Worm.Win32.Rebhip_29ba4e9387 – Adaware

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer.

Process activity

The Worm creates the following process(es):

mscorsvw.exe:1912
cscript.exe:596
%original file name%.exe:604

The Worm injects its code into the following process(es):

explorer.exe:672
Explorer.EXE:840

File activity

The process cscript.exe:596 makes changes in the file system.

The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\teste.txt (2 bytes)

The process %original file name%.exe:604 makes changes in the file system.

The Worm creates and/or writes to the following file(s):

%System%\Svchost\svchost.exe (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XX--XX--XX.txt (235 bytes)

Registry activity

The process mscorsvw.exe:1912 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\State]
"AccumulatedWaitIdleTime" = "2340000"

The process cscript.exe:596 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1E A1 1A EE 20 57 06 FE 6E A8 0E EC E3 D5 41 D8"

The process %original file name%.exe:604 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F9 6A B0 6F E1 46 80 E3 EC 90 DA 00 D9 56 7F 16"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"javaing" = "%System%\Svchost\svchost.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
"javaing" = "%System%\Svchost\svchost.exe"

[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{1WVNI4J5-VURB-0861-M083-G62Y24ST2062}]
"StubPath" = "%System%\Svchost\svchost.exe Restart"

To automatically run itself each time Windows is booted, the Worm adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"javaing" = "%System%\Svchost\svchost.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"jusheds" = "%System%\Svchost\svchost.exe"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
mscorsvw.exe:1912
cscript.exe:596
%original file name%.exe:604
Delete the original Worm file.
Delete or disinfect the following files created/modified by the Worm:
%Documents and Settings%\%current user%\Local Settings\Temp\teste.txt (2 bytes)
%System%\Svchost\svchost.exe (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XX--XX--XX.txt (235 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"javaing" = "%System%\Svchost\svchost.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"jusheds" = "%System%\Svchost\svchost.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
UPX0	4096	61440	0	0	d41d8cd98f00b204e9800998ecf8427e
UPX1	65536	278528	276480	5.37415	f608269c21a2ff3c0a574b375e13e525
.rsrc	344064	4096	1024	2.45234	b29facbbcaa3008316b50b3751ed8510

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 3
60954bdf094b17d9eeb8ccdb935b8392
37d94ca81642797906d465c04cdddbcb
337fb9edd49ebc56cef18b182a137464

Network Activity

URLs

URL	IP
meheme.zapto.org	185.26.144.109

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Worm connects to the servers at the folowing location(s):

Strings from Dumps

explorer.exe_672:

.text

`.data

.rsrc

@.reloc

ADVAPI32.dll

BROWSEUI.dll

GDI32.dll

KERNEL32.dll

NTDLL.DLL

msvcrt.dll

ole32.dll

OLEAUT32.dll

SHDOCVW.dll

SHELL32.dll

SHLWAPI.dll

USER32.dll

UxTheme.dll

FTSSh

t0SSh

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system

SShwk

98~%SP

ExplorerStartMsgLoop

PSSh;

6SSSSh

SSSSh

SPSSSShL

u%SSh

t.WWWW

xpsp2res.dll

xpsp3res.dll

tbSSh

Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartMenu

Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartPanel

kernel32.dll

GetSystemWindowsDirectoryW

NetGetJoinInformation

WINMM.dll

SETUPAPI.dll

WINSTA.dll

OLEACC.dll

USERENV.dll

ntdll.dll

RegEnumKeyExW

RegNotifyChangeKeyValue

RegOpenKeyExA

RegEnumKeyW

RegCloseKey

RegCreateKeyW

RegQueryInfoKeyW

RegOpenKeyExW

RegCreateKeyExW

OffsetViewportOrgEx

GetViewportOrgEx

SetViewportOrgEx

SetProcessShutdownParameters

GetProcessHeap

GetWindowsDirectoryW

CreateIoCompletionPort

ShellExecuteExW

SHRegCloseUSKey

SHRegCreateUSKeyW

AssocQueryKeyW

SHRegOpenUSKeyW

SHDeleteKeyW

TileWindows

ExitWindowsEx

RegisterHotKey

UnregisterHotKey

EnumChildWindows

GetKeyState

GetAsyncKeyState

CascadeWindows

MsgWaitForMultipleObjects

EnumWindows

explorer.pdb

name="Microsoft.Windows.Shell.explorer"

version="5.1.0.0"

<description>Windows Shell</description>

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

]]"```^]]\

3333333330

3333330

333333334

)@. '5 !*

.DEHHF>?/

2<===@@=

&$%Uooqkezs

['$$#%&(4

3333333333333333333

33333333333330

7''''))

3'')))33.

222`444(555

%%%{///-

000000000

00000000

`[66...00

0000000

`]66./.000

/./././././././.

66///0000

0000000000000

0000000000

6666,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,0.010.010.010.010.010.010.010.010.010.010.001

4366666666K,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6.010.010.010.010.010.010.010.010.010.010.000

:;<;:;<;:;<;:;<;:;<0

) ) ) ) )

|2222'2'2'2'2'2'2'2'2'2'2'2'2'2'2'2',),),),),),),),),),),),),),),),),),),),),),,

22222222222

3333333

.SB99;;;99twv}ut{oxt~

.SB;;;:::2:w}{{qddgghg

" """ """ """ """ "" #

""" """ """ "#

.SG>''';;9::p

:5:5:5:5:5:5:5:5:5:5#"

# # # # # # # # # # # # # # # # # # # # # ##$

( # # # # # # # # # # # # # # # # # # # # ###

1232123212321232123

(&(((&(((&(((&(((&((&&)

&(((&(((&(((&()

`,''')))

'4,4'4,4'4,4'4,4'4,4)(

55///0000

5555-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-0

555555555

55555555

5555555

14441444144414441

4343434343434343

5555555555555

5555555555

-,-,-,-,-,-,-,-,-,-,-*.

..............................JFJFJFJFJFJFJFJFJFJFJ.-

{22*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-../

|ujjjjuhF..BBBBBBBBBBBBT

~j|F.BB*BBB*BBB*Bwop

&!!!&!!!&

44466666

44444444416

4446666

66666666

|= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |=

|= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |=

DDDDE%CTDD@

A%US$

%UUUU

%%UUU

33U

""2222!!

!"!"%UUR""

!""!"#2"""

"!!"#3"!"

dnnnnn:n.nfCnmddddd

////;/;;88

;888;;!/

!//!!;;^

:;:!::!!!

.88.88.8

.N.NN.M

::8.8...

:::!;;:!

//!!;888

.8.8.88...

:;!::!!;!//!;

!!;:!!::

.88..8..

!!:::/^!

!;/;!;;;!!!:

.8:!!!!^

!!:;:::..

/:!^^!;{8{../

...:::.-

**6***66*6**6566*5666 ,

6*6666*6*6 655*65

6*65 56*5 55 555 *5 6

555( 55 (5 5(

76 5 66 555*677

6*6 5 5(5 (55( '5((5 (556 ('5

665**6(('S((((((S(((]('((@('SS((S(((((((6C-.NEC66S5sU

555(555(5((5(5(5(

5 5 5 5555 (555(555'(((5(5('55(((

((''('5'5(5('('('('('((''('(((@(((('&(((&

%&&%&&&&3>&3&3&33&3&3333&&3>3333

'(3&'&3&

3&33&&((

3323>33>%>3%>3>33>3%3&%

*5'(('((&@3(

,63%3>323>3%>&>33323>>%>

3(3'(((@@'5('@(@(&('(

>2>323%>3

75((((@3&333&3&&&%&3&&3&33>33%3>23%>3

>2%$32%>2>%>2$3>

3&%&&3&33>3>33

3>%>3%&3$23>23$2>2%$>2>

)4433((&(&('*

('((((''(**6(('' *

32323>3>

2$%>22%>%3' (

&(&''((5(5 *

'(&(&((&('''

&&%&3&&%3%

2%>22>22

5''3(((3(('&(&'&

3%%3%3%2#$

22$22$2%$22$2%2%$2%$2$222%$22

&>2$2$2$222$22$%%

:7'((('(3('(3(&(&

222222222222

22222222222222

222222222222222

22$22$22$22$

&(%3%&&&&3&&&3%3

222222222222222222

&&(&3(&(&'('((3'(&&

2222222

22$<$$2$22$%

&&(3(3('(&'

222"2212

22<2<22"

(&(3(3((

((565 ((( 6

333&33(&&

'(('('(('(

'&%%"$

2"2"22"2

2222<2"222

"2"22<2<22

2%('(3'32222?&'

2"2"2"121212<</pre><pre>2"2"2$"?</pre><pre>%%22%2</pre><pre>&3(3(3((&</pre><pre>"2"<"2<2<</pre><pre><2<"<"<"<</pre><pre>1"?((&21</pre><pre><?<?22<$2</pre><pre>2%""22&&</pre><pre>2<2$$2222</pre><pre>'&('(3(''</pre><pre>((%%%"</pre><pre>5(3%"%</pre><pre>"2%5*67</pre><pre>))) ))))</pre><pre>""**<****"""</pre><pre>"*<<<<*"</pre><pre>#2#---2222-222442-</pre><pre>--&#-(-%</pre><pre>$/222(--444222!</pre><pre>#&-221269924999;</pre><pre>&$-22-($2%</pre><pre>#(2---222622212-</pre><pre>#2221299629968</pre><pre>#&--%#(2##!</pre><pre>-222422422426662-%</pre><pre>"2-##&</pre><pre>!##-#&#-&&#%---#---#&-219662%</pre><pre>$&-(151,44.9</pre><pre>&1242662-</pre><pre>-(..19.19</pre><pre>,4492.12</pre><pre>12-$-,-,</pre><pre>-, $$----</pre><pre>#%#-15/-&</pre><pre>-,(,,(,(,</pre><pre>$$11651566/,$&&</pre><pre>,2592&&&-</pre><pre>2466/!$$</pre><pre>""*<*"****""</pre><pre>) '????[</pre><pre>&&&$-556>>61,,5994511-</pre><pre>$(//$$$(6>6/,$,-$</pre><pre>#$-22692/,,$,-&</pre><pre>-266661..4514#</pre><pre>&,2-&&##</pre><pre>&-222,22--#</pre><pre>#&&---2-,-&$&(,,291.566..BNNNTNNNNNAABIAA88</pre><pre>&!#&!-##</pre><pre>&#--//11468>885882&</pre><pre>$266961$&--$&%</pre><pre>,1661,!-((#</pre><pre>&$,4255$,92</pre><pre>&$,44..&</pre><pre>""**""***""</pre><pre>"****<*<<**"</pre><pre>"**""""*""""</pre><pre>&-569./-,16522$</pre><pre>.BAA=86546888=AAAEAAEMNRMQQSWZZ\]gk__m__\</pre><pre>bTRHHHHHQQHQJQWJSSSSSSSSSSSSSSSSWWSSSS\\V]VZW8,.FW]\\]\]\]\\ZZ\\WFR>38(</pre><pre>.BTTkgn]ktvgmvvvvvmvvvsvzzzyzyzyzyyyzmkkkkkZSRA816;F87</pre><pre>yzyzyzym^Z]WN3 $&$.Wt\</pre><pre>""*"""****""""</pre><pre>"***"**""**<**"</pre><pre>$5612,.2,</pre><pre>&$$,,,5]</pre><pre>$]t.Ft</pre><pre>7%8U8</pre><pre>3 303<3]3</pre><pre>2<3</pre><pre>8 8$8(8,8084888<8}8</pre><pre>5%5,575{6</pre><pre><,<0<4<8<</pre><pre>7 7$7(7,70747</pre><pre>rundll32.exe</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced</pre><pre>::{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}</pre><pre>::{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}</pre><pre>::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}</pre><pre>::{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}</pre><pre>::{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}</pre><pre>::{D20EA4E1-3957-11d2-A40B-0C5020524153}</pre><pre>::{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}</pre><pre>{208D2C60-3AEA-1069-A2D7-08002B30309D}</pre><pre>{20D04FE0-3AEA-1069-A2D8-08002B30309D}</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites</pre><pre>{450D8FBA-AD25-11D0-98A8-0800361B1103}</pre><pre>CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}</pre><pre>Software\Microsoft\Windows\CurrentVersion\RunOnce</pre><pre>Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\DontShowMeThisDialogAgain</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\CleanupWiz</pre><pre>\\.\WMIDataDevice</pre><pre>Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run</pre><pre>Software\Microsoft\Windows NT\CurrentVersion\Windows</pre><pre>ExplorerIsShellMutex</pre><pre>desk.cpl</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer</pre><pre>tourstart.exe</pre><pre>tourstart.exe,0</pre><pre>Microsoft.OfferTour</pre><pre>WINWORD.EXE</pre><pre>Software\Microsoft\Windows\CurrentVersion\Applets</pre><pre>Software\Microsoft\Windows\CurrentVersion\Applets\Tour</pre><pre>explorer.exe,9</pre><pre>Microsoft.FixScreenResolution</pre><pre>shell:::{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation</pre><pre>Software\Microsoft\Windows NT\CurrentVersion</pre><pre>shell:::{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage</pre><pre>Software\Microsoft\Windows\CurrentVersion\Policies\Explorer</pre><pre>DDEEXECUTESHORTCIRCUIT</pre><pre>http\shell</pre><pre>IEXPLORE.EXE</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\Streams\Desktop</pre><pre>Software\Microsoft\Windows\CurrentVersion\RunOnceEx</pre><pre>comctl32.dll</pre><pre>Software\Microsoft\Windows\Internet Settings</pre><pre>AutoConfigURL</pre><pre>system.ini</pre><pre>AppEvents\Schemes\Apps\.Default\%s\.current</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\TrayNotify</pre><pre>MSShellRunDlgReady</pre><pre>res://mys.dll/mys.hta /explorer</pre><pre>mshta.exe</pre><pre>SOFTWARE\Microsoft\Windows NT\CurrentVersion\Setup\Welcome</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\Tips</pre><pre>SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\MYS</pre><pre>cys.exe</pre><pre>SOFTWARE\Microsoft\Windows NT\CurrentVersion\srvWiz</pre><pre>install.exe</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel</pre><pre>OUTLOOK.EXE</pre><pre>explorer.exe,16</pre><pre>iernonce.dll</pre><pre>WININET.DLL</pre><pre>UpdateURL</pre><pre>WindowsUpdate</pre><pre>HWND%x</pre><pre>Software\Microsoft\Windows\CurrentVersion\OemStartMenuData</pre><pre>fldrclnr.dll,Wizard_RunDLL</pre><pre>iexplore.exe</pre><pre>winbrand.dll</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\Remote\%d</pre><pre>shell32.dll</pre><pre>nusrmgr.cpl ,initialTask=ChangePicture</pre><pre>NewExeName</pre><pre>Windows</pre><pre>ediskeer.dll</pre><pre>timedate.cpl</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\LastVisitedMRU</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\OpenSaveMRU</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\Doc Find Spec MRU</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU</pre><pre>Software\Microsoft\Internet Explorer\TypedURLs</pre><pre>%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Calculator.lnk</pre><pre>%ALLUSERSPROFILE%\Start Menu\Programs\Games\Solitaire.lnk</pre><pre>%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Paint.lnk</pre><pre>%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\WordPad.lnk</pre><pre>%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\Files and Settings Transfer Wizard.lnk</pre><pre>%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Windows Movie Maker.lnk</pre><pre>%USERPROFILE%\Start Menu\Programs\Accessories\Tour Windows XP.lnk</pre><pre>%ALLUSERSPROFILE%\Start Menu\Programs\Windows Messenger.lnk</pre><pre>%USERPROFILE%\Start Menu\Programs\Windows Media Player.lnk</pre><pre>%ALLUSERSPROFILE%\Start Menu\Programs\MSN.lnk</pre><pre>%ALLUSERSPROFILE%\Start Menu\Programs\Get Online with MSN.lnk</pre><pre>%ALLUSERSPROFILE%\Start Menu\Programs\Get Going with Tablet PC.lnk</pre><pre>%ALLUSERSPROFILE%\Start Menu\Set Program Access and Defaults.lnk</pre><pre>%ALLUSERSPROFILE%\Start Menu\Programs\Windows Journal.lnk</pre><pre>%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Media Center\Media Center.lnk</pre><pre>%USERPROFILE%\Start Menu\Programs\Internet Explorer.lnk</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel</pre><pre>TSAppCMP.DLL</pre><pre>netapi32.dll</pre><pre>%SystemRoot%\system32\restore\rstrui.exe</pre><pre>RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL ?0x%X?%s</pre><pre>RunDLL32.EXE</pre><pre>%s%d%s</pre><pre>Software\Microsoft\Windows\CurrentVersion\Policies\System</pre><pre>settings.dll</pre><pre>explorer.exe "</pre><pre>explorer.exe /e, "</pre><pre>WindowsLogon</pre><pre>WindowsLogoff</pre><pre>%s %s</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count</pre><pre>uAppWiz.Cpl</pre><pre>\explorer.exe</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu</pre><pre>::{20D04FE0-3AEA-1069-A2D8-08002B30309D}</pre><pre>taskmgr.exe</pre><pre>ShellExecute</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\AppKey\%d</pre><pre>\WindowsShell.Manifest</pre><pre>Get Online with MSN.lnk</pre><pre>Set Program Access and Defaults.lnk</pre><pre>Link%d</pre><pre>OEM%d</pre><pre>Software\Microsoft\Windows\CurrentVersion\SMDEn</pre><pre>::{D20EA4E1-3957-11d2-A40B-0C5020524152}</pre><pre>There is a file or folder on your computer called "%s" which could cause certain applications to not function correctly. Renaming it to "%s" would solve this problem. Would you like to rename it now?</pre><pre>Ca&scade Windows</pre><pre>Tile Windows &Horizontally</pre><pre>Tile Windows V&ertically</pre><pre>&Windows Security...</pre><pre>&Help and Support</pre><pre>&Log Off %s...</pre><pre>Windows Explorer</pre><pre>6.00.2900.5512 (xpsp.080413-2105)</pre><pre>EXPLORER.EXE</pre><pre>Windows</pre><pre>Operating System</pre><pre>6.00.2900.5512</pre><pre>Keep the &taskbar on top of other windows</pre><pre>To remove records of recently accessed documents, programs, and Web sites, click Clear.</pre><pre>Windows displays icons for active and urgent notifications, and hides inactive ones. You can change this behavior for items in the list below.</pre><pre>Select this option to use the menu style from earlier versions of Windows.</pre><pre>6There is not enough memory to complete this operation.8Unable to run command.</pre><pre>The folder '%1' has been removed.WMy Computer or Windows Explorer has not been properly initialized yet. Try again later.</pre><pre>&Undo %s</pre><pre>Windows is running in safe mode.</pre><pre>This special diagnostic mode of Windows enables you to fix a problem which may be caused by your network or hardware settings. Make sure these settings are correct in Control Panel, and then try starting Windows again. While in safe mode, some of your devices may not be available.</pre><pre>startRThere was an internal error and one of the windows you were using has been closed.</pre><pre>Restrictions{This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator.</pre><pre>&Show Open Windows</pre><pre>Windows was unable to change the display settings for the new configuration. Return the computer to the previous state, shut down Windows, and restart the computer in the desired configuration.</pre><pre>There may be a problem with your display settings if you continue. To safely change to a new configuration, you should shut down Windows and restart the computer in the desired configuration. Do you want to continue anyway?</pre><pre>This pre-release version of "Internet Explorer 4.0" Desktop/Explorer has expired. Please update to the latest release of "Internet Explorer 4.0" from WWW.MICROSOFT.COM</pre><pre>helpctr.exe>-FromStartHelp</pre><pre>Take a tour of Windows XP</pre><pre>NOpens a window where you can pick search options and work with search results.aOpens a central location for Help topics, tutorials, troubleshooting, and other support services.</pre><pre>/Opens a program, folder, document, or Web site.</pre><pre>Provides options for closing your programs and logging off, or for leaving your programs running and switching to another user.lProvides options for turning off or restarting your computer, or for activating Stand By or Hibernate modes.RDisconnects your session. You can reconnect to the session when you log on again.</pre><pre>&Windows Security</pre><pre>iOpens the My Documents folder, where you can store letters, reports, notes, and other kinds of documents./Displays recently opened documents and folders.KOpens the My Music folder, where you can store music and other audio files.]Opens the My Pictures folder, where you can store digital photos, images, and graphics files.zGives access to, and information about, the disk drives, cameras, scanners, and other hardware connected to your computer.MGives access to, and information about, folders and files on other computers.8Connects to other computers, networks, and the Internet.</pre>explorer.exe_672_rwx_00090000_00001000:<pre>KERNEL32.DLL</pre>explorer.exe_672_rwx_001D0000_00001000:<pre>KERNEL32.DLL</pre>explorer.exe_672_rwx_00210000_00001000:<pre>KERNEL32.DLL</pre>explorer.exe_672_rwx_00250000_00001000:<pre>KERNEL32.DLL</pre>explorer.exe_672_rwx_00290000_00001000:<pre>KERNEL32.DLL</pre>explorer.exe_672_rwx_002D0000_00001000:<pre>KERNEL32.DLL</pre>explorer.exe_672_rwx_00BD0000_00001000:<pre>advapi32.dll</pre>explorer.exe_672_rwx_00C00000_00001000:<pre>RegOpenKeyA</pre>explorer.exe_672_rwx_00C10000_00001000:<pre>advapi32.dll</pre>explorer.exe_672_rwx_00C40000_00001000:<pre>AVICAP32.DLL</pre>explorer.exe_672_rwx_00C90000_00001000:<pre>AVICAP32.DLL</pre>explorer.exe_672_rwx_00CC0000_00001000:<pre>gdi32.dll</pre>explorer.exe_672_rwx_00D00000_00001000:<pre>gdi32.dll</pre>explorer.exe_672_rwx_00F40000_00001000:<pre>gdiplus.dll</pre>explorer.exe_672_rwx_00F80000_00001000:<pre>gdiplus.dll</pre>explorer.exe_672_rwx_00FC0000_00001000:<pre>mpr.dll</pre>explorer.exe_672_rwx_01400000_00001000:<pre>mpr.dll</pre>explorer.exe_672_rwx_01430000_00001000:<pre>msacm32.dll</pre>explorer.exe_672_rwx_01570000_00001000:<pre>msacm32.dll</pre>explorer.exe_672_rwx_015A0000_00001000:<pre>ntdll.dll</pre>explorer.exe_672_rwx_016E0000_00001000:<pre>ntdll.dll</pre>explorer.exe_672_rwx_01710000_00001000:<pre>ole32.dll</pre>explorer.exe_672_rwx_01850000_00001000:<pre>ole32.dll</pre>explorer.exe_672_rwx_01880000_00001000:<pre>oleaut32.dll</pre>explorer.exe_672_rwx_019C0000_00001000:<pre>oleaut32.dll</pre>explorer.exe_672_rwx_019F0000_00001000:<pre>powrprof.dll</pre>explorer.exe_672_rwx_01B30000_00001000:<pre>powrprof.dll</pre>explorer.exe_672_rwx_01B60000_00001000:<pre>shell32.dll</pre>explorer.exe_672_rwx_01CA0000_00001000:<pre>shell32.dll</pre>explorer.exe_672_rwx_01CD0000_00001000:<pre>user32.dll</pre>explorer.exe_672_rwx_01E10000_00001000:<pre>user32.dll</pre>explorer.exe_672_rwx_01E40000_00001000:<pre>wininet.dll</pre>explorer.exe_672_rwx_01F70000_00001000:<pre>FtpOpenFileA</pre>explorer.exe_672_rwx_01F80000_00001000:<pre>wininet.dll</pre>explorer.exe_672_rwx_01FB0000_00001000:<pre>winmm.dll</pre>explorer.exe_672_rwx_020F0000_00001000:<pre>winmm.dll</pre>explorer.exe_672_rwx_02120000_00001000:<pre>wsock32.dll</pre>explorer.exe_672_rwx_02260000_00001000:<pre>wsock32.dll</pre>explorer.exe_672_rwx_02740000_0004B000:<pre>`.rsrc</pre><pre>kernel32.dll</pre><pre>$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)</pre><pre>sqlite3_bind_blob</pre><pre>sqlite3_bind_text</pre><pre>sqlite3_bind_double</pre><pre>sqlite3_bind_int</pre><pre>sqlite3_bind_int64</pre><pre>sqlite3_bind_null</pre><pre>sqlite3_bind_parameter_index</pre><pre>sqlite3_open</pre><pre>sqlite3_close</pre><pre>sqlite3_errmsg</pre><pre>sqlite3_errcode</pre><pre>sqlite3_free</pre><pre>sqlite3_prepare_v2</pre><pre>sqlite3_column_count</pre><pre>sqlite3_column_name</pre><pre>sqlite3_column_decltype</pre><pre>sqlite3_step</pre><pre>sqlite3_column_blob</pre><pre>sqlite3_column_bytes</pre><pre>sqlite3_column_double</pre><pre>sqlite3_column_text</pre><pre>sqlite3_column_type</pre><pre>sqlite3_column_int64</pre><pre>sqlite3_finalize</pre><pre>sqlite3_reset</pre><pre>SQL error or missing database</pre><pre>An internal logic error in SQLite</pre><pre>Operation terminated by sqlite3_interrupt()</pre><pre>Uses OS features not supported on host</pre><pre>2nd parameter to sqlite3_bind out of range</pre><pre>sqlite3_step() has another row ready</pre><pre>sqlite3_step() has finished executing</pre><pre>Unknown SQLite Error Code "</pre><pre>oleaut32.dll</pre><pre>EVariantBadIndexError</pre><pre>u%CNu</pre><pre>Uh%fu</pre><pre>%s[%d]</pre><pre>ESQLiteException</pre><pre>TSQLiteDatabasex</pre><pre>TSQLiteTable</pre><pre>Failed to open database "%s" : %s</pre><pre>Failed to open database "%s" : unknown error</pre><pre>Error [%d]: %s.</pre><pre>"%s": %s</pre><pre>Error executing SQL</pre><pre>Could not prepare SQL statement</pre><pre>Error executing SQL statement</pre><pre>SQLite is Busy</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders</pre><pre>Mozilla</pre><pre>Firefox</pre><pre>sqlite3.dll</pre><pre>mozcrt19.dll</pre><pre>nspr4.dll</pre><pre>plc4.dll</pre><pre>plds4.dll</pre><pre>nssutil3.dll</pre><pre>nss3.dll</pre><pre>PK11_GetInternalKeySlot</pre><pre>\Mozilla\Firefox\profiles.ini</pre><pre>\Mozilla\Firefox\</pre><pre>signons.sqlite</pre><pre>SELECT * FROM moz_logins</pre><pre>encryptedPassword</pre><pre>ole32.dll</pre><pre>##@@## ##@@## ##@@##</pre><pre>\Google\Chrome\User Data\Default\Web Data</pre><pre>SELECT * FROM logins</pre><pre>password_value</pre><pre>origin_url</pre><pre>getservbyport</pre><pre>WSAAsyncGetServByPort</pre><pre>WSAJoinLeaf</pre><pre>WS2_32.DLL</pre><pre>127.0.0.1</pre><pre>TIdSocketListWindows</pre><pre>TIdStackWindowsU</pre><pre>IdStackWindows</pre><pre>ftpTransfer</pre><pre>ftpReady</pre><pre>ftpAborted</pre><pre>ClientPortMin<</pre><pre>ClientPortMaxh</pre><pre>Port</pre><pre>EIdCanNotBindPortInRange</pre><pre>EIdInvalidPortRangeSVW</pre><pre>saUsernamePassword</pre><pre>Password<</pre><pre>Porth</pre><pre>0.0.0.1</pre><pre>TIdTCPConnection</pre><pre>IdTCPConnection</pre><pre>EIdTCPConnectionError</pre><pre>EIdObjectTypeNotSupported</pre><pre>TIdTCPServer</pre><pre>IdTCPServer</pre><pre>CmdDelimiterh</pre><pre>TIdTCPServerConnection</pre><pre>DefaultPort</pre><pre>OnExecuteL</pre><pre>EIdTCPServerError</pre><pre>EIdNoExecuteSpecified</pre><pre>TIdTCPClient</pre><pre>IdTCPClient</pre><pre>BoundPorth</pre><pre>PortU</pre><pre>TOnHTTPDocument</pre><pre>TIdHTTPProxyServer</pre><pre>TIdHTTPProxyServer0</pre><pre>IdHTTPProxyServer</pre><pre>DefaultPortd</pre><pre>OnHTTPDocument</pre><pre>HTTP/1.0</pre><pre>Windows Firewall Update</pre><pre>1.2.3</pre><pre>deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly</pre><pre>KWindows</pre><pre>IdTCPStream</pre><pre> IdTCPServer</pre><pre>SQLiteTable3</pre><pre>SQLite3</pre><pre>DIdHTTPProxyServer</pre><pre>UnitChrome</pre><pre>UnitFireFox3_5</pre><pre>GetCPInfo</pre><pre>RegOpenKeyExA</pre><pre>RegFlushKey</pre><pre>RegCreateKeyExA</pre><pre>RegCloseKey</pre><pre>GetKeyboardType</pre><pre>MsgWaitForMultipleObjects</pre><pre>((&)))!&$</pre><pre>"#$$&-)01$$'&,--%.&,</pre><pre>4\@%c</pre><pre>.idata</pre><pre>.edata</pre><pre>P.reloc</pre><pre>P.rsrc</pre><pre>$>.icR9</pre><pre>KERNEL32.DLL</pre><pre>advapi32.dll</pre><pre>crypt32.dll</pre><pre>user32.dll</pre><pre>funcoes.dll</pre><pre>GetChromePass</pre><pre>Mozilla3_5Password</pre><pre>StartHttpProxy</pre><pre>Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.</pre><pre>Command not supported.</pre><pre>Address type not supported.</pre><pre>Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.</pre><pre>Operation would block.</pre><pre>Operation now in progress.</pre><pre>Operation already in progress.</pre><pre>Socket operation on non-socket.</pre><pre>Protocol not supported.</pre><pre>Socket type not supported."Operation not supported on socket.</pre><pre>Protocol family not supported.0Address family not supported by protocol family.</pre><pre>&Error on loading Winsock2 library (%s)</pre><pre>Resolving hostname %s.</pre><pre>Connecting to %s.</pre><pre>%s is not a valid service.</pre><pre>Socket Error # %d</pre><pre>File "%s" not found1Only one TIdAntiFreeze can exist per application.</pre><pre>Object type not supported.</pre><pre>No execute handler found.</pre><pre>No data to read.$Can not bind in port range (%d - %d)</pre><pre>Invalid Port Range (%d - %d)</pre><pre>No command handler found.*Error on call Winsock2 library function %s</pre><pre>Failed to set data for '%s'</pre><pre>%s.Seek not implemented$Operation not allowed on sorted list</pre><pre>Property %s does not exist</pre><pre>Thread creation error: %s</pre><pre>Thread Error: %s (%d)</pre><pre>OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters</pre><pre>Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.</pre><pre>%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates</pre><pre>Cannot create file "%s". %s</pre><pre>Cannot open file "%s". %s$''%s'' is not a valid component name</pre><pre>Invalid property value List capacity out of bounds (%d)</pre><pre>List count out of bounds (%d)</pre><pre>List index out of bounds (%d) Out of memory while expanding memory stream</pre><pre>Error reading %s%s%s: %s</pre><pre>Ancestor for '%s' not found</pre><pre>Cannot assign a %s to a %sECheckSynchronize called from thread $%x, which is NOT the main thread</pre><pre>Class %s not found</pre><pre>%s (%s, line %d)</pre><pre>Abstract Error?Access violation at address %p in module '%s'. %s of address %p</pre><pre>System Error. Code: %d.</pre><pre>Invalid variant operation%Invalid variant operation (%s%.8x)</pre><pre>%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)</pre><pre>Operation not supported</pre><pre>External exception %x</pre><pre>Interface not supported</pre><pre>Invalid pointer operation</pre><pre>Invalid class typecast0Access violation at address %p. %s of address %p</pre><pre>Privileged instruction(Exception %s in module %s at %p.</pre><pre>Application Error1Format '%s' invalid or incompatible with argument</pre><pre>No argument for format '%s'"Variant method calls not supported</pre><pre>!'%s' is not a valid integer value('%s' is not a valid floating point value</pre><pre>I/O error %d</pre><pre>Integer overflow Invalid floating point operation</pre>explorer.exe_672_rwx_028C0000_0004B000:<pre>`.rsrc</pre><pre>kernel32.dll</pre><pre>$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)</pre><pre>sqlite3_bind_blob</pre><pre>sqlite3_bind_text</pre><pre>sqlite3_bind_double</pre><pre>sqlite3_bind_int</pre><pre>sqlite3_bind_int64</pre><pre>sqlite3_bind_null</pre><pre>sqlite3_bind_parameter_index</pre><pre>sqlite3_open</pre><pre>sqlite3_close</pre><pre>sqlite3_errmsg</pre><pre>sqlite3_errcode</pre><pre>sqlite3_free</pre><pre>sqlite3_prepare_v2</pre><pre>sqlite3_column_count</pre><pre>sqlite3_column_name</pre><pre>sqlite3_column_decltype</pre><pre>sqlite3_step</pre><pre>sqlite3_column_blob</pre><pre>sqlite3_column_bytes</pre><pre>sqlite3_column_double</pre><pre>sqlite3_column_text</pre><pre>sqlite3_column_type</pre><pre>sqlite3_column_int64</pre><pre>sqlite3_finalize</pre><pre>sqlite3_reset</pre><pre>SQL error or missing database</pre><pre>An internal logic error in SQLite</pre><pre>Operation terminated by sqlite3_interrupt()</pre><pre>Uses OS features not supported on host</pre><pre>2nd parameter to sqlite3_bind out of range</pre><pre>sqlite3_step() has another row ready</pre><pre>sqlite3_step() has finished executing</pre><pre>Unknown SQLite Error Code "</pre><pre>oleaut32.dll</pre><pre>EVariantBadIndexError</pre><pre>u%CNu</pre><pre>%s[%d]</pre><pre>ESQLiteException</pre><pre>TSQLiteDatabasex</pre><pre>TSQLiteTable</pre><pre>Failed to open database "%s" : %s</pre><pre>Failed to open database "%s" : unknown error</pre><pre>Error [%d]: %s.</pre><pre>"%s": %s</pre><pre>Error executing SQL</pre><pre>Could not prepare SQL statement</pre><pre>Error executing SQL statement</pre><pre>SQLite is Busy</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders</pre><pre>Mozilla</pre><pre>Firefox</pre><pre>sqlite3.dll</pre><pre>mozcrt19.dll</pre><pre>nspr4.dll</pre><pre>plc4.dll</pre><pre>plds4.dll</pre><pre>nssutil3.dll</pre><pre>nss3.dll</pre><pre>PK11_GetInternalKeySlot</pre><pre>\Mozilla\Firefox\profiles.ini</pre><pre>\Mozilla\Firefox\</pre><pre>signons.sqlite</pre><pre>SELECT * FROM moz_logins</pre><pre>encryptedPassword</pre><pre>ole32.dll</pre><pre>##@@## ##@@## ##@@##</pre><pre>\Google\Chrome\User Data\Default\Web Data</pre><pre>SELECT * FROM logins</pre><pre>password_value</pre><pre>origin_url</pre><pre>getservbyport</pre><pre>WSAAsyncGetServByPort</pre><pre>WSAJoinLeaf</pre><pre>WS2_32.DLL</pre><pre>127.0.0.1</pre><pre>TIdSocketListWindows</pre><pre>TIdStackWindowsU</pre><pre>IdStackWindows</pre><pre>ftpTransfer</pre><pre>ftpReady</pre><pre>ftpAborted</pre><pre>ClientPortMin<</pre><pre>ClientPortMaxh</pre><pre>Port</pre><pre>EIdCanNotBindPortInRange</pre><pre>EIdInvalidPortRangeSVW</pre><pre>saUsernamePassword</pre><pre>Password<</pre><pre>Porth</pre><pre>0.0.0.1</pre><pre>TIdTCPConnection</pre><pre>IdTCPConnection</pre><pre>EIdTCPConnectionError</pre><pre>EIdObjectTypeNotSupported</pre><pre>TIdTCPServer</pre><pre>IdTCPServer</pre><pre>CmdDelimiterh</pre><pre>TIdTCPServerConnection</pre><pre>DefaultPort</pre><pre>OnExecuteL</pre><pre>EIdTCPServerError</pre><pre>EIdNoExecuteSpecified</pre><pre>TIdTCPClient</pre><pre>IdTCPClient</pre><pre>BoundPorth</pre><pre>PortU</pre><pre>TOnHTTPDocument</pre><pre>TIdHTTPProxyServer</pre><pre>TIdHTTPProxyServer0</pre><pre>IdHTTPProxyServer</pre><pre>DefaultPortd</pre><pre>OnHTTPDocument</pre><pre>HTTP/1.0</pre><pre>Windows Firewall Update</pre><pre>1.2.3</pre><pre>deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly</pre><pre>KWindows</pre><pre>IdTCPStream</pre><pre> IdTCPServer</pre><pre>SQLiteTable3</pre><pre>SQLite3</pre><pre>DIdHTTPProxyServer</pre><pre>UnitChrome</pre><pre>UnitFireFox3_5</pre><pre>GetCPInfo</pre><pre>RegOpenKeyExA</pre><pre>RegFlushKey</pre><pre>RegCreateKeyExA</pre><pre>RegCloseKey</pre><pre>GetKeyboardType</pre><pre>MsgWaitForMultipleObjects</pre><pre>((&)))!&$</pre><pre>"#$$&-)01$$'&,--%.&,</pre><pre>4\@%c</pre><pre>.idata</pre><pre>.edata</pre><pre>P.reloc</pre><pre>P.rsrc</pre><pre>$>.icR9</pre><pre>KERNEL32.DLL</pre><pre>advapi32.dll</pre><pre>crypt32.dll</pre><pre>user32.dll</pre><pre>funcoes.dll</pre><pre>GetChromePass</pre><pre>Mozilla3_5Password</pre><pre>StartHttpProxy</pre><pre>Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.</pre><pre>Command not supported.</pre><pre>Address type not supported.</pre><pre>Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.</pre><pre>Operation would block.</pre><pre>Operation now in progress.</pre><pre>Operation already in progress.</pre><pre>Socket operation on non-socket.</pre><pre>Protocol not supported.</pre><pre>Socket type not supported."Operation not supported on socket.</pre><pre>Protocol family not supported.0Address family not supported by protocol family.</pre><pre>&Error on loading Winsock2 library (%s)</pre><pre>Resolving hostname %s.</pre><pre>Connecting to %s.</pre><pre>%s is not a valid service.</pre><pre>Socket Error # %d</pre><pre>File "%s" not found1Only one TIdAntiFreeze can exist per application.</pre><pre>Object type not supported.</pre><pre>No execute handler found.</pre><pre>No data to read.$Can not bind in port range (%d - %d)</pre><pre>Invalid Port Range (%d - %d)</pre><pre>No command handler found.*Error on call Winsock2 library function %s</pre><pre>Failed to set data for '%s'</pre><pre>%s.Seek not implemented$Operation not allowed on sorted list</pre><pre>Property %s does not exist</pre><pre>Thread creation error: %s</pre><pre>Thread Error: %s (%d)</pre><pre>OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters</pre><pre>Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.</pre><pre>%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates</pre><pre>Cannot create file "%s". %s</pre><pre>Cannot open file "%s". %s$''%s'' is not a valid component name</pre><pre>Invalid property value List capacity out of bounds (%d)</pre><pre>List count out of bounds (%d)</pre><pre>List index out of bounds (%d) Out of memory while expanding memory stream</pre><pre>Error reading %s%s%s: %s</pre><pre>Ancestor for '%s' not found</pre><pre>Cannot assign a %s to a %sECheckSynchronize called from thread $%x, which is NOT the main thread</pre><pre>Class %s not found</pre><pre>%s (%s, line %d)</pre><pre>Abstract Error?Access violation at address %p in module '%s'. %s of address %p</pre><pre>System Error. Code: %d.</pre><pre>Invalid variant operation%Invalid variant operation (%s%.8x)</pre><pre>%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)</pre><pre>Operation not supported</pre><pre>External exception %x</pre><pre>Interface not supported</pre><pre>Invalid pointer operation</pre><pre>Invalid class typecast0Access violation at address %p. %s of address %p</pre><pre>Privileged instruction(Exception %s in module %s at %p.</pre><pre>Application Error1Format '%s' invalid or incompatible with argument</pre><pre>No argument for format '%s'"Variant method calls not supported</pre><pre>!'%s' is not a valid integer value('%s' is not a valid floating point value</pre><pre>I/O error %d</pre><pre>Integer overflow Invalid floating point operation</pre>explorer.exe_672_rwx_02A10000_0004B000:<pre>`.rsrc</pre><pre>kernel32.dll</pre><pre>$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)</pre><pre>sqlite3_bind_blob</pre><pre>sqlite3_bind_text</pre><pre>sqlite3_bind_double</pre><pre>sqlite3_bind_int</pre><pre>sqlite3_bind_int64</pre><pre>sqlite3_bind_null</pre><pre>sqlite3_bind_parameter_index</pre><pre>sqlite3_open</pre><pre>sqlite3_close</pre><pre>sqlite3_errmsg</pre><pre>sqlite3_errcode</pre><pre>sqlite3_free</pre><pre>sqlite3_prepare_v2</pre><pre>sqlite3_column_count</pre><pre>sqlite3_column_name</pre><pre>sqlite3_column_decltype</pre><pre>sqlite3_step</pre><pre>sqlite3_column_blob</pre><pre>sqlite3_column_bytes</pre><pre>sqlite3_column_double</pre><pre>sqlite3_column_text</pre><pre>sqlite3_column_type</pre><pre>sqlite3_column_int64</pre><pre>sqlite3_finalize</pre><pre>sqlite3_reset</pre><pre>SQL error or missing database</pre><pre>An internal logic error in SQLite</pre><pre>Operation terminated by sqlite3_interrupt()</pre><pre>Uses OS features not supported on host</pre><pre>2nd parameter to sqlite3_bind out of range</pre><pre>sqlite3_step() has another row ready</pre><pre>sqlite3_step() has finished executing</pre><pre>Unknown SQLite Error Code "</pre><pre>oleaut32.dll</pre><pre>EVariantBadIndexError</pre><pre>u%CNu</pre><pre>%s[%d]</pre><pre>ESQLiteException</pre><pre>TSQLiteDatabasex</pre><pre>TSQLiteTable</pre><pre>Failed to open database "%s" : %s</pre><pre>Failed to open database "%s" : unknown error</pre><pre>Error [%d]: %s.</pre><pre>"%s": %s</pre><pre>Error executing SQL</pre><pre>Could not prepare SQL statement</pre><pre>Error executing SQL statement</pre><pre>SQLite is Busy</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders</pre><pre>Mozilla</pre><pre>Firefox</pre><pre>sqlite3.dll</pre><pre>mozcrt19.dll</pre><pre>nspr4.dll</pre><pre>plc4.dll</pre><pre>plds4.dll</pre><pre>nssutil3.dll</pre><pre>nss3.dll</pre><pre>PK11_GetInternalKeySlot</pre><pre>\Mozilla\Firefox\profiles.ini</pre><pre>\Mozilla\Firefox\</pre><pre>signons.sqlite</pre><pre>SELECT * FROM moz_logins</pre><pre>encryptedPassword</pre><pre>ole32.dll</pre><pre>##@@## ##@@## ##@@##</pre><pre>\Google\Chrome\User Data\Default\Web Data</pre><pre>SELECT * FROM logins</pre><pre>password_value</pre><pre>origin_url</pre><pre>getservbyport</pre><pre>WSAAsyncGetServByPort</pre><pre>WSAJoinLeaf</pre><pre>WS2_32.DLL</pre><pre>127.0.0.1</pre><pre>TIdSocketListWindows</pre><pre>TIdStackWindowsU</pre><pre>IdStackWindows</pre><pre>ftpTransfer</pre><pre>ftpReady</pre><pre>ftpAborted</pre><pre>ClientPortMin<</pre><pre>ClientPortMaxh</pre><pre>Port</pre><pre>EIdCanNotBindPortInRange</pre><pre>EIdInvalidPortRangeSVW</pre><pre>saUsernamePassword</pre><pre>Password<</pre><pre>Porth</pre><pre>0.0.0.1</pre><pre>TIdTCPConnection</pre><pre>IdTCPConnection</pre><pre>EIdTCPConnectionError</pre><pre>EIdObjectTypeNotSupported</pre><pre>TIdTCPServer</pre><pre>IdTCPServer</pre><pre>CmdDelimiterh</pre><pre>TIdTCPServerConnection</pre><pre>DefaultPort</pre><pre>OnExecuteL</pre><pre>EIdTCPServerError</pre><pre>EIdNoExecuteSpecified</pre><pre>TIdTCPClient</pre><pre>IdTCPClient</pre><pre>BoundPorth</pre><pre>PortU</pre><pre>TOnHTTPDocument</pre><pre>TIdHTTPProxyServer</pre><pre>TIdHTTPProxyServer0</pre><pre>IdHTTPProxyServer</pre><pre>DefaultPortd</pre><pre>OnHTTPDocument</pre><pre>HTTP/1.0</pre><pre>Windows Firewall Update</pre><pre>1.2.3</pre><pre>deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly</pre><pre>KWindows</pre><pre>IdTCPStream</pre><pre> IdTCPServer</pre><pre>SQLiteTable3</pre><pre>SQLite3</pre><pre>DIdHTTPProxyServer</pre><pre>UnitChrome</pre><pre>UnitFireFox3_5</pre><pre>GetCPInfo</pre><pre>RegOpenKeyExA</pre><pre>RegFlushKey</pre><pre>RegCreateKeyExA</pre><pre>RegCloseKey</pre><pre>GetKeyboardType</pre><pre>MsgWaitForMultipleObjects</pre><pre>((&)))!&$</pre><pre>"#$$&-)01$$'&,--%.&,</pre><pre>4\@%c</pre><pre>.idata</pre><pre>.edata</pre><pre>P.reloc</pre><pre>P.rsrc</pre><pre>$>.icR9</pre><pre>KERNEL32.DLL</pre><pre>advapi32.dll</pre><pre>crypt32.dll</pre><pre>user32.dll</pre><pre>funcoes.dll</pre><pre>GetChromePass</pre><pre>Mozilla3_5Password</pre><pre>StartHttpProxy</pre><pre>Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.</pre><pre>Command not supported.</pre><pre>Address type not supported.</pre><pre>Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.</pre><pre>Operation would block.</pre><pre>Operation now in progress.</pre><pre>Operation already in progress.</pre><pre>Socket operation on non-socket.</pre><pre>Protocol not supported.</pre><pre>Socket type not supported."Operation not supported on socket.</pre><pre>Protocol family not supported.0Address family not supported by protocol family.</pre><pre>&Error on loading Winsock2 library (%s)</pre><pre>Resolving hostname %s.</pre><pre>Connecting to %s.</pre><pre>%s is not a valid service.</pre><pre>Socket Error # %d</pre><pre>File "%s" not found1Only one TIdAntiFreeze can exist per application.</pre><pre>Object type not supported.</pre><pre>No execute handler found.</pre><pre>No data to read.$Can not bind in port range (%d - %d)</pre><pre>Invalid Port Range (%d - %d)</pre><pre>No command handler found.*Error on call Winsock2 library function %s</pre><pre>Failed to set data for '%s'</pre><pre>%s.Seek not implemented$Operation not allowed on sorted list</pre><pre>Property %s does not exist</pre><pre>Thread creation error: %s</pre><pre>Thread Error: %s (%d)</pre><pre>OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters</pre><pre>Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.</pre><pre>%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates</pre><pre>Cannot create file "%s". %s</pre><pre>Cannot open file "%s". %s$''%s'' is not a valid component name</pre><pre>Invalid property value List capacity out of bounds (%d)</pre><pre>List count out of bounds (%d)</pre><pre>List index out of bounds (%d) Out of memory while expanding memory stream</pre><pre>Error reading %s%s%s: %s</pre><pre>Ancestor for '%s' not found</pre><pre>Cannot assign a %s to a %sECheckSynchronize called from thread $%x, which is NOT the main thread</pre><pre>Class %s not found</pre><pre>%s (%s, line %d)</pre><pre>Abstract Error?Access violation at address %p in module '%s'. %s of address %p</pre><pre>System Error. Code: %d.</pre><pre>Invalid variant operation%Invalid variant operation (%s%.8x)</pre><pre>%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)</pre><pre>Operation not supported</pre><pre>External exception %x</pre><pre>Interface not supported</pre><pre>Invalid pointer operation</pre><pre>Invalid class typecast0Access violation at address %p. %s of address %p</pre><pre>Privileged instruction(Exception %s in module %s at %p.</pre><pre>Application Error1Format '%s' invalid or incompatible with argument</pre><pre>No argument for format '%s'"Variant method calls not supported</pre><pre>!'%s' is not a valid integer value('%s' is not a valid floating point value</pre><pre>I/O error %d</pre><pre>Integer overflow Invalid floating point operation</pre>explorer.exe_672_rwx_24080000_00062000:<pre>`.rsrc</pre><pre>/w)f%u/</pre><pre>kernel32.dll</pre><pre>Portions Copyright (c) 1999,2003 Avenger by NhT</pre><pre>SHFileOperationA</pre><pre>shell32.dll</pre><pre>URLDownloadToFileA</pre><pre>urlmon.dll</pre><pre>ShellExecuteA</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders</pre><pre>GetWindowsDirectoryA</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion</pre><pre>http\shell\open\command</pre><pre>\Internet Explorer\iexplore.exe</pre><pre>####@####</pre><pre>$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)</pre><pre>Portugal</pre><pre>Turkey</pre><pre>Windows 3.1</pre><pre>Windows 95 (Release 2)</pre><pre>Windows 95</pre><pre>Windows 98 SE</pre><pre>Windows 98</pre><pre>Windows ME</pre><pre>Windows 7</pre><pre>Windows Vista</pre><pre>%s %s</pre><pre>Windows XP Professional x64</pre><pre>Windows XP Home</pre><pre>Windows XP Professional</pre><pre>Windows 2000 Professional</pre><pre>Windows NT %d.%d</pre><pre>Windows 2008</pre><pre>%s %s Server</pre><pre>Windows 2003 Server Datacenter</pre><pre>Windows 2003 Server Enterprise</pre><pre>Windows 2003 Server Web Edition</pre><pre>Windows 2003 Server</pre><pre>Windows Home Server</pre><pre>Windows 2003 Server (Release 2)</pre><pre>Windows 2000 Server Datacenter</pre><pre>Windows 2000 Server Enterprise</pre><pre>Windows 2000 Server Web Edition</pre><pre>Windows 2000 Server</pre><pre>Windows NT 4.0 Server Datacenter</pre><pre>Windows NT 4.0 Server Enterprise</pre><pre>Windows NT 4.0 Server Web Edition</pre><pre>Windows NT 4.0 Server</pre><pre>Unknown Platform ID (%d)</pre><pre>%d.%d</pre><pre>%s (Build: %d</pre><pre>- Service Pack: %s</pre><pre>KERNEL32.DLL</pre><pre>teste.vbs</pre><pre>teste.txt</pre><pre>Set objSecurityCenter = GetObject("winmgmts:\\.\root\SecurityCenter")</pre><pre>Set colFirewall = objSecurityCenter.ExecQuery("Select * From FirewallProduct",,48)</pre><pre>Set colAntiVirus = objSecurityCenter.ExecQuery("Select * From AntiVirusProduct",,48)</pre><pre>Set objFileSystem = CreateObject("Scripting.fileSystemObject")</pre><pre>Set objFile = objFileSystem.CreateTextFile("</pre><pre>Info = Info & "F" & CountFw & ") " & objFirewall.displayName & " v" & objFirewall.versionNumber & Enter</pre><pre>Info = Info & "A" & CountAV & ") " & objAntiVirus.displayName & " v" & objAntiVirus.versionNumber & Enter</pre><pre>objFile.WriteLine(Info)</pre><pre>objFile.Close</pre><pre>cscript.exe</pre><pre>AVICAP32.dll</pre><pre>tFtpAccess</pre><pre>BuildImportTable: can't load library:</pre><pre>BuildImportTable: ReallocMemory failed</pre><pre>BuildImportTable: GetProcAddress failed</pre><pre>BTMemoryLoadLibary: BuildImportTable failed</pre><pre>BTMemoryGetProcAddress: no export table found</pre><pre>BTMemoryGetProcAddress: DLL doesn't export anything</pre><pre>BTMemoryGetProcAddress: exported symbol not found</pre><pre>SetupApi.dll</pre><pre>SetupDiOpenClassRegKey</pre><pre>SetupDiOpenClassRegKeyExA</pre><pre>SetupDiOpenClassRegKeyExW</pre><pre>SetupDiCreateDeviceInterfaceRegKeyA</pre><pre>SetupDiCreateDeviceInterfaceRegKeyW</pre><pre>SetupDiOpenDeviceInterfaceRegKey</pre><pre>SetupDiDeleteDeviceInterfaceRegKey</pre><pre>SetupDiCreateDevRegKeyA</pre><pre>SetupDiCreateDevRegKeyW</pre><pre>SetupDiOpenDevRegKey</pre><pre>SetupDiDeleteDevRegKey</pre><pre>CM_DEVCAP_LOCKSUPPORTED</pre><pre>CM_DEVCAP_EJECTSUPPORTED</pre><pre>PDCAP_D0_SUPPORTED</pre><pre>PDCAP_D1_SUPPORTED</pre><pre>PDCAP_D2_SUPPORTED</pre><pre>PDCAP_D3_SUPPORTED</pre><pre>PDCAP_WAKE_FROM_D0_SUPPORTED</pre><pre>PDCAP_WAKE_FROM_D1_SUPPORTED</pre><pre>PDCAP_WAKE_FROM_D2_SUPPORTED</pre><pre>PDCAP_WAKE_FROM_D3_SUPPORTED</pre><pre>PDCAP_WARM_EJECT_SUPPORTED</pre><pre>HKEY_CLASSES_ROOT</pre><pre>HKEY_CURRENT_CONFIG</pre><pre>HKEY_CURRENT_USER</pre><pre>HKEY_LOCAL_MACHINE</pre><pre>HKEY_USERS</pre><pre>127.0.0.1</pre><pre>iphlpapi.dll</pre><pre>AllocateAndGetTcpExTableFromStack</pre><pre>AllocateAndGetUdpExTableFromStack</pre><pre>SetTcpEntry</pre><pre>GetExtendedTcpTable</pre><pre>GetExtendedUdpTable</pre><pre>Mozilla3_5Password</pre><pre>GetChromePass</pre><pre>StartHttpProxy</pre><pre>1.2.3</pre><pre>XxX.xXx</pre><pre>UuU.uUu</pre><pre>keyboardkey</pre><pre>webcaminactive</pre><pre>webcamgetbuffer</pre><pre>webcam</pre><pre>enviarexecnormal</pre><pre>enviarexechidden</pre><pre>openweb</pre><pre>downexec</pre><pre>sendftp</pre><pre>keylogger</pre><pre>keyloggergetlog</pre><pre>keyloggereraselog</pre><pre>keyloggerativar</pre><pre>keyloggerdesativar</pre><pre>renamekey</pre><pre>windowsfechar</pre><pre>windowsmax</pre><pre>windowsmin</pre><pre>windowsmostrar</pre><pre>windowsocultar</pre><pre>windowsmintodas</pre><pre>windowscaption</pre><pre>listarportas</pre><pre>listarportasdns</pre><pre>finalizarprocessoportas</pre><pre>webcamsettings</pre><pre>chatmsg</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\</pre><pre>PSAPI.dll</pre><pre>\config\SteamAppData.vdf</pre><pre>AutoLoginUser</pre><pre>/ClientRegistry.Blob</pre><pre>\ClientRegistry.blob</pre><pre>\steam.dll</pre><pre>%SYS%</pre><pre>ÞSKTOP%</pre><pre>FirstExecution</pre><pre>chatmsg|</pre><pre>Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run</pre><pre>listarjanelas|windowsfechar|</pre><pre>listarjanelas|windowsmax|</pre><pre>listarjanelas|windowsmin|</pre><pre>listarjanelas|windowsmostrar|</pre><pre>listarjanelas|windowsocultar|</pre><pre>listarjanelas|windowsmintodas|</pre><pre>listarjanelas|windowscaption|</pre><pre>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall</pre><pre>listarportas|listadeportaspronta|</pre><pre>listarportas|finalizarconexao|</pre><pre>listarportas|finalizarprocessoportas|Y|</pre><pre>listarportas|finalizarprocessoportas|N|</pre><pre>registro|renamekey|</pre><pre>keylogger|keylogger|keyloggerativar|</pre><pre>keylogger|keylogger|keyloggerdesativar|</pre><pre>keylogger|keyloggergetlog|</pre><pre>keylogger|keylogger|keyloggervazio|</pre><pre>keyloggersearch</pre><pre>keyloggersearchok|</pre><pre>webcam|webcaminactive|</pre><pre>webcam|webcamactive|</pre><pre>getpassword</pre><pre>_x_X_PASSWORDLIST_X_x_</pre><pre>NOIP.abc</pre><pre>MSN.abc</pre><pre>FIREFOX.abc</pre><pre>IELOGIN.abc</pre><pre>IEPASS.abc</pre><pre>IEAUTO.abc</pre><pre>IEWEB.abc</pre><pre>SOFTWARE\Mozilla\Mozilla Firefox</pre><pre>getfirefox</pre><pre>getielogin</pre><pre>getiepass</pre><pre>getieweb</pre><pre>getchrome</pre><pre>getpassword|getpasswordlist|</pre><pre>getpassword|getpassworderror|</pre><pre>updateservidorweb</pre><pre>##@@## ##@@## ##@@##</pre><pre>Windows\CurrentVersion\Uninstall\eDonkey2000</pre><pre>UNWISE.EXE</pre><pre>ntdll.dll</pre><pre>icon=shell32.dll,4</pre><pre>shellexecute=</pre><pre>autorun.inf</pre><pre>XX--XX--XX.txt</pre><pre>logs.dat</pre><pre>SQLite3.dll</pre><pre>$1.2.3</pre><pre>deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly</pre><pre>inflate 1.2.3 Copyright 1995-2005 Mark Adler</pre><pre>KWindows</pre><pre>UnitExecutarComandos</pre><pre>uftp</pre><pre>UrlMon</pre><pre>.UnitBytesSize</pre><pre>UnitListarPortasAtivas</pre><pre>UnitWebcam</pre><pre>UnitKeylogger</pre><pre>WinExec</pre><pre>SetNamedPipeHandleState</pre><pre>GetProcessHeap</pre><pre>CreatePipe</pre><pre>RegOpenKeyExA</pre><pre>RegOpenKeyA</pre><pre>RegEnumKeyExA</pre><pre>RegDeleteKeyA</pre><pre>RegCreateKeyA</pre><pre>RegCloseKey</pre><pre>GdiplusShutdown</pre><pre>keybd_event</pre><pre>MapVirtualKeyA</pre><pre>GetKeyboardState</pre><pre>GetKeyboardLayoutNameA</pre><pre>GetKeyState</pre><pre>GetAsyncKeyState</pre><pre>ExitWindowsEx</pre><pre>EnumWindows</pre><pre>FtpGetFileSize</pre><pre>FtpSetCurrentDirectoryA</pre><pre>FtpOpenFileA</pre><pre>%( % & % % % ]</pre><pre>.idata</pre><pre>.reloc</pre><pre>P.rsrc</pre><pre>advapi32.dll</pre><pre>AVICAP32.DLL</pre><pre>gdi32.dll</pre><pre>gdiplus.dll</pre><pre>mpr.dll</pre><pre>msacm32.dll</pre><pre>ole32.dll</pre><pre>oleaut32.dll</pre><pre>powrprof.dll</pre><pre>user32.dll</pre><pre>wininet.dll</pre><pre>winmm.dll</pre><pre>wsock32.dll</pre>Explorer.EXE_840_rwx_01450000_00001000:<pre>KERNEL32.DLL</pre>Explorer.EXE_840_rwx_01CD0000_00001000:<pre>KERNEL32.DLL</pre>Explorer.EXE_840_rwx_01D10000_00001000:<pre>KERNEL32.DLL</pre>Explorer.EXE_840_rwx_01DE0000_00001000:<pre>KERNEL32.DLL</pre>Explorer.EXE_840_rwx_01E90000_00001000:<pre>KERNEL32.DLL</pre>Explorer.EXE_840_rwx_02010000_00001000:<pre>KERNEL32.DLL</pre>Explorer.EXE_840_rwx_02040000_00001000:<pre>advapi32.dll</pre>Explorer.EXE_840_rwx_02170000_00001000:<pre>RegOpenKeyA</pre>Explorer.EXE_840_rwx_02180000_00001000:<pre>advapi32.dll</pre>Explorer.EXE_840_rwx_021B0000_00001000:<pre>AVICAP32.DLL</pre>Explorer.EXE_840_rwx_022F0000_00001000:<pre>AVICAP32.DLL</pre>Explorer.EXE_840_rwx_02320000_00001000:<pre>gdi32.dll</pre>Explorer.EXE_840_rwx_02460000_00001000:<pre>gdi32.dll</pre>Explorer.EXE_840_rwx_02490000_00001000:<pre>gdiplus.dll</pre>Explorer.EXE_840_rwx_025D0000_00001000:<pre>gdiplus.dll</pre>Explorer.EXE_840_rwx_02600000_00001000:<pre>mpr.dll</pre>Explorer.EXE_840_rwx_02640000_00001000:<pre>mpr.dll</pre>Explorer.EXE_840_rwx_02670000_00001000:<pre>msacm32.dll</pre>Explorer.EXE_840_rwx_026B0000_00001000:<pre>msacm32.dll</pre>Explorer.EXE_840_rwx_026E0000_00001000:<pre>ntdll.dll</pre>Explorer.EXE_840_rwx_02A30000_00001000:<pre>ntdll.dll</pre>Explorer.EXE_840_rwx_02A60000_00001000:<pre>ole32.dll</pre>Explorer.EXE_840_rwx_02BA0000_00001000:<pre>ole32.dll</pre>Explorer.EXE_840_rwx_02BD0000_00001000:<pre>oleaut32.dll</pre>Explorer.EXE_840_rwx_02D10000_00001000:<pre>oleaut32.dll</pre>Explorer.EXE_840_rwx_02D40000_00001000:<pre>powrprof.dll</pre>Explorer.EXE_840_rwx_02E80000_00001000:<pre>powrprof.dll</pre>Explorer.EXE_840_rwx_02EB0000_00001000:<pre>shell32.dll</pre>Explorer.EXE_840_rwx_02FF0000_00001000:<pre>shell32.dll</pre>Explorer.EXE_840_rwx_03020000_00001000:<pre>user32.dll</pre>Explorer.EXE_840_rwx_03160000_00001000:<pre>user32.dll</pre>Explorer.EXE_840_rwx_03190000_00001000:<pre>wininet.dll</pre>Explorer.EXE_840_rwx_032C0000_00001000:<pre>FtpOpenFileA</pre>Explorer.EXE_840_rwx_032D0000_00001000:<pre>wininet.dll</pre>Explorer.EXE_840_rwx_03300000_00001000:<pre>winmm.dll</pre>Explorer.EXE_840_rwx_03440000_00001000:<pre>winmm.dll</pre>Explorer.EXE_840_rwx_03470000_00001000:<pre>wsock32.dll</pre>Explorer.EXE_840_rwx_035B0000_00001000:<pre>wsock32.dll</pre>Explorer.EXE_840_rwx_24010000_00062000:<pre>`.rsrc</pre><pre>/w)f%u/</pre><pre>kernel32.dll</pre><pre>Portions Copyright (c) 1999,2003 Avenger by NhT</pre><pre>SHFileOperationA</pre><pre>shell32.dll</pre><pre>URLDownloadToFileA</pre><pre>urlmon.dll</pre><pre>ShellExecuteA</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders</pre><pre>GetWindowsDirectoryA</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion</pre><pre>http\shell\open\command</pre><pre>\Internet Explorer\iexplore.exe</pre><pre>####@####</pre><pre>$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)</pre><pre>Portugal</pre><pre>Turkey</pre><pre>Windows 3.1</pre><pre>Windows 95 (Release 2)</pre><pre>Windows 95</pre><pre>Windows 98 SE</pre><pre>Windows 98</pre><pre>Windows ME</pre><pre>Windows 7</pre><pre>Windows Vista</pre><pre>%s %s</pre><pre>Windows XP Professional x64</pre><pre>Windows XP Home</pre><pre>Windows XP Professional</pre><pre>Windows 2000 Professional</pre><pre>Windows NT %d.%d</pre><pre>Windows 2008</pre><pre>%s %s Server</pre><pre>Windows 2003 Server Datacenter</pre><pre>Windows 2003 Server Enterprise</pre><pre>Windows 2003 Server Web Edition</pre><pre>Windows 2003 Server</pre><pre>Windows Home Server</pre><pre>Windows 2003 Server (Release 2)</pre><pre>Windows 2000 Server Datacenter</pre><pre>Windows 2000 Server Enterprise</pre><pre>Windows 2000 Server Web Edition</pre><pre>Windows 2000 Server</pre><pre>Windows NT 4.0 Server Datacenter</pre><pre>Windows NT 4.0 Server Enterprise</pre><pre>Windows NT 4.0 Server Web Edition</pre><pre>Windows NT 4.0 Server</pre><pre>Unknown Platform ID (%d)</pre><pre>%d.%d</pre><pre>%s (Build: %d</pre><pre>- Service Pack: %s</pre><pre>KERNEL32.DLL</pre><pre>teste.vbs</pre><pre>teste.txt</pre><pre>Set objSecurityCenter = GetObject("winmgmts:\\.\root\SecurityCenter")</pre><pre>Set colFirewall = objSecurityCenter.ExecQuery("Select * From FirewallProduct",,48)</pre><pre>Set colAntiVirus = objSecurityCenter.ExecQuery("Select * From AntiVirusProduct",,48)</pre><pre>Set objFileSystem = CreateObject("Scripting.fileSystemObject")</pre><pre>Set objFile = objFileSystem.CreateTextFile("</pre><pre>Info = Info & "F" & CountFw & ") " & objFirewall.displayName & " v" & objFirewall.versionNumber & Enter</pre><pre>Info = Info & "A" & CountAV & ") " & objAntiVirus.displayName & " v" & objAntiVirus.versionNumber & Enter</pre><pre>objFile.WriteLine(Info)</pre><pre>objFile.Close</pre><pre>cscript.exe</pre><pre>AVICAP32.dll</pre><pre>tFtpAccess</pre><pre>BuildImportTable: can't load library:</pre><pre>BuildImportTable: ReallocMemory failed</pre><pre>BuildImportTable: GetProcAddress failed</pre><pre>BTMemoryLoadLibary: BuildImportTable failed</pre><pre>BTMemoryGetProcAddress: no export table found</pre><pre>BTMemoryGetProcAddress: DLL doesn't export anything</pre><pre>BTMemoryGetProcAddress: exported symbol not found</pre><pre>SetupApi.dll</pre><pre>SetupDiOpenClassRegKey</pre><pre>SetupDiOpenClassRegKeyExA</pre><pre>SetupDiOpenClassRegKeyExW</pre><pre>SetupDiCreateDeviceInterfaceRegKeyA</pre><pre>SetupDiCreateDeviceInterfaceRegKeyW</pre><pre>SetupDiOpenDeviceInterfaceRegKey</pre><pre>SetupDiDeleteDeviceInterfaceRegKey</pre><pre>SetupDiCreateDevRegKeyA</pre><pre>SetupDiCreateDevRegKeyW</pre><pre>SetupDiOpenDevRegKey</pre><pre>SetupDiDeleteDevRegKey</pre><pre>CM_DEVCAP_LOCKSUPPORTED</pre><pre>CM_DEVCAP_EJECTSUPPORTED</pre><pre>PDCAP_D0_SUPPORTED</pre><pre>PDCAP_D1_SUPPORTED</pre><pre>PDCAP_D2_SUPPORTED</pre><pre>PDCAP_D3_SUPPORTED</pre><pre>PDCAP_WAKE_FROM_D0_SUPPORTED</pre><pre>PDCAP_WAKE_FROM_D1_SUPPORTED</pre><pre>PDCAP_WAKE_FROM_D2_SUPPORTED</pre><pre>PDCAP_WAKE_FROM_D3_SUPPORTED</pre><pre>PDCAP_WARM_EJECT_SUPPORTED</pre><pre>HKEY_CLASSES_ROOT</pre><pre>HKEY_CURRENT_CONFIG</pre><pre>HKEY_CURRENT_USER</pre><pre>HKEY_LOCAL_MACHINE</pre><pre>HKEY_USERS</pre><pre>127.0.0.1</pre><pre>iphlpapi.dll</pre><pre>AllocateAndGetTcpExTableFromStack</pre><pre>AllocateAndGetUdpExTableFromStack</pre><pre>SetTcpEntry</pre><pre>GetExtendedTcpTable</pre><pre>GetExtendedUdpTable</pre><pre>Mozilla3_5Password</pre><pre>GetChromePass</pre><pre>StartHttpProxy</pre><pre>1.2.3</pre><pre>XxX.xXx</pre><pre>UuU.uUu</pre><pre>keyboardkey</pre><pre>webcaminactive</pre><pre>webcamgetbuffer</pre><pre>webcam</pre><pre>enviarexecnormal</pre><pre>enviarexechidden</pre><pre>openweb</pre><pre>downexec</pre><pre>sendftp</pre><pre>keylogger</pre><pre>keyloggergetlog</pre><pre>keyloggereraselog</pre><pre>keyloggerativar</pre><pre>keyloggerdesativar</pre><pre>renamekey</pre><pre>windowsfechar</pre><pre>windowsmax</pre><pre>windowsmin</pre><pre>windowsmostrar</pre><pre>windowsocultar</pre><pre>windowsmintodas</pre><pre>windowscaption</pre><pre>listarportas</pre><pre>listarportasdns</pre><pre>finalizarprocessoportas</pre><pre>webcamsettings</pre><pre>chatmsg</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\</pre><pre>PSAPI.dll</pre><pre>\config\SteamAppData.vdf</pre><pre>AutoLoginUser</pre><pre>/ClientRegistry.Blob</pre><pre>\ClientRegistry.blob</pre><pre>\steam.dll</pre><pre>%SYS%</pre><pre>ÞSKTOP%</pre><pre>FirstExecution</pre><pre>chatmsg|</pre><pre>Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run</pre><pre>listarjanelas|windowsfechar|</pre><pre>listarjanelas|windowsmax|</pre><pre>listarjanelas|windowsmin|</pre><pre>listarjanelas|windowsmostrar|</pre><pre>listarjanelas|windowsocultar|</pre><pre>listarjanelas|windowsmintodas|</pre><pre>listarjanelas|windowscaption|</pre><pre>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall</pre><pre>listarportas|listadeportaspronta|</pre><pre>listarportas|finalizarconexao|</pre><pre>listarportas|finalizarprocessoportas|Y|</pre><pre>listarportas|finalizarprocessoportas|N|</pre><pre>registro|renamekey|</pre><pre>keylogger|keylogger|keyloggerativar|</pre><pre>keylogger|keylogger|keyloggerdesativar|</pre><pre>keylogger|keyloggergetlog|</pre><pre>keylogger|keylogger|keyloggervazio|</pre><pre>keyloggersearch</pre><pre>keyloggersearchok|</pre><pre>webcam|webcaminactive|</pre><pre>webcam|webcamactive|</pre><pre>getpassword</pre><pre>_x_X_PASSWORDLIST_X_x_</pre><pre>NOIP.abc</pre><pre>MSN.abc</pre><pre>FIREFOX.abc</pre><pre>IELOGIN.abc</pre><pre>IEPASS.abc</pre><pre>IEAUTO.abc</pre><pre>IEWEB.abc</pre><pre>SOFTWARE\Mozilla\Mozilla Firefox</pre><pre>getfirefox</pre><pre>getielogin</pre><pre>getiepass</pre><pre>getieweb</pre><pre>getchrome</pre><pre>getpassword|getpasswordlist|</pre><pre>getpassword|getpassworderror|</pre><pre>updateservidorweb</pre><pre>##@@## ##@@## ##@@##</pre><pre>Windows\CurrentVersion\Uninstall\eDonkey2000</pre><pre>UNWISE.EXE</pre><pre>ntdll.dll</pre><pre>icon=shell32.dll,4</pre><pre>shellexecute=</pre><pre>autorun.inf</pre><pre>XX--XX--XX.txt</pre><pre>logs.dat</pre><pre>SQLite3.dll</pre><pre>$1.2.3</pre><pre>deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly</pre><pre>inflate 1.2.3 Copyright 1995-2005 Mark Adler</pre><pre>KWindows</pre><pre>UnitExecutarComandos</pre><pre>uftp</pre><pre>UrlMon</pre><pre>.UnitBytesSize</pre><pre>UnitListarPortasAtivas</pre><pre>UnitWebcam</pre><pre>UnitKeylogger</pre><pre>WinExec</pre><pre>SetNamedPipeHandleState</pre><pre>GetProcessHeap</pre><pre>CreatePipe</pre><pre>RegOpenKeyExA</pre><pre>RegOpenKeyA</pre><pre>RegEnumKeyExA</pre><pre>RegDeleteKeyA</pre><pre>RegCreateKeyA</pre><pre>RegCloseKey</pre><pre>GdiplusShutdown</pre><pre>keybd_event</pre><pre>MapVirtualKeyA</pre><pre>GetKeyboardState</pre><pre>GetKeyboardLayoutNameA</pre><pre>GetKeyState</pre><pre>GetAsyncKeyState</pre><pre>ExitWindowsEx</pre><pre>EnumWindows</pre><pre>FtpGetFileSize</pre><pre>FtpSetCurrentDirectoryA</pre><pre>FtpOpenFileA</pre><pre>%( % & % % % ]</pre><pre>.idata</pre><pre>.reloc</pre><pre>P.rsrc</pre><pre>advapi32.dll</pre><pre>AVICAP32.DLL</pre><pre>gdi32.dll</pre><pre>gdiplus.dll</pre><pre>mpr.dll</pre><pre>msacm32.dll</pre><pre>ole32.dll</pre><pre>oleaut32.dll</pre><pre>powrprof.dll</pre><pre>user32.dll</pre><pre>wininet.dll</pre><pre>winmm.dll</pre><pre>wsock32.dll</pre></pre></pre></pre></pre></pre></pre></pre></pre>

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps