MD5: bd3fb39882817e7f8c738d7a405ee970
SHA1: 0b825aa3ab6d2843881431dd111ba39b19f07ade
SHA256: 232d8951079fabdf7c78b8d13138d4afff8810396164629429aa27827003f235
SSDeep: 49152:wLQzAZuXFePwhZcjC2L6xYE3jINgBwji5IwyGwFRv6usU9Tsn:wLbZ FfZc7OxL32i5ISwFlUiG
Size: 2240717 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6
Company: AirInstaller Inc.
Created at: 2007-08-19 11:31:03
Analyzed on: WindowsXP SP3 32-bit

Summary:

Backdoor. Malware that enables a remote control of victim's machine.

Payload

No specific payload has been found.

Process activity

The Backdoor creates the following process(es):

WScript.exe:640
win7.exe:316

The Backdoor injects its code into the following process(es):

%original file name%.exe:636

File activity

The process %original file name%.exe:636 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\re.txt (735 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\win7.exe (5105568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FP83.tmp (229 bytes)

The process win7.exe:316 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\foxyinstalled.dll (52736 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\LinkMaker.dll (112640 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\Conf\Addresses.cfg (2296 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\win7.exe (5234688 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\win7.vbs (574 bytes)

The Backdoor deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\__tmp_rar_sfx_access_check_2324593 (0 bytes)

Registry activity

The process WScript.exe:640 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8D 68 24 02 F7 84 15 CE 92 C5 49 BB 5E FF B1 C1"

To automatically run itself each time Windows is booted, the Backdoor adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"office" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\RarSFX0\office.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"office" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\RarSFX0\office.exe"

The process %original file name%.exe:636 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "33 90 D8 BA 66 92 01 8B 5B 25 74 19 1C 5C E8 C1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Документы"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Рабочий стол"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91167d45-103d-11db-8c91-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d8c0d8da-77bd-11e0-bb02-000c293bc0fd}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"Win7.exe" = "win7"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91167d42-103d-11db-8c91-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Рабочий стол"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\Мои документы"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ebcf8d94-66db-11de-b228-806d6172696f}]
"BaseClass" = "Drive"

The Backdoor modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Backdoor modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Backdoor modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process win7.exe:316 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CD B2 59 7E DF 9E D0 88 14 2C 4B 5C 08 18 09 66"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Документы"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Рабочий стол"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91167d45-103d-11db-8c91-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d8c0d8da-77bd-11e0-bb02-000c293bc0fd}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91167d42-103d-11db-8c91-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Рабочий стол"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"wscript.exe" = "Microsoft (R) Windows Based Script Host"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\Мои документы"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ebcf8d94-66db-11de-b228-806d6172696f}]
"BaseClass" = "Drive"

The Backdoor modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Backdoor modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Backdoor modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

c168db521c2bd276ca8ea3dabd31e355

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 3
4284fb73d8c89d60b08f4472e5df8efc
e52e0b2d2d341fe6681f1b395a2ff140
882feefa2d6bce352779ca857033919e

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

`.rsrc

ERROR #0027 Wrong password

The password that you typed is not correct.

Password:

This executable is password protected. Please enter the password in the box below.

SOFTWARE\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

Please select or create the folder where you would like to extract the files packed in this executable.

CmdLine

Password needed.

Password

invalid executable code

unzip 1.01 Copyright 1998-2004 Gilles Vollant - http://www.winimage.com/zLibDll

1.2.2

inflate 1.2.2 Copyright 1995-2004 Mark Adler

c:\%original file name%.exe

:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\win7.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

win7.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\win7.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\FP83.tmp

GetWindowsDirectoryA

RegOpenKeyExA

RegCloseKey

ShellExecuteExA

SHFileOperationA

CreateDialogIndirectParamA

.text

`.rdata

@.data

.rsrc

KeydA

name="JvwComputing.|.FilePacker v1.1 for Windows 9x/2000/XP"

version="1.1.0.0"

FilePacker v1.1 for Windows.

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

KERNEL32.DLL

ADVAPI32.dll

COMCTL32.dll

GDI32.dll

ole32.dll

SHELL32.dll

USER32.dll

%original file name%.exe_636_rwx_00401000_00021000:

ERROR #0027 Wrong password

The password that you typed is not correct.

Password:

This executable is password protected. Please enter the password in the box below.

SOFTWARE\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

Please select or create the folder where you would like to extract the files packed in this executable.

CmdLine

Password needed.

Password

invalid executable code

unzip 1.01 Copyright 1998-2004 Gilles Vollant - http://www.winimage.com/zLibDll

1.2.2

inflate 1.2.2 Copyright 1995-2004 Mark Adler

c:\%original file name%.exe

:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\win7.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

win7.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\win7.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\FP83.tmp

GetWindowsDirectoryA

RegOpenKeyExA

RegCloseKey

ShellExecuteExA

SHFileOperationA

CreateDialogIndirectParamA

.text

`.rdata

@.data

.rsrc

KeydA

uedit32.exe_1948:

.text

`.rdata

@.data

.SHARED

.rsrc

SSSSSh

t>SSh

tlSSh

9~l~%S

FtPhz

u.SVj

zv^<_tZ<$tV<#tR<.tN<\tJ
tYSSh
t.WWQP
PPSSSh<
|6SSh
&t.HHt*j
|0SSh
tZSSh
.SVSSSVVSSS
FtPh
~%UUh
P\SSh
%SSSQSSSQSSS
.tTPV
FTPjK
FtPj;
F.PjRWj
?%u#f
u.hxYY
u.WWj
u.VVj
u$SShe
@u.Wj
SSSSh
Bar#%d
MRUDockLeftPos
%s-Summary
%s-Bar%d
hhctrl.ocx
CLSID\{ADB880A6-D8FF-11CF-9377-00AA003B7A11}\InprocServer32
%*.*f
{X-X-X-XX-XXXXXX}
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
COMCTL32.DLL
CCmdTarget
GDI32.DLL
CMDIChildWnd
CMDIFrameWnd
windows
CNotSupportedException
RICHED32.DLL
CTL3D32.DLL
MAPI32.DLL
KERNEL32.DLL
ddeexec
%s\ShellNew
%s\DefaultIcon
%s\shell\printto\%s
%s\shell\print\%s
%s\shell\open\%s
ole32.dll
__MSVCRT_HEAP_SELECT
portuguese-brazilian
IMM32.dll
WS2_32.dll
MPR.dll
TIDYLIB.dll
Sftp_Abort
Sftp_SetAuthentication
Sftp_SetBlocking
Sftp_Create
Sftp_Destroy
Sftp_Disconnect
Sftp_GetState
Sftp_Connect
Sftp_LoadPrivateKey
Sftp_SetPort
Sftp_SetPassword
Sftp_SetLogin
Sftp_SetHostname
Sftp_SetCompression
Sftp_PutFile
Sftp_SetTransferMode
Sftp_GetListItem
Sftp_ListDir
Sftp_GetFile
Sftp_RealPath
Sftp_GetRemotePath
Sftp_SetRemotePath
Sftp_SetAttributes
Sftp_MakeDir
Sftp_Rename
Sftp_DeleteFile
Sftp_RemoveDir
Sftp_GetServerErrorText
Sftp_GetServerErrorCode
Sftp_GetErrorText
SftpDLL.dll
GetWindowsDirectoryA
WinExec
GetCPInfo
CreatePipe
KERNEL32.dll
GetKeyState
MapVirtualKeyA
GetKeyboardState
SetWindowsHookExA
UnhookWindowsHookEx
GetKeyboardLayout
GetAsyncKeyState
SetKeyboardState
CreateDialogIndirectParamA
USER32.dll
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
GetViewportOrgEx
GDI32.dll
comdlg32.dll
WINSPOOL.DRV
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyA
RegCreateKeyA
ADVAPI32.dll
ShellExecuteA
SHFileOperationA
ShellExecuteExA
SHELL32.dll
COMCTL32.dll
oledlg.dll
OLEPRO32.DLL
OLEAUT32.dll
RPCRT4.dll
SHDeleteKeyA
SHLWAPI.dll
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
WININET.dll
ueres.dll
Bitmap Files (*.bmp)|*.bmp|
Unnamed Toolbar No.%d
%s %s%s
W%c %d %s
FTP::
ID_ISENSE_KEYWORDLIST
ID_CVS_EXPORT
ID_CVS_IMPORT
ID_HTML_CMD28
ID_HTML_CMD27
ID_HTML_CMD26
ID_HTML_CMD25
ID_HTML_CMD24
ID_HTML_CMD23
ID_HTML_CMD22
ID_HTML_CMD21
ID_HTML_CMD20
ID_HTML_CMD19
ID_HTML_CMD18
ID_HTML_CMD17
ID_HTML_CMD16
ID_HTML_CMD15
ID_HTML_CMD14
ID_HTML_CMD13
ID_HTML_CMD12
ID_HTML_CMD11
ID_HTML_CMD10
ID_HTML_CMD09
ID_HTML_CMD08
ID_HTML_CMD07
ID_HTML_CMD06
ID_HTML_CMD05
ID_HTML_CMD04
ID_HTML_CMD03
ID_HTML_CMD02
ID_HTML_CMD01
ID_EDIT_HEXEBCDIC
ID_FIX_LEFTPANE
ID_FTP_OPEN
ID_FTP_SAVEAS
ID_KEYA
ID_KEYA_SHIFT
ID_KEYO
ID_KEYO_SHIFT
ID_KEYS
ID_KEYS_SHIFT
ID_KEYU
ID_KEYU_SHIFT
ID_RUNDOSCMD
ID_RUNDOSCMD1
ID_SYNC_WINDOWS
GNU\Aspell\bin\aspell-15.dll
*.tfg
*.mfg
%m.%d.%y
FTP::%s\
%m/%d/%y %H:%M
%s-SCBar-%d
%m/%d/%y, %H:%M
ExportedType
.4.4.4.t35
.2.2.2.2.4.#b.#s.#s.#b
.4.4.4
.4.2.2.2.2.4.#b.#s.#s
.4.2.2.#s.#b.t8
unknown error (%x)
file is not a NET executable !
file is not PE executable !
file is not executable !
#XXX
Image Files (*.gif;*.jpg;*.jpeg;*.bmp;*.png)|*.gif;*.jpg;*.jpeg;*.bmp;*.png||
http://www.w3.org/TR/REC-CSS2
HTML Tidy Config Files (*.txt;*.cfg;*.conf)|*.txt; *.cfg; *.conf||
*.dll
*.HLP; *.CHM
Please install latest version of Aspell for Windows
ignore-X-%s.csv
personal_ws-1.1 %s %d
Project contains one or more FTP files.
This version of Back Up doesn't support FTP files yet. Do you want to continue ?
CCfgKeyBd
Unknown Key
.PAVCFileException@@
Error writing keyboard file
Tool Cmd
*.BMP; *.ICO
GetCPInfoExA
kernel32.dll
BurlyWood
RGB(0x%X, 0x%X, 0x%X)
XXX
RGB(0xx,0xx,0xx)
%s%u%s
%s0xxxx%s
%s#%s%s
All Files (*.*)|*.*|
.vjsproj
.vcproj
.vbproj
.csproj
ues.id
\Microsoft .NET\
winexe
Windows Application
pass32
.\cset.paths
uedit32.ini
UEDIT32.mnu
UEDIT32.tbr
Please download the latest version from www.ultraedit.com
BetaKey
uedit32.reg
%u,%u,%d,%d,%d,%d,%d,%d,%d,%d
Recent Project %d
Compare EXE
Ctag EXE
#2$!*&%$#3(&
mailto:[email protected]
http://www.idmcomp.com
http://www.ultraedit.com
WORDFILE.TXT
TAB Windows Font Height
TAB Windows Font
Extra Windows Font Height
Extra Windows Font
OLD FTP DIR
Skip FTP Connect Close
FindInFiles-Use Windows
-L %fi -f %fo
GNU\ctags.exe
tags.lst
Reload FTP Files
Use Windows Default Dir
NoAutoSaveFTPFiles
File%d
HexEdit
FTPRenameDelete
Cannot load resource dll: ueres.dll, quitting!
uninstal.exe
INSTALL.LOG
.PAVCException@@
sShortDate
ucl.exe
software\microsoft\windows\currentversion\app paths\uc.exe
uediff.exe
uedit32.exe
uedit32.exe "
*.prj
https:
http:
.java:
http://www.ultraedit.com/ue_register.html
%s\IDMComp\%s\%s
Basic.mfg
Basic.tfg
Advanced.tfg
Advanced.mfg
%s\%s\
"{" "(" "[" "<"
"{" "(" "["
"(" "[" "<"
"}" ")" "]" ">"
"}" ")" "]"
")" "]" ">"
""
STYLE_KEYWORD
STYLE_OPERATOR
!$*);^-/
0123456789
!"#$(* ,;01:3)4
]$*);^-/
Cannot create temp file for FTP Save
~atu.tmp
.html
~ue.html
ReportDouble
DOS Execute
Win Execute
MSWHEEL_ROLLMSG
{4e0be4eb-63dc-42a0-9a30-0cb1c39ff6b8}
{02062954-ddc8-424e-bf76-c97e844b1085}
\uedit32v11.cfg
IfFTP
*.TXT
HtmlCommandd
RichEd32.dll
Macro Auto Execute Error
*.EXE; *.COM; *.BAT
*.EXE
command.com
cmd.exe /c
\command.com /c
UEDOS32.EXE"
cmd /c
\command.com /E:2048 /c
%sel%
%col%
ftp:/
UETMPLTE.DAT
&%d %s
\Insert\*.ins
user32.dll
0xX 0xX
Error reading keyboard file
*.HTML;*.HTM;*.JAVA;*.JAV
*.H;*.HPP
*.C;*.CPP
*.INI
*.BAT
*.DOC
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
line %u column %u
%d/%m/%Y, %H:%M
%m/%d/%Y, %H:%M
Solution Files (*.prw)|*.prw||
Project Files (*.prj)|*.prj||
Bitmap Path%d
A severe error (%d) occured.
test.htm
IMPLEMENT_OLECREATE(@@CURSOR@@, , 0x%X, 0x%X, 0x%X, 0x%X, 0x%X, 0x%X, 0x%X, 0x%X, 0x%X, 0x%X, 0x%X);
DEFINE_GUID(@@CURSOR@@, 0x%X, 0x%X, 0x%X, 0x%X, 0x%X, 0x%X, 0x%X, 0x%X, 0x%X, 0x%X, 0x%X);
static const GUID @@CURSOR@@ = { 0x%X, 0x%X, 0x%X, { 0x%X, 0x%X, 0x%X, 0x%X, 0x%X, 0x%X, 0x%X, 0x%X } };
AStyle [http://astyle.sf.net] ...
*.exe
Astyle (*.exe)|*.exe||
Astyle.exe
RichEd20.dll
MSH_SCROLL_LINES_MSG
Cannot allocate enough memory for operation!
0-9^-]  
.,;:(){}<>'=
test.html
~ty.html
~ty.log
HTMLTIDY.DLL
csevalidator.dll
%%x
|
|
%%X
document.write(unescape("
%%x
ShowCmd
www.serialz.to
9Down.COM
%A, %B %d, %Y
.java
\shell\print\ddeexec
\shell\open\ddeexec
NOTEPAD.EXE /P "%1"
NOTEPAD.EXE "%1"
ULTRAEDT.EXE
UEDIT32.EXE
FTP Accounts
Password
Password1
Save Password
Proxy Port
Cache Password
Passive Mode
Secure FTP
Key Path
Key Password Req
my key
FTP Account -
!@~_)* {}:
Long Name Support
Send After Login
Auto Browse FTP
FTP Connect On Change
SFTP Compression
FTP Debug
%s/%s,%s.%s
FTP Dialog
/qsys.lib/
/QSYS.LIB/
www.ultraedit.com
{lX-X-x-XX-XXXXXX}
UXTHEME.DLL
default.ini
*.MAC
Select .NET executable ...
.NET Executables (*.exe)|*.exe||
Please select first .NET executable file you want to protect !
%s: [%s] ok.
error: %s
file: %s
http://download8.htmlvalidator.com/idm/csesetup.exe
http://download8.htmlvalidator.com/idm/cselite.exe
%d=%s
projects.lst
Files - %s
%d Seconds,
%d Minutes,
%d Hours,
%d Days,
line %d of
warning %d in line %d of
error %d in line %d of
Pass32 Assembler
\winhlp32.exe
Language %d
TAGLIST.TXT
(Full keying)
9ACCT %s
PASS %s
USER %s
RETR %s
PORT %s,%d,%d
STOR %s
DELE %s
RNTO %s
RNFR %s
CWD %s
MKD %s
RMD %s
SITE chmod %d %s
[password not displayed]
tmp%d.tmp
a|name|href=$i|hreflang|type|rel=nofollow|rev|charset|id|class|lang|dir=ltr,rtl|title|style|shape|onfocus=$f|onblur=$f|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|target=_blank,_parent,_search,_self,_top|tabindex|accesskey|
abbr|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
acronym|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
address|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
area|shape|coords|nohref|usemap=$i|id|class|lang|dir=ltr,rtl|title|style|alt|href=$i|target=_blank,_parent,_self,_top|tabindex|accesskey|shape|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|onfocus=$f|onblur=$f|
b|id|class|lang|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
bdo|dir=ltr,rtl|lang|accesskey|class|id|language|tabindex|title|onclick=$f|onhelp=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
big|id|class|lang|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
blockquote|cite=$i|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
body|background=$i|text=$c|link=$c|vlink=$c|alink=$c|id|class|lang|dir=ltr,rtl|title|target=_blank,_parent,_self,_top|style|bgcolor=$c|onload=$f|onunload=$f|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
button|name|value|type=button,submit,reset|id|lang|dir=ltr,rtl|title|style|disabled|accesskey|tabindex|onfocus=$f|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
caption|align=top,bottom,left,right|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
center|clear|id|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
cite|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
code|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
col|span|width|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|align=left,center,right,justify,char|char|charoff|valign=top,middle,bottom,baseline|
colgroup|span|width|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|align=left,center,right,justify,char|char|charoff|valign=top,middle,bottom,baseline|
dd|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
del|cite=$i|datetime|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
dfn|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
dir|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
div|id|class|lang|dir=ltr,rtl|title|style|align=left,center,right,justify|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
dl|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
dt|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
em|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
fieldset|align=top,bottom,left,right|id|lang|dir=ltr,rtl|title|style|accesskey|onclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
form|action=$i|method=GET,POST|enctype|accept-charset|accept|name|id|lang|dir=ltr,rtl|style|title|target=_blank,_parent,_self,_top|onsubmit=$f|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
h1|id|class|lang|dir=ltr,rtl|title|style|align=left,center,right,justify|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
h2|id|class|lang|dir=ltr,rtl|title|style|align=left,center,right,justify|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
h3|id|class|lang|dir=ltr,rtl|title|style|align=left,center,right,justify|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
h4|id|class|lang|dir=ltr,rtl|title|style|align=left,center,right,justify|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
h5|id|class|lang|dir=ltr,rtl|title|style|align=left,center,right,justify|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
h6|id|class|lang|dir=ltr,rtl|title|style|align=left,center,right,justify|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
hr|align=left,center,right|noshade|size|width|id|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
i|id|class|lang|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
img|src=$i|align=top,middle,bottom,left,right|longdesc|name|id|class|alt|lang|width|height|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|ismap|hspace|vspace|
input|type=button,checkbox,file,hidden,image,password,radio,reset,submit,text|autocomplete=off,on|name|value|size|class|maxlength|checked|src=$i|id|lang|dir=ltr,rtl|title|style|alt|align=top,middle,bottom,left,right|accept|readonly|disabled|tabindex|accesskey|usemap=$i|ismap|onfocus=$f|onselect=$f|onchange=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|
ins|cite=$i|datetime|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
kbd|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
label|for|id|lang|dir=ltr,rtl|title|style|accesskey|onfocus=$f|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
legend|class|align=top,bottom,left,right|id|lang|dir=ltr,rtl|title|style|accesskey|onclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
li|type|start|value|compact|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
link|id|class|lang|dir|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|href=$i|hreflang|type=text/css,text/javascript|rel|rev|target=_blank,_parent,_self,_top|media|charset|
map|name|id|class|lang|dir=ltr,rtl|title|style|alt|href=$i|target|tabindex|accesskey|shape|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|onfocus=$f|onblur=$f|
menu|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
meta|name|content|scheme|http-equiv|lang|charset|url|
noframes|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
object|align=top,middle,bottom,left,right|classid=$i|codebase=$i|codetype|data=$i|type|archive|declare|standby|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|tabindex|usemap=$i|hspace|vspace|
ol|type|start|value|compact|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
optgroup|name|size|multiple|disabled|tabindex|onfocus=$f|onblur=$f|onchange=$f|id|lang|dir=ltr,rtl|title|style|disabled|tabindex|onclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
option|name|size|multiple|disabled|tabindex|onfocus=$f|onblur=$f|onchange=$f|id|lang|dir=ltr,rtl|title|style|onclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
p|id|class|lang|dir=ltr,rtl|title|style|align=left,center,right,justify|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
pre|width|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
q|cite=$i|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
s|id|class|lang|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
samp|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
select|name|size|multiple|disabled|tabindex|onfocus=$f|onblur=$f|onchange=$f|id|lang|dir=ltr,rtl|title|style|tabindex|onclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
small|id|class|lang|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
span|id|class|lang|dir=ltr,rtl|title|style|align|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
strike|id|class|lang|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
strong|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
sub|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
sup|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
table|border|summary|align=left,center,right|width|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|bgcolor=$c|frame|cellspacing|cellpadding|
tbody|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|align=left,center,right,justify,char|char|charoff|valign=top,middle,bottom,baseline|
td|headers|scope|abbr|axis|rowspan|colspan|nowrap|width|height|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|bgcolor=$c|align=left,center,right,justify,char|char|charoff|valign=top,middle,bottom,baseline|
textarea|name|rows|cols|class|id|lang|dir=ltr,rtl|title|style|readonly|disabled|tabindex|onfocus=$f|onselect=$f|onchange=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|
tfoot|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|align=left,center,right,justify,char|char|charoff|valign=top,middle,bottom,baseline|
th|headers|scope|abbr|axis|rowspan|colspan|nowrap|width|height|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|bgcolor=$c|char|charoff|valign=top,middle,bottom,baseline|
thead|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|align=left,center,right,justify,char|char|charoff|valign=top,middle,bottom,baseline|
tr|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|bgcolor=$c|align=left,center,right,justify,char|char|charoff|valign=top,middle,bottom,baseline|
tt|id|class|lang|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
u|id|class|lang|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
ul|type|start|value|compact|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f|
var|id|class|lang|dir=ltr,rtl|title|style|onclick=$f|ondblclick=$f|onmousedown=$f|onmouseup=$f|onmouseover=$f|onmousemove=$f|onmouseout=$f|onkeypress=$f|onkeydown=$f|onkeyup=$f||||
AdminExecuteSequence|
AdvtExecuteSequence|
Certificate|Id|BinaryKey|CertificatePath|Overwrite=yes,no|PFXPassword|Request=yes,no|StoreLocation=currentUser,localMachine|StoreName=ca,my,request,root|
Column|Id|Localizable=yes,no|Nullable=yes,no|PrimaryKey=yes,no|Type=binary,int,string|Width=$i|
Component|Id|ComPlusFlags=$i|DiskId|Guid=$u|KeyPath=yes,no|Location=local,source,either|NeverOverwrite=yes,no|Permanent=yes,no|SharedDllRefCount=yes,no|Transitive=yes,no|Win64=yes,no|
Control|Id|Bitmap=yes,no|Cancel=yes,no|CDROM=yes,no|CheckBoxValue|ComboList=yes,no|Default=yes,no|Disabled=yes,no|First=yes,no|Fixed=yes,no|FixedSize=yes,no|Floppy=yes,no|FormatSize=yes,no|HasBorder=yes,no|Height=$i|Help|Hidden=yes,no|Icon=yes,no|IconSize=16,32,48|Image=yes,no|Indirect=yes,no|Integer=yes,no|LeftScroll=yes,no|Multiline=yes,no|NoPrefix=yes,no|NoWrap=yes,no|Password=yes,no|ProgressBlocks=yes,no|Property|PushLike=yes,no|RAMDisk=yes,no|Remote=yes,no|Removable=yes,no|RightAligned=yes,no|RightToLeft=yes,no|ShowRollbackCost=yes,no|Sorted=yes,no|Sunken=yes,no|TabSkip=yes,no|Text|ToolTip|Transparent=yes,no|Type|UserLanguage=yes,no|Width=$i|X=$i|Y=$i|
CustomAction|BinaryKey|Directory|DllEntry|Error|ExeCommand|Execute=immediate,deferred,rollback,commit,oncePerProcess,firstSequence,secondSequence|FileKey|HideTarget=yes,no|Id|Impersonate=yes,no|InstallProperties|JScriptCall|PackagePath|PackageProductCode=$u|PackageSubstorage|Property|Return=check,ignore,asyncWait,asyncNoWait|TSAware=yes,no|Value|VBScriptCall|
DigitalCertificate|Name|src|
File|Id|Assembly=no,win32,.net|AssemblyApplication|AssemblyManifest|AssemblyRegisterComInterop=yes,no|BindPath|Checksum=yes,no|CompanionFile|Compressed=default,yes,no|DiskId|FontTitle|Hidden=yes,no|KeyPath=yes,no|LongName=$L|Name=$S|PatchAdded=yes,no|ProcessorArchitecture=neutral,x86|ReadOnly=yes,no|SelfRegCost=$i|src|System=yes,no|TrueType=yes,no|Vital=yes,no|
IniFile|Id|Action=addLine,createLine,addTag,removeLine,removeTag|Directory|Key|Name|Section|Value|
IniFileSearch|Id|Field=$i|File|Key|Section|Type=directory,file,registry|
InstallExecute|After|Before|Sequence=$i|
InstallExecuteAgain|After|Before|Sequence=$i|
InstallExecuteSequence|
ODBCDataSource|Id|DriverName|KeyPath=yes,no|Name|Registration=machine,user|
Package|AdminImage=yes,no|Comments|Compressed=yes,no|Description|Id=$u|InstallerVersion=$i|Keywords|Languages|Manufacturer|Platforms|ShortNames=yes,no|SummaryCodepage=$i|
Permission|Append=yes,no|ChangePermission=yes,no|CreateChild=yes,no|CreateFile=yes,no|CreateLink=yes,no|CreateSubkeys=yes,no|Delete=yes,no|DeleteChild=yes,no|Domain|EnumerateSubkeys=yes,no|Execute=yes,no|GenericAll=yes,no|GenericExecute=yes,no|GenericRead=yes,no|GenericWrite=yes,no|Notify=yes,no|Read=yes,no|ReadAttributes=yes,no|ReadExtendedAttributes=yes,no|ReadPermission=yes,no|Synchronize=yes,no|TakeOwnership=yes,no|Traverse=yes,no|User|Write=yes,no|WriteAttributes=yes,no|WriteExtendedAttributes=yes,no|
Registry|Id|Action=write,append,prepend,remove,removeKey|Key|KeyPath=yes,no|Name|Root=HKMU,HKCR,HKCU,HKLM,HKU|Type=string,integer,binary,expandable,multiString|Value|
RegistrySearch|Id|Key|Name|Root=HKCR,HKCU,HKLM,HKU|Type=directory,file,registry|Win64=yes,no|
ServiceInstall|Id|Account|Arguments|Description|DisplayName|EraseDescription=yes,no|ErrorControl=ignore,normal,critical|Interactive=yes,no|LocalGroup|Name|Password|Start=auto,demand,disabled,boot,system|Type=ownProcess,shareProcess,kernelDriver,systemDriver|Vital=yes,no|
Shortcut|Id|Advertise=yes,no|Arguments|Description|Directory|Hotkey=$i|Icon|IconIndex=$i|LongName=$L|Name=$S|Show=normal,minimized,maximized|Target|WorkingDirectory|
SqlDatabase|Id|ConfirmOverwrite=yes,no|ContinueOnError=yes,no|CreateOnInstall=yes,no|CreateOnUninstall=yes,no|Database|DropOnInstall=yes,no|DropOnUninstall=yes,no|Instance|Server|User|
SqlScript|Id|BinaryKey|ContinueOnError=yes,no|ExecuteOnInstall=yes,no|ExecuteOnUninstall=yes,no|RollbackOnInstall=yes,no|RollbackOnUninstall=yes,no|Sequence=$i|SqlDb|User|
SqlString|Id|ContinueOnError=yes,no|ExecuteOnInstall=yes,no|ExecuteOnUninstall=yes,no|RollbackOnInstall=yes,no|RollbackOnUninstall=yes,no|Sequence=$i|SQL|SqlDb|User|
User|Id|CanNotChangePassword=yes,no|CreateUser=yes,no|Disabled=yes,no|Domain|FailIfExists=yes,no|Name|Password|PasswordExpired=yes,no|PasswordNeverExpires=yes,no|RemoveOnUninstall=yes,no|UpdateIfExists=yes,no|
WebAddress|Id|Header|IP|KeyPath=yes,no|Port|Secure=yes,no|
WebApplication|Id|AllowSessions=default,yes,no|Buffer=default,yes,no|ClientDebugging=default,yes,no|DefaultScript=VBScript,JScript|Isolation=low,medium,high|Name|ParentPaths=default,yes,no|ScriptTimeout=$i|ServerDebugging=default,yes,no|SessionTimeout=$i|WebAppPool|
WebApplicationExtension|Id|CheckPath=yes,no|Executable|Script=yes,no|Verbs|
WebAppPool|Id|CpuAction=none,shutdown|Identity=networkService,localService,localSystem,other|IdleTimeout=$i|MaxCpuUsage|MaxWorkerProcesses=$i|QueueLimit=$i|RecycleMinutes=$i|RecycleRequests=$i|RefreshCpu=$i|User|
WebDir|Id|DirProperties|Path|WebApplication|WebSite|
WebDirProperties|Id|AnonymousAccess=yes,no|AnonymousUser|AspDetailedError=yes,no|BasicAuthentication=yes,no|CacheControlCustom|CacheControlMaxAge=$i|DefaultDocuments|DigestAuthentication=yes,no|Execute=yes,no|HttpExpires|IIsControlledPassword=yes,no|Index=yes,no|LogVisits=yes,no|Read=yes,no|Script=yes,no|WindowsAuthentication=yes,no|Write=yes,no|
WebError|ErrorCode=$i|Path|SubCode=$i|Type=default,file,url|
WebFilter|Id|Description|Flags=$i|LoadOrder|Path|WebSite|
WebProperty|Id=IIs5IsolationMode,MaxGlobalBandwidth,LogInUTF8|Value|
WebServiceExtension|Id|Allow=yes,no|Description|File|Group|UIDeletable=yes,no|
WebSite|Id|AutoStart=yes,no|ConfigureIfExists=yes,no|Description|Directory|DirProperties|Sequence=$i|StartOnInstall=yes,no|WebApplication|
WebVirtualDir|Id|Alias|Directory|DirProperties|WebApplication|WebSite|
aclui.dll
activeds.dll
advapi32.dll
GetEventLogInformation@20
ReportEventW@36
ReportEventA@36
ImpersonateNamedPipeClient@4
GetWindowsAccountDomainSid@12
MSChapSrvChangePassword@28
MSChapSrvChangePassword2@28
ElfReportEventW@48
ElfReportEventA@48
GetServiceKeyNameA@16
GetServiceKeyNameW@16
RegDeleteKeyA@8
RegDeleteKeyW@8
RegEnumKeyA@16
RegEnumKeyW@16
RegEnumKeyExA@32
RegEnumKeyExW@32
RegCreateKeyA@12
RegCreateKeyW@12
RegCreateKeyExA@36
RegCreateKeyExW@36
RegOverridePredefKey@8
RegCloseKey@4
RegFlushKey@4
RegOpenKeyA@12
RegOpenKeyW@12
RegOpenKeyExA@20
RegOpenKeyExW@20
RegNotifyChangeKeyValue@20
RegQueryInfoKeyA@48
RegQueryInfoKeyW@48
RegGetKeySecurity@16
RegSetKeySecurity@12
RegSaveKeyA@12
RegSaveKeyW@12
RegSaveKeyExA@16
RegSaveKeyExW@16
RegRestoreKeyA@12
RegRestoreKeyW@12
RegLoadKeyA@12
RegLoadKeyW@12
RegUnLoadKeyA@8
RegUnLoadKeyW@8
RegReplaceKeyA@16
RegReplaceKeyW@16
CryptGenKey@16
CryptDeriveKey@20
CryptDestroyKey@4
CryptSetKeyParam@16
CryptGetKeyParam@20
CryptExportKey@24
CryptImportKey@24
CryptHashSessionKey@12
CryptGetUserKey@12
CryptDuplicateKey@16
GetMultipleTrusteeOperationW@4
GetMultipleTrusteeOperationA@4
SetUserFileEncryptionKey@4
FreeEncryptionCertificateHashList@4
EncryptedFileKeyInfo@12
FreeEncryptedFileKeyInfo@4
authz.dll
bdnapi.dll
bignums.dll
cap.dll
comctl32.dll
crtdll.dll
acmdln_dll
amsg_exit
pipe
crypt32.dll
CertAddCRLContextToStore@16
CertAddCTLContextToStore@16
CertAddCertificateContextToStore@16
CertAddEncodedCRLToStore@24
CertAddEncodedCTLToStore@24
CertAddEncodedCertificateToStore@24
CertAddEncodedCertificateToSystemStoreA@12
CertAddEncodedCertificateToSystemStoreW@12
CertAddEnhancedKeyUsageIdentifier@8
CertAddSerializedElementToStore@32
CertAlgIdToOID@4
CertCloseStore@8
CertCompareCertificate@12
CertCompareCertificateName@12
CertCompareIntegerBlob@8
CertComparePublicKeyInfo@12
CertCreateCRLContext@12
CertCreateCTLContext@12
CertCreateCertificateContext@12
CertDeleteCRLFromStore@4
CertDeleteCTLFromStore@4
CertDeleteCertificateFromStore@4
CertDuplicateCRLContext@4
CertDuplicateCTLContext@4
CertDuplicateCertificateContext@4
CertDuplicateStore@4
CertEnumCRLContextProperties@8
CertEnumCTLContextProperties@8
CertEnumCTLsInStore@8
CertEnumCertificateContextProperties@8
CertEnumCertificatesInStore@8
CertFindAttribute@12
CertFindCTLInStore@24
CertFindCertificateInStore@24
CertFindExtension@12
CertFindRDNAttr@8
CertFindSubjectInCTL@20
CertFreeCRLContext@4
CertFreeCTLContext@4
CertFreeCertificateContext@4
CertGetCRLContextProperty@16
CertGetCRLFromStore@16
CertGetCTLContextProperty@16
CertGetCertificateContextProperty@16
CertGetEnhancedKeyUsage@16
CertGetIntendedKeyUsage@16
CertGetIssuerCertificateFromStore@16
CertGetSubjectCertificateFromStore@12
CertIsRDNAttrsInCertificateName@16
CertNameToStrA@20
CertNameToStrW@20
CertOIDToAlgId@4
CertOpenStore@20
CertOpenSystemStoreA@8
CertOpenSystemStoreW@8
CertRDNValueToStrA@16
CertRDNValueToStrW@16
CertRemoveEnhancedKeyUsageIdentifier@8
CertSaveStore@24
CertSerializeCRLStoreElement@16
CertSerializeCTLStoreElement@16
CertSerializeCertificateStoreElement@16
CertSetCRLContextProperty@16
CertSetCTLContextProperty@16
CertSetCertificateContextProperty@16
CertSetEnhancedKeyUsage@8
CertStrToNameA@28
CertStrToNameW@28
CertVerifyCRLRevocation@16
CertVerifyCRLTimeValidity@8
CertVerifyCTLUsage@28
CertVerifyRevocation@28
CertVerifySubjectCertificateContext@12
CertVerifyTimeValidity@8
CertVerifyValidityNesting@8
CryptExportPublicKeyInfo@20
CryptExportPublicKeyInfoEx@32
CryptGetMessageCertificates@20
CryptHashCertificate@28
CryptHashPublicKeyInfo@28
CryptImportPublicKeyInfo@16
CryptImportPublicKeyInfoEx@28
CryptMsgCalculateEncodedLength@24
CryptMsgClose@4
CryptMsgControl@16
CryptMsgCountersign@16
CryptMsgCountersignEncoded@28
CryptMsgEncodeAndSignCTL@24
CryptMsgGetAndVerifySigner@24
CryptMsgGetParam@20
CryptMsgOpenToDecode@24
CryptMsgOpenToEncode@24
CryptMsgSignCTL@28
CryptMsgUpdate@16
CryptMsgVerifyCountersignatureEncoded@28
CryptSignAndEncodeCertificate@36
CryptSignCertificate@36
CryptSignMessageWithKey@20
CryptVerifyCertificateSignature@20
CryptVerifyMessageSignatureWithKey@24
RegCreateKeyExU@36
RegQueryInfoKeyU@48
cryptnet.dll
CryptRetrieveObjectByUrlA@36
CryptRetrieveObjectByUrlW@36
CryptGetObjectUrl@32
cryptui.dll
CryptUIDlgViewCertificateW@8
CryptUIDlgViewCertificateA@8
CryptUIDlgViewCertificatePropertiesW@8
CryptUIDlgViewCertificatePropertiesA@8
CryptUIGetCertificatePropertiesPagesW@16
CryptUIGetCertificatePropertiesPagesA@16
CryptUIFreeCertificatePropertiesPagesW@8
CryptUIFreeCertificatePropertiesPagesA@8
CryptUIDlgSelectCertificateW@4
CryptUIDlgSelectCertificateA@4
CryptUIDlgCertMgr@4
CryptUIStartCertMgr@16
CryptUIWizCertRequest@24
CryptUIWizImport@20
CryptUIWizExport@20
CryptUIWizCreateCertRequestNoDS@16
CryptUIWizSubmitCertRequestNoDS@24
CryptUIWizFreeCertRequestNoDS@4
CryptUIWizQueryCertRequestNoDS@8
CryptUIDlgSelectCertificateFromStore@28
ctl3d32.dll
d3d8.dll
d3dim.dll
d3drm.dll
d3dx8d.dll
d3dxof.dll
dapi.dll
BatchExportA@4
BatchExportW@4
BatchImportA@4
BatchImportW@4
NTExportA@4
NTExportW@4
NWExportA@4
NWExportW@4
dbghelp.dll
IMPORT_DESCRIPTOR_dbghelp
FindExecutableImage@12
FindExecutableImageEx@20
ddraw.dll
dflayout.dll
dinput.dll
dinput8.dll
c_dfDIKeyboard
dlcapi.dll
dplay.dll
dplayx.dll
dpvoice.dll
dsetup.dll
dsound.dll
dsuiext.dll
FormatMsgResource
FormatMsgBox
dxerr.dll
dynloader.dll
edbbcli.dll
gc.dll
gdi32.dll
GetViewportExtEx@8
GetViewportOrgEx@8
OffsetViewportOrgEx@16
ScaleViewportExtEx@24
SetViewportExtEx@16
SetViewportOrgEx@16
UpdateICMRegKeyA@16
UpdateICMRegKeyW@16
gdiplus.dll
GdiplusShutdown@4
GdipSetStringFormatHotkeyPrefix@8
GdipSetPenLineJoin@8
GdipSetImageAttributesColorKeys@20
GdipSetCustomLineCapStrokeJoin@8
GdipGetStringFormatHotkeyPrefix@8
GdipGetPenLineJoin@8
GdipGetCustomLineCapStrokeJoin@8
glide2x.dll
grChromakeyMode@4
grChromakeyValue@4
grSstConfigPipeline@12
glu32.dll
glutExtensionSupported@4
glutInitWindowSize@8
glutKeyboardFunc@4
glutPassiveMotionFunc@4
glutReportErrors@0
glutWindowStatusFunc@4
hlink.dll
HlinkIsShortcut@4
HlinkTranslateURL@12
httpapi.dll
HttpAddUrl@12
HttpRemoveUrl@8
HttpCreateHttpHandle@8
HttpReceiveHttpRequest@32
HttpReceiveRequestEntityBody@32
HttpSendHttpResponse@44
HttpSendResponseEntityBody@44
HttpWaitForDisconnect@16
HttpInitializeServerContext@28
HttpSendHttpRequest@48
HttpSendRequestEntityBody@28
HttpReceiveHttpResponse@40
HttpSetServerContextInformation@20
HttpQueryServerContextInformation@32
HttpCancelHttpRequest@20
HttpInitialize@12
HttpTerminate@8
HttpOpenControlChannel@8
HttpQueryControlChannelInformation@20
HttpSetControlChannelInformation@16
HttpCreateConfigGroup@8
HttpDeleteConfigGroup@12
HttpAddUrlToConfigGroup@24
HttpRemoveUrlFromConfigGroup@16
HttpQueryConfigGroupInformation@28
HttpSetConfigGroupInformation@24
HttpCreateFilter@16
HttpOpenFilter@12
HttpShutdownFilter@4
HttpFilterAccept@20
HttpFilterClose@16
HttpFilterRawRead@28
HttpFilterAppWriteAndRawRead@12
HttpFilterRawWrite@28
HttpFilterAppRead@28
HttpFilterRawWriteAndAppRead@12
HttpFilterAppWrite@28
HttpCreateAppPool@16
HttpOpenAppPool@12
HttpShutdownAppPool@4
HttpQueryAppPoolInformation@20
HttpSetAppPoolInformation@16
HttpFlushResponseCache@16
HttpWaitForDemandStart@20
HttpRemoveAllUrlsFromConfigGroup@12
HttpReceiveClientCertificate@32
HttpGetCounters@20
HttpAddFragmentToCache@20
HttpReadFragmentFromCache@28
HttpQueryServiceConfiguration@32
HttpSetServiceConfiguration@20
HttpDeleteServiceConfiguration@20
icm32.dll
CMDeleteTransform@4
icmp.dll
icmui.dll
imagehlp.dll
ImageAddCertificate@12
ImageEnumerateCertificates@20
ImageGetCertificateData@16
ImageGetCertificateHeader@12
ImageRemoveCertificate@8
imm32.dll
ImmGetHotKey@16
ImmSetHotKey@16
ImmSimulateHotKey@8
ImmGetVirtualKey@4
ImmCreateSoftKeyboard@16
ImmDestroySoftKeyboard@4
ImmShowSoftKeyboard@8
iphlpapi.dll
GetTcpTable@12
GetUdpTable@12
GetTcpStatistics@4
GetUdpStatistics@4
SetTcpEntry@4
InternalGetTcpTable@12
InternalGetUdpTable@12
InternalSetTcpEntry@4
AllocateAndGetTcpTableFromStack@16
AllocateAndGetUdpTableFromStack@16
GetTcpTableFromStack@12
SetTcpEntryToStack@4
GetUdpTableFromStack@12
GetUdpStatsFromStack@4
GetTcpStatsFromStack@4
iprop.dll
irprops.dll
CallNamedPipeA@28
CallNamedPipeW@28
ConnectNamedPipe@8
CreateIoCompletionPort@16
CreateNamedPipeA@32
CreateNamedPipeW@32
CreatePipe@16
DisconnectNamedPipe@4
GetCPInfo@8
GetCPInfoExA@12
GetCPInfoExW@12
GetConsoleOutputCP@0
GetLargestConsoleWindowSize@4
GetNamedPipeHandleStateA@28
GetNamedPipeHandleStateW@28
GetNamedPipeInfo@20
GetProcessHeap@0
GetProcessHeaps@8
GetProcessShutdownParameters@8
GetSystemWindowsDirectoryA@8
GetSystemWindowsDirectoryW@8
GetWindowsDirectoryA@8
GetWindowsDirectoryW@8
PeekNamedPipe@24
SetConsoleOutputCP@4
SetNamedPipeHandleState@16
SetProcessShutdownParameters@8
SetThreadExecutionState@4
TransactNamedPipe@28
WaitNamedPipeA@8
WaitNamedPipeW@8
WinExec@8
lcclibc.dll
loadperf.dll
lsapi32.dll
lz32.dll
mapi32.dll
CloseIMsgSession@4
GetAttribIMsgOnIStg@12
HrComposeMsgID@24
HrDecomposeMsgID@24
OpenIMsgOnIStg@44
OpenIMsgSession@12
SetAttribIMsgOnIStg@16
mgmtapi.dll
mpr.dll
WNetPasswordChangeNotify@32
WNetSupportGlobalEnum@4
mprapi.dll
MprAdminInterfaceTransportAdd@20
MprAdminInterfaceTransportRemove@12
MprAdminInterfaceTransportGetInfo@20
MprAdminInterfaceTransportSetInfo@20
MprAdminTransportSetInfo@24
MprAdminTransportGetInfo@24
MprConfigTransportCreate@36
MprConfigTransportDelete@8
MprConfigTransportGetHandle@12
MprConfigTransportSetInfo@28
MprConfigTransportGetInfo@28
MprConfigTransportEnum@28
MprConfigInterfaceTransportAdd@28
MprConfigInterfaceTransportRemove@12
MprConfigInterfaceTransportGetHandle@16
MprConfigInterfaceTransportGetInfo@20
MprConfigInterfaceTransportSetInfo@20
MprConfigInterfaceTransportEnum@32
MprAdminPortEnum@32
MprAdminPortGetInfo@16
MprAdminPortClearStats@8
MprAdminPortDisconnect@8
MprAdminPortReset@8
msacm32.dll
acmDriverAddA@20
acmDriverAddW@20
acmDriverClose@8
acmDriverDetailsA@12
acmDriverDetailsW@12
acmDriverEnum@12
acmDriverID@12
acmDriverMessage@16
acmDriverOpen@12
acmDriverPriority@12
acmDriverRemove@8
mscms.dll
msi.dll
MsiViewExecute@8
MsiDatabaseGetPrimaryKeysA@12
MsiDatabaseGetPrimaryKeysW@12
MsiDatabaseImportA@12
MsiDatabaseImportW@12
MsiDatabaseExportA@16
MsiDatabaseExportW@16
msimg32.dll
mslsp32.dll
msvcrt.dll
crtCompareStringA
crtGetLocaleInfoW
crtLCMapStringA
acmdln
wcmdln
wexecl
wexecle
wexeclp
wexeclpe
wexecv
wexecve
wexecvp
wexecvpe
msvcrtd.dll
p__wcmdln
p__crtDbgFlag
p__crtBreakAlloc
p__crtAssertBusy
p__acmdln
CrtSetReportMode
CrtSetReportHook
CrtSetReportFile
CrtSetDumpClient
CrtSetDbgFlag
CrtSetDbgBlockType
CrtSetBreakAlloc
CrtSetAllocHook
CrtMemDumpStatistics
CrtMemDumpAllObjectsSince
CrtMemDifference
CrtMemCheckpoint
CrtIsValidPointer
CrtIsValidHeapPointer
CrtIsMemoryBlock
CrtDumpMemoryLeaks
CrtDoForAllClientObjects
CrtDbgReport
CrtDbgBreak
CrtCheckMemory
wWinMainCRTStartup
wmainCRTStartup
WinMainCRTStartup
mainCRTStartup
CRT_INIT@12
DllMainCRTStartup@12
msvfw32.dll
VideoForWindowsVersion@0
mswsock.dll
rcmd@24
rexec@24
rresvport@4
nal.dll
nddeapi.dll
netapi32.dll
DsRoleGetDcOperationProgress@12
DsRoleGetDcOperationResults@12
I_NetServerPasswordGet@28
I_NetServerPasswordSet@28
I_NetServerPasswordSet2@28
I_NetDfsManagerReportSiteInfo@8
RxNetUserPasswordSet@16
NetGetJoinableOUs@24
NetGetJoinInformation@12
NetJoinDomain@24
NetpUpgradePreNT5JoinInfo@0
NetpAssertFailed@16
NetRemoteComputerSupports@12
NetReplExportDirAdd@16
NetReplExportDirDel@8
NetReplExportDirEnum@28
NetReplExportDirGetInfo@16
NetReplExportDirSetInfo@20
NetReplExportDirLock@8
NetReplExportDirUnlock@12
NetReplImportDirAdd@16
NetReplImportDirDel@8
NetReplImportDirEnum@28
NetReplImportDirGetInfo@16
NetReplImportDirLock@8
NetReplImportDirUnlock@12
NetServerTransportAdd@12
NetServerTransportAddEx@12
NetServerTransportDel@12
NetServerTransportEnum@28
NetUnjoinDomain@16
NetUserChangePassword@16
NetWkstaTransportAdd@16
NetWkstaTransportDel@12
NetWkstaTransportEnum@28
netsh.dll
MatchCmdLine@16
MatchTagsInCmdLine@28
ntdll.dll
DbgSsHandleKmApiMsg@8
LdrQueryImageFileExecutionOptions@24
NtAcceptConnectPort@24
NtCompleteConnectPort@4
NtConnectPort@32
NtCreateKey@28
NtCreateNamedPipeFile@56
NtCreatePort@20
NtDelayExecution@8
NtDeleteKey@4
NtDeleteValueKey@8
NtEnumerateKey@24
NtEnumerateValueKey@24
NtFlushKey@4
NtImpersonateClientOfPort@8
NtListenPort@8
NtLoadKey2@12
NtLoadKey@8
NtNotifyChangeKey@40
NtOpenKey@12
NtQueryInformationPort@20
NtQueryKey@20
NtQueryMultipleValueKey@24
NtQueryValueKey@24
NtRegisterThreadTerminatePort@4
NtReplaceKey@12
NtReplyPort@8
NtReplyWaitReceivePort@16
NtReplyWaitReplyPort@8
NtRequestPort@8
NtRequestWaitReplyPort@12
NtRestoreKey@12
NtSaveKey@8
NtSetDefaultHardErrorPort@4
NtSetInformationKey@16
NtSetValueKey@24
NtUnloadKey@4
NtYieldExecution@0
RtlCheckRegistryKey@8
RtlCreateRegistryKey@8
RtlEnumProcessHeaps@8
RtlFormatCurrentUserKeyPath@4
RtlGetProcessHeaps@8
RtlQueryProcessHeapInformation@4
RtlValidateProcessHeaps@0
RtlpNtCreateKey@24
RtlpNtEnumerateSubKey@16
RtlpNtMakeTemporaryKey@4
RtlpNtOpenKey@16
RtlpNtQueryValueKey@20
RtlpNtSetValueKey@16
ZwAcceptConnectPort@24
ZwCompleteConnectPort@4
ZwConnectPort@32
ZwCreateKey@28
ZwCreateNamedPipeFile@56
ZwCreatePort@20
ZwDelayExecution@8
ZwDeleteKey@4
ZwDeleteValueKey@8
ZwEnumerateKey@24
ZwEnumerateValueKey@24
ZwFlushKey@4
ZwImpersonateClientOfPort@8
ZwListenPort@8
ZwLoadKey2@12
ZwLoadKey@8
ZwNotifyChangeKey@40
ZwOpenKey@12
ZwQueryInformationPort@20
ZwQueryKey@20
ZwQueryMultipleValueKey@24
ZwQueryValueKey@24
ZwRegisterThreadTerminatePort@4
ZwReplaceKey@12
ZwReplyPort@8
ZwReplyWaitReceivePort@16
ZwReplyWaitReplyPort@8
ZwRequestPort@8
ZwRequestWaitReplyPort@12
ZwRestoreKey@12
ZwSaveKey@8
ZwSetDefaultHardErrorPort@4
ZwSetInformationKey@16
ZwSetValueKey@24
ZwUnloadKey@4
ZwYieldExecution@0
ntmsapi.dll
SubmitNtmsOperatorRequestW@24
SubmitNtmsOperatorRequestA@24
WaitForNtmsOperatorRequest@12
CancelNtmsOperatorRequest@8
SatisfyNtmsOperatorRequest@8
ExportNtmsDatabase@4
ImportNtmsDatabase@4
query.dll
odbc32.dll
SQLAllocConnect@8
SQLAllocEnv@4
SQLAllocStmt@8
SQLBindCol@24
SQLCancel@4
SQLColAttributes@28
SQLColAttributesW@28
SQLColAttributesA@28
SQLConnect@28
SQLConnectW@28
SQLConnectA@28
SQLDescribeCol@36
SQLDescribeColW@36
SQLDescribeColA@36
SQLDisconnect@4
SQLError@32
SQLErrorW@32
SQLErrorA@32
SQLExecDirect@12
SQLExecDirectW@12
SQLExecDirectA@12
SQLExecute@4
SQLFetch@4
SQLFreeConnect@4
SQLFreeEnv@4
SQLFreeStmt@8
SQLGetCursorName@16
SQLGetCursorNameW@16
SQLGetCursorNameA@16
SQLNumResultCols@8
SQLPrepare@12
SQLPrepareW@12
SQLPrepareA@12
SQLRowCount@8
SQLSetCursorName@12
SQLSetCursorNameW@12
SQLSetCursorNameA@12
SQLSetParam@32
SQLTransact@12
SQLColumns@36
SQLColumnsW@36
SQLColumnsA@36
SQLDriverConnect@32
SQLDriverConnectW@32
SQLDriverConnectA@32
SQLGetConnectOption@12
SQLGetConnectOptionW@12
SQLGetConnectOptionA@12
SQLGetData@24
SQLGetFunctions@12
SQLGetInfo@20
SQLGetInfoW@20
SQLGetInfoA@20
SQLGetStmtOption@12
SQLGetTypeInfo@8
SQLGetTypeInfoW@8
SQLGetTypeInfoA@8
SQLParamData@8
SQLPutData@12
SQLSetConnectOption@12
SQLSetConnectOptionW@12
SQLSetConnectOptionA@12
SQLSetStmtOption@12
SQLSpecialColumns@40
SQLSpecialColumnsW@40
SQLSpecialColumnsA@40
SQLStatistics@36
SQLStatisticsW@36
SQLStatisticsA@36
SQLTables@36
SQLTablesW@36
SQLTablesA@36
SQLBrowseConnect@24
SQLBrowseConnectW@24
SQLBrowseConnectA@24
SQLColumnPrivileges@36
SQLColumnPrivilegesW@36
SQLColumnPrivilegesA@36
SQLDataSources@32
SQLDataSourcesW@32
SQLDataSourcesA@32
SQLDescribeParam@24
SQLExtendedFetch@20
SQLForeignKeys@52
SQLForeignKeysW@52
SQLForeignKeysA@52
SQLMoreResults@4
SQLNativeSql@24
SQLNativeSqlW@24
SQLNativeSqlA@24
SQLNumParams@8
SQLParamOptions@12
SQLPrimaryKeys@28
SQLPrimaryKeysW@28
SQLPrimaryKeysA@28
SQLProcedureColumns@36
SQLProcedureColumnsW@36
SQLProcedureColumnsA@36
SQLProcedures@28
SQLProceduresW@28
SQLProceduresA@28
SQLSetPos@16
SQLSetScrollOptions@16
SQLTablePrivileges@28
SQLTablePrivilegesW@28
SQLTablePrivilegesA@28
SQLDrivers@32
SQLDriversW@32
SQLDriversA@32
SQLBindParameter@40
SQLAllocHandle@12
SQLBindParam@32
SQLCloseCursor@4
SQLColAttribute@28
SQLColAttributeW@28
SQLColAttributeA@28
SQLCopyDesc@8
SQLEndTran@12
SQLFetchScroll@12
SQLFreeHandle@8
SQLGetConnectAttr@20
SQLGetConnectAttrW@20
SQLGetConnectAttrA@20
SQLGetDescField@24
SQLGetDescFieldW@24
SQLGetDescFieldA@24
SQLGetDescRec@44
SQLGetDescRecW@44
SQLGetDescRecA@44
SQLGetDiagField@28
SQLGetDiagFieldW@28
SQLGetDiagFieldA@28
SQLGetDiagRec@32
SQLGetDiagRecW@32
SQLGetDiagRecA@32
SQLGetEnvAttr@20
SQLGetStmtAttr@20
SQLGetStmtAttrW@20
SQLGetStmtAttrA@20
SQLSetConnectAttr@16
SQLSetConnectAttrW@16
SQLSetConnectAttrA@16
SQLSetDescField@20
SQLSetDescFieldW@20
SQLSetDescFieldA@20
SQLSetDescRec@40
SQLSetEnvAttr@16
SQLSetStmtAttr@16
SQLSetStmtAttrW@16
SQLSetStmtAttrA@16
SQLAllocHandleStd@12
SQLBulkOperations@8
odbcbcp.dll
bcp_exec@8
SQLLinkedServers@4
SQLLinkedCatalogsW@12
SQLLinkedCatalogsA@12
SQLInitEnumServers@8
SQLGetNextEnumeration@12
SQLCloseEnumServers@4
odbccp32.dll
SQLConfigDataSource@16
SQLConfigDataSourceW@16
SQLConfigDriver@28
SQLConfigDriverW@28
SQLCreateDataSource@8
SQLCreateDataSourceW@8
SQLGetAvailableDrivers@16
SQLGetAvailableDriversW@16
SQLGetConfigMode@4
SQLGetInstalledDrivers@12
SQLGetInstalledDriversW@12
SQLGetPrivateProfileString@24
SQLGetPrivateProfileStringW@24
SQLGetTranslator@32
SQLGetTranslatorW@32
SQLInstallDriver@20
SQLInstallDriverEx@28
SQLInstallDriverExW@28
SQLInstallDriverManager@12
SQLInstallDriverManagerW@12
SQLInstallDriverW@20
SQLInstallODBC@16
SQLInstallODBCW@16
SQLInstallTranslator@32
SQLInstallTranslatorEx@28
SQLInstallTranslatorExW@28
SQLInstallTranslatorW@32
SQLInstallerError@20
SQLInstallerErrorW@20
SQLManageDataSources@4
SQLPostInstallerError@8
SQLPostInstallerErrorW@8
SQLReadFileDSN@24
SQLReadFileDSNW@24
SQLRemoveDSNFromIni@4
SQLRemoveDSNFromIniW@4
SQLRemoveDefaultDataSource@0
SQLRemoveDriver@12
SQLRemoveDriverManager@4
SQLRemoveDriverW@12
SQLRemoveTranslator@8
SQLRemoveTranslatorW@8
SQLSetConfigMode@4
SQLValidDSN@4
SQLValidDSNW@4
SQLWriteDSNToIni@8
SQLWriteDSNToIniW@8
SQLWriteFileDSN@16
SQLWriteFileDSNW@16
SQLWritePrivateProfileString@16
SQLWritePrivateProfileStringW@16
oleacc.dll
oleaut32.dll
UserMSG_free_inst@4
UserMSG_free_local@4
UserMSG_from_local@8
UserMSG_to_local@8
olepro32.dll
opengl.dll
glGetTexEnvfv@12
glGetTexEnviv@12
glPassThrough@4
glTexEnvf@12
glTexEnvfv@12
glTexEnvi@12
glTexEnviv@12
glViewport@16
opengl32.dll
pdh.dll
PdhVerifySQLDBA@4
PdhVerifySQLDBW@4
PdhCreateSQLTablesA@4
PdhCreateSQLTablesW@4
penwin32.dll
ProcessHRC@8
pkdp32.dll
powrprof.dll
psapi.dll
qfloat.dll
rasapi32.dll
RasGetHport@4
RasSetOldPassword@8
rasdlg.dll
rassapi.dll
RasAdminPortClearStatistics@8
RasAdminPortDisconnect@8
RasAdminPortEnum@12
RasAdminPortGetInfo@20
resutils.dll
riched20.dll
rpcns4.dll
RpcNsBindingExportW@20
RpcNsBindingExportA@20
RpcNsBindingUnexportW@16
RpcNsBindingUnexportA@16
RpcNsBindingImportBeginW@20
RpcNsBindingImportBeginA@20
RpcNsBindingImportNext@8
RpcNsBindingImportDone@4
RpcNsMgmtBindingUnexportA@20
RpcNsMgmtBindingUnexportW@20
RpcNsBindingExportPnPW@16
RpcNsBindingExportPnPA@16
RpcNsBindingUnexportPnPW@16
RpcNsBindingUnexportPnPA@16
rpcrt4.dll
CStdStubBuffer_IsIIDSupported@8
I_RpcBindingInqTransportType@8
I_RpcFreePipeBuffer@4
I_RpcNsInterfaceExported@12
I_RpcNsInterfaceUnexported@12
I_RpcPauseExecution@4
I_RpcReallocPipeBuffer@8
I_RpcServerAllocateIpPort@8
I_RpcServerInqTransportType@4
NdrCorrelationPass@4
NdrGetPipeBuffer@12
NdrIsAppDoneWithPipes@4
NdrMarkNextActivePipe@4
NdrPipePull@16
NdrPipePush@12
NdrPipeSendReceive@8
NdrPipesInitialize@24
NdrPipesDone@4
RpcCertGeneratePrincipalNameA@12
RpcCertGeneratePrincipalNameW@12
rtm.dll
secur32.dll
ExportSecurityContext@16
ImportSecurityContextA@16
ImportSecurityContextW@16
setupapi.dll
SetupDiCreateDevRegKeyA@28
SetupDiCreateDevRegKeyW@28
SetupDiDeleteDevRegKey@20
SetupDiOpenClassRegKey@8
SetupDiOpenDevRegKey@24
sfc.dll
shell32.dll
WOWShellExecute@28
ShellExecuteW@24
ShellExecuteExW@4
ShellExecuteExA@4
ShellExecuteEx@4
ShellExecuteA@24
SHFileOperationW@4
SHFileOperationA@4
SHFileOperation@4
RealShellExecuteW@40
RealShellExecuteExW@44
RealShellExecuteExA@44
RealShellExecuteA@40
PathIsExe@4
FindExecutableW@12
FindExecutableA@12
FindExeDlgProc@16
shfolder.dll
shlwapi.dll
PathIsURLA@4
PathIsURLW@4
SHDeleteOrphanKeyA@8
SHDeleteOrphanKeyW@8
SHDeleteEmptyKeyA@8
SHDeleteEmptyKeyW@8
SHDeleteKeyA@8
SHDeleteKeyW@8
SHEnumKeyExA@16
SHEnumKeyExW@16
SHQueryInfoKeyA@20
SHQueryInfoKeyW@20
SHRegOpenUSKeyA@20
SHRegOpenUSKeyW@20
SHRegCreateUSKeyA@20
SHRegCreateUSKeyW@20
SHRegEnumUSKeyA@20
SHRegEnumUSKeyW@20
SHRegQueryInfoUSKeyA@24
SHRegQueryInfoUSKeyW@24
SHRegDeleteEmptyUSKeyA@12
SHRegDeleteEmptyUSKeyW@12
SHRegCloseUSKey@4
SHCopyKeyA@16
SHCopyKeyW@16
SHRegDuplicateHKey@4
AssocQueryStringByKeyW@24
AssocQueryStringByKeyA@24
AssocQueryKeyW@20
AssocQueryKeyA@20
UrlCompareA@12
UrlCompareW@12
UrlCombineA@20
UrlCombineW@20
UrlCanonicalizeA@16
UrlCanonicalizeW@16
UrlIsOpaqueA@4
UrlIsOpaqueW@4
UrlIsNoHistoryA@4
UrlIsNoHistoryW@4
UrlIsA@8
UrlIsW@8
UrlGetLocationA@4
UrlGetLocationW@4
UrlUnescapeA@16
UrlUnescapeW@16
UrlEscapeA@16
UrlEscapeW@16
UrlCreateFromPathA@16
UrlCreateFromPathW@16
PathCreateFromUrlA@16
PathCreateFromUrlW@16
UrlHashA@12
UrlHashW@12
UrlGetPartA@20
UrlGetPartW@20
UrlApplySchemeA@16
UrlApplySchemeW@16
wsnmp32.dll
SnmpSendMsg@20
SnmpRecvMsg@20
SnmpCancelMsg@8
SnmpSetPort@8
SnmpEncodeMsg@24
SnmpDecodeMsg@24
snmpapi.dll
SnmpSvcReportEvent@16
SnmpUtilVarBindListCpy@8
strlib.dll
svrapi.dll
tapi32.dll
toolbar.dll
toolhelp.dll
traffic.dll
url.dll
TranslateURLA@12
TranslateURLW@12
URLAssociationDialogA@24
URLAssociationDialogW@24
urlmon.dll
UrlMkBuildVersion@0
CreateURLMoniker@12
CreateURLMonikerEx@16
GetClassURL@8
IsValidURL@12
UrlMkSetSessionOption@16
UrlMkGetSessionOption@20
CoGetClassObjectFromURL@40
CoInternetParseUrl@28
CoInternetCombineUrl@28
CoInternetCompareUrl@12
CoInternetGetSecurityUrl@16
URLDownloadW@20
URLDownloadA@20
URLOpenPullStreamA@16
URLOpenPullStreamW@16
URLDownloadToFileA@20
URLDownloadToFileW@20
URLDownloadToCacheFileA@24
URLDownloadToCacheFileW@24
URLOpenBlockingStreamA@20
URLOpenBlockingStreamW@20
URLOpenStreamA@16
URLOpenStreamW@16
RegisterHotKey@16
UnregisterHotKey@8
EnumWindows@8
EnumChildWindows@12
EnumThreadWindows@12
CreateDialogIndirectParamA@20
CreateDialogIndirectParamW@20
LoadKeyboardLayoutA@8
LoadKeyboardLayoutW@8
ActivateKeyboardLayout@8
UnloadKeyboardLayout@4
GetKeyboardLayoutNameA@4
GetKeyboardLayoutNameW@4
GetKeyState@4
GetAsyncKeyState@4
GetKeyboardState@4
SetKeyboardState@4
GetKeyNameTextA@12
GetKeyNameTextW@12
GetKeyboardType@4
VkKeyScanA@4
VkKeyScanW@4
MapVirtualKeyA@8
MapVirtualKeyW@8
OemKeyScan@4
MsgWaitForMultipleObjects@20
MsgWaitForMultipleObjectsEx@20
EnumWindowStationsA@8
EnumWindowStationsW@8
EnumDesktopWindows@12
CreateWindowStationA@16
CreateWindowStationW@16
OpenWindowStationA@12
OpenWindowStationW@12
CloseWindowStation@4
SetProcessWindowStation@4
GetProcessWindowStation@0
SetWindowsHookA@8
SetWindowsHookW@8
UnhookWindowsHook@8
SetWindowsHookExA@16
SetWindowsHookExW@16
UnhookWindowsHookEx@4
CallMsgFilterA@8
CallMsgFilterW@8
CallMsgFilter@8
ArrangeIconicWindows@4
CascadeChildWindows@8
TileChildWindows@8
ExitWindowsEx@8
keybd_event@16
CascadeWindows@20
GetKeyboardLayout@4
GetKeyboardLayoutList@8
MapVirtualKeyExA@12
MapVirtualKeyExW@12
TileWindows@20
VkKeyScanExA@8
VkKeyScanExW@8
WINNLSGetIMEHotkey@4
userenv.dll
uxtheme.dll
version.dll
webpost.dll
win32spl.dll
winfax.dll
FaxEnumPortsA@12
FaxEnumPortsW@12
FaxGetPortA@8
FaxGetPortW@8
FaxOpenPort@16
FaxSetPortA@8
FaxSetPortW@8
winhttp.dll
WinHttpTimeFromSystemTime@8
WinHttpTimeToSystemTime@8
WinHttpCrackUrl@16
WinHttpCreateUrl@16
WinHttpCheckPlatform@0
WinHttpGetDefaultProxyConfiguration@4
WinHttpSetDefaultProxyConfiguration@4
WinHttpDetectAutoProxyConfigUrl@8
WinHttpGetProxyForUrl@16
WinHttpGetIEProxyConfigForCurrentUser@4
WinHttpOpen@20
WinHttpSetStatusCallback@16
WinHttpSetOption@16
WinHttpQueryOption@16
WinHttpConnect@16
WinHttpOpenRequest@28
WinHttpAddRequestHeaders@16
WinHttpSetCredentials@24
WinHttpSendRequest@28
WinHttpWriteData@16
WinHttpReceiveResponse@8
WinHttpQueryHeaders@24
WinHttpQueryAuthSchemes@16
WinHttpQueryDataAvailable@8
WinHttpReadData@16
WinHttpCloseHandle@4
WinHttpSetTimeouts@20
WinHttpAutoProxySvcMain@8
wininet.dll
CommitUrlCacheEntryA@44
CommitUrlCacheEntryW@44
CreateUrlCacheContainerA@32
CreateUrlCacheContainerW@32
CreateUrlCacheEntryA@20
CreateUrlCacheEntryW@20
CreateUrlCacheGroup@8
DeleteUrlCacheContainerA@8
DeleteUrlCacheContainerW@8
DeleteUrlCacheEntry@4
DeleteUrlCacheEntryA@4
DeleteUrlCacheEntryW@4
DeleteUrlCacheGroup@16
ExportCookieFileA@8
ExportCookieFileW@8
FindCloseUrlCache@4
FindFirstUrlCacheContainerA@16
FindFirstUrlCacheContainerW@16
FindFirstUrlCacheEntryA@12
FindFirstUrlCacheEntryExA@40
FindFirstUrlCacheEntryExW@40
FindFirstUrlCacheEntryW@12
FindFirstUrlCacheGroup@24
FindNextUrlCacheContainerA@12
FindNextUrlCacheContainerW@12
FindNextUrlCacheEntryA@12
FindNextUrlCacheEntryExA@24
FindNextUrlCacheEntryExW@24
FindNextUrlCacheEntryW@12
FindNextUrlCacheGroup@12
FreeUrlCacheSpaceA@12
FreeUrlCacheSpaceW@12
FtpCommandA@24
FtpCommandW@24
FtpCreateDirectoryA@8
FtpCreateDirectoryW@8
FtpDeleteFileA@8
FtpDeleteFileW@8
FtpFindFirstFileA@20
FtpFindFirstFileW@20
FtpGetCurrentDirectoryA@12
FtpGetCurrentDirectoryW@12
FtpGetFileA@28
FtpGetFileEx@28
FtpGetFileSize@8
FtpGetFileW@28
FtpOpenFileA@20
FtpOpenFileW@20
FtpPutFileA@20
FtpPutFileEx@20
FtpPutFileW@20
FtpRemoveDirectoryA@8
FtpRemoveDirectoryW@8
FtpRenameFileA@12
FtpRenameFileW@12
FtpSetCurrentDirectoryA@8
FtpSetCurrentDirectoryW@8
GetUrlCacheConfigInfoA@12
GetUrlCacheConfigInfoW@12
GetUrlCacheEntryInfoA@12
GetUrlCacheEntryInfoExA@28
GetUrlCacheEntryInfoExW@28
GetUrlCacheEntryInfoW@12
GetUrlCacheGroupAttributeA@28
GetUrlCacheGroupAttributeW@28
GetUrlCacheHeaderData@8
HttpAddRequestHeadersA@16
HttpAddRequestHeadersW@16
HttpCheckDavCompliance@20
HttpCheckDavComplianceA@20
HttpCheckDavComplianceW@20
HttpEndRequestA@16
HttpEndRequestW@16
HttpOpenRequestA@32
HttpOpenRequestW@32
HttpQueryInfoA@20
HttpQueryInfoW@20
HttpSendRequestA@20
HttpSendRequestExA@20
HttpSendRequestExW@20
HttpSendRequestW@20
ImportCookieFileA@4
ImportCookieFileW@4
IncrementUrlCacheHeaderData@8
InternetCanonicalizeUrlA@16
InternetCanonicalizeUrlW@16
InternetCombineUrlA@20
InternetCombineUrlW@20
InternetCrackUrlA@16
InternetCrackUrlW@16
InternetCreateUrlA@16
InternetCreateUrlW@16
InternetGetCertByURL@12
InternetGetCertByURLA@12
InternetOpenUrlA@24
InternetOpenUrlW@24
InternetShowSecurityInfoByURL@8
InternetShowSecurityInfoByURLA@8
InternetShowSecurityInfoByURLW@8
IsHostInProxyBypassList@12
IsUrlCacheEntryExpiredA@12
IsUrlCacheEntryExpiredW@12
LoadUrlCacheContent@0
ParseX509EncodedCertificateForListBoxEntry@16
PerformOperationOverUrlCacheA@40
ReadUrlCacheEntryStream@20
RegisterUrlCacheNotification@24
RetrieveUrlCacheEntryFileA@16
RetrieveUrlCacheEntryFileW@16
RetrieveUrlCacheEntryStreamA@20
RetrieveUrlCacheEntryStreamW@20
RunOnceUrlCache@16
SetUrlCacheConfigInfoA@8
SetUrlCacheConfigInfoW@8
SetUrlCacheEntryGroup@28
SetUrlCacheEntryGroupA@28
SetUrlCacheEntryGroupW@28
SetUrlCacheEntryInfoA@12
SetUrlCacheEntryInfoW@12
SetUrlCacheGroupAttributeA@24
SetUrlCacheGroupAttributeW@24
SetUrlCacheHeaderData@8
ShowClientAuthCerts@4
ShowX509EncodedCertificate@12
UnlockUrlCacheEntryFile@8
UnlockUrlCacheEntryFileA@8
UnlockUrlCacheEntryFileW@8
UnlockUrlCacheEntryStream@8
UpdateUrlCacheContentPath@4
winmm.dll
mciExecute@4
midiOutLongMsg@12
midiOutShortMsg@8
EnumPortsA@24
EnumPortsW@24
AddPortA@12
AddPortW@12
ConfigurePortA@12
ConfigurePortW@12
DeletePortA@12
DeletePortW@12
AddPortExW@16
AddPortExA@16
SetPortA@16
SetPortW@16
EnumPrinterKeyA@20
EnumPrinterKeyW@20
DeletePrinterKeyA@8
DeletePrinterKeyW@8
GetPrinterWebInformation@16
wintrust.dll
WinSubmitCertificate@4
wldap32.dll
ldap_extended_operation
ldap_extended_operationA
ldap_extended_operationW
ldap_msgfree
ldap_conn_from_msg
ldap_extended_operation_sW
ldap_extended_operation_sA
wow32.dll
ws2_32.dll
getservbyport@8
WSAAsyncGetServByPort@24
WSAJoinLeaf@32
wsock32.dll
GETXBYYSP_WSAAsyncGetServByPort@24
GETXBYYSP_getservbyport@8
wst.dll
wtsapi32.dll
WTSShutdownSystem@8
zlib.dll
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.PAVCUserException@@
.PAVCArchiveException@@
.PAVCObject@@
.PAVCSimpleException@@
.PAVCResourceException@@
.?AVCToolCmdUI@@
.?AVCMDIFrameWnd@@
.?AVCMDIChildWnd@@
.PAVCMemoryException@@
.PAVCNotSupportedException@@
.?AVCNotSupportedException@@
.?AVCStatusCmdUI@@
.PAVCOleException@@
.PAVCOleDispatchException@@
zcÁ
%d.%m.%Y
%Documents and Settings%\%current user%\Application Data\IDMComp\UltraEdit\
%Documents and Settings%\%current user%\Application Data\IDMComp\UltraEdit\uedit32.INI
C:\TOTALCMD\UE\uedit32.exe
Keywords
C   Keywords
Operators
OPERATORS
type="win32" name="uedit32.exe"/>
name="Microsoft.Windows.Common-Controls" version="6.0.0.0"
publicKeyToken="6595b64144ccf1df" language="*"
373333737
037??804
111|111\111
1115111
1112111
111#111211121112111
1118111
33333335
*,.88, #
***[***2
%%X

win7.exe_316:


.text
`.rdata
@.data
.rsrc
t(j.Xj\f
SSShtxB
^SShq
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
operator
GetProcessWindowStation
USER32.DLL
d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb
COMCTL32.dll
SHLWAPI.dll
GetCPInfo
KERNEL32.dll
USER32.dll
GDI32.dll
COMDLG32.dll
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
ADVAPI32.dll
SHFileOperationW
ShellExecuteExW
SHELL32.dll
ole32.dll
OLEAUT32.dll
GetConsoleOutputCP
WINRAR.SFX
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\win7.exe
:(,4;<=>;?@
3,45657879
8888888888887
version="1.0.0.0"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
Maximum allowed array size (%u) is exceeded
%.*ls(%u)%ls
rtmp%d
Crypt32.dll
GETPASSWORD1
%s %s
%s %s %s
%s%s%d
Software\Microsoft\Windows\CurrentVersion
%s.%d.tmp
winrarsfxmappingfile.tmp
-el -s2 "-d%s" "-p%s" "-sp%s"
__tmp_rar_sfx_access_check_%u
sfxcmd
WaitForMultipleObjects error %d, GetLastError %d
Windows

WScript.exe_640:


.text
`.data
.rsrc
@.reloc
ADVAPI32.dll
KERNEL32.dll
NTDLL.DLL
USER32.dll
msvcrt.dll
OLEAUT32.dll
ole32.dll
VERSION.dll
wscript.exe
advapi32.dll
kernel32.dll
%s%s.DLL
wintrust.dll
%d.%d
Invalid parameter passed to C runtime function.
SOFTWARE\Classes\%s\%s
0x%8X
CreateURLMonikerEx
urlmon.dll
@@8X%u
RegCreateKeyA
RegCloseKey
RegOpenKeyA
RegDeleteKeyA
RegCreateKeyExW
RegCreateKeyExA
RegOpenKeyExW
ReportEventW
RegEnumKeyExA
RegOpenKeyExA
GetProcessHeap
GetCPInfo
MsgWaitForMultipleObjects
EnumThreadWindows
wscript.pdb
stdole2.tlbWWW
.ObjectWW
KeyW
WindowsFolderWWW4
%CopyFolderWWL
Windows Script Host (Ver 5.6)W)
Windows Script Host Application InterfaceW%
Windows Script Host Object
ebstrCmdLineW
78t8x8
5Q5F5
Software\Microsoft\Windows Script Host\Settings
Windows Script Host
WScript.CreateObject
WSHRemote.Execute
Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}
.\%s.mui
.\%s\%s.mui
%s\%s.mui
%s\%s\%s.mui
%s\%s
Microsoft (R) Windows Based Script Host
5.7.0.16599
Microsoft (R) Windows Script Host
(Windows Script Host (debugging disabled)
Windows Script Host Error
Windows Script Host Input Error
This Unicode version of Windows Script Host will only execute under Windows NT.
Please use the ANSI version of Windows Script Host."
WScript execution time was exceeded on script "%1!ls!".
Script execution was terminated.1Could not locate automation class named "%1!ls!".
Could not connect object.'Could not create object named "%1!ls!".1Initialization of the Windows Script Host failed.6Can't find script engine "%2!ls!" for script "%1!ls!".!Can't change default script host.=An attempt at saving your settings via the //S option failed.(Loading script "%1!ls!" failed (%2!ls!).
Loading your settings failed.,Execution of the Windows Script Host failed.,Unexpected error of the Windows Script Host._Windows Script Host access is disabled on this machine. Contact your administrator for details.
Missing job name.*Unicode is not supported on this platform.
Command line options are saved.4The default script host is now set to "wscript.exe".4The default script host is now set to "cscript.exe".,Successful execution of Windows Script Host.3Successful remote execution of Windows Script Host.
Win32 Error 0x%X
Windows Script Host(Windows Script Host (debugging disabled)
Usage: WScript scriptname.extension [option...] [arguments...]
Use engine for executing script
Changes the default script host to CScript.exe
Changes the default script host to WScript.exe (default)
Prevent logo display: No banner will be shown at execution time
#WScript Error - Windows Script Host!Input Error - Windows Script HostlThis Unicode version of WScript will only execute under Windows NT.
%6!ls! WScript - Script Execution Error!Windows Script Host Remote Script/Remote script object can only be executed once. Unable to execute remote script.

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   WScript.exe:640
   win7.exe:316

2. Delete the original Backdoor file.
   
3. Delete or disinfect the following files created/modified by the Backdoor:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\re.txt (735 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\win7.exe (5105568 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\FP83.tmp (229 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\foxyinstalled.dll (52736 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\LinkMaker.dll (112640 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\Conf\Addresses.cfg (2296 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\win7.exe (5234688 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\win7.vbs (574 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
   "office" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\RarSFX0\office.exe"
   
   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "office" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\RarSFX0\office.exe"

5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.