Trojan.Generic.8884557_026387233b

Trojan.Win32.Patched.oy (Kaspersky), Trojan.Generic.8884557 (B) (Emsisoft), Trojan.Generic.8884557 (AdAware), Trojan.Win32.Sasfis.FD, VirTool.Win32.DelfInject.FD, GenericInjector.YR, GenericDownloader.YR (Lavasoft MAS)Behaviour: Trojan, VirTool

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

33s

33s

:$.EJ

:$.EJ

HR.ma

HR.ma

1333333333

1333333333

..YLc.*

..YLc.*

4:;;100`.

4:;;100`.

.BOOO

.BOOO

!),.:;?]}

!),.:;?]}

\VVV.macromedia.com

\VVV.macromedia.com

r.exe

r.exe

\Logs\codesign.txt

\Logs\codesign.txt

lWinHTTP AutoProxy Test

lWinHTTP AutoProxy Test

control.tlb

control.tlb

Adobe Flash Player has stopped a potentially unsafe operation.

Adobe Flash Player has stopped a potentially unsafe operation.

Adobe Flash Player ha interrotto un'operazione potenzialmente pericolosa.

Adobe Flash Player ha interrotto un'operazione potenzialmente pericolosa.

Adobe Flash Player ha detenido una operaci

Adobe Flash Player ha detenido una operaci

Enter the World Wide Web location (URL) or specify the local file you would like to open.

Enter the World Wide Web location (URL) or specify the local file you would like to open.

Geben Sie die Internetadresse (URL) oder eine lokale Datei an, die Sie

Geben Sie die Internetadresse (URL) oder eine lokale Datei an, die Sie

cifiez l'adresse URL (World Wide Web) ou le fichier local

cifiez l'adresse URL (World Wide Web) ou le fichier local

Passo &avanti

Passo &avanti

Specificare l'indirizzo (URL) dell'elemento da aprire.

Specificare l'indirizzo (URL) dell'elemento da aprire.

n Web (URL) o especifique el archivo local que desee abrir.

n Web (URL) o especifique el archivo local que desee abrir.

World Wide Web

World Wide Web

(URL)

(URL)

Adobe Flash Player 9;Adobe Flash movie (*.swf)|*.swf;*.spl|All Files (*.*)|*.*||

Adobe Flash Player 9;Adobe Flash movie (*.swf)|*.swf;*.spl|All Files (*.*)|*.*||

Projector (*.exe)|*.exe||GCopyright

Projector (*.exe)|*.exe||GCopyright

Adobe Flash Player 9>Adobe Flash movie (*.swf)|*.swf;*.spl|Alle Dateien (*.*)|*.*||

Adobe Flash Player 9>Adobe Flash movie (*.swf)|*.swf;*.spl|Alle Dateien (*.*)|*.*||

Projektor (*.exe)|*.exe||KCopyright

Projektor (*.exe)|*.exe||KCopyright

ndern schwebend. Adobe und Flash sind Marken oder registrierte Marken in den USA und/oder anderen L

ndern schwebend. Adobe und Flash sind Marken oder registrierte Marken in den USA und/oder anderen L

Adobe Flash Player 9CAdobe Flash movie (*.swf)|*.swf;*.spl|Tous les fichiers (*.*)|*.*||

Adobe Flash Player 9CAdobe Flash movie (*.swf)|*.swf;*.spl|Tous les fichiers (*.*)|*.*||

Projection (*.exe)|*.exe||HCopyright

Projection (*.exe)|*.exe||HCopyright

ricain 6.879.327 ; Brevets en cours aux

ricain 6.879.327 ; Brevets en cours aux

Adobe Flash Player 9>Adobe Flash movie (*.swf)|*.swf;*.spl|Tutti i file (*.*)|*.*||

Adobe Flash Player 9>Adobe Flash movie (*.swf)|*.swf;*.spl|Tutti i file (*.*)|*.*||

Proiettore (*.exe)|*.exe||LCopyright

Proiettore (*.exe)|*.exe||LCopyright

Adobe Flash Player 9DAdobe Flash movie (*.swf)|*.swf;*.spl|Todos los archivos (*.*)|*.*||

Adobe Flash Player 9DAdobe Flash movie (*.swf)|*.swf;*.spl|Todos los archivos (*.*)|*.*||

Proyector (*.exe)|*.exe||PCopyright

Proyector (*.exe)|*.exe||PCopyright

Adobe Flash Player 9:Adobe Flash movie (*.swf)|*.swf;*.spl|

Adobe Flash Player 9:Adobe Flash movie (*.swf)|*.swf;*.spl|

(*.*)|*.*||

(*.*)|*.*||

(*.exe)|*.exe||4Copyright (C) 1996-2007 Adobe Systems Incorporated. v

(*.exe)|*.exe||4Copyright (C) 1996-2007 Adobe Systems Incorporated. v

6,879,327

6,879,327

Adobe Flash Player 96Adobe Flash movie (*.swf)|*.swf;*.spl|

Adobe Flash Player 96Adobe Flash movie (*.swf)|*.swf;*.spl|

(*.exe)|*.exe||3Copyright (C) 1996-2007 Adobe Systems Incorporated.K

(*.exe)|*.exe||3Copyright (C) 1996-2007 Adobe Systems Incorporated.K

(*.exe)|*.exe||3Copyright (C) 1996-2007 Adobe Systems Incorporated.J

(*.exe)|*.exe||3Copyright (C) 1996-2007 Adobe Systems Incorporated.J

(*.*)|*.*||

(*.*)|*.*||

(*.exe)|*.exe||ICopyright (C) 1996-2007 Adobe Systems Incorporated. All Rights Reserved.

(*.exe)|*.exe||ICopyright (C) 1996-2007 Adobe Systems Incorporated. All Rights Reserved.

%original file name%.exe_2772_rwx_00608000_0006C000:

.idata

.idata

.rdata

.rdata

P.reloc

P.reloc

P.rsrc

P.rsrc

####@####

####@####

kernel32.dll

kernel32.dll

ShellExecuteA

ShellExecuteA

shell32.dll

shell32.dll

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

GetWindowsDirectoryA

GetWindowsDirectoryA

SOFTWARE\Microsoft\Windows\CurrentVersion

SOFTWARE\Microsoft\Windows\CurrentVersion

C:\default.html

C:\default.html

PSAPI.dll

PSAPI.dll

VBoxService.exe

VBoxService.exe

SbieDll.dll

SbieDll.dll

dbghelp.dll

dbghelp.dll

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

55274-640-2673064-23950

55274-640-2673064-23950

76487-644-3177037-23510

76487-644-3177037-23510

76487-337-8429955-22614

76487-337-8429955-22614

\\.\Syser

\\.\Syser

\\.\SyserDbgMsg

\\.\SyserDbgMsg

\\.\SyserBoot

\\.\SyserBoot

\\.\SICE

\\.\SICE

\\.\NTICE

\\.\NTICE

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

explorer.exe

explorer.exe

user32.dll

user32.dll

GetKeyboardType

GetKeyboardType

advapi32.dll

advapi32.dll

RegOpenKeyExA

RegOpenKeyExA

RegCloseKey

RegCloseKey

oleaut32.dll

oleaut32.dll

RegDeleteKeyA

RegDeleteKeyA

RegCreateKeyExA

RegCreateKeyExA

RegCreateKeyA

RegCreateKeyA

MsgWaitForMultipleObjects

MsgWaitForMultipleObjects

FindExecutableA

FindExecutableA

?*?/?]?}?

?*?/?]?}?

####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@####

####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@####

####@#### ####@####

####@#### ####@####

####@#### ####@#### ####@#### ####@####

####@#### ####@#### ####@#### ####@####

####@#### ####@#### ####@####

####@#### ####@#### ####@####

####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@####

####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@####

y.YZJO

y.YZJO

nr.AQ

nr.AQ

E.naM

E.naM

$T.GN

$T.GN

R:\JD

R:\JD

R%fLJg

R%fLJg

>.RW$

>.RW$

Az.Sc

Az.Sc

Qw>%UPRi

Qw>%UPRi

z<.mj>

z<.mj>

2X.jtL

2X.jtL

\X%X,``

\X%X,``

%XXTTD*/

%XXTTD*/

.TdiL

.TdiL

.In:|k

.In:|k

Nd/.zk

Nd/.zk

KWindows

KWindows

explorer.exe_3164:

.text

.text

`.data

`.data

.rsrc

.rsrc

@.reloc

@.reloc

ADVAPI32.dll

ADVAPI32.dll

BROWSEUI.dll

BROWSEUI.dll

GDI32.dll

GDI32.dll

KERNEL32.dll

KERNEL32.dll

NTDLL.DLL

NTDLL.DLL

msvcrt.dll

msvcrt.dll

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

SHDOCVW.dll

SHDOCVW.dll

SHELL32.dll

SHELL32.dll

SHLWAPI.dll

SHLWAPI.dll

USER32.dll

USER32.dll

UxTheme.dll

UxTheme.dll

FTSSh

FTSSh

t0SSh

t0SSh

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system

SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system

SShwk

SShwk

98~%SP

98~%SP

ExplorerStartMsgLoop

ExplorerStartMsgLoop

PSSh;

PSSh;

6SSSSh

6SSSSh

SSSSh

SSSSh

SPSSSShL

SPSSSShL

u%SSh

u%SSh

t.WWWW

t.WWWW

xpsp2res.dll

xpsp2res.dll

xpsp3res.dll

xpsp3res.dll

tbSSh

tbSSh

Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartMenu

Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartMenu

Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartPanel

Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartPanel

kernel32.dll

kernel32.dll

GetSystemWindowsDirectoryW

GetSystemWindowsDirectoryW

NetGetJoinInformation

NetGetJoinInformation

WINMM.dll

WINMM.dll

SETUPAPI.dll

SETUPAPI.dll

WINSTA.dll

WINSTA.dll

OLEACC.dll

OLEACC.dll

USERENV.dll

USERENV.dll

ntdll.dll

ntdll.dll

RegEnumKeyExW

RegEnumKeyExW

RegNotifyChangeKeyValue

RegNotifyChangeKeyValue

RegOpenKeyExA

RegOpenKeyExA

RegEnumKeyW

RegEnumKeyW

RegCloseKey

RegCloseKey

RegCreateKeyW

RegCreateKeyW

RegQueryInfoKeyW

RegQueryInfoKeyW

RegOpenKeyExW

RegOpenKeyExW

RegCreateKeyExW

RegCreateKeyExW

OffsetViewportOrgEx

OffsetViewportOrgEx

GetViewportOrgEx

GetViewportOrgEx

SetViewportOrgEx

SetViewportOrgEx

SetProcessShutdownParameters

SetProcessShutdownParameters

GetProcessHeap

GetProcessHeap

GetWindowsDirectoryW

GetWindowsDirectoryW

CreateIoCompletionPort

CreateIoCompletionPort

ShellExecuteExW

ShellExecuteExW

SHRegCloseUSKey

SHRegCloseUSKey

SHRegCreateUSKeyW

SHRegCreateUSKeyW

AssocQueryKeyW

AssocQueryKeyW

SHRegOpenUSKeyW

SHRegOpenUSKeyW

SHDeleteKeyW

SHDeleteKeyW

TileWindows

TileWindows

ExitWindowsEx

ExitWindowsEx

RegisterHotKey

RegisterHotKey

UnregisterHotKey

UnregisterHotKey

EnumChildWindows

EnumChildWindows

GetKeyState

GetKeyState

GetAsyncKeyState

GetAsyncKeyState

CascadeWindows

CascadeWindows

MsgWaitForMultipleObjects

MsgWaitForMultipleObjects

EnumWindows

EnumWindows

explorer.pdb

explorer.pdb

name="Microsoft.Windows.Shell.explorer"

name="Microsoft.Windows.Shell.explorer"

version="5.1.0.0"

version="5.1.0.0"

Windows Shell

Windows Shell

name="Microsoft.Windows.Common-Controls"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

publicKeyToken="6595b64144ccf1df"

]]"```^]]\

]]"```^]]\

3333333330

3333333330

3333330

3333330

333333334

333333334

)@. '5 !*

)@. '5 !*

.DEHHF>?/

.DEHHF>?/

2

2

&$%Uooqkezs

&$%Uooqkezs

['$$#%&(4

['$$#%&(4

3333333333333333333

3333333333333333333

33333333333330

33333333333330

7''''))

7''''))

3'')))33.

3'')))33.

222`444(555

222`444(555

%%%{///-

%%%{///-

000000000

000000000

00000000

00000000

`[66...00

`[66...00

0000000

0000000

`]66./.000

`]66./.000

/./././././././.

/./././././././.

66///0000

66///0000

0000000000000

0000000000000

0000000000

0000000000

6666,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,0.010.010.010.010.010.010.010.010.010.010.001

6666,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,0.010.010.010.010.010.010.010.010.010.010.001

4366666666K,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6.010.010.010.010.010.010.010.010.010.010.000

4366666666K,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6.010.010.010.010.010.010.010.010.010.010.000

:;

:;

) ) ) ) )

) ) ) ) )

|2222'2'2'2'2'2'2'2'2'2'2'2'2'2'2'2',),),),),),),),),),),),),),),),),),),),),),,

|2222'2'2'2'2'2'2'2'2'2'2'2'2'2'2'2',),),),),),),),),),),),),),),),),),),),),),,

22222222222

22222222222

3333333

3333333

.SB99;;;99twv}ut{oxt~

.SB99;;;99twv}ut{oxt~

.SB;;;:::2:w}{{qddgghg

.SB;;;:::2:w}{{qddgghg

" """ """ """ """ "" #

" """ """ """ """ "" #

""" """ """ "#

""" """ """ "#

.SG>''';;9::p

.SG>''';;9::p

:5:5:5:5:5:5:5:5:5:5#"

:5:5:5:5:5:5:5:5:5:5#"

# # # # # # # # # # # # # # # # # # # # # ##$

# # # # # # # # # # # # # # # # # # # # # ##$

( # # # # # # # # # # # # # # # # # # # # ###

( # # # # # # # # # # # # # # # # # # # # ###

1232123212321232123

1232123212321232123

(&(((&(((&(((&(((&((&&)

(&(((&(((&(((&(((&((&&)

&(((&(((&(((&()

&(((&(((&(((&()

`,''')))

`,''')))

'4,4'4,4'4,4'4,4'4,4)(

'4,4'4,4'4,4'4,4'4,4)(

55///0000

55///0000

5555-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-0

5555-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-0

555555555

555555555

55555555

55555555

5555555

5555555

14441444144414441

14441444144414441

4343434343434343

4343434343434343

5555555555555

5555555555555

5555555555

5555555555

-,-,-,-,-,-,-,-,-,-,-*.

-,-,-,-,-,-,-,-,-,-,-*.

..............................JFJFJFJFJFJFJFJFJFJFJ.-

..............................JFJFJFJFJFJFJFJFJFJFJ.-

{22*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-../

{22*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-../

|ujjjjuhF..BBBBBBBBBBBBT

|ujjjjuhF..BBBBBBBBBBBBT

~j|F.BB*BBB*BBB*Bwop

~j|F.BB*BBB*BBB*Bwop

&!!!&!!!&

&!!!&!!!&

44466666

44466666

44444444416

44444444416

4446666

4446666

66666666

66666666

|= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |=

|= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |=

|= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |=

|= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |=

DDDDE%CTDD@

DDDDE%CTDD@

A%US$

A%US$

%UUUU

%UUUU

%%UUU

%%UUU

33U

33U

""2222!!

""2222!!

!"!"%UUR""

!"!"%UUR""

!""!"#2"""

!""!"#2"""

"!!"#3"!"

"!!"#3"!"

dnnnnn:n.nfCnmddddd

dnnnnn:n.nfCnmddddd

////;/;;88

////;/;;88

;888;;!/

;888;;!/

!//!!;;^

!//!!;;^

:;:!::!!!

:;:!::!!!

.88.88.8

.88.88.8

.N.NN.M

.N.NN.M

::8.8...

::8.8...

:::!;;:!

:::!;;:!

//!!;888

//!!;888

.8.8.88...

.8.8.88...

:;!::!!;!//!;

:;!::!!;!//!;

!!;:!!::

!!;:!!::

.88..8..

.88..8..

!!:::/^!

!!:::/^!

!;/;!;;;!!!:

!;/;!;;;!!!:

.8:!!!!^

.8:!!!!^

!!:;:::..

!!:;:::..

/:!^^!;{8{../

/:!^^!;{8{../

...:::.-

...:::.-

**6***66*6**6566*5666 ,

**6***66*6**6566*5666 ,

6*6666*6*6 655*65

6*6666*6*6 655*65

6*65 56*5 55 555 *5 6

6*65 56*5 55 555 *5 6

555( 55 (5 5(

555( 55 (5 5(

76 5 66 555*677

76 5 66 555*677

6*6 5 5(5 (55( '5((5 (556 ('5

6*6 5 5(5 (55( '5((5 (556 ('5

665**6(('S((((((S(((]('((@('SS((S(((((((6C-.NEC66S5sU

665**6(('S((((((S(((]('((@('SS((S(((((((6C-.NEC66S5sU

555(555(5((5(5(5(

555(555(5((5(5(5(

5 5 5 5555 (555(555'(((5(5('55(((

5 5 5 5555 (555(555'(((5(5('55(((

((''('5'5(5('('('('('((''('(((@(((('&(((&

((''('5'5(5('('('('('((''('(((@(((('&(((&

%&&%&&&&3>&3&3&33&3&3333&&3>3333

%&&%&&&&3>&3&3&33&3&3333&&3>3333

'(3&'&3&

'(3&'&3&

3&33&&((

3&33&&((

3323>33>%>3%>3>33>3%3&%

3323>33>%>3%>3>33>3%3&%

*5'(('((&@3(

*5'(('((&@3(

,63%3>323>3%>&>33323>>%>

,63%3>323>3%>&>33323>>%>

3(3'(((@@'5('@(@(&('(

3(3'(((@@'5('@(@(&('(

>2>323%>3

>2>323%>3

75((((@3&333&3&&&%&3&&3&33>33%3>23%>3

75((((@3&333&3&&&%&3&&3&33>33%3>23%>3

>2%$32%>2>%>2$3>

>2%$32%>2>%>2$3>

3&%&&3&33>3>33

3&%&&3&33>3>33

3>%>3%&3$23>23$2>2%$>2>

3>%>3%&3$23>23$2>2%$>2>

)4433((&(&('*

)4433((&(&('*

('((((''(**6(('' *

('((((''(**6(('' *

32323>3>

32323>3>

2$%>22%>%3' (

2$%>22%>%3' (

&(&''((5(5 *

&(&''((5(5 *

'(&(&((&('''

'(&(&((&('''

&&%&3&&%3%

&&%&3&&%3%

2%>22>22

2%>22>22

5''3(((3(('&(&'&

5''3(((3(('&(&'&

3%%3%3%2#$

3%%3%3%2#$

22$22$2%$22$2%2%$2%$2$222%$22

22$22$2%$22$2%2%$2%$2$222%$22

&>2$2$2$222$22$%%

&>2$2$2$222$22$%%

:7'((('(3('(3(&(&

:7'((('(3('(3(&(&

222222222222

222222222222

22222222222222

22222222222222

222222222222222

222222222222222

22$22$22$22$

22$22$22$22$

&(%3%&&&&3&&&3%3

&(%3%&&&&3&&&3%3

222222222222222222

222222222222222222

&&(&3(&(&'('((3'(&&

&&(&3(&(&'('((3'(&&

2222222

2222222

22$

22$

&&(3(3('(&'

&&(3(3('(&'

222"2212

222"2212

22

22

(&(3(3((

(&(3(3((

((565 ((( 6

((565 ((( 6

333&33(&&

333&33(&&

'(('('(('(

'(('('(('(

'&%%"$

'&%%"$

2"2"22"2

2"2"22"2

2222

2222

"2"22

"2"22

2%('(3'32222?&'

2%('(3'32222?&'

2"2"2"121212

2"2"2"121212

2"2"2$"?

2"2"2$"?

%%22%2

%%22%2

&3(3(3((&

&3(3(3((&

"2"

"2"

1"?((&21

1"?((&21

22

22

2%""22&&

2%""22&&

2

2

'&('(3(''

'&('(3(''

((%%%"

((%%%"

5(3%"%

5(3%"%

"2%5*67

"2%5*67

))) ))))

))) ))))

""**

""**

"*

"*

#2#---2222-222442-

#2#---2222-222442-

---(-%

---(-%

$/222(--444222!

$/222(--444222!

#&-221269924999;

#&-221269924999;

&$-22-($2%

&$-22-($2%

#(2---222622212-

#(2---222622212-

#2221299629968

#2221299629968

#&--%#(2##!

#&--%#(2##!

-222422422426662-%

-222422422426662-%

"2-##&

"2-##&

!##-#-&%---#---#&-219662%

!##-#-&%---#---#&-219662%

$&-(151,44.9

$&-(151,44.9

&1242662-

&1242662-

-(..19.19

-(..19.19

,4492.12

,4492.12

12-$-,-,

12-$-,-,

-, $$----

-, $$----

#%#-15/-&

#%#-15/-&

-,(,,(,(,

-,(,,(,(,

$$11651566/,$&&

$$11651566/,$&&

,2592&&&-

,2592&&&-

2466/!$$

2466/!$$

""*

""*

) '????[

) '????[

&&&$-556>>61,,5994511-

&&&$-556>>61,,5994511-

$(//$$$(6>6/,$,-$

$(//$$$(6>6/,$,-$

#$-22692/,,$,-&

#$-22692/,,$,-&

-266661..4514#

-266661..4514#

&,2-&#

&,2-&#

&-222,22--#

&-222,22--#

#&&---2-,-&$&(,,291.566..BNNNTNNNNNAABIAA88

#&&---2-,-&$&(,,291.566..BNNNTNNNNNAABIAA88

&!#&!-##

&!#&!-##

--//11468>885882&

--//11468>885882&

$266961$&--$&%

$266961$&--$&%

,1661,!-((#

,1661,!-((#

&$,4255$,92

&$,4255$,92

&$,44..&

&$,44..&

""**""***""

""**""***""

"****

"****

"**""""*""""

"**""""*""""

&-569./-,16522$

&-569./-,16522$

.BAA=86546888=AAAEAAEMNRMQQSWZZ\]gk__m__\

.BAA=86546888=AAAEAAEMNRMQQSWZZ\]gk__m__\

bTRHHHHHQQHQJQWJSSSSSSSSSSSSSSSSWWSSSS\\V]VZW8,.FW]\\]\]\]\\ZZ\\WFR>38(

bTRHHHHHQQHQJQWJSSSSSSSSSSSSSSSSWWSSSS\\V]VZW8,.FW]\\]\]\]\\ZZ\\WFR>38(

.BTTkgn]ktvgmvvvvvmvvvsvzzzyzyzyzyyyzmkkkkkZSRA816;F87

.BTTkgn]ktvgmvvvvvmvvvsvzzzyzyzyzyyyzmkkkkkZSRA816;F87

yzyzyzym^Z]WN3 $&$.Wt\

yzyzyzym^Z]WN3 $&$.Wt\

""*"""****""""

""*"""****""""

"***"**""**

"***"**""**

$5612,.2,

$5612,.2,

&$$,,,5]

&$$,,,5]

$]t.Ft

$]t.Ft

7%8U8

7%8U8

3 303

3 303

2

8 8$8(8,8084888
5%5,575{6
7 7$7(7,70747
rundll32.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
::{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}
::{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}
::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
::{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}
::{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}
::{D20EA4E1-3957-11d2-A40B-0C5020524153}
::{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}
{208D2C60-3AEA-1069-A2D7-08002B30309D}
{20D04FE0-3AEA-1069-A2D8-08002B30309D}
Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites
{450D8FBA-AD25-11D0-98A8-0800361B1103}
CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}
Software\Microsoft\Windows\CurrentVersion\RunOnce
Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
Software\Microsoft\Windows\CurrentVersion\Explorer\DontShowMeThisDialogAgain
Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\CleanupWiz
\\.\WMIDataDevice
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
Software\Microsoft\Windows NT\CurrentVersion\Windows
ExplorerIsShellMutex
desk.cpl
Software\Microsoft\Windows\CurrentVersion\Explorer
tourstart.exe
tourstart.exe,0
Microsoft.OfferTour
WINWORD.EXE
Software\Microsoft\Windows\CurrentVersion\Applets
Software\Microsoft\Windows\CurrentVersion\Applets\Tour
explorer.exe,9
Microsoft.FixScreenResolution
shell:::{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}
Software\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation
Software\Microsoft\Windows NT\CurrentVersion
shell:::{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}
Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
DDEEXECUTESHORTCIRCUIT
http\shell
IEXPLORE.EXE
Software\Microsoft\Windows\CurrentVersion\Explorer\Streams\Desktop
Software\Microsoft\Windows\CurrentVersion\RunOnceEx
comctl32.dll
Software\Microsoft\Windows\Internet Settings
AutoConfigURL
system.ini
AppEvents\Schemes\Apps\.Default\%s\.current
Software\Microsoft\Windows\CurrentVersion\Explorer\TrayNotify
MSShellRunDlgReady
res://mys.dll/mys.hta /explorer
mshta.exe
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Setup\Welcome
Software\Microsoft\Windows\CurrentVersion\Explorer\Tips
SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\MYS
cys.exe
SOFTWARE\Microsoft\Windows NT\CurrentVersion\srvWiz
install.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel
OUTLOOK.EXE
explorer.exe,16
iernonce.dll
WININET.DLL
UpdateURL
WindowsUpdate
HWND%x
Software\Microsoft\Windows\CurrentVersion\OemStartMenuData
fldrclnr.dll,Wizard_RunDLL
iexplore.exe
winbrand.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\Remote\%d
shell32.dll
nusrmgr.cpl ,initialTask=ChangePicture
NewExeName
Windows
ediskeer.dll
timedate.cpl
Software\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\LastVisitedMRU
Software\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\OpenSaveMRU
Software\Microsoft\Windows\CurrentVersion\Explorer\Doc Find Spec MRU
Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
Software\Microsoft\Internet Explorer\TypedURLs
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Calculator.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Games\Solitaire.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Paint.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\WordPad.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\Files and Settings Transfer Wizard.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Windows Movie Maker.lnk
%USERPROFILE%\Start Menu\Programs\Accessories\Tour Windows XP.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Windows Messenger.lnk
%USERPROFILE%\Start Menu\Programs\Windows Media Player.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\MSN.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Get Online with MSN.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Get Going with Tablet PC.lnk
%ALLUSERSPROFILE%\Start Menu\Set Program Access and Defaults.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Windows Journal.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Media Center\Media Center.lnk
%USERPROFILE%\Start Menu\Programs\Internet Explorer.lnk
Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel
TSAppCMP.DLL
netapi32.dll
%SystemRoot%\system32\restore\rstrui.exe
RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL ?0x%X?%s
RunDLL32.EXE
%s%d%s
Software\Microsoft\Windows\CurrentVersion\Policies\System
settings.dll
explorer.exe "
explorer.exe /e, "
WindowsLogon
WindowsLogoff
%s %s
Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count
uAppWiz.Cpl
\explorer.exe
Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu
::{20D04FE0-3AEA-1069-A2D8-08002B30309D}
taskmgr.exe
ShellExecute
Software\Microsoft\Windows\CurrentVersion\Explorer\AppKey\%d
\WindowsShell.Manifest
Get Online with MSN.lnk
Set Program Access and Defaults.lnk
Link%d
OEM%d
Software\Microsoft\Windows\CurrentVersion\SMDEn
::{D20EA4E1-3957-11d2-A40B-0C5020524152}
There is a file or folder on your computer called "%s" which could cause certain applications to not function correctly. Renaming it to "%s" would solve this problem. Would you like to rename it now?
Ca&scade Windows
Tile Windows &Horizontally
Tile Windows V&ertically
&Windows Security...
&Help and Support
&Log Off %s...
Windows Explorer
6.00.2900.5512 (xpsp.080413-2105)
EXPLORER.EXE
Windows
Operating System
6.00.2900.5512
Keep the &taskbar on top of other windows
To remove records of recently accessed documents, programs, and Web sites, click Clear.
Windows displays icons for active and urgent notifications, and hides inactive ones. You can change this behavior for items in the list below.
Select this option to use the menu style from earlier versions of Windows.
6There is not enough memory to complete this operation.8Unable to run command.
The folder '%1' has been removed.WMy Computer or Windows Explorer has not been properly initialized yet. Try again later.
&Undo %s
Windows is running in safe mode.
This special diagnostic mode of Windows enables you to fix a problem which may be caused by your network or hardware settings. Make sure these settings are correct in Control Panel, and then try starting Windows again. While in safe mode, some of your devices may not be available.
startRThere was an internal error and one of the windows you were using has been closed.
Restrictions{This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator.
&Show Open Windows
Windows was unable to change the display settings for the new configuration. Return the computer to the previous state, shut down Windows, and restart the computer in the desired configuration.
There may be a problem with your display settings if you continue. To safely change to a new configuration, you should shut down Windows and restart the computer in the desired configuration. Do you want to continue anyway?
This pre-release version of "Internet Explorer 4.0" Desktop/Explorer has expired. Please update to the latest release of "Internet Explorer 4.0" from WWW.MICROSOFT.COM
helpctr.exe>-FromStartHelp
Take a tour of Windows XP
NOpens a window where you can pick search options and work with search results.aOpens a central location for Help topics, tutorials, troubleshooting, and other support services.
/Opens a program, folder, document, or Web site.
Provides options for closing your programs and logging off, or for leaving your programs running and switching to another user.lProvides options for turning off or restarting your computer, or for activating Stand By or Hibernate modes.RDisconnects your session. You can reconnect to the session when you log on again.
&Windows Security
iOpens the My Documents folder, where you can store letters, reports, notes, and other kinds of documents./Displays recently opened documents and folders.KOpens the My Music folder, where you can store music and other audio files.]Opens the My Pictures folder, where you can store digital photos, images, and graphics files.zGives access to, and information about, the disk drives, cameras, scanners, and other hardware connected to your computer.MGives access to, and information about, folders and files on other computers.8Connects to other computers, networks, and the Internet.
explorer.exe_3164_rwx_00090000_00001000:
KERNEL32.DLL
explorer.exe_3164_rwx_001D0000_00001000:
KERNEL32.DLL
explorer.exe_3164_rwx_00210000_00001000:
KERNEL32.DLL
explorer.exe_3164_rwx_00250000_00001000:
KERNEL32.DLL
server.exe_3420:
.text
.rdata
@.data
.rodata
.rsrc
JWx%f
uâ„¢u!
9H%u$
9y%u/
D$4PSSh
L$4QSSh
>%u
~%UVW
D$Dt%SR
SSSht
SSSSht
t5SSSh
tASSSh
SSShS
SSSSShd
SSSSSh
SSSh&
SSShO
SSSh'
SSSh1
SSShn
SSShT
!!!!!!""#$%&'(((((())* ,-.DDDDDDDD//01234555676789:;<:>?@ABC
88888888
8888888888
88888888888888
8888888888888
UDPQ
!"#$%&'()* ,
-./01234456
.idata
P.reloc
P.rsrc
####@####
kernel32.dll
ShellExecuteA
shell32.dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
GetWindowsDirectoryA
SOFTWARE\Microsoft\Windows\CurrentVersion
C:\default.html
PSAPI.dll
VBoxService.exe
SbieDll.dll
dbghelp.dll
Software\Microsoft\Windows\CurrentVersion
55274-640-2673064-23950
76487-644-3177037-23510
76487-337-8429955-22614
\\.\Syser
\\.\SyserDbgMsg
\\.\SyserBoot
\\.\SICE
\\.\NTICE
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
Software\Microsoft\Windows\CurrentVersion\Run
explorer.exe
user32.dll
GetKeyboardType
advapi32.dll
RegOpenKeyExA
RegCloseKey
oleaut32.dll
RegDeleteKeyA
RegCreateKeyExA
RegCreateKeyA
MsgWaitForMultipleObjects
FindExecutableA
?*?/?]?}?
####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@####
####@#### ####@####
####@#### ####@#### ####@#### ####@####
####@#### ####@#### ####@####
####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@####
y.YZJO
nr.AQ
E.naM
$T.GN
R:\JD
R%fLJg
>.RW$
Az.Sc
Qw>%UPRi
z<.mj>
2X.jtL
\X%X,``
%XXTTD*/
.TdiL
.In:|k
Nd/.zk
KWindows
flash.filters.DropShadowFilter
@flash.filters.GlowFilter
flash.filters.BlurFilter
flash.filters.BevelFilter
flash.filters.ConvolutionFilter
flash.filters.DisplacementMapFilter
flash.filters.GradientGlowFilter
flash.filters.GradientBevelFilter
flash.filters.ColorMatrixFilter
application/x-www-form-urlencoded
flash.geom.Rectangle
flash.geom.Point
flash.geom.Transform
portrait
flash.display.BitmapData
flash.geom.Matrix
flash.geom.ColorTransform
ProductDownloadBaseUrl
CodeSignRootCert
AutoUpdateVersionUrl
.macromedia.com
hXXp://
.macromedia.com/support/flashplayer/sys/
hXXps://
mms.cfg
hXXp://VVV.macromedia.com
hXXps://VVV.macromedia.com/support/flashplayer/sys/
FlashAuthor.cfg
=cacheSize.txt
%3 %3 %d %2:%2:%2 GMT%c%2%2 %d
0 1 2 3 4 5 6 7
!%),.?]}
for (var i=0; i
for (var i=index; i
return s.replace(/&/g, "&").replace(/, "/g, ">").replace(/"/g, """).replace(/'/g, "'");
return ""   value.getTime()   "";
Client.Header.MustUnderstand
Client.Data.UnderFlow
NetConnection.Call.BadVersion
_global.System
flash.net.FileReference
PTF://
https:
.macromedia.com/
%s%sdescription.xml
%s%s.xml
%s%s.z
%s?product=%s&signed=true&%s%s
%s&product=%s&signed=true&%s%s
hXXp://fpdownload2.macromedia.com/get/
hXXps://fpdownload.macromedia.com/get/
hXXps://VVV.macromedia.com/bin/flashdownload.cgi
-https=
9,0,115,0
VVV.macromedia.com
Download.Complete
Download.Cancelled
Download.Failed
unknown URL
>1.2.3
Webdings
Curlz MT
http:
[[IMPORT]]/
by-ftp-filename
/crossdomain.xml
to-ports
.local
SHA-256 part of OpenSSL 0.9.8d 28 Sep 2006
A=%b&SA=%b&SV=%b&EV=%b&MP3=%b&AE=%b&VE=%b&ACC=%b&PR=%b&SP=%b&SB=%b&DEB=%b&V=%s%s&PT=%s&AVD=%b&LFD=%b&WD=%b&TLS=%b
hXXp://%s/
.maxscroll
.scroll
NetConnection.Call.Failed
HTTP:
onKeyUp
onKeyDown
url_stream_port
url_stream_host
url_stream_path
NetConnection.Call.Prohibited
url_request_target
url_request
password
vnd.ms.wmhtml:
URLNotFound
hXXp://settingsmanager.adobe.com
hXXp://VVV.adobe.com
hXXp://VVV.macromedia.com/support/flashplayer/sys/
onHTTPStatus
iso_646.irv:1991
windows-936
tcp01140
webcdic-fi-278 euro
webcdic-se-278 euro
%cp037
%csibm037
Tcp852
iso_646.irv:1983
csshiftjis
jwindows-874
windows-1250
windows-1251
windows-1252
windows-1253
windows-1254
windows-1255
windows-1256
windows-1257
windows-1258
windows-31j
cswindows31j
imm32.dll
System.IME
,,0,0,,,
WWW_OpenURL
ddeexec
dwmapi.dll
d3d8.dll
ddraw.dll
RegDeleteKeyW
RegOpenKeyExW
RegCreateKeyExW
version.dll
ShellExecuteExW
Windows 95
Windows 98/ME
Windows NT
Windows 2000
Windows XP
Windows Vista
Windows
Adobe Windows
Macromedia Windows
&M=%s&R=%dx%d&DP=%d&COL=%s&AR=%s&OS=%s&L=%s&IME=%b
*.exe
*.swf
W@\\?\
).mdmp
SAFlashPlayer.exe
player_crash_log_(*).mdmp
z>https
onHTTPError
&Macromedia Flash Certificate Authority1
secure@macromedia.com1
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
update.bat
VerifyMessage : Second CertVerifySubjectCertificateContext() failed.
VerifyMessage : CertVerifySubjectCertificateContext() failed.
VerifyMessage : Certificate chain is too long.
VerifyMessage : CertCreateCertificateContext() failed.
VerifyMessage : CryptGetMessageCertificates() failed.
VerifyMessage : Unable to read external root certificate specified in MMS.CFG by CodeSignRootCert.
\\?\UNC\
HTTP/1.0
%d.%d.%d.%d
trapallkeys
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpDetectAutoProxyConfigUrl
WinHttpGetDefaultProxyConfiguration
WinHttpCloseHandle
WinHttpOpen
winhttp.dll
URLDownloadToFileA
urlmon.dll
jsproxy.dll
DetectAutoProxyUrl
wininet.dll
http=
https=
Secur32.dll
Security.dll
CertCloseStore
CertOpenSystemStoreW
CertFreeCertificateContext
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertGetCertificateChain
crypt32.dll
.jpeg
FtpOpenFileA
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
User32.dll
FlashPlayer.ProtectedMediaForFlashPlayer
FlashPlayer.ProtectedMediaForFlashPlayer\DefaultIcon
FlashPlayer.ProtectedMediaForFlashPlayer\shell\open\command
FlashPlayer.AudioForFlashPlayer
FlashPlayer.AudioForFlashPlayer\DefaultIcon
FlashPlayer.AudioForFlashPlayer\shell\open\command
FlashPlayer.VideoForFlashPlayer
FlashPlayer.VideoForFlashPlayer\DefaultIcon
FlashPlayer.VideoForFlashPlayer\shell\open\command
FlashPlayer.FlashVideo
FlashPlayer.FlashVideo\DefaultIcon
FlashPlayer.FlashVideo\shell\open\command
ShockwaveFlash.ShockwaveFlash
ShockwaveFlash.ShockwaveFlash\DefaultIcon
ShockwaveFlash.ShockwaveFlash\shell\open\command
keyFrameInterval
tag=%s;timestamp=%d;zone=%d;uri=%s
NetConnection.Connect.CertificateAPIError
NetConnection.Connect.CertificateInvalid
NetConnection.Connect.CertificateRevoked
NetConnection.Connect.CertificateUntrustedSigner
NetConnection.Connect.CertificatePrincipalMismatch
NetConnection.Connect.CertificateExpired
NetConnection.Connect.SSLHandshakeFailed
NetConnection.Connect.SSLNotAvailable
NetConnection.Connect.ProxyAuthFailed
CONNECT %s:%d HTTP/1.1
127.0.0.1
fpadPort
.Unmuted
.Muted
Camera.Unmuted
Camera.Muted
Microphone.Unmuted
Microphone.Muted
/bin/flashhelp.cgi
~&\;:"',? #
macromedia.com
/support/flashplayer/sys/
SharedObject.Failed
SharedObject.Flush.Failed
SharedObject.Flush.Success
hXXp://%s
hXXp://a.
SharedObject.BadPersistence
SharedObject.UriMismatch
NetConnection.Connect.Failed
NetConnection.Connect.Success
NetConnection.Connect.Closed
port
pageUrl
tcUrl
swfUrl
HTTPS
@NetStream.Buffer.Flush
NetStream.Buffer.Full
NetStream.Buffer.Empty
NetStream.Play.Stop
NetStream.Play.Start
NetStream.Unpause.Notify
NetStream.Pause.Notify
b?NetStream.Play.NoSupportedTrackFound
NetStream.Play.FileStructureInvalid
NetStream.Seek.Notify
NetStream.Seek.InvalidTime
NetStream.Play.StreamNotFound
NetStream.Publish.BadName
NetStream.Play.Failed
HttpEndRequestA
HttpSendRequestExA
HttpAddRequestHeadersA
FileReference.upload
FileReference.download
FileReference.browse
FileReferenceList.browse
trapAllKeys
BitmapData.draw
Operation
operationStr
Loader.content
LoaderContext.checkPolicyFile
LoaderContext.securityDomain
Loader.load
LoaderInfo.loader
LoaderInfo.content
LocalConnection.send
LocalConnection.connect
NetConnection.connect
NetStream.play
keyDown
keyFocusChange
keyUp
httpStatus
navigateToURL
sendToURL
hXXp://VVV.adobe.com/2006/actionscript/flash/proxy
SharedObject.getLocal
SharedObject.getRemote
.connect
Sound.load
Sound.id3
@SoundMixer.computeSpectrum
Stage.removeChildAt
Stage.swapChildrenAt
flash.text
URLStream.load
OleAut32.dll
q.CUN3C
4294967295
@wKA%2:%2:%2 %cM
%2:%2:%2 GMT%c%2%2
%3 %3 %d %d
%3 %3 %d %2:%2:%2 %d UTC
%3 %3 %d %d %2:%2:%2 %cM
-2147483648
hXXp://VVV.w3.org/XML/1998/namespace
builtin.as$0
hasOwnProperty!hXXp://adobe.com/AS3/2006/builtin
Boolean.prototype.toString
Boolean.prototype.valueOf
Number.prototype.toString
Number.prototype.valueOf
int.prototype.toString
int.prototype.valueOf
uint.prototype.toString
uint.prototype.valueOf
String.prototype.toString
String.prototype.valueOf
RETURNINDEXEDARRAY
join
_join
builtin.as$0:MethodClosure
Math.as$1
Error.as$2
RegExp.as$3
Date.as$4
XML.as$5
QName.prototype.toString
((('&%$#"!
*{?.cu
 !,"/%0&3%4&7-8.;-<.>O=P>SATBWAXB[I\J_I`JcMdNgMhNkUlVoUpVsYtZwYxZ{]|^
$ 29:3,%
&-4;7?
#)0*$%&' 12,-./3894567:;?
!""##$$%%%&&&''''
#%*,!"$(' -.
mscoree.dll
- This application cannot run using the active version of the Microsoft .NET Runtime
Please contact the application's support team for more information.
internal state. The program cannot safely continue execution and must
continue execution and must now be terminated.
GetProcessWindowStation
e:\flashfarm\depot\main\player\branches\FlashPlayer\FlashPlayer9_DotReleases\platform\win32\standalone\Release\FlashPlayer.pdb
WININET.dll
CertVerifySubjectCertificateContext
CertFindCertificateInStore
CertCreateCertificateContext
CryptGetMessageCertificates
CRYPT32.dll
VERSION.dll
WINMM.dll
OLEAUT32.dll
GetCPInfo
KERNEL32.dll
GetKeyboardLayout
GetKeyState
MapVirtualKeyA
USER32.dll
GDI32.dll
comdlg32.dll
ADVAPI32.dll
SHELL32.dll
ole32.dll
WS2_32.dll
GetProcessHeap
FlashPlayer.exe
pcre_exec
t.ZgN2_:
~.Oo 0
flash.utils
flash.debugger
adobe.utils
MMExecute
flash.profiler
flash.net
URLRequest
sendToURL"flash.errors:IllegalOperationError
flash.errors
IllegalOperationError
flash.errors:IOError
flash.errors:MemoryError
flash.errors:StackOverflowError
flash.errors:ScriptTimeoutError
flash.errors:InvalidSWFError
flash.errors:EOFError
flash_errors.as$1
flash.text:CSMSettings
CSMSettings.as$3
CSMSettings flash.net:IDynamicPropertyOutput
IDynamicPropertyOutput flash.net:IDynamicPropertyWriter
flash.utils:IExternalizable
flash.display
IBitmapDrawable!flash.accessibility:Accessibility
flash.accessibility
Accessibility.as$12/flash.accessibility:AccessibilityImplementation
stub!AccessibilityImplementation.as$13
flash.geom
ExcludeClass flash.accessibility:AccessibilityProperties
AccessibilityProperties.as$14
flash.system:ApplicationDomain
flash.system
ApplicationDomain.as$16
flash.geom:ColorTransform
ColorTransform.as$23
concat flash.ui:ContextMenuBuiltInItems
flash.ui
ContextMenuBuiltinItems.as$26
adobe.utils:CustomActions
CustomActions.as$29
flash.utils:Endian
Endian.as$32
flash.utils:IDataInput
flash.utils:IDataOutput
writeObject'flash.filters:DisplacementMapFilterMode
flash.filters
DisplacementMapFilterMode.as$37
flash.display:BlendMode
BlendMode.as$39
flash.events:Event
flash.events
Event.as$43
flash.events:EventPhase
EventPhase.as$44 flash.external:ExternalInterface
ExternalInterface.as$46
flash.external
_evalJS.__flash__addCallback(document.getElementById("
document.getElementById("
").SetReturnValue(
; } catch (e) { 6").SetReturnValue(""   e   "");"").SetReturnValue("");#""   e   "";
FSCommand.as$47
flash.system:FSCommand
flash.net:FileFilter
FileFilter.as$48
flash.text:Font
Font.as$52
flash.text:FontType
FontType.as$53
flash.display:Graphics
Graphics.as$58
flash.display:GradientType
GradientType.as$59
flash.display:SpreadMethod
SpreadMethod.as$60!flash.display:InterpolationMethod
InterpolationMethod.as$61
flash.display:LineScaleMode
LineScaleMode.as$62
flash.display:CapsStyle
CapsStyle.as$63
flash.display:JointStyle
JointStyle
JointStyle.as$64
flash.events:IEventDispatcher
flash.display:BitmapDataChannel
BitmapDataChannel.as$69
flash.filters:BitmapFilter
BitmapFilter.as$70
flash.filters:BitmapFilterType
BitmapFilterType.as$71!flash.filters:BitmapFilterQuality
BitmapFilterQuality.as$72
flash.display:PixelSnapping
PixelSnapping.as$74
flash.ui:Keyboard
Keyboard
Keyboard.as$77
flash.ui:KeyLocation
KeyLocation
KeyLocation.as$78
flash.text:TextLineMetrics
TextLineMetrics.as$80
flash.system:SecurityDomain
SecurityDomain.as$83
flash.system:LoaderContext
LoaderContext.as$84
flash.geom:Matrix
Matrix.as$87
flash.ui:Mouse
Mouse.as$91
flash.display:Scene
Scene.as$94
flash.display:FrameLabel
FrameLabel.as$95
flash.net:ObjectEncoding
ObjectEncoding.as$101
flash.geom:Point
Point.as$102
flash.printing:PrintJobOptions
PrintJobOptions.as$104
flash.printing
PrintJobOptions"flash.printing:PrintJobOrientation
PORTRAIT
PrintJobOrientation.as$105
flash.display:SWFVersion
SWFVersion.as$106!flash.display:ActionScriptVersion
ActionScriptVersion.as$107
flash.utils:Proxy
Proxy.as$1112hXXp://VVV.adobe.com/2006/actionscript/flash/proxy
flash.geom:Rectangle
Rectangle.as$112
flash.net:Responder
Responder.as$113
flash.system:Security
Security.as$114
flash.system:SecurityPanel
SecurityPanel.as$115
flash.media:ID3Info
flash.media
ID3Info.as$121
flash.media:SoundLoaderContext
SoundLoaderContext.as$122
flash.media:SoundTransform
SoundTransform.as$124
flash.media:SoundMixer
SoundMixer.as$125
flash.display:StageAlign
StageAlign.as$127
flash.display:StageDisplayState
StageDisplayState.as$128
flash.display:StageQuality
StageQuality.as$129
flash.display:StageScaleMode
StageScaleMode.as$130
flash.system:System
System.as$135
flash.system:Capabilities
Capabilities.as$136
flash.system:IMEConversionMode
IMEConversionMode.as$138
flash.text:TextExtent
TextExtent.as$139
flash.text:TextFieldAutoSize
TextFieldAutoSize.as$141
flash.text:TextFieldType
TextFieldType.as$142
flash.text:TextFormat
TextFormat.as$143
flash.text:TextFormatDisplay
TextFormatDisplay.as$144
flash.text:TextFormatAlign
TextFormatAlign.as$145
flash.text:TextRenderer
TextRenderer.as$146
flash.text:AntiAliasType
AntiAliasType.as$147!flash.net:SharedObjectFlushStatus
SharedObjectFlushStatus.as$148
flash.text:GridFitType
GridFitType.as$149
flash.text:TextColorType
TextColorType.as$150
flash.text:TextDisplayMode
TextDisplayMode.as$151
flash.text:FontStyle
FontStyle.as$152
flash.text:TextRun
TextRun.as$153
flash.text:TextSnapshot
TextSnapshot.as$154
flash.geom:Transform
Transform.as$158
flash.net:URLLoaderDataFormat
URLLoaderDataFormat
URLLoaderDataFormat.as$160
flash.net:URLRequest
URLRequest.as$161
flash.net:URLRequestHeader
URLRequestHeader.as$162
URLRequestHeader
flash.net:URLRequestMethod
URLRequestMethod
URLRequestMethod.as$163
flash.net:URLVariables
URLVariables.as$165
URLVariables
flash.xml:XMLNode
flash.xml
XMLNode.as$167
flash.xml:XMLNodeType
XMLNodeType.as$168
flash.xml:XMLParser
XMLParser.as$170
flash.xml:XMLTag
XMLTag.as$172
Sampler.as$173
flash.sampler
flash.sampler:StackFrame
flash.sampler:Sample
flash.sampler:NewObjectSample
NewObjectSample flash.sampler:DeleteObjectSample
adobe.utils:XMLUI
XMLUI.as$174
flash.trace:Trace
flash.trace
Trace.as$175
flash.utils:Dictionary
Dictionary.as$176
flash.net:DynamicPropertyOutput
DynamicPropertyOutput.as$7
flash.display:BitmapData
BitmapData.as$68
flash.utils:ObjectInput
ObjectInput.as$5
flash.utils:ObjectOutput
ObjectOutput.as$4
flash.utils:ByteArray
ByteArray.as$20
flash.events:ActivityEvent
ActivityEvent.as$15
flash.events:TextEvent
TextEvent.as$30
flash.events:FocusEvent
KEY_FOCUS_CHANGE
FocusEvent.as$51
m_shiftKey
m_keyCode
shiftKey
keyCode
flash.events:HTTPStatusEvent
HTTP_STATUS
HTTPStatusEvent.as$65
HTTPStatusEvent
flash.events:KeyboardEvent
KEY_DOWN
KEY_UP
KeyboardEvent.as$79
m_keyLocation
m_ctrlKey
m_altKey
KeyboardEvent
keyLocation
ctrlKey
altKey
flash.events:ContextMenuEvent
ContextMenuEvent.as$88
flash.events:MouseEvent
MouseEvent.as$92
flash.events:NetStatusEvent
NetStatusEvent.as$98
flash.events:NetFilterEvent
NetFilterEvent.as$100
flash.events:ProgressEvent
ProgressEvent.as$110
flash.events:StatusEvent
StatusEvent.as$132
flash.events:SyncEvent
SyncEvent.as$134
flash.events:TimerEvent
TimerEvent.as$157
flash.events:WeakMethodClosure
WeakMethodClosure flash.events:WeakFunctionClosure
flash.events:EventDispatcher
EventDispatcher.as$45
flash.events.Event
flash.filters:BevelFilter
BevelFilter.as$17
flash.filters:BlurFilter
BlurFilter.as$18
flash.filters:ColorMatrixFilter
ColorMatrixFilter.as$22
flash.filters:ConvolutionFilter
ConvolutionFilter.as$28
ConvolutionFilter#flash.filters:DisplacementMapFilter
DisplacementMapFilter.as$36
flash.filters:DropShadowFilter
DropShadowFilter.as$40
flash.filters:GlowFilter
GlowFilter.as$55
GlowFilter!flash.filters:GradientBevelFilter
GradientBevelFilter.as$56
GradientBevelFilter flash.filters:GradientGlowFilter
GradientGlowFilter.as$57
flash.xml:XMLDocument
XMLDocument.as$169
flash.events:FullScreenEvent
FullScreenEvent.as$54
flash.events:DataEvent
DataEvent.as$31
flash.events:ErrorEvent
ErrorEvent.as$42
flash.events:IMEEvent
ImeEvent.as$75
flash.media:Camera
setKeyFrameInterval
Camera.as$21
flash.events.StatusEvent
flash.events.ActivityEvent
flash.ui:ContextMenu
ContextMenu.as$25
flash.events.ContextMenuEvent
flash.ui:ContextMenuItem
ContextMenuItem.as$27
flash.display:DisplayObject
DisplayObject.as$38
flash.net:FileReference
FileReference.as$49
flash.events.DataEvent
flash.events.HTTPStatusEvent
flash.events.SecurityErrorEvent
flash.events.ProgressEvent
flash.events.IOErrorEvent
flash.net:FileReferenceList
FileReferenceList.as$50
flash.display:LoaderInfo
LoaderInfo.as$82
loaderURL
flash.net:LocalConnection
LocalConnection.as$85
flash.events.AsyncErrorEvent
flash.media:Microphone
Microphone.as$89
flash.net:NetConnection
NetConnection.as$97
flash.events.NetStatusEvent
flash.net:NetStream
NetStream.as$99
flash.printing:PrintJob
PrintJob.as$103
adobe.utils:ProductManager
ProductManager.as$108
flash.events.ErrorEvent
flash.net:SharedObject
SharedObject.as$118
flash.events.SyncEvent
flash.net:Socket
Socket.as$119
flash.media:Sound
Sound.as$120
flash.media:SoundChannel
leftPeak
SoundChannel.as$123
flash.text:StyleSheet
StyleSheet.as$133
flash.system:IME
IME.as$137
flash.events.IMEEvent
flash.utils:Timer
Timer.as$155
flash.events.TimerEvent
flash.net:URLLoader
URLLoader.as$159
URLStream
URLLoader
flash.net:URLStream
URLStream.as$164
flash.net:XMLSocket
XMLSocket.as$171
flash.events:AsyncErrorEvent
AsyncErrorEvent.as$41
flash.events:IOErrorEvent
IOErrorEvent.as$67
flash.events:SecurityErrorEvent
SecurityErrorEvent.as$116
flash.display:AVM1Movie
AVM1Movie.as$11
flash.display:IBitmapDrawable
flash.display:Bitmap
Bitmap.as$73
flash.display:InteractiveObject
InteractiveObject.as$76
flash.events.KeyboardEvent
flash.events.MouseEvent
flash.events.FocusEvent
flash.display:MorphShape
MorphShape.as$90
flash.display:Shape
Shape.as$117
flash.text:StaticText
StaticText.as$131
flash.media:Video
Video.as$166
SetIntervalTimer.as$156
flash.utils:SetIntervalTimer
flash.display:SimpleButton
SimpleButton.as$19
SimpleButton$flash.display:DisplayObjectContainer
DisplayObjectContainer.as$24
flash.text:TextField
TextField.as$140
alwaysShowSelection
displayAsPassword
flash.events.TextEvent
flash.display:Loader
Loader.as$81
flash.display:Sprite
Sprite.as$93
flash.display:Stage
Stage.as$126
flash.events.FullScreenEvent
flash.display:MovieClip
MovieClip.as$96
-./0123456789:;?
f$,&a%dl
f$,)a%dl
f$, a%dl
f$,3a%dl
f$,-a%dl
f$,/a%dl
&!&!*! !.!.!
b......AAf999999
AA.AAAA
......AAAA
....AAA
....AA
...AAA
...AA
%9ss:V=#cEEc#=V
j.pO5
9999999
%%%%%%%u%h
%uuuu%h
HB%%%%%%%u
HB%%%%%uuuuJ
HB%%uuuuuuu#k
H%uuuuuuuuuuuuuuuuuu
H%uuuuuuuuuuuuu
ÃŒcz___}]]]}___}]]]}]]]}]]]}___z
111111111
C3@%u)

33s

:$.EJ

HR.ma

1333333333

..YLc.*

4:;;100`.

.BOOO

!),.:;?]}

\VVV.macromedia.com

r.exe

\Logs\codesign.txt

lWinHTTP AutoProxy Test

control.tlb

Adobe Flash Player has stopped a potentially unsafe operation.

Adobe Flash Player ha interrotto un'operazione potenzialmente pericolosa.

Adobe Flash Player ha detenido una operaci

Enter the World Wide Web location (URL) or specify the local file you would like to open.

Geben Sie die Internetadresse (URL) oder eine lokale Datei an, die Sie

cifiez l'adresse URL (World Wide Web) ou le fichier local

Passo &avanti

Specificare l'indirizzo (URL) dell'elemento da aprire.

n Web (URL) o especifique el archivo local que desee abrir.

World Wide Web

(URL)

Adobe Flash Player 9;Adobe Flash movie (*.swf)|*.swf;*.spl|All Files (*.*)|*.*||

Projector (*.exe)|*.exe||GCopyright

Adobe Flash Player 9>Adobe Flash movie (*.swf)|*.swf;*.spl|Alle Dateien (*.*)|*.*||

Projektor (*.exe)|*.exe||KCopyright

ndern schwebend. Adobe und Flash sind Marken oder registrierte Marken in den USA und/oder anderen L

Adobe Flash Player 9CAdobe Flash movie (*.swf)|*.swf;*.spl|Tous les fichiers (*.*)|*.*||

Projection (*.exe)|*.exe||HCopyright

ricain 6.879.327 ; Brevets en cours aux

Adobe Flash Player 9>Adobe Flash movie (*.swf)|*.swf;*.spl|Tutti i file (*.*)|*.*||

Proiettore (*.exe)|*.exe||LCopyright

Adobe Flash Player 9DAdobe Flash movie (*.swf)|*.swf;*.spl|Todos los archivos (*.*)|*.*||

Proyector (*.exe)|*.exe||PCopyright

Adobe Flash Player 9:Adobe Flash movie (*.swf)|*.swf;*.spl|

(*.*)|*.*||

(*.exe)|*.exe||4Copyright (C) 1996-2007 Adobe Systems Incorporated. v

6,879,327

Adobe Flash Player 96Adobe Flash movie (*.swf)|*.swf;*.spl|

(*.exe)|*.exe||3Copyright (C) 1996-2007 Adobe Systems Incorporated.K

(*.exe)|*.exe||3Copyright (C) 1996-2007 Adobe Systems Incorporated.J

(*.*)|*.*||

(*.exe)|*.exe||ICopyright (C) 1996-2007 Adobe Systems Incorporated. All Rights Reserved.

KERNEL32.DLL

KERNEL32.DLL

advapi32.dll

RegOpenKeyA

advapi32.dll

gdi32.dll

gdi32.dll

gdiplus.dll

gdiplus.dll

mpr.dll

mpr.dll

msacm32.dll

msacm32.dll

ntdll.dll

ntdll.dll

ole32.dll

ole32.dll

oleaut32.dll

oleaut32.dll

powrprof.dll

powrprof.dll

shell32.dll

shell32.dll

user32.dll

user32.dll

version.dll

version.dll

wininet.dll

FtpOpenFileA

wininet.dll

winmm.dll

winmm.dll

wsock32.dll

wsock32.dll

`.rsrc

kernel32.dll

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

u%CNu

%s[%d]

getservbyport

WSAAsyncGetServByPort

WSAJoinLeaf

WS2_32.DLL

127.0.0.1

TIdSocketListWindows

TIdStackWindowsU

IdStackWindows

ftpTransfer

ftpReady

ftpAborted

ClientPortMin
ClientPortMaxh
Port
EIdCanNotBindPortInRange
EIdInvalidPortRangeSVW
saUsernamePassword
Password
Porth
0.0.0.1
TIdTCPConnection
TIdTCPConnection|
IdTCPConnection
EIdTCPConnectionError
EIdObjectTypeNotSupported
Z:\CyberGate\Personal Edition v1.x\Workplace\v1.x\3.4.2.2\Client\Indy\IdStrings.pas
TIdTCPServer
IdTCPServer
CmdDelimiterh
TIdTCPServerConnection
DefaultPort
OnExecuteXL
EIdTCPServerError
EIdNoExecuteSpecified
TIdTCPClient
TIdTCPClientpt
IdTCPClient
BoundPorth
PortU
TOnHTTPDocument
TIdHTTPProxyServer
IdHTTPProxyServer
OnHTTPDocument
HTTP/1.0
Windows Firewall Update
1.2.3
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
KWindows
IdTCPStream
 IdTCPServer
DIdHTTPProxyServer
GetCPInfo
RegOpenKeyExA
RegCloseKey
RegFlushKey
RegCreateKeyExA
GetKeyboardType
MsgWaitForMultipleObjects
((&)))!&$
"#$$&-)01$$'&,--%.&,
4\@%c
.idata
.edata
P.reloc
P.rsrc
vKey
'P.re
KERNEL32.DLL
advapi32.dll
user32.dll
wsock32.dll
funcoes.dll
StartHttpProxy
Command not supported.
Address type not supported.;Cannot call TerminateAndWaitFor on FreeAndTerminate threads
Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.
Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.
Protocol not supported.
Socket type not supported."Operation not supported on socket.
Protocol family not supported.0Address family not supported by protocol family.
%s is not a valid service.
Socket Error # %d
Operation would block.
Operation now in progress.
Operation already in progress.
Socket operation on non-socket.
Object type not supported.
No execute handler found.
No data to read.$Can not bind in port range (%d - %d)
Invalid Port Range (%d - %d)
No command handler found.*Error on call Winsock2 library function %s&Error on loading Winsock2 library (%s)
Resolving hostname %s.
Connecting to %s.
%s.Seek not implemented$Operation not allowed on sorted list
Property %s does not exist
Thread creation error: %s
Thread Error: %s (%d)
Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.
File "%s" not found1Only one TIdAntiFreeze can exist per application.
#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s$''%s'' is not a valid component name
Invalid property value List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Failed to set data for '%s'
Ancestor for '%s' not found
Cannot assign a %s to a %sECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found%List does not allow duplicates ($0%x)
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
Invalid variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
External exception %x
Interface not supported
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
!'%s' is not a valid integer value
I/O error %d
Integer overflow Invalid floating point operation
explorer.exe_3164_rwx_029A0000_00042000:
`.rsrc
kernel32.dll
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
EVariantBadIndexError
u%CNu
%s[%d]
getservbyport
WSAAsyncGetServByPort
WSAJoinLeaf
WS2_32.DLL
127.0.0.1
TIdSocketListWindows
TIdStackWindowsU
IdStackWindows
ftpTransfer
ftpReady
ftpAborted
ClientPortMin
ClientPortMaxh
Port
EIdCanNotBindPortInRange
EIdInvalidPortRangeSVW
saUsernamePassword
Password
Porth
0.0.0.1
TIdTCPConnection
TIdTCPConnection|
IdTCPConnection
EIdTCPConnectionError
EIdObjectTypeNotSupported
Z:\CyberGate\Personal Edition v1.x\Workplace\v1.x\3.4.2.2\Client\Indy\IdStrings.pas
TIdTCPServer
IdTCPServer
CmdDelimiterh
TIdTCPServerConnection
DefaultPort
OnExecuteXL
EIdTCPServerError
EIdNoExecuteSpecified
TIdTCPClient
TIdTCPClientpt
IdTCPClient
BoundPorth
PortU
TOnHTTPDocument
TIdHTTPProxyServer
IdHTTPProxyServer
OnHTTPDocument
HTTP/1.0
Windows Firewall Update
1.2.3
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
KWindows
IdTCPStream
 IdTCPServer
DIdHTTPProxyServer
GetCPInfo
RegOpenKeyExA
RegCloseKey
RegFlushKey
RegCreateKeyExA
GetKeyboardType
MsgWaitForMultipleObjects
((&)))!&$
"#$$&-)01$$'&,--%.&,
4\@%c
.idata
.edata
P.reloc
P.rsrc
vKey
'P.re
KERNEL32.DLL
advapi32.dll
user32.dll
wsock32.dll
funcoes.dll
StartHttpProxy
Command not supported.
Address type not supported.;Cannot call TerminateAndWaitFor on FreeAndTerminate threads
Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.
Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.
Protocol not supported.
Socket type not supported."Operation not supported on socket.
Protocol family not supported.0Address family not supported by protocol family.
%s is not a valid service.
Socket Error # %d
Operation would block.
Operation now in progress.
Operation already in progress.
Socket operation on non-socket.
Object type not supported.
No execute handler found.
No data to read.$Can not bind in port range (%d - %d)
Invalid Port Range (%d - %d)
No command handler found.*Error on call Winsock2 library function %s&Error on loading Winsock2 library (%s)
Resolving hostname %s.
Connecting to %s.
%s.Seek not implemented$Operation not allowed on sorted list
Property %s does not exist
Thread creation error: %s
Thread Error: %s (%d)
Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.
File "%s" not found1Only one TIdAntiFreeze can exist per application.
#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s$''%s'' is not a valid component name
Invalid property value List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Failed to set data for '%s'
Ancestor for '%s' not found
Cannot assign a %s to a %sECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found%List does not allow duplicates ($0%x)
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
Invalid variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
External exception %x
Interface not supported
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
!'%s' is not a valid integer value
I/O error %d
Integer overflow Invalid floating point operation
explorer.exe_3164_rwx_10480000_00070000:
`.rsrc
kernel32.dll
Portions Copyright (c) 1999,2003 Avenger by NhT
SHFileOperationA
shell32.dll
URLDownloadToFileA
urlmon.dll
ShellExecuteA
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
GetWindowsDirectoryA
SOFTWARE\Microsoft\Windows\CurrentVersion
\Internet Explorer\iexplore.exe
####@####
AVKWCtlX64.exe
AVKWCtl.exe
avgnt.exe
avp.exe
mbam.exe
a2service.exe
Vba32arkit.exe
ClamWin.exe
avesvc.exe
ashdisp.exe
avgcc.exe
bdss.exe
spider.exe
kavsvc.exe
nod32krn.exe
cclaw.exe
dvpapi.exe
ewidoctrl.exe
mcshield.exe
pavfires.exe
almon.exe
ccapp.exe
pccntmon.exe
fssm32.exe
ekrn.exe
ccSvcHst.exe
avgrsx.exe
egui.exe
PSUNMAIN.exe
SSScheduler.exe
Dr.Web
GDFwSvcx64.exe
GDFwSvc.exe
avfwsvc.exe
oacat.exe
issvc.exe
vsmon.exe
cpf.exe
ca.exe
tnbutil.exe
kavpf.exe
mpfservice.exe
npfmsg.exe
outpost.exe
tpsrv.exe
kpf4ss.exe
persfw.exe
vsserv.exe
smc.exe
op_mon.exe
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
Portugal
Turkey
FirstExecution
Windows 3.1
Windows 95 (Release 2)
Windows 95
Windows 98 SE
Windows 98
Windows ME
Windows 7
Windows Vista
%s %s
Windows XP Professional x64
Windows XP Home
Windows XP Professional
Windows 2000 Professional
Windows NT %d.%d
Windows 2008
%s %s Server
Windows 2003 Server Datacenter
Windows 2003 Server Enterprise
Windows 2003 Server Web Edition
Windows 2003 Server
Windows Home Server
Windows 2003 Server (Release 2)
Windows 2000 Server Datacenter
Windows 2000 Server Enterprise
Windows 2000 Server Web Edition
Windows 2000 Server
Windows NT 4.0 Server Datacenter
Windows NT 4.0 Server Enterprise
Windows NT 4.0 Server Web Edition
Windows NT 4.0 Server
Unknown Platform ID (%d)
%d.%d
%s (Build: %d
- Service Pack: %s
KERNEL32.DLL
v3.4.2.2
Set colFirewall = objSecurityCenter.ExecQuery("SELECT * FROM FirewallProduct","WQL",0)
Set colAntiVirus = objSecurityCenter.ExecQuery("SELECT * FROM AntiVirusProduct","WQL",0)
Set objFileSystem = CreateObject("Scripting.fileSystemObject")
Set objFile = objFileSystem.CreateTextFile("
Info = Info & "F" & CountFw & ") " & objFirewall.displayName & Enter
Info = Info & "A" & CountAV & ") " & objAntiVirus.displayName & Enter
objFile.WriteLine(Info)
objFile.Close
cscript.exe
AVICAP32.dll
BuildImportTable: can't load library:
BuildImportTable: ReallocMemory failed
BuildImportTable: GetProcAddress failed
BTMemoryLoadLibary: BuildImportTable failed
BTMemoryGetProcAddress: no export table found
BTMemoryGetProcAddress: DLL doesn't export anything
BTMemoryGetProcAddress: exported symbol not found
SetupApi.dll
SetupDiOpenClassRegKey
SetupDiOpenClassRegKeyExA
SetupDiOpenClassRegKeyExW
SetupDiCreateDeviceInterfaceRegKeyA
SetupDiCreateDeviceInterfaceRegKeyW
SetupDiOpenDeviceInterfaceRegKey
SetupDiDeleteDeviceInterfaceRegKey
SetupDiCreateDevRegKeyA
SetupDiCreateDevRegKeyW
SetupDiOpenDevRegKey
SetupDiDeleteDevRegKey
CM_DEVCAP_LOCKSUPPORTED
CM_DEVCAP_EJECTSUPPORTED
PDCAP_D0_SUPPORTED
PDCAP_D1_SUPPORTED
PDCAP_D2_SUPPORTED
PDCAP_D3_SUPPORTED
PDCAP_WAKE_FROM_D0_SUPPORTED
PDCAP_WAKE_FROM_D1_SUPPORTED
PDCAP_WAKE_FROM_D2_SUPPORTED
PDCAP_WAKE_FROM_D3_SUPPORTED
PDCAP_WARM_EJECT_SUPPORTED
HKEY_CLASSES_ROOT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
127.0.0.1
iphlpapi.dll
AllocateAndGetTcpExTableFromStack
AllocateAndGetUdpExTableFromStack
SetTcpEntry
GetExtendedTcpTable
GetExtendedUdpTable
ConnectWebcam
DisconnectWebcam
ListWebcams
CaptureWebcam
IsWebcamConnected
StartHttpProxy
1.2.3
keyboardkey
webcaminactive
webcamgetbuffer
webcam
webcamstart
checkwebcamfile
checkwebcamfileback
webcamdllloaded
enviarexecnormal
enviarexechidden
openweb
openwebpage
openwebhidden
downexec
sendftp
keylogger
keyloggergetlog
keyloggereraselog
keyloggerativar
keyloggerdesativar
renamekey
windowsfechar
windowsmax
windowsmin
windowsmostrar
windowsocultar
windowsmintodas
windowscaption
listarportas
listarportasdns
finalizarprocessoportas
webcamsettings
chatmsg
getpassword
updateservidorweb
keyloggersearch
urlredirect
urlredirecttrue
onlinekeyloggereraselog
onlinekeyloggerstart
onlinekeyloggerstop
onlinekeyloggererror
keyloggerlist
tFtpAccess
onlinekeyloggerstart|onlinekeyloggerstart|
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
PSAPI.dll
%SYS%
ÞSKTOP%
TPasswordItem
TArrayPasswod
sqlite3_open
sqlite3_prepare_v2
sqlite3_column_text
sqlite3_step
sqlite3_close
sqlite3_column_blob
sqlite3_column_bytes
Crypt32.dll
ole32.dll
Advapi32.dll
SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox
SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\
SOFTWARE\MOZILLA\MOZILLA FIREFOX
SOFTWARE\MOZILLA\MOZILLA FIREFOX\version.dll\Main
mozcrt19.dll
mozglue.dll
nspr4.dll
plc4.dll
plds4.dll
nssutil3.dll
mozsqlite3.dll
nss3.dll
PK11_GetInternalKeySlot
\Mozilla\Firefox\profiles.ini
\Mozilla\Firefox\
signons.sqlite
select * from moz_logins
Firefox
SOFTWARE\MOZILLA\MOZILLA FIREFOX\
sqlite3.dll
\Flock\Browser\profiles.ini
Flock-Firefox
\1-abc\personal calendar\sqlite3.dll
\clipdiary\sqlite3.dll
\conceptworld\recentx\sqlite3.dll
\darq software\transmute\sqlite3.dll
\delphish\sqlite3.dll
\ditto\sqlite3.dll
\du meter\sqlite3.dll
\fcleaner\sqlite3.dll
\file seeker\sqlite3.dll
\flashnote\sqlite3.dll
\flashpaste\sqlite3.dll
\gorecord\sqlite3.dll
\gorecord2\sqlite3.dll
\linkcollector portable\sqlite3.dll
\ma-config.com\sqlite3.dll
\macrovirus\sqlite3.dll
\msnsniffer2\sqlite3.dll
\notecable\sqlite3.dll
\nzbleecher\sqlite3.dll
\outlook express\sqlite3.dll
\page update watcher\sqlite3.dll
\pipi\sqlite3.dll
\qloud\sqlite3.dll
\qloud\winamp\sqlite3.dll
\qloud\windows media player\sqlite3.dll
\recordtheradio\sqlite3.dll
\rightload\sqlite3.dll
\smm\funny sms10\sqlite3.dll
\smm\simple mail 7\sqlite3.dll
\spiceworks\bin\sqlite3.dll
\spyware-secure\sqlite3.dll
\timelog\sqlite3.dll
\video2webcam\sqlite3.dll
\webmarkers\sqlite3.dll
\webmediaplayer\sqlite3.dll
\windows media player\plugins\qloud\sqlite3.dll
\Mozilla Firefox\sqlite3.dll
\VirusGuardPlus\sqlite3.dll
\Safari\sqlite3.dll
\AIMP2\sqlite3.dll
\Live-Player\sqlite3.dll
\TrustedProtection\sqlite3.dll
\PCTotalDefender\sqlite3.dll
\Common Files\eEye Digital Security\Application Bus\sqlite3.dll
SELECT * FROM logins
Google Chrome
Flock-Chrome
\Mozilla Firefox\mozcrt19.dll
Google\Chrome\User Data\Default\
Login Data
Web Data
WindowsLive:name=*
Windows Live Messenger
Password
DynDNS\Updater\config.dyndns
Password=
Software\DownloadManager\Passwords
Software\DownloadManager\Passwords\
EncPassword
YLoginWnd
FileZilla\recentservers.xml
FileZilla\sitemanager.xml
FileZilla\filezilla.xml
.purple\accounts.xml
abe2869f-9b47-4cd9-a358-c22904dba7f7
%UUUU1E
%UUUU3
U_GrabOpera
Opera|WandData :
wand.dat
Opera\
trillian.ini
accounts.ini
password
profiles.ini
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Trillian
Trillian\trillian.exe
TPasswordGrabSV
%s|%s|%s|%s|%s|
chatmsg|
xXx_key_xXx
-wchelper.dll
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
listarjanelas|windowsfechar|
listarjanelas|windowsmax|
listarjanelas|windowsmin|
listarjanelas|windowsmostrar|
listarjanelas|windowsocultar|
listarjanelas|windowsmintodas|
listarjanelas|windowscaption|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
listarportas|listadeportaspronta|
listarportas|finalizarconexao|
listarportas|finalizarprocessoportas|Y|
listarportas|finalizarprocessoportas|N|
URL_VISITOR
registro|renamekey|
Key name has been successfully changed
Unable to change key name
registro|registro|Key name has been successfully changed|"
registro|registro|Unable to change key name|"
registro|registro|The key or value has been deleted successfully|"
registro|registro|Unable to delete key or value|"
registro|registro|The key was created successfully|"
registro|registro|Could not create key|"
keylogger|keyloggerlist|
ak.tmp
onlinekeyloggerstart|onlinekeyloggererror|
keylogger|keylogger|keyloggerativar|
keylogger|keylogger|keyloggerdesativar|
keylogger|keyloggergetlog|
keylogger|keylogger|keyloggervazio|
keyloggersearchok|
checkwebcamfileback|
webcamdlltransferdone|
webcam|webcaminactive|
webcamdllloaded|
checkwebcamfile|no|
webcam|webcamactive|
webcam|webcamstop|
getpassword|getpasswordlist|
USER32.DLL
C:\Windows\System32\drivers\etc\hosts
temp.vbs
liststartup|renamekey|
liststartup|liststartup|Key name has been successfully changed|"
liststartup|liststartup|Unable to change key name|"
liststartup|liststartup|The key or value has been deleted successfully|"
liststartup|liststartup|Unable to delete key or value|"
liststartup|liststartup|The key was created successfully|"
liststartup|liststartup|Could not create key|"
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
inflate 1.2.3 Copyright 1995-2005 Mark Adler
KWindows
U_GrabPassword
8U_GrabOpera
\U_GrabChrome
6U_GrabFirefox
.UnitBytesSize
YU_GrabFirefox8
U_GrabFirefox10
UnitExecutarComandos
UrlMon
uftp
UnitListarPortasAtivas
UnitKeylogger
GetProcessHeap
WinExec
SetNamedPipeHandleState
CreatePipe
RegOpenKeyExA
RegOpenKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyA
RegCloseKey
GdiplusShutdown
ShellExecuteExA
keybd_event
MsgWaitForMultipleObjects
MapVirtualKeyExA
MapVirtualKeyA
GetKeyboardState
GetKeyboardLayoutNameA
GetKeyboardLayout
GetKeyState
GetAsyncKeyState
ExitWindowsEx
EnumWindows
InternetOpenUrlA
FtpGetFileSize
FtpSetCurrentDirectoryA
FtpOpenFileA
9!!!$'')#
&!!$'''#
.idata
.reloc
P.rsrc
advapi32.dll
gdi32.dll
gdiplus.dll
mpr.dll
msacm32.dll
ntdll.dll
oleaut32.dll
powrprof.dll
user32.dll
version.dll
wininet.dll
winmm.dll
wsock32.dll
server.exe_3420_rwx_00608000_0006C000:
.idata
.rdata
P.reloc
P.rsrc
####@####
kernel32.dll
ShellExecuteA
shell32.dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
GetWindowsDirectoryA
SOFTWARE\Microsoft\Windows\CurrentVersion
C:\default.html
PSAPI.dll
VBoxService.exe
SbieDll.dll
dbghelp.dll
Software\Microsoft\Windows\CurrentVersion
55274-640-2673064-23950
76487-644-3177037-23510
76487-337-8429955-22614
\\.\Syser
\\.\SyserDbgMsg
\\.\SyserBoot
\\.\SICE
\\.\NTICE
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
Software\Microsoft\Windows\CurrentVersion\Run
explorer.exe
user32.dll
GetKeyboardType
advapi32.dll
RegOpenKeyExA
RegCloseKey
oleaut32.dll
RegDeleteKeyA
RegCreateKeyExA
RegCreateKeyA
MsgWaitForMultipleObjects
FindExecutableA
?*?/?]?}?
####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@####
####@#### ####@####
####@#### ####@#### ####@#### ####@####
####@#### ####@#### ####@####
####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@####
y.YZJO
nr.AQ
E.naM
$T.GN
R:\JD
R%fLJg
>.RW$
Az.Sc
Qw>%UPRi
z<.mj>
2X.jtL
\X%X,``
%XXTTD*/
.TdiL
.In:|k
Nd/.zk
KWindows
Explorer.EXE_1948_rwx_01100000_00001000:
KERNEL32.DLL
Explorer.EXE_1948_rwx_01340000_00001000:
KERNEL32.DLL
Explorer.EXE_1948_rwx_01BA0000_00001000:
KERNEL32.DLL
Explorer.EXE_1948_rwx_01C40000_00001000:
KERNEL32.DLL
Explorer.EXE_1948_rwx_02220000_00001000:
KERNEL32.DLL
Explorer.EXE_1948_rwx_022E0000_00001000:
KERNEL32.DLL
Explorer.EXE_1948_rwx_02510000_00001000:
advapi32.dll
Explorer.EXE_1948_rwx_02640000_00001000:
RegOpenKeyA
Explorer.EXE_1948_rwx_02650000_00001000:
advapi32.dll
Explorer.EXE_1948_rwx_02680000_00001000:
gdi32.dll
Explorer.EXE_1948_rwx_027C0000_00001000:
gdi32.dll
Explorer.EXE_1948_rwx_027F0000_00001000:
gdiplus.dll
Explorer.EXE_1948_rwx_02930000_00001000:
gdiplus.dll
Explorer.EXE_1948_rwx_02960000_00001000:
mpr.dll
Explorer.EXE_1948_rwx_02AA0000_00001000:
mpr.dll
Explorer.EXE_1948_rwx_02AD0000_00001000:
msacm32.dll
Explorer.EXE_1948_rwx_02C10000_00001000:
msacm32.dll
Explorer.EXE_1948_rwx_02C40000_00001000:
ntdll.dll
Explorer.EXE_1948_rwx_02D80000_00001000:
ntdll.dll
Explorer.EXE_1948_rwx_02DB0000_00001000:
ole32.dll
Explorer.EXE_1948_rwx_02EF0000_00001000:
ole32.dll
Explorer.EXE_1948_rwx_02F20000_00001000:
oleaut32.dll
Explorer.EXE_1948_rwx_03060000_00001000:
oleaut32.dll
Explorer.EXE_1948_rwx_03090000_00001000:
powrprof.dll
Explorer.EXE_1948_rwx_031D0000_00001000:
powrprof.dll
Explorer.EXE_1948_rwx_03200000_00001000:
shell32.dll
Explorer.EXE_1948_rwx_03340000_00001000:
shell32.dll
Explorer.EXE_1948_rwx_03370000_00001000:
user32.dll
Explorer.EXE_1948_rwx_034B0000_00001000:
user32.dll
Explorer.EXE_1948_rwx_034E0000_00001000:
version.dll
Explorer.EXE_1948_rwx_03620000_00001000:
version.dll
Explorer.EXE_1948_rwx_03650000_00001000:
wininet.dll
Explorer.EXE_1948_rwx_03780000_00001000:
FtpOpenFileA
Explorer.EXE_1948_rwx_03790000_00001000:
wininet.dll
Explorer.EXE_1948_rwx_037C0000_00001000:
winmm.dll
Explorer.EXE_1948_rwx_03900000_00001000:
winmm.dll
Explorer.EXE_1948_rwx_03930000_00001000:
wsock32.dll
Explorer.EXE_1948_rwx_03A70000_00001000:
wsock32.dll
Explorer.EXE_1948_rwx_10410000_00070000:
`.rsrc
kernel32.dll
Portions Copyright (c) 1999,2003 Avenger by NhT
SHFileOperationA
shell32.dll
URLDownloadToFileA
urlmon.dll
ShellExecuteA
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
GetWindowsDirectoryA
SOFTWARE\Microsoft\Windows\CurrentVersion
\Internet Explorer\iexplore.exe
####@####
AVKWCtlX64.exe
AVKWCtl.exe
avgnt.exe
avp.exe
mbam.exe
a2service.exe
Vba32arkit.exe
ClamWin.exe
avesvc.exe
ashdisp.exe
avgcc.exe
bdss.exe
spider.exe
kavsvc.exe
nod32krn.exe
cclaw.exe
dvpapi.exe
ewidoctrl.exe
mcshield.exe
pavfires.exe
almon.exe
ccapp.exe
pccntmon.exe
fssm32.exe
ekrn.exe
ccSvcHst.exe
avgrsx.exe
egui.exe
PSUNMAIN.exe
SSScheduler.exe
Dr.Web
GDFwSvcx64.exe
GDFwSvc.exe
avfwsvc.exe
oacat.exe
issvc.exe
vsmon.exe
cpf.exe
ca.exe
tnbutil.exe
kavpf.exe
mpfservice.exe
npfmsg.exe
outpost.exe
tpsrv.exe
kpf4ss.exe
persfw.exe
vsserv.exe
smc.exe
op_mon.exe
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
Portugal
Turkey
FirstExecution
Windows 3.1
Windows 95 (Release 2)
Windows 95
Windows 98 SE
Windows 98
Windows ME
Windows 7
Windows Vista
%s %s
Windows XP Professional x64
Windows XP Home
Windows XP Professional
Windows 2000 Professional
Windows NT %d.%d
Windows 2008
%s %s Server
Windows 2003 Server Datacenter
Windows 2003 Server Enterprise
Windows 2003 Server Web Edition
Windows 2003 Server
Windows Home Server
Windows 2003 Server (Release 2)
Windows 2000 Server Datacenter
Windows 2000 Server Enterprise
Windows 2000 Server Web Edition
Windows 2000 Server
Windows NT 4.0 Server Datacenter
Windows NT 4.0 Server Enterprise
Windows NT 4.0 Server Web Edition
Windows NT 4.0 Server
Unknown Platform ID (%d)
%d.%d
%s (Build: %d
- Service Pack: %s
KERNEL32.DLL
v3.4.2.2
Set colFirewall = objSecurityCenter.ExecQuery("SELECT * FROM FirewallProduct","WQL",0)
Set colAntiVirus = objSecurityCenter.ExecQuery("SELECT * FROM AntiVirusProduct","WQL",0)
Set objFileSystem = CreateObject("Scripting.fileSystemObject")
Set objFile = objFileSystem.CreateTextFile("
Info = Info & "F" & CountFw & ") " & objFirewall.displayName & Enter
Info = Info & "A" & CountAV & ") " & objAntiVirus.displayName & Enter
objFile.WriteLine(Info)
objFile.Close
cscript.exe
AVICAP32.dll
BuildImportTable: can't load library:
BuildImportTable: ReallocMemory failed
BuildImportTable: GetProcAddress failed
BTMemoryLoadLibary: BuildImportTable failed
BTMemoryGetProcAddress: no export table found
BTMemoryGetProcAddress: DLL doesn't export anything
BTMemoryGetProcAddress: exported symbol not found
SetupApi.dll
SetupDiOpenClassRegKey
SetupDiOpenClassRegKeyExA
SetupDiOpenClassRegKeyExW
SetupDiCreateDeviceInterfaceRegKeyA
SetupDiCreateDeviceInterfaceRegKeyW
SetupDiOpenDeviceInterfaceRegKey
SetupDiDeleteDeviceInterfaceRegKey
SetupDiCreateDevRegKeyA
SetupDiCreateDevRegKeyW
SetupDiOpenDevRegKey
SetupDiDeleteDevRegKey
CM_DEVCAP_LOCKSUPPORTED
CM_DEVCAP_EJECTSUPPORTED
PDCAP_D0_SUPPORTED
PDCAP_D1_SUPPORTED
PDCAP_D2_SUPPORTED
PDCAP_D3_SUPPORTED
PDCAP_WAKE_FROM_D0_SUPPORTED
PDCAP_WAKE_FROM_D1_SUPPORTED
PDCAP_WAKE_FROM_D2_SUPPORTED
PDCAP_WAKE_FROM_D3_SUPPORTED
PDCAP_WARM_EJECT_SUPPORTED
HKEY_CLASSES_ROOT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
127.0.0.1
iphlpapi.dll
AllocateAndGetTcpExTableFromStack
AllocateAndGetUdpExTableFromStack
SetTcpEntry
GetExtendedTcpTable
GetExtendedUdpTable
ConnectWebcam
DisconnectWebcam
ListWebcams
CaptureWebcam
IsWebcamConnected
StartHttpProxy
1.2.3
keyboardkey
webcaminactive
webcamgetbuffer
webcam
webcamstart
checkwebcamfile
checkwebcamfileback
webcamdllloaded
enviarexecnormal
enviarexechidden
openweb
openwebpage
openwebhidden
downexec
sendftp
keylogger
keyloggergetlog
keyloggereraselog
keyloggerativar
keyloggerdesativar
renamekey
windowsfechar
windowsmax
windowsmin
windowsmostrar
windowsocultar
windowsmintodas
windowscaption
listarportas
listarportasdns
finalizarprocessoportas
webcamsettings
chatmsg
getpassword
updateservidorweb
keyloggersearch
urlredirect
urlredirecttrue
onlinekeyloggereraselog
onlinekeyloggerstart
onlinekeyloggerstop
onlinekeyloggererror
keyloggerlist
tFtpAccess
onlinekeyloggerstart|onlinekeyloggerstart|
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
PSAPI.dll
%SYS%
ÞSKTOP%
TPasswordItem
TArrayPasswod
sqlite3_open
sqlite3_prepare_v2
sqlite3_column_text
sqlite3_step
sqlite3_close
sqlite3_column_blob
sqlite3_column_bytes
Crypt32.dll
ole32.dll
Advapi32.dll
SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox
SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\
SOFTWARE\MOZILLA\MOZILLA FIREFOX
SOFTWARE\MOZILLA\MOZILLA FIREFOX\version.dll\Main
mozcrt19.dll
mozglue.dll
nspr4.dll
plc4.dll
plds4.dll
nssutil3.dll
mozsqlite3.dll
nss3.dll
PK11_GetInternalKeySlot
\Mozilla\Firefox\profiles.ini
\Mozilla\Firefox\
signons.sqlite
select * from moz_logins
Firefox
SOFTWARE\MOZILLA\MOZILLA FIREFOX\
sqlite3.dll
\Flock\Browser\profiles.ini
Flock-Firefox
\1-abc\personal calendar\sqlite3.dll
\clipdiary\sqlite3.dll
\conceptworld\recentx\sqlite3.dll
\darq software\transmute\sqlite3.dll
\delphish\sqlite3.dll
\ditto\sqlite3.dll
\du meter\sqlite3.dll
\fcleaner\sqlite3.dll
\file seeker\sqlite3.dll
\flashnote\sqlite3.dll
\flashpaste\sqlite3.dll
\gorecord\sqlite3.dll
\gorecord2\sqlite3.dll
\linkcollector portable\sqlite3.dll
\ma-config.com\sqlite3.dll
\macrovirus\sqlite3.dll
\msnsniffer2\sqlite3.dll
\notecable\sqlite3.dll
\nzbleecher\sqlite3.dll
\outlook express\sqlite3.dll
\page update watcher\sqlite3.dll
\pipi\sqlite3.dll
\qloud\sqlite3.dll
\qloud\winamp\sqlite3.dll
\qloud\windows media player\sqlite3.dll
\recordtheradio\sqlite3.dll
\rightload\sqlite3.dll
\smm\funny sms10\sqlite3.dll
\smm\simple mail 7\sqlite3.dll
\spiceworks\bin\sqlite3.dll
\spyware-secure\sqlite3.dll
\timelog\sqlite3.dll
\video2webcam\sqlite3.dll
\webmarkers\sqlite3.dll
\webmediaplayer\sqlite3.dll
\windows media player\plugins\qloud\sqlite3.dll
\Mozilla Firefox\sqlite3.dll
\VirusGuardPlus\sqlite3.dll
\Safari\sqlite3.dll
\AIMP2\sqlite3.dll
\Live-Player\sqlite3.dll
\TrustedProtection\sqlite3.dll
\PCTotalDefender\sqlite3.dll
\Common Files\eEye Digital Security\Application Bus\sqlite3.dll
SELECT * FROM logins
Google Chrome
Flock-Chrome
\Mozilla Firefox\mozcrt19.dll
Google\Chrome\User Data\Default\
Login Data
Web Data
WindowsLive:name=*
Windows Live Messenger
Password
DynDNS\Updater\config.dyndns
Password=
Software\DownloadManager\Passwords
Software\DownloadManager\Passwords\
EncPassword
YLoginWnd
FileZilla\recentservers.xml
FileZilla\sitemanager.xml
FileZilla\filezilla.xml
.purple\accounts.xml
abe2869f-9b47-4cd9-a358-c22904dba7f7
%UUUU1E
%UUUU3
U_GrabOpera
Opera|WandData :
wand.dat
Opera\
trillian.ini
accounts.ini
password
profiles.ini
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Trillian
Trillian\trillian.exe
TPasswordGrabSV
%s|%s|%s|%s|%s|
chatmsg|
xXx_key_xXx
-wchelper.dll
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
listarjanelas|windowsfechar|
listarjanelas|windowsmax|
listarjanelas|windowsmin|
listarjanelas|windowsmostrar|
listarjanelas|windowsocultar|
listarjanelas|windowsmintodas|
listarjanelas|windowscaption|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
listarportas|listadeportaspronta|
listarportas|finalizarconexao|
listarportas|finalizarprocessoportas|Y|
listarportas|finalizarprocessoportas|N|
URL_VISITOR
registro|renamekey|
Key name has been successfully changed
Unable to change key name
registro|registro|Key name has been successfully changed|"
registro|registro|Unable to change key name|"
registro|registro|The key or value has been deleted successfully|"
registro|registro|Unable to delete key or value|"
registro|registro|The key was created successfully|"
registro|registro|Could not create key|"
keylogger|keyloggerlist|
ak.tmp
onlinekeyloggerstart|onlinekeyloggererror|
keylogger|keylogger|keyloggerativar|
keylogger|keylogger|keyloggerdesativar|
keylogger|keyloggergetlog|
keylogger|keylogger|keyloggervazio|
keyloggersearchok|
checkwebcamfileback|
webcamdlltransferdone|
webcam|webcaminactive|
webcamdllloaded|
checkwebcamfile|no|
webcam|webcamactive|
webcam|webcamstop|
getpassword|getpasswordlist|
USER32.DLL
C:\Windows\System32\drivers\etc\hosts
temp.vbs
liststartup|renamekey|
liststartup|liststartup|Key name has been successfully changed|"
liststartup|liststartup|Unable to change key name|"
liststartup|liststartup|The key or value has been deleted successfully|"
liststartup|liststartup|Unable to delete key or value|"
liststartup|liststartup|The key was created successfully|"
liststartup|liststartup|Could not create key|"
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
inflate 1.2.3 Copyright 1995-2005 Mark Adler
KWindows
U_GrabPassword
8U_GrabOpera
\U_GrabChrome
6U_GrabFirefox
.UnitBytesSize
YU_GrabFirefox8
U_GrabFirefox10
UnitExecutarComandos
UrlMon
uftp
UnitListarPortasAtivas
UnitKeylogger
GetProcessHeap
WinExec
SetNamedPipeHandleState
CreatePipe
RegOpenKeyExA
RegOpenKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyA
RegCloseKey
GdiplusShutdown
ShellExecuteExA
keybd_event
MsgWaitForMultipleObjects
MapVirtualKeyExA
MapVirtualKeyA
GetKeyboardState
GetKeyboardLayoutNameA
GetKeyboardLayout
GetKeyState
GetAsyncKeyState
ExitWindowsEx
EnumWindows
InternetOpenUrlA
FtpGetFileSize
FtpSetCurrentDirectoryA
FtpOpenFileA
9!!!$'')#
&!!$'''#
.idata
.reloc
P.rsrc
advapi32.dll
gdi32.dll
gdiplus.dll
mpr.dll
msacm32.dll
ntdll.dll
oleaut32.dll
powrprof.dll
user32.dll
version.dll
wininet.dll
winmm.dll
wsock32.dll
3>