HEUR:Trojan.Win32.Generic (Kaspersky), Trojan.GenericKD.1949790 (B) (Emsisoft), Trojan.GenericKD.1949790 (AdAware), GenericInjector.YR (Lavasoft MAS)Behaviour: Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: ad4a834e856901913762b72f2bc3abd0
SHA1: f28076c4709136a447d202b53bd4f183c468b6d5
SHA256: dc86494cd478a5fe0f70bc2faec7f79a1ff203b0670c5efa5fd71c3b1abe4484
SSDeep: 12288:i9GcukRNfj9O0JLrSnJwF6lk2Xlq1SYfg8m7mxBLgi2It:adjj99JLrSJwF6 21ISYIHm7gj4
Size: 612312 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171, UPolyXv05_v6
Company: no certificate found
Created at: 1991-11-15 13:03:21
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
%original file name%.exe:1156
attrib.exe:1932
The Trojan injects its code into the following process(es):
icardagt.exe:2000
Explorer.EXE:532
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:1156 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\All Users\Application Data\d0hh048ddd.exe (4185 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2d17e659d34601689591 (67 bytes)
The process icardagt.exe:2000 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT.LOG (7416 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT (6220 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\2d17e659d34601689591 (0 bytes)
Registry activity
The process %original file name%.exe:1156 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7B E2 A6 8D 2C 4D 27 4D 5F 56 38 B0 AF AE CE B4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\D:]
"2361512357.bat" = "2361512357"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
"IntranetName" = "1"
The process attrib.exe:1932 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "44 D7 03 1A 9F 52 AF 7A 09 17 8A D2 56 4B 5B AA"
The process icardagt.exe:2000 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "40 6D 51 95 76 47 12 53 A8 4D 00 8F 7E 68 D0 8E"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Keyboard]
"2d17e6" = "73 A5 FF C7 F6 1B F6 C7 5C AE 44 EB 46 A5 FF 2C"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"IntelPowerAgent64" = "rundll32.exe shell32.dll, ShellExec_RunDLL C:\DOCUME~1\ALLUSE~1\APPLIC~1\D0HH04~1.EXE"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
Dropped PE files
There are no dropped PE files.
HOSTS file anomalies
No changes have been detected.
Rootkit activity
The Trojan installs the following user-mode hooks in CRYPT32.dll:
PFXImportCertStore
The Trojan installs the following user-mode hooks in WININET.dll:
HttpSendRequestExA
HttpSendRequestW
InternetSetStatusCallbackW
InternetReadFileExA
InternetWriteFileExA
InternetSetStatusCallback
InternetQueryDataAvailable
HttpSendRequestExW
InternetReadFile
HttpSendRequestA
InternetCloseHandle
The Trojan installs the following user-mode hooks in USER32.dll:
GetClipboardData
SendInput
GetMessageA
CreateDialogParamW
GetMessageW
TranslateMessage
The Trojan installs the following user-mode hooks in ADVAPI32.dll:
CryptEncrypt
The Trojan installs the following user-mode hooks in WS2_32.dll:
WSASend
recv
gethostbyname
WSARecv
send
getaddrinfo
The Trojan installs the following user-mode hooks in kernel32.dll:
CreateProcessInternalW
LoadLibraryExW
The Trojan installs the following user-mode hooks in ntdll.dll:
RtlGetNativeSystemInformation
NtQueryInformationProcess
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Scan a system with an anti-rootkit tool.
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1156
attrib.exe:1932 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\All Users\Application Data\d0hh048ddd.exe (4185 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2d17e659d34601689591 (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT.LOG (7416 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"IntelPowerAgent64" = "rundll32.exe shell32.dll, ShellExec_RunDLL C:\DOCUME~1\ALLUSE~1\APPLIC~1\D0HH04~1.EXE" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description:
Comments:
Language: English (United States)
Company Name: Product Name: Product Version: Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: File Description: Comments: Language: English (United States)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 38170 | 40960 | 4.24785 | e39baa5e8374acb58089a9ea204ee810 |
.rdata | 45056 | 9554 | 12288 | 3.45397 | faba8c448c715d14966f345edfa876bd |
.data | 57344 | 512536 | 4096 | 0.18937 | 309143eec9eb8cb63ab7dd2c120c11d7 |
.rsrc | 573440 | 904 | 4096 | 0.651009 | e2eac8f044f29fe83311dc34648a2350 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 18
e03fc730c82a946c8bae47b8ee170482
c79d637339fd7facceabb88f47e93d4b
a3f203a4d0edfb4551d276d1e619150d
72c2e6526d655fcb60a42c38b43eed95
5b922b453379bff49411ccfeeec12b57
f663e0bb08ef761c493659078a47dbca
907b9edff1063388a7b47455cc8de7ce
23eb5914772fbbc6ece6f181944c82c3
e6fc8d256cd02772b550d8de91f999a8
730d67807e2e4020583415b48f3071e1
cbdf45b834e63323319177d67dc2304c
07353a1878f0389cfeab1bf36c58a36e
fb115bb2cc8df01a5751f65c4241c5e9
1180b5ef7dd644e2642bc14441822ab0
a8c9e42457796d3ed873acc587b4a9bb
42bc26f94ff8f53c9e8f7506ce41f605
25823f6fc96a6ff4f2c93178eda92910
245bb7064c60c6763feae00413afc8f8
Network Activity
URLs
URL | IP |
---|---|
download.windowsupdate.com | 213.155.152.146 |
www.microsoft.com | 23.64.223.148 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
icardagt.exe_2000:
.text
.text
`.data
`.data
.rsrc
.rsrc
f:\dd\ndp\indigo\src\infocard\agent\common.cpp
f:\dd\ndp\indigo\src\infocard\agent\common.cpp
f:\dd\ndp\indigo\src\infocard\agent\desktop.h
f:\dd\ndp\indigo\src\infocard\agent\desktop.h
f:\dd\ndp\indigo\src\infocard\agent\agentmodule.cpp
f:\dd\ndp\indigo\src\infocard\agent\agentmodule.cpp
f:\dd\ndp\indigo\src\infocard\agent\crypthash.cpp
f:\dd\ndp\indigo\src\infocard\agent\crypthash.cpp
f:\dd\ndp\indigo\src\infocard\agent\claim.cpp
f:\dd\ndp\indigo\src\infocard\agent\claim.cpp
f:\dd\ndp\indigo\src\infocard\agent\infocard.cpp
f:\dd\ndp\indigo\src\infocard\agent\infocard.cpp
f:\dd\ndp\indigo\src\infocard\agent\recipient.cpp
f:\dd\ndp\indigo\src\infocard\agent\recipient.cpp
f:\dd\ndp\indigo\src\infocard\agent\uiagent.cpp
f:\dd\ndp\indigo\src\infocard\agent\uiagent.cpp
f:\dd\ndp\indigo\src\infocard\agent\asyncrequest.h
f:\dd\ndp\indigo\src\infocard\agent\asyncrequest.h
f:\dd\ndp\indigo\src\infocard\agent\agentservicerequest.h
f:\dd\ndp\indigo\src\infocard\agent\agentservicerequest.h
f:\dd\ndp\indigo\src\infocard\agent\asynccreatesecuritytokenrequest.h
f:\dd\ndp\indigo\src\infocard\agent\asynccreatesecuritytokenrequest.h
f:\dd\ndp\indigo\src\infocard\agent\userpreference.cpp
f:\dd\ndp\indigo\src\infocard\agent\userpreference.cpp
f:\dd\ndp\indigo\src\infocard\agent\deletecardrequest.cpp
f:\dd\ndp\indigo\src\infocard\agent\deletecardrequest.cpp
f:\dd\ndp\indigo\src\infocard\agent\getcertificaterequest.cpp
f:\dd\ndp\indigo\src\infocard\agent\getcertificaterequest.cpp
f:\dd\ndp\indigo\src\infocard\agent\roundrectanglematrix.cpp
f:\dd\ndp\indigo\src\infocard\agent\roundrectanglematrix.cpp
f:\dd\ndp\indigo\src\infocard\agent\fontmanager.cpp
f:\dd\ndp\indigo\src\infocard\agent\fontmanager.cpp
f:\dd\ndp\indigo\src\infocard\agent\imagebase.cpp
f:\dd\ndp\indigo\src\infocard\agent\imagebase.cpp
f:\dd\ndp\indigo\src\infocard\agent\cardimage.cpp
f:\dd\ndp\indigo\src\infocard\agent\cardimage.cpp
f:\dd\ndp\indigo\src\infocard\agent\card.cpp
f:\dd\ndp\indigo\src\infocard\agent\card.cpp
f:\dd\ndp\indigo\src\infocard\agent\backbuttoncontrolimpl.cpp
f:\dd\ndp\indigo\src\infocard\agent\backbuttoncontrolimpl.cpp
f:\dd\ndp\indigo\src\infocard\agent\control.h
f:\dd\ndp\indigo\src\infocard\agent\control.h
f:\dd\ndp\indigo\src\infocard\agent\commandlinkcontrolimpl.cpp
f:\dd\ndp\indigo\src\infocard\agent\commandlinkcontrolimpl.cpp
f:\dd\ndp\indigo\src\infocard\agent\syslinkcontrolimpl.cpp
f:\dd\ndp\indigo\src\infocard\agent\syslinkcontrolimpl.cpp
f:\dd\ndp\indigo\src\infocard\agent\certificatecontrol.cpp
f:\dd\ndp\indigo\src\infocard\agent\certificatecontrol.cpp
f:\dd\ndp\indigo\src\infocard\agent\certificateviewer.cpp
f:\dd\ndp\indigo\src\infocard\agent\certificateviewer.cpp
f:\dd\ndp\indigo\src\infocard\agent\claimseditor.h
f:\dd\ndp\indigo\src\infocard\agent\claimseditor.h
f:\dd\ndp\indigo\src\infocard\agent\claimseditor.cpp
f:\dd\ndp\indigo\src\infocard\agent\claimseditor.cpp
f:\dd\ndp\indigo\src\infocard\agent\headercontrol.h
f:\dd\ndp\indigo\src\infocard\agent\headercontrol.h
f:\dd\ndp\indigo\src\infocard\agent\utility.h
f:\dd\ndp\indigo\src\infocard\agent\utility.h
f:\dd\ndp\indigo\src\infocard\agent\imagelist.h
f:\dd\ndp\indigo\src\infocard\agent\imagelist.h
f:\dd\ndp\indigo\src\infocard\agent\gdiobject.h
f:\dd\ndp\indigo\src\infocard\agent\gdiobject.h
f:\dd\ndp\indigo\src\infocard\agent\cardlistcontrol.cpp
f:\dd\ndp\indigo\src\infocard\agent\cardlistcontrol.cpp
f:\dd\ndp\indigo\src\infocard\agent\contextcontrol.cpp
f:\dd\ndp\indigo\src\infocard\agent\contextcontrol.cpp
f:\dd\ndp\indigo\src\infocard\agent\listviewcontrol.cpp
f:\dd\ndp\indigo\src\infocard\agent\listviewcontrol.cpp
f:\dd\ndp\indigo\src\infocard\agent\richeditcontrol.cpp
f:\dd\ndp\indigo\src\infocard\agent\richeditcontrol.cpp
f:\dd\ndp\indigo\src\infocard\agent\pagecontrol.cpp
f:\dd\ndp\indigo\src\infocard\agent\pagecontrol.cpp
f:\dd\ndp\indigo\src\infocard\agent\taskcontrol.cpp
f:\dd\ndp\indigo\src\infocard\agent\taskcontrol.cpp
f:\dd\ndp\indigo\src\infocard\agent\shutdowndialog.cpp
f:\dd\ndp\indigo\src\infocard\agent\shutdowndialog.cpp
f:\dd\ndp\indigo\src\infocard\agent\monitorwindow.cpp
f:\dd\ndp\indigo\src\infocard\agent\monitorwindow.cpp
f:\dd\ndp\indigo\src\infocard\agent\monitorwindows.cpp
f:\dd\ndp\indigo\src\infocard\agent\monitorwindows.cpp
f:\dd\ndp\indigo\src\infocard\agent\page.cpp
f:\dd\ndp\indigo\src\infocard\agent\page.cpp
f:\dd\ndp\indigo\src\infocard\agent\checkboxcontrol.h
f:\dd\ndp\indigo\src\infocard\agent\checkboxcontrol.h
f:\dd\ndp\indigo\src\infocard\agent\carddetailpage.cpp
f:\dd\ndp\indigo\src\infocard\agent\carddetailpage.cpp
f:\dd\ndp\indigo\src\infocard\agent\menu.h
f:\dd\ndp\indigo\src\infocard\agent\menu.h
f:\dd\ndp\indigo\src\infocard\agent\cardpickerpage.cpp
f:\dd\ndp\indigo\src\infocard\agent\cardpickerpage.cpp
f:\dd\ndp\indigo\src\infocard\agent\credentialspage.cpp
f:\dd\ndp\indigo\src\infocard\agent\credentialspage.cpp
f:\dd\ndp\indigo\src\infocard\agent\credentialcardpage.cpp
f:\dd\ndp\indigo\src\infocard\agent\credentialcardpage.cpp
f:\dd\ndp\indigo\src\infocard\agent\certificatecredentialpage.cpp
f:\dd\ndp\indigo\src\infocard\agent\certificatecredentialpage.cpp
f:\dd\ndp\indigo\src\infocard\agent\recipientinformationcontrol.cpp
f:\dd\ndp\indigo\src\infocard\agent\recipientinformationcontrol.cpp
f:\dd\ndp\indigo\src\infocard\agent\deletecardpage.cpp
f:\dd\ndp\indigo\src\infocard\agent\deletecardpage.cpp
f:\dd\ndp\indigo\src\infocard\agent\editcardpage.cpp
f:\dd\ndp\indigo\src\infocard\agent\editcardpage.cpp
f:\dd\ndp\indigo\src\infocard\agent\importcardpage.cpp
f:\dd\ndp\indigo\src\infocard\agent\importcardpage.cpp
f:\dd\ndp\indigo\src\infocard\agent\lockcodepage.cpp
f:\dd\ndp\indigo\src\infocard\agent\lockcodepage.cpp
f:\dd\ndp\indigo\src\infocard\agent\networkaccesspage.cpp
f:\dd\ndp\indigo\src\infocard\agent\networkaccesspage.cpp
f:\dd\ndp\indigo\src\infocard\agent\pinpage.cpp
f:\dd\ndp\indigo\src\infocard\agent\pinpage.cpp
f:\dd\ndp\indigo\src\infocard\agent\policypage.cpp
f:\dd\ndp\indigo\src\infocard\agent\policypage.cpp
f:\dd\ndp\indigo\src\infocard\agent\commandlinkcontrol.h
f:\dd\ndp\indigo\src\infocard\agent\commandlinkcontrol.h
f:\dd\ndp\indigo\src\infocard\agent\rippage.cpp
f:\dd\ndp\indigo\src\infocard\agent\rippage.cpp
f:\dd\ndp\indigo\src\infocard\agent\selectcardspage.cpp
f:\dd\ndp\indigo\src\infocard\agent\selectcardspage.cpp
f:\dd\ndp\indigo\src\infocard\agent\authenticationstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\authenticationstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\authenticationwindowstate.h
f:\dd\ndp\indigo\src\infocard\agent\authenticationwindowstate.h
f:\dd\ndp\indigo\src\infocard\agent\carddetailstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\carddetailstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\mainwindowstate.h
f:\dd\ndp\indigo\src\infocard\agent\mainwindowstate.h
f:\dd\ndp\indigo\src\infocard\agent\cardnotselectedstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\cardnotselectedstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\cardpickerstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\cardpickerstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\cardselectedstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\cardselectedstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\changepinstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\changepinstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\copycardstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\copycardstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\createtokenstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\createtokenstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\credentialsstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\credentialsstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\deletecardstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\deletecardstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\editcardstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\editcardstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\exportselectstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\exportselectstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\exportpasswordstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\exportpasswordstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\exportfilestate.cpp
f:\dd\ndp\indigo\src\infocard\agent\exportfilestate.cpp
f:\dd\ndp\indigo\src\infocard\agent\gettokenstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\gettokenstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\importstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\importstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\importcardstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\importcardstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\importcardpolicystate.cpp
f:\dd\ndp\indigo\src\infocard\agent\importcardpolicystate.cpp
f:\dd\ndp\indigo\src\infocard\agent\importpasswordstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\importpasswordstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\importselectstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\importselectstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\lockcardstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\lockcardstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\managestate.cpp
f:\dd\ndp\indigo\src\infocard\agent\managestate.cpp
f:\dd\ndp\indigo\src\infocard\agent\newcardstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\newcardstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\removepinstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\removepinstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\ripstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\ripstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\topstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\topstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\unlockcardstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\unlockcardstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\statecontext.cpp
f:\dd\ndp\indigo\src\infocard\agent\statecontext.cpp
f:\dd\ndp\indigo\src\infocard\agent\mainwindowcontext.cpp
f:\dd\ndp\indigo\src\infocard\agent\mainwindowcontext.cpp
f:\dd\ndp\indigo\src\infocard\agent\authenticationwindowcontext.cpp
f:\dd\ndp\indigo\src\infocard\agent\authenticationwindowcontext.cpp
f:\dd\ndp\indigo\src\infocard\agent\mainwindow.cpp
f:\dd\ndp\indigo\src\infocard\agent\mainwindow.cpp
f:\dd\ndp\indigo\src\infocard\agent\mainhelperwindow.cpp
f:\dd\ndp\indigo\src\infocard\agent\mainhelperwindow.cpp
f:\dd\ndp\indigo\src\infocard\agent\authenticationwindow.cpp
f:\dd\ndp\indigo\src\infocard\agent\authenticationwindow.cpp
f:\dd\ndp\indigo\src\infocard\agent\displaytoken.cpp
f:\dd\ndp\indigo\src\infocard\agent\displaytoken.cpp
f:\dd\ndp\indigo\src\infocard\agent\rpccryptoservice.cpp
f:\dd\ndp\indigo\src\infocard\agent\rpccryptoservice.cpp
f:\dd\ndp\indigo\src\infocard\agent\cryptkey.h
f:\dd\ndp\indigo\src\infocard\agent\cryptkey.h
f:\dd\ndp\indigo\src\infocard\agent\rpccryptocontext.cpp
f:\dd\ndp\indigo\src\infocard\agent\rpccryptocontext.cpp
f:\dd\ndp\indigo\src\infocard\agent\x509certificatetokenfactorycredential.cpp
f:\dd\ndp\indigo\src\infocard\agent\x509certificatetokenfactorycredential.cpp
305.1if:\dd\ndp\indigo\src\infocard\agent\accannotationhelper.cpp
305.1if:\dd\ndp\indigo\src\infocard\agent\accannotationhelper.cpp
f:\dd\ndp\indigo\src\infocard\agent\deletestorestate.cpp
f:\dd\ndp\indigo\src\infocard\agent\deletestorestate.cpp
f:\dd\ndp\indigo\src\infocard\agent\agentmodulebase.cpp
f:\dd\ndp\indigo\src\infocard\agent\agentmodulebase.cpp
f:\dd\ndp\indigo\src\infocard\agent\helpwindow.cpp
f:\dd\ndp\indigo\src\infocard\agent\helpwindow.cpp
f:\dd\ndp\indigo\src\infocard\agent\getfilenamefromuserrequest.h
f:\dd\ndp\indigo\src\infocard\agent\getfilenamefromuserrequest.h
f:\dd\ndp\indigo\src\infocard\agent\getfilenamefromuserrequest.cpp
f:\dd\ndp\indigo\src\infocard\agent\getfilenamefromuserrequest.cpp
f:\dd\ndp\indigo\src\infocard\agent\selectcreatecardpage.cpp
f:\dd\ndp\indigo\src\infocard\agent\selectcreatecardpage.cpp
f:\dd\ndp\indigo\src\infocard\agent\selectcreatecardstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\selectcreatecardstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\webclient.cpp
f:\dd\ndp\indigo\src\infocard\agent\webclient.cpp
f:\dd\ndp\indigo\src\infocard\agent\x509certlogoclient.cpp
f:\dd\ndp\indigo\src\infocard\agent\x509certlogoclient.cpp
f:\dd\ndp\indigo\src\infocard\agent\asyncwebclient.cpp
f:\dd\ndp\indigo\src\infocard\agent\asyncwebclient.cpp
f:\dd\ndp\indigo\src\infocard\agent\notificationcontrol.cpp
f:\dd\ndp\indigo\src\infocard\agent\notificationcontrol.cpp
f:\dd\ndp\indigo\src\infocard\agent\cardusagecontrol.cpp
f:\dd\ndp\indigo\src\infocard\agent\cardusagecontrol.cpp
f:\dd\ndp\indigo\src\infocard\agent\horizontalbuttonstrip.cpp
f:\dd\ndp\indigo\src\infocard\agent\horizontalbuttonstrip.cpp
f:\dd\ndp\indigo\src\infocard\agent\cardusagestate.cpp
f:\dd\ndp\indigo\src\infocard\agent\cardusagestate.cpp
f:\dd\ndp\indigo\src\infocard\agent\cardsummaryviewcontrol.cpp
f:\dd\ndp\indigo\src\infocard\agent\cardsummaryviewcontrol.cpp
f:\dd\ndp\indigo\src\infocard\agent\fileselectpage.cpp
f:\dd\ndp\indigo\src\infocard\agent\fileselectpage.cpp
f:\dd\ndp\indigo\src\infocard\agent\importfileselectstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\importfileselectstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\preferencespage.cpp
f:\dd\ndp\indigo\src\infocard\agent\preferencespage.cpp
f:\dd\ndp\indigo\src\infocard\agent\preferencesstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\preferencesstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\lockcode.cpp
f:\dd\ndp\indigo\src\infocard\agent\lockcode.cpp
f:\dd\ndp\indigo\src\infocard\agent\lockcodeeditcontrol.cpp
f:\dd\ndp\indigo\src\infocard\agent\lockcodeeditcontrol.cpp
f:\dd\ndp\indigo\src\infocard\agent\selectfilepage.cpp
f:\dd\ndp\indigo\src\infocard\agent\selectfilepage.cpp
f:\dd\ndp\indigo\src\infocard\agent\claimnamecontrol.cpp
f:\dd\ndp\indigo\src\infocard\agent\claimnamecontrol.cpp
f:\dd\ndp\indigo\src\infocard\agent\progressstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\progressstate.cpp
f:\dd\ndp\indigo\src\infocard\agent\commonfiledialogbase.cpp
f:\dd\ndp\indigo\src\infocard\agent\commonfiledialogbase.cpp
f:\dd\ndp\indigo\src\infocard\agent\vistacommonfiledialog.cpp
f:\dd\ndp\indigo\src\infocard\agent\vistacommonfiledialog.cpp
f:\dd\ndp\indigo\src\infocard\agent\filedialog.cpp
f:\dd\ndp\indigo\src\infocard\agent\filedialog.cpp
f:\dd\ndp\indigo\src\infocard\agent\errorwindow.cpp
f:\dd\ndp\indigo\src\infocard\agent\errorwindow.cpp
f:\dd\ndp\indigo\src\infocard\agent\claimvaluecontrolimpl.cpp
f:\dd\ndp\indigo\src\infocard\agent\claimvaluecontrolimpl.cpp
kernel32.dll
kernel32.dll
icardagt.pdb
icardagt.pdb
PSSj%S
PSSj%S
8P%u#
8P%u#
t1It.It
t1It.It
Wj.hl~@
Wj.hl~@
x8SSh
x8SSh
x8SSh!
x8SSh!
_amsg_exit
_amsg_exit
_wcmdln
_wcmdln
MSVCR80.dll
MSVCR80.dll
_crt_debugger_hook
_crt_debugger_hook
MSVCP80.dll
MSVCP80.dll
RegCloseKey
RegCloseKey
RegOpenKeyExW
RegOpenKeyExW
CryptDestroyKey
CryptDestroyKey
ReportEventW
ReportEventW
CryptGetUserKey
CryptGetUserKey
ADVAPI32.dll
ADVAPI32.dll
KERNEL32.dll
KERNEL32.dll
GDI32.dll
GDI32.dll
GetKeyboardLayout
GetKeyboardLayout
GetKeyboardLayoutList
GetKeyboardLayoutList
GetKeyState
GetKeyState
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
USER32.dll
USER32.dll
COMCTL32.dll
COMCTL32.dll
comdlg32.dll
comdlg32.dll
CryptUIDlgViewCertificateW
CryptUIDlgViewCertificateW
CRYPTUI.dll
CRYPTUI.dll
GdiplusShutdown
GdiplusShutdown
gdiplus.dll
gdiplus.dll
MSIMG32.dll
MSIMG32.dll
ole32.dll
ole32.dll
RPCRT4.dll
RPCRT4.dll
SHLWAPI.dll
SHLWAPI.dll
UxTheme.dll
UxTheme.dll
CertFreeCertificateContext
CertFreeCertificateContext
CertCreateCertificateContext
CertCreateCertificateContext
CertCloseStore
CertCloseStore
CertDuplicateCertificateContext
CertDuplicateCertificateContext
CertDuplicateStore
CertDuplicateStore
CertFindCertificateInStore
CertFindCertificateInStore
CertStrToNameW
CertStrToNameW
CertOpenStore
CertOpenStore
CertSerializeCertificateStoreElement
CertSerializeCertificateStoreElement
CryptAcquireCertificatePrivateKey
CryptAcquireCertificatePrivateKey
CertOIDToAlgId
CertOIDToAlgId
CRYPT32.dll
CRYPT32.dll
USERENV.dll
USERENV.dll
ShellExecuteExW
ShellExecuteExW
SHELL32.dll
SHELL32.dll
VERSION.dll
VERSION.dll
HttpQueryInfoW
HttpQueryInfoW
HttpSendRequestW
HttpSendRequestW
HttpOpenRequestW
HttpOpenRequestW
InternetCrackUrlW
InternetCrackUrlW
WININET.dll
WININET.dll
GetProcessHeap
GetProcessHeap
.PAVInfoCardException@@
.PAVInfoCardException@@
PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
%SystemRoot%\System32\icardres.dll
%SystemRoot%\System32\icardres.dll
%systemroot%\system32\msctfmonitor.dll
%systemroot%\system32\msctfmonitor.dll
strMessage.LoadStringW( 527 )
strMessage.LoadStringW( 527 )
ShellExecEx failed on wisptis.exe AgentModule::StartTabletProcessesIfNeeded()
ShellExecEx failed on wisptis.exe AgentModule::StartTabletProcessesIfNeeded()
CloseHandle( shexinfo.hProcess )
CloseHandle( shexinfo.hProcess )
Successfully terminated wisptis.exe process early.
Successfully terminated wisptis.exe process early.
Failed to terminuate wisptis.exe AgentModule::StartTabletProcessesIfNeeded()
Failed to terminuate wisptis.exe AgentModule::StartTabletProcessesIfNeeded()
\wisptis.exe
\wisptis.exe
rSelfIssuedClaimCount == m_mapClaimToIndex.size()
rSelfIssuedClaimCount == m_mapClaimToIndex.size()
strClaim.length() > 0
strClaim.length() > 0
strResource.LoadStringW( 105 )
strResource.LoadStringW( 105 )
!m_claims.empty()
!m_claims.empty()
A!m_pinHash.empty()
A!m_pinHash.empty()
!newpin.empty()
!newpin.empty()
m_pinHash.empty()
m_pinHash.empty()
!oldpin.empty()
!oldpin.empty()
!m_pin.empty()
!m_pin.empty()
m_pinHash.size() == hash.size()
m_pinHash.size() == hash.size()
m_isCertCached
m_isCertCached
m_pAsyncImpl || !"AsyncRequest.IsComplete shouldn't be called after the operation is cancelled"
m_pAsyncImpl || !"AsyncRequest.IsComplete shouldn't be called after the operation is cancelled"
NULL != m_pOutArgs.get()
NULL != m_pOutArgs.get()
m_pAsyncImpl || !"AsyncRequest.GetOutArgs shouldn't be called after the operation is cancelled"
m_pAsyncImpl || !"AsyncRequest.GetOutArgs shouldn't be called after the operation is cancelled"
!"AsyncRequest.Process shouldn't be called after the operation is cancelled"
!"AsyncRequest.Process shouldn't be called after the operation is cancelled"
B!m_recipientIdentifier.empty()
B!m_recipientIdentifier.empty()
GetCertificateRequest
GetCertificateRequest
strFaceName.LoadStringW( uFaceNameId )
strFaceName.LoadStringW( uFaceNameId )
strMessage.LoadStringW( 512 )
strMessage.LoadStringW( 512 )
strMessage.LoadStringW( 517 )
strMessage.LoadStringW( 517 )
Bg.DrawImage( pOldBitmap, rectNew, 0, 0, sizeOldBitmap.cx, sizeOldBitmap.cy, UnitPixel ) == Ok
Bg.DrawImage( pOldBitmap, rectNew, 0, 0, sizeOldBitmap.cx, sizeOldBitmap.cy, UnitPixel ) == Ok
g.SetInterpolationMode( InterpolationModeHighQualityBicubic ) == Ok
g.SetInterpolationMode( InterpolationModeHighQualityBicubic ) == Ok
strText.LoadStringW( 80 )
strText.LoadStringW( 80 )
strUnnamed.LoadStringW( 101 )
strUnnamed.LoadStringW( 101 )
m_imageGlyph.LoadFromUserDefinedResource( 413, 256 )
m_imageGlyph.LoadFromUserDefinedResource( 413, 256 )
WM_NCCREATE == uMsg
WM_NCCREATE == uMsg
0 != wci.Register( &wci.pWndProc )
0 != wci.Register( &wci.pWndProc )
m_imageGlyph.LoadFromUserDefinedResource( 406, 256 )
m_imageGlyph.LoadFromUserDefinedResource( 406, 256 )
DCertificateControl
DCertificateControl
strLock.LoadStringW( 1404 )
strLock.LoadStringW( 1404 )
strNotVerified.LoadStringW( 1408 )
strNotVerified.LoadStringW( 1408 )
logoString.LoadStringW( 1126 )
logoString.LoadStringW( 1126 )
logoString.LoadStringW( 1127 )
logoString.LoadStringW( 1127 )
logoString.LoadStringW( 1125 )
logoString.LoadStringW( 1125 )
logoString.LoadStringW( 1135 )
logoString.LoadStringW( 1135 )
strTitle.LoadStringW( 1124 )
strTitle.LoadStringW( 1124 )
strTitle.LoadStringW( 1122 )
strTitle.LoadStringW( 1122 )
strNote.LoadStringW( 1139 )
strNote.LoadStringW( 1139 )
strTitle.LoadStringW( 1132 )
strTitle.LoadStringW( 1132 )
strTitle.LoadStringW( 1131 )
strTitle.LoadStringW( 1131 )
strTitle.LoadStringW( 1137 )
strTitle.LoadStringW( 1137 )
strName.LoadStringW( uNameId )
strName.LoadStringW( uNameId )
strTitle.LoadStringW( 1136 )
strTitle.LoadStringW( 1136 )
strError.LoadStringW( 528 )
strError.LoadStringW( 528 )
BnameStr.LoadStringW( uNameId )
BnameStr.LoadStringW( uNameId )
hstr.LoadStringW( strId )
hstr.LoadStringW( strId )
m_unspecifiedStr.LoadStringW( 621 )
m_unspecifiedStr.LoadStringW( 621 )
m_femaleStr.LoadStringW( 620 )
m_femaleStr.LoadStringW( 620 )
m_maleStr.LoadStringW( 619 )
m_maleStr.LoadStringW( 619 )
strGroup.LoadStringW( 882 )
strGroup.LoadStringW( 882 )
strGroup.LoadStringW( 884 index )
strGroup.LoadStringW( 884 index )
strGroup.LoadStringW( 880 index )
strGroup.LoadStringW( 880 index )
notSpecified.LoadStringW( 624 )
notSpecified.LoadStringW( 624 )
str.LoadStringW( 618 )
str.LoadStringW( 618 )
gender.LoadStringW( 619 )
gender.LoadStringW( 619 )
gender.LoadStringW( 620 )
gender.LoadStringW( 620 )
nIndex ( m_data.size() 2 m_history.size() m_details.size() GroupMaxValue 2 )
nIndex ( m_data.size() 2 m_history.size() m_details.size() GroupMaxValue 2 )
m_details.end() != simpleVal
m_details.end() != simpleVal
imageLabel.LoadStringW( 613 )
imageLabel.LoadStringW( 613 )
nameLabel.LoadStringW( 612 )
nameLabel.LoadStringW( 612 )
BrequiredIndicator.LoadStringW( 626 )
BrequiredIndicator.LoadStringW( 626 )
DisplayClaimList == displayToken.GetDisplayType()
DisplayClaimList == displayToken.GetDisplayType()
hXXp://schemas.xmlsoap.org/ws/2005/05/identity/claims/dateofbirth
hXXp://schemas.xmlsoap.org/ws/2005/05/identity/claims/dateofbirth
hXXp://schemas.xmlsoap.org/ws/2005/05/identity/claims/gender
hXXp://schemas.xmlsoap.org/ws/2005/05/identity/claims/gender
hXXp://schemas.xmlsoap.org/ws/2005/05/identity/claims/privatepersonalidentifier
hXXp://schemas.xmlsoap.org/ws/2005/05/identity/claims/privatepersonalidentifier
addCardName.LoadStringW( 900 )
addCardName.LoadStringW( 900 )
strOther.LoadStringW( 899 )
strOther.LoadStringW( 899 )
strOther.LoadStringW( 897 )
strOther.LoadStringW( 897 )
strUsed.LoadStringW( 898 )
strUsed.LoadStringW( 898 )
strHeader.LoadStringW( 897 )
strHeader.LoadStringW( 897 )
strName.LoadStringW( 896 )
strName.LoadStringW( 896 )
m_strContext.LoadStringW( uId )
m_strContext.LoadStringW( uId )
m_strUEText.LoadStringW( uId )
m_strUEText.LoadStringW( uId )
m_image.LoadFromUserDefinedResource( 412, 256 )
m_image.LoadFromUserDefinedResource( 412, 256 )
priched20.dll
priched20.dll
D!button.IsWindow()
D!button.IsWindow()
text.LoadStringW( 135 )
text.LoadStringW( 135 )
controlText.LoadStringW( uTextId )
controlText.LoadStringW( uTextId )
m_titleText.LoadStringW(titleTextId)
m_titleText.LoadStringW(titleTextId)
0 != pMonitorWindows
0 != pMonitorWindows
strCaption.LoadStringW( 96 )
strCaption.LoadStringW( 96 )
notifyMessage.LoadStringW( 604 )
notifyMessage.LoadStringW( 604 )
notifyMessage.LoadStringW( 1266 )
notifyMessage.LoadStringW( 1266 )
notifyMessage.LoadStringW( 602 )
notifyMessage.LoadStringW( 602 )
notifyMessage.LoadStringW( 601 )
notifyMessage.LoadStringW( 601 )
notifyMessage.LoadStringW( 609 )
notifyMessage.LoadStringW( 609 )
notifyMessage.LoadStringW( 636 )
notifyMessage.LoadStringW( 636 )
strItem.LoadStringW( uStringId )
strItem.LoadStringW( uStringId )
strText.LoadStringW( 940 )
strText.LoadStringW( 940 )
strText.LoadStringW( 627 )
strText.LoadStringW( 627 )
strText.LoadStringW( 955 )
strText.LoadStringW( 955 )
strText.LoadStringW( 934 )
strText.LoadStringW( 934 )
strPersonal.LoadStringW( 932 )
strPersonal.LoadStringW( 932 )
strManaged.LoadStringW( 933 )
strManaged.LoadStringW( 933 )
strText.LoadStringW( 935 )
strText.LoadStringW( 935 )
strButtonText.LoadStringW( 584 )
strButtonText.LoadStringW( 584 )
strButtonText.LoadStringW( 585 )
strButtonText.LoadStringW( 585 )
m_strPreviewText.LoadStringW( 930 )
m_strPreviewText.LoadStringW( 930 )
iconAnnotation.LoadStringW( 1407 )
iconAnnotation.LoadStringW( 1407 )
strText.LoadStringW( replacementId )
strText.LoadStringW( replacementId )
pstrTitle.LoadStringW( 682 )
pstrTitle.LoadStringW( 682 )
strError.LoadStringW( uErrorId )
strError.LoadStringW( uErrorId )
EstrTitle.LoadStringW( 814 )
EstrTitle.LoadStringW( 814 )
strShield.LoadStringW( 1407 )
strShield.LoadStringW( 1407 )
EusageText.LoadStringW( 633 )
EusageText.LoadStringW( 633 )
EstrError.LoadStringW( 529 )
EstrError.LoadStringW( 529 )
EstrButton.LoadStringW( 727 )
EstrButton.LoadStringW( 727 )
Emsg.LoadStringW( messageId )
Emsg.LoadStringW( messageId )
strAnnotation.LoadStringW( 122 )
strAnnotation.LoadStringW( 122 )
strText.LoadStringW( 758 )
strText.LoadStringW( 758 )
strText.LoadStringW( 759 )
strText.LoadStringW( 759 )
strText.LoadStringW( 760 )
strText.LoadStringW( 760 )
strText.LoadStringW( 757 )
strText.LoadStringW( 757 )
hstrMessage.LoadStringW( 526 )
hstrMessage.LoadStringW( 526 )
strMessage.LoadStringW( 516 )
strMessage.LoadStringW( 516 )
Dmessage.IsCommand()
Dmessage.IsCommand()
name.LoadStringW( nameTxtId )
name.LoadStringW( nameTxtId )
strAddText.LoadStringW( 584 )
strAddText.LoadStringW( 584 )
strAddText.LoadStringW( 585 )
strAddText.LoadStringW( 585 )
message.IsNotify()
message.IsNotify()
DGetContext().IsCardSelected()
DGetContext().IsCardSelected()
strPrefix.LoadStringW( 100 )
strPrefix.LoadStringW( 100 )
strGenericError.LoadString( IDS_E_ICARD_FAILED_NETWORK_ACCESS )
strGenericError.LoadString( IDS_E_ICARD_FAILED_NETWORK_ACCESS )
strMessage.LoadStringW( 520 )
strMessage.LoadStringW( 520 )
plockCodeA.Unprotect()
plockCodeA.Unprotect()
pstrCue.LoadStringW( 1158 )
pstrCue.LoadStringW( 1158 )
warningTitle.LoadStringW( 0x1400 )
warningTitle.LoadStringW( 0x1400 )
warningText.LoadStringW( 0x1401 )
warningText.LoadStringW( 0x1401 )
pstrMessage.LoadStringW( 524 )
pstrMessage.LoadStringW( 524 )
DstrMessage.LoadStringW( 521 )
DstrMessage.LoadStringW( 521 )
DpAgent && pImport
DpAgent && pImport
plockCode.Protect()
plockCode.Protect()
lockCode.Unprotect()
lockCode.Unprotect()
DpImport
DpImport
ERecipientTypeX509 == recipient.GetRecipientType()
ERecipientTypeX509 == recipient.GetRecipientType()
EstrMessage.LoadStringW( 523 )
EstrMessage.LoadStringW( 523 )
strWindowName.LoadStringW( 97 )
strWindowName.LoadStringW( 97 )
windowParent.GetWindowRect( rectParent )
windowParent.GetWindowRect( rectParent )
strWindowName.LoadStringW( 98 )
strWindowName.LoadStringW( 98 )
CancelAsyncOperationRequest
CancelAsyncOperationRequest
EGetImportedCardRequest
EGetImportedCardRequest
EExportFileRequest
EExportFileRequest
NULL != m_hCryptKey
NULL != m_hCryptKey
EstrMessage.LoadStringW( 1360 )
EstrMessage.LoadStringW( 1360 )
ImportFileRequest
ImportFileRequest
EGetImportFileNameRequest
EGetImportFileNameRequest
ppropStr.LoadStringW( iStrId )
ppropStr.LoadStringW( iStrId )
E%SystemRoot%\System32\icardres.dll
E%SystemRoot%\System32\icardres.dll
The Windows CardSpace User Interface Agent was not able to load the MUI Library. This indicates a problem with the installation of Windows CardSpace. Contact your system administrator
The Windows CardSpace User Interface Agent was not able to load the MUI Library. This indicates a problem with the installation of Windows CardSpace. Contact your system administrator
CardSpace 3.0.0.0
CardSpace 3.0.0.0
NULL != s_pAgentModule.get()
NULL != s_pAgentModule.get()
p\StringFileInfo\xx\FileDescription
p\StringFileInfo\xx\FileDescription
version.dll
version.dll
NULL == s_pAgentModule.get()
NULL == s_pAgentModule.get()
D\StringFileInfo\xx\ProductVersion
D\StringFileInfo\xx\ProductVersion
13d389bc-393e-47bf-b667-aafe93ac6b63
13d389bc-393e-47bf-b667-aafe93ac6b63
Reporting file dialog selection to idsvc. pwszFileChoice=%1!ws!
Reporting file dialog selection to idsvc. pwszFileChoice=%1!ws!
strWindowName.LoadStringW( 0x1201 )
strWindowName.LoadStringW( 0x1201 )
%u %ld %ld %ld %ld "%s"
%u %ld %ld %ld %ld "%s"
FileType::Unspecified
FileType::Unspecified
m_userAgentString.LoadStringW( 106 )
m_userAgentString.LoadStringW( 106 )
0 == m_logoBytes.size()
0 == m_logoBytes.size()
0 == m_downloadBytes.size()
0 == m_downloadBytes.size()
iconAnnotation.LoadStringW( uIconText )
iconAnnotation.LoadStringW( uIconText )
notifyIconText.LoadStringW( 890 )
notifyIconText.LoadStringW( 890 )
bullet.LoadStringW( 107 )
bullet.LoadStringW( 107 )
notification.LoadStringW( uTextId )
notification.LoadStringW( uTextId )
noItemsText.LoadStringW( 846 )
noItemsText.LoadStringW( 846 )
colum1text.LoadStringW( 842 )
colum1text.LoadStringW( 842 )
colum0text.LoadStringW( 841 )
colum0text.LoadStringW( 841 )
noItemsText.LoadStringW( 843 )
noItemsText.LoadStringW( 843 )
rect.X rect.Width >= container.X && rect.X rect.Width
rect.X rect.Width >= container.X && rect.X rect.Width
rect.X >= container.X && rect.X
rect.X >= container.X && rect.X
nameTxt.LoadStringW( uNameTextId )
nameTxt.LoadStringW( uNameTextId )
EstrFilePath.LoadStringW( 1158 )
EstrFilePath.LoadStringW( 1158 )
strFilePath.LoadStringW( 1159 )
strFilePath.LoadStringW( 1159 )
DFileType::ImportCard == fileType || FileType::ImportStore == fileType
DFileType::ImportCard == fileType || FileType::ImportStore == fileType
strCueManaged.LoadStringW( 1159 )
strCueManaged.LoadStringW( 1159 )
strMessage.LoadStringW( 530 )
strMessage.LoadStringW( 530 )
txt.LoadStringW(uLabelTextId)
txt.LoadStringW(uLabelTextId)
colon.LoadStringW( 1281 )
colon.LoadStringW( 1281 )
strMessage.LoadStringW( uExtensionErrorId )
strMessage.LoadStringW( uExtensionErrorId )
strMessage.LoadStringW( 522 )
strMessage.LoadStringW( 522 )
strFilter.LoadStringW( uFilterId )
strFilter.LoadStringW( uFilterId )
strTitle.LoadStringW( uTitleId )
strTitle.LoadStringW( uTitleId )
pstrWindowName.LoadStringW( uWindowName )
pstrWindowName.LoadStringW( uWindowName )
Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}
Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}
.\%s.mui
.\%s.mui
.\%s\%s.mui
.\%s\%s.mui
%s\%s.mui
%s\%s.mui
%s\%s\%s.mui
%s\%s\%s.mui
%s\%s
%s\%s
%S:%d: %s
%S:%d: %s
Windows CardSpace User Interface Agent
Windows CardSpace User Interface Agent
3.0.4506.648 (Winfxred.004506-0648)
3.0.4506.648 (Winfxred.004506-0648)
.NET Framework
.NET Framework
3.0.4506.648
3.0.4506.648
icardagt.exe_2000_rwx_00A70000_00026000:
.text
.text
`.rdata
`.rdata
@.data
@.data
.reloc
.reloc
SSSh`M
SSSh`M
SSSSh
SSSSh
|$L.to
|$L.to
%x.tmp
%x.tmp
|.^$* ?()[\
|.^$* ?()[\
%%%d%s
%%%d%s
%s\%s
%s\%s
Z:\coding\project\main\payload\payload.x86.pdb
Z:\coding\project\main\payload\payload.x86.pdb
CallNamedPipeA
CallNamedPipeA
ConnectNamedPipe
ConnectNamedPipe
GetSystemWindowsDirectoryA
GetSystemWindowsDirectoryA
DisconnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeA
CreateNamedPipeA
KERNEL32.dll
KERNEL32.dll
GetKeyboardState
GetKeyboardState
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
RegFlushKey
RegFlushKey
ADVAPI32.dll
ADVAPI32.dll
SHELL32.dll
SHELL32.dll
ODBC32.dll
ODBC32.dll
WS2_32.dll
WS2_32.dll
SHLWAPI.dll
SHLWAPI.dll
ntdll.dll
ntdll.dll
HttpQueryInfoA
HttpQueryInfoA
HttpAddRequestHeadersW
HttpAddRequestHeadersW
HttpAddRequestHeadersA
HttpAddRequestHeadersA
WININET.dll
WININET.dll
CryptAcquireCertificatePrivateKey
CryptAcquireCertificatePrivateKey
CertOpenStore
CertOpenStore
CertOpenSystemStoreW
CertOpenSystemStoreW
CertFreeCertificateContext
CertFreeCertificateContext
CertAddCertificateContextToStore
CertAddCertificateContextToStore
CertFindCertificateInStore
CertFindCertificateInStore
CertCloseStore
CertCloseStore
CertGetNameStringA
CertGetNameStringA
CryptVerifyCertificateSignature
CryptVerifyCertificateSignature
PFXImportCertStore
PFXImportCertStore
CertEnumCertificatesInStore
CertEnumCertificatesInStore
CertEnumSystemStore
CertEnumSystemStore
CertNameToStrA
CertNameToStrA
CertVerifyTimeValidity
CertVerifyTimeValidity
PFXExportCertStoreEx
PFXExportCertStoreEx
CRYPT32.dll
CRYPT32.dll
WinHttpQueryOption
WinHttpQueryOption
WinHttpSendRequest
WinHttpSendRequest
WinHttpConnect
WinHttpConnect
WinHttpOpen
WinHttpOpen
WinHttpOpenRequest
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpCloseHandle
WinHttpSetOption
WinHttpSetOption
WINHTTP.dll
WINHTTP.dll
GetProcessHeap
GetProcessHeap
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
ExitWindowsEx
ExitWindowsEx
ShellExecuteExA
ShellExecuteExA
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
WinSCard.dll
WinSCard.dll
GetTcpTable
GetTcpTable
IPHLPAPI.DLL
IPHLPAPI.DLL
WINTRUST.dll
WINTRUST.dll
SensApi.dll
SensApi.dll
HttpOpenRequestA
HttpOpenRequestA
HttpSendRequestA
HttpSendRequestA
urlmon.dll
urlmon.dll
gdiplus.dll
gdiplus.dll
USERENV.dll
USERENV.dll
payload.x86.dll
payload.x86.dll
%Documents and Settings%\All Users\Application Data\d0hh048ddd.exe
%Documents and Settings%\All Users\Application Data\d0hh048ddd.exe
\\.\pipe\ffb23cf9
\\.\pipe\ffb23cf9
a8a56912x
a8a56912x
a8a5691dx
a8a5691dx
%System%\icardagt.exe
%System%\icardagt.exe
%Documents and Settings%\%current user%
%Documents and Settings%\%current user%
?.?5?:???\?
?.?5?:???\?
Windows Explorer
Windows Explorer
Explorer.EXE_532_rwx_02250000_00026000:
.text
.text
`.rdata
`.rdata
@.data
@.data
.reloc
.reloc
SSSh`M%
SSSh`M%
SSSSh
SSSSh
|$L.to
|$L.to
%x.tmp
%x.tmp
|.^$* ?()[\
|.^$* ?()[\
%%%d%s
%%%d%s
%s\%s
%s\%s
Z:\coding\project\main\payload\payload.x86.pdb
Z:\coding\project\main\payload\payload.x86.pdb
CallNamedPipeA
CallNamedPipeA
ConnectNamedPipe
ConnectNamedPipe
GetSystemWindowsDirectoryA
GetSystemWindowsDirectoryA
DisconnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeA
CreateNamedPipeA
KERNEL32.dll
KERNEL32.dll
GetKeyboardState
GetKeyboardState
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
RegFlushKey
RegFlushKey
ADVAPI32.dll
ADVAPI32.dll
SHELL32.dll
SHELL32.dll
ODBC32.dll
ODBC32.dll
WS2_32.dll
WS2_32.dll
SHLWAPI.dll
SHLWAPI.dll
ntdll.dll
ntdll.dll
HttpQueryInfoA
HttpQueryInfoA
HttpAddRequestHeadersW
HttpAddRequestHeadersW
HttpAddRequestHeadersA
HttpAddRequestHeadersA
WININET.dll
WININET.dll
CryptAcquireCertificatePrivateKey
CryptAcquireCertificatePrivateKey
CertOpenStore
CertOpenStore
CertOpenSystemStoreW
CertOpenSystemStoreW
CertFreeCertificateContext
CertFreeCertificateContext
CertAddCertificateContextToStore
CertAddCertificateContextToStore
CertFindCertificateInStore
CertFindCertificateInStore
CertCloseStore
CertCloseStore
CertGetNameStringA
CertGetNameStringA
CryptVerifyCertificateSignature
CryptVerifyCertificateSignature
PFXImportCertStore
PFXImportCertStore
CertEnumCertificatesInStore
CertEnumCertificatesInStore
CertEnumSystemStore
CertEnumSystemStore
CertNameToStrA
CertNameToStrA
CertVerifyTimeValidity
CertVerifyTimeValidity
PFXExportCertStoreEx
PFXExportCertStoreEx
CRYPT32.dll
CRYPT32.dll
WinHttpQueryOption
WinHttpQueryOption
WinHttpSendRequest
WinHttpSendRequest
WinHttpConnect
WinHttpConnect
WinHttpOpen
WinHttpOpen
WinHttpOpenRequest
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpCloseHandle
WinHttpSetOption
WinHttpSetOption
WINHTTP.dll
WINHTTP.dll
GetProcessHeap
GetProcessHeap
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
ExitWindowsEx
ExitWindowsEx
ShellExecuteExA
ShellExecuteExA
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
WinSCard.dll
WinSCard.dll
GetTcpTable
GetTcpTable
IPHLPAPI.DLL
IPHLPAPI.DLL
WINTRUST.dll
WINTRUST.dll
SensApi.dll
SensApi.dll
HttpOpenRequestA
HttpOpenRequestA
HttpSendRequestA
HttpSendRequestA
urlmon.dll
urlmon.dll
gdiplus.dll
gdiplus.dll
USERENV.dll
USERENV.dll
payload.x86.dll
payload.x86.dll
%Documents and Settings%\All Users\Application Data\d0hh048ddd.exe
%Documents and Settings%\All Users\Application Data\d0hh048ddd.exe
\\.\pipe\ffb23cf9
\\.\pipe\ffb23cf9
a8a56912x
a8a56912x
a8a5691dx
a8a5691dx
%WinDir%\explorer.exe
%WinDir%\explorer.exe
?.?5?:???\?
?.?5?:???\?
Windows Explorer
Windows Explorer