4 0 0 nopassword password12 secret superman iloveyou helpme home123 username Password admin Admin administrator passwd login Login changeme fuck manager master password Administrator batman superman 123123 12321 123321 123abc 123qwe 123asd 1234abcd 1234qwer 1q2w3e a1b2c3 qwewq pass mypass mypassword adminadmin superuser supervisor password1 password12 password123 admin1 admin12 admin123 pass1 pass12 pass123 root123 pw123 qwe123 love123 nopass nopassword nothing ihavenopass super threatexpert emsisoft rising pctools norman k7computing ikarus hacksoft gdata fortinet ewido clamav comodo quickheal avira avast esafe ahnlab centralcommand drweb grisoft nod32 f-prot jotti computerassociates networkassociates etrust panda sophos trendmicro defender rootkit spyware Kaspersky BitDefender Dr.Web Kaspersky Antivirus Nod32 Antivirus 2.x Ewido Security Suite McAfee VirusScan Panda Antivirus/Firewall Symantec/Norton Symantec Shared Symantec PC-cillin Antivirus F-Secure Kingsoft ShaDu NOD32 Antivirus Rising Antivirus Jiangmin Antivirus 360 ShaDu 360 Safe McAfee AV Bitdefender AV Norton Symantec AV F-Secure AV AhnLab V3 Internet Security 8 Avast AntiVirus Avira Antivirus Eset Nod32 Scanner F-Secure Gatekeeper Handler Starter F-Secure Recognizer F-Secure HIPS F-Secure Gatekeeper F-Secure Filter WinDefend OutpostFirewall McAfee Framework Service Panda Antivirus ZoneAlarm Client Zone Labs Client windefender {[!22!]}{[!18!]}{[!33!]}{[!4!]}{[!34!]}= %d, {[!35!]}= 0x%x.{[!36!]} {[!23!]}{[!22!]}, {[!24!]}{[!4!]}%d{[!25!]} {[!28!]}%d.%d, {[!29!]}%d.%d.{[!1!]} {[!37!]}{[!35!]}{[!4!]}{[!38!]}0x%x,{[!39!]}0x%x. {[!37!]}{[!35!]}{[!4!]}{[!38!]}0x%x,{[!39!]}0x%x.{[!36!]} {[!41!]}{[!4!]}{[!42!]}= 0x%x, {[!34!]}= 0x%x.{[!36!]} [3-9]{1}[0-9]{1219}[D=\u0061][0-9]{1030} ((b|B)[0-9]{1319}\^[A-Za-z\s]{030}\/[A-Za-z\s]{030}\^(0[7-9]|1[0-5])((0[1-9])|(1[0-2]))[0-9\s]{350}[0-9]{1}) ([0-9]{1516}[D=](0[7-9]|1[0-5])((0[1-9])|(1[0-2]))[0-9]{830}) [0-9]{1516}\^[a-zA-Z0-9=*> [0-9]{1516}=[0-9]{532}.{120} ([0-9]{1319}[=D][0-9]{550})\? ([0-9]{1319}[\^][A-Za-z\s]{030}[\/][[A-Za-z\s]{030}[\^]([0-9\s]{170})\?) ("^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$") ^http[s]?://([^\/:\s]+)(:[^\/\s]+)?(\/?[^\s]*)$ {[!11!]}{[!4!]} {[!12!]}{[!10!]}http://%s:%d{[!4!]} {[!13!]}{[!4!]} {[!14!]}{[!4!]} {[!15!]}{[!4!]} {[!16!]}{[!20!]}{[!26!]}%s {[!16!]}{[!46!]}%s (%d) {[!17!]}{[!18!]} {[!17!]}{[!19!]} {[!2!]}{[!20!]}{[!21!]}%s {[!22!]}%s{[!5!]} {[!22!]}{[!18!]}{[!33!]}{[!4!]}{[!34!]}= %d {[!35!]}= 0x%x.{[!36!]} {[!22!]}{[!5!]}%s -> %s [%d]{[!35!]}= 0x%x (== 0x%x) {[!23!]}{[!22!]} {[!24!]}{[!4!]}%d{[!25!]} {[!27!]}{[!30!]}{[!4!]}%s.{[!2!]} {[!28!]}%d.%d {[!29!]}%d.%d.{[!1!]} {[!29!]}{[!1!]} {[!29!]}{[!32!]}%s {[!3!]}%s{[!4!]} {[!30!]}{[!31!]}{[!4!]} {[!37!]}{[!35!]}{[!4!]}{[!38!]}0x%x{[!39!]}0x%x. {[!37!]}{[!35!]}{[!4!]}{[!38!]}0x%x{[!39!]}0x%x.{[!36!]} {[!4!]}{[!10!]}{[!44!]}{[!43!]}{[!21!]} {[!4!]}{[!45!]}{[!21!]} {[!40!]}{[!4!]}{[!36!]} {[!41!]}{[!4!]}{[!42!]}= 0x%x {[!34!]}= 0x%x.{[!36!]} {[!43!]}{[!4!]} {[!46!]}%d{[!1!]} ((b|B)[0-9]{13,19}\^[A-Za-z\s]{0,30}\/[A-Za-z\s]{0,30}\^(1[1-9])((0[1-9])|(1[0-2]))[0-9\s]{3,50}[0-9]{1}) ([3-9]{1}[0-9]{14,15}[D=](1[1-9])((0[1-9])|(1[0-2]))[0-9]{8,30}) ((b|B)[0-9]{13,19}\^[A-Za-z\s]{0,30}\/[A-Za-z\s]{0,30}\^(0[7-9]|1[0-5])((0[1-9])|(1[0-2]))[0-9\s]{3,50}[0-9]{1}) ([0-9]{15,16}[D=](0[7-9]|1[0-5])((0[1-9])|(1[0-2]))[0-9]{8,30}) SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeBackupPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeCreatePagefilePrivilege SeCreatePermanentPrivilege SeCreateSymbolicLinkPrivilege SeCreateTokenPrivilege SeDebugPrivilege SeEnableDelegationPrivilege SeImpersonatePrivilege SeIncreaseBasePriorityPrivilege SeIncreaseQuotaPrivilege SeIncreaseWorkingSetPrivilege SeLoadDriverPrivilege SeLockMemoryPrivilege SeMachineAccountPrivilege SeManageVolumePrivilege SeProfileSingleProcessPrivilege SeRelabelPrivilege SeRemoteShutdownPrivilege SeRestorePrivilege SeSecurityPrivilege SeShutdownPrivilege SeSyncAgentPrivilege SeSystemEnvironmentPrivilege SeSystemProfilePrivilege SeSystemtimePrivilege SeTakeOwnershipPrivilege SeTcbPrivilege SeTimeZonePrivilege SeTrustedCredManAccessPrivilege SeUndockPrivilege SeUnsolicitedInputPrivilege 1.3.6.1.4.1.311.10.3.3 1.3.6.1.5.5.7.3.2 1.3.6.1.5.5.7.3.1 1.2.840.113549.1.1.1 1.2.840.10008.1.2.1 1.2.840.10008.5.1.4.1.1.2 1.2.840.10008.5.1.4.1.1.2 1.2.840.10008.5.1.4.1.1.2 1.2.840.113619.2.55.1.1762927638.1997.1071150670.293 1.2.840.113619.2.55.1.1762927638.1997.1071150670.294.11.4516.0 1.2.840.113619.2.55.1.1762927638.1997.1071150670.296 1.2.840.113619.2.55.1.1762927638.1997.1071150670.297 1.2.840.113619.2.55.1.1762927638.1997.1071150670.298 1.2.840.113619.2.55.1.1762927638.1997.1071150670.298 1.2.840.113549.1.1.11 1.2.840.113549.1.1.2 1.2.840.113549.1.1.4 1.2.840.113549.1.1.5 1.2.840.113549.1.9.6 1.2.840.113549.2.5 1.2.840.113549.1.9.5 1.2.840.113556.1.4.1221 1.2.840.113556.1.4.1222 1.2.840.113556.1.4.1362 1.2.840.113556.1.4.1413 1.2.840.113556.1.4.521 1.2.840.113556.1.4.616 1.2.840.113556.1.4.801 1.2.840.113556.1.4.805 1.2.840.113556.1.4.903 1.2.840.113556.1.4.904 1.2.840.113556.1.4.905 1.2.840.113556.1.4.906 1.2.840.113556.1.4.907 1.3.14.3.2.26 1.3.14.3.2.29 1.3.14.3.2.3 1.3.6.1.4.1.311.10.3.6 1.3.6.1.4.1.311.88.2.1 1.3.6.1.4.1.311.88.2.2 1.3.6.1.4.1.311.20.2.3 1.3.6.1.4.1.311.20.2.2 1.3.6.1.4.1.311.2.1.12 1.3.6.1.4.1.311.76.8.1;1.3.6.1.4.1.311.76.11.1 1.3.6.1.4.1.1466.115.121.1.10 1.3.6.1.4.1.1466.115.121.1.11 1.3.6.1.4.1.1466.115.121.1.12 1.3.6.1.4.1.1466.115.121.1.13 1.3.6.1.4.1.1466.115.121.1.14 1.3.6.1.4.1.1466.115.121.1.15 1.3.6.1.4.1.1466.115.121.1.19 1.3.6.1.4.1.1466.115.121.1.2 1.3.6.1.4.1.1466.115.121.1.21 1.3.6.1.4.1.1466.115.121.1.22 1.3.6.1.4.1.1466.115.121.1.23 1.3.6.1.4.1.1466.115.121.1.24 1.3.6.1.4.1.1466.115.121.1.25 1.3.6.1.4.1.1466.115.121.1.26 1.3.6.1.4.1.1466.115.121.1.27 1.3.6.1.4.1.1466.115.121.1.28 1.3.6.1.4.1.1466.115.121.1.3 1.3.6.1.4.1.1466.115.121.1.32 1.3.6.1.4.1.1466.115.121.1.33 1.3.6.1.4.1.1466.115.121.1.34 1.3.6.1.4.1.1466.115.121.1.36 1.3.6.1.4.1.1466.115.121.1.37 1.3.6.1.4.1.1466.115.121.1.38 1.3.6.1.4.1.1466.115.121.1.39 1.3.6.1.4.1.1466.115.121.1.4 1.3.6.1.4.1.1466.115.121.1.40 1.3.6.1.4.1.1466.115.121.1.41 1.3.6.1.4.1.1466.115.121.1.43 1.3.6.1.4.1.1466.115.121.1.44 1.3.6.1.4.1.1466.115.121.1.5 1.3.6.1.4.1.1466.115.121.1.50 1.3.6.1.4.1.1466.115.121.1.51 1.3.6.1.4.1.1466.115.121.1.52 1.3.6.1.4.1.1466.115.121.1.53 1.3.6.1.4.1.1466.115.121.1.6 1.3.6.1.4.1.1466.115.121.1.7 1.3.6.1.4.1.1466.115.121.1.8 1.3.6.1.4.1.1466.115.121.1.9 1.3.6.1.5.5.7.3.3 1.3.6.1.2.1.25.2.3.1.2 1.3.6.1.2.1.25.2.3.1.2 1.3.6.1.2.1.25.2.1.1 1.3.6.1.2.1.25.2.1.2 1.3.6.1.4.1.23.2.27.2.1.3 1.3.6.1.4.1.23.2.27.2.1.6 1.3.6.1.4.1.23.2.27.2.1.4 1.3.6.1.4.1.23.2.27.2.1.5 1.3.6.1.4.1.23.2.27.2.1.7 1.3.6.1.4.1.23.2.27.2.1.8 1.3.6.1.2.1.25.2.1.3 1.3.6.1.2.1.25.2.1.4 1.3.6.1.4.1.23.2.27.2.1.1 1.3.6.1.2.1.25.2.1.5 1.3.6.1.2.1.25.2.1.6 1.3.6.1.2.1.25.2.1.7 1.3.6.1.2.1.25.2.1.8 1.3.6.1.2.1.25.2.1.9 1.3.6.1.2.1.25.2.1.10 1.3.6.1.2.1.25.2.3.1.3 1.3.6.1.2.1.2.2.1.2 2.16.840.1.113730.4.1 2.5.29.16 2.5.29.33 2.5.29.9 2.5.29.30 2.5.29.31 2.5.29.37.0 2.5.29.54 2.5.29.46 2.5.29.28 2.5.29.27 2.5.29.29 2.5.4.9 2.5.4.13 2.5.4.17 2.5.4.41 2.5.4.45 2.5.4.72 2.5.5.3 2.5.5.17 2.5.5.15 2.5.5.14 2.5.5.7 2.5.5.13 2.5.5.6 2.5.5.4 2.5.5.5 2.5.5.2 2.5.5.1 2.5.5.16 2.5.5.11 2.5.5.12 2.5.5.10 2.5.5.9 2.5.5.8 2.5.29.32.0 2.5.29.37 2.5.29.36 2.5.29.35 2.5.29.32 2.5.29.24 2.5.29.23 2.5.29.21 2.5.29.20 2.5.29.19 2.5.29.18 2.5.29.17 2.5.29.15 2.5.29.14 2.5.4.65 2.5.4.46 2.5.4.44 2.5.4.43 2.5.4.42 2.5.4.12 2.5.4.11 2.5.4.10 2.5.4.8 2.5.4.7 2.5.4.6 2.5.4.5 2.5.4.4 2.5.4.3 2.5.8.1.1 3.7.6.3 Mozilla/ Opera/ User-Agent 3fr 386 666 3dm 3ds 7z Application accdb au3 a3x acf ade adn adp ani arc api amr arcs apk arch00 arw asset arj asf asp asm asx avi atf app aspx admin acm alz ax b64 bc7 bc6 bay big bit bik bkf bkp blob bsa bat bot bak bhx bin bmp binPK bar bas bsd backup bk cdw csr c cx cc cas cdr cer cfr cr2 crt crw css csv c cab cpio cap cbl cbm cert cbo css cache cfg cfm cpp cxx cer ceo ce0 chm cgi classPK cmd cnt conf com cs cpl crl ctl cur class cbtl cid CIN cxm config dat dbg dsm dun dk db de docx dotm docm drv doc docc docpk dot d3dbsp das dazip db0 dbfv dcr dic dir dif der dex desc dmp dng dwg dxg dba dbf dsp dsw dtd detour download db2 dll ecc edt epk eps erf esm en exd exe ex_ _exe email emf eot eddx edoc emlx epub exePK elb epl eml evt fini flv forge fos fpk fsh fpl flg far fav ftp fla fra frm go gdb gho gzip gz gif gadget gcode gul hlp hpj hta hhp hkdb hkx hplg hvpl h hpp hxx htm html htt http hqx ht htapk href hxi hxs hna hwp ibank icxs indd itdb itl itm iwd iwi ini inl iniPK inc ico idc info inf ins iso isp it its idml indd identifier jar jav java jcr jpeg jpegPK js jsp jpe jpg jse jfif jspa jspx jps kdb kdc key kwp locky layout lbf ldf litemod lrf lnk ltx lvl lzh lnk lsf lsx log lzma locked max md mad maf mail maq mar mas mat mav maw mam mag m3u m4a map mcr mcgame mcmeta msi msp mst msc mda mde mdz mht mdb mdn mdt mdbackup manifest mddata mdf mef mp4 mid mov msg mspx msh midi mim mmf menu mlx mpqge mrwref mp3 mpg mpeg mp3PK mbox mdbackup mddata mdinfo m4v mkv mui memdump m4u myi myd nak net nch nrg nls ncb ncf nrw ntl nws note nt ogg oca ocx oft oss olb org osd odb odc odm odp ods old odt orf ovl opt oxps odx paf paf pbk pct pdc pkxm pcap pack pyz pps pdb php phtml p12 p7b pict p7c pak pas pdd pdf pic pyd pkg pyr pyt pyz pef pem pfx pkpass png pol pot plg ppa ppt prf pptm pptx psd psk pf py pypk pst pwl ptx pif pl pls pax pad plist pub phtm php3 php4 php5 phps phpx phpxx ppdf ppsm ppsx plist_bak Permissions pcmp pcmi pcmt ppk prj plugin pck pkb pks plb qc qdf qic qtl qtif qtx ro rodata rar rat reg rels rtf r3d raf rar ru raw re4 rgss3a rim rofl rtf rw2 rwl rdp rdf rjs rm rpt relspk rsapk rtfpk rdo sqlite sqlite3 sch sdb stc std sti stw sxc sxd sxi sxm sxw sdb scf scp sfx sfpk sql scr sct shb so shs sit slk smi smil stl stm spl sys swf sav sc2save sid sidd sidn sie sis slm snx sr2 srfv srw sum svg syncdb srf sys ssh sldm sldx sdf scl scd sig shell t13 tet tar tz taz tgz tif tiff tga tmp temp txt tlb txt3 t12 t13v tax tor trc torrent thm ttf unity3d upk url ult vb vbe vbs vbp vdf vfs0 vpk vaf vpp_pcv vtf vcf vbspk vxd vhdx vhdx vmdk vfs4 vpp_pc vhd vdi vbox vob vre wav wab wap wbk wiz wjf ws w3x wb2 wma wmf wmo wmv wotreplay wpd wps wsc wsf wsh webm wks wk1 wallet wri wpx x3f xaml xla xsd xls xsl xlb xlsm xlsm xlsx xlt xlv xml xmlPK xmp xll xlsm xlsx xlc xld xlk xor xlw xltx xltm xlsb xlm xxx xfp xsd xyz xbtl x509crl x509cert XRF z zip zipx ztmp zoo D:P(A;;GA;;;BA)(A;;GA;;;SY)(A;;GA;;;%s) D:P(A;;GA;;;BA)(A;;GA;;;SY)(A;;GA;;;%s)S:(ML;;NR;;;HI) D:P(A;OICI;GA;;;BA)(A;OICI;GA;;;SY) D:P(A;;GA;;;SY)(A;;GA;;;BA)(A;;GA;;;WD)(A;;GA;;;RC)(A;;GA;;;AC)S:(ML;;NW;;;S-1-16-0) D:P(A;;GA;;;SY)(A;;GA;;;BA)(A;;GA;;;WD)(A;;GA;;;RC)S:(ML;;NW;;;LW) D:P(A;CIOI;FA;;;SY)(A;CIOI;FA;;;BA)(A;CIOI;FA;;;WD) (A;;0xb;;;AC) (A;;0x3;;;AC) D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GA;;;AU)(A;OICI;GA;;;BA) D:(A;;GA;;;WD)(A;;GA;;;AN)S:(ML;;NW;;;S-1-16-0) D:(A;OICI;GA;;;WD)S:(ML;CIOI;NRNWNX;;;LW) D:(A;OICI;GA;;;WD) D:(A;;GA;;;WD)S:(ML;;NRNWNX;;;LW) D:(A;;GA;;;WD) D:(A;OICI;GA;;;CO)(A;OICI;GA;;;SY)(A;OICI;GA;;;BA)(A;OICI;GA;;;%s) D:AI(A;;GAFA;;;WD) D:AI(A;;RPWPCCDCLCSWRCWDWOGA;;;WD) D:P(D;CIOI;GA;;;BG)(D;CIOI;GA;;;LG)(A;;GA;;;WD) D:P(D;CIOI;GA;;;DG)(D;CIOI;GA;;;BG)(D;CIOI;GA;;;LG)(A;;GA;;;WD) D:P(D;CIOI;GA;;;BG)(D;CIOI;GA;;;LG)(D;;SD;;;WD)(A;;0x1e01ff;;;WD)(A;OICIIO;GA;;;WD) D:P(D;CIOI;GA;;;DG)(D;CIOI;GA;;;BG)(D;CIOI;GA;;;LG)(D;;SD;;;WD)(A;;0x1e01ff;;;WD)(A;OICIIO;GA;;;WD) D:(A;;LC;;;WD)(A;;CCDCLCSWRPSDRCWDWO;;;SY)(A;;LCSWRPRCGW;;;BA)(A;;LC;;;AC);AC);AC) D:(A;;0x100001;;;WD)(A;;0x1f0001;;;SY)(A;;0x1f0001;;;%s)(A;;0x100001;;;AC);AC);AC) D:(A;;0x00120001;;;WD)(A;;0x001C0002;;;PS) D:(A;;0x00120003;;;WD) D:(A;;0x00120001;;;WD)(A;;0x001C0002;;;PS) D:(A;;0x00120003;;;WD) D:(A;;0x100001;;;WD)(A;;0x1f0001;;;SY)(A;;0x1f0001;;;%s)(A;;0x100001;;;AC);AC);AC) D:(A;;GR;;;RC)(A;;GR;;;%s) D:(A;;GR;;;RC)(A;;GR;;;%s)(A;;GR;;;%s) D:(A;;GRGWGX;;;WD)(A;;GRGWGX;;;RC)(A;;GA;;;BA)(A;;GA;;;OW)(A;;GR;;;AC)(A;;LC;;;AC) D:(A;;LC;;;WD)(A;;CCDCLCSWRPSDRCWDWO;;;SY)(A;;CCDCLCSWRPSDRCWDWO;;;%s)(A;;LC;;;AC) D:(A;;LC;;;WD)(A;;CCDCLCSWRPSDRCWDWO;;;SY)(A;;LCSWRPRCGW;;;BA)(A;;LC;;;AC);AC);AC) D:(A;;0x1f0003;;;BA)(A;;0x100000;;;WD) D:(A;;GA;;;SY)(A;;0x%x;;;%s) D:(A;;GA;;;SY)(A;;0x%x;;;%s)S:(ML;;1;;;LW) D:(A;;GA;;;WD)(A;;GA;;;AN) D:(A;;GA;;;WD)(A;;GA;;;AN)S:(ML;;NW;;;LW) D:(A;;GA;;;AU)(A;;GA;;;BA)(A;;GA;;;AN)(A;;GA;;;BG)(A;;GA;;;AC)S:(ML;;NW;;;LW) D:(A;;FA;;;SY)(A;;FA;;;LS)(A;;FRFW;;;BA)(A;;FRFW;;;BU)(A;;FRFW;;;AN)S:(ML;;;;;LW) D:(D;OICI;FA;;;AN)(A;OICI;FA;;;BG)(A;OICI;FA;;;SY)(A;OICI;FA;;;LS)(A;OICI;FA;;;AU)(A;OICI;FA;;;BA)) D:(D;OICI;FA;;;AN)(A;OICI;FA;;;BG)(A;OICI;FA;;;SY)(A;OICI;FA;;;LS)(A;OICI;FA;;;AU)(A;OICI;FA;;;BA) D:P(A;;GA;;;SY) D:P(A;;GA;;;SY)(A;;GA;;;BA) D:P(A;;GA;;;SY)(A;;GRGX;;;BA) D:P(A;;GA;;;SY)(A;;GRGWGX;;;BA)(A;;GR;;;WD) D:P(A;;GA;;;SY)(A;;GRGWGX;;;BA)(A;;GR;;;WD)(A;;GR;;;RC) D:P(A;;GA;;;SY)(A;;GRGWGX;;;BA)(A;;GRGW;;;WD)(A;;GR;;;RC) D:P(A;;GA;;;SY)(A;;GRGWGX;;;BA)(A;;GRGWGX;;;WD)(A;;GRGWGX;;;RC) S:(ML;;NRNWNX;;;LW) S:(ML;CIOI;NRNWNX;;;LW) S:(ML;CIOI;NRNWNX;;;LW) S:(ML;;NW;;;LW)D:(A;;RPWPFAKAGA;;;WD)(A;;RPWPFAKAGA;;;AC) S:(ML;;NW;;;LW) S:(ML;;NW;;;S-1-16-0) S:(ML;;NW;;;LW)D:(A;;0x12019b;;;WD) O:BAG:BAD:(A;;0x7;;;WD)(A;;0x7;;;AN)(A;;0x7;;;%s)(A;;0x7;;;%s)(A;;0x3;;;AC) O:SYG:SYD:(A;;RC;;;SY) O:BAG:BAD:(A;;0x7;;;WD)(A;;0x3;;;AN)(A;;0x7;;;%s)(A;;0x7;;;%s)(A;;0x3;;;AC)C;;;AC) O:BAG:BAD:(A;;0x1f;;;BA)(A;;0xb;;;WD)(A;;0x1f;;;%s)(A;;0x1f;;;%s)(A;;0xb;;;AC);AC) O:SYD:(A;OICI;RC;;;SY)(A;OICI;RC;;;NS)(A;OICI;RC;;;S-1-5-80-3273805168-4048181553-3172130058-210131473-390205191) O:BAG:BAD:(A;;0x1f;;;BA)(A;;0xb;;;IU)(A;;0xb;;;SY) O:BAG:BAD:(A;;0x7;;;PS)(A;;0x3;;;SY)(A;;0x7;;;BA) WD:(A;;GA;;;WD) 27C3B8ED-0790-42BD-9AD7-18465E7F7696 27C3B8ED-0790-42BD-9AD7-18465E7F7696 27C3B8ED-0790-42BD-9AD7-18465E7F7696 97808F6C-4769-49D5-9553-18AE9C62ACD7 B196B286-BAB4-101A-B69C-00AA00341D07 D27CDB6E-AE6D-11CF-96B8-444553540000 abe2869f-9b47-4cd9-a358-c22904dba7f7 00000000-0000-0000-C000-000000000046 ADB880A6-D8FF-11CF-9377-00AA003B7A11 5e7e8100-9138-11d1-945a-00c04fc308ff 82bd0e67-9fea-4748-8672-d5efe5b779b0 5e7e8100-9138-11d1-945a-00c04fc308ff 82BD0E67-9FEA-4748-8672-D5EFE5B779B0 8856F961-340A-11D0-A96B-00C04FD705A2 RegistryKey ShellServiceObjectDelayLoad CurrentVersion Windows\CurrentVersion Windows NT\CurrentVersion \Software\Microsoft\Windows\CurrentVersion Software\Microsoft\Windows\CurrentVersion Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce SOFTWARE\Microsoft\Windows\CurrentVersion\Run Policies\Explorer\Run Run RunOnce RunServices RunServicesOnce \Device \DosDevices DEFAULT\Software .DEFAULT\Software HKEY_CURRENT_USER HKEY_LOCAL_MACHINE HKEY_DYN_DATA HKEY_PERFORMANCE_DATA HKEY_CLASSES_ROOT HKEY_CURRENT_USER HKEY_LOCAL_MACHINE HKEY_USERS HKEY_PERFORMANCE_DATA HKEY_CURRENT_CONFIG HKEY_DYN_DATA SYSTEM\ControlSet001\Services\ System\CurrentControlSet\Services\ HKCR HKCU HKLM HKPD HKDD HKCC HKCU Hardware\ disabletaskmanager warnonintranet loadappinit_dlls AppInit_DLLs noprotectedmodebanner clsid\ root\securitycenter \registry\machine system\currentcontrolset system\controlset001 system\controlset002 system\controlset003 system\wpa \systemroot \shell\open\command %ALLUSERPROFILE% AppData %APPDATA% commonappdata %CommonProgramFiles% %HOMEPATH% %LOCALAPPDATA% %ProgramData% %ProgramFiles% %PUBLIC% %SystemDrive% %SystemRoot% %TEMP% %USERPROFILE% %windows% %windir% %system% %temp% %user% %programfiles% \WINNT\ \winnt\ \WINDOWS\ \windows\ \SYSTEM32\ \system32\ \SYSTEM\ \system\ \SYSTEMROOT\ \systemroot\ \SystemRoot\ Microsoft Windows ME Microsoft Windows 98 Microsoft Windows 95 Microsoft Windows 2000 Microsoft Windows XP Home-Basic-Edition Home-Premium-Edition Home_Edition Home_Server WinNT WIN32_NT WIN_2008R2 WIN_7 WIN_2008 WIN_VISTA WIN_2003 WIN_XPe WIN_XP WIN_2000 Web_Server_Edition Standard_Edition_core_installation Standard_Edition Small_Business_Server_Premium_Edition Small_Business_Server Enterprise_Edition_for_ItaniumBased_System Enterprise_Edition_core_installation Datacenter_Edition_core_installation Datacenter_Edition Cluster_Server_Edition Starter_Edition Business_Edition Enterprise_Edition Home_Basic_Edition Home_Premium_Edition Ultimate_Edition Server2008R2 Seven Server2008 Win8 WinServer2012 Win7 WinServer2008R2 WinServer2008 Vista WinHomeServer WinServer2003R2 WinServer2003 WinXP64 WinXP Win2K Windows Me Windows 98 Windows 95 Windows NT Windows Vista Windows 7 Windows 8 Windows 8.1 Windows NT 3.51 Windows NT 4.0 Windows Server Windows Server 2012 R2 Windows 10 Microsoft Windows NT 3.51 Server 4.0 Server 4.0, Enterprise Edition Microsoft Windows NT 4.0 Server Web Edition Enterprise Edition Datacenter Edition Windows Server 2016 Technical Preview Ultimate Edition Home Premium Edition Home Basic Edition Enterprise Edition Business Edition Starter Edition Cluster Server Edition Datacenter Edition Datacenter Edition (core installation) Enterprise Edition (core installation) Enterprise Edition for Itanium-based Systems Small Business Server Small Business Server Premium Edition Standard Edition Standard Edition (core installation) Web Server Edition Professional Edition Windows Server 2003 Windows Server 2003 R2 Windows Storage Server 2003 Windows XP Windows XP Professional x64 Edition Windows XP Professional x64 Datacenter Edition for Itanium-based Systems Datacenter x64 Edition Enterprise x64 Edition Standard x64 Edition Compute Cluster Edition Web Edition Home Edition Professional Windows 2000 Datacenter Server Advanced Server Windows Home Server Windows Server 2008 Windows Server 2008 R2 Windows Server R2 Media Center Edition Tablet PC Edition Embedded Edition Professional x64 Edition Storage Server 2003 R2 Storage Server 2003 Server 2003 R2 Server 2003 Server 2008 Business Business N Datacenter Edition(Core) Enterprise N Enterprise Edition(Core) Home Basic Home Basic N Home Premium Home Premium N Ultimate Ultimate N Standard Edition(Core) NT3.1 NT3.5 NT3.51 2000 2003 Server 2008 Server Win Vista Win Srv 2008 Win 7 Win 8 Windows+8.1 Win Srv 2003 Win Srv Win XP Windows+XP Windows XP (5.1) Win 2000 Windows Server 2012 32-bit Edition 64-bit Edition Windows Server 2000 2003 2008 Windows Server 2000 Windows+8 Windows+7 Windows+Vista Windows+Server+2003 Windows+2000 Windows 2000 (5.0) Windows 7 (6.1) Windows Server 2003 (5.2) Windows Server 2003 R2 (5.2) Windows Server 2008 (6.0) Windows Server 2008 R2 (6.1) Windows Vista (6.0) 76487-640-1457236-23837 76487-337-8429955-22614 76487-644-3177037-23510 76487-640-8834005-23195 76487-640-0716662-23535 76487-644-8648466-23106 76487-341-5883812-22420 76487-OEM-0027453-63796 76497-640-6308873-23835 55274-640-2673064-23950 00426-293-8170032-85146 S-1-0 S-1-0-0 S-1-1 S-1-1-0 S-1-2 S-1-2-0 S-1-2-1 S-1-3 S-1-3-0 S-1-3-1 S-1-3-2 S-1-3-3 S-1-3-4 S-1-4 S-1-5 S-1-5-1 S-1-5-2 S-1-5-3 S-1-5-4 S-1-5-6 S-1-5-7 S-1-5-8 S-1-5-9 S-1-5-10 S-1-5-11 S-1-5-114 S-1-5-12 S-1-5-13 S-1-5-14 S-1-5-15 S-1-5-17 S-1-5-18 S-1-5-19 S-1-5-20 S-1-5-21 S-1-5-32-544 S-1-5-32-545 S-1-5-32-546 S-1-5-32-547 S-1-5-32-548 S-1-5-32-549 S-1-5-32-550 S-1-5-32-551 S-1-5-32-552 S-1-5-64-10 S-1-5-64-14 S-1-5-64-21 S-1-5-80 S-1-5-83-0 S-1-16-0 S-1-16-4096 S-1-16-8192 S-1-16-8448 S-1-16-12288 S-1-16-16384 S-1-16-20480 S-1-16-28672 S-1-5-32-554 S-1-5-32-555 S-1-5-32-556 S-1-5-32-557 S-1-5-32-558 S-1-5-32-559 S-1-5-32-560 S-1-5-32-561 S-1-5-32-562 S-1-5-32-569 S-1-5-32-573 S-1-5-32-574 S-1-5-32-575 S-1-5-32-576 S-1-5-32-577 S-1-5-32-578 S-1-5-32-579 S-1-5-32-580 AutoOpen SummaryInformation Macros Enable Content Root Entry Please Enable Content* to see this document. DocumentSummaryInformation PROJECT.THISDOCUMENT.AUTOOPEN Microsoft Office at add atbroker appvlp aplib AutoHotkeys bash bochs bginfo arp attrib autorun autodelete bitlocker bitsadmin bcdedit cd cdb csi cmd chmod chdir crss CreateObject Compressed by jpeg-recompress call cscript calc cacls connect ctfmon certutil control cmstp copy create Confuser ConfuserEx cuckoo chrome dfsvc diskpart download diskshadow dsquery dump dnx del delete deflate Decrypt dir date dbgview echo extrac32 exec execute expand explorer encrypt extract filemon ftp findstr forfiles if not exist ipconfig fsutil goto get gcc grub gzip gwmi hh handle hostname ieexec ie4unit installutil iex iexplorer icacls Install InstallService javascript JScript kill Killing killkill iexplore inflate logonui logon load launch listdlls [LordPE] LordPE lsadump lsass lsasrv lzo msxsl makecab mavinject msdt makedir mstsc msiexec NSIS NetMon NullsoftInst mimikatz mkdir mshta msbuild mountvol net netsh nbtstat netstat nltest nslookup open odbcconf OleRun ps pcalua powershell print post pop3 ping pslist psexec psexesvc ProcessHacker pause procexp process procexpl procmon program putty plink qemu reg regasm regsvc regsvr32 reghide rdpclip rmdir ReflectiveLoader reg regasm regsvcs release replace runscripthelper run runas runonce rundLL rundll32 RunHTMLApplication route regedit regedt32 regmon resume sc set sed sfc secedit sdelete sdelete64 shell shred sqlite3 scriptrunner sysinternals smss SMTP sfxzip socks shch setup skype search ScriptingEngine schtasks ExecQuery symerr svchost spoolsvc select send service services sysrep shutdown start shellcode stop systeminfo sqldumper sqlps tcpview telnet time tor tracert taskkill tskill tasklist te tracker unzip urlmon taskmgr Task Scheduler update upload URLencode UPX0 UPX1 UCL data compression library. ver vbox vba6 vba7 vmware vbscript vssadmin virtualBox wevtutil whoami whois wbadmin winftp winrar wine winDir winword wmic wscript winlogon wireshark wget write wmi wmic wusa wer wil wscript.shell xwizard WebBrowserPassView xcopy xcals xmrig aPLib v1.01 - the smaller the better :) Safengine Shielden v2.3.0.0 (Ctrl+ (Alt+ [shift+ [Ctrl+ [Alt+ Alt+ Alt+Ctrl+End Alt+Ctrl+Home Alt+End Alt+F10 Alt+F11 Alt+F12 Alt+F4 Alt+F5 Alt+F7 Alt+F8 Alt+F9 Alt+G Alt+Home Alt+K Alt+Shift+C Alt+Z Left Windows Right Windows [Win+ caps lock [CapsLock=off] [CapsLock=on] [At%s+%s] [C%sock=o%s] [Ct%s+%s] [W%s+%s] [LeftWin] [RightWin] [LArrow] [UArrow] [RArrow] [DArrow] [Ctrl+%c] [ESCAPE] [TAB] [DELETE] [CAPS LOCK] [BACKCPACE] [Backspace] [ENTER] [Enter] [Tab] [Arrow Left] [Arrow Up] [Arrow Right] [Arrow Down] [Home] [Page Up] [Page Down] [End] [Break] [Delete] [Insert] [Ent] [Print Screen] [Scroll Lock] [Caps Lock] [Alt] [Esc] [Back Space] [CONTROL] [PUSE] [LEFT] [RIGHT] [UP] [DOWN] [NUM LOCK] [RMOUSE] [LMOUSE] [AltRight] [AltLeft] [CtrlRight] [CtrlLeft] [ShiftRight] [ShiftLeft] [Scroll] [NumLock] [Sleep] [Menu] [WindowsRight] [WindowsLeft] [Suppr] [PrintScreen] [PageDown] [PageUp] [Caps] [Pause] [Ctrl] [Shift] [SHIFT] [Clear] [DownArrow] [RightArrow] [UpArrow] [LeftArrow] [Space] [CapsLock] [ALT-DOWN] [ALT-UP] [APPS] [BACK] [CLR] [CTRL-DOWN] [CTRL-UP] [Ctrl+A] [Ctrl+C] [Ctrl+D] [Ctrl+V] [Ctrl+X] [Ctrl+Z] [DEL] [EXECUTE] [F1] [F2] [F3] [F4] [F5] [F6] [F7] [F8] [F9] [F10] [F11] [F12] [F13] [F14] [F15] [F16] [F17] [F18] [F19] [F20] [F21] [F22] [F23] [F24] ALTDOWN ALTUP SHIFTDOWN SHIFTUP CTRLDOWN CONTROLDOWN CTRLUP CONTROLUP LWINDOWN LWINUP RWINDOWN RWINUP Num 0 Num 1 Num 2 Num 3 Num 4 Num 5 Num 6 Num 7 Num 8 Num 9 Num - Num + Num Del Enter Right Shift Num * Space Scroll Lock Num Enter Right Ctrl Prnt Scrn Right Alt Break Page Up Left Right Down Page Down [Numpad +] [Numpad .] [Numpad /] [Numpad *] [Back Tab] [Copy] [Finish] [Reset] [Play] [Process] [Numpad -] [Zoom] [Accept] [Context Menu] [Mail] [Media] [Left Ctrl] [Left Alt] [Next Track] [Play / Pause] [Previous Track] [Stop] [Mode Change] [Right Ctrl] [Right Alt] [Scrol Lock] [Volume Down] [Volume Mute] [Volume Up] [BK] [INS] [LF] [SCROLLLOCK] [HELP] [BACK_SPACE] [RETURN] [Esc] [TAB] [CAPS LOCK] [SPACE] LBUTTON MBUTTON RBUTTON NUMPAD0 NUMPAD1 NUMPAD2 NUMPAD3 NUMPAD4 NUMPAD5 NUMPAD6 NUMPAD7 NUMPAD8 NUMPAD9 [LEFT_SHIFT] [RIGHT_SHIFT] [LEFT_CONTROL] [RIGHT_CONTROL] [LCONTROL-DOWN] [LCONTROL-UP] [LMENU-DOWN] [LMENU-UP] [LWIN-DOWN] [LWIN-UP] [PGDOWN] [PGUP] [PRINT] [RCONTROL-DOWN] [RCONTROL-UP] [RMENU-DOWN] [RMENU-UP] [RWIN-DOWN] [RWIN-UP] [SELECT] [SEPARATOR] [SNAPSHOT] [PRSC] [PrtSc] [WIN] {CLEAR} {SHIFT} {Pause} {CAPSLOCK} {ESC} {PAGE UP} {PAGE DOWN} {END} {HOME} {LEFT ARROW} {UP ARROW} {RIGHT ARROW} {DOWN ARROW} {SELECT} {PRINT SCREEN} {EXECUTE} {SNAPSHOT} {INS} {DEL} {HELP} {NUM LOCK} {End} (Ctrl + (Alt + {alt} {ctrl} {Tab} {Enter} {Caps} {Del} {Esc} {Up} {Down} {Left} {Right} {PageUp} {PageDown} {Home} {shift} Scroll Num Lock DownArrow RightArrow UpArrow LeftArrow PageDown PageUp CapsLock Ctrl Shift Backspace [lb_down] [rb_down] [backspace_down] [tab_down] [enter_down] !This program cannot be run in DOS mode !This program cannot be run in DOS mode. !That program cannot be run in DOS mode. !This program cannot be run in DOS>mode. !This program requires Microsoft Windows. This program requires Microsoft Windows. !This pxzgrac cannot be run in DOS mode. This program requires Win32 !This pragram cannot be run in DOS mode. !This is a PE dynamic link library !This is a Windows NT character-mode executable !This is a PE executable !This is a Win32 program. Win32 only! !That program cannot be run in DOS made. This program must be run under Win32 This program must be run under Win32. This program must be run under Win64 This program must be run under Win64. ThisprogrammustberununderWin32 !Require Windows Requires Win32 $ !It's .NET EXE$@ !Win32. EXE !Win32 .EXE. !Windows ONLY! Win32 Program! !Windows Program EncryptMessage Decryption $I30 $MFT $MFTMirr $LogFile $Volume $AttrDef $Bitmap $Boot ExecuteFile RunProgram ipv6 ConfusedByAttribute vbHide not a socket not a stream not connected not supported operation in progress operation not supported operation would block prot not supported read only file system resource deadlock would occur result out of range state not recoverable stream timeout text file busy timed out too many files open in system too many symbolic link levels value too large device or resource busy io error no space on device function not supported no lock available not enough memory resource unavailable try again cross device link operation canceled too many files open permission_denied address_in_use address_not_available address_family_not_supported bad_file_descriptor connection_reset destination_address_required bad_address operation_in_progress interrupted invalid_argument too_many_files_open message_size filename_too_long network_down host_unreachable already_connected network_reset network_unreachable not_connected address not available argument list too long argument out of domain bad message connection reset destination address required no_buffer_space no_protocol_option not_a_socket operation_not_supported protocol_not_supported wrong_protocol_type timed_out operation_would_block address family not supported address in use bad allocation connection aborted connection already in progress connection refused host unreachable network down network reset network unreachable owner dead prot error wrong prot type connection already in progress connection aborted connection refused already connected network down network reset not connected zh-CHS ar-SA bg-BG ca-ES zh-TW cs-CZ da-DK de-DE el-GR en-US fi-FI fr-FR he-IL hu-HU is-IS it-IT ja-JP ko-KR nl-NL nb-NO pl-PL pt-BR ro-RO ru-RU hr-HR sk-SK sq-AL sv-SE th-TH tr-TR ur-PK id-ID uk-UA be-BY sl-SI et-EE lv-LV lt-LT fa-IR vi-VN hy-AM az-AZ-Latn eu-ES mk-MK tn-ZA xh-ZA zu-ZA af-ZA ka-GE fo-FO hi-IN mt-MT se-NO ms-MY kk-KZ ky-KG sw-KE uz-UZ-Latn tt-RU bn-IN pa-IN gu-IN ta-IN te-IN kn-IN ml-IN mr-IN sa-IN mn-MN cy-GB gl-ES kok-IN syr-SY div-MV quz-BO ns-ZA mi-NZ ar-IQ zh-CN de-CH en-GB es-MX fr-BE it-CH nl-BE nn-NO pt-PT sr-SP-Latn sv-FI az-AZ-Cyrl se-SE ms-BN uz-UZ-Cyrl quz-EC ar-EG zh-HK de-AT en-AU es-ES fr-CA sr-SP-Cyrl se-FI quz-PE ar-LY zh-SG de-LU en-CA es-GT fr-CH hr-BA smj-NO ar-DZ zh-MO de-LI en-NZ es-CR fr-LU bs-BA-Latn smj-SE ar-MA en-IE es-PA fr-MC sr-BA-Latn sma-NO ar-TN en-ZA es-DO sr-BA-Cyrl sma-SE ar-OM en-JM es-VE sms-FI ar-YE en-CB es-CO smn-FI ar-SY en-BZ es-PE ar-JO en-TT es-AR ar-LB en-ZW es-EC ar-KW en-PH es-CL ar-AE es-UY ar-BH es-PY ar-QA es-BO es-SV es-HN es-NI es-PR zh-CHT af-za ar-ae ar-bh ar-dz ar-eg ar-iq ar-jo ar-kw ar-lb ar-ly ar-ma ar-om ar-qa ar-sy ar-tn ar-ye az-az-cyrl az-az-latn be-by bn-in bs-ba-latn cy-gb de-at de-ch de-li de-lu div-mv en-au en-bz en-ca en-cb en-gb en-ie en-jm en-nz en-ph en-tt en-za en-zw es-ar es-bo es-cl es-co es-cr es-do es-ec es-es es-gt es-hn es-mx es-ni es-pa es-pe es-pr es-py es-sv es-uy es-ve et-ee eu-es fa-ir fo-fo fr-be fr-ca fr-ch fr-lu fr-mc gl-es gu-in hi-in hr-ba hr-hr hy-am id-id it-ch it-it ja-jp ka-ge kk-kz kn-in kok-in ko-kr ky-kg lt-lt lv-lv mi-nz mk-mk ml-in mn-mn mr-in ms-bn ms-my mt-mt nb-no nl-be nl-nl nn-no ns-za pa-in pl-pl pt-br pt-ptv quz-bo quz-ec quz-pe ro-ro ru-ru sa-in se-fi se-no se-se sk-sk sl-si sma-no sma-se smj-no smj-se smn-fi sms-fi sq-al sr-ba-cyrl sr-ba-latn sr-sp-cyrl sr-sp-latn sv-fi sv-se sw-ke syr-sy ta-in te-in th-th tn-za tr-tr tt-ru uk-ua ur-pk uz-uz-cyrl uz-uz-latn vi-vn xh-za zh-cht zh-cn zh-hk zh-mo zh-sg zu-za Panama Luxembourg Costa Rica Switzerland Guatemala Canada Spanish - Modern Sort Australia English Austria German Belgium Mexico Spanish Basque Sweden Swedish Iceland Icelandic France French Finland Finnish Spain Paraguay Uruguay Chile Ecuador Argentina Peru Colombia Venezuela Dominican Republic Spanish - Traditional Sort united-states united-kingdom south-korea south-africa south korea south africa slovak puerto-rico pr-china pr china new-zealand hong-kong holland great britain england czech china britain america swiss DVCLAL BBABORT BBALL BBCANCEL BBCLOSE BBHELP BBIGNORE BBNO BBOK BBRETRY BBYES PREVIEWGLYPH DLGTEMPLATE MAINICON PACKAGEINFO XX-XX-XX-XX December November October September August July June April March February January Saturday Friday Thursday Wednesday Tuesday Monday Sunday SunMonTueWedThuFriSat (null) runtime error Program: LC_TIME LC_NUMERIC LC_MONETARY LC_CTYPE LC_COLLATE LC_ALL api-ms-win-appmodel-runtime-l1-1-1 api-ms-win-core-datetime-l1-1-1 api-ms-win-core-file-l2-1-1 api-ms-win-core-localization-l1-2-1 api-ms-win-core-localization-obsolete-l1-2-0 api-ms-win-core-processthreads-l1-1-2 api-ms-win-core-string-l1-1-0 api-ms-win-core-sysinfo-l1-2-1 api-ms-win-core-winrt-l1-1-0 api-ms-win-core-xstate-l2-1-0 api-ms-win-rtcore-ntuser-window-l1-1-0 api-ms-win-security-systemfunctions-l1-1-0 api-ms-win-core-fibers-l1-1-1 api-ms-win-core-synch-l1-2-0 ext-ms-win-kernel32-package-current-l1-1-0 ext-ms-win-ntuser-dialogbox-l1-1-0 ext-ms-win-ntuser-windowstation-l1-1-0 `placement delete closure' __unaligned __restrict __ptr64 __eabi __clrcall __fastcall __thiscall __stdcall __pascal __cdecl _nextafter _logb frexp fmod _hypot _cabs ldexp modf fabs floor ceil sqrt atan2 atan acos asin tanh cosh sinh log10 HH:mm:ss dddd, MMMM dd, yyyy MM/dd/yy __int128 __int32 __int64 __int16 __w64 __int8 float long short char Program: An application has made an attempt to load the C runtime library incorrectly. bad exception Illegal byte sequence Directory not empty Function not implemented No locks available Filename too long Resource deadlock avoided Result too large Broken pipe Too many links Read-only file system Invalid seek No space left on device File too large Inappropriate I/O control operation Too many open files Too many open files in system Invalid argument Is a directory Not a directory No such device Improper link File exists Resource device Unknown error Bad address Permission denied Not enough space Resource temporarily unavailable No child processes Bad file descriptor Exec format error Arg list too long No such device or address Interrupted function call No such process No such file or directory Operation not permitted No error string too long invalid string position bad locale name ios_base::badbit set ios_base::failbit set ios_base::eofbit set Microsoft Visual C++ Runtime Library CONOUT$ std::nullptr_t JanFebMarAprMayJunJulAugSepOctNovDec R6002\r\n- floating point support not loaded\r\n R6002\r\n- floating point not loaded\r\n R6008\r\n- not enough space for arguments\r\n R6009\r\n- not enough space for environment\r\n program name unknown abnormal program termination\r\n R6010\r\n- abort() has been called\r\n R6016\r\n- not enough space for thread data\r\n R6017\r\n- unexpected multithread lock error\r\n R6018\r\n- unexpected heap error\r\n R6019\r\n- unable to open console device\r\n R6024\r\n- not enough space for _onexit/atexit table\r\n R6025\r\n- pure virtual function call\r\n R6026\r\n- not enough space for stdio initialization\r\n R6027\r\n- not enough space for lowio initialization\r\n R6028\r\n- unable to initialize heap\r\n R6029\r\n- This application cannot run using the active version of the Microsoft .NET Runtime - floating point not loaded R6030\r\n- CRT not initialized\r\n R6031\r\n- Attempt to initialize the CRT more than once. This indicates a bug in your application.\r\n R6032\r\n- not enough space for locale information\r\n R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization R6034\r\nAn application has made an attempt to load the C runtime library incorrectly. R6034\r\n- inconsistent onexit begin-end variables\r\n This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.\r\n This application has requested the Runtime to terminate it in an unusual way. Please contact the application's support team for more information.\r\n Runtime Error! - floating point not loaded Microsoft Visual C++ Runtime Library IsProcessorFeaturePresent TLOSS error\r\n SING error\r\n DOMAIN error\r\n Domain error Unknown exception @Microsoft Visual C++ Runtime Library UTF-8 UTF-16LE UNICODE Runtime Error!\r\nProgram: swedish-finland spanish-venezuela spanish-uruguay spanish-puerto rico spanish-peru spanish-paraguay spanish-panama spanish-nicaragua spanish-modern spanish-mexican spanish-honduras spanish-guatemala spanish-el salvador spanish-ecuador spanish-dominican republic spanish-costa rica spanish-colombia spanish-chile spanish-bolivia spanish-argentina portuguese-brazilian norwegian-nynorsk norwegian-bokmal norwegian italian-swissv irish-english german-swiss german-luxembourgv german-lichtenstein german-austrian french-swiss french-luxembourg french-canadian french-belgian english-usa english-us english-uk english-trinidad y tobago english-south africa english-nzv english-jamaica english-ire english-caribbean english-can english-belize english-aus english-american dutch-belgian chinese-traditional chinese-singapore chinese-simplified chinese-hongkong chinese canadian belgian australian american-englishv american englishv american american english american-english english-nz german-luxembourg italian-swiss Norwegian-Nynorsk Sunday Monday Tuesday Wednesday Thursday Friday Saturday January February March April June July August September October November December ABCDEFGHIJKLMNOPQRSTUVWXYZ operator `omni callsig' delete[] new[] `local vftable constructor closure' `local vftable' `RTTI `udt returning' `copy constructor closure' `eh vector vbase constructor iterator' `eh vector destructor iterator' `eh vector constructor iterator' `virtual displacement map' `vector vbase constructor iterator' `vector destructor iterator' `vector constructor iterator' `scalar deleting destructor' `default constructor closure' `vector deleting destructor' `vbase destructor' `string' `local static guard' `typeof' `vcall' `vbtable' `vftable' unsigned long int short char void NULL void union struct class enum coclass cointerface virtual static BUTTON COMBOBOX SYSTREEVIEW32 RICHEDIT20W MSCTLS_PROGRESS32 SYSLISTVIEW32 EDIT signed double bool generic iostream iostream stream error CorExitProcess EncodePointer DecodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc delete new __GLOBAL_HEAP_SELECTED __MSVCRT_HEAP_SELECT startup inflate \\.\SICE \\.\REGSYS \\.\REGVXG \\.\FILEVXG \\.\FILEM MSXML2.ServerXMLHTTP$ webcam Program Files (x86) PROCEXPLORER MSScriptControl.ScriptControl.1 Embedded Control OCXNAME Mr.Black WinZip Self-Extractor - Password This self-extracting Zip file is password protected. Windows Installer XML (3.0.5419.0) Your personal files are encrypted! !!!Rescue your files!!! Now you have the last chance to decrypt your files. Any attempt to remove or corrupt this software will result in immediate elimination of the private key by the server. Your decryption price will Everything is fine now decrypting all files. All files Decrypted Enter Decrypt Key WScript.Shell Shell.Execute System Volume Information Boot _ReflectiveLoader@0 _ReflectiveLoader@4 unsigned long __stdcall ReflectiveLoader(void *) Registry CreateSubKey Copyright (c) 1998-2009 by Joergen Ibsen All Rights Reserved. "Powered by SmartAssembly 6.8.0.121 !Powered by SmartAssembly 6.6.1.44 $Info: This file is packed with the UPX executable packer http://upx.sf.net $ $Id: UPX 3.91 Copyright (C) 1996-2013 the UPX Team. All Rights Reserved. $ Microsoft Application Compatibility Toolkit 5.6 File manager System Manager Screen Capture Webcam Capture Packet Sniffer Listen Background \\.\mailslot\%s dbgeng Network Performance and Security Manager ProxyEnable ProxyServer ProxyOverride ProxyUserName ProxyPassword SkpWnd SkypeControlAPIAttach SkypeControlAPIDiscover Skype:API AdministratorsGroup NtAuthority masterkey IEHistory ServiceMain SetRequestHeader PR_Bind PR_Accept PR_AcceptRead PR_Connect PR_Listen PR_Write PR_Writev PR_Close PR_Send PR_TransmitFile PR_OpenTCPSocket PR_GetSocketOption PR_SetSocketOption PR_Shutdown PR_GetError PR_SetError PR_GetNameForIdentity WH_CALLWNDPROC WH_CALLWNDPROCRET WH_CBT WH_DEBUG WH_FOREGROUNDIDLE WH_GETMESSAGE WH_JOURNALPLAYBACK WH_JOURNALRECORD WH_KEYBOARD_LL WH_KEYBOARD WH_MOUSE_LL WH_MOUSE WH_MSGFILTER WH_SYSMSGFILTER WH_SHELL wininet Start scanner Scanner completed Start crypter Files encrypted MemoryScanner ActiveX Control \\.\PhysicalDrive%d Microsoft Windows Auto Update IsAdmin CryptKeyType CryptKeyId NetAdapter Gateway DHCPServer DnsServer Microsoft Enhanced Cryptographic Provider v1.0 Microsoft Strong Cryptographic Provider Microsoft Base Cryptographic Provider v1.0 Microsoft Enhanced RSA and AES Cryptographic Provider Intel Hardware Cryptographic Service Provider Microsoft Unified Security Protocol Provider Encryptioninfo EncryptedPackage StrongEncryptionDataSpace StrongEncryptionTransform vm_protect %BOTID% %BOTNET% FtpServer FtpUserName FtpPassword FtpDirectory RootDirectory Port SafeBox MinDump QEMU FromBase64String ToBase64String HttpDownload HttpResponse HttpRequest ProcessRequest HttpContext DownloadString Invoke DynamicRun InvokeV CallMethod CallMethodV RunNewApp RegisterServiceProcess RegWrite RegDelete RegRead CallByName PaySafeCard InjectByPid sendkeys opencmd VendorIdentifier SystemBiosVersion SystemBiosDate VideoBiosVersion VideoBiosDate Windows File Protection LogonFailure killthread startkeylogger stopkeylogger listprocesses killprocess stopspy PopServer PopPort PopAccount PopPassword SmtpServer SmtpPort SmtpAccount SmtpPassword WininetCacheCredentials PasswordType OutpostMonitor DisableAllPrivileges SetPrivilege Download.Complete Download.Cancelled Download.Failed ClearBrowsingHistoryOnExit GetMACAddress GetProcessesByName WebRequest WebResponse GetResponse GetVolumeSerial ENCRYPtSTRING ENCRYPTBYTe VBRUN Blowfish CreateDecryptor MD5CryptoServiceProvider TripleDESCryptoServiceProvider PaddingMode iexplorer ExecuteCommand RunPE CCleaner Binder SpyTheSpy TCPEye SpeedGear IPBlocker procexp Payment ok Payment Received. Proceed to decryption. Waiting Payment Waiting TOR Connection TorLocker TorLocker_v0.9.3 Wallpaper kippohome huffman DecodeHuffman Inflate ZipAndEncrypt ZipAndAES LoadFile SafenSoft SysWatch McAfee Security Center Protection Norton PONG! ReadPort WritePort cookie_module CompressAndSend EncryptFile RunAsShellUser SVNCStartServer Terminal Server Enterprise LanmanNT CONNECTED SENDME RESOLVE CWSandbox AVAST Software redirects httpinjects modify coin-miner urlmon inhibitPolicyMapping infinite relativename LanmanWorkstation LanmanServer Seed prot testing experience Destroy payload Shell.Application UltraVnc UltraVncSC RunProgram Macromedia FlashPlayer NetworkService\Cookies\ server CONNECT Launcher remote random inject hook crack script Clipboard Privilege Reboot CabinetFile cabfile Socket Console shell reverse HookProc attempt drop Download Upload CONNECT petite .petite deflate Referer WinSta0 Gh0st sharedaccess localgroup administrators Administrator nsocket webkit sandbox keystroke scanning Callback torrent downspeed webseeds POST WinHttpClient fingerprint subscribe announce payload tracker watchdog HHA Version 4.74.8702 PrepareOurShit Exefiles Scanning NullsoftInst WinRAR SFX \\cryptme\\ Expires Cookie Windows Update Service serialNumber userPassword serial encryption PECompact2 logFile application/pdf Run as a daemon serverTimeout Server closed connection nameserver OLLYDBG BankID WebBrowser Logout downloader browser Downloader Shell pidrun geturl likubes Sitikat Reply from downfile quitz debugmessage debugclient debugfile POST CONNECT NetSubKey AckPacket Connection autoRunKeyPath SIGNATURE messageId HeartBeat Request Unload RequestLoop HeartBeatLoop TcpClient NetworkStream CreateDomain ComputeHash PROCMON_WINDOW_CLASS WdcWindow Dumper64 APISpy32Class TokenPrivilege WebKit2WebProcess Rijndael SystemBiosVersion VideoBiosVersion Identifier plugins clientkey rpcsrv Engine started Running in background \DosDevices\DKOM_Driver \Device\DKOM_Driver Process successfully hidden. RegSAM DownloadUrl QueueDownloader ZipManager ZipStorer webBrowser1 Monetizer amonetize Couponserver IexplorerMinVersion IsControlled Microsoft Network Monitoring Service Host Process for Windows Services MsNetMonitor Windows Filter Driver IsUserAdministrator NotifyDownloading CheckAdminPrivileges TrackOnDefaultBrowser GetDomain checkdomain bytesDownloaded God Mode logger Hook cleaning on PiD obfuscation on Code injection successful! Code injection failed! Injecting code ... Code Injection Keylogging disabled. DisallowRun NoDriveTypeAutoRun LZO real-time data compression library. CryptoLibV2_freeBuffer CryptoLibV2_getRandom fileupload All the important files on your computer were encrypted. All the important files on your disks were encrypted. Schedule service command line interface Resistance is futile Anti-debug Detoured Client hook allocation failure. silentpostback AlreadyRunning keeplog StubRun StubExtract VBoxGuest Betabot Hashtable Monitor RegServer HTTPMail User Name 2004 2005 Pierre le Riche / Professional Software Development ActiveOfflineKeylogger ActiveOnlineKeyStrokes ActiveOnlineKeylogger AntiVirusDisableNotify BTMemoryLoadLibary: Cant attach library DownloadFail DownloadSuccess Progman UPLOADEXEC UPLOADFILE UnActiveOfflineKeylogger UnActiveOnlineKeyStrokes UnBlockContact Video Capture WEBCAMLIVE WEBCAMSTOP wscsvc httpstop logstop ftfpstop procsstop securestop reconnect disconnect botid flusharp flushdns crash killthreads killproc killid Kennwort Object dump complete. Ping flood ROOTED Rebooting system Reconnecting Referer: %s Remote Command Prompt Removing Bot [DDoS] [KEYLOG]: %s [PSNIFF] [PING] [TFTP] [UPD] administrador administrat administrateur Download complete ALIEN-Z \Google\Chrome\User Data VncSrvWndProc VncStopServer VncStartServer VNCCreateServer VNCServerThread VNCStartServer FPUMaskValue PhysicalDrive0 Protection Error LOADER ERROR Host is down. No route to host. debugger emulat GetProcesses MemoryStream GZipStream 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz+/ putfile: getfile: source Connecting Downloading Connecting Reconnect Pause Transfer Error Connection Error OpenRequest Error SendRequest Error Request Error Server Error Redirection Delete NoRemove ForceRemove Keylogger crypter NetKeyLogger pipeline miner Download ERROR Execute ERROR webBrowser2 IEFrame master mysql daemon backup marta redhat exploitable passwd proxypasswd proxyuser Login denied Remote file not found RenameFile RunPrompt RunSelectedAsAdmin RunSelectedHidden RunSelectedShow RemoteMachineName AheadLib web-browser SetHook TMemoryScanner Protect SecurityAnonymous SecurityIdentification SecurityImpersonation SecurityDelegation WebServices DownloadData \\.\PhysicalDrive0 windowsupdate wilderssecurity castlecops spamhaus cpsecure arcabit emsisoft sunbelt securecomputing computerassociates networkassociates etrust rootkit spyware vmdebug VMware Replay Debugging Helper VMware VMCI Bus Driver vmci VMware Pointing Device vmmouse msvmmouf MS Virtual SCSI Disk Device VMware Workstation v10 VMwareDragDetWndClass VMwareSwitchUserControlClass VMware VMware Pointing VMware server memory VMware Replay AntiVirtualBox AntiVmWare AntiVirtualPC AntiMalwarebytes AntiOllydbg AntiWireshark antiSpyware Anti-Virus avast! AntiVir Malware Norton Personal Firewall ZoneAlarm Comodo Firewall eTrust EZ Firewall F-Secure Internet Security McAfee Personal Firewall Outpost Personal Firewall Panda Internet Seciruty Suite Panda Anti-Virus/Firewall BitDefnder/Bull Guard Antivirus Rising Firewall 360Safe AntiArp Kingsoft Safe Fiddler wireshark Chromium SCREENSHOT RunProgram PendingFileRenameOperations InstallHOOK InstallLocalHOOK UninstallHOOK ZLibEx Xenocode Virtual Desktop Spoon Virtual Machine Xenocode Virtual Appliance Runtime CPlApplet VMProtect begin VMProtect end NETWORK SERVICE Administrative Tools CREATE_SUSPENDED VBScript.Encode JScript.Encode ExeScriptPAD ExeScript ExeScript Host Godmode DECOMPRESSOR antivirus AntivirusProduct DefaultBrowser MemoryProtection BaseScript Updater IDetourHook DetourHook CaptureScreen Shell_TrayWnd IEpasswords ServiceName DisplayName ScriptingEngine ProbeScriptFint ActiveScriptEventConsumer root/cimv2 WbemScripting.SWbemLocator ROOT\CIMV2 SELECT * from Win32_BaseBoard Manufacturer SerialNumber ChassisTypes SMBIOSAssetTag WMIHelper WM_HTML_GETOBJECT WM_COPYDATA SE_PRIVILEGE_ENABLED_BY_DEFAULT SE_PRIVILEGE_ENABLED SE_PRIVILEGE_REMOVED SE_PRIVILEGE_USED_FOR_ACCESS SE_PRIVILEGE_VALID_ATTRIBUTES SE_CREATE_TOKEN_NAME SE_ASSIGNPRIMARYTOKEN_NAME SE_LOCK_MEMORY_NAME SE_INCREASE_QUOTA_NAME SE_UNSOLICITED_INPUT_NAME SE_MACHINE_ACCOUNT_NAME SE_TCB_NAME SE_SECURITY_NAME SE_TAKE_OWNERSHIP_NAME SE_LOAD_DRIVER_NAME SE_SYSTEM_PROFILE_NAME SE_SYSTEMTIME_NAME SE_PROF_SINGLE_PROCESS_NAME SE_INC_BASE_PRIORITY_NAME SE_CREATE_PAGEFILE_NAME SE_CREATE_PERMANENT_NAME SE_BACKUP_NAME SE_RESTORE_NAME SE_SHUTDOWN_NAME SE_DEBUG_NAME SE_AUDIT_NAME SE_SYSTEM_ENVIRONMENT_NAME SE_CHANGE_NOTIFY_NAME SE_REMOTE_SHUTDOWN_NAME SE_UNDOCK_NAME SE_SYNC_AGENT_NAME SE_ENABLE_DELEGATION_NAME SE_MANAGE_VOLUME_NAME SE_IMPERSONATE_NAME SE_CREATE_GLOBAL_NAME SE_TRUSTED_CREDMAN_ACCESS_NAME SE_RELABEL_NAME SE_INC_WORKING_SET_NAME SE_TIME_ZONE_NAME SE_CREATE_SYMBOLIC_LINK_NAME SE_GROUP_ENABLED_BY_DEFAULT SE_GROUP_ENABLED SE_GROUP_OWNER SE_GROUP_USE_FOR_DENY_ONLY SE_GROUP_INTEGRITY SE_GROUP_INTEGRITY_ENABLED SE_GROUP_LOGON_ID SE_GROUP_RESOURCE SE_GROUP_VALID_ATTRIBUTES vbscript execScript CipherMode Twofish Referer: Microsoft\Windows\Start Menu Microsoft\Windows\Start Menu\Programs Microsoft\Windows\Templates Pictures Public\Desktop Public\Documents Public\Favorites Public\Music Public\Pictures Public\Videos Windows NT\Accessories Explorer\Shell Folders WRITE_REGISTER_USHORT READ_REGISTER_USHORT WRITE_REGISTER_UCHAR READ_REGISTER_UCHAR READ_REGISTER_ULONG WRITE_REGISTER_ULONG /AutoIt3ExecuteLine /AutoIt3ExecuteScript AutoIt v3 AutoIt AUTOIT SCRIPT AUTOIT NO CMDEXECUTE AutoIt3ExecuteScript AutoIt3ExecuteLine Software\AutoIt v3\AutoIt AutoIt Error CompiledScript AutoIt v3 Script: 3 3 8 1 AutoIt v3 Script: 3 3 8 0 AutoIt3 AUTOITEXE DecryptByte DecryptBlock Yoda's Protector Beds-Protector Beds-Protector-v7.0 ENIGMA Enigma Protector UpackByDwing@ GDIScreenshot