s

SessionStartCallout: %p %s

KTIMER %p DPC %p DefRoutine %p %s

Cannot find KPRCB.DpcRoutineActive

Unknown KPRCB: DpcRoutineActive %X WorkerRoutine %X

Unknown KPRCB: DpcRoutineActive %X

Processor %d:

KTIMERS[%d]: %X

Patched %s   %X by %s

Patched ord.%d   %X by %s

Patched %s   %X

Patched ord.%d   %X

Patched %s by %s

Patched ord.%d by %s

Patched %s

Patched ord.%d

Exception %X occured during EAT checking of %s

check_module_iat(%s) - cannot find exports for %s

check_module_iat(%s): zeroed ImportLookUp, cannot check import

Cannot find ordinal %X in module %s (%s) in import table of %s

Cannot find symbol %s in module %s (%s) in import table of %s

(%s) %s.%s hooked in %s: my IAT %p, must be %p

(%s) %s.%d hooked in %s: my IAT %p, must be %p

apfn %s patched by %s, addr %p

apfn[%d] patched by %s, addr %p

apfn %s patched, addr %p

apfn[%d] patched, addr %p

%s%s!%s patched by %s, addr %p

%s%s![%d] patched by %s, addr %p

%s%s!%s patched, addr %p

%s%s![%d] patched, addr %p

LSA SP %s has %d patched functions in SECPKG_FUNCTION_TABLE:

PID %d: LSA SP %s has %d patched functions in SECPKG_USER_FUNCTION_TABLE:

PID %d: LSA SP %s has %d patched functions in CallPackageDispatch:

ole32 hooked by %s

Cannot relocate section %s!%s

Exception %X occured on checking %s!%s

Module %s!%s has %X patched bytes !

Exception %X occured on check_module_iat(%s)

MyModule: %p %s

%SystemRoot%\System32\ncrypt.dll

%SystemRoot%\System32\ntdsa.dll

%SystemRoot%\System32\kernelbase.dll

%SystemRoot%\System32\kernel32.dll

%SystemRoot%\System32\user32.dll

%SystemRoot%\System32\umpnpmgr.dll

%SystemRoot%\System32\combase.dll

%SystemRoot%\System32\ole32.dll

%SystemRoot%\System32\imm32.dll

%SystemRoot%\System32\rpcrt4.dll

%SystemRoot%\System32\mswsock.dll

%SystemRoot%\System32\advapi32.dll

%SystemRoot%\System32\cryptbase.dll

%SystemRoot%\System32\apisetschema.dll

read_ndis_oid_handlers failed, returned %d bytes, error %d, ntstatus %X

read_ndis_oid_handlers failed, returned %d bytes, error %d

[%X] %s: post %p %s

[%X] %s: pre %p %s

[%X] %s: pre %p (%s) post %p (%s)

[%X] %X: post %p %s

[%X] %X: pre %p %s

[%X] %X: pre %p (%s) post %p (%s)

read_tcp_off_handlers failed, returned %d bytes, error %d, ntstatus %X

read_tcp_off_handlers failed, returned %d bytes, error %d

TcpOfflineHandlers:

TcpOffloadEventIndicate: %p %s

TcpOffloadReceiveIndicate: %p %s

TcpOffloadSendComplete: %p %s

TcpOffloadReceiveComplete: %p %s

TcpOffloadDisconnectComplete: %p %s

TcpOffloadForwardComplete: %p %s

Cannot alloc %X bytes from reading filter block

read_ndis_filter_block: len %d, returned %d bytes, error %d, ntstatus %X

read_ndis_filter_block: len %d, returned %d bytes, error %d

check_ndis - reading of TDI callback failed, error %d, ntstatus %X

check_ndis - reading of TDI callback failed, error %d

check_ndis - reading of TDI PnP handler failed, error %d, ntstatus %X

check_ndis - reading of TDI PnP handler failed, error %d

TDI callback %p patched by %s

TDI PnP handler %p patched by %s

check_ndis - reading of providers count failed, error %d, ntstatus %X

check_ndis - reading of providers count failed, error %d

check_ndis: %d providers

check_ndis: cannot alloc %X bytes

Cannot store provider_block %p (%d)

check_ndis: stored %d provider_blocks

check_ndis - reading of interfaces count failed, error %d, ntstatus %X

check_ndis - reading of interfaces count failed, error %d

check_ndis: %d interfaces, size of miniport %X

Interface[%d]:

check_ndis - reading of protocols count failed, error %d, ntstatus %X

check_ndis - reading of protocols count failed, error %d

check_ndis: %d protocols, size of protocol %X

check_ndis: stored %d protocols

check_ndis - reading of minidrivers count failed, error %d, ntstatus %X

check_ndis - reading of minidrivers count failed, error %d

check_ndis: %d minidrivers, size of minidriver %X, sizeof(ndis50) %X, sizeof(ndis52) %X

Cannot store minidriver %d (%p)

Stored %d mini-drivers

check_ndis - reading of miniports count failed, error %d, ntstatus %X

check_ndis - reading of miniports count failed, error %d

check_ndis: %d miniports, size of miniport %X

check_ndis: read %d miniports, total %X

Miniport[%d] %p:

check_ndis: stored %d miniports, sizeof(miniport_block_w7) %X

check_ndis - reading of open_blocks count failed, error %d, ntstatus %X

check_ndis - reading of open_blocks count failed, error %d

check_ndis: %d open_blocks, size of open_block %X

check_ndis: read %d open_blocks, total %X

Open_Block[%d]:

Cannot store open_block %p (%d)

check_ndis: stored %d open_blocks

check_ndis - reading of filter_drivers count failed, error %d, ntstatus %X

check_ndis - reading of filter_drivers count failed, error %d

check_ndis: %d filter_drivers, size of open_block %X

check_ndis: read %d filter_drivers, total %X

FilterDriver[%d]:

check_ndis: stored %d filter_drivers, %d filter_blocks

Passive

read_punicode_string failed, len %d, returned %d bytes, error %d, ntstatus %X

read_punicode_string failed, len %d, returned %d bytes, error %d

Cannot read NDIS_MINIPORT_INTERRUPT %p

NDIS_MINIPORT_INTERRUPT:

MiniportIsr: %p %s

MiniportDpc: %p %s

Cannot read NDIS_MINIPORT_INTERRUPT_CHARACTERISTICS %p

NDIS_MINIPORT_INTERRUPT_CHARACTERISTICS:

InterruptHandler: %p %s

InterruptDpcHandler: %p %s

DisableInterruptHandler: %p %s

EnableInterruptHandler: %p %s

MessageInterruptHandler: %p %s

MessageInterruptDpcHandler: %p %s

DisableMessageInterruptHandler: %p %s

EnableMessageInterruptHandler: %p %s

MiniportIsr: %p %s

MiniportDpc: %p %s

MiniportMessageIsr: %p %s

MiniportMessageInterruptDpc: %p %s

MiniportIsr: %p %s

MiniportDpc: %p %s

MiniportEnableInterrupt: %p %s

MiniportDisableInterrupt: %p %s

MiniportMessageIsr: %p %s

MiniportMessageInterruptDpc: %p %s

MiniportDisableMessageInterrupt: %p %s

MiniportEnableMessageInterrupt: %p %s

NDIS Protocol[%d]: %S

MajorNdisVersion %d

MinorNdisVersion %d

Flags %X

OpenAdapterCompleteHandler: %p %s

CloseAdapterCompleteHandler: %p %s

SendCompleteHandler: %p %s

TransferDataCompleteHandler: %p %s

ResetCompleteHandler: %p %s

RequestCompleteHandler: %p %s

ReceiveHandler: %p %s

ReceiveCompleteHandler: %p %s

StatusHandler: %p %s

StatusCompleteHandler: %p %s

ReceivePacketHandler: %p %s

BindAdapterHandler: %p %s

UnbindAdapterHandler: %p %s

PnPEventHandler: %p %s

UnloadHandler: %p %s

CoSendCompleteHandler: %p %s

CoStatusHandler: %p %s

CoReceivePacketHandler: %p %s

CoAfRegisterNotifyHandler: %p %s

MajorNdisVersion %d

MinorNdisVersion %d

MajorDriverVersion %d

MinorDriverVersion %d

Flags %X

IsIPv4 %d

IsIPv6 %d

IsNdisTest6 %d

BindAdapterHandlerEx: %p %s

UnbindAdapterHandlerEx: %p %s

OpenAdapterCompleteHandlerEx: %p %s

CloseAdapterCompleteHandlerEx: %p %s

PnPEventHandler: %p %s

UnloadHandler: %p %s

UninstallHandler: %p %s

RequestCompleteHandler: %p %s

StatusHandler: %p %s

StatusCompleteHandler: %p %s

ReceiveNetBufferListsHandler: %p %s

SendNetBufferListsCompleteHandler: %p %s

CoStatusHandler: %p %s

CoAfRegisterNotifyHandler: %p %s

CoReceiveNetBufferListsHandler: %p %s

CoSendNetBufferListsCompleteHandler: %p %s

OpenAdapterCompleteHandler: %p %s

CloseAdapterCompleteHandler: %p %s

SendCompleteHandler: %p %s

TransferDataCompleteHandler: %p %s

ResetCompleteHandler: %p %s

ReceiveHandler: %p %s

ReceiveCompleteHandler: %p %s

ReceivePacketHandler: %p %s

BindAdapterHandler: %p %s

UnbindAdapterHandler: %p %s

CoSendCompleteHandler: %p %s

CoReceivePacketHandler: %p %s

OidRequestCompleteHandler: %p %s

InitiateOffloadCompleteHandler: %p %s

TerminateOffloadCompleteHandler: %p %s

UpdateOffloadCompleteHandler: %p %s

InvalidateOffloadCompleteHandler: %p %s

QueryOffloadCompleteHandler: %p %s

IndicateOffloadEventHandler: %p %s

TcpOffloadSendCompleteHandler: %p %s

TcpOffloadReceiveCompleteHandler: %p %s

TcpOffloadDisconnectCompleteHandler: %p %s

TcpOffloadForwardCompleteHandler: %p %s

TcpOffloadEventHandler: %p %s

TcpOffloadReceiveIndicateHandler: %p %s

Unknown NDIS Type %X and Size %X

DirectOidRequestCompleteHandler: %p %s

AllocateSharedMemoryHandler: %p %s

FreeSharedMemoryHandler: %p %s

Unknown ndis protocol size: %X

NDIS MiniDriver[%d] %p

MajorNdisVersion: %d

MinorNdisVersion: %d

CheckForHangHandler: %p %s

DisableInterruptHandler: %p %s

EnableInterruptHandler: %p %s

HaltHandler %p %s

HandleInterruptHandler: %p %s

InitializeHandler: %p %s

ISRHandler: %p %s

QueryInformationHandler: %p %s

ReconfigureHandler: %p %s

ResetHandler: %p %s

SendHandler: %p %s

SetInformationHandler: %p %s

TransferDataHandler: %p %s

ReturnPacketHandler: %p %s

SendPacketsHandler: %p %s

AllocateCompleteHandler: %p %s

CoCreateVcHandler: %p %s

CoDeleteVcHandler: %p %s

CoActivateVcHandler: %p %s

CoDeactivateVcHandler: %p %s

CoSendPacketsHandler: %p %s

CoRequestHandler: %p %s

CheckForHangHandler: %p %s

DisableInterruptHandler: %p %s

EnableInterruptHandler: %p %s

HaltHandler %p %s

HandleInterruptHandler: %p %s

InitializeHandler: %p %s

ISRHandler: %p %s

QueryInformationHandler: %p %s

ReconfigureHandler: %p %s

ResetHandler: %p %s

SendHandler: %p %s

SetInformationHandler: %p %s

TransferDataHandler: %p %s

ReturnPacketHandler: %p %s

SendPacketsHandler: %p %s

AllocateCompleteHandler: %p %s

CoCreateVcHandler: %p %s

CoDeleteVcHandler: %p %s

CoActivateVcHandler: %p %s

CoDeactivateVcHandler: %p %s

CoSendPacketsHandler: %p %s

CoRequestHandler: %p %s

CancelSendPacketsHandler: %p %s

PnPEventNotifyHandler: %p %s

AdapterShutdownHandler: %p %s

CheckForHangHandler: %p %s

DisableInterruptHandler: %p %s

EnableInterruptHandler: %p %s

HaltHandler %p %s

HandleInterruptHandler: %p %s

InitializeHandler: %p %s

ISRHandler: %p %s

QueryInformationHandler: %p %s

ReconfigureHandler: %p %s

ResetHandler: %p %s

SendHandler: %p %s

SetInformationHandler: %p %s

TransferDataHandler: %p %s

ReturnPacketHandler: %p %s

SendPacketsHandler: %p %s

AllocateCompleteHandler: %p %s

CoCreateVcHandler: %p %s

CoDeleteVcHandler: %p %s

CoActivateVcHandler: %p %s

CoDeactivateVcHandler: %p %s

CoSendPacketsHandler: %p %s

CoRequestHandler: %p %s

CancelSendPacketsHandler: %p %s

PnPEventNotifyHandler: %p %s

AdapterShutdownHandler: %p %s

ISRHandlerEx: %p %s

HandleInterruptHandlerEx: %p %s

InitiateOffloadHandler: %p %s

TerminateOffloadHandler: %p %s

UpdateOffloadHandler: %p %s

InvalidateOffloadHandler: %p %s

QueryOffloadHandler: %p %s

TcpOffloadSendHandler: %p %s

TcpOffloadReceiveHandler: %p %s

TcpOffloadDisconnectHandler: %p %s

TcpOffloadForwardHandler: %p %s

TcpOffloadReceiveReturnHandler: %p %s

ReturnPacketsHandlerEx: %p %s

RequestTimeoutDpcHandler: %p %s

MajorNdisVersion: %d

MinorNdisVersion: %d

MajorDriverVersion: %d

MinorDriverVersion: %d

Flags: %X

SetOptionsHandler: %p %s

InitializeHandlerEx: %p %s

HaltHandlerEx: %p %s

UnloadHandler: %p %s

PauseHandler: %p %s

RestartHandler: %p %s

OidRequestHandler: %p %s

SendNetBufferListsHandler: %p %s

ReturnNetBufferListsHandler: %p %s

CancelSendHandler: %p %s

CheckForHangHandlerEx: %p %s

ResetHandlerEx: %p %s

DevicePnPEventNotifyHandler: %p %s

ShutdownHandlerEx: %p %s

CancelOidRequestHandler: %p %s

DirectOidRequestHandler: %p %s

CancelDirectOidRequestHandler: %p %s

NDIS MiniPort[%d] %p

State: %s

MediaType: %s

AdapterType: %s

DefaultSendAuthorizationState: %s

DefaultRcvAuthorizationState: %s

DefaultPortSendAuthorizationState: %s

DefaultPortRcvAuthorizationState: %s

NextCancelSendNetBufferListsHandler: %p %s

PacketIndicateHandler: %p %s

SendCompleteHandler: %p %s

SendResourcesHandler: %p %s

ResetCompleteHandler: %p %s

DisableInterruptHandler: %p %s

EnableInterruptHandler: %p %s

SendPacketsHandler: %p %s

DeferredSendHandler: %p %s

EthRxIndicateHandler: %p %s

NextSendNetBufferListsHandler: %p %s

EthRxCompleteHandler: %p %s

SavedNextSendNetBufferListsHandler: %p %s

StatusHandler: %p %s

StatusCompleteHandler: %p %s

TDCompleteHandler: %p %s

QueryCompleteHandler: %p %s

SetCompleteHandler: %p %s

WanSendCompleteHandler: %p %s

WanRcvHandler: %p %s

WanRcvCompleteHandler: %p %s

SendNetBufferListsCompleteHandler: %p %s

WSendPacketsHandler: %p %s

NextSendPacketsHandler: %p %s

FinalSendPacketsHandler: %p %s

TopIndicateNetBufferListsHandler: %p %s

TopIndicateLoopbackNetBufferListsHandler: %p %s

Ndis5PacketIndicateHandler: %p %s

MiniportReturnPacketHandler: %p %s

SynchronousReturnPacketHandler: %p %s

TopNdis5PacketIndicateHandler: %p %s

AllocateSharedMemoryHandler: %p %s

FreeSharedMemoryHandler: %p %s

SetBusData: %p %s

GetBusData: %p %s

NoFilter.CancelSendHandler %p %s

NoFilter.SendNetBufferListsCompleteHandler %p %s

NoFilter.IndicateNetBufferListsHandler %p %s

NoFilter.SaveIndicateNetBufferListsHandler %p %s

NoFilter.ReturnNetBufferListsHandler %p %s

NoFilter.SendNetBufferListsHandler %p %s

Next.CancelSendHandler %p %s

Next.SendNetBufferListsCompleteHandler %p %s

Next.IndicateNetBufferListsHandler %p %s

Next.SaveIndicateNetBufferListsHandler %p %s

Next.ReturnNetBufferListsHandler %p %s

Next.SendNetBufferListsHandler %p %s

Name: %S

BaseName: %S

SymbolicLinkName: %S

NextCancelSendNetBufferListsHandler %p %s

TrRxIndicateHandler: %p %s

TrRxCompleteHandler: %p %s

IndicateNetBufferListsHandler: %p %s

NextReturnNetBufferLists: %p %s

SavedIndicateNetBufferListsHandler: %p %s

SavedPacketIndicateHandler: %p %s

ShutdownHandler: %p %s

NDIS MiniPort[%d] %S

BusType: %s

PacketIndicateHandler: %p %s

SendCompleteHandler: %p %s

SendResourcesHandler: %p %s

ResetCompleteHandler: %p %s

DeferredSendHandler: %p %s

EthRxIndicateHandler: %p %s

TrRxIndicateHandler: %p %s

FddiRxIndicateHandler: %p %s

EthRxCompleteHandler: %p %s

TrRxCompleteHandler: %p %s

FddiRxCompleteHandler: %p %s

StatusHandler: %p %s

StatusCompleteHandler: %p %s

TDCompleteHandler: %p %s

QueryCompleteHandler: %p %s

SetCompleteHandler: %p %s

WanSendCompleteHandler: %p %s

WanRcvHandler: %p %s

WanRcvCompleteHandler: %p %s

AdapterInstanceName: %S

OpenBlock [%d] %p

RootName: %S

BindName: %S

ProtocolMajorVersion: %X

NextSendHandler: %p %s

NextReturnNetBufferListsHandler: %p %s

SendHandler: %p %s

TransferDataHandler: %p %s

WanReceiveHandler: %p %s

SendPacketsHandler: %p %s

ResetHandler: %p %s

RequestHandler: %p %s

OidRequestHandler: %p %s

WSendHandler: %p %s

WTransferDataHandler: %p %s

WSendPacketsHandler: %p %s

CancelSendPacketsHandler: %p %s

ProtSendNetBufferListsComplete: %p %s

NextSendNetBufferListsComplete: %p %s

ReceiveNetBufferLists: %p %s

SavedSendNBLHandler: %p %s

SavedSendPacketsHandler: %p %s

SavedCancelSendPacketsHandler: %p %s

SavedSendHandler: %p %s

Ndis5WanSendHandler: %p %s

ProtSendCompleteHandler: %p %s

OidRequestCompleteHandler %p %s

OpenFlags: %X

DirectOidRequestHandler: %p %s

RootName: %S

BindName: %S

Flags: %X

SendHandler: %p %s

WanSendHandler: %p %s

TransferDataHandler: %p %s

WanReceiveHandler: %p %s

SendPacketsHandler: %p %s

ResetHandler: %p %s

RequestHandler: %p %s

WSendHandler: %p %s

WTransferDataHandler: %p %s

WSendPacketsHandler: %p %s

CancelSendPacketsHandler: %p %s

Flags %X

Mtu %X

PromiscuousMode %d

AccessType %s

DirectionType %s

ConnectionType %s

MediaType %s

MediaConnectState %s

AdminStatus %s

OperStatus %s

InterfaceGuid %s

NetworkGuid %s

ifIndex %X

ifDescr %S

ifAlias %S

FilterDriverCharacteristics[%d]:

FriendlyName: %S

UniqueName: %S

ServiceName: %S

SetOptionsHandler: %p %s

SetFilterModuleOptionsHandler: %p %s

AttachHandler: %p %s

DetachHandler: %p %s

RestartHandler: %p %s

PauseHandler: %p %s

SendNetBufferListsHandler: %p %s

SendNetBufferListsCompleteHandler: %p %s

CancelSendNetBufferListsHandler: %p %s

ReceiveNetBufferListsHandler: %p %s

ReturnNetBufferListsHandler: %p %s

OidRequestHandler: %p %s

OidRequestCompleteHandler: %p %s

CancelOidRequestHandler: %p %s

DevicePnPEventNotifyHandler: %p %s

NetPnPEventHandler: %p %s

StatusHandler: %p %s

DirectOidRequestHandler: %p %s

DirectOidRequestCompleteHandler: %p %s

CancelDirectOidRequestHandler: %p %s

InterfaceGuid: %s

FilterState: %s

NextSendNetBufferListsHandler: %p %s

NextSendNetBufferListsCompleteHandler: %p %s

NextIndicateReceiveNetBufferListsHandler: %p %s

NextReturnNetBufferListsHandler: %p %s

NextCancelSendNetBufferListsHandler: %p %s

SetFilterModuleOptionalHandlers: %p %s

OidRequestHandler: %p %s

OidRequestCompleteHandler: %p %s

CancelRequestHandler: %p %s

DevicePnPEventNotifyHandler: %p %s

NetPnPEventHandler: %p %s

StatusHandler: %p %s

FilterSendNetBufferListsHandler: %p %s

FilterIndicateReceiveNetBufferListsHandler: %p %s

FilterCancelSendNetBufferListsHandler: %p %s

InitiateOffloadCompleteHandler: %p %s

TerminateOffloadCompleteHandler: %p %s

UpdateOffloadCompleteHandler: %p %s

InvalidateOffloadCompleteHandler: %p %s

QueryOffloadCompleteHandler: %p %s

IndicateOffloadEventHandler: %p %s

TcpOffloadSendCompleteHandler: %p %s

TcpOffloadReceiveCompleteHandler: %p %s

TcpOffloadDisconnectCompleteHandler: %p %s

TcpOffloadForwardCompleteHandler: %p %s

TcpOffloadEventHandler: %p %s

TcpOffloadReceiveIndicateHandler: %p %s

InitiateOffloadHandler: %p %s

TerminateOffloadHandler: %p %s

UpdateOffloadHandler: %p %s

InvalidateOffloadHandler: %p %s

QueryOffloadHandler: %p %s

TcpOffloadReceiveReturnHandler: %p %s

DirectOidRequestHandler: %p %s

DirectOidRequestCompleteHandler: %p %s

CancelDirectOidRequestHandler: %p %s

TcpOffloadSendHandler: %p %s

TcpOffloadReceiveHandler: %p %s

TcpOffloadDisconnectHandler: %p %s

TcpOffloadForwardHandler: %p %s

Provider[%d]: %p

QueryObjectHandler: %p %s

SetObjectHandler: %p %s

FilterDriverBlock[%d]

InitiateOffloadHandler: %p %s

TerminateOffloadHandler: %p %s

UpdateOffloadHandler: %p %s

InvalidateOffloadHandler: %p %s

QueryOffloadHandler: %p %s

TcpOffloadReceiveReturnHandler: %p %s

TcpOffloadSendHandler: %p %s

TcpOffloadReceiveHandler: %p %s

TcpOffloadDisconnectHandler: %p %s

TcpOffloadForwardHandler: %p %s

ClCreateVcHandler: %p %s

ClDeleteVcHandler: %p %s

ClOidRequestHandler: %p %s

ClOidRequestCompleteHandler: %p %s

ClOpenAfCompleteHandlerEx: %p %s

ClCloseAfCompleteHandler: %p %s

ClRegisterSapCompleteHandler: %p %s

ClDeregisterSapCompleteHandler: %p %s

ClMakeCallCompleteHandler: %p %s

ClModifyCallQoSCompleteHandler: %p %s

ClCloseCallCompleteHandler: %p %s

ClAddPartyCompleteHandler: %p %s

ClDropPartyCompleteHandler: %p %s

ClIncomingCallHandler: %p %s

ClIncomingCallQoSChangeHandler: %p %s

ClIncomingCloseCallHandler: %p %s

ClIncomingDropPartyHandler: %p %s

ClCallConnectedHandler: %p %s

ClNotifyCloseAfHandler: %p %s

CmCreateVcHandler: %p %s

CmDeleteVcHandler: %p %s

CmOpenAfHandler: %p %s

CmCloseAfHandler: %p %s

CmRegisterSapHandler: %p %s

CmDeregisterSapHandler: %p %s

CmMakeCallHandler: %p %s

CmCloseCallHandler: %p %s

CmIncomingCallCompleteHandler: %p %s

CmAddPartyHandler: %p %s

CmDropPartyHandler: %p %s

CmActivateVcCompleteHandler: %p %s

CmDeactivateVcCompleteHandler: %p %s

CmModifyCallQoSHandler: %p %s

CmOidRequestHandler: %p %s

CmOidRequestCompleteHandler: %p %s

CmNotifyCloseAfCompleteHandler: %p %s

DriverVersion: %X

CoCreateVcHandler: %p %s

CoDeleteVcHandler: %p %s

CoActivateVcHandler: %p %s

CoDeactivateVcHandler: %p %s

CoSendNetBufferListsHandler: %p %s

CoRequestHandler: %p %s

CoOidRequestHandler: %p %s

InitiateOffloadHandler: %p %s

TerminateOffloadHandler: %p %s

UpdateOffloadHandler: %p %s

InvalidateOffloadHandler: %p %s

QueryOffloadHandler: %p %s

TcpOffloadSendHandler: %p %s

TcpOffloadReceiveHandler: %p %s

TcpOffloadDisconnectHandler: %p %s

TcpOffloadForwardHandler: %p %s

TcpOffloadReceiveReturnHandler: %p %s

AddDeviceHandler: %p %s

RemoveDeviceHandler: %p %s

FilterResourceRequirementsHandler: %p %s

StartDeviceHandler: %p %s

ServiceName: %S

CoCreateVcHandler: %p %s

CoDeleteVcHandler: %p %s

CoActivateVcHandler: %p %s

CoDeactivateVcHandler: %p %s

CoSendNetBufferListsHandler: %p %s

CoRequestHandler: %p %s

CoOidRequestHandler: %p %s

InitiateOffloadHandler: %p %s

TerminateOffloadHandler: %p %s

UpdateOffloadHandler: %p %s

InvalidateOffloadHandler: %p %s

QueryOffloadHandler: %p %s

TcpOffloadSendHandler: %p %s

TcpOffloadReceiveHandler: %p %s

TcpOffloadDisconnectHandler: %p %s

TcpOffloadForwardHandler: %p %s

TcpOffloadReceiveReturnHandler: %p %s

AddDeviceHandler: %p %s

RemoveDeviceHandler: %p %s

FilterResourceRequirementsHandler: %p %s

StartDeviceHandler: %p %s

OpenNDKAdapterHandler: %p %s

CloseNDKAdapterHandler: %p %s

IdleNotificationHandler: %p %s

CancelIdleNotificationHandler: %p %s

AllocateNetBufferListForwardingContextHandler: %p %s

FreeNetBufferListForwardingContextHandler: %p %s

AddNetBufferListDestinationHandler: %p %s

SetNetBufferListSourceHandler: %p %s

GrowNetBufferListDestinationsHandler: %p %s

GetNetBufferListDestinationsHandler: %p %s

UpdateNetBufferListDestinationsHandler: %p %s

CopyNetBufferListInfoHandler: %p %s

ReferenceSwitchNicHandler: %p %s

DereferenceSwitchNicHandler: %p %s

ReferenceSwitchPortHandler: %p %s

DereferenceSwitchPortHandler: %p %s

ReportFilteredNetBufferListsHandler: %p %s

ImageName: %S

SetNetBufferListSwitchContextHandler: %p %s

GetNetBufferListSwitchContextHandler: %p %s

netio legacy handler %p %s

read netio legacy handler failed, error %d, status %X

read netio legacy handler failed, error %d

%p %s

read netio WfpNblInfoDispTable failed, error %d, status %X

read netio WfpNblInfoDispTable failed, error %d

netio MacShim %p %s

WfpShim[%d] %p %s

Unknown WFP callout size %d

WFP callout[%d]:

ClassifyCallback: %p %s

NotifyCallback: %p %s

uFlowDeleteFunction: %p %s

Exception %X on sysptr seed reading at %p

Decode system scheme - %s

Decode scheme - %s

Cannot read my process cookie, error %X

Trace[%d] %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X (%p) %s

Trace[%d] %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X %p

SystemFunction%3.3d (%p) %s

PFNCLIENT.%s patched by %s (%p)

PFNCLIENT.%s patched %p

check_user32_pfnclient: exception %X occured

PFNCLIENTWORKER.%s patched by %s (%p)

PFNCLIENTWORKER.%s patched %p

ConsoleCtrlHandler[%d]: %s (%p)

ConsoleCtrlHandler[%d]: %p UNKNOWN

ConsoleCtrlHandler: %s (%p)

UnhandledExceptionFilter: %s (%p)

ShimModule: %s (%p)

RtlpStartThreadFunc: %s (%p)

RtlpExitThreadFunc: %s (%p)

RtlpUnhandledExceptionFilter: %s (%p)

RtlSecureMemoryCacheCallback: %s (%p)

TppLogpRoutine: %s (%p)

CsrServerApiRoutine: %s (%p)

LdrpManifestProberRoutine: %s (%p)

LdrpCreateActCtxLanguage: %s (%p)

LdrpReleaseActCtx: %s (%p)

LdrpAppCompatDllRedirectionCallbackFunction: %s (%p)

%s%s!%s patched by %s (addr %p)

%s%s.%d patched by %s (addr %p)

%s%s.%d patched, addr %p

PID %d trace callbacks: %d

Trace[%d] %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X %p %s

Process PID %d has the same token as system process: %p !!!

Process PID %d token: %p

%p %s %8X

%p %s %8X

CheckProc: cannot get modules list for PID %d (%S), error %d, ntstatus %X

CheckProc: cannot get modules list for PID %d (%S), error %d

CheckProcess PID %d (%S):

PEB.PostProcessInitRoutine: %p %s

PEB.PostProcessInitRoutine: %p UNKNOWN

PEB.pShimData: %p

PEB.AppCompat: %p

PEB.FastPebLockRoutine: %p %s

PEB.FastPebLockRoutine: %p UNKNOWN

PEB.FastPebUnlockRoutine: %p %s

PEB.FastPebUnlockRoutine: %p UNKNOWN

Module: %s at %p

Cannot read %s, PID %d, error %d

PID %d: LSA SP %s has %d patched functions in SECPKG_FUNCTION_TABLE:

PID %d: ncrypt has %d patched functions

PID %d: mswsock has %d patched functions in SockProcTable

PID %d: mswsock has %d patched functions in NspVector

PID %d: mswsock has %d patched MSAFD functions

SHAREDINFO.aheList: %p

PID %d: ntdsa has %d patched functions

PID %d - ole32 hooked by %s

PID %d - ole32 hooked by unknown module, addr %p

PID %d: rpcrt4 has %d patched functions

PID %d: basesrv has %d patched user functions

PID %d: winsrv has %d patched user functions

PID %d: winsrv has %d patched cons functions

PID %d: lsasrv has %d patched functions

PID %d: lsasrv has %d patched functions in LsapSspiExtension

PID %d: lsasrv has %d patched functions in LsapLookupExtension

PID %d: lsasrv has %d patched functions in LsapLsasrvIfTable

Cannot alloc %X bytes for EAT checking of %s, PID %d

Cannot read EAT of %s, PID %d

Cannot alloc %X bytes for checking section %s of %s, PID %d

Cannot read section %s content %X bytes of %s, PID %d

Cannot make section %s of %s, PID %d

Module %s section %s has %X patched bytes, PID %d

PID %d: user32 has %d patched imm32 functions

PID %d: advapi32 has %d patched functions

PID %d: kernel32 has %d patched functions

ShimHandler[%d]: %p %s

ShimHandler[%d]: %p UNKNOWN, located at %p

ApplicationRecoveryCallback: %s (%p)

%s, PID %d:

Cannot alloc %X bytes for IAT checking of %s, PID %d

Cannot read IAT (size %X at %p) of %s, PID %d

Cannot find function %s.%s for module %s process %d

Cannot find function %s.%d for module %s process %d

IAT Patched %s.%s in module %s process %d by %s

IAT Patched %s.%s in module %s process %d, addr %p

IAT Patched %s.%d in module %s process %d by %s

IAT Patched %s.%d in module %s process %d

Cannot alloc %X bytes for delayed IAT checking of %s, PID %d

Cannot read delayed IAT (size %X at %p) of %s, PID %d

Cannot find delayed function %s.%s for module %s process %d

Cannot find delayed function %s.%d for module %s process %d

LdrpDllNotificationList: %d

%p %s

Read %d QueuedWorkerItems:

[%d] %p %s

check_drivers_reinit: cannot read size of list, error %d, status %X

check_drivers_reinit: cannot read size of list, error %d

check_drivers_reinit: cannot alloc %X bytes

check_drivers_reinit: cannot read list, error %d, ntstatus %X

check_drivers_reinit: cannot read list, error %d

[%d] Drv %p %s routine %p %s

read_shutdown_notificators: cannot read size of %s, error %d, status %X

read_shutdown_notificators: cannot read size of %s, error %d

read_shutdown_notificators: cannot alloc %X bytes

read_shutdown_notificators: cannot read %s, error %d, ntstatus %X

read_shutdown_notificators: cannot read %s, error %d

[%d] DevObj %p Drv %p (addr %p) %s

[%d] DevObj %p Drv %p %s

MailSlot: %S, server %d (%S)

MailSlot: %S, server %d

NamedPipe: %S, server %d (%S)

NamedPipe: %S, server %d

Flags: %X, server %d (%S)

Flags: %X, creator %d, server %d

Flags: %X, server %d

Endpoints: %d

Endpoint %S PID %d (%S):

Endpoint %S:

RPC controls: %d

%S: %S

%8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X version %d.%d

Cannot load kernel %s

Unknown scheduler: ReadySummary %X DispatcherReadyListHead %X

Unknown scheduler: ReadySummary %X DeferredReadyListHead %X

Unknown scheduler: ReadySummary %X

Readed %d threads, total %d

Thread %p ProcID %X ThreadID %X Win32Thread %p %s

Thread %p ProcID %X ThreadID %X Priority %d Win32Thread %p

Thread %p ProcID %X ThreadID %X %s

Thread %p ProcID %X ThreadID %X Priority %d

reading count of threads on processor %d failed, error %X

%d threads

reading of threads on processor %d failed, error %X

Scheduler index %d

reading count of threads failed, error %X

reading of threads failed, error %X

Cannot find ETHREAD.ServiceTable

Unknown version of ETHREAD, offset %X

Cannot alloc %X bytes for ProcessesAndThreadsInformation

Cannot realloc %X bytes for ProcessesAndThreadsInformation

ProcessesAndThreadsInformation failed, error %X

read_sdt for threadID %X failed, error %d, status %X

read_sdt for threadID %X failed, error %d

ProcessID %X (%S) ThreadID %X SDT %p %s

ProcessID %X ThreadID %X SDT %p %s

read_thread_token for threadID %X failed, error %d, status %X

read_thread_token for threadID %X failed, error %d

ProcessID %X (%S) ThreadID %X token %p ImpersonationLevel %d

ProcessID %X ThreadID %X token %p ImpersonationLevel %d

Cannot detect ETHREAD.StartAddress

Unknown kernel %s, StartAddress %X, IrpList %X, StackLimit %X, StackBase %X

Unknown kernel %s, StartAddress %X, StackLimit %X, StackBase %X

Unknown kernel %s, StartAddress %X, IrpList %X

Unknown kernel %s, StartAddress %X

Cannot read count of system threads, ntstatus %X

Cannot alloc %d bytes

Cannot read system threads, ntstatus %X

%d System Threads

Thread %p Start %p %c stack %p limit %p %s

read IPSec status failed, error %d, status %X

read IPSec status failed, error %d

IPSec status %X

IPSecHandler: %p %s

IPSecQueryStatus: %p %s

IPSecSendCmplt: %p %s

IPSecNdisStatus: %p %s

IPSecRcvFWPacket: %p %s

check_tdi_pnp_clnts: cannot read size of clnts list, error %d, ntstatus %X

check_tdi_pnp_clnts: cannot read size of clnts list, error %d

check_tdi_pnp_clnts: cannot alloc %X bytes

check_tdi_pnp_clnts: cannot read clnts list, error %d, ntstatus %X

check_tdi_pnp_clnts: cannot read clnts list, error %d

TDI PnP clients: %d (readed %d)

[%d]: version %X %S

PnPPowerHandler: %p %s

BindHandler: %p %s

UnBindHandler: %p %s

AddAddressHandler: %p %s

DelAddressHandler: %p %s

Microsoft-Windows-Windows Firewall With Advanced Security

Microsoft-Windows-Kernel-Boot

Microsoft-Windows-EQoS

Microsoft-Windows-XWizards

ASP.NET Events

Microsoft-Windows-UIRibbon

Microsoft-Windows-WPD-CompositeClassDriver

Microsoft-Windows-Wired-AutoConfig

Microsoft-Windows-PrintService

Microsoft-Windows-ApplicationExperience-LookupServiceTrigger

Microsoft-Windows-IDCRL

Microsoft-Windows-MPS-DRV

Microsoft-Windows-P2P-Mesh

Microsoft-Windows-TabletPC-MathRecognizer

Microsoft-Windows-Spell-Checking

Microsoft-Windows-Fax

Microsoft-Windows-GroupPolicy

Microsoft-Windows-Crashdump

Microsoft-Windows-PrintSpooler

Microsoft-Windows-LanguagePackSetup

Microsoft-Windows-OneX

Microsoft-Windows-OfflineFiles-CscApi

Microsoft-Windows-ADSI

Microsoft-Windows-Dhcp-Client

Microsoft-Windows-CertificateServicesClient-AutoEnrollment

Microsoft-Windows-NlaSvc

Microsoft-Windows-Diagnosis-MSDE

Microsoft-Windows-SpoolerWin32SPL

Microsoft-Windows-SPB-ClassExtension

Microsoft-Windows-Kernel-Memory

Microsoft-Windows-Application Server-Applications

Microsoft-Windows-MUI

Microsoft-Windows-P2P-Collab

Microsoft-Windows-Security-Netlogon

Microsoft-Windows-SQM-Events

Microsoft-Windows-USB-USBPORT

Microsoft-Windows-SendTo

Microsoft-Windows-AIT

Microsoft-Windows-P2P-CRP

PrintFilterPipelineSvc_ObjectsGuid

Microsoft-Windows-IME-JPPRED

Microsoft-Windows-WMP

Microsoft-Windows-Eqos-SQM-Provider

MSDADIAG.ETW

Microsoft-Windows-Processor-Aggregator

Microsoft-Windows-ErrorReportingConsole

Microsoft-Windows-SmartCard-TPM-VCard-Module

Microsoft-Windows-User Profiles Service

Microsoft-Windows-Crypto-CNG

Microsoft-Windows-LinkLayerDiscoveryProtocol

Microsoft-Windows-TaskbarCPL

Microsoft-Windows-Networking-Correlation

Microsoft-Windows-RestartManager

Microsoft-Windows-WMPDMCCore

Microsoft-Windows-TCPIP

Microsoft-Windows-MSDTC

Microsoft-Windows-Resources-MrmBc

Microsoft-Windows-Time-Service

Microsoft-Windows-HomeGroup-ProviderService

Microsoft-Windows-DriverFrameworks-UserMode

Microsoft-Windows-Runtime-Networking

Microsoft-Windows-Network-Connection-Broker

Microsoft-Windows-Shell-AppWizCpl

Microsoft-Windows-PDC

Microsoft-Windows-Biometrics

Microsoft-Windows-IME-SCDICCOMPILER

Microsoft-Windows-Wininit

Microsoft-Windows-Dwm-Dwm

Microsoft-Windows-Photo-Image-Codec

Microsoft-Windows-TaskScheduler

Microsoft-Windows-osk

Microsoft-Windows-Kernel-PowerTrigger

Microsoft-Windows-EventLog-WMIProvider

Microsoft-Windows-IME-OEDCompiler

Microsoft-Windows-WER-SystemErrorReporting

Microsoft-Windows-Deplorch

Microsoft-Windows-SPB-HIDI2C

Microsoft-Windows-UxTheme

Microsoft-Windows-BfeTriggerProvider

Microsoft-Windows-Media-Streaming

Microsoft-Windows-Remotefs-UTProvider

Microsoft-Windows-Ntfs-SQM

Microsoft-Windows-User-PnP

Microsoft-Windows-AltTab

Microsoft-Windows-Kernel-StoreMgr

Microsoft-Windows-WindowsColorSystem

Microsoft-Windows-RemoteDesktopServices-RemoteFX-VM-User-Mode-Transport

Microsoft-Windows-MSMPEG2ADEC

Microsoft-Windows-TerminalServices-PnPDevices

Microsoft-Windows-GettingStarted

Microsoft-Windows-Narrator

Windows Wininit Trace

Microsoft-Windows-FileHistory-UI

Microsoft-Windows-MediaFoundation-PlayAPI

Microsoft-Windows-CertificateServicesClient-Lifecycle-System

Microsoft-Windows-BitLocker-Driver-Performance

Microsoft-Windows-PerfProc

Microsoft-Windows-Resource-Leak-Diagnostic

Microsoft-Windows-WebServices

Microsoft-Windows-FileHistory-Service

Microsoft-Windows-MediaEngine

Microsoft-Windows-StartupRepair

Microsoft-Windows-Security-IdentityStore

Microsoft-Windows-IME-SCSetting

Microsoft-Windows-FileHistory-EventListener

Microsoft-Windows-Program-Compatibility-Assistant

Microsoft-Windows-DesktopActivityModerator

Microsoft-Windows-MemoryDiagnostics-Schedule

Microsoft-Windows-FileHistory-Engine

Microsoft-Windows-PerfDisk

Microsoft-Windows-OOBE-Machine-Core

Microsoft-Windows-WLAN-AutoConfig

Microsoft-Windows-FileHistory-ConfigManager

Microsoft-Windows-Search-ProfileNotify

Microsoft-Windows-PerfCtrs

UMPass Driver Trace

Microsoft-Windows-FileHistory-Catalog

Microsoft-Windows-WlanDlg

Microsoft-Windows-CDROM

Microsoft-Windows-Crypto-NCrypt

Certificate Services Client CredentialRoaming Trace

Microsoft-Windows-CredUI

Windows Firewall Service

Microsoft-Windows-FileHistory-Core

Microsoft-Windows-Direct3D11

Microsoft-Windows-DirectoryServices-Deployment

Microsoft-Windows-All-User-Install-Agent

Microsoft-Windows-Kernel-Licensing-StartServiceTrigger

Microsoft-Windows-ServerManager-ManagementProvider

Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider

Microsoft-Windows-IIS-W3SVC-WP

Microsoft-Windows-TerminalServices-MediaRedirection-DShow

Microsoft-Windows-Rdms-UI

Microsoft-Windows-Feedback-Service-TriggerProvider

Microsoft-Windows-Eventlog

Microsoft-Windows-CodeIntegrity

Microsoft-Windows-WPDClassInstaller

Microsoft-Windows-NetworkAccessProtection

Microsoft-Windows-UIAutomationCore

Microsoft-Windows-StartLmhosts

Microsoft-Windows-IME-Broker

Microsoft-Windows-Kernel-Process

Microsoft-Windows-CertificateServicesClient

Microsoft-Windows-AppXDeployment

Microsoft-Windows-Shell-Core

Microsoft-Windows-Anytime-Upgrade

Microsoft-Windows-PCI

Microsoft-Windows-WPD-MTPBT

Microsoft-Windows-CertificationAuthorityClient-CertCli

Microsoft-Windows-Srv2

Microsoft-Windows-TunnelDriver-SQM-Provider

Microsoft-Windows-Security-Licensing-SLC

Microsoft-Windows-ATAPort

Microsoft-Windows-Recovery

Microsoft-Windows-GenericRoaming

Microsoft-Windows-Sdbus-SQM

Microsoft-Windows-DirectComposition

Microsoft-Windows-P2PIMSvc

Microsoft-Windows-WCN-Config-Registrar

Microsoft-Windows-WPD-API

Microsoft-Windows-P2P-PNRP

Microsoft-Windows-DeviceUx

Windows Mobile Performance Hooks

Microsoft-Windows-ProcessStateManager

Windows Connect Now

Microsoft-Windows-Networking-RealTimeCommunication

Microsoft-Windows-EventSystem

Microsoft-Windows-Spaceport

Windows Mobile Remote API

Microsoft-Windows-Dhcp-Nap-Enforcement-Client

Microsoft-Windows-WinNat

Windows Mobile AirSync Engine 2

Microsoft-Windows-WCN-Config-Registrar-Secure

Windows Mobile AirSync Engine 1

Microsoft-Windows-Security-Kerberos

Windows Mobile ActiveSync Engine

Microsoft-Windows-WSC-SRV

Microsoft-Windows-Eventlog-ForwardPlugin

Windows Mobile Serial Connectivity

Microsoft-Windows-TerminalServices-SessionBroker-Client

Microsoft-Windows-WMPNSS-PublicAPI

Windows Mobile Desktop Passthrough

Microsoft-Windows-RPC-Events

Microsoft-Windows-LanguageProfile

Microsoft-Windows-Anytime-Upgrade-Events

Microsoft-Windows-Management-UI

Microsoft-Windows-SMBClient

Microsoft-Windows-TerminalServices-RdpSoundDriver

Microsoft-Windows-Dwm-Api

Microsoft-Windows-QoS-qWAVE

Microsoft-Windows-Kernel-Tm-Trigger

Microsoft-Windows-IPNAT

Microsoft-Windows-NetworkBridge

Microsoft-Windows-MPS-CLNT

Microsoft-Windows-Diagnosis-Scheduled

Microsoft-Windows-WMPNSS-Service

Microsoft-Windows-DxpTaskRingtone

Microsoft-Windows-Kernel-AppCompat

Microsoft-Windows-TimeBroker

Microsoft-Windows-DeviceConfidence

Microsoft-Windows-Shell-Shwebsvc

Microsoft-Windows-Diagnostics-Performance

Windows NetworkMap Trace

Microsoft-Windows-TerminalServices-Printers

Microsoft-Windows-AppLocker

Microsoft-Windows-Audio

Microsoft-Windows-LLTD-MapperIO

Microsoft-Windows-HotspotAuth

Microsoft-Windows-Firewall-CPL

Microsoft-Windows-Kernel-IoTrace

Microsoft-Windows-Perflib

Microsoft-Windows-BootUX

Microsoft-Windows-WMPDMCUI

Microsoft-Windows-Disk

Microsoft-Windows-IME-JPLMP

Microsoft-Windows-Security-SPP-UX-Notifications

Microsoft-Windows-TerminalServices-ClientActiveXCore

Microsoft-Windows-IIS-IISReset

Microsoft-Windows-WindowsUIImmersive

Windows Firewall Control Panel

Microsoft-Windows-DeviceSetupManager

Microsoft-Windows-EnrollmentPolicyWebService

Microsoft-Windows-IME-Roaming

Microsoft-Windows-SetupQueue

Microsoft-Windows-SmartCard-Audit

Microsoft-Windows-Servicing

Microsoft-Windows-ACL-UI

Microsoft-Windows-WWAN-CFE

Microsoft-Windows-FCRegSvc

Microsoft-Windows-IIS-IisMetabaseAudit

Microsoft-Windows-Kernel-WDI

Microsoft-Windows-TabletPC-MathInput

Microsoft-Windows-Kernel-General

Windows Media Player Trace

Microsoft-Windows-DxpTaskDLNA

Microsoft-Windows-User Profiles General

Microsoft-Windows-Kernel-WSService-StartServiceTrigger

Microsoft-Windows-WebAuth

Microsoft-Windows-API-Tracing

Microsoft-Windows-FunctionDiscovery

Microsoft-Windows-StickyNotes

Microsoft-Windows-WCN-WscEapPeer-Trace

Microsoft-Windows-QoS-WMI-Diag

Microsoft-Windows-NetworkProvisioning

Microsoft-Windows-Network-DataUsage

Microsoft-Windows-AppSruProv

Microsoft-Windows-WebcamExperience

Microsoft-Windows-EaseOfAccess

Microsoft-Windows-Spellchecking-Host

Microsoft-Windows-IME-CandidateUI

Microsoft-Windows-TPM-WMI

Microsoft-Windows-Security-SPP

Microsoft-Windows-DirectShow-KernelSupport

Microsoft-Windows-Diagnosis-AdvancedTaskManager

Microsoft-Windows-ThemeCPL

Windows Mobile Co-installer

Microsoft-Windows-MPRMSG

Microsoft-Windows-EnhancedStorage-EhStorCertDrv

Microsoft-Windows-NdisImPlatformEventProvider

Microsoft-Windows-FunctionDiscoveryHost

Microsoft-Windows-MediaFoundation-MSVideoDSP

Microsoft-Windows-IME-JPTIP

Windows Kernel Trace

Microsoft-SQLServerDataTools

Microsoft-Windows-ASN1

Microsoft-Windows-Crypto-BCrypt

Microsoft-Windows-HealthCenterCPL

Microsoft-Windows-XAML

Microsoft-Windows-PDFReader

Microsoft-Windows-TerminalServices-ServerUSBDevices

Microsoft-Windows-WWAN-SVC-EVENTS

Microsoft-Windows-Search-ProtocolHandlers

Microsoft-Windows-IdCtrls

Microsoft-Windows-User-ControlPanel

Microsoft-Windows-Runtime-Media

Microsoft-Windows-CAPI2

Windows Mobile Sync Handlers

Microsoft-Windows-PowerCfg

Microsoft-Windows-SrumTelemetry

Microsoft-Windows-Base-Filtering-Engine-Connections

Microsoft-Windows-Sidebar

Microsoft-Windows-NDF-HelperClassDiscovery

Microsoft-Windows-PerfNet

Microsoft-Windows-PortableDeviceStatusProvider

Microsoft-Windows-TabletPC-Platform-Manipulations

Microsoft-Windows-Subsys-SMSS

Microsoft-Windows-LDAP-Client

Microsoft-Windows-Security-SPP-UX-GC

Microsoft-Windows-Media Center Extender

Microsoft-Windows-DiskDiagnostic

Microsoft-Windows-TSF-msutb

Microsoft-Windows-Reliability-Analysis-Agent

{B6501BA0-C61A-C4E6-6FA2-A4E7F8C8E7A0}

Microsoft-Windows-Kernel-Processor-Power

Microsoft-Windows-NCSI

Microsoft-Windows-NetworkConnectivityStatus

Microsoft-Windows-wmvdecod

Microsoft-Windows-ServiceTriggerPerfEventProvider

Microsoft-Windows-Service Pack Installer

Microsoft-Windows-Bluetooth-HidGatt

Microsoft-Windows-TabletPC-Platform-Input-Ninput

Microsoft-Windows-Tcpip-SQM-Provider

Microsoft-Windows-MPS-SRV

Microsoft-Windows-KnownFolders

Microsoft-Windows-NAPIPSecEnf

Microsoft-Windows-EnrollmentWebService

Microsoft-Windows-Deduplication-Change

Microsoft-Windows-OfflineFiles-CscFastSync

Microsoft-Windows-UxInit

Microsoft-Windows-BranchCacheClientEventProvider

Microsoft-Windows-Forwarding

Microsoft-Windows-RPC-Proxy-LBS

Microsoft-Windows-Kernel-Disk

Microsoft-Windows-TriggerEmulatorProvider

Microsoft-Windows-SystemHealthAgent

Microsoft-Windows-Memory-Diagnostic-Task-Handler

Microsoft-Windows-Winsock-WS2HELP

Microsoft-Windows-ThemeUI

Microsoft-Windows-TerminalServices-MediaRedirection

Microsoft-Windows-TerminalServices-ClientUSBDevices

Microsoft-Windows-TabletPC-CoreInkRecognition

Microsoft-Windows-COM

Microsoft-Windows-PnPMgrTriggerProvider

Microsoft-Windows-LoadPerf

Microsoft-Windows-System-Restore

Microsoft-Windows-UserAccountControl

Microsoft-Windows-Services-Svchost

Microsoft-Windows-PushNotifications-Developer

Microsoft-Windows-LiveId

Microsoft-Windows-Security-SPP-UX

Microsoft-Windows-VAN

Microsoft-Windows-FirstUX-PerfInstrumentation

Microsoft-Windows-Kernel-Tm

Microsoft-Windows-Kernel-ShimEngine

Microsoft-Windows-EapHost

Microsoft-Windows-CertPolEng

Microsoft-Windows-MsLbfoEventProvider

Microsoft-Windows-Complus

Microsoft-Windows-EFS

Microsoft-Windows-WwaHost

Microsoft-Windows-ServerManager

Microsoft-Windows-ComDlg32

Microsoft-Windows-MP4SDECD

Microsoft-Windows-PeopleNearMe

Microsoft-Windows-SmartCard-Bluetooth-Profile

Microsoft-Windows-TZUtil

Microsoft-Windows-ApplicationExperience-SwitchBack

Microsoft-Windows-UI-Input-Inking

Microsoft-Windows-VDRVROOT

Windows Firewall NetShell Plugin

Windows Firewall API

Microsoft-Windows-Kernel-Acpi

Microsoft-Windows-WinRM

Microsoft-Windows-Direct3D10_1

Microsoft-Windows-Kernel-LicensingSqm

Microsoft-Windows-SpoolerSpoolss

Microsoft-Windows-FilterManager

Microsoft-Windows-ActionQueue

Microsoft-Windows-IME-KRAPI

Microsoft-Windows-Resource-Exhaustion-Detector

Microsoft-Windows-ApplicationExperienceInfrastructure

Microsoft-Windows-StorSqm

Microsoft-Windows-Search

Microsoft-Windows-HttpEvent

Microsoft-Windows-AxInstallService

Microsoft-Windows-Diagnosis-PerfHost

Microsoft-Windows-International

Microsoft-Windows-CertificateServicesClient-CredentialRoaming

Microsoft-Windows-SoftwareRestrictionPolicies

Microsoft-Windows-Windows Defender

Microsoft-Windows-ShareMedia-ControlPanel

Microsoft-Windows-CertificateServicesClient-Lifecycle-User

Microsoft-Windows-WPD-MTPUS

Microsoft-Windows-DirectWrite

Microsoft-Windows-RPCSS

Microsoft-Windows-DeviceSync

Microsoft-Windows-NcdAutoSetup

Microsoft-Windows-Diagnosis-PCW

Microsoft-Windows-DistributedCOM

ATA Port Driver Tracing Provider

Microsoft-Windows-WebdavClient-LookupServiceTrigger

Microsoft-Windows-USB-USBXHCI

Microsoft-Windows-Diagnosis-PLA

Microsoft-Windows-WlanConn

Microsoft-Windows-Winlogon

Microsoft-Windows-stobject

Microsoft-Windows-Mobile-Broadband-Experience-SmsRouter

Microsoft-Windows-D3D10Level9

Microsoft-Windows-WAS-ListenerAdapter

Microsoft-Windows-ServerManager-MultiMachine

Microsoft-Windows-AppxPackagingOM

Microsoft-Windows-PushNotifications-Platform

Microsoft-Windows-OOBE-Machine-Plugins-Wireless

Microsoft-Windows-IME-JPAPI

SBP2 Port Driver Tracing Provider

Microsoft-Windows-BranchCacheEventProvider

Microsoft-Windows-Immersive-Shell-API

Microsoft-Windows-ntshrui

Microsoft-Windows-KPSSVC

Microsoft-Windows-BitLocker-DrivePreparationTool

Microsoft-Windows-EapMethods-Sim

Microsoft-Windows-Shell-ZipFolder

Microsoft-Windows-Search-Core

Microsoft-Windows-OfflineFiles-CscNetApi

Microsoft-Windows-Diagnosis-WDI

Microsoft-Windows-PortableDeviceSyncProvider

Microsoft-Windows-Diagnostics-PerfTrack-Counters

Microsoft-Windows-Speech-TTS

Microsoft-Windows-Component-Resources-MrmCore-Events

Microsoft-Windows-BranchCache

Microsoft-Windows-SystemEventsBroker

Microsoft-Windows-VolumeControl

Microsoft-Windows-Win32k

Microsoft-Windows-Kernel-WHEA

Microsoft-Windows-P2P-Meetings

Microsoft-Windows-Diagnosis-WDC

Microsoft-Windows-Serial-ClassExtension

Microsoft-Windows-KPSSVC-WPP

Microsoft-Windows-CertificateServices-Deployment

Microsoft-Windows-PerfOS

Microsoft-Windows-ResetEng

Microsoft-Windows-Runtime-Graphics

Microsoft-Windows-IPSEC-SRV

Microsoft-Windows-CorruptedFileRecovery-Server

Windows Mobile Bluetooth Connectivity

Microsoft-Windows-DLNA-Namespace

Microsoft-Windows-WLAN-MediaManager

Certificate Services Client Trace

Microsoft-Windows-BranchCacheSMB

Microsoft-Windows-PrintService-USBMon

Microsoft-Windows-OOBE-Machine

Microsoft-Windows-DXP

Microsoft-Windows-Immersive-Shell

Microsoft-Windows-OOBE-Machine-Plugins

Microsoft-Windows-Reliability-Analysis-Engine

Microsoft-Windows-Application-Experience

Microsoft-Windows-KdsSvc

Microsoft-Windows-MediaFoundation-Platform

Microsoft-Windows-Security-Configuration-Wizard

Microsoft-Windows-DisplayColorCalibration

Windows Mobile Device Center Base

Microsoft-Windows-WPD-MTPClassDriver

Microsoft-Windows-DNS-Client

Microsoft-Windows-MSDTC Client

Microsoft-Windows-NDIS-PacketCapture

Windows Remote Management Trace

Microsoft-Windows-MSPaint

Microsoft-Windows-HomeGroup-ListenerService

Microsoft-Windows-Sensor-Service-Trigger

Microsoft-Windows-EapMethods-Ttls

Microsoft-Windows-Remotefs-Smb

Microsoft-Windows-SMBWitnessClient

Microsoft-Windows-USB-USBHUB

Microsoft-Windows-DirectWrite-FontCache

Microsoft-Windows-WindowsBackup

Microsoft-Windows-NWiFi

Microsoft-Windows-WER-Diag

Microsoft-Windows-UAC

Microsoft-Windows-LUA

Microsoft-Windows-AppID

Microsoft-Windows-IIS-WMSVC

Microsoft-Windows-Shell-OpenWith

Microsoft-Windows-MediaFoundation-MFReadWrite

Microsoft-Windows-BrokerInfrastructure

Microsoft-Windows-Fault-Tolerant-Heap

Microsoft-Windows-Shell-DefaultPrograms

Microsoft-Windows-Dism-Cli

Microsoft-Windows-SMBDirect

Microsoft-Windows-IME-SCTIP

Microsoft-Windows-EnergyEfficiencyWizard

Microsoft-Windows-ParentalControls

Microsoft-Windows-Smartcard-Server

Microsoft-Windows-FMS

Microsoft-Windows-Devices-Location

Microsoft-Windows-LLTD-Responder

Microsoft-Windows-MsLbfoSysEvtProvider

sqlos

Microsoft-Windows-TerminalServices-RemoteConnectionManager

Microsoft-Windows-SCPNP

Microsoft-Windows-Wordpad

WMI_Tracing_Client_Operations

Microsoft-Windows-Security-Audit-Configuration-Client

Microsoft-Windows-EFSADU

Windows Notification Facility Provider

Microsoft-Windows-DiagCpl

Windows NetworkItemFactory Trace

Microsoft-Windows-ApplicationExperience-Cache

Microsoft-Windows-ResourcePublication

Microsoft-Windows-FailoverClustering-Client

Microsoft-Windows-Runtime-Networking-BackgroundTransfer

Microsoft-Windows-AppHost

Microsoft-Windows-NetAdapterCim-Diag

Microsoft-Windows-IIS-FTP

Microsoft-Windows-Iphlpsvc

Microsoft-Windows-WinINet

Microsoft-Windows-TabletPC-InputPersonalization

Microsoft-Windows-SpoolerFilterPipelineSVC

Microsoft-Windows-Globalization

Microsoft-Windows-Bits-Client

Microsoft-Windows-WFP

Microsoft-Windows-Services

Microsoft-Windows-IdleTriggerProvider

Microsoft-Windows-DxgKrnl

Microsoft-Windows-HealthCenter

Microsoft-Windows-OtpCredentialProviderEvt

Microsoft-Windows-MemoryDiagnostics-Results

Microsoft-Windows-Ncasvc

Microsoft-Windows-SystemSettings

Microsoft-Windows-PDH

Microsoft-Windows-WMPNSSUI

Microsoft-Windows-BdeTriggerProvider

Microsoft-Windows-Diagnostics-PerfTrack

Microsoft-Windows-IIS-APPHOSTSVC

Microsoft-Windows-CoreWindow

Microsoft-Windows-Help

Microsoft-Windows-WindowsUpdateClient

Microsoft-Windows-IIS-W3SVC-PerfCounters

Microsoft-Windows-WMI

Microsoft-Windows-TabletPC-Platform-Input-Wisp

Microsoft-Windows-ProcessExitMonitor

Microsoft-Windows-IME-JPSetting

Microsoft-Windows-Diagnosis-Scripted

Microsoft-Windows-GroupPolicyTriggerProvider

File Kernel Trace; Operation Set 2

Microsoft-Windows-IIS-Configuration

Microsoft-Windows-Diagnosis-TaskManager

Microsoft-Windows-Diagnosis-DPS

Microsoft-Windows-UserPnp

Microsoft-Windows-Security-SPP-UX-GenuineCenter-Logging

Microsoft-Windows-Schannel-Events

NetJoin

Microsoft-Windows-TabletPC-InputPanel

Microsoft-Windows-FileServices-ServerManager-EventProvider

Microsoft-Windows-MediaFoundation-Performance

Microsoft-Windows-EndpointTriggerProvider

Microsoft-Windows-IME-KRTIP

Microsoft-Windows-Mobile-Broadband-Experience-SmsApi

Microsoft-Windows-Hyper-V-Netvsc

Microsoft-Windows-DirectSound

Microsoft-Windows-TabletPC-Platform-Input-Core

Microsoft-Windows-PushNotifications-InProc

Microsoft-Windows-Kernel-Network

Microsoft-Windows-DiskDiagnosticResolver

Microsoft-Windows-NdisImPlatformSysEvtProvider

Microsoft-Windows-MeetingSpace

Microsoft-Windows-Base-Filtering-Engine-Resource-Flows

Microsoft-Windows-RasServer

Microsoft-Windows-VHDMP

Microsoft-Windows-WindowsSystemAssessmentTool

Microsoft-Windows-DCLocator

Microsoft-Windows-Diagnosis-MSDT

Microsoft-Windows-WLGPA

SQLSRV32.1

Microsoft-Windows-CertificateServicesClient-CertEnroll

Microsoft-Windows-IME-TCCORE

Microsoft-Windows-SmartCard-Bluetooth-Transport

Microsoft-Windows-WMVENCOD

Microsoft-Windows-mobsync

Microsoft-Windows-EFSTriggerProvider

Microsoft-Windows-DUSER

Microsoft-Windows-DiskDiagnosticDataCollector

Microsoft-Windows-DirectAccess-MediaManager

Microsoft-Windows-DisplaySwitch

Microsoft-Windows-PackageStateRoaming

Microsoft-Windows-Crypto-DPAPI

Microsoft-Windows-IME-CustomerFeedbackManagerUI

sqlserver

Microsoft-Windows-User-Loader

Microsoft-Windows-NetworkProfileTriggerProvider

Microsoft-Windows-NetworkProfile

Windows Firewall API - GP

Microsoft-Windows-CmiSetup

Microsoft-Windows-Sysprep

Microsoft-Windows-Windeploy

Microsoft-Windows-Setup

Microsoft-Windows-OobeLdr

Microsoft-Windows-SetupUGC

Microsoft-Windows-Audit

Microsoft-Windows-SetupCl

Microsoft-Windows-Winsrv

Microsoft-Windows-WinHttp

Microsoft-Windows-RadioManager

Microsoft-Windows-Websocket-Protocol-Component

Microsoft-Windows-WebIO

Microsoft-Windows-Dwm-Core

Microsoft-Windows-Registry-SQM-Provider

Microsoft-Windows-WHEA-Logger

Microsoft-Windows-PeerToPeerDrtEventProvider

Microsoft-Windows-BitLocker-Driver

Microsoft-Windows-SettingSync

Microsoft-Windows-Mobile-Broadband-Experience-Api-Internal

Microsoft-Windows-EnhancedStorage-EhStorTcgDrv

Microsoft-Windows-PowerShell

Microsoft-Windows-DirectShow-Core

Microsoft-Windows-Kernel-Power

Microsoft-Windows-msmpeg2venc

Microsoft-Windows-MPEG2_DLNA-Encoder

Microsoft-Windows-Remote-FileSystem-Log

Microsoft-Windows-Kernel-PnP

Microsoft-Windows-AppXDeployment-Server

Microsoft-Windows-Folder Redirection

Microsoft-Windows-OfflineFiles-CscUM

Microsoft-Windows-ServerManager-DeploymentProvider

Microsoft-Windows-ServiceReportingApi

Microsoft-Windows-StorDiag

Microsoft-Windows-IME-CustomerFeedbackManager

Microsoft-Windows-Kernel-EventTracing

Microsoft-Windows-Kernel-BootDiagnostics

Microsoft-Windows-DXGI

Microsoft-Windows-Build-RegDll

Microsoft-Windows-PNRPSvc

Microsoft-Windows-Ndu

Microsoft-Windows-Firewall

Microsoft-Windows-Wcmsvc

Microsoft-Windows-OLEACC

Microsoft-Windows-MSDTC Client 2

Microsoft-Windows-InputSwitch

Microsoft-Windows-Runtime-WebAPI

Microsoft-Windows-HAL

Microsoft-Windows-International-RegionalOptionsControlPanel

Microsoft-Windows-RPC

Microsoft-Windows-MFH264Enc

Microsoft-Windows-SharedAccess_NAT

Microsoft-Windows-DeviceAssociationService

Microsoft-Windows-Bluetooth-MTPEnum

Microsoft-Windows-BitLocker-API

{C5BFFE2E-9D87-D568-A09E-08FC83D0C7C2}

Microsoft-Windows-IPMIProvider

Microsoft-Windows-IME-TIP

Microsoft-Windows-WindowsToGo-StartupOptions

Microsoft-Windows-Backup

Microsoft-Windows-WMP-MediaDeliveryEngine

Microsoft-Windows-PrintBRM

Microsoft-Windows-ServerManager-ConfigureSMRemoting

Microsoft-Windows-Video-For-Windows

Microsoft-Windows-ClearTypeTextTuner

Microsoft-Windows-Subsys-Csr

Microsoft-Windows-USB-UCX

Microsoft-Windows-RemoteApp and Desktop Connections

Windows Winlogon Trace

Microsoft-Windows-RasSstp

Microsoft-Windows-UAC-FileVirtualization

Microsoft-Windows-ClassicSruMon

Microsoft-Windows-Security-IdentityListener

Microsoft-Windows-WWAN-MM-EVENTS

Microsoft-Windows-MsiServer

Microsoft-Windows-PhotoAcq

Microsoft-Windows-Power-Troubleshooter

Microsoft-Windows-DxpTaskSyncProvider

Microsoft-Windows-Remotefs-Rdbss

Microsoft-Windows-AppIDServiceTrigger

Microsoft-Windows-Kernel-File

Microsoft-Windows-TSF-msctf

Microsoft-Windows-PowerCpl

Microsoft-Windows-LanGPA

Microsoft-Windows-WWAN-MediaManager

Microsoft-Windows-PrimaryNetworkIcon

Microsoft-Windows-OfflineFiles

Microsoft-Windows-UIAnimation

Microsoft-Windows-Security-Auditing

Microsoft-Windows-WCN-Config-Registrar-Wizard-Trace

Microsoft-Windows-WWAN-NDISUIO-EVENTS

Microsoft-Windows-NetworkManagerTriggerProvider

Microsoft-Windows-Winsock-AFD

Microsoft-Windows-Remote-FileSystem-Monitor

Microsoft-Windows-WABSyncProvider

.NET Common Language Runtime

Microsoft-Windows-MSMPEG2VDEC

Microsoft-Windows-DateTimeControlPanel

Windows Firewall Driver

Microsoft-Windows-IIS-W3SVC

Microsoft-Windows-WWAN-UI-EVENTS

Microsoft-Windows-Speech-UserExperience

Microsoft-Windows-Dism-Api

Microsoft-Windows-Store-Client-UI

Microsoft-Windows-Calculator

Microsoft-Windows-Shell-ConnectedAccountState

Microsoft-Windows-PrintDialogs

Microsoft-Windows-Network-and-Sharing-Center

Microsoft-Windows-Crypto-RNG

Microsoft-Windows-MSDTC 2

Microsoft-Windows-SpellChecker

Microsoft-Windows-propsys

Microsoft-Windows-WPD-MTPIP

Microsoft-Windows-Documents

Microsoft-Windows-StorPort

Microsoft-Windows-Magnification

Microsoft-Windows-Shell-AuthUI

Microsoft-Windows-Dwm-Redir

Microsoft-Windows-BTH-BTHUSB

Microsoft-Windows-Ntfs

Microsoft-Windows-Sens

Microsoft-Windows-UserAccessLogging

Microsoft-Windows-RemoteDesktopServices-RdpCoreTS

Microsoft-Windows-COM-Perf

Microsoft-Windows-StorageSpaces-BackgroundAgent

Microsoft-Windows-Kernel-Prefetch

Portable Device Connectivity API Trace

Microsoft-Windows-RemoteAssistance

Microsoft-Windows-MF

Microsoft-Windows-MediaFoundation-MSVProc

Microsoft-Windows-TBS

Microsoft-Windows-FeedbackTool

Microsoft-Windows-WlanPref

Microsoft-Windows-OfflineFiles-CscDclUser

Microsoft-Windows-Http-SQM-Provider

Microsoft-Windows-Wireless-Network-Setup-Wizard-Trace

Microsoft-Windows-MCT

Microsoft-Windows-HotStart

Microsoft-Windows-Diagnostics-Networking

Microsoft-Windows-Sensors

Microsoft-Windows-SmbServer

Microsoft-Windows-USB-USBHUB3

Microsoft-Windows-Dot3MM

Microsoft-Windows-KernelStreaming

Microsoft-Windows-Mobile-Broadband-Experience-Api

Microsoft-Windows-VolumeSnapshot-Driver

Microsoft-Windows-MobilityCenter

Microsoft-Windows-OfflineFiles-CscService

Microsoft-Windows-Superfetch

Microsoft-Windows-IPBusEnum

Microsoft-Windows-Mprddm

Microsoft-Windows-Dwm-Udwm

Microsoft-Windows-AppModel-State

Microsoft-Windows-WCN-FD-Provider-Trace

Microsoft-Windows-Resource-Exhaustion-Resolver

Microsoft-Windows-Iphlpsvc-Trace

Microsoft-Windows-WUSA

Microsoft-Windows-TerminalServices-LocalSessionManager

Microsoft-Windows-RPC-FirewallManager

Microsoft-Windows-WCN-Common-Trace

Microsoft-Windows-MediaFoundation-MFCaptureEngine

Microsoft-Windows-ReadyBoostDriver

Microsoft-Windows-DUI

Microsoft-Windows-WMP-Setup_WM

Microsoft-Windows-Direct3D10

Microsoft-Windows-DfsSvc

Microsoft-Windows-IME-SCCORE

Microsoft-Windows-NTLM

Microsoft-Windows-VWiFi

Microsoft-Windows-Kernel-PnPConfig

Microsoft-Windows-Winsock-SQM

Microsoft-Windows-SpoolerSpoolSV

Microsoft-Windows-Netshell

Microsoft-Windows-UserModePowerService

Microsoft-Windows-HttpService

HTTP Service Trace

Microsoft-Windows-D3D9

Microsoft-Windows-AppModel-Runtime

Microsoft-Windows-CEIP

Microsoft-Windows-Directory-Services-SAM

Microsoft-Windows-SpoolerTCPMon

Microsoft-Windows-ReadyBoost

Microsoft-Windows-L2NACP

Microsoft-Windows-LLTD-Mapper

Microsoft-Windows-Deduplication

Microsoft-Windows-HomeGroup-ControlPanel

Microsoft-Windows-Mobile-Broadband-Experience-Parser-Task

Microsoft-Windows-DomainJoinManagerTriggerProvider

Microsoft-Windows-SruMon

Microsoft-Windows-ELS-Hyphenation

TCPIP Service Trace

Microsoft-Windows-DriverFrameworks-KernelMode

Microsoft-Windows-CorruptedFileRecovery-Client

Microsoft-Windows-WMI-Activity

Microsoft-Windows-COMRuntime

Microsoft-Windows-WAS

Microsoft-Windows-Wnv

Microsoft-Windows-Shsvcs

Microsoft-Windows-NDIS

Microsoft-Windows-WinMDE

File Kernel Trace; Operation Set 1

Microsoft-Windows-Proximity-Common

Microsoft-Windows-Ntfs-UBPM

Microsoft-Windows-Kernel-Registry

Microsoft-Windows-RemoteDesktopServices-RemoteDesktopSessionManager

Microsoft-Windows-TunnelDriver

Microsoft-Windows-QoS-Pacer

Microsoft-Windows-EventCollector

Microsoft-Windows-OOBE-Machine-DUI

Microsoft-Windows-IME-TCTIP

Microsoft-Windows-WCNWiz

Microsoft-Windows-Display

Microsoft-Windows-OcSetup

Microsoft-Windows-DesktopWindowManager-Diag

Microsoft-Windows-FileInfoMinifilter

Microsoft-Windows-TextPredictionEngine

Microsoft-Windows-NetworkGCW

Microsoft-Windows-DHCPv6-Client

Microsoft-Windows-PlayToManager

NDIS_STATUS_TCP_CONNECTION_OFFLOAD_CURRENT_CONFIG

NDIS_STATUS_PORT_STATE

MS_Windows_AeLookupServiceTrigger_Provider

Microsoft_Windows_SQM_Provider

MS_Windows_AIT_Provider

NDIS_TCP_CONNECTION_OFFLOAD_CURRENT_CONFIG

NDIS_TCP_OFFLOAD_CURRENT_CONFIG

PARPORT_WMI_ALLOCATE_FREE_COUNTS_GUID

NDIS_GEN_ENUMERATE_PORTS

GUID_QOS_TC_SUPPORTED

MS1394_PortVendorRegisterAccessGuid

iSCSI_PersistentLoginsGuid

iSCSI_PortalInfoClassGuid

SerailPortPerfGuid

PortClsEvent

UdpIpGuid

TcpIpGuid

iSCSI_OperationsGuid

CTLGUID_usbport

NDIS_STATUS_TCP_CONNECTION_OFFLOAD_HARDWARE_CAPABILITIES

iSCSI_DiscoveryOperationsGuid

SerialPortNameGuid

CTLGUID_WebClntTrace

POINTER_PORT_WMI_STD_DATA_GUID

KEYBOARD_PORT_WMI_STD_DATA_GUID

MSKeyboard_ClassInformationGuid

NDIS_GEN_CO_MEDIA_SUPPORTED

MS_Windows_AeSwitchBack_Provider

SerialPortHWGuid

MS_SM_PortInformationMethods

ataport_CtlGuid

storport_CtlGuid

MS1394_PortDriverInformationGuid

BTHPORT_WMI_HCI_PACKET_INFO

SerialPortCommGuid

iScsiLBOperationsGuid

MS_Windows_AeCache_Provider

NDIS_GEN_PORT_STATE

WindowsBackup TracingControlGuid

WmiMonitorListedSupportedSourceModes_GUID

NDIS_GEN_MEDIA_SUPPORTED

CTLGUID_certprop

BTHPORT_WMI_SDP_SERVER_LOG_INFO

KEYBOARD_PORT_WMI_EXTENDED_ID

iSCSIRedirectPortalGuid

NDIS_GEN_PORT_AUTHENTICATION_PARAMETERS

BTHPORT_WMI_SDP_DATABASE_EVENT

NDIS_TCP_CONNECTION_OFFLOAD_HARDWARE_CAPABILITIES

iSCSI_TCPIPConfigGuid

SerialPortPropertiesGuid

PortCls_IrpProcessing

iSCSI_SecurityConfigOperationsGuid

NDIS_TCP_OFFLOAD_PARAMETERS

PortCls_PowerState

Microsoft_Windows_GameUx

iSCSI_InitiatorLoginStatisticsGuid

MS1394_PortErrorInformationGuid

PortCls_PinState

CTLGUID_PortCls

NDIS_TCP_OFFLOAD_HARDWARE_CAPABILITIES

CTRLGUID_MF_PIPELINE

.PX`i`

`.HBS

&{%UD(_

dump_wmi_guidentries failed, error %d, status %X

dump_wmi_guidentries failed, error %d

dump_wmi_guidentries: cannot alloc %X bytes (total %d)

dump_wmi_guidentries: read failed, error %d, status %X

dump_wmi_guidentries: read failed, error %d

WMI guidentries: total %X readed %X:

[%X] %X flag %X refcnt %X - %s

[%X] %X flag %X refcnt %X %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X

dump_wmi_regentries failed, error %d, status %X

dump_wmi_regentries failed, error %d

dump_wmi_regentries: cannot alloc %X bytes (total %d)

dump_wmi_regentries: read failed, error %d, status %X

dump_wmi_regentries: read failed, error %d

WMI regentries: total %X readed %X:

[%X] flags %X refcnt %X dev %p prov %X DS %p %s

[%X] flags %X refcnt %X cb %p prov %X DS %p %s

Etw[%d]:

Type %X Index %X InternalCB %p (%s) %s

Type %X Index %X InternalCB %p %s

Type %X Index %X InternalCB %p (%s) ProviderId: %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X

Type %X Index %X InternalCB %p ProviderId: %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X

dump_Etw: exception occured, code %X

dump_Etws: exception occured, code %X

KPRCB.EtwSupport %p:

KPRCB[%d].EtwSupport %p:

read_kernel_etws count failed, error %d, ntstatus %X

read_kernel_etws count failed, error %d

read_kernel_etws: cannot alloc %X bytes

read_kernel_etws failed, error %d, ntstatus %X

read_kernel_etws failed, error %d

KEtw[%X]:

KEtw[%X]: RefCount %d, KProvider - %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X

KEtw[%X]: RefCount %d %s

[%X] %p %s

Type %X InUse %d Index %X InternalCB %p (%s) %s

Type %X InUse %d Index %X InternalCB %p %s

Type %X InUse %d Index %X InternalCB %p (%s) ProviderId: %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X

Type %X InUse %d Index %X InternalCB %p ProviderId: %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X

EtwCallback[%d] %p %s:

EtwCallback[%d]:

EtwTrace[%d] %p Ctx %p %s:

EtwTrace[%d] %p Ctx %p %s - %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X

Unknown type %d for Etw[%d]

DEVINTERFACE_MT_TRANSPORT

DEVINTERFACE_KEYBOARD

DEVINTERFACE_COMPORT

DEVINTERFACE_VIAMINIPORT

DEVINTERFACE_STORAGEPORT

DEVINTERFACE_IRPORT

check_pnp_notifiers failed, error %d, status %X

check_pnp_notifiers failed, error %d

check_pnp_notifiers: cannot alloc %X bytes (total %d)

check_pnp_notifiers: read failed, error %d, status %X

check_pnp_notifiers: read failed, error %d

Pnp Notifiers: total %d, readed %d

Pnp[%d] %p %s %s addr %p

Pnp[%d] %s %s addr %p %s

check_pnp_handlers failed, error %d, status %X

check_pnp_handlers failed, error %d

PlugPlayHandlerTable: %d items

PlugPlayHandlerTable[%d] %p %s

PlugPlayHandlerTable[%d] %p

check_sess_notify, error %d, status %X

check_sess_notify, error %d

check_sess_notify: cannot alloc %X bytes (total %d)

check_sess_notify: read failed, error %d, status %X

check_sess_notify: read failed, error %d

IopSessionNotifications: %d

SessionNotifier[%d]: class %d len %X session %p cb %p %s

check_sess_term_ntfs failed, error %d, status %X

check_sess_term_ntfs failed, error %d

check_sess_term_ntfs: cannot alloc %X bytes (total %d)

check_sess_term_ntfs: read failed, error %d, status %X

check_sess_term_ntfs: read failed, error %d

LogonSessionTerminatedRoutines: %d

[%d] %p %s

check_fs_changes failed, error %d, status %X

check_fs_changes failed, error %d

check_fs_changes: cannot alloc %X bytes (total %d)

check_fs_changes: read failed, error %d, status %X

check_fs_changes: read failed, error %d

FS Change notifiers: %d (actual %d)

DriverObj %p addr %p %s

Cannot read count for %s, error %d

Count of %s is too big - %X

Cannot read %s table, error %d

Cannot read entry %d from table of %s, error %d

check_vista_cmp_list get count failed, error %d, status %X

check_vista_cmp_list get count failed, error %d

check_vista_cmp_list failed, error %d, status %X

check_vista_cmp_list failed, error %d

check_ai_cbs: cannot read ExpDisQueryAttributeInformation, error %d, ntstatus %X

check_ai_cbs: cannot read ExpDisQueryAttributeInformation, error %d

ExpDisQueryAttributeInformation %p %s

check_ai_cbs: cannot read ExpDisSetAttributeInformation, error %d, ntstatus %X

check_ai_cbs: cannot read ExpDisSetAttributeInformation, error %d

ExpDisSetAttributeInformation %p %s

check_dbgk_lkmd: cannot read DbgkLkmd_cblist, error %d, ntstatus %X

check_dbgk_lkmd: cannot read DbgkLkmd_cblist, error %d

DbgkLkmd[%d] callback %p %s

check_fsrtl: cannot read FltMgrCallbacks, error %d, ntstatus %X

check_fsrtl: cannot read FltMgrCallbacks, error %d

FltMgrCallbacks: %p %s

check_fsrtl: cannot read FsRtlpMupCalls, error %d, ntstatus %X

check_fsrtl: cannot read FsRtlpMupCalls, error %d

FsRtlpMupCalls: %p %s

check_Iof: cannot read pIofCallDriver, error %d, ntstatus %X

check_Iof: cannot read pIofCallDriver, error %d

pIofCallDriver %p patched by %s

check_Iof: cannot read pIofCompleteRequest, error %d, ntstatus %X

check_Iof: cannot read pIofCompleteRequest, error %d

pIofCompleteRequest %p patched by %s

check_Iof: cannot read pIoAllocateIrp, error %d, ntstatus %X

check_Iof: cannot read pIoAllocateIrp, error %d

pIoAllocateIrp %p patched by %s

check_Iof: cannot read pIoFreeIrp, error %d, ntstatus %X

check_Iof: cannot read pIoFreeIrp, error %d

pIoFreeIrp %p patched by %s

check_Iof: cannot read HvlpHypercallCodeVa, error %d, ntstatus %X

check_Iof: cannot read HvlpHypercallCodeVa, error %d

HvlpHypercallCodeVa %p patched by %s

%SystemRoot%\System32\sxssrv.dll

%SystemRoot%\System32\csrsrv.dll

%SystemRoot%\System32\basesrv.dll

%SystemRoot%\System32\winsrv.dll

%SystemRoot%\System32\lsasrv.dll

%SystemRoot%\System32\ntdll.dll

KiDebugRoutine %p hooked by %s

PspLegoNotifyRoutine %p hooked by %s

KiTimeUpdateNotifyRoutine %p hooked by %s

KiSwapContextNotifyRoutine %p hooked by %s

KiThreadSelectNotifyRoutine %p hooked by %s

Sysenter patched, addr %p not in %s !!!

Mailslot: %S

NamedPipe: %S

DEVCLASS_MULTIPORTSERIAL

DEVCLASS_PORTS

DEVCLASS_KEYBOARD

DEVCLASS_APMSUPPORT

read_dev_chrs(%S) failed, ntstatus %X

DrvObj %p name %S %s

DrvObj %p nameLen %X %s

dev_props failed, status %X

ClassGUID: %S

ClassGUID: %S - %s

Cannot open directory %S, error %X

Cannot realloc %d bytes

Cannot open device directory, error %X

Cannot open driver directory, error %X

Cannot open FileSystem directory, error %X

Unknown HAL private dispatch table version %X

HalAcpiTimerInit: %p %s

HalAcpiTimerCarry: %p %s

HalAcpiMachineStateInit: %p %s

HalAcpiQueryFlags: %p %s

HalAcpiPicStateIntact: %p %s

HalRestoreInterruptControllerState: %p %s

HalPciInterfaceReadConfig: %p %s

HalPciInterfaceWriteConfig: %p %s

HalSetVectorState: %p %s

HalGetApicVersion: %p %s

HalSetMaxLegacyPciBusNumber: %p %s

HalIsVectorValid: %p %s

HalAcpiGetTableDispatch: %p %s

HalAcpiGetRsdpDispatch: %p %s

HalAcpiGetFacsMappingDispatch: %p %s

HalAcpiGetAllTablesDispatch: %p %s

HalAcpiPmRegisterAvailable: %p %s

HalAcpiPmRegisterRead: %p %s

HalAcpiPmRegisterWrite: %p %s

HalHandlerForBus: %p %s

HalHandlerForConfigSpace: %p %s

HalLocateHiberRanges: %p %s

HalRegisterBusHandler: %p %s

HalSetWakeEnable: %p %s

HalSetWakeAlarm: %p %s

HalPciTranslateBusAddress: %p %s

HalPciAssignSlotResources: %p %s

HalHaltSystem: %p %s

HalFindBusAddressTranslation: %p %s

HalResetDisplay: %p %s

HalHandlerForBus: %p %s

HalHandlerForConfigSpace: %p %s

HalLocateHiberRanges: %p %s

HalRegisterBusHandler: %p %s

HalSetWakeEnable: %p %s

HalSetWakeAlarm: %p %s

HalPciTranslateBusAddress: %p %s

HalPciAssignSlotResources: %p %s

HalHaltSystem: %p %s

HalFindBusAddressTranslation: %p %s

HalResetDisplay: %p %s

KdSetupPciDeviceForDebugging: %p %s

KdReleasePciDeviceforDebugging: %p %s

KdGetAcpiTablePhase0: %p %s

KdCheckPowerButton: %p %s

HalVectorToIDTEntry: %p %s

KdMapPhysicalMemory64: %p %s

KdUnmapVirtualAddress: %p %s

HalMmMemoryUsage: %p %s

HalAllocateMapRegisters: %p %s

KdGetPciDataByOffset: %p %s

KdSetPciDataByOffset: %p %s

HalGetInterruptVector: %p %s

HalGetVectorInput: %p %s

HalLoadMicrocode: %p %s

HalUnloadMicrocode: %p %s

HalMcUpdatePostUpdate: %p %s

HalAllocateMessageTarget: %p %s

HalFreeMessageTarget: %p %s

HalDpReplaceBegin: %p %s

HalDpReplaceTarget: %p %s

HalDpReplaceControl: %p %s

HalDpReplaceEnd: %p %s

HalPrepareForBugcheck: %p %s

HalQueryWakeTime: %p %s

HalReportIdleStateUsage: %p %s

HalHandlerForBus: %p %s

HalHandlerForConfigSpace: %p %s

HalLocateHiberRanges: %p %s

HalRegisterBusHandler: %p %s

HalSetWakeEnable: %p %s

HalSetWakeAlarm: %p %s

HalPciTranslateBusAddress: %p %s

HalPciAssignSlotResources: %p %s

HalHaltSystem: %p %s

HalFindBusAddressTranslation: %p %s

HalResetDisplay: %p %s

HalAllocateMapRegisters: %p %s

KdSetupPciDeviceForDebugging: %p %s

KdReleasePciDeviceforDebugging: %p %s

KdGetAcpiTablePhase0: %p %s

KdCheckPowerButton: %p %s

HalVectorToIDTEntry: %p %s

KdMapPhysicalMemory64: %p %s

KdUnmapVirtualAddress: %p %s

KdGetPciDataByOffset: %p %s

KdSetPciDataByOffset: %p %s

HalGetInterruptVector: %p %s

HalGetVectorInput: %p %s

HalLoadMicrocode: %p %s

HalUnloadMicrocode: %p %s

HalMcUpdatePostUpdate: %p %s

HalAllocateMessageTarget: %p %s

HalFreeMessageTarget: %p %s

HalDpReplaceBegin: %p %s

HalDpReplaceTarget: %p %s

HalDpReplaceControl: %p %s

HalDpReplaceEnd: %p %s

HalPrepareForBugcheck: %p %s

HalQueryWakeTime: %p %s

HalReportIdleStateUsage: %p %s

HalTscSynchronization: %p %s

HalWheaInitProcessorGenericSection: %p %s

HalStopLegacyUsbInterrupts: %p %s

HalReadWheaPhysicalMemory: %p %s

HalWriteWheaPhysicalMemory: %p %s

HalDpMaskLevelTriggeredInterrupts: %p %s

HalDpUnmaskLevelTriggeredInterrupts: %p %s

HalDpGetInterruptReplayState: %p %s

HalDpReplayInterrupts: %p %s

HalQueryIoPortAccessSupported: %p %s

HalHandlerForBus: %p %s

HalHandlerForConfigSpace: %p %s

HalLocateHiberRanges: %p %s

HalRegisterBusHandler: %p %s

HalSetWakeEnable: %p %s

HalSetWakeAlarm: %p %s

HalPciTranslateBusAddress: %p %s

HalPciAssignSlotResources: %p %s

HalHaltSystem: %p %s

HalFindBusAddressTranslation: %p %s

HalResetDisplay: %p %s

HalAllocateMapRegisters: %p %s

KdSetupPciDeviceForDebugging: %p %s

KdReleasePciDeviceforDebugging: %p %s

KdGetAcpiTablePhase0: %p %s

KdCheckPowerButton: %p %s

HalVectorToIDTEntry: %p %s

KdMapPhysicalMemory64: %p %s

KdUnmapVirtualAddress: %p %s

KdGetPciDataByOffset: %p %s

KdSetPciDataByOffset: %p %s

HalGetInterruptVector: %p %s

HalGetVectorInput: %p %s

HalLoadMicrocode: %p %s

HalUnloadMicrocode: %p %s

HalMcUpdatePostUpdate: %p %s

HalAllocateMessageTarget: %p %s

HalFreeMessageTarget: %p %s

HalDpReplaceBegin: %p %s

HalDpReplaceTarget: %p %s

HalDpReplaceControl: %p %s

HalDpReplaceEnd: %p %s

HalPrepareForBugcheck: %p %s

HalQueryWakeTime: %p %s

HalReportIdleStateUsage: %p %s

HalTscSynchronization: %p %s

HalWheaInitProcessorGenericSection: %p %s

HalStopLegacyUsbInterrupts: %p %s

HalReadWheaPhysicalMemory: %p %s

HalWriteWheaPhysicalMemory: %p %s

HalInterruptMaskLevelTriggeredLines: %p %s

HalInterruptUnmaskLevelTriggeredLines: %p %s

HalDpGetInterruptReplayState: %p %s

HalDpReplayInterrupts: %p %s

HalQueryIoPortAccessSupported: %p %s

KdSetupIntegratedDeviceForDebugging: %p %s

KdReleaseIntegratedDeviceForDebugging: %p %s

HalEnlightenmentInitialize: %p %s

HalAllocateEarlyPages: %p %s

HalMapEarlyPages: %p %s

HalTimerGetClockOwner: %p %s

HalTimerGetClockConfiguration: %p %s

HalTimerNotifyProcessorFreeze: %p %s

HalTimerPrepareProcessorForIdle: %p %s

HalDiagRegisterLogRoutine: %p %s

HalTimerResumeProcessorFromIdle: %p %s

HalTimerResetLastClockTick: %p %s

HalVectorToIDTEntryEx: %p %s

HalSecondaryInterruptQueryPrimaryInformation: %p %s

HalMaskInterrupt: %p %s

HalUnmaskInterrupt: %p %s

HalIsInterruptTypeSecondary: %p %s

HalAllocateGsivForSecondaryInterrupt: %p %s

HalAddInterruptRemapping: %p %s

HalRemoveInterruptRemapping: %p %s

HalSaveAndDisableEnlightenment: %p %s

HalRestoreHvEnlightenment: %p %s

HalPciEarlyRestore: %p %s

HalInterruptGetLocalIdentifier: %p %s

HalAllocatePmcCounterSet: %p %s

HalCollectPmcCounters: %p %s

HalFreePmcCounterSet: %p %s

HalTimerQueryCycleCounter: %p %s

HalTimerGetNextTickDuration: %p %s

HalPciMarkHiberPhase: %p %s

HalInterruptQueryProcessorRestartEntryPoint: %p %s

HalInterruptRequestSecondaryInterrupt: %p %s

HalInterruptEnumerateUnmaskedInterrupts: %p %s

HalBiosDisplayReset: %p %s

HalGetDmaAdapter: %p %s

HalCheckPowerButton: %p %s

HalMapPhysicalMemoryWriteThrough64: %p %s

HalUnmapVirtualAddress: %p %s

HalKdReadPCIConfig: %p %s

HalKdWritePCIConfig: %p %s

HalTimerQueryWakeTime: %p %s

HalTimerReportIdleStateUsage: %p %s

HalKdEnumerateDebuggingDevices: %p %s

HalFlushIoRectangleExternalCache: %p %s

HalPowerEarlyRestore: %p %s

HalQueryCapsuleCapabilities: %p %s

HalUpdateCapsule: %p %s

HalPciMultiStageResumeCapable: %p %s

check_hal_private_disp_table: cannot read table, error %d, ntstatus %X

check_hal_private_disp_table: cannot read table, error %d

check_hal_disp_table: cannot read table, error %d, ntstatus %X

check_hal_disp_table: cannot read table, error %d

HalQuerySystemInformation: %p %s

HalSetSystemInformation: %p %s

HalQueryBusSlots: %p %s

HalExamineMBR: %p %s

HalIoReadPartitionTable: %p %s

HalIoSetPartitionInformation: %p %s

HalIoWritePartitionTable: %p %s

HalReferenceHandlerForBus %p %s

HalReferenceBusHandler %p %s

HalDereferenceBusHandler %p %s

HalInitPnpDriver %p %s

HalInitPowerManagement %p %s

HalGetDmaAdapter %p %s

HalGetInterruptTranslator %p %s

HalStartMirroring %p %s

HalEndMirroring %p %s

HalMirrorPhysicalMemory %p %s

HalEndOfBoot %p %s

HalMirrorVerify %p %s

HalGetCachedAcpiTable %p %s

HalSetPciErrorHandlerCallback %p %s

read_hal_apci_disp_table return %X bytes, error %d, ntstatus %X

read_hal_apci_disp_table return %X bytes, error %d

Bad HalAcpiDispatchTable version: %X

read_gdt_size failed, error %d, ntstatus %X

read_gdt_size failed, error %d

Cannot alloc %d bytes for GDT entries

read_gdt failed, error %d, ntstatus %X

read_gdt failed, error %d

Descriptor[%d] %s S %d DPL %d type %X base %X limit %X

WinChecker::dump_ldt failed, error %X, ntstatus %X

WinChecker::dump_ldt failed, error %X

WinChecker::dump_ldt: cannot alloc ldt array, size %X

Ldt[%d]:

Base: X

Limit: X

AVL: %d

D/B: %d

DPL: %d

G: %d

P: %d

S: %d

Type: %d

Cannot read code for kinterrupt(%X) thunk, error %d

IDT patched: unknown type %X selector %X addr %p for int%X

IDT patched: unknown selector %X for int%X

IDT patched: int%X has unknown selector %X base %X limit %X addr %p

IDT patched: int%X addr %p by module %s

IDT int%X addr %p KINTERRUPT %p

IDT patched: int%X addr %p

Int%X: selector %X type TASK DPL %X base %X limit %X

Int%X: selector %X type %X DPL %X addr %p base %X limit %X

Int%X: selector %X type %X DPL %X addr %p

read_idt_size failed, error %d, ntstatus %X

read_idt_size failed, error %d

read_idt: cannot alloc %d bytes for IDT storage

read_idt failed, error %d, ntstatus %X

read_idt failed, error %d

Cannot read kinterrupt (%X), error %d

KInterrupt %X (%p):

Size %X type %X

ServiceRoutine %p %s

DispatchAddress %p %s

check_ob_types: cannot read size of ObTypes list, error %d, ntstatus %X

check_ob_types: cannot read size of ObTypes list, error %d

check_ob_types: cannot read %d bytes (readed %d), error %d, ntstatus %X

check_ob_types: cannot read %d bytes (readed %d), error %d

fill_ob_type: cannot read ObType %S (%X), error %d

Cannot read ObType %S (%X), error %d

ObType %S:

DumpProcedure: %p %s

OpenProcedure: %p %s

CloseProcedure: %p %s

DeleteProcedure: %p %s

ParseProcedure: %p %s

SecurityProcedure: %p %s

QueryNameProcedure: %p %s

OkayToCloseProcedure: %p %s

ZwAlpcConnectPortEx

ZwOpenKeyTransactedEx

ZwOpenKeyEx

ZwOpenKeyTransacted

ZwCreateKeyTransacted

ZwAlpcSendWaitReceivePort

ZwAlpcImpersonateClientOfPort

ZwAlpcDisconnectPort

ZwAlpcDeletePortSection

ZwAlpcCreatePortSection

ZwAlpcCreatePort

ZwAlpcConnectPort

ZwAlpcAcceptConnectPort

ZwUnloadKey2

ZwQueryOpenSubKeysEx

ZwLoadKeyEx

ZwQueryPortInformationProcess

ZwWaitForKeyedEvent

ZwReleaseKeyedEvent

ZwOpenKeyedEvent

ZwCreateKeyedEvent

ZwUnloadKeyEx

ZwSaveKeyEx

ZwRenameKey

ZwLockRegistryKey

ZwLockProductActivationKeys

ZwCompressKey

ZwCompactKeys

ZwYieldExecution

ZwUnloadKey

ZwSetValueKey

ZwSetThreadExecutionState

ZwSetInformationKey

ZwSetDefaultHardErrorPort

ZwSecureConnectPort

ZwSaveMergedKeys

ZwSaveKey

ZwRestoreKey

ZwRequestWaitReplyPort

ZwRequestPort

ZwReplyWaitReplyPort

ZwReplyWaitReceivePortEx

ZwReplyWaitReceivePort

ZwReplyPort

ZwReplaceKey

ZwRegisterThreadTerminatePort

ZwQueryValueKey

ZwQueryOpenSubKeys

ZwQueryMultipleValueKey

ZwQueryKey

ZwQueryInformationPort

ZwOpenKey

ZwNotifyChangeMultipleKeys

ZwNotifyChangeKey

ZwLoadKey2

ZwLoadKey

ZwListenPort

ZwImpersonateClientOfPort

ZwFlushKey

ZwEnumerateValueKey

ZwEnumerateKey

ZwDeleteValueKey

ZwDeleteKey

ZwDelayExecution

ZwCreateWaitablePort

ZwCreatePort

ZwCreateNamedPipeFile

ZwCreateKey

ZwConnectPort

ZwCompleteConnectPort

ZwAcceptConnectPort

FindKiServiceTable: relocation type %d found at X

Cannot read body of %s !

Cannot extract index of %s, error %d

kernel %s don`t contains KeServiceDescriptorTable function !

Cannot find SDT in %s

Cannot read ntdll.dll

Cannot read body of %s!

Cannot read body of ZwYieldExecution!

Cannot extract index of ZwYieldExecution, error %d

Cannot extract index of ZwPlugPlayControl , error %d

%s: %p

SDT entry %X (%s) hooked %p %s!

SDT entry %X hooked %p %s!

Need unhook %d items in SSDT

UNHOOK_ITEM: Index %X Offset %X

Unhook SSDT failed, lasterror %d

Unhooked %d SSDT items

NtUserSetProcessRestrictionExemption

NtUserAcquireIAMKey

NtGdiDdDDICreateKeyedMutex2

NtGdiDdDDIOpenKeyedMutex2

NtGdiDdDDIAcquireKeyedMutex2

NtGdiDdDDIReleaseKeyedMutex2

NtUserSetTHQAPublicKey

NtGdiDdDDIReleaseKeyedMutex

NtGdiDdDDIAcquireKeyedMutex

NtGdiDdDDIDestroyKeyedMutex

NtGdiDdDDIOpenKeyedMutex

NtGdiDdDDICreateKeyedMutex

NtUserEndTouchOperation

NtUserSfmDxReportPendingBindingsToDwm

NtGdiDDCCIGetTimingReport

NtUserUnregisterSessionPort

NtUserRegisterSessionPort

NtUserRegisterErrorReportingDialog

NtGdiSetOPMSigningKeyAndSequenceNumbers

NtGdiGetCertificateSize

NtGdiGetCertificate

NtUserWaitForMsgAndEvent

NtUserVkKeyScanEx

NtUserUnregisterHotKey

NtUserUnlockWindowStation

NtUserUnloadKeyboardLayout

NtUserUnhookWindowsHookEx

NtUserSetWindowStationUser

NtUserSetWindowsHookEx

NtUserSetWindowsHookAW

NtUserSetProcessWindowStation

NtUserSetKeyboardState

NtUserSetImeHotKey

NtUserSetConsoleReserveKeys

NtUserRegisterHotKey

NtUserOpenWindowStation

NtUserMapVirtualKeyEx

NtUserLockWindowStation

NtUserLoadKeyboardLayoutEx

NtUserGetProcessWindowStation

NtUserGetKeyState

NtUserGetKeyNameText

NtUserGetKeyboardState

NtUserGetKeyboardLayoutName

NtUserGetKeyboardLayoutList

NtUserGetImeHotKey

NtUserGetCPD

NtUserGetAsyncKeyState

NtUserCreateWindowStation

NtUserCloseWindowStation

NtUserCheckImeHotKey

NtUserCallMsgFilter

NtUserAlterWindowStyle

NtUserActivateKeyboardLayout

NtGdiScaleViewportExtEx

NtGdiDvpWaitForVideoPortSync

NtGdiDvpUpdateVideoPort

NtGdiDvpGetVideoPortConnectInfo

NtGdiDvpGetVideoPortOutputFormats

NtGdiDvpGetVideoPortLine

NtGdiDvpGetVideoPortInputFormats

NtGdiDvpGetVideoPortFlipStatus

NtGdiDvpGetVideoPortField

NtGdiDvpGetVideoPortBandwidth

NtGdiDvpFlipVideoPort

NtGdiDvpDestroyVideoPort

NtGdiDvpCreateVideoPort

NtGdiDvpCanCreateVideoPort

NtGdiDdSetColorKey

read_shadow_sdt failed, error %d

check_win32k_sdt: cannot alloc %d bytes

Cannot read win32k_sdt at %p size %X, error %d

win32k_sdt[%d] (%s) hooked, addr %p %s

win32k_sdt[%d] hooked, addr %p %s

GetNamedPipeServerProcessId

read_kddb read %X bytes, error %d

cannot read MmNonPagedPoolStart (%p), error %d

cannot read MmNonPagedPoolEnd (%p), error %d

cannot read MmPagedPoolStart (%p), error %d

cannot read MmPagedPoolEnd (%p), error %d

cannot read KernelVerifier (%p), error %d

WindowsType: %S

ETHREAD.StartAddress %X

KiProcessorBlock: %p (%X)

KernelVerifier: %X

KeBugCheckCallbackList: %p (%X)

WorkerRoutine: %p %s

IdleFunction: %p %s

IdleFunction: %p %s

KPRCB[%d].WorkerRoutine: %p %s

KPRCB[%d].IdleFunction: %p %s

KPRCB[%d].IdleFunction: %p %s

read_kpcr return %X bytes, error %d, ntstatus %X

read_kpcr return %X bytes, error %d

KPCR[%d] %p major %X minor %X

KPCR[%d] %p

get_os_info return %X bytes, error %d, ntstatus %X

get_os_info return %X bytes, error %d

NtMajorVersion: %d

NtMinorVersion: %d

BuildNumber: %d

GlobalFlag: %X

Processors: %d

MmVerifierFlags %d

MmSystemSize %d %s

DebuggerEnabled %d

DebuggerNotPresent %d

SafeBootMode %d

NXSupportPolicy %X

CR0 %8.8X %s

CR4 %8.8X %s

Cannot open mailslot %S, error %d

get_mail_slot_owner(%S): returned %d bytes, error %d, ntstatus %X

get_mail_slot_owner(%S): returned %d bytes, error %d

Cannot open named pipe %S, error %d

GetNamedPipeServerProcessId(%S) failed, error %d

get_named_pipe_owner(%S): returned %d bytes, error %d, ntstatus %X

get_named_pipe_owner(%S): returned %d bytes, error %d

read_lpc_port_chars: len %d, returned %d bytes, error %d, ntstatus %X

read_lpc_port_chars: len %d, returned %d bytes, error %d

read_unicode_string: len %d, returned %d bytes, error %d, ntstatus %X

read_unicode_string: len %d, returned %d bytes, error %d

read_drivers_list: cannot get size of drivers list, returned %d bytes, error %d, ntstatus %X

read_drivers_list: cannot get size of drivers list, returned %d bytes, error %d

read_drivers_list: cannot alloc %X bytes for driver list

read_drivers_list: cannot read drivers list, error %d, ntstatus %X

read_drivers_list: cannot read drivers list, error %d

%p:%X flags %X LoadCount %d %s

read_KiThreadSelectNotifyRoutine failed, error %d

read_KiSwapContextNotifyRoutine failed, error %d

read_KiTimeUpdateNotifyRoutine failed, error %d

read_PspLegoNotifyRoutine failed, error %d

read_KiDebugRoutine failed, error %d

read_msrs failed, error %d, ntstatus %X

read_msrs failed, error %d

IManageProcess: Cannot OpenProcess %d

IManageProcess: Cannot open process %d

read_win32_process for PID %X failed, error %d, status %X

read_win32_process for PID %X failed, error %d

read_dword(%p, PID %d) failed, error %d, ntstatus %X

read_dword(%p, PID %d) failed, error %d

read_ptr(%p, PID %d) failed, error %d, ntstatus %X

read_ptr(%p, PID %d) failed, error %d

rp_ReadProcessMemory(%p size %X) from %p error %d

read_token for PID %X failed, error %d, status %X

read_token for PID %X failed, error %d

open_proc(%d, access %X) failed, error %d, ntstatus %X

open_proc(%d, access %X) failed, error %d

rp_OpenProcess(%d, access %X) dwRet %d, error %d

rp_TerminateProcess(%p, %X) dwRet %d, error %d

Major %d Minor %d BuildNumber %d PlatformId %d ServicePackMajor %d ServicePackMinor %d SuiteMask %d ProductType %d CSDVersion %S

ProductType: %X

Cannot open RPC control, error %X

msgsvcsend

_ILocalObjectExporter

IVsShell

IWbemLoginClientID

ICertProtect

_IBTFTPApiEvents

_s_PasswordRecovery

wininet_UrlCache

_IObjectExporter

WMsgAPIs

WMsgKAPIs

INCryptKeyIso

HttpProxyMgrProvider

IKeySvcR

WcnTransportRpc

IPortResolve

IWbemLoginHelper

LRpcSIDKey

ISmartCardRootCerts

IDebugPortSupplier2

IAsyncOperation

IPipelineElement

OnlineProviderCertInterface

IBackgroundCopyJobHttpOptions

HttpProxyMgrClient

IStaticPortMappingCollection

IKeySvc

s_WindowsShutdown

IWebBrowser2

IDebugPortSupplierLocale2

IUPnPHttpHeaderControl

WINHTTP_AUTOPROXY_SERVICE

IErcLuaSupport

IDebugPortSupplier3

IKeySvc2

BackupKey

IWerReport

ICertPassage

IStaticPortMapping

IDebugPortSupplierEx2

IWbemLevel1Login

IWebBrowserApp

msgsvc

IShellWindows

RpcBindingFromStringBinding(%S) failed: %d

RpcMgmtInqIfIds(%S) failed: %d

RpcStringBindingCompose failed: %d

RpcBindingFromStringBinding failed: %d

RpcMgmtInqIfIds failed: %d

%8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X version %d.%d : %s

%8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X version %d.%d : (%s)

RpcMgmtEpEltInqBegin failed: %d

Cannot read npc table, readed %X bytes

rpcrt4

%s.AddressChangeFn: %p %s

rpcrt4_hack::check_myself: exception %d occured

rpcrt4_hack::try_hack: cannot find RpcServerRegisterIfEx

I_RpcInitNdrImports

load_driver(%S) returned %X

Loaded kernel driver: %S

Error loading kernel driver: %ls - 0xx

Error loading kernel driver: %S - 0xx

Error loading kernel driver: %S - OpenSCManager 0xx

tcpip

ClientImmProcessKey

fnHkOPTINLPEVENTMSG

fnHkINLPMSG

fnSENTDDEMSG

fnDWORDOPTINLPMSG

RealMsgWaitForMultipleObjectsEx

PEB.KernelCallbackTable patched, %p

user32_hack::try_hack: bad PE passed

user32_hack::try_hack: cannot read import table

pfnWowMsgBoxIndirectCallback

Unknown apfnDispatch size: %d

%s_hack::try_hack: bad PE passed

%s_hack::try_hack: cannot read exports, error %d

%s_hack::try_hack: cannot find section .data

%s_hack::try_hack: cannot read section .data

%s_hack::try_hack: cannot read section .rdata

%s_hack::try_hack: cannot find section .text

%s_hack::try_hack: cannot read section .text

DxgkReleaseKeyedMutex2

DxgkAcquireKeyedMutex2

DxgkOpenKeyedMutex2

DxgkCreateKeyedMutex2

DxgkReleaseKeyedMutex

DxgkAcquireKeyedMutex

DxgkDestroyKeyedMutex

DxgkOpenKeyedMutex

DxgkCreateKeyedMutex

Cannot read gDxgkInterface, readed %X bytes

WindowHasShadow

DisableProcessWindowsGhosting

zzzUnhookWindowsHook

xxxUpdateWindows

xxxArrangeIconicWindows

SetWindowState

ClearWindowState

SetMsgBox

GetKeyboardType

GetKeyboardLayout

RemotePassthruDisable

xxxRemotePassthruEnable

Cannot read gpsi, readed %X bytes

Cannot read gpsi handlers, readed %X bytes

Cannot read apfnSimpleCall, readed %X bytes

Cannot read gapfnMessageCall, readed %X bytes

Cannot read gapfnScSendMessage, readed %X bytes

Cannot read gaNewProcAddresses, readed %X bytes

Cannot open logfile %S

Cannot create stop event, error %d

Driver %S loaded from %S

SrvGetConsoleKeyboardLayoutName

SrvSetConsoleKeyShortcuts

SrvGetConsoleAliasExes

SrvGetConsoleAliasExesLength

SrvVDMConsoleOperation

SrvGetLargestConsoleWindowSize

SrvExitWindowsEx

winsrv.dll

Unknown size of ConsoleServerApiDispatchTable: %d

Unknown size of UserServerApiDispatchTable: %d

CallUserpExitWindowsEx

GetConsoleAliasExesInternal

GetConsoleAliasExesLengthInternal

SetConsoleKeyShortcuts

GetConsoleKeyboardLayoutNameWorker

SetConsoleOutputCPInternal

GetConsoleOutputCP

GetLargestConsoleWindowSize

reg_ccs_services::read failed - error %d

Cannot open key %S, error %d

SafeSecondaryLog(%d) failed, error %d

SafeSecondaryLog failed, error %d

SafeSendLog(%d) failed, error %d

SafeSendLog failed, error %d

Bad memory %p len %X in dump_hex_buffer

Cannot alloc %d bytes for delayed imports

Cannot alloc %d bytes for imports

read_import_safe(%s) failed %X

Cannot realloc %d bytes for iat

read_delayed_safe(%s) failed %X

store2md_cache: cannot alloc %d bytes

store2md_cache: cannot realloc, alloced %d bytes

wdigest.dll

tspkg.dll

schannel.dll

pku2u.dll

negoexts.dll

msv1_0.dll

livessp.dll

kerberos.dll

umpnpmgr.dll

combase.dll

ntdsa.dll

ntdll.dll

cryptbase.dll

ncrypt.dll

rpcrt4.dll

imm32.dll

user32.dll

kernelbase.dll

kernel32.dll

advapi32.dll

ole32.dll

Cannot alloc %X bytes for relocs

SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired

WS2_32.dll

RPCRT4.dll

GetProcessHeap

GetWindowsDirectoryA

KERNEL32.dll

RegCloseKey

RegOpenKeyExW

RegOpenKeyExA

RegCreateKeyExW

ADVAPI32.dll

GetWindowsDirectoryW

GetCPInfo

RegQueryInfoKeyW

RegEnumKeyW

zcÁ

.?AVMyWindowsChecker@@

.?AV?$rpcrt4_hack@U_IMAGE_NT_HEADERS@@@@

.?AVtcpip_hack@@

.?AV?$import_holder@U_IMAGE_NT_HEADERS@@@CMN@@

.?AVinmem_import_holder@CMN@@

.?AVimport_holder_intf@CMN@@

.?AVmodule_import@CMN@@

aR.Rn

X.UJ^A

w%xyW

f.Gkf

%0X0m0

>$?(?,?0?

3&4;456?90:

77g7

7>7[7`7|7

6#8*878^8~8

11_1
0#101#202
0 11h1J3
6%7S7
7*717>7[8
=!>&>9>>>
7&7@7l78N8V8z8
:);4;>;\;
0%0X0
= >$>(>,>0>
?,?4?\?|?
.----/01/01/01
KERNEL32.DLL
mscoree.dll
U%SystemRoot%\system32\svchost.exe
%SystemRoot%\system32\svchost
WSOCKTRANSPORT
TCPIP6
TCPIP
STORPORT
STORMINIPORT
SOFTPCI
SCSIPORT
SCSIMINIPORT
SBP2PORT
FCPORT
PassiveWatchdogTimeout
sImageExecutionOptions
ErrorPortStartTimeout
ErrorPortCommTimeout
DisablePagingExecutive
DebuggerMaxModuleMsgs
CountOperations
B\\.\
Psapi.dll
sWindows PowerShell
tHost Process for Windows Tasks
Windows Problem Reporting 32 bit
Windows Problem Reporting
Windows Modules Installer
mWindows Start-Up Application
tWindows Search Indexer
sWindows Server Initial Configuration Tasks
Windows Media Player
Dump Reporting Tool
Error Reporter
rWindows Control Panel 32 bit
Windows Control Panel
Windows Connect Now - Config Registrar Service
Windows Media Player Network Sharing Service
Windows firewall
Windows Error Reporting Service
tWindows Defender
vError reporting service
eWindows update service
Windows Image Acquisition
WebClient
tWindows Security Center Notification App
yWindows Based Script Host
Windows installer 32 bit
Windows installer
Windows 16-bit Virtual Machine
Windows Management Instrumentation
Windows User Mode Driver Manager
MS tftp
MS ftp 32 bit
MS ftp
Microsoft Help and Support Center
Cmd.exe 32 bit
Cmd.exe
Windows Logon User Interface Host
Windows update
tGoogle Chrome
rOpera Internet Browser
Mozilla Thunderbird Mail and News Client
dFirefox browser
Services.exe
%SystemRoot%\msagent\agentsvr.exe
%SystemRoot%\System32\dfrgfat.exe
%SystemRoot%\System32\dfrgntfs.exe
%SystemRoot%\System32\services.exe
%SystemRoot%\System32\svchost.exe
%SystemRoot%\System32\alg.exe
%SystemRoot%\System32\spoolsv.exe
%SystemRoot%\System32\net.exe
%SystemRoot%\System32\net1.exe
%SystemRoot%\System32\cmd.exe
%SystemRoot%\System32\notepad.exe
%SystemRoot%\System32\calc.exe
%SystemRoot%\System32\PTF.exe
%SystemRoot%\System32\tPTF.exe
%SystemRoot%\System32\telnet.exe
%SystemRoot%\System32\taskkill.exe
%SystemRoot%\System32\ctfmon.exe
%SystemRoot%\System32\wdfmgr.exe
%SystemRoot%\System32\mmc.exe
%SystemRoot%\System32\userinit.exe
%SystemRoot%\System32\wbem\wmiprvse.exe
%SystemRoot%\System32\wbem\wmiadap.exe
%SystemRoot%\explorer.exe
%SystemRoot%\System32\lsass.exe
%SystemRoot%\System32\winlogon.exe
%SystemRoot%\System32\LogonUI.exe
%SystemRoot%\System32\wuauclt.exe
%SystemRoot%\System32\wuauclt1.exe
%SystemRoot%\System32\CCM\CcmExec.exe
%SystemRoot%\System32\csrss.exe
%SystemRoot%\System32\smss.exe
\SystemRoot\System32\smss.exe
%SystemRoot%\System32\inetsrv\w3wp.exe
%SystemRoot%\System32\schtasks.exe
%SystemRoot%\System32\tstheme.exe
%SystemRoot%\System32\control.exe
%SystemRoot%\System32\taskmgr.exe
%SystemRoot%\System32\dwwin.exe
%SystemRoot%\System32\drwtsn32.exe
%SystemRoot%\System32\dumprep.exe
%SystemRoot%\System32\dfssvc.exe
%SystemRoot%\System32\dllhost.exe
%SystemRoot%\System32\ntvdm.exe
%SystemRoot%\System32\rundll32.exe
%SystemRoot%\System32\msiexec.exe
%SystemRoot%\System32\mshta.exe
%SystemRoot%\System32\regsvr32.exe
%SystemRoot%\System32\cscript.exe
%SystemRoot%\System32\wscript.exe
%SystemRoot%\System32\wscntfy.exe
%SystemRoot%\System32\mstsc.exe
%SystemRoot%\System32\dashost.exe
far.exe
Far.exe
CLSID\{FC7D9E02-3F9E-11d3-93C0-00C04F72DAF7}\InprocServer32
CLSID\{73FDDC80-AEA9-101A-98A7-00AA00374959}\LocalServer32
CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32
iedw.exe
%SystemRoot%\System32\oobechk.exe
%SystemRoot%\System32\oobe.exe
%SystemRoot%\System32\psxss.exe
%SystemRoot%\System32\internat.exe
AcroRd32.exe
excel.exe
outlook.exe
winword.exe
powerpnt.exe
wmplayer.exe
firefox.exe
thunderbird.exe
Opera.exe
WinRAR.exe
%SystemRoot%\System32\wininit.exe
%SystemRoot%\System32\lsm.exe
%SystemRoot%\System32\dwm.exe
%SystemRoot%\System32\werfault.exe
%SystemRoot%\System32\taskeng.exe
%SystemRoot%\System32\conime.exe
%SystemRoot%\System32\wudfhost.exe
%SystemRoot%\System32\taskhost.exe
%SystemRoot%\System32\conhost.exe
%SystemRoot%\System32\rdpclip.exe
%SystemRoot%\System32\SearchFilterHost.exe
%SystemRoot%\System32\SearchProtocolHost.exe
csrss.exe
svchost.exe
alg.exe
sPptpMiniport
Tcpip
psapi.dll
127.0.0.1
\\.\pipe\
\\.\mailslot\
SOFTWARE\Microsoft\Windows NT\CurrentVersion
\\.\Pipe\
\\.\Mailslot\
ncacn_ip_tcp:
ncadg_ip_udp:
\\pipe\\
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\
SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell
RemediationExe
SOFTWARE\Classes\SCCM.VAppLauncher\shell\Open\command
SOFTWARE\Classes\CLSID\{00AAB372-0D6D-4976-B5F5-9BC7605E30BB}\LocalServer32
SOFTWARE\Classes\CLSID\{3C296D07-90AE-4FAC-86F9-65EAA8B82D22}\LocalServer32
SOFTWARE\Classes\CLSID\{D63B10C5-BB46-4990-A94F-E40B9D520160}\LocalServer32
SOFTWARE\Classes\CLSID\{03e64e17-b220-4052-9b9b-155f9cb8e016}\LocalServer32
SOFTWARE\Classes\CLSID\{1F69F884-285E-418E-9715-B9EEE402DD5F}\LocalServer32
Software\Microsoft\Windows\CurrentVersion\WINEVT\publishers
Windows checker
1.0.0.3432
wincheck.exe
0, 0, 8, 16
fGAwoYMM.exe_1616_rwx_05740000_00001000:
.text
`.rdata
@.data
fGAwoYMM.exe_1616_rwx_05750000_00001000:
.text
`.rdata
@.data
NesIMIQs.exe_1664_rwx_00401000_00069000:
3E.Pcq:P!V^
#%Xkq.
.JF{
U%Sa@
('%D^q-*
?|Q%f
SE?.rn~M*
.Dhe4
E.IdJWH
%k%cn>x_
?%uRc!
%3.UGiO0
]w.LQ
I 4keyy
L%C['
7.BLP
;.StH 
>.Qlx #6
Microsoft Windows
P.yrBX.
PB]%C
%FoS(
F<.cs>NesIMIQs.exe_1664_rwx_00900000_00068000:
3E.Pcq:P!V^
#%Xkq.
.JF{
U%Sa@
('%D^q-*
?|Q%f
SE?.rn~M*
.Dhe4
E.IdJWH
%k%cn>x_
?%uRc!
%3.UGiO0
]w.LQ
I 4keyy
L%C['
7.BLP
;.StH 
>.Qlx #6
$g.Gd
P.yrBX.
PB]%C
%FoS(
F<.cs>NesIMIQs.exe_1664_rwx_00980000_00001000:
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp
NesIMIQs.exe_1664_rwx_00BC0000_00001000:
%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM
NesIMIQs.exe_1664_rwx_00BD0000_00001000:
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs
NesIMIQs.exe_1664_rwx_00BE0000_00001000:
%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.inf
NesIMIQs.exe_1664_rwx_00BF0000_00001000:
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.inf
NesIMIQs.exe_1664_rwx_00C00000_00001000:
%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe
NesIMIQs.exe_1664_rwx_00C10000_00001000:
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe
NesIMIQs.exe_1664_rwx_00C40000_00001000:
fGAwoYMM.exe
NesIMIQs.exe_1664_rwx_00C50000_00001000:
NesIMIQs.exe
NesIMIQs.exe_1664_rwx_00C60000_00001000:
taskkill /FI "USERNAME eq adm" /F /IM fGAwoYMM.exe
NesIMIQs.exe_1664_rwx_00C70000_00001000:
taskkill /FI "USERNAME eq adm" /F /IM NesIMIQs.exe
NesIMIQs.exe_1664_rwx_00C80000_00001000:
%Documents and Settings%\All Users\JuwEIgUE\reIEcoQI.exe
NesIMIQs.exe_1664_rwx_00C90000_00001000:
%Documents and Settings%\All Users\KAAo.txt
NesIMIQs.exe_1664_rwx_00CA0000_00001000:
notepad.exe "%Documents and Settings%\All Users\KAAo.txt"
NesIMIQs.exe_1664_rwx_00CB0000_00001000:
%Documents and Settings%\All Users\JuwEIgUE
reIEcoQI.exe_1276_rwx_00401000_00069000:
/.-,3210'&%$ *)(
0/.-4321('&%, *)
.ywW6
.uO_6
"$&(*,.0
3E.Pcq:P!V^
#%Xkq.
2468:@
.JF{
U%Sa@
('%D^q-*
?|Q%f
SE?.rn~M*
.Dhe4
E.IdJWH
%k%cn>x_
?%uRc!
%3.UGiO0
]w.LQ
I 4keyy
L%C['
7.BLP
.bN$ 
ok.dj-U
;.StH 
>.Qlx #6
2software\microsoft\windows\currentversion\run
..yEjoe~51Ku58x(w9'vY2'
$~,1.\01.T80.MY
8..W,).bY
*.KN&s7
3={54/{-8
89l0>.MY
u>2%MY>'s;]8u:6.nY:.n128n;$%{48Kr-2%iY>$t78(nY4$y-18u:6.nY..t=]8
 .KT
P.yrBX.
PB]%C
%FoS(
F<.cs>reIEcoQI.exe_1276_rwx_00680000_00068000:
.ywW6
.uO_6
"$&(*,.0
3E.Pcq:P!V^
#%Xkq.
2468:@
.JF{
U%Sa@
('%D^q-*
?|Q%f
SE?.rn~M*
.Dhe4
E.IdJWH
%k%cn>x_
?%uRc!
%3.UGiO0
]w.LQ
I 4keyy
L%C['
7.BLP
;.StH 
>.Qlx #6
$g.Gd
..yEjoe~51Ku58x(w9'vY2'
$~,1.\01.T80.MY
8..W,).bY
*.KN&s7
3={54/{-8
89l0>.MY
u>2%MY>'s;]8u:6.nY:.n128n;$%{48Kr-2%iY>$t78(nY4$y-18u:6.nY..t=]8
 .KT
P.yrBX.
PB]%C
%FoS(
F<.cs>reIEcoQI.exe_1276_rwx_00700000_00001000:
%WinDir%\TEMP
reIEcoQI.exe_1276_rwx_00930000_00001000:
DU-T%3U
reIEcoQI.exe_1276_rwx_00940000_00001000:
%Documents and Settings%\LocalService\dUskcAww\fGAwoYMM
reIEcoQI.exe_1276_rwx_00950000_00001000:
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs
reIEcoQI.exe_1276_rwx_00960000_00001000:
%Documents and Settings%\LocalService\dUskcAww\fGAwoYMM.inf
reIEcoQI.exe_1276_rwx_00970000_00001000:
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.inf
reIEcoQI.exe_1276_rwx_00980000_00001000:
%Documents and Settings%\LocalService\dUskcAww\fGAwoYMM.exe
reIEcoQI.exe_1276_rwx_00990000_00001000:
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe
reIEcoQI.exe_1276_rwx_009C0000_00001000:
fGAwoYMM.exe
reIEcoQI.exe_1276_rwx_009D0000_00001000:
NesIMIQs.exe
reIEcoQI.exe_1276_rwx_009E0000_00001000:
taskkill /FI "USERNAME eq SYSTEM" /F /IM fGAwoYMM.exe
reIEcoQI.exe_1276_rwx_009F0000_00001000:
taskkill /FI "USERNAME eq SYSTEM" /F /IM NesIMIQs.exe