MD5: 8902b71a7c8cdbe0835a16906dfb4a6e
SHA1: 4f9c4b4dffb6b7a5adf955f3b683791cd028900c
SHA256: 9ec0b0035dad118fce612f704ae2d85ffc01eff7af1c253c6158d1b115fed799
SSDeep: 12288:JpP8yCWHNrTu5W9E0qoqS1vxdfSFfbHuCm31O8M/WTa3YzD7zE1:PEyCWHN3UGE0QSxxdfSJHuCW1CH3YzPa
Size: 765440 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6
Company: Pipicapage
Created at: 1992-06-20 01:22:17
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Generic's file once a user opens a drive's folder in Windows Explorer.

Process activity

The Generic creates the following process(es):

%original file name%.exe:1796
chrome.exe:3508

The Generic injects its code into the following process(es):

chrome.exe:3364
System.exe:1620

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:1796 makes changes in the file system.
The Generic creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\XX--XX--XX.txt (603 bytes)
C:\Windows\System32\winrm\out\out\System.exe (5441 bytes)

The process chrome.exe:3364 makes changes in the file system.
The Generic creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\logs.dat (15 bytes)
C:\Windows\System32\winrm\out\out\System.exe (765 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat (80 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UuU.uUu (32 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\XxX.xXx (13600 bytes)

The Generic deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\XX--XX--XX.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\XxX.xXx (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UuU.uUu (0 bytes)

Registry activity

The process %original file name%.exe:1796 makes changes in the system registry.
The Generic creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"Policies" = "C:\Windows\System32\winrm\out\out\System.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
"Policies" = "C:\Windows\System32\winrm\out\out\System.exe"

[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{212TQ547-J62H-6YA0-J560-7R004MMAU4TE}]
"StubPath" = "C:\Windows\System32\winrm\out\out\System.exe Restart"

To automatically run itself each time Windows is booted, the Generic adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender" = "C:\Windows\System32\winrm\out\out\System.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Audio do Windows" = "C:\Windows\System32\winrm\out\out\System.exe"

The process chrome.exe:3364 makes changes in the system registry.
The Generic creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\chrome_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\chrome_RASAPI32]
"MaxFileSize" = "1048576"
"ConsoleTracingMask" = "4294901760"
"EnableConsoleTracing" = "0"
"FileDirectory" = "%windir%\tracing"
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\chrome_RASMANCS]
"EnableFileTracing" = "0"

"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3C 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\chrome_RASMANCS]
"MaxFileSize" = "1048576"

[HKCU\Software\Google\Chrome\BLBeacon]
"failed_count" = "0"

[HKCU\Software\vitima]
"FirstExecution" = "03/04/2017 -- 05:09"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\chrome_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Google\Chrome\BLBeacon]
"State" = "2"

[HKCU\Software\vitima]
"NewIdentification" = "Vitima"

[HKLM\SOFTWARE\Microsoft\Tracing\chrome_RASAPI32]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\chrome_RASMANCS]
"FileTracingMask" = "4294901760"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Generic deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Generic's file once a user opens a drive's folder in Windows Explorer.

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
UPX0	4096	561152	0	0	d41d8cd98f00b204e9800998ecf8427e
UPX1	565248	565248	563712	5.42992	16c3e86f8cc79ed716104709a5ecacf8
.rsrc	1130496	200704	200704	4.23339	20d05d5a4b3422a79201b60bc4dd4e2c

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://server.com/sqlite3.dll
hxxp://www.server.com/sqlite3.dll	52.8.126.80
hackdafamilia25.ddns.net	141.255.157.133
dns.msftncsi.com

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /sqlite3.dll HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.server.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Server: nginx

Date: Mon, 03 Apr 2017 02:09:38 GMT

Content-Type: text/html

Content-Length: 1020

Connection: keep-alive

Last-Modified: Sat, 04 Jun 2016 08:29:07 GMT

ETag: "3fc-5346fa2067c4c"

Accept-Ranges: bytes

X-Powered-By: PleskLin
<HTML>.<HEAD>.<TITLE>404 Not Found</TITLE>.<
;BASE href="/error_docs/"><!--[if lte IE 6]></BASE><
![endif]-->.</HEAD>.<BODY>.<H1>Not Found</H1&g
t;.The requested document was not found on this server..<P>.<
HR>.<ADDRESS>.Web Server at server.com.</ADDRESS>.</
BODY>.</HTML>..<!--.   - Unfortunately, Microsoft has adde
d a clever new.   - "feature" to Internet Explorer. If the text of.   
- an error's message is "too small", specifically.   - less than 512 b
ytes, Internet Explorer returns.   - its own error message. You can tu
rn that off,.   - but it's pretty tricky to find switch called.   - "s
mart error messages". That means, of course,.   - that short error mes
sages are censored by default..   - IIS always returns error messages 
that are long.   - enough to make Internet Explorer happy. The.   - wo
rkaround is pretty simple: pad the error.   - message with a big comme
nt like this to push it.   - over the five hundred and twelve bytes mi
nimum..   - Of course, that's exactly what you're reading.   - right n
ow..   -->...

GET /sqlite3.dll HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.server.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Server: nginx

Date: Mon, 03 Apr 2017 02:10:06 GMT

Content-Type: text/html

Content-Length: 1020

Connection: keep-alive

Last-Modified: Sat, 04 Jun 2016 08:29:07 GMT

ETag: "3fc-5346fa2067c4c"

Accept-Ranges: bytes

X-Powered-By: PleskLin
<HTML>.<HEAD>.<TITLE>404 Not Found</TITLE>.<
;BASE href="/error_docs/"><!--[if lte IE 6]></BASE><
![endif]-->.</HEAD>.<BODY>.<H1>Not Found</H1&g
t;.The requested document was not found on this server..<P>.<
HR>.<ADDRESS>.Web Server at server.com.</ADDRESS>.</
BODY>.</HTML>..<!--.   - Unfortunately, Microsoft has adde
d a clever new.   - "feature" to Internet Explorer. If the text of.   
- an error's message is "too small", specifically.   - less than 512 b
ytes, Internet Explorer returns.   - its own error message. You can tu
rn that off,.   - but it's pretty tricky to find switch called.   - "s
mart error messages". That means, of course,.   - that short error mes
sages are censored by default..   - IIS always returns error messages 
that are long.   - enough to make Internet Explorer happy. The.   - wo
rkaround is pretty simple: pad the ..

The Generic connects to the servers at the folowing location(s):

chrome.exe_3364:

.text

`.rdata

@.data

.gfids

@.tls

.rsrc

@.reloc

D$,j.Xf

jxh(%F

j.Yf;

_tcPVj@

.PjRW

ole32.dll

POWRPROF.dll

address family not supported

broken pipe

function not supported

inappropriate io control operation

not supported

operation canceled

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

InitOnceExecuteOnce

operator

operator ""

?#%X.y

%S#[k

?OLEAUT32.dll

user32.dll

c:\b\build\slave\win-pgo\build\src\chrome\app\chrome_exe_main_win.cc

c:\b\build\slave\win-pgo\build\src\chrome\app\main_dll_loader_win.cc

Failed to load Chrome DLL from

ChromeMain

RelaunchChromeBrowserWithNewCommandLineIfNeeded

Could not find exported function

%s: option `%s' is ambiguous (could be `--%s' or `--%s')

%s: invalid option -- `-%c'

%s: argument required for option `

--%s'

0.8.0

%ls (%s) %s

hXXps://crashpad.chromium.org/

hXXps://crashpad.chromium.org/bug/new

Report %ls bugs to

%s home page: <%s>

%ls: %s

(0x%X)

Error (0x%X) while retrieving error. (0x%X)

PlatformFile.UnknownErrors.Windows

c:\b\build\slave\win-pgo\build\src\base\threading\thread_local_win.cc

0123456789

(flags = 0x%x)

Histogram: %s recorded %d samples

.syzygy

.thunks

Windows NT

Histogram.InconsistentCountHigh

Histogram.InconsistentCountLow

c:\b\build\slave\win-pgo\build\src\base\metrics\persistent_memory_allocator.cc

(%d = %3.1f%%)

UMA.CreatePersistentHistogram.Result

Dictionary keys must be quoted.

Unsupported encoding. JSON must be UTF-8.

Line: %i, column: %i, %s

widevinecdmadapter.dll

c:\b\build\slave\win-pgo\build\src\chrome\installer\util\google_update_settings.cc

Failed to write to application's ClientState key

Removed incremental installer failure key; switching to channel:

Removed multi-install failure key; switching to channel:

CHROME_PROBED_PROGRAM_FILES_PATH

chrome-sxs

c:\b\build\slave\win-pgo\build\src\chrome\installer\util\google_chrome_distribution.cc

iexplore.exe

googlechrome

googlechromeframe

c:\b\build\slave\win-pgo\build\src\chrome\installer\util\channel_info.cc

c:\b\build\slave\win-pgo\build\src\chrome\installer\util\language_selector.cc

c:\b\build\slave\win-pgo\build\src\chrome\installer\util\app_commands.cc

Cannot initialize AppCommands from an invalid key.

Skipping over key "

Failed to open key "

Cannot initialize an AppCommand from an invalid key.

c:\b\build\slave\win-pgo\build\src\chrome\installer\util\app_command.cc

CHROME_MAIN_TICKS

user_experience_metrics.reporting_enabled

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\settings.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\numeric\in_range_cast.h

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc

x-x-x-xx-xxxxxx

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\misc\uuid.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_io.cc

--annotation=KEY=VALUE set a process annotation in each crash report

--database=PATH store the crash report database at PATH

create a new pipe and send its name via HANDLE

--pipe-name=PIPE communicate with the client over PIPE

--url=URL send crash reports to this Breakpad server URL,

pipe-name

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\handler_main.cc

duplicate key

--annotation requires KEY=VALUE

--handshake-handle and --pipe-name are incompatible

--handshake-handle or --pipe-name is required

SetProcessShutdownParameters

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\crash_report_upload_thread.cc

reserved key

FinishedWritingCrashReport failed

PrepareNewCrashReport failed

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\win\crash_report_exception_handler.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_file_writer.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_writer_util.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_writable.cc

%s.%s,%s,%s

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_context_writer.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\process_snapshot_minidump.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_snapshot_win.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\crashpad_info_client_options.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\minidump_simple_string_dictionary_reader.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\module_snapshot_minidump.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\exception_snapshot_win.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\module_snapshot_win.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\system_snapshot_win.cc

%s %d.%d.%d.%s%s

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_reader_win.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\minidump_string_list_reader.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\capture_memory.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\cpu_context_win.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_reader.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_annotations_reader.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_subrange_reader.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_resource_reader.cc

kernel32.dll

c:\b\build\slave\win-pgo\build\src\sandbox\win\src\sandbox_policy_base.cc

NtOpenKey

NtCreateKey

GetCertificateSize

GetCertificate

GetCertificateSizeByHandle

GetCertificateByHandle

SetOPMSigningKeyAndSequenceNumbers

CreateNamedPipeW

NtOpenKeyEx

PruneCrashReportDatabase: Failed to get pending reports

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\prune_crash_reports.cc

PruneCrashReportDatabase: Failed to get completed reports

Database Pruning: Failed to remove report

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\exception_handler_server.cc

::GetNamedPipeClientProcessId

\\.\pipe\crashpad_%d_

ImpersonateNamedPipeClient

ConnectNamedPipe

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_reader.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\net\http_transport_win.cc

WinHttpCrackUrl

WinHttpConnect

WinHttpOpenRequest

WinHttpCloseHandle

Crashpad/0.8.0

WinHttpOpen

WinHttpSetTimeouts

WinHttpReceiveResponse

WinHttpQueryHeaders

HTTP status %d

WinHttpReadData

WinHttpAddRequestHeaders

WinHttpSendRequest

%%x

--%s%sContent-Disposition: form-data; name="%s"

; filename="%s"%s

Content-Type: %s%s

multipart/form-data; boundary=%s

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\scoped_process_suspend.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_seeker.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\process_info.cc

Reading x64 process from x86 process not supported

0x%llx   0x%llx (%s)

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\module_version.cc

<failed to retrieve error message (0x%x)>

(0xx)

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\scoped_local_alloc.cc

SetNamedPipeHandleState

WaitNamedPipe

TransactNamedPipe: expected

TransactNamedPipe

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\registration_protocol_win.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\net\http_body.cc

InvokeMainViaCRT

ExitMainViaCRT

Microsoft.CRTProvider

C:\b\build\slave\win-pgo\build\src\out\Release\initialexe\chrome.exe.pdb

.text$di

.text$mn

.text$x

.text$yd

.idata$5

.CRT$XCA

.CRT$XCAA

.CRT$XCC

.CRT$XCL

.CRT$XCU

.CRT$XCZ

.CRT$XIA

.CRT$XIAA

.CRT$XIAC

.CRT$XIC

.CRT$XIZ

.CRT$XLA

.CRT$XLB

.CRT$XLZ

.CRT$XPA

.CRT$XPX

.CRT$XPXA

.CRT$XPZ

.CRT$XTA

.CRT$XTZ

.rdata

.rdata$T

.rdata$r

.rdata$sxdata

.rdata$zETW0

.rdata$zETW1

.rdata$zETW2

.rdata$zETW9

.rdata$zzzdbg

.rtc$IAA

.rtc$IZZ

.rtc$TAA

.rtc$TZZ

.xdata$x

.didat$2

.didat$3

.didat$4

.didat$6

.didat$7

.edata

.idata$2

.idata$3

.idata$4

.idata$6

.data

.data$r

.didat$5

.gfids$x

.gfids$y

.tls$ZZZ

.rsrc$01

.rsrc$02

chrome.exe

SignalChromeElf

chrome_elf.dll

RegOpenKeyExW

RegEnumKeyExW

RegCreateKeyExW

RegQueryInfoKeyW

RegCloseKey

ADVAPI32.dll

CreateIoCompletionPort

GetWindowsDirectoryW

GetProcessHandleCount

KERNEL32.dll

ShellExecuteExW

SHELL32.dll

CloseWindowStation

CreateWindowStationW

GetProcessWindowStation

SetProcessWindowStation

USER32.dll

VERSION.dll

WINMM.dll

WTSAPI32.dll

RPCRT4.dll

GetCPInfo

GetProcessHeap

PeekNamedPipe

DisconnectNamedPipe

WaitNamedPipeW

WINHTTP.dll

.?AU_Crt_new_delete@std@@

a.IDATx

%F?????????3 

ÿFFFFFFFFFFFFFFF?B%

:1----16

Rhgf^rrrr(   ?NOCdhgfrrrr...DlEBScjhg^rr,001k>985Tnhherr-12

:BBBBBBBBBB>>-.jdddcccca

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency><dependency><dependentAssembly><assemblyIdentity type="win32" name="54.0.2840.59" version="54.0.2840.59" language="*"></assemblyIdentity></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"></supportedOS><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"></supportedOS><supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"></supportedOS><supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"></supportedOS><supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"></supportedOS></application></compatibility></assembly>

3 3*363@3

6 6%6-646

-0F3K4U4g4m4r4}4

1$3 303{3

081?1_1?3

4!4%4)4{4

9—9d9

; <0<6<;<

<&=.=6=>=~=

? ?$?(?,?

5 5$5(5,5

5 5$5(5,5054585

9,9094989

< <$<(<,<0<4<

4 4<4@4\4`4|4

5 5<5@5\5`5|5

KERNEL32.DLL

mscoree.dll

ext-ms-win-ntuser-windowstation-l1-1-0

portuguese-brazilian

Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers

nchrome_watcher.dll

PreReadChromeChildInBrowser

${windows}

Ndebug.log

\StringFileInfo\xx\%ls

ntdll.dll

shell32.dll

resources.pak

script.log

chrome

pepflashplayer.dll

Browse the web

Software\Microsoft\Windows\CurrentVersion\Uninstall\Chromium

{7D2B3E1D-D096-4594-9D8F-A6667F12E0AC}

{A2DF06F9-A21A-44A8-8A99-8B9C84F29160}

Chrome

chrome_child.dll

chrome.dll

Google Chrome Canary

{4ea16ac7-fd5a-47c3-875b-dbf4a2008c20}

ChromeCanary

Chrome Canary HTML Document

ChromeSSHTM

{1BEAC3E3-B852-44F4-B468-8906C062422E}

{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}

Google Chrome binaries

hXXps://support.google.com/chrome/contact/chromeuninstall3?hl=$1

Google Chrome

%d.%d.%d

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

;ChromeHTML

Chrome HTML Document

{8A69D345-D564-463c-AFF1-A69D9E530F96}

{5C65F4B0-3651-4514-B207-D10CB699B14B}

Google Chrome Frame

Chrome in a Frame.

Google\Chrome Frame

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame

{8BA986DA-5100-405E-AA35-86F34A02ACBF}

WebAccessible

-chromeframe

-chrome

lSOFTWARE\Policies\Google\Chrome

reports

settings.dat

?kernel32.dll

ALPC Port

\Sessions\%d\AppContainerNamedObjects\%ls

sHKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_PERFORMANCE_TEXT

HKEY_PERFORMANCE_NLSTEXT

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_CURRENT_CONFIG

HKEY_DYN_DATA

pipe\

@ntdll.dll

egdi32.dll

tntdll.dll

@kernel32.dll

xntdll.dll

Chrome_MessageWindow

Failed to create directory %ls, last error is %d

Chrome SxS\Application

Awinhttp.dll

54.0.2840.59

chrome_exe

chrome.exe_3364_rwx_00060000_00001000:

kernel32.dll

chrome.exe_3364_rwx_000A0000_00001000:

kernel32.dll

chrome.exe_3508:

.text

`.rdata

@.data

.gfids

@.tls

.rsrc

@.reloc

D$,j.Xf

jxh(%F

j.Yf;

_tcPVj@

.PjRW

ole32.dll

POWRPROF.dll

address family not supported

broken pipe

function not supported

inappropriate io control operation

not supported

operation canceled

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

InitOnceExecuteOnce

operator

operator ""

?#%X.y

%S#[k

?OLEAUT32.dll

user32.dll

c:\b\build\slave\win-pgo\build\src\chrome\app\chrome_exe_main_win.cc

c:\b\build\slave\win-pgo\build\src\chrome\app\main_dll_loader_win.cc

Failed to load Chrome DLL from

ChromeMain

RelaunchChromeBrowserWithNewCommandLineIfNeeded

Could not find exported function

%s: option `%s' is ambiguous (could be `--%s' or `--%s')

%s: invalid option -- `-%c'

%s: argument required for option `

--%s'

0.8.0

%ls (%s) %s

hXXps://crashpad.chromium.org/

hXXps://crashpad.chromium.org/bug/new

Report %ls bugs to

%s home page: <%s>

%ls: %s

(0x%X)

Error (0x%X) while retrieving error. (0x%X)

PlatformFile.UnknownErrors.Windows

c:\b\build\slave\win-pgo\build\src\base\threading\thread_local_win.cc

0123456789

(flags = 0x%x)

Histogram: %s recorded %d samples

.syzygy

.thunks

Windows NT

Histogram.InconsistentCountHigh

Histogram.InconsistentCountLow

c:\b\build\slave\win-pgo\build\src\base\metrics\persistent_memory_allocator.cc

(%d = %3.1f%%)

UMA.CreatePersistentHistogram.Result

Dictionary keys must be quoted.

Unsupported encoding. JSON must be UTF-8.

Line: %i, column: %i, %s

widevinecdmadapter.dll

c:\b\build\slave\win-pgo\build\src\chrome\installer\util\google_update_settings.cc

Failed to write to application's ClientState key

Removed incremental installer failure key; switching to channel:

Removed multi-install failure key; switching to channel:

CHROME_PROBED_PROGRAM_FILES_PATH

chrome-sxs

c:\b\build\slave\win-pgo\build\src\chrome\installer\util\google_chrome_distribution.cc

iexplore.exe

googlechrome

googlechromeframe

c:\b\build\slave\win-pgo\build\src\chrome\installer\util\channel_info.cc

c:\b\build\slave\win-pgo\build\src\chrome\installer\util\language_selector.cc

c:\b\build\slave\win-pgo\build\src\chrome\installer\util\app_commands.cc

Cannot initialize AppCommands from an invalid key.

Skipping over key "

Failed to open key "

Cannot initialize an AppCommand from an invalid key.

c:\b\build\slave\win-pgo\build\src\chrome\installer\util\app_command.cc

CHROME_MAIN_TICKS

user_experience_metrics.reporting_enabled

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\settings.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\numeric\in_range_cast.h

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc

x-x-x-xx-xxxxxx

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\misc\uuid.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_io.cc

--annotation=KEY=VALUE set a process annotation in each crash report

--database=PATH store the crash report database at PATH

create a new pipe and send its name via HANDLE

--pipe-name=PIPE communicate with the client over PIPE

--url=URL send crash reports to this Breakpad server URL,

pipe-name

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\handler_main.cc

duplicate key

--annotation requires KEY=VALUE

--handshake-handle and --pipe-name are incompatible

--handshake-handle or --pipe-name is required

SetProcessShutdownParameters

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\crash_report_upload_thread.cc

reserved key

FinishedWritingCrashReport failed

PrepareNewCrashReport failed

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\win\crash_report_exception_handler.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_file_writer.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_writer_util.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_writable.cc

%s.%s,%s,%s

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_context_writer.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\process_snapshot_minidump.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_snapshot_win.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\crashpad_info_client_options.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\minidump_simple_string_dictionary_reader.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\module_snapshot_minidump.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\exception_snapshot_win.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\module_snapshot_win.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\system_snapshot_win.cc

%s %d.%d.%d.%s%s

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_reader_win.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\minidump_string_list_reader.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\capture_memory.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\cpu_context_win.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_reader.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_annotations_reader.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_subrange_reader.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_resource_reader.cc

kernel32.dll

c:\b\build\slave\win-pgo\build\src\sandbox\win\src\sandbox_policy_base.cc

NtOpenKey

NtCreateKey

GetCertificateSize

GetCertificate

GetCertificateSizeByHandle

GetCertificateByHandle

SetOPMSigningKeyAndSequenceNumbers

CreateNamedPipeW

NtOpenKeyEx

PruneCrashReportDatabase: Failed to get pending reports

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\prune_crash_reports.cc

PruneCrashReportDatabase: Failed to get completed reports

Database Pruning: Failed to remove report

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\exception_handler_server.cc

::GetNamedPipeClientProcessId

\\.\pipe\crashpad_%d_

ImpersonateNamedPipeClient

ConnectNamedPipe

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_reader.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\net\http_transport_win.cc

WinHttpCrackUrl

WinHttpConnect

WinHttpOpenRequest

WinHttpCloseHandle

Crashpad/0.8.0

WinHttpOpen

WinHttpSetTimeouts

WinHttpReceiveResponse

WinHttpQueryHeaders

HTTP status %d

WinHttpReadData

WinHttpAddRequestHeaders

WinHttpSendRequest

%%x

--%s%sContent-Disposition: form-data; name="%s"

; filename="%s"%s

Content-Type: %s%s

multipart/form-data; boundary=%s

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\scoped_process_suspend.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_seeker.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\process_info.cc

Reading x64 process from x86 process not supported

0x%llx   0x%llx (%s)

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\module_version.cc

<failed to retrieve error message (0x%x)>

(0xx)

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\scoped_local_alloc.cc

SetNamedPipeHandleState

WaitNamedPipe

TransactNamedPipe: expected

TransactNamedPipe

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\registration_protocol_win.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\net\http_body.cc

InvokeMainViaCRT

ExitMainViaCRT

Microsoft.CRTProvider

C:\b\build\slave\win-pgo\build\src\out\Release\initialexe\chrome.exe.pdb

.text$di

.text$mn

.text$x

.text$yd

.idata$5

.CRT$XCA

.CRT$XCAA

.CRT$XCC

.CRT$XCL

.CRT$XCU

.CRT$XCZ

.CRT$XIA

.CRT$XIAA

.CRT$XIAC

.CRT$XIC

.CRT$XIZ

.CRT$XLA

.CRT$XLB

.CRT$XLZ

.CRT$XPA

.CRT$XPX

.CRT$XPXA

.CRT$XPZ

.CRT$XTA

.CRT$XTZ

.rdata

.rdata$T

.rdata$r

.rdata$sxdata

.rdata$zETW0

.rdata$zETW1

.rdata$zETW2

.rdata$zETW9

.rdata$zzzdbg

.rtc$IAA

.rtc$IZZ

.rtc$TAA

.rtc$TZZ

.xdata$x

.didat$2

.didat$3

.didat$4

.didat$6

.didat$7

.edata

.idata$2

.idata$3

.idata$4

.idata$6

.data

.data$r

.didat$5

.gfids$x

.gfids$y

.tls$ZZZ

.rsrc$01

.rsrc$02

chrome.exe

SignalChromeElf

chrome_elf.dll

RegOpenKeyExW

RegEnumKeyExW

RegCreateKeyExW

RegQueryInfoKeyW

RegCloseKey

ADVAPI32.dll

CreateIoCompletionPort

GetWindowsDirectoryW

GetProcessHandleCount

KERNEL32.dll

ShellExecuteExW

SHELL32.dll

CloseWindowStation

CreateWindowStationW

GetProcessWindowStation

SetProcessWindowStation

USER32.dll

VERSION.dll

WINMM.dll

WTSAPI32.dll

RPCRT4.dll

GetCPInfo

GetProcessHeap

PeekNamedPipe

DisconnectNamedPipe

WaitNamedPipeW

WINHTTP.dll

.?AU_Crt_new_delete@std@@

a.IDATx

%F?????????3 

ÿFFFFFFFFFFFFFFF?B%

:1----16

Rhgf^rrrr(   ?NOCdhgfrrrr...DlEBScjhg^rr,001k>985Tnhherr-12

:BBBBBBBBBB>>-.jdddcccca

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency><dependency><dependentAssembly><assemblyIdentity type="win32" name="54.0.2840.59" version="54.0.2840.59" language="*"></assemblyIdentity></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"></supportedOS><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"></supportedOS><supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"></supportedOS><supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"></supportedOS><supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"></supportedOS></application></compatibility></assembly>

3 3*363@3

6 6%6-646

-0F3K4U4g4m4r4}4

1$3 303{3

081?1_1?3

4!4%4)4{4

9—9d9

; <0<6<;<

<&=.=6=>=~=

? ?$?(?,?

5 5$5(5,5

5 5$5(5,5054585

9,9094989

< <$<(<,<0<4<

4 4<4@4\4`4|4

5 5<5@5\5`5|5

KERNEL32.DLL

mscoree.dll

ext-ms-win-ntuser-windowstation-l1-1-0

portuguese-brazilian

Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers

nchrome_watcher.dll

PreReadChromeChildInBrowser

${windows}

Ndebug.log

\StringFileInfo\xx\%ls

ntdll.dll

shell32.dll

resources.pak

script.log

chrome

pepflashplayer.dll

Browse the web

Software\Microsoft\Windows\CurrentVersion\Uninstall\Chromium

{7D2B3E1D-D096-4594-9D8F-A6667F12E0AC}

{A2DF06F9-A21A-44A8-8A99-8B9C84F29160}

Chrome

chrome_child.dll

chrome.dll

Google Chrome Canary

{4ea16ac7-fd5a-47c3-875b-dbf4a2008c20}

ChromeCanary

Chrome Canary HTML Document

ChromeSSHTM

{1BEAC3E3-B852-44F4-B468-8906C062422E}

{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}

Google Chrome binaries

hXXps://support.google.com/chrome/contact/chromeuninstall3?hl=$1

Google Chrome

%d.%d.%d

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

;ChromeHTML

Chrome HTML Document

{8A69D345-D564-463c-AFF1-A69D9E530F96}

{5C65F4B0-3651-4514-B207-D10CB699B14B}

Google Chrome Frame

Chrome in a Frame.

Google\Chrome Frame

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame

{8BA986DA-5100-405E-AA35-86F34A02ACBF}

WebAccessible

-chromeframe

-chrome

lSOFTWARE\Policies\Google\Chrome

reports

settings.dat

?kernel32.dll

ALPC Port

\Sessions\%d\AppContainerNamedObjects\%ls

sHKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_PERFORMANCE_TEXT

HKEY_PERFORMANCE_NLSTEXT

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_CURRENT_CONFIG

HKEY_DYN_DATA

pipe\

@ntdll.dll

egdi32.dll

tntdll.dll

@kernel32.dll

xntdll.dll

Chrome_MessageWindow

Failed to create directory %ls, last error is %d

Chrome SxS\Application

Awinhttp.dll

%Program Files%\Google\Chrome\Application\chrome.exe

54.0.2840.59

chrome_exe

System.exe_1620:

`.rsrc

Portions Copyright (c) 1999,2003 Avenger by NhT

####@####

kernel32.dll

VBoxService.exe

SbieDll.dll

dbghelp.dll

Software\Microsoft\Windows\CurrentVersion

55274-640-2673064-23950

76487-644-3177037-23510

76487-337-8429955-22614

\\.\Syser

\\.\SyserDbgMsg

\\.\SyserBoot

\\.\SICE

\\.\NTICE

ShellExecuteA

shell32.dll

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

GetWindowsDirectoryA

SOFTWARE\Microsoft\Windows\CurrentVersion

http\shell\open\command

\Internet Explorer\iexplore.exe

PSAPI.dll

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Software\Microsoft\Windows\CurrentVersion\Run

Microsoft\Network\Connections\pbk\rasphone.pbk

rasapi32.dll

rnaph.dll

RAS Passwords |

uURLHistory

Password:

abe2869f-9b47-4cd9-a358-c22904dba7f7

Password

UnitPasswords

advapi32.dll

WindowsLive:name=*

xxxyyyzzz.dat

\Mozilla Firefox\

mozcrt19.dll

sqlite3.dll

nspr4.dll

plc4.dll

plds4.dll

nssutil3.dll

softokn3.dll

nss3.dll

PK11_GetInternalKeySlot

userenv.dll

\Mozilla\Firefox\

profiles.ini

\signons3.txt

\signons2.txt

\signons1.txt

\signons.txt

(unnamed password)

explorer.exe

_x_X_PASSWORDLIST_X_x_

NOIP.abc

MSN.abc

FIREFOX.abc

IELOGIN.abc

IEPASS.abc

IEAUTO.abc

IEWEB.abc

XX--XX--XX.txt

?456789:;<=

!"#$%&'()* ,-./0123

hu2.iu

.j.Hm_j

KWindows

KuURLHistory

IEpasswords

####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@####

####@#### ####@####

####@#### ####@#### ####@#### ####@####

####@#### ####@#### ####@####

w}-cL}

XhDq.Tu

.Iu|$p

1dH0z.MNJ2

!id%9X%

kp.vK

.ClT(8

'.WH*

@.sp&

%XAWW

m.Pm=

pn.Kqz!

h%X:y

LH.dbL-.

%D=\ptu

*v.Cw

geV%FZq

%c)*L9

t`.Ju

uT.dCC7

TRÌU

TuÌU

ÌUZ

ÌU}

T_Ì

T%Ì

TB.CCU6

Te.CCU

T3.CCU

.CCUJ

.CCUm

TO.CC

Tr.CC

T8.CC

7o.TW

7o.Tq

T.CCC7d7

T.FCC8|

T.ICC

T.GCC

@T.HAC

TB.AC

TS.AC

T\.AC

Tm.AC

T~.AC

TX.AC{

T%S@CC

T%X@C

T.SCC79

|T.DCC1

D.TbGCC5

GetProcessHeap

RegOpenKeyExA

RegDeleteKeyA

RegCreateKeyExA

RegCreateKeyA

RegCloseKey

SetWindowsHookExA

GetKeyboardState

.idata

.rdata

P.reloc

P.rsrc

Zx....RhJXBH:

KERNEL32.DLL

crypt32.dll

ole32.dll

oleaut32.dll

pstorec.dll

user32.dll

chrome.exe_3364_rwx_00170000_00001000:

kernel32.dll

chrome.exe_3364_rwx_001B0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_002F0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_00330000_00001000:

kernel32.dll

chrome.exe_3364_rwx_00370000_00001000:

kernel32.dll

chrome.exe_3364_rwx_004B0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_004F0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_00530000_00001000:

kernel32.dll

chrome.exe_3364_rwx_00740000_00001000:

kernel32.dll

chrome.exe_3364_rwx_00780000_00001000:

kernel32.dll

chrome.exe_3364_rwx_007C0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_00800000_00001000:

kernel32.dll

chrome.exe_3364_rwx_00840000_00001000:

kernel32.dll

chrome.exe_3364_rwx_00880000_00001000:

kernel32.dll

chrome.exe_3364_rwx_008C0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_00900000_00001000:

kernel32.dll

chrome.exe_3364_rwx_01A20000_00001000:

kernel32.dll

chrome.exe_3364_rwx_01A60000_00001000:

kernel32.dll

chrome.exe_3364_rwx_01AA0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_01AE0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_01B20000_00001000:

kernel32.dll

chrome.exe_3364_rwx_01B60000_00001000:

kernel32.dll

chrome.exe_3364_rwx_01BA0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_01BE0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_01C20000_00001000:

kernel32.dll

chrome.exe_3364_rwx_01C60000_00001000:

kernel32.dll

chrome.exe_3364_rwx_01CA0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_01CE0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_01D20000_00001000:

kernel32.dll

chrome.exe_3364_rwx_01D60000_00001000:

kernel32.dll

chrome.exe_3364_rwx_01DA0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_01DE0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_01E20000_00001000:

kernel32.dll

chrome.exe_3364_rwx_01E60000_00001000:

kernel32.dll

chrome.exe_3364_rwx_01EA0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_01EE0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_01F20000_00001000:

kernel32.dll

chrome.exe_3364_rwx_01F60000_00001000:

kernel32.dll

chrome.exe_3364_rwx_01FA0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_01FE0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_02020000_00001000:

kernel32.dll

chrome.exe_3364_rwx_02060000_00001000:

kernel32.dll

chrome.exe_3364_rwx_02090000_00001000:

GetProcessHeap

chrome.exe_3364_rwx_020A0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_020D0000_00001000:

user32.dll

chrome.exe_3364_rwx_02110000_00001000:

user32.dll

chrome.exe_3364_rwx_02250000_00001000:

user32.dll

chrome.exe_3364_rwx_02280000_00001000:

advapi32.dll

chrome.exe_3364_rwx_022C0000_00001000:

advapi32.dll

chrome.exe_3364_rwx_022F0000_00001000:

RegOpenKeyExA

chrome.exe_3364_rwx_02300000_00001000:

advapi32.dll

chrome.exe_3364_rwx_02330000_00001000:

RegCloseKey

chrome.exe_3364_rwx_02340000_00001000:

advapi32.dll

chrome.exe_3364_rwx_02370000_00001000:

oleaut32.dll

chrome.exe_3364_rwx_024B0000_00001000:

oleaut32.dll

chrome.exe_3364_rwx_024F0000_00001000:

oleaut32.dll

chrome.exe_3364_rwx_02530000_00001000:

oleaut32.dll

chrome.exe_3364_rwx_02560000_00001000:

advapi32.dll

chrome.exe_3364_rwx_025A0000_00001000:

advapi32.dll

chrome.exe_3364_rwx_025E0000_00001000:

advapi32.dll

chrome.exe_3364_rwx_02710000_00001000:

RegOpenKeyExA

chrome.exe_3364_rwx_02720000_00001000:

advapi32.dll

chrome.exe_3364_rwx_02850000_00001000:

RegOpenKeyA

chrome.exe_3364_rwx_02860000_00001000:

advapi32.dll

chrome.exe_3364_rwx_028A0000_00001000:

advapi32.dll

chrome.exe_3364_rwx_028D0000_00001000:

RegEnumKeyExA

chrome.exe_3364_rwx_028E0000_00001000:

advapi32.dll

chrome.exe_3364_rwx_02920000_00001000:

advapi32.dll

chrome.exe_3364_rwx_02950000_00001000:

RegDeleteKeyA

chrome.exe_3364_rwx_02960000_00001000:

advapi32.dll

chrome.exe_3364_rwx_02990000_00001000:

RegCreateKeyA

chrome.exe_3364_rwx_029A0000_00001000:

advapi32.dll

chrome.exe_3364_rwx_029D0000_00001000:

RegCloseKey

chrome.exe_3364_rwx_029E0000_00001000:

advapi32.dll

chrome.exe_3364_rwx_02A20000_00001000:

advapi32.dll

chrome.exe_3364_rwx_02A60000_00001000:

advapi32.dll

chrome.exe_3364_rwx_02AA0000_00001000:

advapi32.dll

chrome.exe_3364_rwx_02AE0000_00001000:

advapi32.dll

chrome.exe_3364_rwx_02B10000_00001000:

kernel32.dll

chrome.exe_3364_rwx_02B50000_00001000:

kernel32.dll

chrome.exe_3364_rwx_02B90000_00001000:

kernel32.dll

chrome.exe_3364_rwx_02BD0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_02C10000_00001000:

kernel32.dll

chrome.exe_3364_rwx_02C40000_00001000:

WinExec

chrome.exe_3364_rwx_02C50000_00001000:

kernel32.dll

chrome.exe_3364_rwx_02C90000_00001000:

kernel32.dll

chrome.exe_3364_rwx_02CD0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_02E10000_00001000:

kernel32.dll

chrome.exe_3364_rwx_02E50000_00001000:

kernel32.dll

chrome.exe_3364_rwx_02E90000_00001000:

kernel32.dll

chrome.exe_3364_rwx_02ED0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_02F10000_00001000:

kernel32.dll

chrome.exe_3364_rwx_02F50000_00001000:

kernel32.dll

chrome.exe_3364_rwx_02F90000_00001000:

kernel32.dll

chrome.exe_3364_rwx_02FD0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03010000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03050000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03090000_00001000:

kernel32.dll

chrome.exe_3364_rwx_030C0000_00001000:

SetNamedPipeHandleState

chrome.exe_3364_rwx_030D0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03110000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03150000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03190000_00001000:

kernel32.dll

chrome.exe_3364_rwx_031D0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03210000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03250000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03290000_00001000:

kernel32.dll

chrome.exe_3364_rwx_032D0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03310000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03350000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03390000_00001000:

kernel32.dll

chrome.exe_3364_rwx_033D0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03410000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03450000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03490000_00001000:

kernel32.dll

chrome.exe_3364_rwx_034D0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03510000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03550000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03590000_00001000:

kernel32.dll

chrome.exe_3364_rwx_035D0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03610000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03650000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03690000_00001000:

kernel32.dll

chrome.exe_3364_rwx_036D0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03710000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03750000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03790000_00001000:

kernel32.dll

chrome.exe_3364_rwx_037D0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03810000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03850000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03890000_00001000:

kernel32.dll

chrome.exe_3364_rwx_038C0000_00001000:

GetProcessHeap

chrome.exe_3364_rwx_038D0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03910000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03950000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03990000_00001000:

kernel32.dll

chrome.exe_3364_rwx_039D0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03A10000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03A50000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03A90000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03AD0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03B10000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03B50000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03B90000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03BD0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03C10000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03C50000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03C90000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03CD0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03D10000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03D50000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03D90000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03DD0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03E10000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03E50000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03E90000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03ED0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03F10000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03F50000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03F80000_00001000:

CreatePipe

chrome.exe_3364_rwx_03F90000_00001000:

kernel32.dll

chrome.exe_3364_rwx_03FD0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_04010000_00001000:

kernel32.dll

chrome.exe_3364_rwx_04050000_00001000:

kernel32.dll

chrome.exe_3364_rwx_04090000_00001000:

kernel32.dll

chrome.exe_3364_rwx_040D0000_00001000:

kernel32.dll

chrome.exe_3364_rwx_04100000_00001000:

mpr.dll

chrome.exe_3364_rwx_04140000_00001000:

mpr.dll

chrome.exe_3364_rwx_04180000_00001000:

mpr.dll

chrome.exe_3364_rwx_041C0000_00001000:

mpr.dll

chrome.exe_3364_rwx_041F0000_00001000:

gdi32.dll

chrome.exe_3364_rwx_04230000_00001000:

gdi32.dll

chrome.exe_3364_rwx_04270000_00001000:

gdi32.dll

chrome.exe_3364_rwx_043B0000_00001000:

gdi32.dll

chrome.exe_3364_rwx_043F0000_00001000:

gdi32.dll

chrome.exe_3364_rwx_04530000_00001000:

gdi32.dll

chrome.exe_3364_rwx_04570000_00001000:

gdi32.dll

chrome.exe_3364_rwx_045B0000_00001000:

gdi32.dll

chrome.exe_3364_rwx_045F0000_00001000:

gdi32.dll

chrome.exe_3364_rwx_04630000_00001000:

gdi32.dll

chrome.exe_3364_rwx_04670000_00001000:

gdi32.dll

chrome.exe_3364_rwx_046B0000_00001000:

gdi32.dll

chrome.exe_3364_rwx_046F0000_00001000:

gdi32.dll

chrome.exe_3364_rwx_04730000_00001000:

gdi32.dll

chrome.exe_3364_rwx_04760000_00001000:

user32.dll

chrome.exe_3364_rwx_047A0000_00001000:

user32.dll

chrome.exe_3364_rwx_047E0000_00001000:

user32.dll

chrome.exe_3364_rwx_04820000_00001000:

user32.dll

chrome.exe_3364_rwx_04850000_00001000:

keybd_event

chrome.exe_3364_rwx_04860000_00001000:

user32.dll

chrome.exe_3364_rwx_048A0000_00001000:

user32.dll

chrome.exe_3364_rwx_048E0000_00001000:

user32.dll

chrome.exe_3364_rwx_04A20000_00001000:

user32.dll

chrome.exe_3364_rwx_04A60000_00001000:

user32.dll

chrome.exe_3364_rwx_04AA0000_00001000:

user32.dll

chrome.exe_3364_rwx_04AE0000_00001000:

user32.dll

chrome.exe_3364_rwx_04B20000_00001000:

user32.dll

chrome.exe_3364_rwx_04B60000_00001000:

user32.dll

chrome.exe_3364_rwx_04BA0000_00001000:

user32.dll

chrome.exe_3364_rwx_04BE0000_00001000:

user32.dll

chrome.exe_3364_rwx_04C20000_00001000:

user32.dll

chrome.exe_3364_rwx_04C60000_00001000:

user32.dll

chrome.exe_3364_rwx_04CA0000_00001000:

user32.dll

chrome.exe_3364_rwx_04CE0000_00001000:

user32.dll

chrome.exe_3364_rwx_04D20000_00001000:

user32.dll

chrome.exe_3364_rwx_04D60000_00001000:

user32.dll

chrome.exe_3364_rwx_04DA0000_00001000:

user32.dll

chrome.exe_3364_rwx_04DE0000_00001000:

user32.dll

chrome.exe_3364_rwx_04E20000_00001000:

user32.dll

chrome.exe_3364_rwx_04E60000_00001000:

user32.dll

chrome.exe_3364_rwx_04EA0000_00001000:

user32.dll

chrome.exe_3364_rwx_04EE0000_00001000:

user32.dll

chrome.exe_3364_rwx_04F10000_00001000:

MapVirtualKeyA

chrome.exe_3364_rwx_04F20000_00001000:

user32.dll

chrome.exe_3364_rwx_04F60000_00001000:

user32.dll

chrome.exe_3364_rwx_04FA0000_00001000:

user32.dll

chrome.exe_3364_rwx_04FE0000_00001000:

user32.dll

chrome.exe_3364_rwx_05020000_00001000:

user32.dll

chrome.exe_3364_rwx_05060000_00001000:

user32.dll

chrome.exe_3364_rwx_050A0000_00001000:

user32.dll

chrome.exe_3364_rwx_050E0000_00001000:

user32.dll

chrome.exe_3364_rwx_05120000_00001000:

user32.dll

chrome.exe_3364_rwx_05160000_00001000:

user32.dll

chrome.exe_3364_rwx_051A0000_00001000:

user32.dll

chrome.exe_3364_rwx_051E0000_00001000:

user32.dll

chrome.exe_3364_rwx_05220000_00001000:

user32.dll

chrome.exe_3364_rwx_05260000_00001000:

user32.dll

chrome.exe_3364_rwx_052A0000_00001000:

user32.dll

chrome.exe_3364_rwx_052E0000_00001000:

user32.dll

chrome.exe_3364_rwx_05320000_00001000:

user32.dll

chrome.exe_3364_rwx_05360000_00001000:

user32.dll

chrome.exe_3364_rwx_05390000_00001000:

GetKeyboardState

chrome.exe_3364_rwx_053A0000_00001000:

user32.dll

chrome.exe_3364_rwx_053D0000_00001000:

GetKeyboardLayoutNameA

chrome.exe_3364_rwx_053E0000_00001000:

user32.dll

chrome.exe_3364_rwx_05410000_00001000:

GetKeyState

chrome.exe_3364_rwx_05420000_00001000:

user32.dll

chrome.exe_3364_rwx_05460000_00001000:

user32.dll

chrome.exe_3364_rwx_054A0000_00001000:

user32.dll

chrome.exe_3364_rwx_054E0000_00001000:

user32.dll

chrome.exe_3364_rwx_05520000_00001000:

user32.dll

chrome.exe_3364_rwx_05560000_00001000:

user32.dll

chrome.exe_3364_rwx_055A0000_00001000:

user32.dll

chrome.exe_3364_rwx_055E0000_00001000:

user32.dll

chrome.exe_3364_rwx_05610000_00001000:

GetAsyncKeyState

chrome.exe_3364_rwx_05620000_00001000:

user32.dll

chrome.exe_3364_rwx_05660000_00001000:

user32.dll

chrome.exe_3364_rwx_056A0000_00001000:

user32.dll

chrome.exe_3364_rwx_056E0000_00001000:

user32.dll

chrome.exe_3364_rwx_05710000_00001000:

ExitWindowsEx

chrome.exe_3364_rwx_05720000_00001000:

user32.dll

chrome.exe_3364_rwx_05750000_00001000:

EnumWindows

chrome.exe_3364_rwx_05760000_00001000:

user32.dll

chrome.exe_3364_rwx_057A0000_00001000:

user32.dll

chrome.exe_3364_rwx_057E0000_00001000:

user32.dll

chrome.exe_3364_rwx_05820000_00001000:

user32.dll

chrome.exe_3364_rwx_05860000_00001000:

user32.dll

chrome.exe_3364_rwx_058A0000_00001000:

user32.dll

chrome.exe_3364_rwx_058E0000_00001000:

user32.dll

chrome.exe_3364_rwx_05920000_00001000:

user32.dll

chrome.exe_3364_rwx_05960000_00001000:

user32.dll

chrome.exe_3364_rwx_059A0000_00001000:

user32.dll

chrome.exe_3364_rwx_059E0000_00001000:

user32.dll

chrome.exe_3364_rwx_05A20000_00001000:

user32.dll

chrome.exe_3364_rwx_05A50000_00001000:

ntdll.dll

chrome.exe_3364_rwx_05A90000_00001000:

ntdll.dll

chrome.exe_3364_rwx_05AD0000_00001000:

ntdll.dll

chrome.exe_3364_rwx_05B00000_00001000:

kernel32.dll

chrome.exe_3364_rwx_05B40000_00001000:

kernel32.dll

chrome.exe_3364_rwx_05B70000_00001000:

wininet.dll

chrome.exe_3364_rwx_05BB0000_00001000:

wininet.dll

chrome.exe_3364_rwx_05DF0000_00001000:

wininet.dll

chrome.exe_3364_rwx_05E30000_00001000:

wininet.dll

chrome.exe_3364_rwx_05E70000_00001000:

wininet.dll

chrome.exe_3364_rwx_05FA0000_00001000:

FtpGetFileSize

chrome.exe_3364_rwx_05FB0000_00001000:

wininet.dll

chrome.exe_3364_rwx_05FE0000_00001000:

FtpSetCurrentDirectoryA

chrome.exe_3364_rwx_05FF0000_00001000:

wininet.dll

chrome.exe_3364_rwx_06020000_00001000:

FtpOpenFileA

chrome.exe_3364_rwx_06030000_00001000:

wininet.dll

chrome.exe_3364_rwx_06060000_00001000:

wsock32.dll

chrome.exe_3364_rwx_060A0000_00001000:

wsock32.dll

chrome.exe_3364_rwx_060E0000_00001000:

wsock32.dll

chrome.exe_3364_rwx_06120000_00001000:

wsock32.dll

chrome.exe_3364_rwx_06160000_00001000:

wsock32.dll

chrome.exe_3364_rwx_061A0000_00001000:

wsock32.dll

chrome.exe_3364_rwx_062E0000_00001000:

wsock32.dll

chrome.exe_3364_rwx_06320000_00001000:

wsock32.dll

chrome.exe_3364_rwx_06360000_00001000:

wsock32.dll

chrome.exe_3364_rwx_063A0000_00001000:

wsock32.dll

chrome.exe_3364_rwx_063E0000_00001000:

wsock32.dll

chrome.exe_3364_rwx_06420000_00001000:

wsock32.dll

chrome.exe_3364_rwx_06460000_00001000:

wsock32.dll

chrome.exe_3364_rwx_064A0000_00001000:

wsock32.dll

chrome.exe_3364_rwx_064E0000_00001000:

wsock32.dll

chrome.exe_3364_rwx_06520000_00001000:

wsock32.dll

chrome.exe_3364_rwx_06560000_00001000:

wsock32.dll

chrome.exe_3364_rwx_065A0000_00001000:

wsock32.dll

chrome.exe_3364_rwx_065E0000_00001000:

wsock32.dll

chrome.exe_3364_rwx_06620000_00001000:

wsock32.dll

chrome.exe_3364_rwx_06650000_00001000:

ole32.dll

chrome.exe_3364_rwx_06690000_00001000:

ole32.dll

chrome.exe_3364_rwx_066D0000_00001000:

ole32.dll

chrome.exe_3364_rwx_06700000_00001000:

ole32.dll

chrome.exe_3364_rwx_06740000_00001000:

ole32.dll

chrome.exe_3364_rwx_06780000_00001000:

ole32.dll

chrome.exe_3364_rwx_068C0000_00001000:

ole32.dll

chrome.exe_3364_rwx_068F0000_00001000:

gdiplus.dll

chrome.exe_3364_rwx_06930000_00001000:

gdiplus.dll

chrome.exe_3364_rwx_06970000_00001000:

gdiplus.dll

chrome.exe_3364_rwx_06AB0000_00001000:

gdiplus.dll

chrome.exe_3364_rwx_06AF0000_00001000:

gdiplus.dll

chrome.exe_3364_rwx_06B30000_00001000:

gdiplus.dll

chrome.exe_3364_rwx_06B70000_00001000:

gdiplus.dll

chrome.exe_3364_rwx_06DB0000_00001000:

gdiplus.dll

chrome.exe_3364_rwx_06DF0000_00001000:

gdiplus.dll

chrome.exe_3364_rwx_06E30000_00001000:

gdiplus.dll

chrome.exe_3364_rwx_06E70000_00001000:

gdiplus.dll

chrome.exe_3364_rwx_06EB0000_00001000:

gdiplus.dll

chrome.exe_3364_rwx_06EF0000_00001000:

gdiplus.dll

chrome.exe_3364_rwx_06F30000_00001000:

gdiplus.dll

chrome.exe_3364_rwx_06F70000_00001000:

gdiplus.dll

chrome.exe_3364_rwx_06FA0000_00001000:

GdiplusShutdown

chrome.exe_3364_rwx_06FB0000_00001000:

gdiplus.dll

chrome.exe_3364_rwx_06FF0000_00001000:

gdiplus.dll

chrome.exe_3364_rwx_07030000_00001000:

gdiplus.dll

chrome.exe_3364_rwx_07070000_00001000:

gdiplus.dll

chrome.exe_3364_rwx_070A0000_00001000:

AVICAP32.DLL

chrome.exe_3364_rwx_070E0000_00001000:

AVICAP32.DLL

chrome.exe_3364_rwx_07240000_00001000:

advapi32.dll

chrome.exe_3364_rwx_07280000_00001000:

advapi32.dll

chrome.exe_3364_rwx_072C0000_00001000:

advapi32.dll

chrome.exe_3364_rwx_07300000_00001000:

advapi32.dll

chrome.exe_3364_rwx_07340000_00001000:

advapi32.dll

chrome.exe_3364_rwx_07380000_00001000:

advapi32.dll

chrome.exe_3364_rwx_073C0000_00001000:

advapi32.dll

chrome.exe_3364_rwx_07500000_00001000:

advapi32.dll

chrome.exe_3364_rwx_07540000_00001000:

advapi32.dll

chrome.exe_3364_rwx_07580000_00001000:

advapi32.dll

chrome.exe_3364_rwx_075B0000_00001000:

shell32.dll

chrome.exe_3364_rwx_075F0000_00001000:

shell32.dll

chrome.exe_3364_rwx_07630000_00001000:

shell32.dll

chrome.exe_3364_rwx_07660000_00001000:

winmm.dll

chrome.exe_3364_rwx_078A0000_00001000:

winmm.dll

chrome.exe_3364_rwx_078E0000_00001000:

winmm.dll

chrome.exe_3364_rwx_07920000_00001000:

winmm.dll

chrome.exe_3364_rwx_07960000_00001000:

winmm.dll

chrome.exe_3364_rwx_079A0000_00001000:

winmm.dll

chrome.exe_3364_rwx_079E0000_00001000:

winmm.dll

chrome.exe_3364_rwx_07A20000_00001000:

winmm.dll

chrome.exe_3364_rwx_07A60000_00001000:

winmm.dll

chrome.exe_3364_rwx_07A90000_00001000:

powrprof.dll

chrome.exe_3364_rwx_07AD0000_00001000:

powrprof.dll

chrome.exe_3364_rwx_07B10000_00001000:

msacm32.dll

chrome.exe_3364_rwx_07B50000_00001000:

msacm32.dll

chrome.exe_3364_rwx_07B90000_00001000:

msacm32.dll

chrome.exe_3364_rwx_07BD0000_00001000:

msacm32.dll

chrome.exe_3364_rwx_07C10000_00001000:

msacm32.dll

chrome.exe_3364_rwx_07D50000_00001000:

msacm32.dll

chrome.exe_3364_rwx_07E90000_00001000:

msacm32.dll

chrome.exe_3364_rwx_07ED0000_00001000:

msacm32.dll

chrome.exe_3364_rwx_07F00000_00001000:

ADVAPI32.DLL

chrome.exe_3364_rwx_07F40000_00001000:

ADVAPI32.DLL

chrome.exe_3364_rwx_07F80000_00001000:

ADVAPI32.DLL

chrome.exe_3364_rwx_07FC0000_00001000:

ADVAPI32.DLL

chrome.exe_3364_rwx_10410000_0005C000:

.idata

.reloc

P.rsrc

kernel32.dll

Portions Copyright (c) 1999,2003 Avenger by NhT

SHFileOperationA

shell32.dll

URLDownloadToFileA

urlmon.dll

ShellExecuteA

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

GetWindowsDirectoryA

SOFTWARE\Microsoft\Windows\CurrentVersion

http\shell\open\command

\Internet Explorer\iexplore.exe

####@####

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

Portugal

Turkey

Windows 3.1

Windows 95 (Release 2)

Windows 95

Windows 98 SE

Windows 98

Windows ME

Windows 7

Windows Vista

%s %s

Windows XP Professional x64

Windows XP Home

Windows XP Professional

Windows 2000 Professional

Windows NT %d.%d

Windows 2008

%s %s Server

Windows 2003 Server Datacenter

Windows 2003 Server Enterprise

Windows 2003 Server Web Edition

Windows 2003 Server

Windows Home Server

Windows 2003 Server (Release 2)

Windows 2000 Server Datacenter

Windows 2000 Server Enterprise

Windows 2000 Server Web Edition

Windows 2000 Server

Windows NT 4.0 Server Datacenter

Windows NT 4.0 Server Enterprise

Windows NT 4.0 Server Web Edition

Windows NT 4.0 Server

Unknown Platform ID (%d)

%d.%d

%s (Build: %d

- Service Pack: %s

KERNEL32.DLL

teste.vbs

teste.txt

Set objSecurityCenter = GetObject("winmgmts:\\.\root\SecurityCenter")

Set colFirewall = objSecurityCenter.ExecQuery("Select * From FirewallProduct",,48)

Set colAntiVirus = objSecurityCenter.ExecQuery("Select * From AntiVirusProduct",,48)

Set objFileSystem = CreateObject("Scripting.fileSystemObject")

Set objFile = objFileSystem.CreateTextFile("

Info = Info & "F" & CountFw & ") " & objFirewall.displayName & " v" & objFirewall.versionNumber & Enter

Info = Info & "A" & CountAV & ") " & objAntiVirus.displayName & " v" & objAntiVirus.versionNumber & Enter

objFile.WriteLine(Info)

objFile.Close

cscript.exe

AVICAP32.dll

tFtpAccess

BuildImportTable: can't load library:

BuildImportTable: ReallocMemory failed

BuildImportTable: GetProcAddress failed

BTMemoryLoadLibary: BuildImportTable failed

BTMemoryGetProcAddress: no export table found

BTMemoryGetProcAddress: DLL doesn't export anything

BTMemoryGetProcAddress: exported symbol not found

SetupApi.dll

SetupDiOpenClassRegKey

SetupDiOpenClassRegKeyExA

SetupDiOpenClassRegKeyExW

SetupDiCreateDeviceInterfaceRegKeyA

SetupDiCreateDeviceInterfaceRegKeyW

SetupDiOpenDeviceInterfaceRegKey

SetupDiDeleteDeviceInterfaceRegKey

SetupDiCreateDevRegKeyA

SetupDiCreateDevRegKeyW

SetupDiOpenDevRegKey

SetupDiDeleteDevRegKey

CM_DEVCAP_LOCKSUPPORTED

CM_DEVCAP_EJECTSUPPORTED

PDCAP_D0_SUPPORTED

PDCAP_D1_SUPPORTED

PDCAP_D2_SUPPORTED

PDCAP_D3_SUPPORTED

PDCAP_WAKE_FROM_D0_SUPPORTED

PDCAP_WAKE_FROM_D1_SUPPORTED

PDCAP_WAKE_FROM_D2_SUPPORTED

PDCAP_WAKE_FROM_D3_SUPPORTED

PDCAP_WARM_EJECT_SUPPORTED

HKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

127.0.0.1

iphlpapi.dll

AllocateAndGetTcpExTableFromStack

AllocateAndGetUdpExTableFromStack

SetTcpEntry

GetExtendedTcpTable

GetExtendedUdpTable

Mozilla3_5Password

GetChromePass

StartHttpProxy

1.2.3

XxX.xXx

UuU.uUu

keyboardkey

webcaminactive

webcamgetbuffer

webcam

enviarexecnormal

enviarexechidden

openweb

downexec

sendftp

keylogger

keyloggergetlog

keyloggereraselog

keyloggerativar

keyloggerdesativar

renamekey

windowsfechar

windowsmax

windowsmin

windowsmostrar

windowsocultar

windowsmintodas

windowscaption

listarportas

listarportasdns

finalizarprocessoportas

webcamsettings

chatmsg

getpassword

updateservidorweb

keyloggersearch

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

PSAPI.dll

\config\SteamAppData.vdf

AutoLoginUser

/ClientRegistry.Blob

\ClientRegistry.blob

\steam.dll

%SYS%

ÞSKTOP%

TThreadSearch`%D

FirstExecution

chatmsg|

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

listarjanelas|windowsfechar|

listarjanelas|windowsmax|

listarjanelas|windowsmin|

listarjanelas|windowsmostrar|

listarjanelas|windowsocultar|

listarjanelas|windowsmintodas|

listarjanelas|windowscaption|

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

listarportas|listadeportaspronta|

listarportas|finalizarconexao|

listarportas|finalizarprocessoportas|Y|

listarportas|finalizarprocessoportas|N|

registro|renamekey|

keylogger|keylogger|keyloggerativar|

keylogger|keylogger|keyloggerdesativar|

keylogger|keyloggergetlog|

keylogger|keylogger|keyloggervazio|

keyloggersearchok|

webcam|webcaminactive|

webcam|webcamactive|

_x_X_PASSWORDLIST_X_x_

NOIP.abc

MSN.abc

FIREFOX.abc

IELOGIN.abc

IEPASS.abc

IEAUTO.abc

IEWEB.abc

SOFTWARE\Mozilla\Mozilla Firefox

getfirefox

getielogin

getiepass

getieweb

getchrome

getpassword|getpasswordlist|

getpassword|getpassworderror|

##@@## ##@@## ##@@##

Windows\CurrentVersion\Uninstall\eDonkey2000

UNWISE.EXE

ntdll.dll

icon=shell32.dll,4

shellexecute=

autorun.inf

XX--XX--XX.txt

logs.dat

SQLite3.dll

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

inflate 1.2.3 Copyright 1995-2005 Mark Adler

)ju2.iu

GetProcessHeap

user32.dll

advapi32.dll

RegOpenKeyExA

RegCloseKey

oleaut32.dll

RegOpenKeyA

RegEnumKeyExA

RegDeleteKeyA

RegCreateKeyA

WinExec

SetNamedPipeHandleState

CreatePipe

mpr.dll

gdi32.dll

keybd_event

MapVirtualKeyA

GetKeyboardState

GetKeyboardLayoutNameA

GetKeyState

GetAsyncKeyState

ExitWindowsEx

EnumWindows

wininet.dll

FtpGetFileSize

FtpSetCurrentDirectoryA

FtpOpenFileA

wsock32.dll

ole32.dll

gdiplus.dll

GdiplusShutdown

AVICAP32.DLL

winmm.dll

powrprof.dll

msacm32.dll

ADVAPI32.DLL

7-727:7?7

4.4 5=5`5|5 6

> >$>(>,>

>'>3><>]>}>

040=0^0~0

2 2/2]2}2

:$:6:^:~:

; ;%;-;5;

KWindows

UnitExecutarComandos

uftp

UrlMon

.UnitBytesSize

UnitListarPortasAtivas

UnitWebcam

UnitKeylogger

System.exe_1620_rwx_00401000_00112000:

Portions Copyright (c) 1999,2003 Avenger by NhT

####@####

kernel32.dll

VBoxService.exe

SbieDll.dll

dbghelp.dll

Software\Microsoft\Windows\CurrentVersion

55274-640-2673064-23950

76487-644-3177037-23510

76487-337-8429955-22614

\\.\Syser

\\.\SyserDbgMsg

\\.\SyserBoot

\\.\SICE

\\.\NTICE

ShellExecuteA

shell32.dll

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

GetWindowsDirectoryA

SOFTWARE\Microsoft\Windows\CurrentVersion

http\shell\open\command

\Internet Explorer\iexplore.exe

PSAPI.dll

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Software\Microsoft\Windows\CurrentVersion\Run

Microsoft\Network\Connections\pbk\rasphone.pbk

rasapi32.dll

rnaph.dll

RAS Passwords |

uURLHistory

Password:

abe2869f-9b47-4cd9-a358-c22904dba7f7

Password

UnitPasswords

advapi32.dll

WindowsLive:name=*

xxxyyyzzz.dat

\Mozilla Firefox\

mozcrt19.dll

sqlite3.dll

nspr4.dll

plc4.dll

plds4.dll

nssutil3.dll

softokn3.dll

nss3.dll

PK11_GetInternalKeySlot

userenv.dll

\Mozilla\Firefox\

profiles.ini

\signons3.txt

\signons2.txt

\signons1.txt

\signons.txt

(unnamed password)

explorer.exe

_x_X_PASSWORDLIST_X_x_

NOIP.abc

MSN.abc

FIREFOX.abc

IELOGIN.abc

IEPASS.abc

IEAUTO.abc

IEWEB.abc

XX--XX--XX.txt

?456789:;<=

!"#$%&'()* ,-./0123

hu2.iu

.j.Hm_j

KWindows

KuURLHistory

IEpasswords

####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@#### ####@####

####@#### ####@####

####@#### ####@#### ####@#### ####@####

####@#### ####@#### ####@####

w}-cL}

XhDq.Tu

.Iu|$p

1dH0z.MNJ2

!id%9X%

kp.vK

.ClT(8

'.WH*

@.sp&

%XAWW

m.Pm=

pn.Kqz!

h%X:y

LH.dbL-.

%D=\ptu

*v.Cw

geV%FZq

%c)*L9

t`.Ju

uT.dCC7

TRÌU

TuÌU

ÌUZ

ÌU}

T_Ì

T%Ì

TB.CCU6

Te.CCU

T3.CCU

.CCUJ

.CCUm

TO.CC

Tr.CC

T8.CC

7o.TW

7o.Tq

T.CCC7d7

T.FCC8|

T.ICC

T.GCC

@T.HAC

TB.AC

TS.AC

T\.AC

Tm.AC

T~.AC

TX.AC{

T%S@CC

T%X@C

T.SCC79

|T.DCC1

D.TbGCC5

GetProcessHeap

RegOpenKeyExA

RegDeleteKeyA

RegCreateKeyExA

RegCreateKeyA

RegCloseKey

SetWindowsHookExA

GetKeyboardState

.idata

.rdata

P.reloc

P.rsrc

Zx....RhJXBH:

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:1796
   chrome.exe:3508
   

2. Delete the original Generic file.
   
3. Delete or disinfect the following files created/modified by the Generic:
   

   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\XX--XX--XX.txt (603 bytes)
   C:\Windows\System32\winrm\out\out\System.exe (5441 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\logs.dat (15 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat (80 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UuU.uUu (32 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\XxX.xXx (13600 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "Windows Defender" = "C:\Windows\System32\winrm\out\out\System.exe"
   
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "Audio do Windows" = "C:\Windows\System32\winrm\out\out\System.exe"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
   
7. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.