HEUR:Trojan.Win32.Generic (Kaspersky), Gen:Variant.Kazy.71794 (B) (Emsisoft), Gen:Variant.Kazy.71794 (AdAware), Trojan.Win32.IEDummy.FD, WormRebhip.YR, GenericAutorunWorm.YR, GenericInjector.YR (Lavasoft MAS)Behaviour: Trojan, Worm, WormAutorun
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 215b7a5221d2cb6b27170f7e41cd7eaa
SHA1: 6dff97082a23665a2fd645518abd3d9b00c3f732
SHA256: 42f6315507386b0a9b10970bb10ce3db4aee7297065dc5721f7d56419c71bbfa
SSDeep: 12288:XAtBCmozLDv/37rnHb7H/nPjvzDjn/zN3W8Vds2/3LHcC46zwlgY6QjRdYHuqjGM:wtkhm8Vdv3LHcCW6Q9dbyGM
Size: 765952 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6
Company: ClientConnect
Created at: 2013-04-23 03:51:54
Analyzed on: WindowsXP SP3 32-bit
Summary: Worm. A program that is primarily replicating on networks or removable drives.
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer. |
Process activity
The Worm creates the following process(es):
%original file name%.exe:1468
%original file name%.exe:688
The Worm injects its code into the following process(es):
javaw.exe:2140
iexplore.exe:400
Explorer.EXE:512
File activity
The process javaw.exe:2140 makes changes in the file system.
The Worm creates and/or writes to the following file(s):
%System%\d3d9caps.tmp (1324 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\imageio470458140073804775.tmp (1916 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\imageio3264313033012084545.tmp (24451 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\imageio782014916185674667.tmp (668 bytes)
The Worm deletes the following file(s):
%System%\d3d9caps.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\imageio470458140073804775.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\imageio3264313033012084545.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\imageio782014916185674667.tmp (0 bytes)
The process iexplore.exe:400 makes changes in the file system.
The Worm creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\XxX.xXx (14736 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UuU.uUu (32 bytes)
%Documents and Settings%\%current user%\Application Data\logs.dat (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Minecraft.exe (263 bytes)
The Worm deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\UuU.uUu (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XxX.xXx (0 bytes)
C:\%original file name%.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XX--XX--XX.txt (0 bytes)
The process %original file name%.exe:688 makes changes in the file system.
The Worm creates and/or writes to the following file(s):
C:\dir\install\install\svchost.exe (5441 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XX--XX--XX.txt (1779 bytes)
Registry activity
The process javaw.exe:2140 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "42 2A 24 C2 A8 D2 9F 3A AC 9F 0E EE A3 81 F7 B5"
[HKCU\Software\Microsoft\Direct3D\MostRecentApplication]
"Name" = "javaw.exe"
The process iexplore.exe:400 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "55 D0 B4 E0 C0 C2 31 EC 85 15 37 BE BE 67 BA 21"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Svchost]
"FirstExecution" = "15/04/2014 -- 12:18"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\c:\dir\install\install]
"svchost.exe" = ""
[HKCU\Software\Svchost]
"NewIdentification" = "svchost"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"Minecraft.exe" = "Minecraft"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Worm modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The process %original file name%.exe:1468 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C4 66 65 FB 74 08 CD 59 52 C6 1A E1 7E 19 2D FB"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
The process %original file name%.exe:688 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5D 15 50 D1 AE 07 A1 34 CF C5 09 B9 3B 00 9B 72"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"Policies" = "c:\dir\install\install\svchost.exe"
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{UY285VD8-78JA-6872-1S5I-22F13P83B613}]
"StubPath" = "c:\dir\install\install\svchost.exe Restart"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
"Policies" = "c:\dir\install\install\svchost.exe"
To automatically run itself each time Windows is booted, the Worm adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"HKCU" = "c:\dir\install\install\svchost.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HKLM" = "c:\dir\install\install\svchost.exe"
Dropped PE files
MD5 | File path |
---|---|
b63ccb43f2779cbea5d8d3ce2e3d90fb | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Minecraft.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer.
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1468
%original file name%.exe:688 - Delete the original Worm file.
- Delete or disinfect the following files created/modified by the Worm:
%System%\d3d9caps.tmp (1324 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\imageio470458140073804775.tmp (1916 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\imageio3264313033012084545.tmp (24451 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\imageio782014916185674667.tmp (668 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XxX.xXx (14736 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UuU.uUu (32 bytes)
%Documents and Settings%\%current user%\Application Data\logs.dat (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Minecraft.exe (263 bytes)
C:\dir\install\install\svchost.exe (5441 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XX--XX--XX.txt (1779 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"HKCU" = "c:\dir\install\install\svchost.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HKLM" = "c:\dir\install\install\svchost.exe" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.
Static Analysis
VersionInfo
Company Name:
Product Name:
Product Version: 0.0.0.0
Legal Copyright:
Legal Trademarks:
Original Filename: v5pcnzhz.exe
Internal Name: v5pcnzhz.exe
File Version: 0.0.0.0
File Description:
Comments:
Language: English (United States)
Company Name: Product Name: Product Version: 0.0.0.0Legal Copyright: Legal Trademarks: Original Filename: v5pcnzhz.exeInternal Name: v5pcnzhz.exeFile Version: 0.0.0.0File Description: Comments: Language: English (United States)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 8192 | 587796 | 589824 | 5.41558 | 049dd0f88f209a0f1be75c32adb929d1 |
.sdata | 598016 | 98 | 4096 | 0.16598 | 4ecd81e4bd1b2439723a73ab73506858 |
.rsrc | 606208 | 163008 | 163840 | 3.37897 | 613658a2e26324944766127392672438 |
.reloc | 770048 | 12 | 4096 | 0.011035 | 55502ac084061dea639f99a209602cbd |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://mcupdate.tumblr.com/ | 66.6.40.43 |
hxxp://d2glp9604qyu8g.cloudfront.net/fonts/gibson/stylesheet.css?v=3 | |
hxxp://d2pi0bc9ewx28h.cloudfront.net/qfn3sex/ezom7y7iq/bg_main.png | |
hxxp://s3-1.amazonaws.com/cobalt/cobalt_logo_150.PNG | |
hxxp://s3-1.amazonaws.com/scrolls/scrolls_logo_150.png | |
hxxp://www.tumblr.com/impixu?T=1397570854&J=eyJ0eXBlIjoidXJsIiwidXJsIjoiaHR0cDpcL1wvbWN1cGRhdGUudHVtYmxyLmNvbVwvIiwicmVxdHlwZSI6MCwicm91dGUiOiJcLyIsIm5vc2NyaXB0IjoxfQ==&U=KFGLMIBGLN&K=23ca2edfb61a152ff24872503928cf944c494034f39c8e5d8fa92a2d0271536f&R= | 66.6.44.20 |
hxxp://www.tumblr.com/impixu?T=1397570854&J=eyJ0eXBlIjoicG9zdCIsInVybCI6Imh0dHA6XC9cL21jdXBkYXRlLnR1bWJsci5jb21cLyIsInJlcXR5cGUiOjAsInJvdXRlIjoiXC8iLCJwb3N0cyI6W3sicG9zdGlkIjoiODIyMDM5MTM5MjciLCJibG9naWQiOiIxMjQ2MTk0OSIsInNvdXJjZSI6MzN9LHsicG9zdGlkIjoiODIxODQyMjgxOTAiLCJibG9naWQiOiIxMjQ2MTk0OSIsInNvdXJjZSI6MzN9LHsicG9zdGlkIjoiODA3ODI2NTU1MTYiLCJibG9naWQiOiIxMjQ2MTk0OSIsInNvdXJjZSI6MzN9LHsicG9zdGlkIjoiNzc4OTU4MzEwMjciLCJibG9naWQiOiIxMjQ2MTk0OSIsInNvdXJjZSI6MzN9LHsicG9zdGlkIjoiNjk1NzkzOTUxNzgiLCJibG9naWQiOiIxMjQ2MTk0OSIsInNvdXJjZSI6MzN9LHsicG9zdGlkIjoiNjkwNjUwNTM4MjEiLCJibG9naWQiOiIxMjQ2MTk0OSIsInNvdXJjZSI6MzN9LHsicG9zdGlkIjoiNjUwNDA4MzIyNTgiLCJibG9naWQiOiIxMjQ2MTk0OSIsInNvdXJjZSI6MzN9LHsicG9zdGlkIjoiNjIwNDY4MTQ5NjciLCJibG9naWQiOiIxMjQ2MTk0OSIsInNvdXJjZSI6MzN9LHsicG9zdGlkIjoiNTQ5MDU2MzkyMTciLCJibG9naWQiOiIxMjQ2MTk0OSIsInNvdXJjZSI6MzN9LHsicG9zdGlkIjoiNTQzMzcxNDk0MDQiLCJibG9naWQiOiIxMjQ2MTk0OSIsInNvdXJjZSI6MzN9XSwibm9zY3JpcHQiOjF9&U=NDGKAKDEAD&K=fbea40ed86e022118c6b773ed681e484a8563d25350193e24b22b4b95bfb7676&R= | |
pixel.quantserve.com | 64.94.107.49 |
assets.tumblr.com | 54.230.38.160 |
assets.mojang.com | 176.32.102.82 |
static.tumblr.com | 204.246.169.231 |
eusouzikamlk.no-ip.org | 177.45.103.97 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /qfn3sex/ezom7y7iq/bg_main.png HTTP/1.1
User-Agent: Java/1.6.0_18
Host: static.tumblr.com
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: keep-alive
HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 434
Connection: keep-alive
Date: Sun, 13 Apr 2014 06:49:05 GMT
Last-Modified: Mon, 30 Jul 2012 00:47:15 GMT
ETag: "f1596e0654794b9a0dd94fa78ddd7d17"
Accept-Ranges: bytes
Server: AmazonS3
Age: 25912
X-Cache: Hit from cloudfront
Via: 1.1 8cc88d3be451c0b934da599fbb325005.cloudfront.net (CloudFront)
X-Amz-Cf-Id: -L9PsFoC61g_Ud0a2tG-ts9-KGDdtVwoP9I_anzoJj4IN6dgbdGM2A==
.PNG........IHDR...0...0......`n.....tEXtSoftware.Adobe ImageReadyq.e<...TIDATx......0.D...?.......Ph....L....S0Q.>f..m.yn^q.GS....".t.Z.%/.q..}. ..hn...AI...^.|...,.....a`52...mW.......!/.u.:.R..%Ze....XA..$?.C.2..dlh..'.9..@wJ.3........l. V".5.\.....X..jEAx.K.EwV..,..h.=S.U. .*........2.... ..2tcdA..[,%..J....../.4.b..4q...@l.FV.v..b..........]e .L..3L..V..G.1...O...r..sH.c.2.8q}...J....F.O?.?D..\X../...J..`.#S..../.....IEND.B`...
GET /fonts/gibson/stylesheet.css?v=3 HTTP/1.1
User-Agent: Java/1.6.0_18
Host: assets.tumblr.com
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: keep-alive
HTTP/1.1 200 OK
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Date: Sun, 13 Apr 2014 06:49:02 GMT
Last-Modified: Thu, 13 Mar 2014 18:55:53 GMT
Expires: Wed, 23 Apr 2014 12:56:02 GMT
Cache-Control: max-age=2592000
X-Varnish: 383501742 375131323
Access-Control-Allow-Origin: hXXp://VVV.tumblr.com
Vary: Accept-Encoding
Age: 1905101
X-Cache: Hit from cloudfront
Via: 1.1 b211469d843c22c59dc668f60ed60542.cloudfront.net (CloudFront)
X-Amz-Cf-Id: v1cvr5FPHVL0cXwJIStMlH79s0d1hea6W1JXGiyuuGYpfAuE36GYzA==
97e../*. * Web Fonts from fontspring.com. *. * All OpenType features and all extended glyphs have been removed.. * Fully installable fonts can be purchased at hXXp://VVV.fontspring.com. *. * The fonts included in this stylesheet are subject to the End User License you purchased. * from Fontspring. The fonts are protected under domestic and international trademark and . * copyright law. You are prohibited from modifying, reverse engineering, duplicating, or. * distributing this font software.. *. * (c) 2010-2013 Fontspring. *. *. *. *. * The fonts included are copyrighted by the vendor listed below.. *. * Vendor: Canada Type. * License URL: hXXp://VVV.fontspring.com/fflicense/canada-type. *. *. */..@font-face {. font-family: 'Gibson';. src: url('Gibson-Regular-webfont.eot?3');. src: url('Gibson-Regular-webfont.eot?3?#iefix') format('embedded-opentype'),. url('Gibson-Regular-webfont.woff?3') format('woff'),. url('Gibson-Regular-webfont.ttf?3') format('truetype'),. url('Gibson-Regular-webfont.svg?3#GibsonRegular') format('svg');. font-weight: normal;. font-style: normal;..}..@font-face {. font-family: 'Gibson';. src: url('Gibson-SemiBold-webfont.eot?3');. src: url('Gibson-SemiBold-webfont.eot?3?#iefix') format('embedded-opentype'),. url('Gibson-SemiBold-webfont.woff?3') format('woff'),. url('Gibson-SemiBold-webfont.ttf?3') format('truetype'),. url('Gibson-SemiBold-webfont.svg?3#GibsonLightBold') format('svg');. font-weight: bold;. f
<<
<<< skipped >>>
GET /impixu?T=1397570854&J=eyJ0eXBlIjoidXJsIiwidXJsIjoiaHR0cDpcL1wvbWN1cGRhdGUudHVtYmxyLmNvbVwvIiwicmVxdHlwZSI6MCwicm91dGUiOiJcLyIsIm5vc2NyaXB0IjoxfQ==&U=KFGLMIBGLN&K=23ca2edfb61a152ff24872503928cf944c494034f39c8e5d8fa92a2d0271536f&R= HTTP/1.1
User-Agent: Java/1.6.0_18
Host: VVV.tumblr.com
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: keep-alive
HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 95
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
P3P: CP="ALL ADM DEV PSAi COM OUR OTRo STP IND ONL"
Set-Cookie: anon_id=GCLWQLTNXKRXVOXRYCBEGUHTJZFVLFHW; Max-Age=7862400; Path=/
Connection: close
.PNG........IHDR.............%.V.....PLTE....z=.....tRNS.@..f....IDAT..c`.......!.3....IEND.B`...
GET /pixel/'p-19UtqE8ngoZbM'.gif HTTP/1.1
User-Agent: Java/1.6.0_18
Host: pixel.quantserve.com
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: keep-alive
HTTP/1.1 200 OK
Connection: close
Content-Type: image/gif
Set-Cookie: mc=534d3d33-58199-f678a-3080f; expires=Thu, 15-Oct-2015 14:07:47 GMT; path=/; domain=.quantserve.com
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
Cache-Control: private, no-cache, no-store, proxy-revalidate
Pragma: no-cache
Expires: Fri, 04 Aug 1978 12:00:00 GMT
Content-Length: 35
Date: Tue, 15 Apr 2014 14:07:47 GMT
Server: QS
GIF89a.......,.................D..;..
GET /cobalt/cobalt_logo_150.PNG HTTP/1.1
User-Agent: Java/1.6.0_18
Host: assets.mojang.com
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: keep-alive
HTTP/1.1 200 OK
x-amz-id-2: 2r2fIq0z069kdV8re KkohEtaujPelp8FUSbx2xbdqIvHo1VxowCmQEeUUEPEWh3
x-amz-request-id: 843804C6D5C59318
Date: Tue, 15 Apr 2014 14:07:47 GMT
x-amz-meta-cb-modifiedtime: Tue, 11 Mar 2014 19:59:42 GMT
Last-Modified: Tue, 11 Mar 2014 20:44:37 GMT
ETag: "97a52f46c2e0669b3bc48347e059c1c4"
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 14706
Server: AmazonS3
.PNG........IHDR.......3.....u.......pHYs................OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE...........Q,......!.........{.k........>...........H3Q5...B..........@..$p....d!s.#...~<< ".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I. .6a.a.@..y..2.4..............x.....6..._-...."bb.....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<......$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?....D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/.@.4.Qh..p...U..=p..a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9., .......3...!.[..b@q..S.(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._... .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).)..4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC].@C.a.a......<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<
<<< skipped >>>
GET / HTTP/1.1
User-Agent: Java/1.6.0_18
Host: mcupdate.tumblr.com
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: keep-alive
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
P3P: CP="ALL ADM DEV PSAi COM OUR OTRo STP IND ONL"
X-Tumblr-User: mcupdate
X-Tumblr-Pixel-0: hXXp://VVV.tumblr.com/impixu?T=1397570854&J=eyJ0eXBlIjoidXJsIiwidXJsIjoiaHR0cDpcL1wvbWN1cGRhdGUudHVtYmxyLmNvbVwvIiwicmVxdHlwZSI6MCwicm91dGUiOiJcLyJ9&U=OGDHPCDJEI&K=342e13e15b6bf593df503a3270f8babe26865824fcd14283ce3df7cdd0eb809e--hXXp://VVV.tumblr.com/impixu?T=1397570854&J=eyJ0eXBlIjoicG9zdCIsInVybCI6Imh0dHA6XC9cL21jdXBkYXRlLnR1bWJsci5jb21cLyIsInJlcXR5cGUiOjAsInJvdXRlIjoiXC8iLCJwb3N0cyI6W3sicG9zdGlkIjoiODIyMDM5MTM5MjciLCJibG9naWQiOiIxMjQ2MTk0OSIsInNvdXJjZSI6MzN9LHsicG9zdGlkIjoiODIxODQy
X-Tumblr-Pixel-1: MjgxOTAiLCJibG9naWQiOiIxMjQ2MTk0OSIsInNvdXJjZSI6MzN9LHsicG9zdGlkIjoiODA3ODI2NTU1MTYiLCJibG9naWQiOiIxMjQ2MTk0OSIsInNvdXJjZSI6MzN9LHsicG9zdGlkIjoiNzc4OTU4MzEwMjciLCJibG9naWQiOiIxMjQ2MTk0OSIsInNvdXJjZSI6MzN9LHsicG9zdGlkIjoiNjk1NzkzOTUxNzgiLCJibG9naWQiOiIxMjQ2MTk0OSIsInNvdXJjZSI6MzN9LHsicG9zdGlkIjoiNjkwNjUwNTM4MjEiLCJibG9naWQiOiIxMjQ2MTk0OSIsInNvdXJjZSI6MzN9LHsicG9zdGlkIjoiNjUwNDA4MzIyNTgiLCJibG9naWQiOiIxMjQ2MTk0OSIsInNvdXJjZSI6MzN9LHsicG9zdGlkIjoiNjIwNDY4MTQ5NjciLCJibG9naWQiOiIxMjQ2MTk0OS
X-Tumblr-Pixel-2: IsInNvdXJjZSI6MzN9LHsicG9zdGlkIjoiNTQ5MDU2MzkyMTciLCJibG9naWQiOiIxMjQ2MTk0OSIsInNvdXJjZSI6MzN9LHsicG9zdGlkIjoiNTQzMzcxNDk0MDQiLCJibG9naWQiOiIxMjQ2MTk0OSIsInNvdXJjZSI6MzN9XX0=&U=MKMFKEHPME&K=c06e00efb6d583aa441a98ec976b8f6f4f14b6e67f063d6166b07376e06ebca4
X-Tumblr-Pixel: 3
Link: <hXXp://assets.tumblr.com/images/default_avatar_128.png>; rel=icon
X-UA-Compatible: IE=Edge,chrome=1
X-UA-Device: desktop
Vary: X-UA-Device
Transfer-Encoding: chunked
Date: Tue, 15 Apr 2014 14:07:44 GMT
Connection: close
007ef1..<!DOCTYPE html>.<script>var __pbpa = true;</script><script>var translated_warning_string = 'Warning: Never enter your Tumblr password unless \u201chXXps://VVV.tumblr.com/login\u201d\x0ais the address in your web browser.\x0a\x0aYou should also see a green \u201cTumblr, Inc.\u201d identification in the address bar.\x0a\x0aSpammers and other bad guys use fake forms to steal passwords.\x0a\x0aTumblr will never ask you to log in from a user\u2019s blog.\x0a\x0aAre you absolutely sure you want to continue?';</script><script type="text/javascript" language="javascript" src="hXXp://assets.tumblr.com/assets/scripts/pre_tumblelog.js?_v=c9a24c93905a6db0265be4f39f27f15e"></script>.<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><!--. Photo Minimal. A Tumblr theme by William Rainbird - http://william.rainbird.me.. Tweaked for the Minecraft Launcher by Mojang.--><html xmlns="hXXp://VVV.w3.org/1999/xhtml" xml:lang="en" lang="en">.<head prefix="og: hXXp://ogp.me/ns# fb: hXXp://ogp.me/ns/fb# blog: hXXp://ogp.me/ns/blog#">. <meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>. <title>Minecraft Update News</title>. .<style type="text/css">.body {. font-family: sans-serif;. background-color: #222222;. background-image: url('hXXp://static.tumblr.com/qfn3sex/ezom7y7iq/bg_main.png');. color: #e0d0d0;..}.a {. color: #aaaaff;.}.
<<
<<< skipped >>>
GET /impixu?T=1397570854&J=eyJ0eXBlIjoicG9zdCIsInVybCI6Imh0dHA6XC9cL21jdXBkYXRlLnR1bWJsci5jb21cLyIsInJlcXR5cGUiOjAsInJvdXRlIjoiXC8iLCJwb3N0cyI6W3sicG9zdGlkIjoiODIyMDM5MTM5MjciLCJibG9naWQiOiIxMjQ2MTk0OSIsInNvdXJjZSI6MzN9LHsicG9zdGlkIjoiODIxODQyMjgxOTAiLCJibG9naWQiOiIxMjQ2MTk0OSIsInNvdXJjZSI6MzN9LHsicG9zdGlkIjoiODA3ODI2NTU1MTYiLCJibG9naWQiOiIxMjQ2MTk0OSIsInNvdXJjZSI6MzN9LHsicG9zdGlkIjoiNzc4OTU4MzEwMjciLCJibG9naWQiOiIxMjQ2MTk0OSIsInNvdXJjZSI6MzN9LHsicG9zdGlkIjoiNjk1NzkzOTUxNzgiLCJibG9naWQiOiIxMjQ2MTk0OSIsInNvdXJjZSI6MzN9LHsicG9zdGlkIjoiNjkwNjUwNTM4MjEiLCJibG9naWQiOiIxMjQ2MTk0OSIsInNvdXJjZSI6MzN9LHsicG9zdGlkIjoiNjUwNDA4MzIyNTgiLCJibG9naWQiOiIxMjQ2MTk0OSIsInNvdXJjZSI6MzN9LHsicG9zdGlkIjoiNjIwNDY4MTQ5NjciLCJibG9naWQiOiIxMjQ2MTk0OSIsInNvdXJjZSI6MzN9LHsicG9zdGlkIjoiNTQ5MDU2MzkyMTciLCJibG9naWQiOiIxMjQ2MTk0OSIsInNvdXJjZSI6MzN9LHsicG9zdGlkIjoiNTQzMzcxNDk0MDQiLCJibG9naWQiOiIxMjQ2MTk0OSIsInNvdXJjZSI6MzN9XSwibm9zY3JpcHQiOjF9&U=NDGKAKDEAD&K=fbea40ed86e022118c6b773ed681e484a8563d25350193e24b22b4b95bfb7676&R= HTTP/1.1
User-Agent: Java/1.6.0_18
Host: VVV.tumblr.com
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: keep-alive
HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 95
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
P3P: CP="ALL ADM DEV PSAi COM OUR OTRo STP IND ONL"
Set-Cookie: anon_id=VJELKZSIMXBFOTADMYSJSQRGHCBZOLNV; Max-Age=7862400; Path=/
Connection: close
.PNG........IHDR.............%.V.....PLTE....z=.....tRNS.@..f....IDAT..c`.......!.3....IEND.B`...
GET /scrolls/scrolls_logo_150.png HTTP/1.1
User-Agent: Java/1.6.0_18
Host: assets.mojang.com
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: keep-alive
HTTP/1.1 200 OK
x-amz-id-2: tb11W3cx1SSfIsEUPbdW Ln90wz5EyTNKtbAxW99EhlhEDA/D/YjHCae7im0iRQX
x-amz-request-id: 1DE7A1B0633EB059
Date: Tue, 15 Apr 2014 14:07:47 GMT
x-amz-meta-cb-modifiedtime: Fri, 15 Nov 2013 09:16:58 GMT
Last-Modified: Fri, 07 Mar 2014 10:52:46 GMT
ETag: "be802fcce5b09a6f246badaf3b20c754"
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 15557
Server: AmazonS3
.PNG........IHDR.......3.....u.......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:7BCAE45A4DD611E38B5DB11D1B767DEF" xmpMM:DocumentID="xmp.did:7BCAE45B4DD611E38B5DB11D1B767DEF"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7BCAE4584DD611E38B5DB11D1B767DEF" stRef:documentID="xmp.did:7BCAE4594DD611E38B5DB11D1B767DEF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>6T....99IDATx..}.x....;m.j...w..$...{.`c.......@...P.\J @...'tB......w.V.z..wgg......n.ss....c..-ig......w.....8~.?..........C.w....>.C......PG.*.....`3sHO...".Y....".X.....{S.x...I.'.dT...N%..9.X..I.dY......n.<C..k.=....z........j..7.x`.o..~.!.o...?...T.Aqj:F.!U.|....B.W~!.....g%...c_l.)MH(.).CTT...xZr.5[.x....q...kR..S.M...Ua...................a6...{...YcD.....Q.rum.8~{#.....!@Q......ty..ojp] D.C...Y..&.....)M;...B..:.y....}....r].k..M.EW..*.L.X.lc.....$I.K.....e.8.<}..lW....m......L..i"&U.Q..#7KDF...../... .c.X.f].N..Y. .T.Z/..ot\c......'?t...m..e=N..#.....?6-....|4.{...r.8..79..
<<
<<< skipped >>>
Map
Strings from Dumps
iexplore.exe_400:
%?9-*09,*19}*09
%?9-*09,*19}*09
.text
.text
`.data
`.data
.rsrc
.rsrc
msvcrt.dll
msvcrt.dll
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
USER32.dll
USER32.dll
SHLWAPI.dll
SHLWAPI.dll
SHDOCVW.dll
SHDOCVW.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
IE-X-X
IE-X-X
rsabase.dll
rsabase.dll
System\CurrentControlSet\Control\Windows
System\CurrentControlSet\Control\Windows
dw15 -x -s %u
dw15 -x -s %u
watson.microsoft.com
watson.microsoft.com
IEWatsonURL
IEWatsonURL
%s -h %u
%s -h %u
iedw.exe
iedw.exe
Iexplore.XPExceptionFilter
Iexplore.XPExceptionFilter
jscript.DLL
jscript.DLL
mshtml.dll
mshtml.dll
mlang.dll
mlang.dll
urlmon.dll
urlmon.dll
wininet.dll
wininet.dll
shdocvw.DLL
shdocvw.DLL
browseui.DLL
browseui.DLL
comctl32.DLL
comctl32.DLL
IEXPLORE.EXE
IEXPLORE.EXE
iexplore.pdb
iexplore.pdb
ADVAPI32.dll
ADVAPI32.dll
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
IExplorer.EXE
IExplorer.EXE
IIIIIB(II<.Fg
IIIIIB(II<.Fg
7?_____ZZSSH%
7?_____ZZSSH%
)z.UUUUUUUU
)z.UUUUUUUU
,....Qym
,....Qym
````2```
````2```
{.QLQIIIKGKGKGKGKGKG
{.QLQIIIKGKGKGKGKGKG
;33;33;0
;33;33;0
8888880
8888880
8887080
8887080
browseui.dll
browseui.dll
shdocvw.dll
shdocvw.dll
6.00.2900.5512 (xpsp.080413-2105)
6.00.2900.5512 (xpsp.080413-2105)
Windows
Windows
Operating System
Operating System
6.00.2900.5512
6.00.2900.5512
iexplore.exe_400_rwx_00150000_00001000:
KERNEL32.DLL
KERNEL32.DLL
iexplore.exe_400_rwx_00290000_00001000:
KERNEL32.DLL
KERNEL32.DLL
javaw.exe_2140:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
/Xusage.txt
/Xusage.txt
-Djava.class.path=%s
-Djava.class.path=%s
Unable to locate JRE meeting specification "%s"
Unable to locate JRE meeting specification "%s"
1.6.0_18-b07
1.6.0_18-b07
JRE-Version = %s, JRE-Restrict-Search = %s Selected = %s
JRE-Version = %s, JRE-Restrict-Search = %s Selected = %s
Syntax error in version specification "%s"
Syntax error in version specification "%s"
Invalid or corrupt jarfile %s
Invalid or corrupt jarfile %s
Unable to access jarfile %s
Unable to access jarfile %s
-Djava.awt.headless=
-Djava.awt.headless=
-Djava.awt.headless=true
-Djava.awt.headless=true
option[-] = '%s'
option[-] = '%s'
ignoreUnrecognized is %s,
ignoreUnrecognized is %s,
sun.jnu.encoding
sun.jnu.encoding
isSupported
isSupported
-Dsun.java.command=
-Dsun.java.command=
-Dsun.java.launcher=SUN_STANDARD
-Dsun.java.launcher=SUN_STANDARD
A %c separated list of directories, JAR archives,
A %c separated list of directories, JAR archives,
load Java programming language agent, see java.lang.instrument
load Java programming language agent, see java.lang.instrument
The default VM is %s%s
The default VM is %s%s
is a synonym for the "%s" VM [deprecated]
is a synonym for the "%s" VM [deprecated]
to select the "%s" VM
to select the "%s" VM
Usage: %s [-options] class [args...]
Usage: %s [-options] class [args...]
(to execute a class)
(to execute a class)
or %s [-options] -jar jarfile [args...]
or %s [-options] -jar jarfile [args...]
(to execute a jar file)
(to execute a jar file)
Can't open %s
Can't open %s
Could not find the main class: %s. Program will exit.
Could not find the main class: %s. Program will exit.
Failed to load Main Class: %s
Failed to load Main Class: %s
Could not find the main class: %s. Program will exit.
Could not find the main class: %s. Program will exit.
argv[-] = '%s'
argv[-] = '%s'
Apps' argc is %d
Apps' argc is %d
Main-Class is '%s'
Main-Class is '%s'
Warning: %s VM not supported; %s VM will be used
Warning: %s VM not supported; %s VM will be used
Error: %s VM not supported
Error: %s VM not supported
Error: Unable to resolve VM alias %s
Error: Unable to resolve VM alias %s
Error: Corrupt jvm.cfg file; cycle in alias list.
Error: Corrupt jvm.cfg file; cycle in alias list.
Default VM: %s
Default VM: %s
%s requires class path specification
%s requires class path specification
%s full version "%s"
%s full version "%s"
Warning: %s option is no longer supported.
Warning: %s option is no longer supported.
-Xrunhprof:cpu=old,file=java.prof
-Xrunhprof:cpu=old,file=java.prof
-Xrunhprof:cpu=old,file=%s
-Xrunhprof:cpu=old,file=%s
%ld micro seconds to parse jvm.cfg
%ld micro seconds to parse jvm.cfg
name: %s vmType: %s alias: %s
name: %s vmType: %s alias: %s
name: %s vmType: %s server_class: %s
name: %s vmType: %s server_class: %s
jvm.cfg[%d] = ->%s<-><pre>Warning: unknown VM type on line %d of `%s'</pre><pre>Warning: missing server class VM on line %d of `%s'</pre><pre>Warning: missing VM alias on line %d of `%s'</pre><pre>Warning: missing VM type on line %d of `%s'</pre><pre>Warning: no leading - on line %d of `%s'</pre><pre>Error: could not open `%s'</pre><pre>\jvm.cfg</pre><pre>\bin\splashscreen.dll</pre><pre>%s\jvm.dll</pre><pre>%s\bin\%s\jvm.dll</pre><pre>Version major.minor.micro = %s.%s</pre><pre>Failed reading value of registry key:</pre><pre>Software\JavaSoft\Java Runtime Environment\%s\JavaHome</pre><pre>Error opening registry key 'Software\JavaSoft\Java Runtime Environment\%s'</pre><pre>Registry key 'Software\JavaSoft\Java Runtime Environment\CurrentVersion'</pre><pre>has value '%s', but '1.6' is required.</pre><pre>Error opening registry key 'Software\JavaSoft\Java Runtime Environment'</pre><pre>-Dsun.java2d.opengl</pre><pre>-Dsun.java2d.d3d</pre><pre>-Dsun.java2d.noddraw</pre><pre>-Dsun.awt.warmup</pre><pre>Unable to resolve path to current %s executable: %s</pre><pre>CreateProcess(%s, ...) failed: %s</pre><pre>ReExec Args: %s</pre><pre>ReExec Command: %s (%s)</pre><pre>ExecJRE: new: %s</pre><pre>ExecJRE: old: %s</pre><pre>Error: could not find java.dll</pre><pre>JRE path is %s</pre><pre>%s\jre\bin\java.dll</pre><pre>%s\bin\java.dll</pre><pre>Error loading: %s</pre><pre>CRT path is %s</pre><pre>\bin\msvcr71.dll</pre><pre>EnsureJreInstallation:%s:load failed</pre><pre>\bin\jkernel.dll</pre><pre>EnsureJreInstallation:<%s>:not found</pre><pre>EnsureJreInstallation:unsupported platform</pre><pre>Error: can't find JNI interfaces in: %s</pre><pre>JVM path is %s</pre><pre>\bin\awt.dll</pre><pre>\bin\java.dll</pre><pre>\bin\verify.dll</pre><pre>Error: no `%s' JVM at `%s'.</pre><pre>Error: no known VMs. (check for corrupt jvm.cfg file)</pre><pre>before: "%s"</pre><pre>after : "%s"</pre><pre>META-INF/MANIFEST.MF</pre><pre>1.1.3</pre><pre>inflate 1.1.3 Copyright 1995-1998 Mark Adler</pre><pre>mscoree.dll</pre><pre>Broken pipe</pre><pre>Inappropriate I/O control operation</pre><pre>Operation not permitted</pre><pre>kernel32.dll</pre><pre>- This application cannot run using the active version of the Microsoft .NET Runtime</pre><pre>Please contact the application's support team for more information.</pre><pre>GetProcessWindowStation</pre><pre>user32.dll</pre><pre>internal state. The program cannot safely continue execution and must</pre><pre>continue execution and must now be terminated.</pre><pre>C:\BUILD_~1\jdk6_18\control\build\WINDOW~1\tmp\java\javaw\obj\javaw.pdb</pre><pre>RegCloseKey</pre><pre>RegOpenKeyExA</pre><pre>RegEnumKeyA</pre><pre>ADVAPI32.dll</pre><pre>USER32.dll</pre><pre>GetCPInfo</pre><pre>KERNEL32.dll</pre><pre>%Program Files%\Java\jre6\bin\javaw.exe</pre><pre><assemblyIdentity version="6.0.180.7"><pre>name="javaw.exe"</pre><pre>name="Microsoft.Windows.Common-Controls"</pre><pre>version="6.0.0.0"</pre><pre>publicKeyToken="6595b64144ccf1df"</pre><pre><requestedExecutionLevel><pre>3333333333330</pre><pre>333333333307</pre><pre>PP%d(jjjjj</pre><pre>6.0.180.7</pre><pre>javaw.exe</pre><b>iexplore.exe_400_rwx_002D0000_00001000:</b><pre>KERNEL32.DLL</pre><b>iexplore.exe_400_rwx_00310000_00001000:</b><pre>KERNEL32.DLL</pre><b>iexplore.exe_400_rwx_00350000_00001000:</b><pre>KERNEL32.DLL</pre><b>iexplore.exe_400_rwx_00390000_00001000:</b><pre>KERNEL32.DLL</pre><b>iexplore.exe_400_rwx_00C40000_00001000:</b><pre>advapi32.dll</pre><b>iexplore.exe_400_rwx_00D70000_00001000:</b><pre>RegOpenKeyA</pre><b>iexplore.exe_400_rwx_00D80000_00001000:</b><pre>advapi32.dll</pre><b>iexplore.exe_400_rwx_00DB0000_00001000:</b><pre>AVICAP32.DLL</pre><b>iexplore.exe_400_rwx_00EF0000_00001000:</b><pre>AVICAP32.DLL</pre><b>iexplore.exe_400_rwx_00F20000_00001000:</b><pre>gdi32.dll</pre><b>iexplore.exe_400_rwx_00F60000_00001000:</b><pre>gdi32.dll</pre><b>iexplore.exe_400_rwx_00F90000_00001000:</b><pre>gdiplus.dll</pre><b>iexplore.exe_400_rwx_00FD0000_00001000:</b><pre>gdiplus.dll</pre><b>iexplore.exe_400_rwx_01010000_00001000:</b><pre>mpr.dll</pre><b>iexplore.exe_400_rwx_01060000_00001000:</b><pre>mpr.dll</pre><b>iexplore.exe_400_rwx_01090000_00001000:</b><pre>msacm32.dll</pre><b>iexplore.exe_400_rwx_014E0000_00001000:</b><pre>msacm32.dll</pre><b>iexplore.exe_400_rwx_01510000_00001000:</b><pre>ntdll.dll</pre><b>iexplore.exe_400_rwx_01650000_00001000:</b><pre>ntdll.dll</pre><b>iexplore.exe_400_rwx_01680000_00001000:</b><pre>ole32.dll</pre><b>iexplore.exe_400_rwx_017C0000_00001000:</b><pre>ole32.dll</pre><b>iexplore.exe_400_rwx_017F0000_00001000:</b><pre>oleaut32.dll</pre><b>iexplore.exe_400_rwx_01830000_00001000:</b><pre>oleaut32.dll</pre><b>iexplore.exe_400_rwx_01970000_00001000:</b><pre>powrprof.dll</pre><b>iexplore.exe_400_rwx_01AB0000_00001000:</b><pre>powrprof.dll</pre><b>iexplore.exe_400_rwx_01AE0000_00001000:</b><pre>shell32.dll</pre><b>iexplore.exe_400_rwx_01C20000_00001000:</b><pre>shell32.dll</pre><b>iexplore.exe_400_rwx_01C50000_00001000:</b><pre>user32.dll</pre><b>iexplore.exe_400_rwx_01D90000_00001000:</b><pre>user32.dll</pre><b>iexplore.exe_400_rwx_01DC0000_00001000:</b><pre>wininet.dll</pre><b>iexplore.exe_400_rwx_01EF0000_00001000:</b><pre>FtpOpenFileA</pre><b>iexplore.exe_400_rwx_01F00000_00001000:</b><pre>wininet.dll</pre><b>iexplore.exe_400_rwx_01F30000_00001000:</b><pre>winmm.dll</pre><b>iexplore.exe_400_rwx_02070000_00001000:</b><pre>winmm.dll</pre><b>iexplore.exe_400_rwx_020A0000_00001000:</b><pre>wsock32.dll</pre><b>iexplore.exe_400_rwx_021E0000_00001000:</b><pre>wsock32.dll</pre><b>iexplore.exe_400_rwx_24080000_00062000:</b><pre>`.rsrc</pre><pre>/w)f%u/</pre><pre>kernel32.dll</pre><pre>Portions Copyright (c) 1999,2003 Avenger by NhT</pre><pre>SHFileOperationA</pre><pre>shell32.dll</pre><pre>URLDownloadToFileA</pre><pre>urlmon.dll</pre><pre>ShellExecuteA</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders</pre><pre>GetWindowsDirectoryA</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion</pre><pre>http\shell\open\command</pre><pre>\Internet Explorer\iexplore.exe</pre><pre>####@####</pre><pre>$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)</pre><pre>Portugal</pre><pre>Turkey</pre><pre>Windows 3.1</pre><pre>Windows 95 (Release 2)</pre><pre>Windows 95</pre><pre>Windows 98 SE</pre><pre>Windows 98</pre><pre>Windows ME</pre><pre>Windows 7</pre><pre>Windows Vista</pre><pre>%s %s</pre><pre>Windows XP Professional x64</pre><pre>Windows XP Home</pre><pre>Windows XP Professional</pre><pre>Windows 2000 Professional</pre><pre>Windows NT %d.%d</pre><pre>Windows 2008</pre><pre>%s %s Server</pre><pre>Windows 2003 Server Datacenter</pre><pre>Windows 2003 Server Enterprise</pre><pre>Windows 2003 Server Web Edition</pre><pre>Windows 2003 Server</pre><pre>Windows Home Server</pre><pre>Windows 2003 Server (Release 2)</pre><pre>Windows 2000 Server Datacenter</pre><pre>Windows 2000 Server Enterprise</pre><pre>Windows 2000 Server Web Edition</pre><pre>Windows 2000 Server</pre><pre>Windows NT 4.0 Server Datacenter</pre><pre>Windows NT 4.0 Server Enterprise</pre><pre>Windows NT 4.0 Server Web Edition</pre><pre>Windows NT 4.0 Server</pre><pre>Unknown Platform ID (%d)</pre><pre>%d.%d</pre><pre>%s (Build: %d</pre><pre>- Service Pack: %s</pre><pre>KERNEL32.DLL</pre><pre>teste.vbs</pre><pre>teste.txt</pre><pre>Set objSecurityCenter = GetObject("winmgmts:\\.\root\SecurityCenter")</pre><pre>Set colFirewall = objSecurityCenter.ExecQuery("Select * From FirewallProduct",,48)</pre><pre>Set colAntiVirus = objSecurityCenter.ExecQuery("Select * From AntiVirusProduct",,48)</pre><pre>Set objFileSystem = CreateObject("Scripting.fileSystemObject")</pre><pre>Set objFile = objFileSystem.CreateTextFile("</pre><pre>Info = Info & "F" & CountFw & ") " & objFirewall.displayName & " v" & objFirewall.versionNumber & Enter</pre><pre>Info = Info & "A" & CountAV & ") " & objAntiVirus.displayName & " v" & objAntiVirus.versionNumber & Enter</pre><pre>objFile.WriteLine(Info)</pre><pre>objFile.Close</pre><pre>cscript.exe</pre><pre>AVICAP32.dll</pre><pre>tFtpAccess</pre><pre>BuildImportTable: can't load library:</pre><pre>BuildImportTable: ReallocMemory failed</pre><pre>BuildImportTable: GetProcAddress failed</pre><pre>BTMemoryLoadLibary: BuildImportTable failed</pre><pre>BTMemoryGetProcAddress: no export table found</pre><pre>BTMemoryGetProcAddress: DLL doesn't export anything</pre><pre>BTMemoryGetProcAddress: exported symbol not found</pre><pre>SetupApi.dll</pre><pre>SetupDiOpenClassRegKey</pre><pre>SetupDiOpenClassRegKeyExA</pre><pre>SetupDiOpenClassRegKeyExW</pre><pre>SetupDiCreateDeviceInterfaceRegKeyA</pre><pre>SetupDiCreateDeviceInterfaceRegKeyW</pre><pre>SetupDiOpenDeviceInterfaceRegKey</pre><pre>SetupDiDeleteDeviceInterfaceRegKey</pre><pre>SetupDiCreateDevRegKeyA</pre><pre>SetupDiCreateDevRegKeyW</pre><pre>SetupDiOpenDevRegKey</pre><pre>SetupDiDeleteDevRegKey</pre><pre>CM_DEVCAP_LOCKSUPPORTED</pre><pre>CM_DEVCAP_EJECTSUPPORTED</pre><pre>PDCAP_D0_SUPPORTED</pre><pre>PDCAP_D1_SUPPORTED</pre><pre>PDCAP_D2_SUPPORTED</pre><pre>PDCAP_D3_SUPPORTED</pre><pre>PDCAP_WAKE_FROM_D0_SUPPORTED</pre><pre>PDCAP_WAKE_FROM_D1_SUPPORTED</pre><pre>PDCAP_WAKE_FROM_D2_SUPPORTED</pre><pre>PDCAP_WAKE_FROM_D3_SUPPORTED</pre><pre>PDCAP_WARM_EJECT_SUPPORTED</pre><pre>HKEY_CLASSES_ROOT</pre><pre>HKEY_CURRENT_CONFIG</pre><pre>HKEY_CURRENT_USER</pre><pre>HKEY_LOCAL_MACHINE</pre><pre>HKEY_USERS</pre><pre>127.0.0.1</pre><pre>iphlpapi.dll</pre><pre>AllocateAndGetTcpExTableFromStack</pre><pre>AllocateAndGetUdpExTableFromStack</pre><pre>SetTcpEntry</pre><pre>GetExtendedTcpTable</pre><pre>GetExtendedUdpTable</pre><pre>Mozilla3_5Password</pre><pre>GetChromePass</pre><pre>StartHttpProxy</pre><pre>1.2.3</pre><pre>XxX.xXx</pre><pre>UuU.uUu</pre><pre>keyboardkey</pre><pre>webcaminactive</pre><pre>webcamgetbuffer</pre><pre>webcam</pre><pre>enviarexecnormal</pre><pre>enviarexechidden</pre><pre>openweb</pre><pre>downexec</pre><pre>sendftp</pre><pre>keylogger</pre><pre>keyloggergetlog</pre><pre>keyloggereraselog</pre><pre>keyloggerativar</pre><pre>keyloggerdesativar</pre><pre>renamekey</pre><pre>windowsfechar</pre><pre>windowsmax</pre><pre>windowsmin</pre><pre>windowsmostrar</pre><pre>windowsocultar</pre><pre>windowsmintodas</pre><pre>windowscaption</pre><pre>listarportas</pre><pre>listarportasdns</pre><pre>finalizarprocessoportas</pre><pre>webcamsettings</pre><pre>chatmsg</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\</pre><pre>PSAPI.dll</pre><pre>\config\SteamAppData.vdf</pre><pre>AutoLoginUser</pre><pre>/ClientRegistry.Blob</pre><pre>\ClientRegistry.blob</pre><pre>\steam.dll</pre><pre>%SYS%</pre><pre>ÞSKTOP%</pre><pre>FirstExecution</pre><pre>chatmsg|</pre><pre>Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run</pre><pre>listarjanelas|windowsfechar|</pre><pre>listarjanelas|windowsmax|</pre><pre>listarjanelas|windowsmin|</pre><pre>listarjanelas|windowsmostrar|</pre><pre>listarjanelas|windowsocultar|</pre><pre>listarjanelas|windowsmintodas|</pre><pre>listarjanelas|windowscaption|</pre><pre>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall</pre><pre>listarportas|listadeportaspronta|</pre><pre>listarportas|finalizarconexao|</pre><pre>listarportas|finalizarprocessoportas|Y|</pre><pre>listarportas|finalizarprocessoportas|N|</pre><pre>registro|renamekey|</pre><pre>keylogger|keylogger|keyloggerativar|</pre><pre>keylogger|keylogger|keyloggerdesativar|</pre><pre>keylogger|keyloggergetlog|</pre><pre>keylogger|keylogger|keyloggervazio|</pre><pre>keyloggersearch</pre><pre>keyloggersearchok|</pre><pre>webcam|webcaminactive|</pre><pre>webcam|webcamactive|</pre><pre>getpassword</pre><pre>_x_X_PASSWORDLIST_X_x_</pre><pre>NOIP.abc</pre><pre>MSN.abc</pre><pre>FIREFOX.abc</pre><pre>IELOGIN.abc</pre><pre>IEPASS.abc</pre><pre>IEAUTO.abc</pre><pre>IEWEB.abc</pre><pre>SOFTWARE\Mozilla\Mozilla Firefox</pre><pre>getfirefox</pre><pre>getielogin</pre><pre>getiepass</pre><pre>getieweb</pre><pre>getchrome</pre><pre>getpassword|getpasswordlist|</pre><pre>getpassword|getpassworderror|</pre><pre>updateservidorweb</pre><pre>##@@## ##@@## ##@@##</pre><pre>Windows\CurrentVersion\Uninstall\eDonkey2000</pre><pre>UNWISE.EXE</pre><pre>ntdll.dll</pre><pre>icon=shell32.dll,4</pre><pre>shellexecute=</pre><pre>autorun.inf</pre><pre>XX--XX--XX.txt</pre><pre>logs.dat</pre><pre>SQLite3.dll</pre><pre>$1.2.3</pre><pre>deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly</pre><pre>inflate 1.2.3 Copyright 1995-2005 Mark Adler</pre><pre>KWindows</pre><pre>UnitExecutarComandos</pre><pre>uftp</pre><pre>UrlMon</pre><pre>.UnitBytesSize</pre><pre>UnitListarPortasAtivas</pre><pre>UnitWebcam</pre><pre>UnitKeylogger</pre><pre>WinExec</pre><pre>SetNamedPipeHandleState</pre><pre>GetProcessHeap</pre><pre>CreatePipe</pre><pre>RegOpenKeyExA</pre><pre>RegOpenKeyA</pre><pre>RegEnumKeyExA</pre><pre>RegDeleteKeyA</pre><pre>RegCreateKeyA</pre><pre>RegCloseKey</pre><pre>GdiplusShutdown</pre><pre>keybd_event</pre><pre>MapVirtualKeyA</pre><pre>GetKeyboardState</pre><pre>GetKeyboardLayoutNameA</pre><pre>GetKeyState</pre><pre>GetAsyncKeyState</pre><pre>ExitWindowsEx</pre><pre>EnumWindows</pre><pre>FtpGetFileSize</pre><pre>FtpSetCurrentDirectoryA</pre><pre>FtpOpenFileA</pre><pre>%( % & % % % ]</pre><pre>.idata</pre><pre>.reloc</pre><pre>P.rsrc</pre><pre>advapi32.dll</pre><pre>AVICAP32.DLL</pre><pre>gdi32.dll</pre><pre>gdiplus.dll</pre><pre>mpr.dll</pre><pre>msacm32.dll</pre><pre>ole32.dll</pre><pre>oleaut32.dll</pre><pre>powrprof.dll</pre><pre>user32.dll</pre><pre>wininet.dll</pre><pre>winmm.dll</pre><pre>wsock32.dll</pre><b>javaw.exe_2140_rwx_00990000_00178000:</b><pre>Â8&</pre><pre>\$` \$,;</pre><b>Explorer.EXE_512_rwx_00F30000_00001000:</b><pre>KERNEL32.DLL</pre><b>Explorer.EXE_512_rwx_01E70000_00001000:</b><pre>KERNEL32.DLL</pre><b>Explorer.EXE_512_rwx_01F10000_00001000:</b><pre>KERNEL32.DLL</pre><b>Explorer.EXE_512_rwx_02100000_00001000:</b><pre>KERNEL32.DLL</pre><b>Explorer.EXE_512_rwx_02140000_00001000:</b><pre>KERNEL32.DLL</pre><b>Explorer.EXE_512_rwx_02180000_00001000:</b><pre>KERNEL32.DLL</pre><b>Explorer.EXE_512_rwx_021B0000_00001000:</b><pre>advapi32.dll</pre><b>Explorer.EXE_512_rwx_022E0000_00001000:</b><pre>RegOpenKeyA</pre><b>Explorer.EXE_512_rwx_022F0000_00001000:</b><pre>advapi32.dll</pre><b>Explorer.EXE_512_rwx_02320000_00001000:</b><pre>AVICAP32.DLL</pre><b>Explorer.EXE_512_rwx_02460000_00001000:</b><pre>AVICAP32.DLL</pre><b>Explorer.EXE_512_rwx_02490000_00001000:</b><pre>gdi32.dll</pre><b>Explorer.EXE_512_rwx_025D0000_00001000:</b><pre>gdi32.dll</pre><b>Explorer.EXE_512_rwx_02600000_00001000:</b><pre>gdiplus.dll</pre><b>Explorer.EXE_512_rwx_02740000_00001000:</b><pre>gdiplus.dll</pre><b>Explorer.EXE_512_rwx_02770000_00001000:</b><pre>mpr.dll</pre><b>Explorer.EXE_512_rwx_027B0000_00001000:</b><pre>mpr.dll</pre><b>Explorer.EXE_512_rwx_027E0000_00001000:</b><pre>msacm32.dll</pre><b>Explorer.EXE_512_rwx_02820000_00001000:</b><pre>msacm32.dll</pre><b>Explorer.EXE_512_rwx_02850000_00001000:</b><pre>ntdll.dll</pre><b>Explorer.EXE_512_rwx_02BA0000_00001000:</b><pre>ntdll.dll</pre><b>Explorer.EXE_512_rwx_02BD0000_00001000:</b><pre>ole32.dll</pre><b>Explorer.EXE_512_rwx_02D10000_00001000:</b><pre>ole32.dll</pre><b>Explorer.EXE_512_rwx_02D40000_00001000:</b><pre>oleaut32.dll</pre><b>Explorer.EXE_512_rwx_02E80000_00001000:</b><pre>oleaut32.dll</pre><b>Explorer.EXE_512_rwx_02EB0000_00001000:</b><pre>powrprof.dll</pre><b>Explorer.EXE_512_rwx_02FF0000_00001000:</b><pre>powrprof.dll</pre><b>Explorer.EXE_512_rwx_03020000_00001000:</b><pre>shell32.dll</pre><b>Explorer.EXE_512_rwx_03160000_00001000:</b><pre>shell32.dll</pre><b>Explorer.EXE_512_rwx_03190000_00001000:</b><pre>user32.dll</pre><b>Explorer.EXE_512_rwx_032D0000_00001000:</b><pre>user32.dll</pre><b>Explorer.EXE_512_rwx_03300000_00001000:</b><pre>wininet.dll</pre><b>Explorer.EXE_512_rwx_03430000_00001000:</b><pre>FtpOpenFileA</pre><b>Explorer.EXE_512_rwx_03440000_00001000:</b><pre>wininet.dll</pre><b>Explorer.EXE_512_rwx_03470000_00001000:</b><pre>winmm.dll</pre><b>Explorer.EXE_512_rwx_035B0000_00001000:</b><pre>winmm.dll</pre><b>Explorer.EXE_512_rwx_035E0000_00001000:</b><pre>wsock32.dll</pre><b>Explorer.EXE_512_rwx_03720000_00001000:</b><pre>wsock32.dll</pre><b>Explorer.EXE_512_rwx_24010000_00062000:</b><pre>`.rsrc</pre><pre>/w)f%u/</pre><pre>kernel32.dll</pre><pre>Portions Copyright (c) 1999,2003 Avenger by NhT</pre><pre>SHFileOperationA</pre><pre>shell32.dll</pre><pre>URLDownloadToFileA</pre><pre>urlmon.dll</pre><pre>ShellExecuteA</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders</pre><pre>GetWindowsDirectoryA</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion</pre><pre>http\shell\open\command</pre><pre>\Internet Explorer\iexplore.exe</pre><pre>####@####</pre><pre>$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)</pre><pre>Portugal</pre><pre>Turkey</pre><pre>Windows 3.1</pre><pre>Windows 95 (Release 2)</pre><pre>Windows 95</pre><pre>Windows 98 SE</pre><pre>Windows 98</pre><pre>Windows ME</pre><pre>Windows 7</pre><pre>Windows Vista</pre><pre>%s %s</pre><pre>Windows XP Professional x64</pre><pre>Windows XP Home</pre><pre>Windows XP Professional</pre><pre>Windows 2000 Professional</pre><pre>Windows NT %d.%d</pre><pre>Windows 2008</pre><pre>%s %s Server</pre><pre>Windows 2003 Server Datacenter</pre><pre>Windows 2003 Server Enterprise</pre><pre>Windows 2003 Server Web Edition</pre><pre>Windows 2003 Server</pre><pre>Windows Home Server</pre><pre>Windows 2003 Server (Release 2)</pre><pre>Windows 2000 Server Datacenter</pre><pre>Windows 2000 Server Enterprise</pre><pre>Windows 2000 Server Web Edition</pre><pre>Windows 2000 Server</pre><pre>Windows NT 4.0 Server Datacenter</pre><pre>Windows NT 4.0 Server Enterprise</pre><pre>Windows NT 4.0 Server Web Edition</pre><pre>Windows NT 4.0 Server</pre><pre>Unknown Platform ID (%d)</pre><pre>%d.%d</pre><pre>%s (Build: %d</pre><pre>- Service Pack: %s</pre><pre>KERNEL32.DLL</pre><pre>teste.vbs</pre><pre>teste.txt</pre><pre>Set objSecurityCenter = GetObject("winmgmts:\\.\root\SecurityCenter")</pre><pre>Set colFirewall = objSecurityCenter.ExecQuery("Select * From FirewallProduct",,48)</pre><pre>Set colAntiVirus = objSecurityCenter.ExecQuery("Select * From AntiVirusProduct",,48)</pre><pre>Set objFileSystem = CreateObject("Scripting.fileSystemObject")</pre><pre>Set objFile = objFileSystem.CreateTextFile("</pre><pre>Info = Info & "F" & CountFw & ") " & objFirewall.displayName & " v" & objFirewall.versionNumber & Enter</pre><pre>Info = Info & "A" & CountAV & ") " & objAntiVirus.displayName & " v" & objAntiVirus.versionNumber & Enter</pre><pre>objFile.WriteLine(Info)</pre><pre>objFile.Close</pre><pre>cscript.exe</pre><pre>AVICAP32.dll</pre><pre>tFtpAccess</pre><pre>BuildImportTable: can't load library:</pre><pre>BuildImportTable: ReallocMemory failed</pre><pre>BuildImportTable: GetProcAddress failed</pre><pre>BTMemoryLoadLibary: BuildImportTable failed</pre><pre>BTMemoryGetProcAddress: no export table found</pre><pre>BTMemoryGetProcAddress: DLL doesn't export anything</pre><pre>BTMemoryGetProcAddress: exported symbol not found</pre><pre>SetupApi.dll</pre><pre>SetupDiOpenClassRegKey</pre><pre>SetupDiOpenClassRegKeyExA</pre><pre>SetupDiOpenClassRegKeyExW</pre><pre>SetupDiCreateDeviceInterfaceRegKeyA</pre><pre>SetupDiCreateDeviceInterfaceRegKeyW</pre><pre>SetupDiOpenDeviceInterfaceRegKey</pre><pre>SetupDiDeleteDeviceInterfaceRegKey</pre><pre>SetupDiCreateDevRegKeyA</pre><pre>SetupDiCreateDevRegKeyW</pre><pre>SetupDiOpenDevRegKey</pre><pre>SetupDiDeleteDevRegKey</pre><pre>CM_DEVCAP_LOCKSUPPORTED</pre><pre>CM_DEVCAP_EJECTSUPPORTED</pre><pre>PDCAP_D0_SUPPORTED</pre><pre>PDCAP_D1_SUPPORTED</pre><pre>PDCAP_D2_SUPPORTED</pre><pre>PDCAP_D3_SUPPORTED</pre><pre>PDCAP_WAKE_FROM_D0_SUPPORTED</pre><pre>PDCAP_WAKE_FROM_D1_SUPPORTED</pre><pre>PDCAP_WAKE_FROM_D2_SUPPORTED</pre><pre>PDCAP_WAKE_FROM_D3_SUPPORTED</pre><pre>PDCAP_WARM_EJECT_SUPPORTED</pre><pre>HKEY_CLASSES_ROOT</pre><pre>HKEY_CURRENT_CONFIG</pre><pre>HKEY_CURRENT_USER</pre><pre>HKEY_LOCAL_MACHINE</pre><pre>HKEY_USERS</pre><pre>127.0.0.1</pre><pre>iphlpapi.dll</pre><pre>AllocateAndGetTcpExTableFromStack</pre><pre>AllocateAndGetUdpExTableFromStack</pre><pre>SetTcpEntry</pre><pre>GetExtendedTcpTable</pre><pre>GetExtendedUdpTable</pre><pre>Mozilla3_5Password</pre><pre>GetChromePass</pre><pre>StartHttpProxy</pre><pre>1.2.3</pre><pre>XxX.xXx</pre><pre>UuU.uUu</pre><pre>keyboardkey</pre><pre>webcaminactive</pre><pre>webcamgetbuffer</pre><pre>webcam</pre><pre>enviarexecnormal</pre><pre>enviarexechidden</pre><pre>openweb</pre><pre>downexec</pre><pre>sendftp</pre><pre>keylogger</pre><pre>keyloggergetlog</pre><pre>keyloggereraselog</pre><pre>keyloggerativar</pre><pre>keyloggerdesativar</pre><pre>renamekey</pre><pre>windowsfechar</pre><pre>windowsmax</pre><pre>windowsmin</pre><pre>windowsmostrar</pre><pre>windowsocultar</pre><pre>windowsmintodas</pre><pre>windowscaption</pre><pre>listarportas</pre><pre>listarportasdns</pre><pre>finalizarprocessoportas</pre><pre>webcamsettings</pre><pre>chatmsg</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\</pre><pre>PSAPI.dll</pre><pre>\config\SteamAppData.vdf</pre><pre>AutoLoginUser</pre><pre>/ClientRegistry.Blob</pre><pre>\ClientRegistry.blob</pre><pre>\steam.dll</pre><pre>%SYS%</pre><pre>ÞSKTOP%</pre><pre>FirstExecution</pre><pre>chatmsg|</pre><pre>Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run</pre><pre>listarjanelas|windowsfechar|</pre><pre>listarjanelas|windowsmax|</pre><pre>listarjanelas|windowsmin|</pre><pre>listarjanelas|windowsmostrar|</pre><pre>listarjanelas|windowsocultar|</pre><pre>listarjanelas|windowsmintodas|</pre><pre>listarjanelas|windowscaption|</pre><pre>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall</pre><pre>listarportas|listadeportaspronta|</pre><pre>listarportas|finalizarconexao|</pre><pre>listarportas|finalizarprocessoportas|Y|</pre><pre>listarportas|finalizarprocessoportas|N|</pre><pre>registro|renamekey|</pre><pre>keylogger|keylogger|keyloggerativar|</pre><pre>keylogger|keylogger|keyloggerdesativar|</pre><pre>keylogger|keyloggergetlog|</pre><pre>keylogger|keylogger|keyloggervazio|</pre><pre>keyloggersearch</pre><pre>keyloggersearchok|</pre><pre>webcam|webcaminactive|</pre><pre>webcam|webcamactive|</pre><pre>getpassword</pre><pre>_x_X_PASSWORDLIST_X_x_</pre><pre>NOIP.abc</pre><pre>MSN.abc</pre><pre>FIREFOX.abc</pre><pre>IELOGIN.abc</pre><pre>IEPASS.abc</pre><pre>IEAUTO.abc</pre><pre>IEWEB.abc</pre><pre>SOFTWARE\Mozilla\Mozilla Firefox</pre><pre>getfirefox</pre><pre>getielogin</pre><pre>getiepass</pre><pre>getieweb</pre><pre>getchrome</pre><pre>getpassword|getpasswordlist|</pre><pre>getpassword|getpassworderror|</pre><pre>updateservidorweb</pre><pre>##@@## ##@@## ##@@##</pre><pre>Windows\CurrentVersion\Uninstall\eDonkey2000</pre><pre>UNWISE.EXE</pre><pre>ntdll.dll</pre><pre>icon=shell32.dll,4</pre><pre>shellexecute=</pre><pre>autorun.inf</pre><pre>XX--XX--XX.txt</pre><pre>logs.dat</pre><pre>SQLite3.dll</pre><pre>$1.2.3</pre><pre>deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly</pre><pre>inflate 1.2.3 Copyright 1995-2005 Mark Adler</pre><pre>KWindows</pre><pre>UnitExecutarComandos</pre><pre>uftp</pre><pre>UrlMon</pre><pre>.UnitBytesSize</pre><pre>UnitListarPortasAtivas</pre><pre>UnitWebcam</pre><pre>UnitKeylogger</pre><pre>WinExec</pre><pre>SetNamedPipeHandleState</pre><pre>GetProcessHeap</pre><pre>CreatePipe</pre><pre>RegOpenKeyExA</pre><pre>RegOpenKeyA</pre><pre>RegEnumKeyExA</pre><pre>RegDeleteKeyA</pre><pre>RegCreateKeyA</pre><pre>RegCloseKey</pre><pre>GdiplusShutdown</pre><pre>keybd_event</pre><pre>MapVirtualKeyA</pre><pre>GetKeyboardState</pre><pre>GetKeyboardLayoutNameA</pre><pre>GetKeyState</pre><pre>GetAsyncKeyState</pre><pre>ExitWindowsEx</pre><pre>EnumWindows</pre><pre>FtpGetFileSize</pre><pre>FtpSetCurrentDirectoryA</pre><pre>FtpOpenFileA</pre><pre>%( % & % % % ]</pre><pre>.idata</pre><pre>.reloc</pre><pre>P.rsrc</pre><pre>advapi32.dll</pre><pre>AVICAP32.DLL</pre><pre>gdi32.dll</pre><pre>gdiplus.dll</pre><pre>mpr.dll</pre><pre>msacm32.dll</pre><pre>ole32.dll</pre><pre>oleaut32.dll</pre><pre>powrprof.dll</pre><pre>user32.dll</pre><pre>wininet.dll</pre><pre>winmm.dll</pre><pre>wsock32.dll</pre></requestedExecutionLevel></pre></assemblyIdentity></pre></->