Win32.Ramnit.N_55f59b0194

by malwarelabrobot on March 31st, 2017 in Malware Descriptions.

HEUR:Trojan-Downloader.Script.Generic (Kaspersky), Win32.Ramnit.N (B) (Emsisoft), Win32.Ramnit.N (AdAware), Trojan.Win32.Delphi.FD, Trojan.Win32.Sasfis.FD, Trojan.Win32.Swrort.3.FD, VirTool.Win32.DelfInject.FD, GenericAutorunWorm.YR, GenericInjector.YR (Lavasoft MAS)
Behaviour: Trojan-Downloader, Trojan, Worm, VirTool, WormAutorun


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 55f59b0194d97d3bda3a864618b0c75c
SHA1: bca1e5c325bff8690b68344711edbae30c611546
SHA256: 321580f338332704de83c01b81adac8ff2be53f120504e731c8851dcfd287162
SSDeep: 49152:wnsHyjtk2MYC5GDS2028gxOYbBkzzpn4vd5HgH4cXUe qrNEF5iuB6cGwTwiaksf:wnsmtk2a5w8gxOYbBkBnW5HgH4cEezrn
Size: 3027968 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6, BorlandDelphi30, BorlandDelphiv30, ACProtect141
Company: no certificate found
Created at: 1992-06-20 01:22:17
Analyzed on: Windows7 SP1 32-bit


Summary:

Trojan-Downloader. Trojan program, which downloads files from the Internet without user's notice and executes them.

Payload

Behaviour Description
WormAutorun A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.


Process activity

The Trojan creates the following process(es):

%original file name%.exe:3404
._cache_55f59b0194d97d3bda3a864618b0c75cSrv.exe:3396

The Trojan injects its code into the following process(es):

chrome.exe:160
chrome.exe:3712
._cache_%original file name%.exe:3388
Synaptics.exe:2948
iexplore.exe:264
iexplore.exe:1480
csrss.exe:320
wininit.exe:360
csrss.exe:368
winlogon.exe:416
services.exe:460
lsass.exe:468
lsm.exe:476
svchost.exe:580
svchost.exe:648
svchost.exe:700
svchost.exe:824
svchost.exe:864
taskhost.exe:872
svchost.exe:1048
svchost.exe:1156
spoolsv.exe:1244
svchost.exe:1280
Dwm.exe:1376
Explorer.EXE:1440
wmiprvse.exe:1468
conhost.exe:1648
TPAutoConnSvc.exe:1676
svchost.exe:1732
TPAutoConnect.exe:2160
conhost.exe:2168
SearchIndexer.exe:2228
taskhost.exe:2496
svchost.exe:2560
sppsvc.exe:3244

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:3404 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Windows\System32\config\SOFTWARE (39650 bytes)
C:\ (4 bytes)
C:\ProgramData\Synaptics\Synaptics.exe (22350 bytes)
C:\$Directory (96 bytes)
C:\Windows\System32\config\SOFTWARE.LOG1 (34247 bytes)
C:\ProgramData\Synaptics\RCX1C84.tmp (136247 bytes)

The process chrome.exe:160 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\Google\Chrome\Application\dmlconf.dat (48 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat (80 bytes)

The process ._cache_%original file name%.exe:3388 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

The process ._cache_55f59b0194d97d3bda3a864618b0c75cSrv.exe:3396 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\Microsoft\DesktopLayer.exe (113 bytes)

The Trojan deletes the following file(s):

%Program Files%\Microsoft\px1D40.tmp (0 bytes)

The process Synaptics.exe:2948 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RCX1FB1.tmp (137517 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\29q812mh.exe (5441 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\29q812mh.ico (284 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RCX1F81.tmp (137517 bytes)
C:\Users\"%CurrentUserName%"\Downloads\dotNetFx35setup.exe (25426 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\29q812mh.exe (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\29q812mh.ico (0 bytes)

Registry activity

The process %original file name%.exe:3404 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synaptics Pointing Device Driver" = "C:\ProgramData\Synaptics\Synaptics.exe"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process chrome.exe:160 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Google\Chrome\BLBeacon]
"State" = "2"
"failed_count" = "0"

The Trojan adds the reference to itself to be executed when a user logs on:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"UserInit" = "c:\windows\system32\userinit.exe,,c:\program files\microsoft\desktoplayer.exe"

The process Synaptics.exe:2948 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\Synaptics_RASMANCS]
"MaxFileSize" = "1048576"
"FileDirectory" = "%windir%\tracing"
"EnableFileTracing" = "0"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

[HKLM\SOFTWARE\Microsoft\Tracing\Synaptics_RASMANCS]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD]
"Blob" = "0F 00 00 00 01 00 00 00 20 00 00 00 52 29 BA 15"

[HKLM\SOFTWARE\Microsoft\Tracing\Synaptics_RASAPI32]
"MaxFileSize" = "1048576"
"FileDirectory" = "%windir%\tracing"
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\Synaptics_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3C 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\Synaptics_RASAPI32]
"ConsoleTracingMask" = "4294901760"
"FileTracingMask" = "4294901760"

"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\Synaptics_RASMANCS]
"EnableConsoleTracing" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates]
"D69B561148F01C77C54578C10926DF5B856976AD"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

Dropped PE files

MD5 File path
086da454168653a4a07b9b698441ec60 c:\ProgramData\Synaptics\Synaptics.exe
086da454168653a4a07b9b698441ec60 c:\Users\All Users\Synaptics\Synaptics.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

VersionInfo

Company Name: Synaptics
Product Name: Synaptics Pointing Device Driver
Product Version: 1.0.0.0
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.4
File Description: Synaptics Pointing Device Driver
Comments:
Language: Language Neutral

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
CODE 4096 629740 629760 4.55603 33fbe30e8a64654287edd1bf05ae7c8c
DATA 634880 11860 12288 3.36497 1f5e19e7d20c1d128443d738ac7bc610
BSS 647168 4581 0 0 d41d8cd98f00b204e9800998ecf8427e
.idata 655360 10818 11264 3.40982 21ff53180b390dc06e3a1adf0e57a073
.tls 667648 16 0 0 d41d8cd98f00b204e9800998ecf8427e
.rdata 671744 57 512 0.543857 a92cf494c617731a527994013429ad97
.reloc 675840 43392 43520 4.62615 dcd1b1c3f3d28d444920211170d1e8e6
.rsrc 720896 2329232 2329600 4.69325 bf78cb1488532d3b5f21684a7c78095b

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 50.23.197.94
tvrstrynyvwstrtve.com 109.74.196.143
google.com 172.217.20.174
fget-career.com 89.185.44.100
docs.google.com 172.217.20.174
xred.mooo.com 195.155.220.220
dns.msftncsi.com 131.107.255.255
supnewdmn.com 89.223.109.60
rtvwerjyuver.com


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET TROJAN Win32/Ramnit Checkin
ET MALWARE ISearchTech.com XXXPornToolbar Activity (MyApp)

Traffic

GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1
User-Agent: MyApp
Host: freedns.afraid.org
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Mar 2017 14:22:15 GMT
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Cache: MISS
77..xred.mooo.com|195.155.220.220|hXXp://freedns.afraid.org/dynamic/up
date.php?bUxTREVRbG1pZlBtWWg0V0lqWmVESm43OjEyOTUxNjgz..0..HTTP/1.1 200
 OK..Server: nginx..Date: Thu, 30 Mar 2017 14:22:15 GMT..Content-Type:
 text/plain; charset=utf-8..Transfer-Encoding: chunked..Connection: ke
ep-alive..Vary: Accept-Encoding..X-Cache: MISS..77..xred.mooo.com|195.
155.220.220|hXXp://freedns.afraid.org/dynamic/update.php?bUxTREVRbG1pZ
lBtWWg0V0lqWmVESm43OjEyOTUxNjgz..0..

The Trojan connects to the servers at the folowing location(s):

._cache_%original file name%.exe_3388:

.text
`.rdata
@.data
.rsrc
@.reloc
B.rmnet
u$SShe
@ SSHPWj
t.ht;
j%XtL9E
SSSSh
tWSShW
tl9_ tgSSh
FTCP
t'SShl
tAHt.HHt
FtPW
SSh@B
<SShG
diu2.iu
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl2.cpp
user32.dll
f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
Afx:%p:%x:%p:%p:%p
Afx:%p:%x
commctrl_DragListMsg
CCmdTarget
CNotSupportedException
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Software\Microsoft\Windows\CurrentVersion\Policies\Network
Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32
KERNEL32.DLL
%s%s.dll
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp
lX-X-x-XX-XXXXXX
RegOpenKeyTransactedA
Advapi32.dll
RegCreateKeyTransactedA
RegDeleteKeyTransactedA
comctl32.dll
comdlg32.dll
shell32.dll
CHttpConnection
CHttpFile
hXXp://
HTTP/1.0
Shell32.dll
%s:%x:%x:%x:%x
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp
%sMFCToolBar-%d%x
%sMFCToolBar-%d
%sMFCToolBarParameters
TOOLBAR_RESETKEYBAORD
&%d %s
RegDeleteKeyExA
lXXxXXXXXXXX
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp
CMDITabProxyWnd
CMDIChildWndEx
CMDIFrameWndEx
KeyboardManager
MSG_CHECKEMPTYMINIFRAME
%sDockingManager-%d
MFCLink_UrlPrefix
MFCLink_Url
ole32.dll
%sPane-%d%x
%sPane-%d
%sBasePane-%d%x
%sBasePane-%d
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp
windows
ShowCmd
%c%d%c%s
CMDIChildWnd
CMDIFrameWnd
CMDIClientAreaWnd
%sMDIClientArea-%d
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\viewcore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleipfrm.cpp
Hex={X,X,X}
%sMFCOutlookBar-%d%x
%sMFCOutlookBar-%d
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp
%sDockablePaneAdapter-%d%x
%sDockablePaneAdapter-%d
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledrop2.cpp
CMFCToolBarsKeyboardPropertyPage
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olestrm.cpp
ENABLE_KEYS
KEYS_MENU
KEYS
RGB(%d, %d, %d)
%sMFCTasksPane-%d%x
%sMFCTasksPane-%d
operator
GetProcessWindowStation
c:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\atlmfc\include\afxwin1.inl
%s (%s:%d)
TotalInjector.exe
%s -dontcopy
RF-Cheats.ru:
auth.rf-cheats.ru
/news.txt?%s
RF-Cheats.ru
(*.dll)|*.dll||
*.dll
: %s (%d)
: %d)
ntdll.dll
\\.\pipe\1%d%d%d%d
\\.\pipe\handshake
DLL (%s)
(PID: %d)
(EnumWindows
(.exe/.bin)
EnumWindows(): %d
OpenProcess(): %d .
\TInjector.cfg
LastInfectedProcess=%s
del %s
selfremove.bat
del selfremove.bat
(*.exe)|*.exe||
*.exe
Software\Microsoft\Windows NT\CurrentVersion\Windows
RegOpenKeyEx() error
RegSetValueEx(): %d (
hXXp://VVV.rf-cheats.ru/forum/?TotalInjector
kernel32.dll
K:\MyProjects\hookdll\TotalInjector\Release\TotalInjector.pdb
KERNEL32.dll
PSAPI.DLL
RegOpenKeyExA
RegCloseKey
ADVAPI32.dll
WinExec
GetCPInfo
GetWindowsDirectoryA
GetProcessHeap
EnumWindows
GetKeyNameTextA
MapVirtualKeyA
GetKeyState
UnhookWindowsHookEx
SetWindowsHookExA
CreateDialogIndirectParamA
GetAsyncKeyState
GetKeyboardLayout
GetKeyboardState
MapVirtualKeyExA
USER32.dll
GetViewportExtEx
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
GetViewportOrgEx
GDI32.dll
MSIMG32.dll
COMDLG32.dll
WINSPOOL.DRV
ShellExecuteA
SHELL32.dll
COMCTL32.dll
SHLWAPI.dll
OLEAUT32.dll
GdiplusShutdown
gdiplus.dll
OLEACC.dll
HttpSendRequestA
HttpOpenRequestA
WININET.dll
IMM32.dll
WINMM.dll
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyA
RegEnumKeyExA
.?AVCTestCmdUI@@
.?AVCCmdUI@@
.PAVCUserException@@
.PAVCOleException@@
.PAVCObject@@
.PAVCMemoryException@@
.PAVCSimpleException@@
.PAVCNotSupportedException@@
.PAVCInvalidArgException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCInternetException@@
.?AVCHttpConnection@@
.?AVCHttpFile@@
.PAVCArchiveException@@
.?AVCMFCToolBarCmdUI@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDV12@PBD@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDPAVCDocument@@PAV3@@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD_N_N@@
.?AV?$CMap@PAVCDocument@@PAV1@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@@
.?AVCMDITabProxyWnd@@
.?AVCMDIChildWndEx@@
.?AVCMDIChildWnd@@
.?AVCMDIFrameWndEx@@
.?AVCMDIFrameWnd@@
.PAVCFileException@@
.?AVCMFCCmdUsageCount@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDPAVCObList@@PAV3@@@
.?AV?$CList@PAVCMDIChildWndEx@@PAV1@@@
.?AVCMDIClientAreaWnd@@
.?AVCMFCRibbonCmdUI@@
.?AVCMFCColorBarCmdUI@@
.?AV?$CMap@KKV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@@
.?AVCMFCAcceleratorKey@@
.?AVCMFCToolBarsKeyboardPropertyPage@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDHH@@
.?AVCMFCRibbonKeyTip@@
.?AVCMFCTasksPaneToolBarCmdUI@@
.?AVCMFCAcceleratorKeyAssignCtrl@@
zcÁ
.?AVCCmdTarget@@
.PAVCException@@
D:\._cache_%original file name%.exe
J#%uPR
M-.jJK
ilO"%C
K/.mQPoKKuOOvRRiGGS//?
P..lHHuSSc??A
`36Q"%F
%Z"'S!%F
J"#M"%R#&T"&W"%U!!R
U%$V%'X%)Z(*Z)'Y*&U*'W*&^('`'%c%%a&$Y&$U&"T$"T$ T!
$]%*`$*a#)b&,\& Q%&L$%K#$M#$T""V""X""W##U%$R'$T*%S(%U%$U#%[#(^& _*-b..a.,]*'_(%a(&c*)c)*c(,c(,i  h- e. c. d-*d )h )e*(_(%^)&^)&^)&_(%[(%V)%S &N($P*&S*(S*(S'(T%'U$&V$&U#%T"$S!#Q! Q! O! P# R" U
#T!%U"&X"'[%*^(-\# e*2g 3g 3j.4f,1[&)X&(W%'\'*b)*d* d((e''e''f((d )d *g(*j',l(/o 2n.3n23k//i.,k.,q10v23u03t.4v.4|13}24u34p44m43l32l32m11k//k//m//n..k  f**a *`- a.,b/-a0.a0.^.-]-,^-/_-/\'*_( a()_&']$%[#"[#"\$#[#"\&%Z*(Y,)Z*(]'&g''j&'k&)g&(^((Y)(T('S'&T$#S!!R "N
;=|89{9:}??
Q,.wOPS'(W'&Q! C
SQl34
"[!"["%X#&X')\ -a,/V
N"!P$#U'&Y)(_  a()`!#r35`&'\&&`,,_))f* e)*b()]''V&%U%$V""X""R P
]$%c''i  o/.u34w65y87z98z98z98x87v65s64q42n31m20j1/h1.g0-c. `-*]*'Y&#W$"R
Z -Q"%S$'E
T'$d74Y)'d42wEExEC
89}12~44
9<~48n/1[ )P 'M'%D# <
"N"#T#%c--c* i77
nCFvEG_.0T&%D
N!$Z(,` .a( f* f')f%'h((n,-r01t23s12{78z45z45|67}46z13y02y34z45w34u12q/0o-.n,-o-.o//o//n..m -j) i(*b&'[%%U##T$#W)(b21c//i/0o-/n$(t*.x45z::x88t44y78};<
Q%&T#%S!#T
`'(c-,a *]'&c *f.-f.-g/.b*)\&%X"!V#!V#!S" R!
S!![%%X""[$'^((\%(\((` ._  [&)T""O
D!%D!%>
%X"'Z(,S&)H "U.02
bJJn<@h& h!$g!"c$&`**T()I%%C#$C#$J%'F
k(-x23}24
89}69p/1Y"%S
J#%S -Z .W$(V
"W"%S$&H""@
[%%c//}QP
=Cf! f%.X
z-0}&*
26{/3m&)^!%S
25z),r#&l#%f"#b
;<}9:|:;
;<~;:~:;}:9|98~88
.1~/2}03}03}24{24{15{47
X'%s;:
AAy33v* }12p&*i"%c
2;}08~18
5=~.5v14m.0b)*Y%%U$"U%#Z)'`*)n22w56
["%f /p37w8:{:<};=
I!#K#%F
!N!$J#%D
M!"P$%S'&T('W( O #F
H !K #M"%K #M"%S'(U)*V')T%'R$#Q#"N#&V),_-1b,1a',[
AC|:;s/0k'(j#&i"%f
>={78o)*l#%s*,w,.s(*k!%m&)m -k*,a%&X
d$$j) k)*r-0z67}69w12r .|67
"l$*i& h')e&(e#%f!$j $k!%m)*r01{78}9:|89}78z45w12
b %f#(h& h,4
L,-uIJ}DGj',j $y25l34M
W"õ7M
a!&\!%X
99p .b#%U
W"%X&&Y !l"&
K/.xVVySSxLMs>Ap7:u68};=
$b*/g48[,.zRS\66
;<y/3e#%U
%d&,f&,c %p#*y-1
;;n-,b#%U
#\"'_$([
U-.zKM
#["%X
67~35e#%S
M"%S&)O"%F
m,.r13v57~=?y8:j**e%%c!#^
47w//j$%c
N#&O%&K!"N$%F
J !L$%D
$(o%%X%".
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo><application xmlns="urn:schemas-microsoft-com:asm.v3"><windowsSettings><ms_windowsSettings:dpiAware xmlns:ms_windowsSettings="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings" xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">true</ms_windowsSettings:dpiAware></windowsSettings></application></assembly>PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
01C1Y1n1
303D3P3g3
0{0<1A1\1r1y1
8Œ8l8
: ;1;<;|;
2!2%2)2-292
3%3S3
>">(>4>@>
?!?4?:?@?
2/2O2`2f2l2y2
8 8Œ8^8
9/9]9?:`:
5-686C6V6}6
78o8~8
8Ÿ9L9Z9{9
7-7A7}7
>"? ?8?`?
67
3%3,353@3
1%2S2v2
4 4$4(4,4044484<4
0 0$0(0,000
3$3,383\3|3
7(707<7`7
6 6(606<6`6
8$8,888\8|8
Srv.exe
D:\._cache_55f59b0194d97d3bda3a864618b0c75cSrv.exe
O.Cp}l
OO.sJD
AM6d%X
4ml%F
.pkrd
.DBxA
Xvi%2x
8KeysX
<requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"/></requestedPrivileges>
SHELL32.DLL
USER32.DLL
mgr.exe
D:\._cache_55f59b0194d97d3bda3a864618b0c75cmgr.exe
ukernel32.dll
[Æ1%
..Ju'
X4.HT
G%S$o"G
.na?B
#uR.uH 
.textJ
?`.data
333888{{
.....yn~
.....yn
....yn
accKeyboardShortcut
hhctrl.ocx
WININET.DLL
dwmapi.dll
UxTheme.dll
yDWrite.dll
D2D1.dll
RICHED20.DLL
mscoree.dll
ekernel32.dll
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
RF-Cheats.ru DLL Injector
Total DLL Injector by (c) VVV.RF-Cheats.ru
EnumWindows()
(*.*)
RF-Cheats.ru
(c) RF-Cheats.ru.
106.42.73.61
2528-6142
nedwp.exe

._cache_%original file name%.exe_3388_rwx_00BF4000_0004F000:

Srv.exe
D:\._cache_55f59b0194d97d3bda3a864618b0c75cSrv.exe
kernel32.dll
.rsrc
O.Cp}l
OO.sJD
AM6d%X
4ml%F
.pkrd
.DBxA
Xvi%2x
8KeysX
<requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"/></requestedPrivileges>
KERNEL32.DLL
SHELL32.DLL
USER32.DLL
mgr.exe
D:\._cache_55f59b0194d97d3bda3a864618b0c75cmgr.exe
ukernel32.dll
GetWindowsDirectoryA
[Æ1%
..Ju'
X4.HT
G%S$o"G
.na?B
#uR.uH 
.textJ
?`.data
333888{{
.....yn~
.....yn
....yn
106.42.73.61
2528-6142
nedwp.exe

._cache_%original file name%.exe_3388_rwx_20020000_00001000:

.text
`.rdata
@.data
.reloc

iexplore.exe_264:

.text
`.data
.rsrc
@.reloc
>.uzf
.us;}
IEFRAME.dll
MLANG.dll
iertutil.dll
urlmon.dll
ole32.dll
SHELL32.dll
SHLWAPI.dll
msvcrt.dll
USER32.dll
KERNEL32.dll
ADVAPI32.dll
RegOpenKeyExW
RegCloseKey
GetWindowsDirectoryW
_amsg_exit
_wcmdln
UrlApplySchemeW
PathIsURLW
UrlCanonicalizeW
UrlCreateFromPathW
iexplore.pdb
KEYW
KEYWh
KEYWD
.ENNNG.
a.ry.v
l.igM4
?1%SGf
xh.JW^
.97777"7" " " !
3.... )) 
8888888888888
8888888888
.lPV)
úW1
.ApX/
H.ZAf
ð[U
%s!FK
1YYYY1YY9GEAA=77YRNNNW:.VT1
888777777
Y.hilkRROMLK=C,
..(((($$
3...((((%
3....(.''$
3.2...((((%
33.2....(,'
55323222...
(%&'00443445?
00.,,,4(
000.,,9(
0020..9(
003200;(
(#'( (''''!'!
Microsoft.InternetExplorer.Default
user32.dll
Kernel32.DLL
xfire.exe
wlmail.exe
winamp.exe
waol.exe
sidebar.exe
psocdesigner.exe
np.exe
netscape.exe
netcaptor.exe
neoplanet.exe
msn.exe
mshtmpad.exe
mshta.exe
loader42.exe
infopath.exe
iexplore.exe
iepreview.exe
groove.exe
explorer.exe
dreamweaver.exe
contribute.exe
aol.exe
{28fb17e0-d393-439d-9a21-9474a070473a}
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
DShell32.dll
Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe
Software\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}
"%s" %s
Kernel32.dll
\AppPatch\sysmain.sdb
-extoff go.microsoft.com/fwlink/?LinkId=106323
-extoff go.microsoft.com/fwlink/?LinkId=106322
-extoff go.microsoft.com/fwlink/?LinkId=106320
kernel32.dll
{00000000-0000-0000-0000-000000000000}
\\?\Volume
shell:%s
Imaging_CreateWebPagePreview_Perftrack
Browseui_Tabs_Tearoff_BetweenWindows
Frame_URLEntered
Imaging_CreateWebPagePreview
WS_ExecuteQuery
Shdocvw_BaseBrowser_FireEvent_WindowStateChanged
IdleTask_Execution_Time
9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
IEXPLORE.EXE
Windows
9.00.8112.16421

iexplore.exe_1480:

.text
`.data
.rsrc
@.reloc
>.uzf
.us;}
IEFRAME.dll
MLANG.dll
iertutil.dll
urlmon.dll
ole32.dll
SHELL32.dll
SHLWAPI.dll
msvcrt.dll
USER32.dll
KERNEL32.dll
ADVAPI32.dll
RegOpenKeyExW
RegCloseKey
GetWindowsDirectoryW
_amsg_exit
_wcmdln
UrlApplySchemeW
PathIsURLW
UrlCanonicalizeW
UrlCreateFromPathW
iexplore.pdb
KEYW
KEYWh
KEYWD
.ENNNG.
a.ry.v
l.igM4
?1%SGf
xh.JW^
.97777"7" " " !
3.... )) 
8888888888888
8888888888
.lPV)
úW1
.ApX/
H.ZAf
ð[U
%s!FK
1YYYY1YY9GEAA=77YRNNNW:.VT1
888777777
Y.hilkRROMLK=C,
..(((($$
3...((((%
3....(.''$
3.2...((((%
33.2....(,'
55323222...
(%&'00443445?
00.,,,4(
000.,,9(
0020..9(
003200;(
(#'( (''''!'!
Microsoft.InternetExplorer.Default
user32.dll
Kernel32.DLL
xfire.exe
wlmail.exe
winamp.exe
waol.exe
sidebar.exe
psocdesigner.exe
np.exe
netscape.exe
netcaptor.exe
neoplanet.exe
msn.exe
mshtmpad.exe
mshta.exe
loader42.exe
infopath.exe
iexplore.exe
iepreview.exe
groove.exe
explorer.exe
dreamweaver.exe
contribute.exe
aol.exe
{28fb17e0-d393-439d-9a21-9474a070473a}
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
DShell32.dll
Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe
Software\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}
"%s" %s
Kernel32.dll
\AppPatch\sysmain.sdb
-extoff go.microsoft.com/fwlink/?LinkId=106323
-extoff go.microsoft.com/fwlink/?LinkId=106322
-extoff go.microsoft.com/fwlink/?LinkId=106320
kernel32.dll
{00000000-0000-0000-0000-000000000000}
\\?\Volume
shell:%s
Imaging_CreateWebPagePreview_Perftrack
Browseui_Tabs_Tearoff_BetweenWindows
Frame_URLEntered
Imaging_CreateWebPagePreview
WS_ExecuteQuery
Shdocvw_BaseBrowser_FireEvent_WindowStateChanged
IdleTask_Execution_Time
9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
IEXPLORE.EXE
Windows
9.00.8112.16421

iexplore.exe_264_rwx_00080000_00001000:

wD:\._cache_55f59b0194d97d3bda3a864618b0c75cmgr.exe

iexplore.exe_264_rwx_20010000_0000E000:

.text
.rdata
@.data
.reloc
q:Lmgr.exe
kernel32.dll
GetWindowsDirectoryA

iexplore.exe_1480_rwx_00080000_00001000:

wD:\._cache_55f59b0194d97d3bda3a864618b0c75cmgr.exe

iexplore.exe_1480_rwx_20010000_00001000:

.text
`.rdata
@.data
.reloc

chrome.exe_160:

.text
`.rdata
@.data
.gfids
@.tls
.rsrc
@.reloc
D$,j.Xf
jxh(%C
j.Yf;
_tcPVj@
.PjRW
ole32.dll
POWRPROF.dll
address family not supported
broken pipe
function not supported
inappropriate io control operation
not supported
operation canceled
operation in progress
operation not permitted
operation not supported
operation would block
protocol not supported
InitOnceExecuteOnce
operator
operator ""
?#%X.y
%S#[k
?OLEAUT32.dll
user32.dll
c:\b\build\slave\win-pgo\build\src\chrome\app\chrome_exe_main_win.cc
c:\b\build\slave\win-pgo\build\src\chrome\app\main_dll_loader_win.cc
Failed to load Chrome DLL from
ChromeMain
RelaunchChromeBrowserWithNewCommandLineIfNeeded
Could not find exported function
%s: option `%s' is ambiguous (could be `--%s' or `--%s')
%s: invalid option -- `-%c'
%s: argument required for option `
--%s'
0.8.0
%ls (%s) %s
hXXps://crashpad.chromium.org/
hXXps://crashpad.chromium.org/bug/new
Report %ls bugs to
%s home page: <%s>
%ls: %s
(0x%X)
Error (0x%X) while retrieving error. (0x%X)
PlatformFile.UnknownErrors.Windows
c:\b\build\slave\win-pgo\build\src\base\threading\thread_local_win.cc
0123456789
(flags = 0x%x)
Histogram: %s recorded %d samples
.syzygy
.thunks
Windows NT
Histogram.InconsistentCountHigh
Histogram.InconsistentCountLow
c:\b\build\slave\win-pgo\build\src\base\metrics\persistent_memory_allocator.cc
(%d = %3.1f%%)
UMA.CreatePersistentHistogram.Result
Dictionary keys must be quoted.
Unsupported encoding. JSON must be UTF-8.
Line: %i, column: %i, %s
widevinecdmadapter.dll
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\google_update_settings.cc
Failed to write to application's ClientState key
Removed incremental installer failure key; switching to channel:
Removed multi-install failure key; switching to channel:
CHROME_PROBED_PROGRAM_FILES_PATH
chrome-sxs
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\google_chrome_distribution.cc
iexplore.exe
googlechrome
googlechromeframe
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\channel_info.cc
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\language_selector.cc
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\app_commands.cc
Cannot initialize AppCommands from an invalid key.
Skipping over key "
Failed to open key "
Cannot initialize an AppCommand from an invalid key.
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\app_command.cc
CHROME_MAIN_TICKS
user_experience_metrics.reporting_enabled
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\settings.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\numeric\in_range_cast.h
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc
x-x-x-xx-xxxxxx
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\misc\uuid.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_io.cc
--annotation=KEY=VALUE set a process annotation in each crash report
--database=PATH store the crash report database at PATH
create a new pipe and send its name via HANDLE
--pipe-name=PIPE communicate with the client over PIPE
--url=URL send crash reports to this Breakpad server URL,
pipe-name
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\handler_main.cc
duplicate key
--annotation requires KEY=VALUE
--handshake-handle and --pipe-name are incompatible
--handshake-handle or --pipe-name is required
SetProcessShutdownParameters
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\crash_report_upload_thread.cc
reserved key
FinishedWritingCrashReport failed
PrepareNewCrashReport failed
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\win\crash_report_exception_handler.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_file_writer.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_writer_util.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_writable.cc
%s.%s,%s,%s
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_context_writer.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\process_snapshot_minidump.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_snapshot_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\crashpad_info_client_options.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\minidump_simple_string_dictionary_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\module_snapshot_minidump.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\exception_snapshot_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\module_snapshot_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\system_snapshot_win.cc
%s %d.%d.%d.%s%s
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_reader_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\minidump_string_list_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\capture_memory.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\cpu_context_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_annotations_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_subrange_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_resource_reader.cc
kernel32.dll
c:\b\build\slave\win-pgo\build\src\sandbox\win\src\sandbox_policy_base.cc
NtOpenKey
NtCreateKey
GetCertificateSize
GetCertificate
GetCertificateSizeByHandle
GetCertificateByHandle
SetOPMSigningKeyAndSequenceNumbers
CreateNamedPipeW
NtOpenKeyEx
PruneCrashReportDatabase: Failed to get pending reports
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\prune_crash_reports.cc
PruneCrashReportDatabase: Failed to get completed reports
Database Pruning: Failed to remove report
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\exception_handler_server.cc
::GetNamedPipeClientProcessId
\\.\pipe\crashpad_%d_
ImpersonateNamedPipeClient
ConnectNamedPipe
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\net\http_transport_win.cc
WinHttpCrackUrl
WinHttpConnect
WinHttpOpenRequest
WinHttpCloseHandle
Crashpad/0.8.0
WinHttpOpen
WinHttpSetTimeouts
WinHttpReceiveResponse
WinHttpQueryHeaders
HTTP status %d
WinHttpReadData
WinHttpAddRequestHeaders
WinHttpSendRequest
%%x
--%s%sContent-Disposition: form-data; name="%s"
; filename="%s"%s
Content-Type: %s%s
multipart/form-data; boundary=%s
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\scoped_process_suspend.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_seeker.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\process_info.cc
Reading x64 process from x86 process not supported
0x%llx   0x%llx (%s)
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\module_version.cc
<failed to retrieve error message (0x%x)>
(0xx)
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\scoped_local_alloc.cc
SetNamedPipeHandleState
WaitNamedPipe
TransactNamedPipe: expected
TransactNamedPipe
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\registration_protocol_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\net\http_body.cc
InvokeMainViaCRT
ExitMainViaCRT
Microsoft.CRTProvider
C:\b\build\slave\win-pgo\build\src\out\Release\initialexe\chrome.exe.pdb
.text$di
.text$mn
.text$x
.text$yd
.idata$5
.CRT$XCA
.CRT$XCAA
.CRT$XCC
.CRT$XCL
.CRT$XCU
.CRT$XCZ
.CRT$XIA
.CRT$XIAA
.CRT$XIAC
.CRT$XIC
.CRT$XIZ
.CRT$XLA
.CRT$XLB
.CRT$XLZ
.CRT$XPA
.CRT$XPX
.CRT$XPXA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$T
.rdata$r
.rdata$sxdata
.rdata$zETW0
.rdata$zETW1
.rdata$zETW2
.rdata$zETW9
.rdata$zzzdbg
.rtc$IAA
.rtc$IZZ
.rtc$TAA
.rtc$TZZ
.xdata$x
.didat$2
.didat$3
.didat$4
.didat$6
.didat$7
.edata
.idata$2
.idata$3
.idata$4
.idata$6
.data
.data$r
.didat$5
.gfids$x
.gfids$y
.tls$ZZZ
.rsrc$01
.rsrc$02
chrome.exe
SignalChromeElf
chrome_elf.dll
RegOpenKeyExW
RegEnumKeyExW
RegCreateKeyExW
RegQueryInfoKeyW
RegCloseKey
ADVAPI32.dll
CreateIoCompletionPort
GetWindowsDirectoryW
GetProcessHandleCount
KERNEL32.dll
ShellExecuteExW
SHELL32.dll
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
SetProcessWindowStation
USER32.dll
VERSION.dll
WINMM.dll
WTSAPI32.dll
RPCRT4.dll
GetCPInfo
GetProcessHeap
PeekNamedPipe
DisconnectNamedPipe
WaitNamedPipeW
WINHTTP.dll
.?AU_Crt_new_delete@std@@
a.IDATx
%F?????????3 
ÿFFFFFFFFFFFFFFF?B%
:1----16
Rhgf^rrrr(   ?NOCdhgfrrrr...DlEBScjhg^rr,001k>985Tnhherr-12
:BBBBBBBBBB>>-.jdddcccca
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency><dependency><dependentAssembly><assemblyIdentity type="win32" name="54.0.2840.59" version="54.0.2840.59" language="*"></assemblyIdentity></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"></supportedOS><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"></supportedOS><supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"></supportedOS><supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"></supportedOS><supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"></supportedOS></application></compatibility></assembly>
3 3*363@3
6 6%6-646
-0F3K4U4g4m4r4}4
1$3 303{3
081?1_1?3
4!4%4)4{4
9—9d9
; <0<6<;<
<&=.=6=>=~=
? ?$?(?,?
5 5$5(5,5
5 5$5(5,5054585
9,9094989
< <$<(<,<0<4<
4 4<4@4\4`4|4
5 5<5@5\5`5|5
KERNEL32.DLL
mscoree.dll
ext-ms-win-ntuser-windowstation-l1-1-0
portuguese-brazilian
Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
nchrome_watcher.dll
PreReadChromeChildInBrowser
${windows}
Ndebug.log
\StringFileInfo\xx\%ls
ntdll.dll
shell32.dll
resources.pak
script.log
chrome
pepflashplayer.dll
Browse the web
Software\Microsoft\Windows\CurrentVersion\Uninstall\Chromium
{7D2B3E1D-D096-4594-9D8F-A6667F12E0AC}
{A2DF06F9-A21A-44A8-8A99-8B9C84F29160}
Chrome
chrome_child.dll
chrome.dll
Google Chrome Canary
{4ea16ac7-fd5a-47c3-875b-dbf4a2008c20}
ChromeCanary
Chrome Canary HTML Document
ChromeSSHTM
{1BEAC3E3-B852-44F4-B468-8906C062422E}
{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}
Google Chrome binaries
hXXps://support.google.com/chrome/contact/chromeuninstall3?hl=$1
Google Chrome
%d.%d.%d
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
ChromeHTML
Chrome HTML Document
{8A69D345-D564-463c-AFF1-A69D9E530F96}
{5C65F4B0-3651-4514-B207-D10CB699B14B}
Google Chrome Frame
Chrome in a Frame.
Google\Chrome Frame
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame
{8BA986DA-5100-405E-AA35-86F34A02ACBF}
WebAccessible
-chromeframe
-chrome
lSOFTWARE\Policies\Google\Chrome
reports
settings.dat
ALPC Port
\Sessions\%d\AppContainerNamedObjects\%ls
sHKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_PERFORMANCE_TEXT
HKEY_PERFORMANCE_NLSTEXT
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_CURRENT_CONFIG
HKEY_DYN_DATA
pipe\
egdi32.dll
tntdll.dll
xntdll.dll
Chrome_MessageWindow
Failed to create directory %ls, last error is %d
Chrome SxS\Application
winhttp.dll
54.0.2840.59
chrome_exe

chrome.exe_160_rwx_00190000_00001000:

w%Program Files%\Microsoft\DesktopLayer.exe

chrome.exe_160_rwx_20010000_00009000:

.text
.rdata
@.data
.reloc
Srv.exe
kernel32.dll

chrome.exe_160_rwx_20020000_00001000:

.text
`.rdata
@.data
.reloc

chrome.exe_3712:

.text
`.rdata
@.data
.gfids
@.tls
.rsrc
@.reloc
D$,j.Xf
jxh(%C
j.Yf;
_tcPVj@
.PjRW
ole32.dll
POWRPROF.dll
address family not supported
broken pipe
function not supported
inappropriate io control operation
not supported
operation canceled
operation in progress
operation not permitted
operation not supported
operation would block
protocol not supported
InitOnceExecuteOnce
operator
operator ""
?#%X.y
%S#[k
?OLEAUT32.dll
user32.dll
c:\b\build\slave\win-pgo\build\src\chrome\app\chrome_exe_main_win.cc
c:\b\build\slave\win-pgo\build\src\chrome\app\main_dll_loader_win.cc
Failed to load Chrome DLL from
ChromeMain
RelaunchChromeBrowserWithNewCommandLineIfNeeded
Could not find exported function
%s: option `%s' is ambiguous (could be `--%s' or `--%s')
%s: invalid option -- `-%c'
%s: argument required for option `
--%s'
0.8.0
%ls (%s) %s
hXXps://crashpad.chromium.org/
hXXps://crashpad.chromium.org/bug/new
Report %ls bugs to
%s home page: <%s>
%ls: %s
(0x%X)
Error (0x%X) while retrieving error. (0x%X)
PlatformFile.UnknownErrors.Windows
c:\b\build\slave\win-pgo\build\src\base\threading\thread_local_win.cc
0123456789
(flags = 0x%x)
Histogram: %s recorded %d samples
.syzygy
.thunks
Windows NT
Histogram.InconsistentCountHigh
Histogram.InconsistentCountLow
c:\b\build\slave\win-pgo\build\src\base\metrics\persistent_memory_allocator.cc
(%d = %3.1f%%)
UMA.CreatePersistentHistogram.Result
Dictionary keys must be quoted.
Unsupported encoding. JSON must be UTF-8.
Line: %i, column: %i, %s
widevinecdmadapter.dll
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\google_update_settings.cc
Failed to write to application's ClientState key
Removed incremental installer failure key; switching to channel:
Removed multi-install failure key; switching to channel:
CHROME_PROBED_PROGRAM_FILES_PATH
chrome-sxs
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\google_chrome_distribution.cc
iexplore.exe
googlechrome
googlechromeframe
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\channel_info.cc
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\language_selector.cc
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\app_commands.cc
Cannot initialize AppCommands from an invalid key.
Skipping over key "
Failed to open key "
Cannot initialize an AppCommand from an invalid key.
c:\b\build\slave\win-pgo\build\src\chrome\installer\util\app_command.cc
CHROME_MAIN_TICKS
user_experience_metrics.reporting_enabled
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\settings.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\numeric\in_range_cast.h
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc
x-x-x-xx-xxxxxx
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\misc\uuid.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_io.cc
--annotation=KEY=VALUE set a process annotation in each crash report
--database=PATH store the crash report database at PATH
create a new pipe and send its name via HANDLE
--pipe-name=PIPE communicate with the client over PIPE
--url=URL send crash reports to this Breakpad server URL,
pipe-name
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\handler_main.cc
duplicate key
--annotation requires KEY=VALUE
--handshake-handle and --pipe-name are incompatible
--handshake-handle or --pipe-name is required
SetProcessShutdownParameters
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\crash_report_upload_thread.cc
reserved key
FinishedWritingCrashReport failed
PrepareNewCrashReport failed
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\win\crash_report_exception_handler.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_file_writer.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_writer_util.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_writable.cc
%s.%s,%s,%s
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_context_writer.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\process_snapshot_minidump.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_snapshot_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\crashpad_info_client_options.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\minidump_simple_string_dictionary_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\module_snapshot_minidump.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\exception_snapshot_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\module_snapshot_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\system_snapshot_win.cc
%s %d.%d.%d.%s%s
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_reader_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\minidump_string_list_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\capture_memory.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\cpu_context_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_annotations_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_subrange_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_resource_reader.cc
kernel32.dll
c:\b\build\slave\win-pgo\build\src\sandbox\win\src\sandbox_policy_base.cc
NtOpenKey
NtCreateKey
GetCertificateSize
GetCertificate
GetCertificateSizeByHandle
GetCertificateByHandle
SetOPMSigningKeyAndSequenceNumbers
CreateNamedPipeW
NtOpenKeyEx
PruneCrashReportDatabase: Failed to get pending reports
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\prune_crash_reports.cc
PruneCrashReportDatabase: Failed to get completed reports
Database Pruning: Failed to remove report
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\exception_handler_server.cc
::GetNamedPipeClientProcessId
\\.\pipe\crashpad_%d_
ImpersonateNamedPipeClient
ConnectNamedPipe
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_reader.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\net\http_transport_win.cc
WinHttpCrackUrl
WinHttpConnect
WinHttpOpenRequest
WinHttpCloseHandle
Crashpad/0.8.0
WinHttpOpen
WinHttpSetTimeouts
WinHttpReceiveResponse
WinHttpQueryHeaders
HTTP status %d
WinHttpReadData
WinHttpAddRequestHeaders
WinHttpSendRequest
%%x
--%s%sContent-Disposition: form-data; name="%s"
; filename="%s"%s
Content-Type: %s%s
multipart/form-data; boundary=%s
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\scoped_process_suspend.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_seeker.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\process_info.cc
Reading x64 process from x86 process not supported
0x%llx   0x%llx (%s)
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\module_version.cc
<failed to retrieve error message (0x%x)>
(0xx)
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\scoped_local_alloc.cc
SetNamedPipeHandleState
WaitNamedPipe
TransactNamedPipe: expected
TransactNamedPipe
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\registration_protocol_win.cc
c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\net\http_body.cc
InvokeMainViaCRT
ExitMainViaCRT
Microsoft.CRTProvider
C:\b\build\slave\win-pgo\build\src\out\Release\initialexe\chrome.exe.pdb
.text$di
.text$mn
.text$x
.text$yd
.idata$5
.CRT$XCA
.CRT$XCAA
.CRT$XCC
.CRT$XCL
.CRT$XCU
.CRT$XCZ
.CRT$XIA
.CRT$XIAA
.CRT$XIAC
.CRT$XIC
.CRT$XIZ
.CRT$XLA
.CRT$XLB
.CRT$XLZ
.CRT$XPA
.CRT$XPX
.CRT$XPXA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$T
.rdata$r
.rdata$sxdata
.rdata$zETW0
.rdata$zETW1
.rdata$zETW2
.rdata$zETW9
.rdata$zzzdbg
.rtc$IAA
.rtc$IZZ
.rtc$TAA
.rtc$TZZ
.xdata$x
.didat$2
.didat$3
.didat$4
.didat$6
.didat$7
.edata
.idata$2
.idata$3
.idata$4
.idata$6
.data
.data$r
.didat$5
.gfids$x
.gfids$y
.tls$ZZZ
.rsrc$01
.rsrc$02
chrome.exe
SignalChromeElf
chrome_elf.dll
RegOpenKeyExW
RegEnumKeyExW
RegCreateKeyExW
RegQueryInfoKeyW
RegCloseKey
ADVAPI32.dll
CreateIoCompletionPort
GetWindowsDirectoryW
GetProcessHandleCount
KERNEL32.dll
ShellExecuteExW
SHELL32.dll
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
SetProcessWindowStation
USER32.dll
VERSION.dll
WINMM.dll
WTSAPI32.dll
RPCRT4.dll
GetCPInfo
GetProcessHeap
PeekNamedPipe
DisconnectNamedPipe
WaitNamedPipeW
WINHTTP.dll
.?AU_Crt_new_delete@std@@
a.IDATx
%F?????????3 
ÿFFFFFFFFFFFFFFF?B%
:1----16
Rhgf^rrrr(   ?NOCdhgfrrrr...DlEBScjhg^rr,001k>985Tnhherr-12
:BBBBBBBBBB>>-.jdddcccca
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency><dependency><dependentAssembly><assemblyIdentity type="win32" name="54.0.2840.59" version="54.0.2840.59" language="*"></assemblyIdentity></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"></supportedOS><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"></supportedOS><supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"></supportedOS><supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"></supportedOS><supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"></supportedOS></application></compatibility></assembly>
3 3*363@3
6 6%6-646
-0F3K4U4g4m4r4}4
1$3 303{3
081?1_1?3
4!4%4)4{4
9—9d9
; <0<6<;<
<&=.=6=>=~=
? ?$?(?,?
5 5$5(5,5
5 5$5(5,5054585
9,9094989
< <$<(<,<0<4<
4 4<4@4\4`4|4
5 5<5@5\5`5|5
KERNEL32.DLL
mscoree.dll
ext-ms-win-ntuser-windowstation-l1-1-0
portuguese-brazilian
Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
nchrome_watcher.dll
PreReadChromeChildInBrowser
${windows}
Ndebug.log
\StringFileInfo\xx\%ls
ntdll.dll
shell32.dll
resources.pak
script.log
chrome
pepflashplayer.dll
Browse the web
Software\Microsoft\Windows\CurrentVersion\Uninstall\Chromium
{7D2B3E1D-D096-4594-9D8F-A6667F12E0AC}
{A2DF06F9-A21A-44A8-8A99-8B9C84F29160}
Chrome
chrome_child.dll
chrome.dll
Google Chrome Canary
{4ea16ac7-fd5a-47c3-875b-dbf4a2008c20}
ChromeCanary
Chrome Canary HTML Document
ChromeSSHTM
{1BEAC3E3-B852-44F4-B468-8906C062422E}
{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}
Google Chrome binaries
hXXps://support.google.com/chrome/contact/chromeuninstall3?hl=$1
Google Chrome
%d.%d.%d
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
ChromeHTML
Chrome HTML Document
{8A69D345-D564-463c-AFF1-A69D9E530F96}
{5C65F4B0-3651-4514-B207-D10CB699B14B}
Google Chrome Frame
Chrome in a Frame.
Google\Chrome Frame
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame
{8BA986DA-5100-405E-AA35-86F34A02ACBF}
WebAccessible
-chromeframe
-chrome
lSOFTWARE\Policies\Google\Chrome
reports
settings.dat
ALPC Port
\Sessions\%d\AppContainerNamedObjects\%ls
sHKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_PERFORMANCE_TEXT
HKEY_PERFORMANCE_NLSTEXT
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_CURRENT_CONFIG
HKEY_DYN_DATA
pipe\
egdi32.dll
tntdll.dll
xntdll.dll
Chrome_MessageWindow
Failed to create directory %ls, last error is %d
Chrome SxS\Application
winhttp.dll
%Program Files%\Google\Chrome\Application\chrome.exe
54.0.2840.59
chrome_exe

chrome.exe_3712_rwx_20020000_00001000:

.text
`.rdata
@.data
.reloc

Synaptics.exe_2948:

.idata
.rdata
P.reloc
P.rsrc
kernel32.dll
Windows
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
EVariantBadIndexError
ssShift
htKeyword
EInvalidOperation
u%CNu
%s[%d]
%s_%d
EInvalidGraphicOperation
USER32.DLL
comctl32.dll
uxtheme.dll
MAPI32.DLL
Uh=%C
ssHorizontal
OnKeyDowntgC
OnKeyPress(gC
OnKeyUpLfC
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
JumpID("","%s")
TKeyEvent
TKeyPressEvent
HelpKeyword
crSQLWait
%s (%s)
imm32.dll
AutoHotkeys
AutoHotkeys<
ssHotTrack
TWindowState
poProportional
TWMKey
KeyPreview
WindowState
tagMSG
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
vcltest3.dll
User32.dll
OnActionExecute
TOrtusShellFolder
TOrtusShellSpecialFolder
OrtusShellGlobal
*TOrtusShellChangeNotifierAssocChangedEvent
(TOrtusShellChangeNotifierAttributesEvent
$TOrtusShellChangeNotifierCreateEvent
$TOrtusShellChangeNotifierDeleteEvent
&TOrtusShellChangeNotifierDriveAddEvent
)TOrtusShellChangeNotifierDriveAddGUIEvent
*TOrtusShellChangeNotifierDriveRemovedEvent
'TOrtusShellChangeNotifierFreeSpaceEvent
 TOrtusShellChangeNotifierMediaInsertedEvent
*TOrtusShellChangeNotifierMediaRemovedEvent
#TOrtusShellChangeNotifierMkDirEvent
&TOrtusShellChangeNotifierNetShareEvent
(TOrtusShellChangeNotifierNetUnshareEvent
*TOrtusShellChangeNotifierRenameFolderEvent
(TOrtusShellChangeNotifierRenameItemEvent
#TOrtusShellChangeNotifierRmDirEvent
.TOrtusShellChangeNotifierServerDisconnectEvent
'TOrtusShellChangeNotifierUpdateDirEvent
)TOrtusShellChangeNotifierUpdateImageEvent
(TOrtusShellChangeNotifierUpdateItemEvent
TOrtusShellChangeNotifierItem
TCustomOrtusShellChangeNotifier
OrtusShellChangeNotifier
TOrtusShellChangeNotifierFolder
TOrtusShellChangeNotifierFolders
TOrtusShellChangeNotifier
MsgId_OrtusShellChangeNotifier
SHELL32.DLL
Unknown (Windows
shell32.dll
{374DE290-123F-4565-9164-39C4925E467B}
Software\Microsoft\Windows\CurrentVersion\Run
\StringFileInfo\%0.4x%0.4x\%s
cmd.exe /C
00-00-00-00-00-00
Uh.ZG
$000000.tmp
ole32.dll
Excel.Application
.xlsm
getservbyport
WSAAsyncGetServByPort
WSAJoinLeaf
WS2_32.DLL
127.0.0.1
TIdSocketListWindows
TIdStackWindowsU
IdStackWindows
%s, %d %s %d %s %s
ftpTransfer
ftpReady
ftpAborted
ClientPortMin<
ClientPortMax
Port
EIdCanNotBindPortInRange
EIdInvalidPortRangeSVW
saUsernamePassword
Password<
0.0.0.1
TIdTCPStream
End of stream: %s at %d
TIdTCPConnection
TIdTCPConnectiond!H
IdTCPConnection
EIdTCPConnectionError
EIdObjectTypeNotSupported
TIdTCPClient
TIdTCPClient`CH
IdTCPClient
BoundPort
PortU
%s <%s>
=?WINDOWS
Indy 9.00.10
atLogin
IdSMTP
TIdSMTP
Password
AUTH LOGIN
LOGIN
libeay32.dll
ssleay32.dll
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_certificate_file
SSL_get_peer_certificate
SSL_CTX_set_default_passwd_cb
SSL_CTX_set_default_passwd_cb_userdata
SSL_CTX_check_private_key
X509_STORE_CTX_get_current_cert
des_set_key
sslvrfFailIfNoPeerCert
TPasswordEvent
Certificate
RootCertFile
CertFile
KeyFile<
OnGetPassword
EIdOSSLLoadingRootCertError
EIdOSSLLoadingCertErrorl'I
EIdOSSLLoadingKeyError
TRootKey
RootKey
MonitoredKey
WatchSubKeys
\libeay32.dll
\ssleay32.dll
\SSLLibrary.ddl
afraid.org/api
GetCMDAccess
Synaptics.exe
Synaptics.dll
.xlsx
smtp.gmail.com
ShellExecute=
autorun.inf
PORT
EXEURL1
cachex.ini
xred.mooo.com
hXXp://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
INIURL1
hXXps://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
INIURL2
hXXps://VVV.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
INIURL3
hXXp://xred.site50.net/syn/SUpdate.ini
hXXps://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
EXEURL2
hXXps://VVV.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
EXEURL3
hXXp://xred.site50.net/syn/Synaptics.rar
SSLURL1
hXXps://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
SSLURL2
hXXps://VVV.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
SSLURL3
hXXp://xred.site50.net/syn/SSLLibrary.dll
xredline2@gmail.com;xredline3@gmail.com
PASSWORD
xredline1@gmail.com
KEYBOARDHOOK
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
TCP Client -> Aktif
TCP Client -> Pasif
Keyboard Hook -> Active
Keyboard Hook -> Deactive
#!V!W!"!&!r%!%#%%%'%)%c%e%g%C%<!"%$%&%(%*% %-%/%1%3%5%7%9%;$=%?%A%D%F%H%J%K%L%M%N%O%R%U%X%[%^%_%`%a%b%d%f%h%i%j%k%l%m%o%s% !,!
P%S%V%Y%\%
?456789:;<=
!"#$%&'()* ,-./0123
!"#$%&'()* ,-./0123456789:;<=>?
&'()* ,-./0123456789:;<=>?
1iu2.iu
user32.dll
GetKeyboardType
advapi32.dll
RegOpenKeyExA
RegCloseKey
RegNotifyChangeKeyValue
RegFlushKey
RegCreateKeyExA
GetCPInfo
CreatePipe
version.dll
gdi32.dll
SetViewportOrgEx
UnhookWindowsHookEx
SetWindowsHookExA
MsgWaitForMultipleObjects
MapVirtualKeyExA
MapVirtualKeyA
LoadKeyboardLayoutA
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextA
EnumWindows
EnumThreadWindows
ActivateKeyboardLayout
ShellExecuteExA
wininet.dll
InternetOpenUrlA
wsock32.dll
netapi32.dll
; ;$;(;,;0;4;8;<;@;
3"3*323:3
? ?$?(?,?0?4?8?<?@?`?
= =$=(=<=
8#8'8 8/83888
8,9094989<9
:#:': :/:4:
:|;5<:<?=
7 8$8(8,8
8)9-91989
9-:1:5:<:
:2;6;:;@;
2 2$2(2,20282`2
8(8-858`8
3 3$3(3,3034383<3\3|3
9 9$929|9
5_5K5b5
333333333333333333
33333833
3333339
3333333333333338
:*"*"$3338
3333333
33333333
33333333333
3333333333338
33338?383
333333333333
:*3:"$3338
333333333333333
.edata
KBHks.dll
7 7$7,777
KWindows
(OrtusShellChangeNotifier
UrlMon
#IdSMTP
IdTCPStream
 IdTCPServer
Font.Charset
Font.Color
Font.Height
Font.Name
Font.Style
[Content_Types].xml
_rels/.rels
xl/_rels/workbook.xml.rels
xl/workbook.xml
xl/vbaProject.bin
T@:.xx
xl/theme/theme1.xml
xl/styles.xml
xl/worksheets/sheet1.xml
docProps/core.xml
docProps/app.xml
[Content_Types].xmlPK
_rels/.relsPK
xl/_rels/workbook.xml.relsPK
xl/workbook.xmlPK
xl/vbaProject.binPK
xl/theme/theme1.xmlPK
xl/styles.xmlPK
xl/worksheets/sheet1.xmlPK
docProps/core.xmlPK
docProps/app.xmlPK
Error creating SSL context. Could not load root certificate.
Could not load certificate.#Could not load key, check password.
SSL status: "%s"
Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.
Command not supported.
Address type not supported.$Error accepting connection with SSL.
Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.
Operation already in progress.
Socket operation on non-socket.
Protocol not supported.
Socket type not supported."Operation not supported on socket.
Protocol family not supported.0Address family not supported by protocol family.
%s is not a valid service.
Socket Error # %d
Operation would block.
Operation now in progress.
Object type not supported.
No data to read.$Can not bind in port range (%d - %d)
Invalid Port Range (%d - %d)
@ Outside address*Error on call Winsock2 library function %s&Error on loading Winsock2 library (%s)
Resolving hostname %s.
Connecting to %s.
JPEG error #%d
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.4Failed attempting to retrieve time zone information.
File "%s" not found
No help keyword specified.
Alt  Clipboard does not support Icons
Text exceeds memo capacity/Menu '%s' is already being used by another form
No help found for %s#No context-sensitive help installed$No topic-based help system installed
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
Failed to set data for '%s'
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
Property %s does not exist
Thread creation error: %s
Thread Error: %s (%d)
Unsupported clipboard format
Cannot open file "%s". %s
Unable to write to %s
Invalid stream format$''%s'' is not a valid component name
Invalid data type for '%s' List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Failed to get data for '%s'
Ancestor for '%s' not found
Cannot assign a %s to a %s
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
External exception %x
Interface not supported
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
Operation aborted(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
Invalid variant operation
Invalid NULL variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)
Integer overflow Invalid floating point operation
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
!'%s' is not a valid integer value('%s' is not a valid floating point value
'%s' is not a valid date
'%s' is not a valid time!'%s' is not a valid date and time
'%s' is not a valid GUID value!'%s' is not a valid boolean value
I/O error %d
1.0.0.4
1.0.0.0

Synaptics.exe_2948_rwx_20020000_00001000:

.text
`.rdata
@.data
.reloc

csrss.exe_320_rwx_20020000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

csrss.exe_320_rwx_20030000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

csrss.exe_320_rwx_20040000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

csrss.exe_320_rwx_20050000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

csrss.exe_320_rwx_20060000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

csrss.exe_320_rwx_20070000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

csrss.exe_320_rwx_20080000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

csrss.exe_320_rwx_20090000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

csrss.exe_320_rwx_200A0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

csrss.exe_320_rwx_200B0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

csrss.exe_320_rwx_200C0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

csrss.exe_320_rwx_200D0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

csrss.exe_320_rwx_200E0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

csrss.exe_320_rwx_200F0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

wininit.exe_360_rwx_20020000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

wininit.exe_360_rwx_20030000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

wininit.exe_360_rwx_20040000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

wininit.exe_360_rwx_20050000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

wininit.exe_360_rwx_20060000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

wininit.exe_360_rwx_20070000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

wininit.exe_360_rwx_20080000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

wininit.exe_360_rwx_20090000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

wininit.exe_360_rwx_200A0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

wininit.exe_360_rwx_200B0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

wininit.exe_360_rwx_200C0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

wininit.exe_360_rwx_200D0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

wininit.exe_360_rwx_200E0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

wininit.exe_360_rwx_200F0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

csrss.exe_368_rwx_20020000_00001000:

.text
`.rdata
@.data
.reloc

winlogon.exe_416_rwx_20020000_00001000:

.text
`.rdata
@.data
.reloc

services.exe_460_rwx_20020000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

services.exe_460_rwx_20030000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

services.exe_460_rwx_20040000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

services.exe_460_rwx_20050000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

services.exe_460_rwx_20060000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

services.exe_460_rwx_20070000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

services.exe_460_rwx_20080000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

services.exe_460_rwx_20090000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

services.exe_460_rwx_200A0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

services.exe_460_rwx_200B0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

services.exe_460_rwx_200C0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

services.exe_460_rwx_200D0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

services.exe_460_rwx_200E0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

services.exe_460_rwx_200F0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

lsass.exe_468_rwx_20020000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

lsass.exe_468_rwx_20030000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

lsass.exe_468_rwx_20040000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

lsass.exe_468_rwx_20050000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

lsass.exe_468_rwx_20060000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

lsass.exe_468_rwx_20070000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

lsass.exe_468_rwx_20080000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

lsass.exe_468_rwx_20090000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

lsass.exe_468_rwx_200A0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

lsass.exe_468_rwx_200B0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

lsass.exe_468_rwx_200C0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

lsass.exe_468_rwx_200D0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

lsass.exe_468_rwx_200E0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

lsass.exe_468_rwx_200F0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

lsm.exe_476_rwx_20020000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

lsm.exe_476_rwx_20030000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

lsm.exe_476_rwx_20040000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

lsm.exe_476_rwx_20050000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

lsm.exe_476_rwx_20060000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

lsm.exe_476_rwx_20070000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

lsm.exe_476_rwx_20080000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

lsm.exe_476_rwx_20090000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

lsm.exe_476_rwx_200A0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

lsm.exe_476_rwx_200B0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

lsm.exe_476_rwx_200C0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

lsm.exe_476_rwx_200D0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

lsm.exe_476_rwx_200E0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

lsm.exe_476_rwx_200F0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_580_rwx_20020000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_580_rwx_20030000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_580_rwx_20040000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_580_rwx_20050000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_580_rwx_20060000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_580_rwx_20070000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_580_rwx_20080000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_580_rwx_20090000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_580_rwx_200A0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_580_rwx_200B0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_580_rwx_200C0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_580_rwx_200D0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_580_rwx_200E0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_580_rwx_200F0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_648_rwx_20020000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_648_rwx_20030000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_648_rwx_20040000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_648_rwx_20050000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_648_rwx_20060000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_648_rwx_20070000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_648_rwx_20080000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_648_rwx_20090000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_648_rwx_200A0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_648_rwx_200B0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_648_rwx_200C0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_648_rwx_200D0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_648_rwx_200E0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_648_rwx_200F0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_700_rwx_20020000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_700_rwx_20030000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_700_rwx_20040000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_700_rwx_20050000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_700_rwx_20060000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_700_rwx_20070000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_700_rwx_20080000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_700_rwx_20090000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_700_rwx_200A0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_700_rwx_200B0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_700_rwx_200C0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_700_rwx_200D0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_700_rwx_200E0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_700_rwx_200F0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_824_rwx_20020000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_824_rwx_20030000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_824_rwx_20040000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_824_rwx_20050000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_824_rwx_20060000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_824_rwx_20070000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_824_rwx_20080000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_824_rwx_20090000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_824_rwx_200A0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_824_rwx_200B0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_824_rwx_200C0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_824_rwx_200D0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_824_rwx_200E0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_824_rwx_200F0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_864_rwx_20020000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_864_rwx_20030000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_864_rwx_20040000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_864_rwx_20050000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_864_rwx_20060000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_864_rwx_20070000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_864_rwx_20080000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_864_rwx_20090000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_864_rwx_200A0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_864_rwx_200B0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_864_rwx_200C0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_864_rwx_200D0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_864_rwx_200E0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_864_rwx_200F0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

taskhost.exe_872_rwx_20020000_00001000:

.text
`.rdata
@.data
.reloc

svchost.exe_1048_rwx_20020000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1048_rwx_20030000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1048_rwx_20040000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1048_rwx_20050000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1048_rwx_20060000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1048_rwx_20070000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1048_rwx_20080000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1048_rwx_20090000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1048_rwx_200A0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1048_rwx_200B0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1048_rwx_200C0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1048_rwx_200D0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1048_rwx_200E0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1048_rwx_200F0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1156_rwx_20020000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1156_rwx_20030000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1156_rwx_20040000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1156_rwx_20050000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1156_rwx_20060000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1156_rwx_20070000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1156_rwx_20080000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1156_rwx_20090000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1156_rwx_200A0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1156_rwx_200B0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1156_rwx_200C0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1156_rwx_200D0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1156_rwx_200E0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1156_rwx_200F0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

spoolsv.exe_1244_rwx_20020000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

spoolsv.exe_1244_rwx_20030000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

spoolsv.exe_1244_rwx_20040000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

spoolsv.exe_1244_rwx_20050000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

spoolsv.exe_1244_rwx_20060000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

spoolsv.exe_1244_rwx_20070000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

spoolsv.exe_1244_rwx_20080000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

spoolsv.exe_1244_rwx_20090000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

spoolsv.exe_1244_rwx_200A0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

spoolsv.exe_1244_rwx_200B0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

spoolsv.exe_1244_rwx_200C0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

spoolsv.exe_1244_rwx_200D0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

spoolsv.exe_1244_rwx_200E0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

spoolsv.exe_1244_rwx_200F0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1280_rwx_20020000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1280_rwx_20030000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1280_rwx_20040000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1280_rwx_20050000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1280_rwx_20060000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1280_rwx_20070000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1280_rwx_20080000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1280_rwx_20090000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1280_rwx_200A0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1280_rwx_200B0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1280_rwx_200C0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1280_rwx_200D0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1280_rwx_200E0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1280_rwx_200F0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

Dwm.exe_1376_rwx_20020000_00001000:

.text
`.rdata
@.data
.reloc

Explorer.EXE_1440_rwx_20020000_00001000:

.text
`.rdata
@.data
.reloc

wmiprvse.exe_1468_rwx_20020000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

wmiprvse.exe_1468_rwx_20030000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

wmiprvse.exe_1468_rwx_20040000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

wmiprvse.exe_1468_rwx_20050000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

wmiprvse.exe_1468_rwx_20060000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

wmiprvse.exe_1468_rwx_20070000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

wmiprvse.exe_1468_rwx_20080000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

wmiprvse.exe_1468_rwx_20090000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

wmiprvse.exe_1468_rwx_200A0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

wmiprvse.exe_1468_rwx_200B0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

wmiprvse.exe_1468_rwx_200C0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

wmiprvse.exe_1468_rwx_200D0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

wmiprvse.exe_1468_rwx_200E0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

wmiprvse.exe_1468_rwx_200F0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

conhost.exe_1648_rwx_20020000_00001000:

.text
`.rdata
@.data
.reloc

TPAutoConnSvc.exe_1676_rwx_20020000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

TPAutoConnSvc.exe_1676_rwx_20030000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

TPAutoConnSvc.exe_1676_rwx_20040000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

TPAutoConnSvc.exe_1676_rwx_20050000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

TPAutoConnSvc.exe_1676_rwx_20060000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

TPAutoConnSvc.exe_1676_rwx_20070000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

TPAutoConnSvc.exe_1676_rwx_20080000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

TPAutoConnSvc.exe_1676_rwx_20090000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

TPAutoConnSvc.exe_1676_rwx_200A0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

TPAutoConnSvc.exe_1676_rwx_200B0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

TPAutoConnSvc.exe_1676_rwx_200C0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

TPAutoConnSvc.exe_1676_rwx_200D0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

TPAutoConnSvc.exe_1676_rwx_200E0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

TPAutoConnSvc.exe_1676_rwx_200F0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1732_rwx_20020000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1732_rwx_20030000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1732_rwx_20040000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1732_rwx_20050000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1732_rwx_20060000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1732_rwx_20070000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1732_rwx_20080000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1732_rwx_20090000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1732_rwx_200A0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1732_rwx_200B0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1732_rwx_200C0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1732_rwx_200D0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1732_rwx_200E0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_1732_rwx_200F0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

TPAutoConnect.exe_2160_rwx_20020000_00001000:

.text
`.rdata
@.data
.reloc

conhost.exe_2168_rwx_20020000_00001000:

.text
`.rdata
@.data
.reloc

SearchIndexer.exe_2228_rwx_20020000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

SearchIndexer.exe_2228_rwx_20030000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

SearchIndexer.exe_2228_rwx_20040000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

SearchIndexer.exe_2228_rwx_20050000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

SearchIndexer.exe_2228_rwx_20060000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

SearchIndexer.exe_2228_rwx_20070000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

SearchIndexer.exe_2228_rwx_20080000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

SearchIndexer.exe_2228_rwx_20090000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

SearchIndexer.exe_2228_rwx_200A0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

SearchIndexer.exe_2228_rwx_200B0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

SearchIndexer.exe_2228_rwx_200C0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

SearchIndexer.exe_2228_rwx_200D0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

SearchIndexer.exe_2228_rwx_200E0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

SearchIndexer.exe_2228_rwx_200F0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

taskhost.exe_2496_rwx_20020000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

taskhost.exe_2496_rwx_20030000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

taskhost.exe_2496_rwx_20040000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

taskhost.exe_2496_rwx_20050000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

taskhost.exe_2496_rwx_20060000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

taskhost.exe_2496_rwx_20070000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

taskhost.exe_2496_rwx_20080000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

taskhost.exe_2496_rwx_20090000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

taskhost.exe_2496_rwx_200A0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

taskhost.exe_2496_rwx_200B0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

taskhost.exe_2496_rwx_200C0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

taskhost.exe_2496_rwx_200D0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

taskhost.exe_2496_rwx_200E0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

taskhost.exe_2496_rwx_200F0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_2560_rwx_20020000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_2560_rwx_20030000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_2560_rwx_20040000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_2560_rwx_20050000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_2560_rwx_20060000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_2560_rwx_20070000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_2560_rwx_20080000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_2560_rwx_20090000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_2560_rwx_200A0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_2560_rwx_200B0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_2560_rwx_200C0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_2560_rwx_200D0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_2560_rwx_200E0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

svchost.exe_2560_rwx_200F0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

sppsvc.exe_3244_rwx_20020000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

sppsvc.exe_3244_rwx_20030000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

sppsvc.exe_3244_rwx_20040000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

sppsvc.exe_3244_rwx_20050000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

sppsvc.exe_3244_rwx_20060000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

sppsvc.exe_3244_rwx_20070000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

sppsvc.exe_3244_rwx_20080000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

sppsvc.exe_3244_rwx_20090000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

sppsvc.exe_3244_rwx_200A0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

sppsvc.exe_3244_rwx_200B0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

sppsvc.exe_3244_rwx_200C0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

sppsvc.exe_3244_rwx_200D0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

sppsvc.exe_3244_rwx_200E0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>

sppsvc.exe_3244_rwx_200F0000_0000B000:

.text
`.rdata
@.data
.reloc
GetWindowsDirectoryA
kernel32.dll
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
advapi32.dll
ExitWindowsEx
user32.dll
hooker.dll
{X-X-X-X-XX}
ntdll.dll
POSTGETHTTP/*.*
/GET /%s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP/1.x 301 Moved Permanently
Server: Apache/2.2.14
dnsapi.dll
ws2_32.dll
keywords
alluniqASCIIUTF8UNICODE{keyword}<*>


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    %original file name%.exe:3404
    ._cache_55f59b0194d97d3bda3a864618b0c75cSrv.exe:3396

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    C:\Windows\System32\config\SOFTWARE (39650 bytes)
    C:\ProgramData\Synaptics\Synaptics.exe (22350 bytes)
    C:\$Directory (96 bytes)
    C:\Windows\System32\config\SOFTWARE.LOG1 (34247 bytes)
    C:\ProgramData\Synaptics\RCX1C84.tmp (136247 bytes)
    %Program Files%\Google\Chrome\Application\dmlconf.dat (48 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat (80 bytes)
    %Program Files%\Microsoft\DesktopLayer.exe (113 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RCX1FB1.tmp (137517 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\29q812mh.exe (5441 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\29q812mh.ico (284 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RCX1F81.tmp (137517 bytes)
    C:\Users\"%CurrentUserName%"\Downloads\dotNetFx35setup.exe (25426 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Synaptics Pointing Device Driver" = "C:\ProgramData\Synaptics\Synaptics.exe"

  5. Remove the references to the Trojan by modifying the following registry value(s) (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "UserInit" = "c:\windows\system32\userinit.exe,,c:\program files\microsoft\desktoplayer.exe"

  6. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  7. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
  8. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2025 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now